source/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                       1998.
   7  *  Copyright (C) Jeremy Allison                    1999.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24 #include "includes.h"
  25
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_RPC_CLI
  28
  29 extern struct pipe_id_info pipe_names[];
  30
  31 /********************************************************************
  32  Rpc pipe call id.
  33  ********************************************************************/
  34
  35 static uint32 get_rpc_call_id(void)
  36 {
  37         static uint32 call_id = 0;
  38         return ++call_id;
  39 }
  40
  41 /*******************************************************************
  42  Use SMBreadX to get rest of one fragment's worth of rpc data.
  43  ********************************************************************/
  44
  45 static BOOL rpc_read(struct cli_state *cli, prs_struct *rdata, uint32 data_to_read, uint32 *rdata_offset)
  46 {
  47         size_t size = (size_t)cli->max_recv_frag;
  48         int stream_offset = 0;
  49         int num_read;
  50         char *pdata;
  51         int extra_data_size = ((int)*rdata_offset) + ((int)data_to_read) - (int)prs_data_size(rdata);
  52
  53         DEBUG(5,("rpc_read: data_to_read: %u rdata offset: %u extra_data_size: %d\n",
  54                 (int)data_to_read, (unsigned int)*rdata_offset, extra_data_size));
  55
  56         /*
  57          * Grow the buffer if needed to accommodate the data to be read.
  58          */
  59
  60         if (extra_data_size > 0) {
  61                 if(!prs_force_grow(rdata, (uint32)extra_data_size)) {
  62                         DEBUG(0,("rpc_read: Failed to grow parse struct by %d bytes.\n", extra_data_size ));
  63                         return False;
  64                 }
  65                 DEBUG(5,("rpc_read: grew buffer by %d bytes to %u\n", extra_data_size, prs_data_size(rdata) ));
  66         }
  67
  68         pdata = prs_data_p(rdata) + *rdata_offset;
  69
  70         do /* read data using SMBreadX */
  71         {
  72                 uint32 ecode;
  73                 uint8 eclass;
  74
  75                 if (size > (size_t)data_to_read)
  76                         size = (size_t)data_to_read;
  77
  78                 num_read = (int)cli_read(cli, cli->nt_pipe_fnum, pdata, (off_t)stream_offset, size);
  79
  80                 DEBUG(5,("rpc_read: num_read = %d, read offset: %d, to read: %d\n",
  81                           num_read, stream_offset, data_to_read));
  82
  83                 if (cli_is_dos_error(cli)) {
  84                         cli_dos_error(cli, &eclass, &ecode);
  85                         if (eclass != ERRDOS && ecode != ERRmoredata) {
  86                                 DEBUG(0,("rpc_read: Error %d/%u in cli_read\n",
  87                                          eclass, (unsigned int)ecode));
  88                                 return False;
  89                         }
  90                 }
  91
  92                 data_to_read -= num_read;
  93                 stream_offset += num_read;
  94                 pdata += num_read;
  95
  96         } while (num_read > 0 && data_to_read > 0);
  97         /* && err == (0x80000000 | STATUS_BUFFER_OVERFLOW)); */
  98
  99         /*
 100          * Update the current offset into rdata by the amount read.
 101          */
 102         *rdata_offset += stream_offset;
 103
 104         return True;
 105 }
 106
 107 /****************************************************************************
