source/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                       1998.
   7  *  Copyright (C) Jeremy Allison                    1999.
   8  *  Copyright (C) Andrew Bartlett                   2003.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 #include "includes.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_RPC_CLI
  29
  30 extern struct pipe_id_info pipe_names[];
  31
  32 /* convert pipe auth flags into the RPC auth type and level */
  33
  34 void get_auth_type_level(int pipe_auth_flags, int *auth_type, int *auth_level)
  35 {
  36         *auth_type = 0;
  37         *auth_level = 0;
  38         if (pipe_auth_flags & AUTH_PIPE_SEAL) {
  39                 *auth_level = RPC_PIPE_AUTH_SEAL_LEVEL;
  40         } else if (pipe_auth_flags & AUTH_PIPE_SIGN) {
  41                 *auth_level = RPC_PIPE_AUTH_SIGN_LEVEL;
  42         }
  43
  44         if (pipe_auth_flags & AUTH_PIPE_NETSEC) {
  45                 *auth_type = NETSEC_AUTH_TYPE;
  46         } else if (pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
  47                 *auth_type = NTLMSSP_AUTH_TYPE;
  48         }
  49 }
  50
  51 /********************************************************************
  52  Rpc pipe call id.
  53  ********************************************************************/
  54
  55 static uint32 get_rpc_call_id(void)
  56 {
  57         static uint32 call_id = 0;
  58         return ++call_id;
  59 }
  60
  61 /*******************************************************************
  62  Use SMBreadX to get rest of one fragment's worth of rpc data.
  63  ********************************************************************/
  64
  65 static BOOL rpc_read(struct cli_state *cli, prs_struct *rdata, uint32 data_to_read, uint32 *rdata_offset)
  66 {
  67         size_t size = (size_t)cli->max_recv_frag;
  68         int stream_offset = 0;
  69         int num_read;
  70         char *pdata;
  71         int extra_data_size = ((int)*rdata_offset) + ((int)data_to_read) - (int)prs_data_size(rdata);
  72
  73         DEBUG(5,("rpc_read: data_to_read: %u rdata offset: %u extra_data_size: %d\n",
  74                 (int)data_to_read, (unsigned int)*rdata_offset, extra_data_size));
  75
  76         /*
  77          * Grow the buffer if needed to accommodate the data to be read.
  78          */
  79
  80         if (extra_data_size > 0) {
  81                 if(!prs_force_grow(rdata, (uint32)extra_data_size)) {
  82                         DEBUG(0,("rpc_read: Failed to grow parse struct by %d bytes.\n", extra_data_size ));
  83                         return False;
  84                 }
  85                 DEBUG(5,("rpc_read: grew buffer by %d bytes to %u\n", extra_data_size, prs_data_size(rdata) ));
  86         }
  87
  88         pdata = prs_data_p(rdata) + *rdata_offset;
  89
  90         do /* read data using SMBreadX */
  91         {
  92                 uint32 ecode;
  93                 uint8 eclass;
  94
  95                 if (size > (size_t)data_to_read)
  96                         size = (size_t)data_to_read;
  97
  98                 num_read = (int)cli_read(cli, cli->nt_pipe_fnum, pdata, (off_t)stream_offset, size);
  99
 100                 DEBUG(5,("rpc_read: num_read = %d, read offset: %d, to read: %d\n",
 101                           num_read, stream_offset, data_to_read));
 102
 103                 if (cli_is_dos_error(cli)) {
 104                         cli_dos_error(cli, &eclass, &ecode);
 105                         if (eclass != ERRDOS && ecode != ERRmoredata) {
 106                                 DEBUG(0,("rpc_read: Error %d/%u in cli_read\n",
 107                                          eclass, (unsigned int)ecode));
 108                                 return False;
 109                         }
 110                 }
 111
 112                 data_to_read -= num_read;
 113                 stream_offset += num_read;
 114                 pdata += num_read;
 115
 116         } while (num_read > 0 && data_to_read > 0);
 117         /* && err == (0x80000000 | STATUS_BUFFER_OVERFLOW)); */
 118
 119         /*
 120          * Update the current offset into rdata by the amount read.
 121          */
 122         *rdata_offset += stream_offset;
 123
 124         return True;
 125 }
 126
 127 /****************************************************************************
 128  Checks the header. This will set the endian bit in the rdata prs_struct. JRA.
 129  ****************************************************************************/
 130
 131 static BOOL rpc_check_hdr(prs_struct *rdata, RPC_HDR *rhdr,
 132                           BOOL *first, BOOL *last, uint32 *len)
 133 {
 134         DEBUG(5,("rpc_check_hdr: rdata->data_size = %u\n", (uint32)prs_data_size(rdata) ));
 135
 136         /* Next call sets endian bit. */
 137
 138         if(!smb_io_rpc_hdr("rpc_hdr   ", rhdr, rdata, 0)) {
 139                 DEBUG(0,("rpc_check_hdr: Failed to unmarshall RPC_HDR.\n"));
 140                 return False;
 141         }
 142
 143         if (prs_offset(rdata) != RPC_HEADER_LEN) {
 144                 DEBUG(0,("rpc_check_hdr: offset was %x, should be %x.\n", prs_offset(rdata), RPC_HEADER_LEN));
 145                 return False;
 146         }
 147
 148         (*first) = ((rhdr->flags & RPC_FLG_FIRST) != 0);
 149         (*last) = ((rhdr->flags & RPC_FLG_LAST ) != 0);
 150         (*len) = (uint32)rhdr->frag_len - prs_data_size(rdata);
 151
 152         return (rhdr->pkt_type != RPC_FAULT);
 153 }
 154
 155 /****************************************************************************
 156  Verify data on an rpc pipe.
 157  The VERIFY & SEAL code is only executed on packets that look like this :
 158
 159  Request/Response PDU's look like the following...
 160
 161  |<------------------PDU len----------------------------------------------->|
 162  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 163
 164  +------------+-----------------+-------------+---------------+-------------+
 165  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 166  +------------+-----------------+-------------+---------------+-------------+
 167
 168  Never on bind requests/responses.
 169  ****************************************************************************/
 170
 171 static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata,
 172                           uint32 fragment_start, int len, int auth_len, uint8 pkt_type,
 173                           int *pauth_padding_len)
 174 {
 175
 176         /*
 177          * The following is that length of the data we must sign or seal.
 178          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
 179          * preceeding the auth_data.
 180          */
 181
 182         int data_len = len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 183
 184         /*
 185          * The start of the data to sign/seal is just after the RPC headers.
