source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1998,
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Paul Ashton                       1998.
   8  *  Copyright (C) Jeremy Allison                    1999.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 #include "includes.h"
  26
  27 extern int DEBUGLEVEL;
  28 extern struct pipe_id_info pipe_names[];
  29 extern fstring global_myworkgroup;
  30 extern pstring global_myname;
  31
  32 /********************************************************************
  33  Rpc pipe call id.
  34  ********************************************************************/
  35
  36 static uint32 get_rpc_call_id(void)
  37 {
  38         static uint32 call_id = 0;
  39         return ++call_id;
  40 }
  41
  42 /*******************************************************************
  43  Use SMBreadX to get rest of one fragment's worth of rpc data.
  44  ********************************************************************/
  45
  46 static BOOL rpc_read(struct cli_state *cli, prs_struct *rdata, uint32 data_to_read, uint32 *rdata_offset)
  47 {
  48         size_t size = (size_t)cli->max_recv_frag;
  49         int stream_offset = 0;
  50         int num_read;
  51         char *pdata;
  52         int extra_data_size = ((int)*rdata_offset) + ((int)data_to_read) - (int)prs_data_size(rdata);
  53
  54         DEBUG(5,("rpc_read: data_to_read: %u rdata offset: %u extra_data_size: %d\n",
  55                 (int)data_to_read, (unsigned int)*rdata_offset, extra_data_size));
  56
  57         /*
  58          * Grow the buffer if needed to accommodate the data to be read.
  59          */
  60
  61         if (extra_data_size > 0) {
  62                 if(!prs_force_grow(rdata, (uint32)extra_data_size)) {
  63                         DEBUG(0,("rpc_read: Failed to grow parse struct by %d bytes.\n", extra_data_size ));
  64                         return False;
  65                 }
  66                 DEBUG(5,("rpc_read: grew buffer by %d bytes to %u\n", extra_data_size, prs_data_size(rdata) ));
  67         }
  68
  69         pdata = prs_data_p(rdata) + *rdata_offset;
  70
  71         do /* read data using SMBreadX */
  72         {
  73                 uint32 ecode;
  74                 uint8 eclass;
  75
  76                 if (size > (size_t)data_to_read)
  77                         size = (size_t)data_to_read;
  78
  79                 num_read = (int)cli_read(cli, cli->nt_pipe_fnum, pdata, (off_t)stream_offset, size);
  80
  81                 DEBUG(5,("rpc_read: num_read = %d, read offset: %d, to read: %d\n",
  82                           num_read, stream_offset, data_to_read));
  83
  84                 if (cli_is_dos_error(cli) &&
  85                     cli_dos_error(cli, &eclass, &ecode) &&
  86                     (eclass != ERRDOS && ecode != ERRmoredata)) {
  87                         DEBUG(0,("rpc_read: Error %d/%u in cli_read\n",
  88                                  eclass, (unsigned int)ecode));
  89                         return False;
  90                 }
  91
  92                 data_to_read -= num_read;
  93                 stream_offset += num_read;
  94                 pdata += num_read;
  95
  96         } while (num_read > 0 && data_to_read > 0);
  97         /* && err == (0x80000000 | STATUS_BUFFER_OVERFLOW)); */
  98
  99         /*
 100          * Update the current offset into rdata by the amount read.
 101          */
 102         *rdata_offset += stream_offset;
 103
 104         return True;
 105 }
 106
 107 /****************************************************************************
 108  Checks the header. This will set the endian bit in the rdata prs_struct. JRA.
 109  ****************************************************************************/
 110
 111 static BOOL rpc_check_hdr(prs_struct *rdata, RPC_HDR *rhdr,
 112                           BOOL *first, BOOL *last, uint32 *len)
 113 {
 114         DEBUG(5,("rpc_check_hdr: rdata->data_size = %u\n", (uint32)prs_data_size(rdata) ));
 115
 116         /* Next call sets endian bit. */
 117
 118         if(!smb_io_rpc_hdr("rpc_hdr   ", rhdr, rdata, 0)) {
 119                 DEBUG(0,("rpc_check_hdr: Failed to unmarshall RPC_HDR.\n"));
 120                 return False;
 121         }
 122
 123         if (prs_offset(rdata) != RPC_HEADER_LEN) {
 124                 DEBUG(0,("rpc_check_hdr: offset was %x, should be %x.\n", prs_offset(rdata), RPC_HEADER_LEN));
 125                 return False;
 126         }
 127
 128         (*first) = ((rhdr->flags & RPC_FLG_FIRST) != 0);
 129         (*last) = ((rhdr->flags & RPC_FLG_LAST ) != 0);
 130         (*len) = (uint32)rhdr->frag_len - prs_data_size(rdata);
 131
 132         return (rhdr->pkt_type != RPC_FAULT);
 133 }
 134
 135 static void NTLMSSPcalc_ap( struct cli_state *cli, unsigned char *data, uint32 len)
 136 {
 137         unsigned char *hash = cli->ntlmssp_hash;
 138         unsigned char index_i = hash[256];
 139         unsigned char index_j = hash[257];
 140         int ind;
 141
 142         for( ind = 0; ind < len; ind++) {
 143                 unsigned char tc;
 144                 unsigned char t;
 145
 146                 index_i++;
 147                 index_j += hash[index_i];
 148
 149                 tc = hash[index_i];
 150                 hash[index_i] = hash[index_j];
 151                 hash[index_j] = tc;
 152
 153                 t = hash[index_i] + hash[index_j];
 154                 data[ind] = data[ind] ^ hash[t];
 155         }
 156
 157         hash[256] = index_i;
 158         hash[257] = index_j;
 159 }
 160
 161 /****************************************************************************
 162  Verify data on an rpc pipe.
 163  The VERIFY & SEAL code is only executed on packets that look like this :
 164
 165  Request/Response PDU's look like the following...
 166
 167  |<------------------PDU len----------------------------------------------->|
 168  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 169
 170  +------------+-----------------+-------------+---------------+-------------+
 171  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 172  +------------+-----------------+-------------+---------------+-------------+
 173
 174  Never on bind requests/responses.
 175  ****************************************************************************/
 176
 177 static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int auth_len)
 178 {
 179         /*
 180          * The following is that length of the data we must sign or seal.