 108  Checks the header. This will set the endian bit in the rdata prs_struct. JRA.
 109  ****************************************************************************/
 110
 111 static BOOL rpc_check_hdr(prs_struct *rdata, RPC_HDR *rhdr,
 112                           BOOL *first, BOOL *last, uint32 *len)
 113 {
 114         DEBUG(5,("rpc_check_hdr: rdata->data_size = %u\n", (uint32)prs_data_size(rdata) ));
 115
 116         /* Next call sets endian bit. */
 117
 118         if(!smb_io_rpc_hdr("rpc_hdr   ", rhdr, rdata, 0)) {
 119                 DEBUG(0,("rpc_check_hdr: Failed to unmarshall RPC_HDR.\n"));
 120                 return False;
 121         }
 122
 123         if (prs_offset(rdata) != RPC_HEADER_LEN) {
 124                 DEBUG(0,("rpc_check_hdr: offset was %x, should be %x.\n", prs_offset(rdata), RPC_HEADER_LEN));
 125                 return False;
 126         }
 127
 128         (*first) = ((rhdr->flags & RPC_FLG_FIRST) != 0);
 129         (*last) = ((rhdr->flags & RPC_FLG_LAST ) != 0);
 130         (*len) = (uint32)rhdr->frag_len - prs_data_size(rdata);
 131
 132         return (rhdr->pkt_type != RPC_FAULT);
 133 }
 134
 135 static void NTLMSSPcalc_ap( struct cli_state *cli, unsigned char *data, uint32 len)
 136 {
 137         unsigned char *hash = cli->ntlmssp_hash;
 138         unsigned char index_i = hash[256];
 139         unsigned char index_j = hash[257];
 140         int ind;
 141
 142         for( ind = 0; ind < len; ind++) {
 143                 unsigned char tc;
 144                 unsigned char t;
 145
 146                 index_i++;
 147                 index_j += hash[index_i];
 148
 149                 tc = hash[index_i];
 150                 hash[index_i] = hash[index_j];
 151                 hash[index_j] = tc;
 152
 153                 t = hash[index_i] + hash[index_j];
 154                 data[ind] = data[ind] ^ hash[t];
 155         }
 156
 157         hash[256] = index_i;
 158         hash[257] = index_j;
 159 }
 160
 161 /****************************************************************************
 162  Verify data on an rpc pipe.
 163  The VERIFY & SEAL code is only executed on packets that look like this :
 164
 165  Request/Response PDU's look like the following...
 166
 167  |<------------------PDU len----------------------------------------------->|
 168  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 169
 170  +------------+-----------------+-------------+---------------+-------------+
 171  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 172  +------------+-----------------+-------------+---------------+-------------+
 173
 174  Never on bind requests/responses.
 175  ****************************************************************************/
 176
 177 static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int auth_len)
 178 {
 179         /*
 180          * The following is that length of the data we must sign or seal.
 181          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
 182          * preceeding the auth_data.
 183          */
 184
 185         int data_len = len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 186
 187         /*
 188          * The start of the data to sign/seal is just after the RPC headers.
 189          */
 190         char *reply_data = prs_data_p(rdata) + RPC_HEADER_LEN + RPC_HDR_REQ_LEN;
 191
 192         BOOL auth_verify = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SIGN) != 0);
 193         BOOL auth_seal = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SEAL) != 0);
 194
 195         DEBUG(5,("rpc_auth_pipe: len: %d auth_len: %d verify %s seal %s\n",
 196                   len, auth_len, BOOLSTR(auth_verify), BOOLSTR(auth_seal)));
 197
 198         /*
 199          * Unseal any sealed data in the PDU, not including the
 200          * 8 byte auth_header or the auth_data.
 201          */
 202
 203         if (auth_seal) {
 204                 DEBUG(10,("rpc_auth_pipe: unseal\n"));
 205                 dump_data(100, reply_data, data_len);
 206                 NTLMSSPcalc_ap(cli, (uchar*)reply_data, data_len);
 207                 dump_data(100, reply_data, data_len);
 208         }
 209
 210         if (auth_verify || auth_seal) {
 211                 RPC_HDR_AUTH rhdr_auth;
 212                 prs_struct auth_req;
 213                 char data[RPC_HDR_AUTH_LEN];
 214                 /*
 215                  * We set dp to be the end of the packet, minus the auth_len
 216                  * and the length of the header that preceeds the auth_data.
 217                  */
 218                 char *dp = prs_data_p(rdata) + len - auth_len - RPC_HDR_AUTH_LEN;
 219
 220                 if(dp - prs_data_p(rdata) > prs_data_size(rdata)) {
 221                         DEBUG(0,("rpc_auth_pipe: auth data > data size !\n"));
 222                         return False;
 223                 }
 224
 225                 memcpy(data, dp, sizeof(data));
 226
 227                 prs_init(&auth_req , 0, cli->mem_ctx, UNMARSHALL);
 228
 229                 /* The endianness must be preserved... JRA. */
 230
 231                 prs_set_endian_data(&auth_req, rdata->bigendian_data);
 232
 233                 prs_give_memory(&auth_req, data, RPC_HDR_AUTH_LEN, False);
 234
 235                 /*
 236                  * Unmarshall the 8 byte auth_header that comes before the
 237                  * auth data.