 186          */
 187         char *reply_data = prs_data_p(rdata) + fragment_start + RPC_HEADER_LEN + RPC_HDR_REQ_LEN;
 188
 189         RPC_HDR_AUTH rhdr_auth;
 190
 191         char *dp = prs_data_p(rdata) + fragment_start + len -
 192                 RPC_HDR_AUTH_LEN - auth_len;
 193         prs_struct auth_verf;
 194
 195         *pauth_padding_len = 0;
 196
 197         if (auth_len == 0) {
 198                 if (cli->pipe_auth_flags == 0) {
 199                         /* move along, nothing to see here */
 200                         return True;
 201                 }
 202
 203                 DEBUG(2, ("No authenticaton header recienved on reply, but this pipe is authenticated\n"));
 204                 return False;
 205         }
 206
 207         DEBUG(5,("rpc_auth_pipe: pkt_type: %d len: %d auth_len: %d NTLMSSP %s schannel %s sign %s seal %s \n",
 208                  pkt_type, len, auth_len,
 209                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP),
 210                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_NETSEC),
 211                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_SIGN),
 212                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_SEAL)));
 213
 214         if (dp - prs_data_p(rdata) > prs_data_size(rdata)) {
 215                 DEBUG(0,("rpc_auth_pipe: schannel auth data > data size !\n"));
 216                 return False;
 217         }
 218
 219         DEBUG(10,("rpc_auth_pipe: packet:\n"));
 220         dump_data(100, dp, auth_len);
 221
 222         prs_init(&auth_verf, 0, cli->mem_ctx, UNMARSHALL);
 223
 224         /* The endinness must be preserved. JRA. */
 225         prs_set_endian_data( &auth_verf, rdata->bigendian_data);
 226
 227         /* Point this new parse struct at the auth section of the main
 228            parse struct - rather than copying it.  Avoids needing to
 229            free it on every error
 230         */
 231         prs_give_memory(&auth_verf, dp, RPC_HDR_AUTH_LEN + auth_len, False /* not dynamic */);
 232         prs_set_offset(&auth_verf, 0);
 233
 234         {
 235                 int auth_type;
 236                 int auth_level;
 237                 if (!smb_io_rpc_hdr_auth("auth_hdr", &rhdr_auth, &auth_verf, 0)) {
 238                         DEBUG(0, ("rpc_auth_pipe: Could not parse auth header\n"));
 239                         return False;
 240                 }
 241
 242                 /* Let the caller know how much padding at the end of the data */
 243                 *pauth_padding_len = rhdr_auth.padding;
 244
 245                 /* Check it's the type of reply we were expecting to decode */
 246
 247                 get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 248                 if (rhdr_auth.auth_type != auth_type) {
 249                         DEBUG(0, ("BAD auth type %d (should be %d)\n",
 250                                   rhdr_auth.auth_type, auth_type));
 251                         return False;
 252                 }
 253
 254                 if (rhdr_auth.auth_level != auth_level) {
 255                         DEBUG(0, ("BAD auth level %d (should be %d)\n",
 256                                   rhdr_auth.auth_level, auth_level));
 257                         return False;
 258                 }
 259         }
 260
 261         if (pkt_type == RPC_BINDACK) {
 262                 if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 263                         /* copy the next auth_len bytes into a buffer for
 264                            later use */
 265
 266                         DATA_BLOB ntlmssp_verf = data_blob(NULL, auth_len);
 267
 268                         /* save the reply away, for use a little later */
 269                         prs_copy_data_out((char *)ntlmssp_verf.data, &auth_verf, auth_len);
 270
 271
 272                         return (NT_STATUS_IS_OK(ntlmssp_client_store_response(cli->ntlmssp_pipe_state,
 273                                                                               ntlmssp_verf)));
 274                 }
 275                 else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 276                         /* nothing to do here - we don't seem to be able to
 277                            validate the bindack based on VL's comments */
 278                         return True;
 279                 }
 280         }
 281
 282         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 283                 NTSTATUS nt_status;
 284                 DATA_BLOB sig;
 285                 if ((cli->pipe_auth_flags & AUTH_PIPE_SIGN) ||
 286                     (cli->pipe_auth_flags & AUTH_PIPE_SEAL)) {
 287                         if (auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) {
 288                                 DEBUG(0,("rpc_auth_pipe: wrong ntlmssp auth len %d\n", auth_len));
 289                                 return False;
 290                         }
 291                         sig = data_blob(NULL, auth_len);
 292                         prs_copy_data_out((char *)sig.data, &auth_verf, auth_len);
 293                 }
 294
 295                 /*
 296                  * Unseal any sealed data in the PDU, not including the
 297                  * 8 byte auth_header or the auth_data.
 298                  */
 299
 300                 /*
 301                  * Now unseal and check the auth verifier in the auth_data at
 302                  * the end of the packet.
 303                  */
 304
 305                 if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) {
 306                         if (data_len < 0) {
 307                                 DEBUG(1, ("Can't unseal - data_len < 0!!\n"));
 308                                 return False;
 309                         }
 310                         nt_status = ntlmssp_client_unseal_packet(cli->ntlmssp_pipe_state,
 311                                                                  (unsigned char *)reply_data, data_len,
 312                                                                  &sig);
 313                 }
 314                 else if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
 315                         nt_status = ntlmssp_client_check_packet(cli->ntlmssp_pipe_state,
 316                                                                 (const unsigned char *)reply_data, data_len,
 317                                                                 &sig);
 318                 }
 319
 320                 data_blob_free(&sig);
 321
 322                 if (!NT_STATUS_IS_OK(nt_status)) {
 323                         DEBUG(0, ("rpc_auth_pipe: could not validate "
 324                                   "incoming NTLMSSP packet!\n"));
 325                         return False;
 326                 }
 327         }
 328
 329         if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 330                 RPC_AUTH_NETSEC_CHK chk;
 331
 332                 if (auth_len != RPC_AUTH_NETSEC_CHK_LEN) {
 333                         DEBUG(0,("rpc_auth_pipe: wrong schannel auth len %d\n", auth_len));
 334                         return False;
 335                 }
 336
 337                 if (!smb_io_rpc_auth_netsec_chk("schannel_auth_sign",
 338                                                 &chk, &auth_verf, 0)) {
 339                         DEBUG(0, ("rpc_auth_pipe: schannel unmarshalling "
 340                                   "RPC_AUTH_NETSECK_CHK failed\n"));
 341                         return False;
 342                 }
 343
 344                 if (!netsec_decode(&cli->auth_info,
 345                                    cli->pipe_auth_flags,
 346                                    SENDER_IS_ACCEPTOR,
 347                                    &chk, reply_data, data_len)) {
 348                         DEBUG(0, ("rpc_auth_pipe: Could not decode schannel\n"));
 349                         return False;
 350                 }
 351
 352                 cli->auth_info.seq_num++;
 353
 354         }
 355         return True;
 356 }
 357
 358
 359 /****************************************************************************
 360  Send data on an rpc pipe via trans, which *must* be the last fragment.
 361  receive response data from an rpc pipe, which may be large...
 362
 363  Read the first fragment: unfortunately have to use SMBtrans for the first
 364  bit, then SMBreadX for subsequent bits.
 365
 366  If first fragment received also wasn't the last fragment, continue
 367  getting fragments until we _do_ receive the last fragment.
 368
 369  Request/Response PDU's look like the following...
 370
 371  |<------------------PDU len----------------------------------------------->|
 372  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 373
 374  +------------+-----------------+-------------+---------------+-------------+
 375  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 376  +------------+-----------------+-------------+---------------+-------------+
 377
 378  Where the presence of the AUTH_HDR and AUTH are dependent on the
 379  signing & sealing being negotiated.
 380
 381  ****************************************************************************/
 382
 383 static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rdata,
 384                          uint8 expected_pkt_type)
 385 {
 386         uint32 len;
 387         char *rparam = NULL;
 388         uint32 rparam_len = 0;
 389         uint16 setup[2];
 390         BOOL first = True;
 391         BOOL last  = True;
 392         RPC_HDR rhdr;
 393         char *pdata = data ? prs_data_p(data) : NULL;
 394         uint32 data_len = data ? prs_offset(data) : 0;
 395         char *prdata = NULL;
 396         uint32 rdata_len = 0;
 397         uint32 current_offset = 0;
 398         uint32 fragment_start = 0;
 399         uint32 max_data = cli->max_xmit_frag ? cli->max_xmit_frag : 1024;
 400         int auth_padding_len = 0;
 401
 402         /* Create setup parameters - must be in native byte order. */
 403
 404         setup[0] = TRANSACT_DCERPCCMD;
 405         setup[1] = cli->nt_pipe_fnum; /* Pipe file handle. */
 406
 407         DEBUG(5,("rpc_api_pipe: fnum:%x\n", (int)cli->nt_pipe_fnum));
 408
 409         /* Send the RPC request and receive a response.  For short RPC
 410            calls (about 1024 bytes or so) the RPC request and response
 411            appears in a SMBtrans request and response.  Larger RPC
 412            responses are received further on. */
 413
 414         if (!cli_api_pipe(cli, "\\PIPE\\",
 415                   setup, 2, 0,                     /* Setup, length, max */
 416                   NULL, 0, 0,                      /* Params, length, max */
 417                   pdata, data_len, max_data,       /* data, length, max */
 418                   &rparam, &rparam_len,            /* return params, len */
 419                   &prdata, &rdata_len))            /* return data, len */
 420         {
 421                 DEBUG(0, ("cli_pipe: return critical error. Error was %s\n", cli_errstr(cli)));
 422                 return False;
 423         }
 424
 425         /* Throw away returned params - we know we won't use them. */
 426
 427         SAFE_FREE(rparam);
 428
 429         if (prdata == NULL) {
 430                 DEBUG(0,("rpc_api_pipe: pipe %x failed to return data.\n",
 431                         (int)cli->nt_pipe_fnum));
 432                 return False;
 433         }
 434
 435         /*
 436          * Give this memory as dynamically allocated to the return parse
 437          * struct.