 181          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
 182          * preceeding the auth_data.
 183          */
 184
 185         int data_len = len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 186
 187         /*
 188          * The start of the data to sign/seal is just after the RPC headers.
 189          */
 190         char *reply_data = prs_data_p(rdata) + RPC_HEADER_LEN + RPC_HDR_REQ_LEN;
 191
 192         BOOL auth_verify = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SIGN) != 0);
 193         BOOL auth_seal = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SEAL) != 0);
 194
 195         DEBUG(5,("rpc_auth_pipe: len: %d auth_len: %d verify %s seal %s\n",
 196                   len, auth_len, BOOLSTR(auth_verify), BOOLSTR(auth_seal)));
 197
 198         /*
 199          * Unseal any sealed data in the PDU, not including the
 200          * 8 byte auth_header or the auth_data.
 201          */
 202
 203         if (auth_seal) {
 204                 DEBUG(10,("rpc_auth_pipe: unseal\n"));
 205                 dump_data(100, reply_data, data_len);
 206                 NTLMSSPcalc_ap(cli, (uchar*)reply_data, data_len);
 207                 dump_data(100, reply_data, data_len);
 208         }
 209
 210         if (auth_verify || auth_seal) {
 211                 RPC_HDR_AUTH rhdr_auth;
 212                 prs_struct auth_req;
 213                 char data[RPC_HDR_AUTH_LEN];
 214                 /*
 215                  * We set dp to be the end of the packet, minus the auth_len
 216                  * and the length of the header that preceeds the auth_data.
 217                  */
 218                 char *dp = prs_data_p(rdata) + len - auth_len - RPC_HDR_AUTH_LEN;
 219
 220                 if(dp - prs_data_p(rdata) > prs_data_size(rdata)) {
 221                         DEBUG(0,("rpc_auth_pipe: auth data > data size !\n"));
 222                         return False;
 223                 }
 224
 225                 memcpy(data, dp, sizeof(data));
 226
 227                 prs_init(&auth_req , 0, cli->mem_ctx, UNMARSHALL);
 228
 229                 /* The endianness must be preserved... JRA. */
 230
 231                 prs_set_endian_data(&auth_req, rdata->bigendian_data);
 232
 233                 prs_give_memory(&auth_req, data, RPC_HDR_AUTH_LEN, False);
 234
 235                 /*
 236                  * Unmarshall the 8 byte auth_header that comes before the
 237                  * auth data.
 238                  */
 239
 240                 if(!smb_io_rpc_hdr_auth("hdr_auth", &rhdr_auth, &auth_req, 0)) {
 241                         DEBUG(0,("rpc_auth_pipe: unmarshalling RPC_HDR_AUTH failed.\n"));
 242                         return False;
 243                 }
 244
 245                 if (!rpc_hdr_auth_chk(&rhdr_auth)) {
 246                         DEBUG(0,("rpc_auth_pipe: rpc_hdr_auth_chk failed.\n"));
 247                         return False;
 248                 }
 249         }
 250
 251         /*
 252          * Now unseal and check the auth verifier in the auth_data at
 253          * then end of the packet. The 4 bytes skipped in the unseal
 254          * seem to be a buffer pointer preceeding the sealed data.
 255          */
 256
 257         if (auth_verify) {
 258                 RPC_AUTH_NTLMSSP_CHK chk;
 259                 uint32 crc32;
 260                 prs_struct auth_verf;
 261                 char data[RPC_AUTH_NTLMSSP_CHK_LEN];
 262                 char *dp = prs_data_p(rdata) + len - auth_len;
 263
 264                 if(dp - prs_data_p(rdata) > prs_data_size(rdata)) {
 265                         DEBUG(0,("rpc_auth_pipe: auth data > data size !\n"));
 266                         return False;
 267                 }
 268
 269                 DEBUG(10,("rpc_auth_pipe: verify\n"));
 270                 dump_data(100, dp, auth_len);
 271                 NTLMSSPcalc_ap(cli, (uchar*)(dp+4), auth_len - 4);
 272
 273                 memcpy(data, dp, RPC_AUTH_NTLMSSP_CHK_LEN);
 274                 dump_data(100, data, auth_len);
 275
 276                 prs_init(&auth_verf, 0, cli->mem_ctx, UNMARSHALL);
 277
 278                 /* The endinness must be preserved. JRA. */
 279                 prs_set_endian_data( &auth_verf, rdata->bigendian_data);
 280
 281                 prs_give_memory(&auth_verf, data, RPC_AUTH_NTLMSSP_CHK_LEN, False);
 282
 283                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &chk, &auth_verf, 0)) {
 284                         DEBUG(0,("rpc_auth_pipe: unmarshalling RPC_AUTH_NTLMSSP_CHK failed.\n"));
 285                         return False;
 286                 }
 287
 288                 crc32 = crc32_calc_buffer(reply_data, data_len);
 289
 290                 if (!rpc_auth_ntlmssp_chk(&chk, crc32 , cli->ntlmssp_seq_num)) {
 291                         DEBUG(0,("rpc_auth_pipe: rpc_auth_ntlmssp_chk failed.\n"));
 292                         return False;
 293                 }
 294                 cli->ntlmssp_seq_num++;
 295         }
 296         return True;
 297 }
 298
 299
 300 /****************************************************************************
 301  Send data on an rpc pipe, which *must* be in one fragment.
 302  receive response data from an rpc pipe, which may be large...
 303
 304  Read the first fragment: unfortunately have to use SMBtrans for the first
 305  bit, then SMBreadX for subsequent bits.
 306
 307  If first fragment received also wasn't the last fragment, continue
 308  getting fragments until we _do_ receive the last fragment.
 309
 310  Request/Response PDU's look like the following...
 311
 312  |<------------------PDU len----------------------------------------------->|
 313  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 314
 315  +------------+-----------------+-------------+---------------+-------------+
 316  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 317  +------------+-----------------+-------------+---------------+-------------+
 318
 319  Where the presence of the AUTH_HDR and AUTH are dependent on the
 320  signing & sealing being neogitated.