 238                  */
 239
 240                 if(!smb_io_rpc_hdr_auth("hdr_auth", &rhdr_auth, &auth_req, 0)) {
 241                         DEBUG(0,("rpc_auth_pipe: unmarshalling RPC_HDR_AUTH failed.\n"));
 242                         return False;
 243                 }
 244
 245                 if (!rpc_hdr_auth_chk(&rhdr_auth)) {
 246                         DEBUG(0,("rpc_auth_pipe: rpc_hdr_auth_chk failed.\n"));
 247                         return False;
 248                 }
 249         }
 250
 251         /*
 252          * Now unseal and check the auth verifier in the auth_data at
 253          * then end of the packet. The 4 bytes skipped in the unseal
 254          * seem to be a buffer pointer preceeding the sealed data.
 255          */
 256
 257         if (auth_verify) {
 258                 RPC_AUTH_NTLMSSP_CHK chk;
 259                 uint32 crc32;
 260                 prs_struct auth_verf;
 261                 char data[RPC_AUTH_NTLMSSP_CHK_LEN];
 262                 char *dp = prs_data_p(rdata) + len - auth_len;
 263
 264                 if(dp - prs_data_p(rdata) > prs_data_size(rdata)) {
 265                         DEBUG(0,("rpc_auth_pipe: auth data > data size !\n"));
 266                         return False;
 267                 }
 268
 269                 DEBUG(10,("rpc_auth_pipe: verify\n"));
 270                 dump_data(100, dp, auth_len);
 271                 NTLMSSPcalc_ap(cli, (uchar*)(dp+4), auth_len - 4);
 272
 273                 memcpy(data, dp, RPC_AUTH_NTLMSSP_CHK_LEN);
 274                 dump_data(100, data, auth_len);
 275
 276                 prs_init(&auth_verf, 0, cli->mem_ctx, UNMARSHALL);
 277
 278                 /* The endinness must be preserved. JRA. */
 279                 prs_set_endian_data( &auth_verf, rdata->bigendian_data);
 280
 281                 prs_give_memory(&auth_verf, data, RPC_AUTH_NTLMSSP_CHK_LEN, False);
 282
 283                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &chk, &auth_verf, 0)) {
 284                         DEBUG(0,("rpc_auth_pipe: unmarshalling RPC_AUTH_NTLMSSP_CHK failed.\n"));
 285                         return False;
 286                 }
 287
 288                 crc32 = crc32_calc_buffer(reply_data, data_len);
 289
 290                 if (!rpc_auth_ntlmssp_chk(&chk, crc32 , cli->ntlmssp_seq_num)) {
 291                         DEBUG(0,("rpc_auth_pipe: rpc_auth_ntlmssp_chk failed.\n"));
 292                         return False;
 293                 }
 294                 cli->ntlmssp_seq_num++;
 295         }
 296         return True;
 297 }
 298
 299
 300 /****************************************************************************
 301  Send data on an rpc pipe via trans, which *must* be the last fragment.
 302  receive response data from an rpc pipe, which may be large...
 303
 304  Read the first fragment: unfortunately have to use SMBtrans for the first
 305  bit, then SMBreadX for subsequent bits.
 306
 307  If first fragment received also wasn't the last fragment, continue
 308  getting fragments until we _do_ receive the last fragment.
 309
 310  Request/Response PDU's look like the following...
 311
 312  |<------------------PDU len----------------------------------------------->|
 313  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 314
 315  +------------+-----------------+-------------+---------------+-------------+
 316  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 317  +------------+-----------------+-------------+---------------+-------------+
 318
 319  Where the presence of the AUTH_HDR and AUTH are dependent on the
 320  signing & sealing being neogitated.