 438          */
 439
 440         prs_give_memory(rdata, prdata, rdata_len, True);
 441         current_offset = rdata_len;
 442
 443         /* This next call sets the endian bit correctly in rdata. */
 444
 445         if (!rpc_check_hdr(rdata, &rhdr, &first, &last, &len)) {
 446                 prs_mem_free(rdata);
 447                 return False;
 448         }
 449
 450         if (rhdr.pkt_type == RPC_BINDACK) {
 451                 if (!last && !first) {
 452                         DEBUG(5,("rpc_api_pipe: bug in server (AS/U?), setting fragment first/last ON.\n"));
 453                         first = True;
 454                         last = True;
 455                 }
 456         }
 457
 458         if (rhdr.pkt_type == RPC_BINDNACK) {
 459                 DEBUG(3, ("Bind NACK received on pipe %x!\n", (int)cli->nt_pipe_fnum));
 460                 prs_mem_free(rdata);
 461                 return False;
 462         }
 463
 464         if (rhdr.pkt_type == RPC_RESPONSE) {
 465                 RPC_HDR_RESP rhdr_resp;
 466                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, rdata, 0)) {
 467                         DEBUG(5,("rpc_api_pipe: failed to unmarshal RPC_HDR_RESP.\n"));
 468                         prs_mem_free(rdata);
 469                         return False;
 470                 }
 471         }
 472
 473         if (rhdr.pkt_type != expected_pkt_type) {
 474                 DEBUG(3, ("Connection to pipe %x got an unexpected RPC packet type - %d, not %d\n", (int)cli->nt_pipe_fnum, rhdr.pkt_type, expected_pkt_type));
 475                 prs_mem_free(rdata);
 476                 return False;
 477         }
 478
 479         DEBUG(5,("rpc_api_pipe: len left: %u smbtrans read: %u\n",
 480                   (unsigned int)len, (unsigned int)rdata_len ));
 481
 482         /* check if data to be sent back was too large for one SMBtrans */
 483         /* err status is only informational: the _real_ check is on the
 484            length */
 485
 486         if (len > 0) {
 487                 /* || err == (0x80000000 | STATUS_BUFFER_OVERFLOW)) */
 488
 489                 /* Read the remaining part of the first response fragment */
 490
 491                 if (!rpc_read(cli, rdata, len, &current_offset)) {
 492                         prs_mem_free(rdata);
 493                         return False;
 494                 }
 495         }
 496
 497         /*
 498          * Now we have a complete PDU, check the auth struct if any was sent.
 499          */
 500
 501         if(!rpc_auth_pipe(cli, rdata, fragment_start, rhdr.frag_len,
 502                           rhdr.auth_len, rhdr.pkt_type, &auth_padding_len)) {
 503                 prs_mem_free(rdata);
 504                 return False;
 505         }
 506
 507         if (rhdr.auth_len != 0) {
 508                 /*
 509                  * Drop the auth footers from the current offset.
 510                  * We need this if there are more fragments.
 511                  * The auth footers consist of the auth_data and the
 512                  * preceeding 8 byte auth_header.
 513                  */
 514                 current_offset -= (auth_padding_len + RPC_HDR_AUTH_LEN + rhdr.auth_len);
 515         }
 516
 517         /*
 518          * Only one rpc fragment, and it has been read.
 519          */
 520
 521         if (first && last) {
 522                 DEBUG(6,("rpc_api_pipe: fragment first and last both set\n"));
 523                 return True;
 524         }
 525
 526         /*
 527          * Read more fragments using SMBreadX until we get one with the
 528          * last bit set.
 529          */
 530
 531         while (!last) {
 532                 RPC_HDR_RESP rhdr_resp;
 533                 int num_read;
 534                 char hdr_data[RPC_HEADER_LEN+RPC_HDR_RESP_LEN];
 535                 prs_struct hps;
 536                 uint8 eclass;
 537                 uint32 ecode;
 538
 539                 /*
 540                  * First read the header of the next PDU.
 541                  */
 542
 543                 prs_init(&hps, 0, cli->mem_ctx, UNMARSHALL);
 544                 prs_give_memory(&hps, hdr_data, sizeof(hdr_data), False);
 545
 546                 num_read = cli_read(cli, cli->nt_pipe_fnum, hdr_data, 0, RPC_HEADER_LEN+RPC_HDR_RESP_LEN);
 547                 if (cli_is_dos_error(cli)) {
 548                         cli_dos_error(cli, &eclass, &ecode);
 549                         if (eclass != ERRDOS && ecode != ERRmoredata) {
 550                                 DEBUG(0,("rpc_api_pipe: cli_read error : %d/%d\n", eclass, ecode));
 551                                 return False;
 552                         }
 553                 }
 554
 555                 DEBUG(5,("rpc_api_pipe: read header (size:%d)\n", num_read));
 556
 557                 if (num_read != RPC_HEADER_LEN+RPC_HDR_RESP_LEN) {
 558                         DEBUG(0,("rpc_api_pipe: Error : requested %d bytes, got %d.\n",
 559                                 RPC_HEADER_LEN+RPC_HDR_RESP_LEN, num_read ));
 560                         return False;
 561                 }
 562
 563                 /* This call sets the endianness in hps. */
 564
 565                 if (!rpc_check_hdr(&hps, &rhdr, &first, &last, &len))
 566                         return False;
 567
 568                 /* Ensure the endianness in rdata is set correctly - must be same as hps. */
 569
 570                 if (hps.bigendian_data != rdata->bigendian_data) {
 571                         DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to %s\n",
 572                                 rdata->bigendian_data ? "big" : "little",
 573                                 hps.bigendian_data ? "big" : "little" ));
 574                         return False;
 575                 }
 576
 577                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, &hps, 0)) {
 578                         DEBUG(0,("rpc_api_pipe: Error in unmarshalling RPC_HDR_RESP.\n"));
 579                         return False;
 580                 }
 581
 582                 if (first) {
 583                         DEBUG(0,("rpc_api_pipe: secondary PDU rpc header has 'first' set !\n"));
 584                         return False;
 585                 }
 586
 587                 /*
 588                  * Now read the rest of the PDU.
 589                  */
 590
 591                 if (!rpc_read(cli, rdata, len, &current_offset)) {
 592                         prs_mem_free(rdata);
 593                         return False;
 594                 }
 595
 596                 fragment_start = current_offset - len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 597
 598                 /*
 599                  * Verify any authentication footer.
 600                  */
 601
 602
 603                 if(!rpc_auth_pipe(cli, rdata, fragment_start, rhdr.frag_len,
 604                                   rhdr.auth_len, rhdr.pkt_type, &auth_padding_len)) {
 605                         prs_mem_free(rdata);
 606                         return False;
 607                 }
 608
 609                 if (rhdr.auth_len != 0 ) {
 610
 611                         /*
 612                          * Drop the auth footers from the current offset.
 613                          * The auth footers consist of the auth_data and the
 614                          * preceeding 8 byte auth_header.
 615                          * We need this if there are more fragments.
 616                          */
 617                         current_offset -= (auth_padding_len + RPC_HDR_AUTH_LEN + rhdr.auth_len);
 618                 }
 619         }
 620
 621         return True;
 622 }
 623
 624 /*******************************************************************
 625  creates a DCE/RPC bind request
 626
 627  - initialises the parse structure.