 321
 322  ****************************************************************************/
 323
 324 static BOOL rpc_api_pipe(struct cli_state *cli, uint16 cmd, prs_struct *data, prs_struct *rdata)
 325 {
 326         uint32 len;
 327         char *rparam = NULL;
 328         uint32 rparam_len = 0;
 329         uint16 setup[2];
 330         BOOL first = True;
 331         BOOL last  = True;
 332         RPC_HDR rhdr;
 333         char *pdata = data ? prs_data_p(data) : NULL;
 334         uint32 data_len = data ? prs_offset(data) : 0;
 335         char *prdata = NULL;
 336         uint32 rdata_len = 0;
 337         uint32 current_offset = 0;
 338
 339         /* Create setup parameters - must be in native byte order. */
 340
 341         setup[0] = cmd;
 342         setup[1] = cli->nt_pipe_fnum; /* Pipe file handle. */
 343
 344         DEBUG(5,("rpc_api_pipe: cmd:%x fnum:%x\n", (int)cmd,
 345                  (int)cli->nt_pipe_fnum));
 346
 347         /* Send the RPC request and receive a response.  For short RPC
 348            calls (about 1024 bytes or so) the RPC request and response
 349            appears in a SMBtrans request and response.  Larger RPC
 350            responses are received further on. */
 351
 352         if (!cli_api_pipe(cli, "\\PIPE\\",
 353                   setup, 2, 0,                     /* Setup, length, max */
 354                   NULL, 0, 0,                      /* Params, length, max */
 355                   pdata, data_len, data_len,       /* data, length, max */
 356                   &rparam, &rparam_len,            /* return params, len */
 357                   &prdata, &rdata_len))            /* return data, len */
 358         {
 359                 DEBUG(0, ("cli_pipe: return critical error. Error was %s\n", cli_errstr(cli)));
 360                 return False;
 361         }
 362
 363         /* Throw away returned params - we know we won't use them. */
 364
 365         if(rparam) {
 366                 free(rparam);
 367                 rparam = NULL;
 368         }
 369
 370         if (prdata == NULL) {
 371                 DEBUG(0,("rpc_api_pipe: cmd %x on pipe %x failed to return data.\n",
 372                         (int)cmd, (int)cli->nt_pipe_fnum));
 373                 return False;
 374         }
 375
 376         /*
 377          * Give this memory as dynamically allocated to the return parse
 378          * struct.
 379          */
 380
 381         prs_give_memory(rdata, prdata, rdata_len, True);
 382         current_offset = rdata_len;
 383
 384         /* This next call sets the endian bit correctly in rdata. */
 385
 386         if (!rpc_check_hdr(rdata, &rhdr, &first, &last, &len)) {
 387                 prs_mem_free(rdata);
 388                 return False;
 389         }
 390
 391         if (rhdr.pkt_type == RPC_BINDACK) {
 392                 if (!last && !first) {
 393                         DEBUG(5,("rpc_api_pipe: bug in server (AS/U?), setting fragment first/last ON.\n"));
 394                         first = True;
 395                         last = True;
 396                 }
 397         }
 398
 399         if (rhdr.pkt_type == RPC_RESPONSE) {
 400                 RPC_HDR_RESP rhdr_resp;
 401                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, rdata, 0)) {
 402                         DEBUG(5,("rpc_api_pipe: failed to unmarshal RPC_HDR_RESP.\n"));
 403                         prs_mem_free(rdata);
 404                         return False;
 405                 }
 406         }
 407
 408         DEBUG(5,("rpc_api_pipe: len left: %u smbtrans read: %u\n",
 409                   (unsigned int)len, (unsigned int)rdata_len ));
 410
 411         /* check if data to be sent back was too large for one SMBtrans */
 412         /* err status is only informational: the _real_ check is on the
 413            length */
 414
 415         if (len > 0) {
 416                 /* || err == (0x80000000 | STATUS_BUFFER_OVERFLOW)) */
 417
 418                 /* Read the remaining part of the first response fragment */
 419
 420                 if (!rpc_read(cli, rdata, len, &current_offset)) {
 421                         prs_mem_free(rdata);
 422                         return False;
 423                 }
 424         }
 425
 426         /*
 427          * Now we have a complete PDU, check the auth struct if any was sent.
 428          */
 429
 430         if (rhdr.auth_len != 0) {
 431                 if(!rpc_auth_pipe(cli, rdata, rhdr.frag_len, rhdr.auth_len))
 432                         return False;
 433                 /*
 434                  * Drop the auth footers from the current offset.
 435                  * We need this if there are more fragments.
 436                  * The auth footers consist of the auth_data and the
 437                  * preceeding 8 byte auth_header.
 438                  */
 439                 current_offset -= (rhdr.auth_len + RPC_HDR_AUTH_LEN);
 440         }
 441
 442         /*
 443          * Only one rpc fragment, and it has been read.
 444          */
 445
 446         if (first && last) {
 447                 DEBUG(6,("rpc_api_pipe: fragment first and last both set\n"));
 448                 return True;
 449         }
 450
 451         /*
 452          * Read more fragments using SMBreadX until we get one with the
 453          * last bit set.
 454          */
 455
 456         while (!last) {
 457                 RPC_HDR_RESP rhdr_resp;
 458                 int num_read;
 459                 char hdr_data[RPC_HEADER_LEN+RPC_HDR_RESP_LEN];
 460                 prs_struct hps;
 461                 uint8 eclass;
 462                 uint32 ecode;
 463
 464                 /*
 465                  * First read the header of the next PDU.