 321
 322  ****************************************************************************/
 323
 324 static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rdata)
 325 {
 326         uint32 len;
 327         char *rparam = NULL;
 328         uint32 rparam_len = 0;
 329         uint16 setup[2];
 330         BOOL first = True;
 331         BOOL last  = True;
 332         RPC_HDR rhdr;
 333         char *pdata = data ? prs_data_p(data) : NULL;
 334         uint32 data_len = data ? prs_offset(data) : 0;
 335         char *prdata = NULL;
 336         uint32 rdata_len = 0;
 337         uint32 current_offset = 0;
 338         uint32 max_data = cli->max_xmit_frag ? cli->max_xmit_frag : 1024;
 339
 340         /* Create setup parameters - must be in native byte order. */
 341
 342         setup[0] = TRANSACT_DCERPCCMD;
 343         setup[1] = cli->nt_pipe_fnum; /* Pipe file handle. */
 344
 345         DEBUG(5,("rpc_api_pipe: fnum:%x\n", (int)cli->nt_pipe_fnum));
 346
 347         /* Send the RPC request and receive a response.  For short RPC
 348            calls (about 1024 bytes or so) the RPC request and response
 349            appears in a SMBtrans request and response.  Larger RPC
 350            responses are received further on. */
 351
 352         if (!cli_api_pipe(cli, "\\PIPE\\",
 353                   setup, 2, 0,                     /* Setup, length, max */
 354                   NULL, 0, 0,                      /* Params, length, max */
 355                   pdata, data_len, max_data,       /* data, length, max */
 356                   &rparam, &rparam_len,            /* return params, len */
 357                   &prdata, &rdata_len))            /* return data, len */
 358         {
 359                 DEBUG(0, ("cli_pipe: return critical error. Error was %s\n", cli_errstr(cli)));
 360                 return False;
 361         }
 362
 363         /* Throw away returned params - we know we won't use them. */
 364
 365         SAFE_FREE(rparam);
 366
 367         if (prdata == NULL) {
 368                 DEBUG(0,("rpc_api_pipe: pipe %x failed to return data.\n",
 369                         (int)cli->nt_pipe_fnum));
 370                 return False;
 371         }
 372
 373         /*
 374          * Give this memory as dynamically allocated to the return parse
 375          * struct.
 376          */
 377
 378         prs_give_memory(rdata, prdata, rdata_len, True);
 379         current_offset = rdata_len;
 380
 381         /* This next call sets the endian bit correctly in rdata. */
 382
 383         if (!rpc_check_hdr(rdata, &rhdr, &first, &last, &len)) {
 384                 prs_mem_free(rdata);
 385                 return False;
 386         }
 387
 388         if (rhdr.pkt_type == RPC_BINDACK) {
 389                 if (!last && !first) {
 390                         DEBUG(5,("rpc_api_pipe: bug in server (AS/U?), setting fragment first/last ON.\n"));
 391                         first = True;
 392                         last = True;
 393                 }
 394         }
 395
 396         if (rhdr.pkt_type == RPC_RESPONSE) {
 397                 RPC_HDR_RESP rhdr_resp;
 398                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, rdata, 0)) {
 399                         DEBUG(5,("rpc_api_pipe: failed to unmarshal RPC_HDR_RESP.\n"));
 400                         prs_mem_free(rdata);
 401                         return False;
 402                 }
 403         }
 404
 405         DEBUG(5,("rpc_api_pipe: len left: %u smbtrans read: %u\n",
 406                   (unsigned int)len, (unsigned int)rdata_len ));
 407
 408         /* check if data to be sent back was too large for one SMBtrans */
 409         /* err status is only informational: the _real_ check is on the
 410            length */
 411
 412         if (len > 0) {
 413                 /* || err == (0x80000000 | STATUS_BUFFER_OVERFLOW)) */
 414
 415                 /* Read the remaining part of the first response fragment */
 416
 417                 if (!rpc_read(cli, rdata, len, &current_offset)) {
 418                         prs_mem_free(rdata);
 419                         return False;
 420                 }
 421         }
 422
 423         /*
 424          * Now we have a complete PDU, check the auth struct if any was sent.
 425          */
 426
 427         if (rhdr.auth_len != 0) {
 428                 if(!rpc_auth_pipe(cli, rdata, rhdr.frag_len, rhdr.auth_len))
 429                         return False;
 430                 /*
 431                  * Drop the auth footers from the current offset.
 432                  * We need this if there are more fragments.
 433                  * The auth footers consist of the auth_data and the
 434                  * preceeding 8 byte auth_header.
 435                  */
 436                 current_offset -= (rhdr.auth_len + RPC_HDR_AUTH_LEN);
 437         }
 438
 439         /*
 440          * Only one rpc fragment, and it has been read.
 441          */
 442
 443         if (first && last) {
 444                 DEBUG(6,("rpc_api_pipe: fragment first and last both set\n"));
 445                 return True;
 446         }
 447
 448         /*
 449          * Read more fragments using SMBreadX until we get one with the
 450          * last bit set.
 451          */
 452
 453         while (!last) {
 454                 RPC_HDR_RESP rhdr_resp;
 455                 int num_read;
 456                 char hdr_data[RPC_HEADER_LEN+RPC_HDR_RESP_LEN];
 457                 prs_struct hps;
 458                 uint8 eclass;
 459                 uint32 ecode;
 460
 461                 /*
 462                  * First read the header of the next PDU.