 628  - dynamically allocates the header data structure
 629  - caller is expected to free the header data structure once used.
 630
 631  ********************************************************************/
 632
 633 static NTSTATUS create_rpc_bind_req(struct cli_state *cli, prs_struct *rpc_out,
 634                                     uint32 rpc_call_id,
 635                                     RPC_IFACE *abstract, RPC_IFACE *transfer,
 636                                     const char *my_name, const char *domain)
 637 {
 638         RPC_HDR hdr;
 639         RPC_HDR_RB hdr_rb;
 640         RPC_HDR_AUTH hdr_auth;
 641         int auth_len = 0;
 642         int auth_type, auth_level;
 643         size_t saved_hdr_offset = 0;
 644
 645         prs_struct auth_info;
 646         prs_init(&auth_info, RPC_HDR_AUTH_LEN, /* we will need at least this much */
 647                 prs_get_mem_context(rpc_out), MARSHALL);
 648
 649         if (cli->pipe_auth_flags) {
 650                 get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 651
 652                 /*
 653                  * Create the auth structs we will marshall.
 654                  */
 655
 656                 init_rpc_hdr_auth(&hdr_auth, auth_type, auth_level, 0x00, 1);
 657
 658                 /*
 659                  * Now marshall the data into the temporary parse_struct.
 660                  */
 661
 662                 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &auth_info, 0)) {
 663                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_AUTH.\n"));
 664                         prs_mem_free(&auth_info);
 665                         return NT_STATUS_NO_MEMORY;
 666                 }
 667                 saved_hdr_offset = prs_offset(&auth_info);
 668         }
 669
 670         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 671
 672                 NTSTATUS nt_status;
 673                 DATA_BLOB null_blob = data_blob(NULL, 0);
 674                 DATA_BLOB request;
 675
 676                 DEBUG(5, ("Processing NTLMSSP Negotiate\n"));
 677                 nt_status = ntlmssp_client_update(cli->ntlmssp_pipe_state,
 678                                                   null_blob,
 679                                                   &request);
 680
 681                 if (!NT_STATUS_EQUAL(nt_status,
 682                                      NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 683                         prs_mem_free(&auth_info);
 684                         return nt_status;
 685                 }
 686
 687                 /* Auth len in the rpc header doesn't include auth_header. */
 688                 auth_len = request.length;
 689                 prs_copy_data_in(&auth_info, (char *)request.data, request.length);
 690
 691                 DEBUG(5, ("NTLMSSP Negotiate:\n"));
 692                 dump_data(5, (const char *)request.data, request.length);
 693
 694                 data_blob_free(&request);
 695
 696         } else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 697                 RPC_AUTH_NETSEC_NEG netsec_neg;
 698
 699                 /* Use lp_workgroup() if domain not specified */
 700
 701                 if (!domain || !domain[0]) {
 702                         DEBUG(10,("create_rpc_bind_req: no domain; assuming my own\n"));
 703                         domain = lp_workgroup();
 704                 }
 705
 706                 init_rpc_auth_netsec_neg(&netsec_neg, domain, my_name);
 707
 708                 /*
 709                  * Now marshall the data into the temporary parse_struct.
 710                  */
 711
 712                 if(!smb_io_rpc_auth_netsec_neg("netsec_neg",
 713                                                &netsec_neg, &auth_info, 0)) {
 714                         DEBUG(0,("Failed to marshall RPC_AUTH_NETSEC_NEG.\n"));
 715                         prs_mem_free(&auth_info);
 716                         return NT_STATUS_NO_MEMORY;
 717                 }
 718
 719                 /* Auth len in the rpc header doesn't include auth_header. */
 720                 auth_len = prs_offset(&auth_info) - saved_hdr_offset;
 721         }
 722
 723         /* Create the request RPC_HDR */
 724         init_rpc_hdr(&hdr, RPC_BIND, 0x3, rpc_call_id,
 725                 RPC_HEADER_LEN + RPC_HDR_RB_LEN + prs_offset(&auth_info),
 726                 auth_len);
 727
 728         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
 729                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR.\n"));
 730                 prs_mem_free(&auth_info);
 731                 return NT_STATUS_NO_MEMORY;
 732         }
 733
 734         /* create the bind request RPC_HDR_RB */
 735         init_rpc_hdr_rb(&hdr_rb, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN, 0x0,
 736                         0x1, 0x0, 0x1, abstract, transfer);
 737
 738         /* Marshall the bind request data */
 739         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
 740                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_RB.\n"));
 741                 prs_mem_free(&auth_info);
 742                 return NT_STATUS_NO_MEMORY;
 743         }
 744
 745         /*
 746          * Grow the outgoing buffer to store any auth info.
 747          */
 748
 749         if(auth_len != 0) {
 750                 if(!prs_append_prs_data( rpc_out, &auth_info)) {
 751                         DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 752                         prs_mem_free(&auth_info);
 753                         return NT_STATUS_NO_MEMORY;
 754                 }
 755         }
 756         prs_mem_free(&auth_info);
 757         return NT_STATUS_OK;
 758 }
 759
 760 /*******************************************************************
 761  Creates a DCE/RPC bind authentication response.
 762  This is the packet that is sent back to the server once we
 763  have received a BIND-ACK, to finish the third leg of
 764  the authentication handshake.
 765  ********************************************************************/
 766
 767 static NTSTATUS create_rpc_bind_resp(struct cli_state *cli,
 768                                  uint32 rpc_call_id,
 769                                  prs_struct *rpc_out)
 770 {
 771         NTSTATUS nt_status;
 772         RPC_HDR hdr;
 773         RPC_HDR_AUTHA hdr_autha;
 774         DATA_BLOB ntlmssp_null_response = data_blob(NULL, 0);
 775         DATA_BLOB ntlmssp_reply;
 776         int auth_type, auth_level;
 777
 778         /* The response is picked up from the internal cache,
 779            where it was placed by the rpc_auth_pipe() code */
 780         nt_status = ntlmssp_client_update(cli->ntlmssp_pipe_state,
 781                                           ntlmssp_null_response,
 782                                           &ntlmssp_reply);
 783
 784         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 785                 return nt_status;
 786         }
 787
 788         /* Create the request RPC_HDR */
 789         init_rpc_hdr(&hdr, RPC_BINDRESP, 0x0, rpc_call_id,
 790                      RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN + ntlmssp_reply.length,
 791                      ntlmssp_reply.length );
 792
 793         /* Marshall it. */
 794         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
 795                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR.\n"));
 796                 data_blob_free(&ntlmssp_reply);
 797                 return NT_STATUS_NO_MEMORY;
 798         }
 799
 800         get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 801
 802         /* Create the request RPC_HDR_AUTHA */
 803         init_rpc_hdr_autha(&hdr_autha, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN,
 804                            auth_type, auth_level, 0x00);
 805
 806         if(!smb_io_rpc_hdr_autha("hdr_autha", &hdr_autha, rpc_out, 0)) {
 807                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR_AUTHA.\n"));
 808                 data_blob_free(&ntlmssp_reply);
 809                 return NT_STATUS_NO_MEMORY;
 810         }
 811
 812         /*
 813          * Append the auth data to the outgoing buffer.