 466                  */
 467
 468                 prs_init(&hps, 0, cli->mem_ctx, UNMARSHALL);
 469                 prs_give_memory(&hps, hdr_data, sizeof(hdr_data), False);
 470
 471                 num_read = cli_read(cli, cli->nt_pipe_fnum, hdr_data, 0, RPC_HEADER_LEN+RPC_HDR_RESP_LEN);
 472                 if (cli_is_dos_error(cli) &&
 473                     cli_dos_error(cli, &eclass, &ecode) &&
 474                     (eclass != ERRDOS && ecode != ERRmoredata)) {
 475                         DEBUG(0,("rpc_api_pipe: cli_read error : %d/%d\n",
 476                                  eclass, ecode));
 477                         return False;
 478                 }
 479
 480                 DEBUG(5,("rpc_api_pipe: read header (size:%d)\n", num_read));
 481
 482                 if (num_read != RPC_HEADER_LEN+RPC_HDR_RESP_LEN) {
 483                         DEBUG(0,("rpc_api_pipe: Error : requested %d bytes, got %d.\n",
 484                                 RPC_HEADER_LEN+RPC_HDR_RESP_LEN, num_read ));
 485                         return False;
 486                 }
 487
 488                 /* This call sets the endianness in hps. */
 489
 490                 if (!rpc_check_hdr(&hps, &rhdr, &first, &last, &len))
 491                         return False;
 492
 493                 /* Ensure the endianness in rdata is set correctly - must be same as hps. */
 494
 495                 if (hps.bigendian_data != rdata->bigendian_data) {
 496                         DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to %s\n",
 497                                 rdata->bigendian_data ? "big" : "little",
 498                                 hps.bigendian_data ? "big" : "little" ));
 499                         return False;
 500                 }
 501
 502                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, &hps, 0)) {
 503                         DEBUG(0,("rpc_api_pipe: Error in unmarshalling RPC_HDR_RESP.\n"));
 504                         return False;
 505                 }
 506
 507                 if (first) {
 508                         DEBUG(0,("rpc_api_pipe: secondary PDU rpc header has 'first' set !\n"));
 509                         return False;
 510                 }
 511
 512                 /*
 513                  * Now read the rest of the PDU.
 514                  */
 515
 516                 if (!rpc_read(cli, rdata, len, &current_offset))
 517                         return False;
 518
 519                 /*
 520                  * Verify any authentication footer.
 521                  */
 522
 523                 if (rhdr.auth_len != 0 ) {
 524                         if(!rpc_auth_pipe(cli, rdata, rhdr.frag_len, rhdr.auth_len))
 525                                 return False;
 526                         /*
 527                          * Drop the auth footers from the current offset.
 528                          * The auth footers consist of the auth_data and the
 529                          * preceeding 8 byte auth_header.
 530                          * We need this if there are more fragments.
 531                          */
 532                         current_offset -= (rhdr.auth_len + RPC_HDR_AUTH_LEN);
 533                 }
 534         }
 535
 536         return True;
 537 }
 538
 539 /*******************************************************************
 540  creates a DCE/RPC bind request
 541
 542  - initialises the parse structure.
 543  - dynamically allocates the header data structure
 544  - caller is expected to free the header data structure once used.
 545
 546  ********************************************************************/
 547
 548 static BOOL create_rpc_bind_req(prs_struct *rpc_out, BOOL do_auth, uint32 rpc_call_id,
 549                                 RPC_IFACE *abstract, RPC_IFACE *transfer,
 550                                 char *my_name, char *domain, uint32 neg_flags)
 551 {
 552         RPC_HDR hdr;
 553         RPC_HDR_RB hdr_rb;
 554         char buffer[4096];
 555         prs_struct auth_info;
 556         int auth_len = 0;
 557
 558         prs_init(&auth_info, 0, prs_get_mem_context(rpc_out), MARSHALL);
 559
 560         if (do_auth) {
 561                 RPC_HDR_AUTH hdr_auth;
 562                 RPC_AUTH_VERIFIER auth_verifier;
 563                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 564
 565                 /*
 566                  * Create the auth structs we will marshall.
 567                  */
 568
 569                 init_rpc_hdr_auth(&hdr_auth, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, 0x00, 1);
 570                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_NEGOTIATE);
 571                 init_rpc_auth_ntlmssp_neg(&ntlmssp_neg, neg_flags, my_name, domain);
 572
 573                 /*
 574                  * Use the 4k buffer to store the auth info.
 575                  */
 576
 577                 prs_give_memory( &auth_info, buffer, sizeof(buffer), False);
 578
 579                 /*
 580                  * Now marshall the data into the temporary parse_struct.
 581                  */
 582
 583                 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &auth_info, 0)) {
 584                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_AUTH.\n"));
 585                         return False;
 586                 }
 587
 588                 if(!smb_io_rpc_auth_verifier("auth_verifier", &auth_verifier, &auth_info, 0)) {
 589                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_AUTH_VERIFIER.\n"));
 590                         return False;
 591                 }
 592
 593                 if(!smb_io_rpc_auth_ntlmssp_neg("ntlmssp_neg", &ntlmssp_neg, &auth_info, 0)) {
 594                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_AUTH_NTLMSSP_NEG.\n"));
 595                         return False;
 596                 }
 597
 598                 /* Auth len in the rpc header doesn't include auth_header. */
 599                 auth_len = prs_offset(&auth_info) - RPC_HDR_AUTH_LEN;
 600         }
 601
 602         /* create the request RPC_HDR */
 603         init_rpc_hdr(&hdr, RPC_BIND, 0x0, rpc_call_id,
 604                 RPC_HEADER_LEN + RPC_HDR_RB_LEN + prs_offset(&auth_info),
 605                 auth_len);
 606
 607         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
 608                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR.\n"));
 609                 return False;
 610         }
 611
 612         /* create the bind request RPC_HDR_RB */
 613         init_rpc_hdr_rb(&hdr_rb, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN, 0x0,
 614                         0x1, 0x0, 0x1, abstract, transfer);
 615
 616         /* Marshall the bind request data */
 617         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
 618                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_RB.\n"));
 619                 return False;
 620         }
 621
 622         /*
 623          * Grow the outgoing buffer to store any auth info.
 624          */
 625
 626         if(hdr.auth_len != 0) {
 627                 if(!prs_append_prs_data( rpc_out, &auth_info)) {
 628                         DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 629                         return False;
 630                 }
 631         }
 632
 633         return True;
 634 }
 635
 636 /*******************************************************************
 637  Creates a DCE/RPC bind authentication response.
 638  This is the packet that is sent back to the server once we
 639  have received a BIND-ACK, to finish the third leg of
 640  the authentication handshake.
 641  ********************************************************************/
 642
 643 static BOOL create_rpc_bind_resp(struct pwd_info *pwd,
 644                                 char *domain, char *user_name, char *my_name,
 645                                 uint32 ntlmssp_cli_flgs,
 646                                 uint32 rpc_call_id,
 647                                 prs_struct *rpc_out)
 648 {
 649         unsigned char lm_owf[24];
 650         unsigned char nt_owf[24];
 651         RPC_HDR hdr;
 652         RPC_HDR_AUTHA hdr_autha;
 653         RPC_AUTH_VERIFIER auth_verifier;
 654         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 655         char buffer[4096];
 656         prs_struct auth_info;
 657
 658         /*
 659          * Marshall the variable length data into a temporary parse
 660          * struct, pointing into a 4k local buffer.