 463                  */
 464
 465                 prs_init(&hps, 0, cli->mem_ctx, UNMARSHALL);
 466                 prs_give_memory(&hps, hdr_data, sizeof(hdr_data), False);
 467
 468                 num_read = cli_read(cli, cli->nt_pipe_fnum, hdr_data, 0, RPC_HEADER_LEN+RPC_HDR_RESP_LEN);
 469                 if (cli_is_dos_error(cli)) {
 470                         cli_dos_error(cli, &eclass, &ecode);
 471                         if (eclass != ERRDOS && ecode != ERRmoredata) {
 472                                 DEBUG(0,("rpc_api_pipe: cli_read error : %d/%d\n", eclass, ecode));
 473                                 return False;
 474                         }
 475                 }
 476
 477                 DEBUG(5,("rpc_api_pipe: read header (size:%d)\n", num_read));
 478
 479                 if (num_read != RPC_HEADER_LEN+RPC_HDR_RESP_LEN) {
 480                         DEBUG(0,("rpc_api_pipe: Error : requested %d bytes, got %d.\n",
 481                                 RPC_HEADER_LEN+RPC_HDR_RESP_LEN, num_read ));
 482                         return False;
 483                 }
 484
 485                 /* This call sets the endianness in hps. */
 486
 487                 if (!rpc_check_hdr(&hps, &rhdr, &first, &last, &len))
 488                         return False;
 489
 490                 /* Ensure the endianness in rdata is set correctly - must be same as hps. */
 491
 492                 if (hps.bigendian_data != rdata->bigendian_data) {
 493                         DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to %s\n",
 494                                 rdata->bigendian_data ? "big" : "little",
 495                                 hps.bigendian_data ? "big" : "little" ));
 496                         return False;
 497                 }
 498
 499                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, &hps, 0)) {
 500                         DEBUG(0,("rpc_api_pipe: Error in unmarshalling RPC_HDR_RESP.\n"));
 501                         return False;
 502                 }
 503
 504                 if (first) {
 505                         DEBUG(0,("rpc_api_pipe: secondary PDU rpc header has 'first' set !\n"));
 506                         return False;
 507                 }
 508
 509                 /*
 510                  * Now read the rest of the PDU.
 511                  */
 512
 513                 if (!rpc_read(cli, rdata, len, &current_offset))
 514                         return False;
 515
 516                 /*
 517                  * Verify any authentication footer.
 518                  */
 519
 520                 if (rhdr.auth_len != 0 ) {
 521                         if(!rpc_auth_pipe(cli, rdata, rhdr.frag_len, rhdr.auth_len))
 522                                 return False;
 523                         /*
 524                          * Drop the auth footers from the current offset.
 525                          * The auth footers consist of the auth_data and the
 526                          * preceeding 8 byte auth_header.
 527                          * We need this if there are more fragments.
 528                          */
 529                         current_offset -= (rhdr.auth_len + RPC_HDR_AUTH_LEN);
 530                 }
 531         }
 532
 533         return True;
 534 }
 535
 536 /*******************************************************************
 537  creates a DCE/RPC bind request
 538
 539  - initialises the parse structure.
 540  - dynamically allocates the header data structure
 541  - caller is expected to free the header data structure once used.
 542
 543  ********************************************************************/
 544
 545 static BOOL create_rpc_bind_req(prs_struct *rpc_out, BOOL do_auth, uint32 rpc_call_id,
 546                                 RPC_IFACE *abstract, RPC_IFACE *transfer,
 547                                 const char *my_name, const char *domain, uint32 neg_flags)
 548 {
 549         RPC_HDR hdr;
 550         RPC_HDR_RB hdr_rb;
 551         char buffer[4096];
 552         prs_struct auth_info;
 553         int auth_len = 0;
 554
 555         prs_init(&auth_info, 0, prs_get_mem_context(rpc_out), MARSHALL);
 556
 557         if (do_auth) {
 558                 RPC_HDR_AUTH hdr_auth;
 559                 RPC_AUTH_VERIFIER auth_verifier;
 560                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 561
 562                 /*
 563                  * Create the auth structs we will marshall.
 564                  */
 565
 566                 init_rpc_hdr_auth(&hdr_auth, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, 0x00, 1);
 567                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_NEGOTIATE);
 568                 init_rpc_auth_ntlmssp_neg(&ntlmssp_neg, neg_flags, my_name, domain);
 569
 570                 /*
 571                  * Use the 4k buffer to store the auth info.