 814          */
 815
 816         if(!prs_copy_data_in(rpc_out, (char *)ntlmssp_reply.data, ntlmssp_reply.length)) {
 817                 DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 818                 data_blob_free(&ntlmssp_reply);
 819                 return NT_STATUS_NO_MEMORY;
 820         }
 821
 822         if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
 823                 nt_status = ntlmssp_client_sign_init(cli->ntlmssp_pipe_state);
 824
 825                 if (!NT_STATUS_IS_OK(nt_status)) {
 826                         return nt_status;
 827                 }
 828         }
 829
 830         data_blob_free(&ntlmssp_reply);
 831         return NT_STATUS_OK;
 832 }
 833
 834
 835 /*******************************************************************
 836  Creates a DCE/RPC request.
 837  ********************************************************************/
 838
 839 static uint32 create_rpc_request(prs_struct *rpc_out, uint8 op_num, int data_len, int auth_len, uint8 flags, uint32 oldid, uint32 data_left)
 840 {
 841         uint32 alloc_hint;
 842         RPC_HDR     hdr;
 843         RPC_HDR_REQ hdr_req;
 844         uint32 callid = oldid ? oldid : get_rpc_call_id();
 845
 846         DEBUG(5,("create_rpc_request: opnum: 0x%x data_len: 0x%x\n", op_num, data_len));
 847
 848         /* create the rpc header RPC_HDR */
 849         init_rpc_hdr(&hdr, RPC_REQUEST, flags,
 850                      callid, data_len, auth_len);
 851
 852         /*
 853          * The alloc hint should be the amount of data, not including
 854          * RPC headers & footers.
 855          */
 856
 857         if (auth_len != 0)
 858                 alloc_hint = data_len - RPC_HEADER_LEN - RPC_HDR_AUTH_LEN - auth_len;
 859         else
 860                 alloc_hint = data_len - RPC_HEADER_LEN;
 861
 862         DEBUG(10,("create_rpc_request: data_len: %x auth_len: %x alloc_hint: %x\n",
 863                    data_len, auth_len, alloc_hint));
 864
 865         /* Create the rpc request RPC_HDR_REQ */
 866         init_rpc_hdr_req(&hdr_req, alloc_hint, op_num);
 867
 868         /* stream-time... */
 869         if(!smb_io_rpc_hdr("hdr    ", &hdr, rpc_out, 0))
 870                 return 0;
 871
 872         if(!smb_io_rpc_hdr_req("hdr_req", &hdr_req, rpc_out, 0))
 873                 return 0;
 874
 875         if (prs_offset(rpc_out) != RPC_HEADER_LEN + RPC_HDR_REQ_LEN)
 876                 return 0;
 877
 878         return callid;
 879 }
 880
 881 /*******************************************************************
 882  Puts an auth header into an rpc request.
 883  ********************************************************************/
 884
 885 static BOOL create_auth_hdr(prs_struct *outgoing_packet,
 886                             int auth_type,
 887                             int auth_level, int padding)
 888 {
 889         RPC_HDR_AUTH hdr_auth;
 890
 891         init_rpc_hdr_auth(&hdr_auth, auth_type, auth_level,
 892                           padding, 1);
 893         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth,
 894                                 outgoing_packet, 0)) {
 895                 DEBUG(0,("create_auth_hdr:Failed to marshal RPC_HDR_AUTH.\n"));
 896                 return False;
 897         }
 898         return True;
 899 }
 900
 901 /**
 902  * Send a request on an RPC pipe and get a response.
 903  *
 904  * @param data NDR contents of the request to be sent.
 905  * @param rdata Unparsed NDR response data.
 906 **/
 907
 908 BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num,
 909                       prs_struct *data, prs_struct *rdata)
 910 {
 911         uint32 auth_len, real_auth_len, auth_hdr_len, max_data, data_left, data_sent;
 912         NTSTATUS nt_status;
 913         BOOL ret = False;
 914         uint32 callid = 0;
 915         fstring dump_name;
 916
 917         auth_len = 0;
 918         real_auth_len = 0;
 919         auth_hdr_len = 0;
 920
 921         if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
 922                 if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 923                         auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 924                 }
 925                 if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 926                         auth_len = RPC_AUTH_NETSEC_CHK_LEN;
 927                 }
 928                 auth_hdr_len = RPC_HDR_AUTH_LEN;
 929         }
 930
 931         /*
 932          * calc how much actual data we can send in a PDU fragment
 933          */
 934         max_data = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 935                 auth_hdr_len - auth_len - 8;
 936
 937         for (data_left = prs_offset(data), data_sent = 0; data_left > 0;) {
 938                 prs_struct outgoing_packet;
 939                 prs_struct sec_blob;
 940                 uint32 data_len, send_size;
 941                 uint8 flags = 0;
 942                 uint32 auth_padding = 0;
 943                 DATA_BLOB sign_blob;
 944
 945                 /*
 946                  * how much will we send this time
 947                  */
 948                 send_size = MIN(data_left, max_data);
 949
 950                 if (!prs_init(&sec_blob, send_size, /* will need at least this much */
 951                               cli->mem_ctx, MARSHALL)) {
 952                         DEBUG(0,("Could not malloc %u bytes",
 953                                  send_size+auth_padding));
 954                         return False;
 955                 }
 956
 957                 if(!prs_append_some_prs_data(&sec_blob, data,
 958                                              data_sent, send_size)) {
 959                         DEBUG(0,("Failed to append data to netsec blob\n"));
 960                         prs_mem_free(&sec_blob);
 961                         return False;
 962                 }
 963
 964                 /*
 965                  * NT expects the data that is sealed to be 8-byte
 966                  * aligned. The padding must be encrypted as well and
 967                  * taken into account when generating the
 968                  * authentication verifier. The amount of padding must
 969                  * be stored in the auth header.
 970                  */
 971
 972                 if (cli->pipe_auth_flags) {
 973                         size_t data_and_padding_size;
 974                         int auth_type;
 975                         int auth_level;
 976                         prs_align_uint64(&sec_blob);
 977
 978                         get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 979
 980                         data_and_padding_size = prs_offset(&sec_blob);
 981                         auth_padding = data_and_padding_size - send_size;
 982
 983                         /* insert the auth header */
 984
 985                         if(!create_auth_hdr(&sec_blob, auth_type, auth_level, auth_padding)) {
 986                                 prs_mem_free(&sec_blob);
 987                                 return False;
 988                         }
 989
 990                         /* create an NTLMSSP signature */
 991                         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 992                                 /*
 993                                  * Seal the outgoing data if requested.
 994                                  */
 995                                 if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) {
 996
 997                                         nt_status = ntlmssp_client_seal_packet(cli->ntlmssp_pipe_state,
 998                                                                                (unsigned char*)prs_data_p(&sec_blob),
 999                                                                                data_and_padding_size,
1000                                                                                &sign_blob);
1001                                         if (!NT_STATUS_IS_OK(nt_status)) {
1002                                                 prs_mem_free(&sec_blob);
1003                                                 return False;
1004                                         }
1005                                 }
1006                                 else if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
1007
1008                                         nt_status = ntlmssp_client_sign_packet(cli->ntlmssp_pipe_state,
1009                                                                                (unsigned char*)prs_data_p(&sec_blob),
1010                                                                                data_and_padding_size, &sign_blob);
1011                                         if (!NT_STATUS_IS_OK(nt_status)) {
1012                                                 prs_mem_free(&sec_blob);
1013                                                 return False;
1014                                         }
1015                                 }
1016
1017
1018                                 /* write auth footer onto the packet */
1019                                 real_auth_len = sign_blob.length;
1020
1021                                 prs_copy_data_in(&sec_blob, (char *)sign_blob.data, sign_blob.length);
1022                                 data_blob_free(&sign_blob);
1023
1024                         }
1025                         else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
1026                                 size_t parse_offset_marker;
1027                                 RPC_AUTH_NETSEC_CHK verf;
1028                                 DEBUG(10,("SCHANNEL seq_num=%d\n", cli->auth_info.seq_num));
1029
1030                                 netsec_encode(&cli->auth_info,
1031                                               cli->pipe_auth_flags,
1032                                               SENDER_IS_INITIATOR,
1033                                               &verf,
1034                                               prs_data_p(&sec_blob),
1035                                               data_and_padding_size);
1036
1037                                 cli->auth_info.seq_num++;
1038
1039                                 /* write auth footer onto the packet */
1040
1041                                 parse_offset_marker = prs_offset(&sec_blob);
1042                                 if (!smb_io_rpc_auth_netsec_chk("", &verf,
1043                                                                 &sec_blob, 0)) {
1044                                         prs_mem_free(&sec_blob);
1045                                         return False;
1046                                 }
1047                                 real_auth_len = prs_offset(&sec_blob) - parse_offset_marker;
1048                         }
1049                 }
1050
1051                 data_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + prs_offset(&sec_blob);
1052
1053                 /*
1054                  * Malloc parse struct to hold it (and enough for alignments).