 661          */
 662         prs_init(&auth_info, 0, prs_get_mem_context(rpc_out), MARSHALL);
 663
 664         /*
 665          * Use the 4k buffer to store the auth info.
 666          */
 667
 668         prs_give_memory( &auth_info, buffer, sizeof(buffer), False);
 669
 670         /*
 671          * Create the variable length auth_data.
 672          */
 673
 674         init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH);
 675
 676         pwd_get_lm_nt_owf(pwd, lm_owf, nt_owf);
 677
 678         init_rpc_auth_ntlmssp_resp(&ntlmssp_resp,
 679                                  lm_owf, nt_owf,
 680                                  domain, user_name, my_name,
 681                                  ntlmssp_cli_flgs);
 682
 683         /*
 684          * Marshall the variable length auth_data into a temp parse_struct.
 685          */
 686
 687         if(!smb_io_rpc_auth_verifier("auth_verifier", &auth_verifier, &auth_info, 0)) {
 688                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_AUTH_VERIFIER.\n"));
 689                 return False;
 690         }
 691
 692         if(!smb_io_rpc_auth_ntlmssp_resp("ntlmssp_resp", &ntlmssp_resp, &auth_info, 0)) {
 693                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_AUTH_NTLMSSP_RESP.\n"));
 694                 return False;
 695         }
 696
 697         /* Create the request RPC_HDR */
 698         init_rpc_hdr(&hdr, RPC_BINDRESP, 0x0, rpc_call_id,
 699                         RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN + prs_offset(&auth_info),
 700                         prs_offset(&auth_info) );
 701
 702         /* Marshall it. */
 703         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
 704                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR.\n"));
 705                 return False;
 706         }
 707
 708         /* Create the request RPC_HDR_AUTHA */
 709         init_rpc_hdr_autha(&hdr_autha, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN,
 710                         NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, 0x00);
 711
 712         if(!smb_io_rpc_hdr_autha("hdr_autha", &hdr_autha, rpc_out, 0)) {
 713                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR_AUTHA.\n"));
 714                 return False;
 715         }
 716
 717         /*
 718          * Append the auth data to the outgoing buffer.
 719          */
 720
 721         if(!prs_append_prs_data(rpc_out, &auth_info)) {
 722                 DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 723                 return False;
 724         }
 725
 726         return True;
 727 }
 728
 729
 730 /*******************************************************************
 731  Creates a DCE/RPC request.
 732  ********************************************************************/
 733
 734 static BOOL create_rpc_request(prs_struct *rpc_out, uint8 op_num, int data_len, int auth_len)
 735 {
 736         uint32 alloc_hint;
 737         RPC_HDR     hdr;
 738         RPC_HDR_REQ hdr_req;
 739
 740         DEBUG(5,("create_rpc_request: opnum: 0x%x data_len: 0x%x\n", op_num, data_len));
 741
 742         /* create the rpc header RPC_HDR */
 743         init_rpc_hdr(&hdr, RPC_REQUEST, RPC_FLG_FIRST | RPC_FLG_LAST,
 744                      get_rpc_call_id(), data_len, auth_len);
 745
 746         /*
 747          * The alloc hint should be the amount of data, not including
 748          * RPC headers & footers.
 749          */
 750
 751         if (auth_len != 0)
 752                 alloc_hint = data_len - RPC_HEADER_LEN - RPC_HDR_AUTH_LEN - auth_len;
 753         else
 754                 alloc_hint = data_len - RPC_HEADER_LEN;
 755
 756         DEBUG(10,("create_rpc_request: data_len: %x auth_len: %x alloc_hint: %x\n",
 757                    data_len, auth_len, alloc_hint));
 758
 759         /* Create the rpc request RPC_HDR_REQ */
 760         init_rpc_hdr_req(&hdr_req, alloc_hint, op_num);
 761
 762         /* stream-time... */
 763         if(!smb_io_rpc_hdr("hdr    ", &hdr, rpc_out, 0))
 764                 return False;
 765
 766         if(!smb_io_rpc_hdr_req("hdr_req", &hdr_req, rpc_out, 0))
 767                 return False;
 768
 769         if (prs_offset(rpc_out) != RPC_HEADER_LEN + RPC_HDR_REQ_LEN)
 770                 return False;
 771
 772         return True;
 773 }
 774
 775
 776 /****************************************************************************
 777  Send a request on an rpc pipe.
 778  ****************************************************************************/
 779
 780 BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num,
 781                       prs_struct *data, prs_struct *rdata)
 782 {
 783         prs_struct outgoing_packet;
 784         uint32 data_len;
 785         uint32 auth_len;
 786         BOOL ret;
 787         BOOL auth_verify;
 788         BOOL auth_seal;
 789         uint32 crc32 = 0;
 790         char *pdata_out = NULL;
 791
 792         auth_verify = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SIGN) != 0);
 793         auth_seal   = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SEAL) != 0);
 794
 795         /*
 796          * The auth_len doesn't include the RPC_HDR_AUTH_LEN.
 797          */
 798
 799         auth_len = (auth_verify ? RPC_AUTH_NTLMSSP_CHK_LEN : 0);
 800
 801         /*
 802          * PDU len is header, plus request header, plus data, plus
 803          * auth_header_len (if present), plus auth_len (if present).
 804          * NB. The auth stuff should be aligned on an 8 byte boundary
 805          * to be totally DCE/RPC spec complient. For now we cheat and
 806          * hope that the data structs defined are a multiple of 8 bytes.
 807          */
 808
 809         if((prs_offset(data) % 8) != 0) {
 810                 DEBUG(5,("rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....\n"));
 811         }
 812
 813         data_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + prs_offset(data) +
 814                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) + auth_len;
 815
 816         /*
 817          * Malloc a parse struct to hold it (and enough for alignments).