 572                  */
 573
 574                 prs_give_memory( &auth_info, buffer, sizeof(buffer), False);
 575
 576                 /*
 577                  * Now marshall the data into the temporary parse_struct.
 578                  */
 579
 580                 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &auth_info, 0)) {
 581                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_AUTH.\n"));
 582                         return False;
 583                 }
 584
 585                 if(!smb_io_rpc_auth_verifier("auth_verifier", &auth_verifier, &auth_info, 0)) {
 586                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_AUTH_VERIFIER.\n"));
 587                         return False;
 588                 }
 589
 590                 if(!smb_io_rpc_auth_ntlmssp_neg("ntlmssp_neg", &ntlmssp_neg, &auth_info, 0)) {
 591                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_AUTH_NTLMSSP_NEG.\n"));
 592                         return False;
 593                 }
 594
 595                 /* Auth len in the rpc header doesn't include auth_header. */
 596                 auth_len = prs_offset(&auth_info) - RPC_HDR_AUTH_LEN;
 597         }
 598
 599         /* create the request RPC_HDR */
 600         init_rpc_hdr(&hdr, RPC_BIND, 0x3, rpc_call_id,
 601                 RPC_HEADER_LEN + RPC_HDR_RB_LEN + prs_offset(&auth_info),
 602                 auth_len);
 603
 604         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
 605                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR.\n"));
 606                 return False;
 607         }
 608
 609         /* create the bind request RPC_HDR_RB */
 610         init_rpc_hdr_rb(&hdr_rb, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN, 0x0,
 611                         0x1, 0x0, 0x1, abstract, transfer);
 612
 613         /* Marshall the bind request data */
 614         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
 615                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_RB.\n"));
 616                 return False;
 617         }
 618
 619         /*
 620          * Grow the outgoing buffer to store any auth info.
 621          */
 622
 623         if(hdr.auth_len != 0) {
 624                 if(!prs_append_prs_data( rpc_out, &auth_info)) {
 625                         DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 626                         return False;
 627                 }
 628         }
 629
 630         return True;
 631 }
 632
 633 /*******************************************************************
 634  Creates a DCE/RPC bind authentication response.
 635  This is the packet that is sent back to the server once we
 636  have received a BIND-ACK, to finish the third leg of
 637  the authentication handshake.
 638  ********************************************************************/
 639
 640 static BOOL create_rpc_bind_resp(struct pwd_info *pwd,
 641                                 const char *domain, const char *user_name, const char *my_name,
 642                                 uint32 ntlmssp_cli_flgs,
 643                                 uint32 rpc_call_id,
 644                                 prs_struct *rpc_out)
 645 {
 646         unsigned char lm_owf[24];
 647         unsigned char nt_owf[24];
 648         RPC_HDR hdr;
 649         RPC_HDR_AUTHA hdr_autha;
 650         RPC_AUTH_VERIFIER auth_verifier;
 651         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 652         char buffer[4096];
 653         prs_struct auth_info;
 654
 655         /*
 656          * Marshall the variable length data into a temporary parse
 657          * struct, pointing into a 4k local buffer.
 658          */
 659         prs_init(&auth_info, 0, prs_get_mem_context(rpc_out), MARSHALL);
 660
 661         /*
 662          * Use the 4k buffer to store the auth info.
 663          */
 664
 665         prs_give_memory( &auth_info, buffer, sizeof(buffer), False);
 666
 667         /*
 668          * Create the variable length auth_data.
 669          */
 670
 671         init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH);
 672
 673         pwd_get_lm_nt_owf(pwd, lm_owf, nt_owf);
 674
 675         init_rpc_auth_ntlmssp_resp(&ntlmssp_resp,
 676                                  lm_owf, nt_owf,
 677                                  domain, user_name, my_name,
 678                                  ntlmssp_cli_flgs);
 679
 680         /*
 681          * Marshall the variable length auth_data into a temp parse_struct.