1055                  */
1056                 if(!prs_init(&outgoing_packet, data_len + 8,
1057                              cli->mem_ctx, MARSHALL)) {
1058                         DEBUG(0,("rpc_api_pipe_req: Failed to malloc %u bytes.\n", (unsigned int)data_len ));
1059                         return False;
1060                 }
1061
1062                 if (data_left == prs_offset(data))
1063                         flags |= RPC_FLG_FIRST;
1064
1065                 if (data_left <= max_data)
1066                         flags |= RPC_FLG_LAST;
1067                 /*
1068                  * Write out the RPC header and the request header.
1069                  */
1070                 if(!(callid = create_rpc_request(&outgoing_packet, op_num,
1071                                                  data_len, real_auth_len, flags,
1072                                                  callid, data_left))) {
1073                         DEBUG(0,("rpc_api_pipe_req: Failed to create RPC request.\n"));
1074                         prs_mem_free(&outgoing_packet);
1075                         prs_mem_free(&sec_blob);
1076                         return False;
1077                 }
1078
1079                 prs_append_prs_data(&outgoing_packet, &sec_blob);
1080                 prs_mem_free(&sec_blob);
1081
1082                 DEBUG(100,("data_len: %x data_calc_len: %x\n", data_len,
1083                            prs_offset(&outgoing_packet)));
1084
1085                 if (flags & RPC_FLG_LAST)
1086                         ret = rpc_api_pipe(cli, &outgoing_packet,
1087                                            rdata, RPC_RESPONSE);
1088                 else {
1089                         cli_write(cli, cli->nt_pipe_fnum, 0x0008,
1090                                    prs_data_p(&outgoing_packet),
1091                                    data_sent, data_len);
1092                 }
1093                 prs_mem_free(&outgoing_packet);
1094                 data_sent += send_size;
1095                 data_left -= send_size;
1096         }
1097         /* Also capture received data */
1098         slprintf(dump_name, sizeof(dump_name) - 1, "reply_%s",
1099                  cli_pipe_get_name(cli));
1100         prs_dump(dump_name, op_num, rdata);
1101
1102         return ret;
1103 }
1104
1105 /****************************************************************************
1106  Set the handle state.
1107 ****************************************************************************/
1108
1109 static BOOL rpc_pipe_set_hnd_state(struct cli_state *cli, const char *pipe_name, uint16 device_state)
1110 {
1111         BOOL state_set = False;
1112         char param[2];
1113         uint16 setup[2]; /* only need 2 uint16 setup parameters */
1114         char *rparam = NULL;
1115         char *rdata = NULL;
1116         uint32 rparam_len, rdata_len;
1117
1118         if (pipe_name == NULL)
1119                 return False;
1120
1121         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
1122         cli->nt_pipe_fnum, pipe_name, device_state));
1123
1124         /* create parameters: device state */
1125         SSVAL(param, 0, device_state);
1126
1127         /* create setup parameters. */
1128         setup[0] = 0x0001;
1129         setup[1] = cli->nt_pipe_fnum; /* pipe file handle.  got this from an SMBOpenX. */
1130
1131         /* send the data on \PIPE\ */
1132         if (cli_api_pipe(cli, "\\PIPE\\",
1133                     setup, 2, 0,                /* setup, length, max */
1134                     param, 2, 0,                /* param, length, max */
1135                     NULL, 0, 1024,              /* data, length, max */
1136                     &rparam, &rparam_len,        /* return param, length */
1137                     &rdata, &rdata_len))         /* return data, length */
1138         {
1139                 DEBUG(5, ("Set Handle state: return OK\n"));
1140                 state_set = True;
1141         }
1142
1143         SAFE_FREE(rparam);
1144         SAFE_FREE(rdata);
1145
1146         return state_set;
1147 }
1148
1149 /****************************************************************************
1150  check the rpc bind acknowledge response
1151 ****************************************************************************/
1152
1153 int get_pipe_index( const char *pipe_name )
1154 {
1155         int pipe_idx = 0;
1156
1157         while (pipe_names[pipe_idx].client_pipe != NULL) {
1158                 if (strequal(pipe_name, pipe_names[pipe_idx].client_pipe ))
1159                         return pipe_idx;
1160                 pipe_idx++;
1161         };
1162
1163         return -1;
1164 }
1165
1166
1167 /****************************************************************************
1168  check the rpc bind acknowledge response
1169 ****************************************************************************/
1170
1171 const char* get_pipe_name_from_index( const int pipe_index )
1172 {
1173
1174         if ( (pipe_index < 0) || (pipe_index >= PI_MAX_PIPES) )
1175                 return NULL;
1176
1177         return pipe_names[pipe_index].client_pipe;
1178 }
1179
1180 /****************************************************************************
1181  Check to see if this pipe index points to one of
1182  the pipes only supported by Win2k
1183  ****************************************************************************/
1184
1185 BOOL is_win2k_pipe( const int pipe_idx )
1186 {
1187         switch ( pipe_idx )
1188         {
1189                 case PI_LSARPC_DS:
1190                         return True;
1191         }
1192
1193         return False;
1194 }
1195
1196 /****************************************************************************
1197  check the rpc bind acknowledge response
1198 ****************************************************************************/
1199
1200 static BOOL valid_pipe_name(const int pipe_idx, RPC_IFACE *abstract, RPC_IFACE *transfer)
1201 {
1202         if ( pipe_idx >= PI_MAX_PIPES ) {
1203                 DEBUG(0,("valid_pipe_name: Programmer error!  Invalid pipe index [%d]\n",
1204                         pipe_idx));
1205                 return False;
1206         }
1207
1208         DEBUG(5,("Bind Abstract Syntax: "));
1209         dump_data(5, (char*)&(pipe_names[pipe_idx].abstr_syntax),
1210                   sizeof(pipe_names[pipe_idx].abstr_syntax));
1211         DEBUG(5,("Bind Transfer Syntax: "));
1212         dump_data(5, (char*)&(pipe_names[pipe_idx].trans_syntax),
1213                   sizeof(pipe_names[pipe_idx].trans_syntax));
1214
1215         /* copy the required syntaxes out so we can do the right bind */
1216
1217         *transfer = pipe_names[pipe_idx].trans_syntax;
1218         *abstract = pipe_names[pipe_idx].abstr_syntax;
1219
1220         return True;
1221 }
1222
1223 /****************************************************************************
1224  check the rpc bind acknowledge response
1225 ****************************************************************************/
1226
1227 static BOOL check_bind_response(RPC_HDR_BA *hdr_ba, const int pipe_idx, RPC_IFACE *transfer)
1228 {
1229         int i = 0;
1230
1231         if ( hdr_ba->addr.len <= 0)
1232                 return False;
1233
1234         if ( !strequal(hdr_ba->addr.str, pipe_names[pipe_idx].server_pipe ))
1235         {
1236                 DEBUG(4,("bind_rpc_pipe: pipe_name %s != expected pipe %s.  oh well!\n",
1237                          pipe_names[i].server_pipe ,hdr_ba->addr.str));
1238                 return False;
1239         }
1240
1241         DEBUG(5,("bind_rpc_pipe: server pipe_name found: %s\n", pipe_names[i].server_pipe ));
1242
1243         if (pipe_names[pipe_idx].server_pipe == NULL) {
1244                 DEBUG(2,("bind_rpc_pipe: pipe name %s unsupported\n", hdr_ba->addr.str));
1245                 return False;
1246         }
1247
1248         /* check the transfer syntax */
1249         if ((hdr_ba->transfer.version != transfer->version) ||
1250              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1251                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1252                 return False;
1253         }
1254
1255         /* lkclXXXX only accept one result: check the result(s) */
1256         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
1257                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1258                           hdr_ba->res.num_results, hdr_ba->res.reason));
1259         }
1260
1261         DEBUG(5,("bind_rpc_pipe: accepted!\n"));
1262         return True;
1263 }
1264
1265 /****************************************************************************