 818          */
 819
 820         if(!prs_init(&outgoing_packet, data_len + 8, cli->mem_ctx, MARSHALL)) {
 821                 DEBUG(0,("rpc_api_pipe_req: Failed to malloc %u bytes.\n", (unsigned int)data_len ));
 822                 return False;
 823         }
 824
 825         pdata_out = prs_data_p(&outgoing_packet);
 826
 827         /*
 828          * Write out the RPC header and the request header.
 829          */
 830
 831         if(!create_rpc_request(&outgoing_packet, op_num, data_len, auth_len)) {
 832                 DEBUG(0,("rpc_api_pipe_req: Failed to create RPC request.\n"));
 833                 prs_mem_free(&outgoing_packet);
 834                 return False;
 835         }
 836
 837         /*
 838          * Seal the outgoing data if requested.
 839          */
 840
 841         if (auth_seal) {
 842                 crc32 = crc32_calc_buffer(prs_data_p(data), prs_offset(data));
 843                 NTLMSSPcalc_ap(cli, (unsigned char*)prs_data_p(data), prs_offset(data));
 844         }
 845
 846         /*
 847          * Now copy the data into the outgoing packet.
 848          */
 849
 850         if(!prs_append_prs_data( &outgoing_packet, data)) {
 851                 DEBUG(0,("rpc_api_pipe_req: Failed to append data to outgoing packet.\n"));
 852                 prs_mem_free(&outgoing_packet);
 853                 return False;
 854         }
 855
 856         /*
 857          * Add a trailing auth_verifier if needed.
 858          */
 859
 860         if (auth_seal || auth_verify) {
 861                 RPC_HDR_AUTH hdr_auth;
 862
 863                 init_rpc_hdr_auth(&hdr_auth, NTLMSSP_AUTH_TYPE,
 864                         NTLMSSP_AUTH_LEVEL, 0x08, (auth_verify ? 1 : 0));
 865                 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &outgoing_packet, 0)) {
 866                         DEBUG(0,("rpc_api_pipe_req: Failed to marshal RPC_HDR_AUTH.\n"));
 867                         prs_mem_free(&outgoing_packet);
 868                         return False;
 869                 }
 870         }
 871
 872         /*
 873          * Finally the auth data itself.
 874          */
 875
 876         if (auth_verify) {
 877                 RPC_AUTH_NTLMSSP_CHK chk;
 878                 uint32 current_offset = prs_offset(&outgoing_packet);
 879
 880                 init_rpc_auth_ntlmssp_chk(&chk, NTLMSSP_SIGN_VERSION, crc32, cli->ntlmssp_seq_num++);
 881                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &chk, &outgoing_packet, 0)) {
 882                         DEBUG(0,("rpc_api_pipe_req: Failed to marshal RPC_AUTH_NTLMSSP_CHK.\n"));
 883                         prs_mem_free(&outgoing_packet);
 884                         return False;
 885                 }
 886                 NTLMSSPcalc_ap(cli, (unsigned char*)&pdata_out[current_offset+4], RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 887         }
 888
 889         DEBUG(100,("data_len: %x data_calc_len: %x\n", data_len, prs_offset(&outgoing_packet)));
 890
 891         ret = rpc_api_pipe(cli, 0x0026, &outgoing_packet, rdata);
 892
 893         prs_mem_free(&outgoing_packet);
 894
 895         return ret;
 896 }
 897
 898 /****************************************************************************
 899  Set the handle state.
 900 ****************************************************************************/
 901
 902 static BOOL rpc_pipe_set_hnd_state(struct cli_state *cli, char *pipe_name, uint16 device_state)
 903 {
 904         BOOL state_set = False;
 905         char param[2];
 906         uint16 setup[2]; /* only need 2 uint16 setup parameters */
 907         char *rparam = NULL;
 908         char *rdata = NULL;
 909         uint32 rparam_len, rdata_len;
 910
 911         if (pipe_name == NULL)
 912                 return False;
 913
 914         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
 915         cli->nt_pipe_fnum, pipe_name, device_state));
 916
 917         /* create parameters: device state */
 918         SSVAL(param, 0, device_state);
 919
 920         /* create setup parameters. */
 921         setup[0] = 0x0001;
 922         setup[1] = cli->nt_pipe_fnum; /* pipe file handle.  got this from an SMBOpenX. */
 923
 924         /* send the data on \PIPE\ */
 925         if (cli_api_pipe(cli, "\\PIPE\\",
 926                     setup, 2, 0,                /* setup, length, max */
 927                     param, 2, 0,                /* param, length, max */
 928                     NULL, 0, 1024,              /* data, length, max */
 929                     &rparam, &rparam_len,        /* return param, length */
 930                     &rdata, &rdata_len))         /* return data, length */
 931         {
 932                 DEBUG(5, ("Set Handle state: return OK\n"));
 933                 state_set = True;
 934         }
 935
 936         if (rparam)
 937                 free(rparam);
 938         if (rdata)
 939                 free(rdata );
 940
 941         return state_set;
 942 }
 943
 944 /****************************************************************************
 945  check the rpc bind acknowledge response
 946 ****************************************************************************/
 947
 948 static BOOL valid_pipe_name(char *pipe_name, RPC_IFACE *abstract, RPC_IFACE *transfer)
 949 {
 950         int pipe_idx = 0;
 951
 952         while (pipe_names[pipe_idx].client_pipe != NULL) {
 953                 if (strequal(pipe_name, pipe_names[pipe_idx].client_pipe )) {
 954                         DEBUG(5,("Bind Abstract Syntax: "));
 955                         dump_data(5, (char*)&(pipe_names[pipe_idx].abstr_syntax),
 956                                   sizeof(pipe_names[pipe_idx].abstr_syntax));
 957                         DEBUG(5,("Bind Transfer Syntax: "));
 958                         dump_data(5, (char*)&(pipe_names[pipe_idx].trans_syntax),
 959                                   sizeof(pipe_names[pipe_idx].trans_syntax));
 960
 961                         /* copy the required syntaxes out so we can do the right bind */
 962                         *transfer = pipe_names[pipe_idx].trans_syntax;
 963                         *abstract = pipe_names[pipe_idx].abstr_syntax;
 964
 965                         return True;
 966                 }
 967                 pipe_idx++;
 968         };
 969
 970         DEBUG(5,("Bind RPC Pipe[%s] unsupported\n", pipe_name));
 971         return False;
 972 }
 973
 974 /****************************************************************************