 682          */
 683
 684         if(!smb_io_rpc_auth_verifier("auth_verifier", &auth_verifier, &auth_info, 0)) {
 685                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_AUTH_VERIFIER.\n"));
 686                 return False;
 687         }
 688
 689         if(!smb_io_rpc_auth_ntlmssp_resp("ntlmssp_resp", &ntlmssp_resp, &auth_info, 0)) {
 690                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_AUTH_NTLMSSP_RESP.\n"));
 691                 return False;
 692         }
 693
 694         /* Create the request RPC_HDR */
 695         init_rpc_hdr(&hdr, RPC_BINDRESP, 0x0, rpc_call_id,
 696                         RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN + prs_offset(&auth_info),
 697                         prs_offset(&auth_info) );
 698
 699         /* Marshall it. */
 700         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
 701                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR.\n"));
 702                 return False;
 703         }
 704
 705         /* Create the request RPC_HDR_AUTHA */
 706         init_rpc_hdr_autha(&hdr_autha, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN,
 707                         NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, 0x00);
 708
 709         if(!smb_io_rpc_hdr_autha("hdr_autha", &hdr_autha, rpc_out, 0)) {
 710                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR_AUTHA.\n"));
 711                 return False;
 712         }
 713
 714         /*
 715          * Append the auth data to the outgoing buffer.
 716          */
 717
 718         if(!prs_append_prs_data(rpc_out, &auth_info)) {
 719                 DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 720                 return False;
 721         }
 722
 723         return True;
 724 }
 725
 726
 727 /*******************************************************************
 728  Creates a DCE/RPC request.
 729  ********************************************************************/
 730
 731 static uint32 create_rpc_request(prs_struct *rpc_out, uint8 op_num, int data_len, int auth_len, uint8 flags, uint32 oldid, uint32 data_left)
 732 {
 733         uint32 alloc_hint;
 734         RPC_HDR     hdr;
 735         RPC_HDR_REQ hdr_req;
 736         uint32 callid = oldid ? oldid : get_rpc_call_id();
 737
 738         DEBUG(5,("create_rpc_request: opnum: 0x%x data_len: 0x%x\n", op_num, data_len));
 739
 740         /* create the rpc header RPC_HDR */
 741         init_rpc_hdr(&hdr, RPC_REQUEST, flags,
 742                      callid, data_len, auth_len);
 743
 744         /*
 745          * The alloc hint should be the amount of data, not including
 746          * RPC headers & footers.
 747          */
 748
 749         if (auth_len != 0)
 750                 alloc_hint = data_left - RPC_HEADER_LEN - RPC_HDR_AUTH_LEN - auth_len;
 751         else
 752                 alloc_hint = data_left - RPC_HEADER_LEN;
 753
 754         DEBUG(10,("create_rpc_request: data_len: %x auth_len: %x alloc_hint: %x\n",
 755                    data_len, auth_len, alloc_hint));
 756
 757         /* Create the rpc request RPC_HDR_REQ */
 758         init_rpc_hdr_req(&hdr_req, alloc_hint, op_num);
 759
 760         /* stream-time... */
 761         if(!smb_io_rpc_hdr("hdr    ", &hdr, rpc_out, 0))
 762                 return 0;
 763
 764         if(!smb_io_rpc_hdr_req("hdr_req", &hdr_req, rpc_out, 0))
 765                 return 0;
 766
 767         if (prs_offset(rpc_out) != RPC_HEADER_LEN + RPC_HDR_REQ_LEN)
 768                 return 0;
 769
 770         return callid;
 771 }
 772
 773 /*******************************************************************
 774  Puts an auth header into an rpc request.
 775  ********************************************************************/
 776
 777 static BOOL create_auth_hdr(prs_struct *outgoing_packet, BOOL auth_verify)
 778 {
 779         RPC_HDR_AUTH hdr_auth;
 780
 781         init_rpc_hdr_auth(&hdr_auth, NTLMSSP_AUTH_TYPE,
 782                           NTLMSSP_AUTH_LEVEL, 0x08,
 783                           (auth_verify ? 1 : 0));
 784         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth,
 785                                 outgoing_packet, 0)) {
 786                 DEBUG(0,("create_auth_hdr:Failed to marshal RPC_HDR_AUTH.\n"));
 787                 return False;
 788         }
 789         return True;
 790 }
 791
 792 /*******************************************************************
 793  Puts auth data into an rpc request.
 794  ********************************************************************/
 795
 796 static BOOL create_auth_data(struct cli_state *cli, uint32 crc32,
 797                              prs_struct *outgoing_packet)
 798 {
 799         char *pdata_out = prs_data_p(outgoing_packet);
 800         RPC_AUTH_NTLMSSP_CHK chk;
 801         uint32 current_offset = prs_offset(outgoing_packet);
 802
 803         init_rpc_auth_ntlmssp_chk(&chk, NTLMSSP_SIGN_VERSION,
 804                                   crc32, cli->ntlmssp_seq_num++);
 805         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &chk,
 806                                         outgoing_packet, 0)) {
 807                 DEBUG(0,("create_auth_data: Failed to marshal RPC_AUTH_NTLMSSP_CHK.\n"));
 808                 return False;
 809         }
 810         NTLMSSPcalc_ap(cli, (unsigned char*)
 811                        &pdata_out[current_offset+4],
 812                        RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 813         return True;
 814 }
 815
 816 /**
 817  * Send a request on an RPC pipe and get a response.