1266  Create and send the third packet in an RPC auth.
1267 ****************************************************************************/
1268
1269 static BOOL rpc_send_auth_reply(struct cli_state *cli, prs_struct *rdata, uint32 rpc_call_id)
1270 {
1271         prs_struct rpc_out;
1272         ssize_t ret;
1273
1274         prs_init(&rpc_out, RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN, /* need at least this much */
1275                  cli->mem_ctx, MARSHALL);
1276
1277         if (!NT_STATUS_IS_OK(create_rpc_bind_resp(cli, rpc_call_id,
1278                                                   &rpc_out))) {
1279                 return False;
1280         }
1281
1282         if ((ret = cli_write(cli, cli->nt_pipe_fnum, 0x8, prs_data_p(&rpc_out),
1283                         0, (size_t)prs_offset(&rpc_out))) != (ssize_t)prs_offset(&rpc_out)) {
1284                 DEBUG(0,("rpc_send_auth_reply: cli_write failed. Return was %d\n", (int)ret));
1285                 prs_mem_free(&rpc_out);
1286                 return False;
1287         }
1288
1289         prs_mem_free(&rpc_out);
1290         return True;
1291 }
1292
1293 /****************************************************************************
1294  Do an rpc bind.
1295 ****************************************************************************/
1296
1297 static BOOL rpc_pipe_bind(struct cli_state *cli, int pipe_idx, const char *my_name)
1298 {
1299         RPC_IFACE abstract;
1300         RPC_IFACE transfer;
1301         prs_struct rpc_out;
1302         prs_struct rdata;
1303         uint32 rpc_call_id;
1304         char buffer[MAX_PDU_FRAG_LEN];
1305
1306         if ( (pipe_idx < 0) || (pipe_idx >= PI_MAX_PIPES) )
1307                 return False;
1308
1309         DEBUG(5,("Bind RPC Pipe[%x]: %s\n", cli->nt_pipe_fnum, pipe_names[pipe_idx].client_pipe));
1310
1311         if (!valid_pipe_name(pipe_idx, &abstract, &transfer))
1312                 return False;
1313
1314         prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL);
1315
1316         /*
1317          * Use the MAX_PDU_FRAG_LEN buffer to store the bind request.
1318          */
1319
1320         prs_give_memory( &rpc_out, buffer, sizeof(buffer), False);
1321
1322         rpc_call_id = get_rpc_call_id();
1323
1324         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
1325                 NTSTATUS nt_status;
1326                 fstring password;
1327
1328                 DEBUG(5, ("NTLMSSP authenticated pipe selected\n"));
1329
1330                 nt_status = ntlmssp_client_start(&cli->ntlmssp_pipe_state);
1331
1332                 if (!NT_STATUS_IS_OK(nt_status))
1333                         return False;
1334
1335                 nt_status = ntlmssp_set_username(cli->ntlmssp_pipe_state,
1336                                                  cli->user_name);
1337                 if (!NT_STATUS_IS_OK(nt_status))
1338                         return False;
1339
1340                 nt_status = ntlmssp_set_domain(cli->ntlmssp_pipe_state,
1341                                                cli->domain);
1342                 if (!NT_STATUS_IS_OK(nt_status))
1343                         return False;
1344
1345                 pwd_get_cleartext(&cli->pwd, password);
1346                 nt_status = ntlmssp_set_password(cli->ntlmssp_pipe_state,
1347                                                  password);
1348                 if (!NT_STATUS_IS_OK(nt_status))
1349                         return False;
1350
1351                 if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
1352                         cli->ntlmssp_pipe_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
1353                 }
1354
1355                 if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) {
1356                         cli->ntlmssp_pipe_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
1357                 }
1358         } else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
1359                 cli->auth_info.seq_num = 0;
1360         }
1361
1362         /* Marshall the outgoing data. */
1363         create_rpc_bind_req(cli, &rpc_out, rpc_call_id,
1364                             &abstract, &transfer,
1365                             global_myname(), cli->domain);
1366
1367         /* Initialize the incoming data struct. */
1368         prs_init(&rdata, 0, cli->mem_ctx, UNMARSHALL);
1369
1370         /* send data on \PIPE\.  receive a response */
1371         if (rpc_api_pipe(cli, &rpc_out, &rdata, RPC_BINDACK)) {
1372                 RPC_HDR_BA   hdr_ba;
1373
1374                 DEBUG(5, ("rpc_pipe_bind: rpc_api_pipe returned OK.\n"));
1375
1376                 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &rdata, 0)) {
1377                         DEBUG(0,("rpc_pipe_bind: Failed to unmarshall RPC_HDR_BA.\n"));
1378                         prs_mem_free(&rdata);
1379                         return False;
1380                 }
1381
1382                 if(!check_bind_response(&hdr_ba, pipe_idx, &transfer)) {
1383                         DEBUG(2,("rpc_pipe_bind: check_bind_response failed.\n"));
1384                         prs_mem_free(&rdata);
1385                         return False;
1386                 }
1387
1388                 cli->max_xmit_frag = hdr_ba.bba.max_tsize;
1389                 cli->max_recv_frag = hdr_ba.bba.max_rsize;
1390
1391                 /*
1392                  * If we're doing NTLMSSP auth we need to send a reply to
1393                  * the bind-ack to complete the 3-way challenge response
1394                  * handshake.
1395                  */
1396
1397                 if ((cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP)
1398                     && !rpc_send_auth_reply(cli, &rdata, rpc_call_id)) {
1399                         DEBUG(0,("rpc_pipe_bind: rpc_send_auth_reply failed.\n"));
1400                         prs_mem_free(&rdata);
1401                         return False;
1402                 }
1403                 prs_mem_free(&rdata);
1404                 return True;
1405         }
1406
1407         return False;
1408 }
1409
1410 /****************************************************************************
1411  Open a session.
1412  ****************************************************************************/
1413
1414 BOOL cli_nt_session_open(struct cli_state *cli, const int pipe_idx)
1415 {
1416         int fnum;
1417
1418         /* At the moment we can't have more than one pipe open over
1419            a cli connection. )-: */
1420
1421         SMB_ASSERT(cli->nt_pipe_fnum == 0);
1422
1423         /* The pipe index must fall within our array */
1424
1425         SMB_ASSERT((pipe_idx >= 0) && (pipe_idx < PI_MAX_PIPES));
1426
1427         if (cli->capabilities & CAP_NT_SMBS) {
1428                 if ((fnum = cli_nt_create(cli, &pipe_names[pipe_idx].client_pipe[5], DESIRED_ACCESS_PIPE)) == -1) {
1429                         DEBUG(0,("cli_nt_session_open: cli_nt_create failed on pipe %s to machine %s.  Error was %s\n",
1430                                  &pipe_names[pipe_idx].client_pipe[5], cli->desthost, cli_errstr(cli)));
1431                         return False;
1432                 }
1433
1434                 cli->nt_pipe_fnum = (uint16)fnum;
1435         } else {
1436                 if ((fnum = cli_open(cli, pipe_names[pipe_idx].client_pipe, O_CREAT|O_RDWR, DENY_NONE)) == -1) {
1437                         DEBUG(0,("cli_nt_session_open: cli_open failed on pipe %s to machine %s.  Error was %s\n",
1438                                  pipe_names[pipe_idx].client_pipe, cli->desthost, cli_errstr(cli)));
1439                         return False;
1440                 }
1441
1442                 cli->nt_pipe_fnum = (uint16)fnum;
1443
1444                 /**************** Set Named Pipe State ***************/
1445                 if (!rpc_pipe_set_hnd_state(cli, pipe_names[pipe_idx].client_pipe, 0x4300)) {
1446                         DEBUG(0,("cli_nt_session_open: pipe hnd state failed.  Error was %s\n",
1447                                   cli_errstr(cli)));
1448                         cli_close(cli, cli->nt_pipe_fnum);
1449                         return False;
1450                 }
1451         }
1452
1453         /******************* bind request on pipe *****************/
1454
1455         if (!rpc_pipe_bind(cli, pipe_idx, global_myname())) {
1456                 DEBUG(2,("cli_nt_session_open: rpc bind to %s failed\n",
1457                          get_pipe_name_from_index(pipe_idx)));
1458                 cli_close(cli, cli->nt_pipe_fnum);
1459                 return False;
1460         }
1461
1462         /*
1463          * Setup the remote server name prefixed by \ and the machine account name.