 975  check the rpc bind acknowledge response
 976 ****************************************************************************/
 977
 978 static BOOL check_bind_response(RPC_HDR_BA *hdr_ba, char *pipe_name, RPC_IFACE *transfer)
 979 {
 980         int i = 0;
 981
 982         while ((pipe_names[i].client_pipe != NULL) && hdr_ba->addr.len > 0) {
 983                 if ((strequal(pipe_name, pipe_names[i].client_pipe ))) {
 984                         if (strequal(hdr_ba->addr.str, pipe_names[i].server_pipe )) {
 985                                 DEBUG(5,("bind_rpc_pipe: server pipe_name found: %s\n",
 986                                          pipe_names[i].server_pipe ));
 987                                 break;
 988                         } else {
 989                                 DEBUG(4,("bind_rpc_pipe: pipe_name %s != expected pipe %s.  oh well!\n",
 990                                          pipe_names[i].server_pipe ,
 991                                          hdr_ba->addr.str));
 992                                 break;
 993                         }
 994                 } else {
 995                         i++;
 996                 }
 997         }
 998
 999         if (pipe_names[i].server_pipe == NULL) {
1000                 DEBUG(2,("bind_rpc_pipe: pipe name %s unsupported\n", hdr_ba->addr.str));
1001                 return False;
1002         }
1003
1004         /* check the transfer syntax */
1005         if ((hdr_ba->transfer.version != transfer->version) ||
1006              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1007                 DEBUG(0,("bind_rpc_pipe: transfer syntax differs\n"));
1008                 return False;
1009         }
1010
1011         /* lkclXXXX only accept one result: check the result(s) */
1012         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
1013                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1014                           hdr_ba->res.num_results, hdr_ba->res.reason));
1015         }
1016
1017         DEBUG(5,("bind_rpc_pipe: accepted!\n"));
1018         return True;
1019 }
1020
1021 /****************************************************************************
1022  Create and send the third packet in an RPC auth.
1023 ****************************************************************************/
1024
1025 static BOOL rpc_send_auth_reply(struct cli_state *cli, prs_struct *rdata, uint32 rpc_call_id)
1026 {
1027         RPC_HDR_AUTH rhdr_auth;
1028         RPC_AUTH_VERIFIER rhdr_verf;
1029         RPC_AUTH_NTLMSSP_CHAL rhdr_chal;
1030         char buffer[MAX_PDU_FRAG_LEN];
1031         prs_struct rpc_out;
1032         ssize_t ret;
1033
1034         unsigned char p24[24];
1035         unsigned char lm_owf[24];
1036         unsigned char lm_hash[16];
1037
1038         if(!smb_io_rpc_hdr_auth("", &rhdr_auth, rdata, 0)) {
1039                 DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_HDR_AUTH.\n"));
1040                 return False;
1041         }
1042         if(!smb_io_rpc_auth_verifier("", &rhdr_verf, rdata, 0)) {
1043                 DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_AUTH_VERIFIER.\n"));
1044                 return False;
1045         }
1046         if(!smb_io_rpc_auth_ntlmssp_chal("", &rhdr_chal, rdata, 0)) {
1047                 DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_AUTH_NTLMSSP_CHAL.\n"));
1048                 return False;
1049         }
1050
1051         cli->ntlmssp_cli_flgs = rhdr_chal.neg_flags;
1052
1053         pwd_make_lm_nt_owf(&cli->pwd, rhdr_chal.challenge);
1054
1055         prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL);
1056
1057         prs_give_memory( &rpc_out, buffer, sizeof(buffer), False);
1058
1059         create_rpc_bind_resp(&cli->pwd, cli->domain,
1060                              cli->user_name, global_myname,
1061                              cli->ntlmssp_cli_flgs, rpc_call_id,
1062                              &rpc_out);
1063
1064         pwd_get_lm_nt_owf(&cli->pwd, lm_owf, NULL);
1065         pwd_get_lm_nt_16(&cli->pwd, lm_hash, NULL);
1066
1067         NTLMSSPOWFencrypt(lm_hash, lm_owf, p24);
1068
1069         {
1070                 unsigned char j = 0;
1071                 int ind;
1072                 unsigned char k2[8];
1073
1074                 memcpy(k2, p24, 5);
1075                 k2[5] = 0xe5;
1076                 k2[6] = 0x38;
1077                 k2[7] = 0xb0;
1078
1079                 for (ind = 0; ind < 256; ind++)
1080                         cli->ntlmssp_hash[ind] = (unsigned char)ind;
1081
1082                 for( ind = 0; ind < 256; ind++) {
1083                         unsigned char tc;
1084
1085                         j += (cli->ntlmssp_hash[ind] + k2[ind%8]);
1086
1087                         tc = cli->ntlmssp_hash[ind];
1088                         cli->ntlmssp_hash[ind] = cli->ntlmssp_hash[j];
1089                         cli->ntlmssp_hash[j] = tc;
1090                 }
1091
1092                 cli->ntlmssp_hash[256] = 0;
1093                 cli->ntlmssp_hash[257] = 0;
1094         }
1095
1096         memset((char *)lm_hash, '\0', sizeof(lm_hash));
1097
1098         if ((ret = cli_write(cli, cli->nt_pipe_fnum, 0x8, prs_data_p(&rpc_out),
1099                         0, (size_t)prs_offset(&rpc_out))) != (ssize_t)prs_offset(&rpc_out)) {
1100                 DEBUG(0,("rpc_send_auth_reply: cli_write failed. Return was %d\n", (int)ret));
1101                 return False;
1102         }
1103
1104         cli->ntlmssp_srv_flgs = rhdr_chal.neg_flags;
1105         return True;
1106 }
1107
1108 /****************************************************************************
1109  Do an rpc bind.
1110 ****************************************************************************/
1111
1112 BOOL rpc_pipe_bind(struct cli_state *cli, char *pipe_name, char *my_name)
1113 {
1114         RPC_IFACE abstract;
1115         RPC_IFACE transfer;
1116         prs_struct rpc_out;
1117         prs_struct rdata;
1118         BOOL do_auth = (cli->ntlmssp_cli_flgs != 0);
1119         uint32 rpc_call_id;
1120         char buffer[MAX_PDU_FRAG_LEN];
1121
1122         DEBUG(5,("Bind RPC Pipe[%x]: %s\n", cli->nt_pipe_fnum, pipe_name));
1123
1124         if (!valid_pipe_name(pipe_name, &abstract, &transfer))
1125                 return False;
1126
1127         prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL);
1128
1129         /*
1130          * Use the MAX_PDU_FRAG_LEN buffer to store the bind request.
1131          */
1132
1133         prs_give_memory( &rpc_out, buffer, sizeof(buffer), False);
1134
1135         rpc_call_id = get_rpc_call_id();
1136
1137         /* Marshall the outgoing data. */
1138         create_rpc_bind_req(&rpc_out, do_auth, rpc_call_id,
1139                             &abstract, &transfer,
1140                             global_myname, cli->domain, cli->ntlmssp_cli_flgs);
1141
1142         /* Initialize the incoming data struct. */
1143         prs_init(&rdata, 0, cli->mem_ctx, UNMARSHALL);
1144
1145         /* send data on \PIPE\.  receive a response */
1146         if (rpc_api_pipe(cli, 0x0026, &rpc_out, &rdata)) {
1147                 RPC_HDR_BA   hdr_ba;
1148
1149                 DEBUG(5, ("rpc_pipe_bind: rpc_api_pipe returned OK.\n"));
1150
1151                 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &rdata, 0)) {
1152                         DEBUG(0,("rpc_pipe_bind: Failed to unmarshall RPC_HDR_BA.\n"));
1153                         prs_mem_free(&rdata);
1154                         return False;
1155                 }
1156
1157                 if(!check_bind_response(&hdr_ba, pipe_name, &transfer)) {
1158                         DEBUG(0,("rpc_pipe_bind: check_bind_response failed.\n"));
1159                         prs_mem_free(&rdata);
1160                         return False;
1161                 }
1162
1163                 cli->max_xmit_frag = hdr_ba.bba.max_tsize;
1164                 cli->max_recv_frag = hdr_ba.bba.max_rsize;
1165
1166                 /*
1167                  * If we're doing NTLMSSP auth we need to send a reply to
1168                  * the bind-ack to complete the 3-way challenge response
1169                  * handshake.
1170                  */
1171
1172                 if (do_auth && !rpc_send_auth_reply(cli, &rdata, rpc_call_id)) {
1173                         DEBUG(0,("rpc_pipe_bind: rpc_send_auth_reply failed.\n"));
1174                         prs_mem_free(&rdata);
1175                         return False;
1176                 }
1177         }
1178
1179         prs_mem_free(&rdata);
1180         return True;
1181 }
1182
1183 /****************************************************************************
1184  Set ntlmssp negotiation flags.
1185  ****************************************************************************/
1186
1187 void cli_nt_set_ntlmssp_flgs(struct cli_state *cli, uint32 ntlmssp_flgs)
1188 {
1189         cli->ntlmssp_cli_flgs = ntlmssp_flgs;
1190 }
1191
1192
1193 /****************************************************************************
1194  Open a session.
1195  ****************************************************************************/
1196
1197 BOOL cli_nt_session_open(struct cli_state *cli, char *pipe_name)
1198 {
1199         int fnum;
1200
1201         SMB_ASSERT(cli->nt_pipe_fnum == 0);
1202
1203         if (cli->capabilities & CAP_NT_SMBS) {
1204                 if ((fnum = cli_nt_create(cli, &(pipe_name[5]), DESIRED_ACCESS_PIPE)) == -1) {
1205                         DEBUG(0,("cli_nt_session_open: cli_nt_create failed on pipe %s to machine %s.  Error was %s\n",
1206                                  &(pipe_name[5]), cli->desthost, cli_errstr(cli)));
1207                         return False;
1208                 }
1209
1210                 cli->nt_pipe_fnum = (uint16)fnum;
1211         } else {
1212                 if ((fnum = cli_open(cli, pipe_name, O_CREAT|O_RDWR, DENY_NONE)) == -1) {
1213                         DEBUG(0,("cli_nt_session_open: cli_open failed on pipe %s to machine %s.  Error was %s\n",
1214                                  pipe_name, cli->desthost, cli_errstr(cli)));
1215                         return False;
1216                 }
1217
1218                 cli->nt_pipe_fnum = (uint16)fnum;
1219
1220                 /**************** Set Named Pipe State ***************/
1221                 if (!rpc_pipe_set_hnd_state(cli, pipe_name, 0x4300)) {
1222                         DEBUG(0,("cli_nt_session_open: pipe hnd state failed.  Error was %s\n",
1223                                   cli_errstr(cli)));
1224                         cli_close(cli, cli->nt_pipe_fnum);
1225                         return False;
1226                 }
1227         }
1228
1229         /******************* bind request on pipe *****************/
1230
1231         if (!rpc_pipe_bind(cli, pipe_name, global_myname)) {
1232                 DEBUG(0,("cli_nt_session_open: rpc bind failed. Error was %s\n",
1233                           cli_errstr(cli)));
1234                 cli_close(cli, cli->nt_pipe_fnum);
1235                 return False;
1236         }
1237
1238         /*
1239          * Setup the remote server name prefixed by \ and the machine account name.
1240          */
1241
1242         fstrcpy(cli->srv_name_slash, "\\\\");
1243         fstrcat(cli->srv_name_slash, cli->desthost);
1244         strupper(cli->srv_name_slash);
1245
1246         fstrcpy(cli->clnt_name_slash, "\\\\");
1247         fstrcat(cli->clnt_name_slash, global_myname);
1248         strupper(cli->clnt_name_slash);
1249
1250         fstrcpy(cli->mach_acct, global_myname);
1251         fstrcat(cli->mach_acct, "$");
1252         strupper(cli->mach_acct);
1253
1254         return True;
1255 }
1256
1257 /****************************************************************************
1258 close the session
1259 ****************************************************************************/
1260
1261 void cli_nt_session_close(struct cli_state *cli)
1262 {
1263         cli_close(cli, cli->nt_pipe_fnum);
1264         cli->nt_pipe_fnum = 0;
1265 }