1464          */
1465
1466         fstrcpy(cli->srv_name_slash, "\\\\");
1467         fstrcat(cli->srv_name_slash, cli->desthost);
1468         strupper_m(cli->srv_name_slash);
1469
1470         fstrcpy(cli->clnt_name_slash, "\\\\");
1471         fstrcat(cli->clnt_name_slash, global_myname());
1472         strupper_m(cli->clnt_name_slash);
1473
1474         fstrcpy(cli->mach_acct, global_myname());
1475         fstrcat(cli->mach_acct, "$");
1476         strupper_m(cli->mach_acct);
1477
1478         /* Remember which pipe we're talking to */
1479         fstrcpy(cli->pipe_name, pipe_names[pipe_idx].client_pipe);
1480
1481         return True;
1482 }
1483
1484
1485 /****************************************************************************
1486  Open a session to the NETLOGON pipe using schannel.
1487
1488  (Assumes that the netlogon pipe is already open)
1489  ****************************************************************************/
1490
1491 NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan,
1492                                    const uchar trust_password[16])
1493 {
1494         NTSTATUS result;
1495         uint32 neg_flags = NETLOGON_NEG_AUTH2_FLAGS;
1496         int fnum;
1497
1498         cli_nt_netlogon_netsec_session_close(cli);
1499
1500         if (lp_client_schannel() != False)
1501                 neg_flags |= NETLOGON_NEG_SCHANNEL;
1502
1503         result = cli_nt_setup_creds(cli, sec_chan, trust_password,
1504                                     &neg_flags, 2);
1505
1506         if (!NT_STATUS_IS_OK(result)) {
1507                 cli_nt_session_close(cli);
1508                 return result;
1509         }
1510
1511         if ((lp_client_schannel() == True) &&
1512             ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
1513
1514                 DEBUG(3, ("Server did not offer schannel\n"));
1515                 cli_nt_session_close(cli);
1516                 return NT_STATUS_UNSUCCESSFUL;
1517         }
1518
1519         if ((lp_client_schannel() == False) ||
1520             ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
1521                 return NT_STATUS_OK;
1522
1523                 /* keep the existing connection to NETLOGON open */
1524
1525         }
1526
1527         /* Server offered schannel, so try it. */
1528
1529         memcpy(cli->auth_info.sess_key, cli->sess_key,
1530                sizeof(cli->auth_info.sess_key));
1531
1532         cli->saved_netlogon_pipe_fnum = cli->nt_pipe_fnum;
1533
1534         cli->pipe_auth_flags = AUTH_PIPE_NETSEC;
1535         cli->pipe_auth_flags |= AUTH_PIPE_SIGN;
1536         cli->pipe_auth_flags |= AUTH_PIPE_SEAL;
1537
1538         if (cli->capabilities & CAP_NT_SMBS) {
1539
1540                 /* The secure channel connection must be opened on the same
1541                    session (TCP connection) as the one the challenge was
1542                    requested from. */
1543                 if ((fnum = cli_nt_create(cli, PIPE_NETLOGON_PLAIN,
1544                                           DESIRED_ACCESS_PIPE)) == -1) {
1545                         DEBUG(0,("cli_nt_create failed to %s machine %s. "
1546                                  "Error was %s\n",
1547                                  PIPE_NETLOGON, cli->desthost,
1548                                  cli_errstr(cli)));
1549                         return NT_STATUS_UNSUCCESSFUL;
1550                 }
1551
1552                 cli->nt_pipe_fnum = (uint16)fnum;
1553         } else {
1554                 if ((fnum = cli_open(cli, PIPE_NETLOGON,
1555                                      O_CREAT|O_RDWR, DENY_NONE)) == -1) {
1556                         DEBUG(0,("cli_open failed on pipe %s to machine %s. "
1557                                  "Error was %s\n",
1558                                  PIPE_NETLOGON, cli->desthost,
1559                                  cli_errstr(cli)));
1560                         return NT_STATUS_UNSUCCESSFUL;
1561                 }
1562
1563                 cli->nt_pipe_fnum = (uint16)fnum;
1564
1565                 /**************** Set Named Pipe State ***************/
1566                 if (!rpc_pipe_set_hnd_state(cli, PIPE_NETLOGON, 0x4300)) {
1567                         DEBUG(0,("Pipe hnd state failed.  Error was %s\n",
1568                                   cli_errstr(cli)));
1569                         cli_close(cli, cli->nt_pipe_fnum);
1570                         return NT_STATUS_UNSUCCESSFUL;
1571                 }
1572         }
1573
1574         if (!rpc_pipe_bind(cli, PI_NETLOGON, global_myname())) {
1575                 DEBUG(2,("rpc bind to %s failed\n", PIPE_NETLOGON));
1576                 cli_close(cli, cli->nt_pipe_fnum);
1577                 return NT_STATUS_UNSUCCESSFUL;
1578         }
1579
1580         return NT_STATUS_OK;
1581 }
1582
1583
1584 NTSTATUS cli_nt_setup_netsec(struct cli_state *cli, int sec_chan, int auth_flags,
1585                              const uchar trust_password[16])
1586 {
1587         NTSTATUS result;
1588         uint32 neg_flags = NETLOGON_NEG_AUTH2_FLAGS;
1589         cli->pipe_auth_flags = 0;
1590
1591         if (lp_client_schannel() == False) {
1592                 return NT_STATUS_OK;
1593         }
1594
1595         if (!cli_nt_session_open(cli, PI_NETLOGON)) {
1596                 DEBUG(0, ("Could not initialise %s\n",
1597                           get_pipe_name_from_index(PI_NETLOGON)));
1598                 return NT_STATUS_UNSUCCESSFUL;
1599         }
1600
1601         if (lp_client_schannel() != False)
1602                 neg_flags |= NETLOGON_NEG_SCHANNEL;
1603
1604         neg_flags |= NETLOGON_NEG_SCHANNEL;
1605
1606         result = cli_nt_setup_creds(cli, sec_chan, trust_password,
1607                                     &neg_flags, 2);
1608
1609         if (!(neg_flags & NETLOGON_NEG_SCHANNEL)
1610             && lp_client_schannel() == True) {
1611                 DEBUG(1, ("Could not negotiate SCHANNEL with the DC!\n"));
1612                 result = NT_STATUS_UNSUCCESSFUL;
1613         }
1614
1615         if (!NT_STATUS_IS_OK(result)) {
1616                 ZERO_STRUCT(cli->auth_info.sess_key);
1617                 ZERO_STRUCT(cli->sess_key);
1618                 cli->pipe_auth_flags = 0;
1619                 cli_nt_session_close(cli);
1620                 return result;
1621         }
1622
1623         memcpy(cli->auth_info.sess_key, cli->sess_key,
1624                sizeof(cli->auth_info.sess_key));
1625
1626         cli->saved_netlogon_pipe_fnum = cli->nt_pipe_fnum;
1627         cli->nt_pipe_fnum = 0;
1628
1629         /* doing schannel, not per-user auth */
1630         cli->pipe_auth_flags = auth_flags;
1631
1632         return NT_STATUS_OK;
1633 }
1634
1635 const char *cli_pipe_get_name(struct cli_state *cli)
1636 {
1637         return cli->pipe_name;
1638 }
1639
1640