 818  *
 819  * @param data NDR contents of the request to be sent.
 820  * @param rdata Unparsed NDR response data.
 821 **/
 822
 823 BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num,
 824                       prs_struct *data, prs_struct *rdata)
 825 {
 826         uint32 auth_len, max_data, data_left, data_sent;
 827         BOOL ret = False;
 828         BOOL auth_verify, auth_seal;
 829         fstring dump_name;
 830
 831         auth_verify = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SIGN) != 0);
 832         auth_seal   = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SEAL) != 0);
 833
 834         auth_len = (auth_verify ? RPC_AUTH_NTLMSSP_CHK_LEN : 0);
 835
 836         /*
 837          * calc how much actual data we can send in a PDU fragment
 838          */
 839         max_data = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 840                 (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
 841
 842         for (data_left = prs_offset(data), data_sent = 0; data_left > 0;) {
 843                 prs_struct outgoing_packet;
 844                 uint32 data_len, send_size;
 845                 uint8 flags = 0;
 846                 uint32 crc32 = 0;
 847                 uint32 callid = 0;
 848
 849                 /*
 850                  * how much will we send this time
 851                  */
 852                 send_size = MIN(data_left, max_data);
 853                 data_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + send_size +
 854                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) + auth_len;
 855
 856                 /*
 857                  * Malloc parse struct to hold it (and enough for alignments).
 858                  */
 859                 if(!prs_init(&outgoing_packet, data_len + 8,
 860                              cli->mem_ctx, MARSHALL)) {
 861                         DEBUG(0,("rpc_api_pipe_req: Failed to malloc %u bytes.\n", (unsigned int)data_len ));
 862                         return False;
 863                 }
 864
 865                 if (data_left == prs_offset(data))
 866                         flags |= RPC_FLG_FIRST;
 867
 868                 if (data_left < max_data)
 869                         flags |= RPC_FLG_LAST;
 870                 /*
 871                  * Write out the RPC header and the request header.
 872                  */
 873                 if(!(callid = create_rpc_request(&outgoing_packet, op_num,
 874                                                  data_len, auth_len, flags,
 875                                                  callid, data_left))) {
 876                         DEBUG(0,("rpc_api_pipe_req: Failed to create RPC request.\n"));
 877                         prs_mem_free(&outgoing_packet);
 878                         return False;
 879                 }
 880
 881                 /*
 882                  * Seal the outgoing data if requested.
 883                  */
 884                 if (auth_seal) {
 885                         crc32 = crc32_calc_buffer(prs_data_p(data) + data_sent,
 886                                                   send_size);
 887                         NTLMSSPcalc_ap(cli, (unsigned char*)prs_data_p(data) +
 888                                        data_sent, send_size);
 889                 }
 890
 891                 /*
 892                  * Now copy the data into the outgoing packet.
 893                  */
 894                 if(!prs_append_some_prs_data(&outgoing_packet, data,
 895                                              data_sent, send_size)) {
 896                         DEBUG(0,("rpc_api_pipe_req: Failed to append data to outgoing packet.\n"));
 897                         prs_mem_free(&outgoing_packet);
 898                         return False;
 899                 }
 900
 901                 /*
 902                  * Add a trailing auth_verifier if needed.
 903                  */
 904                 if (auth_seal || auth_verify) {
 905                         if(!create_auth_hdr(&outgoing_packet, auth_verify)) {
 906                                 prs_mem_free(&outgoing_packet);
 907                                 return False;
 908                         }
 909                 }
 910
 911                 /*
 912                  * Finally the auth data itself.
 913                  */
 914                 if (auth_verify) {
 915                         if (!create_auth_data(cli, crc32, &outgoing_packet)) {
 916                                 prs_mem_free(&outgoing_packet);
 917                                 return False;
 918                         }
 919                 }
 920
 921                 DEBUG(100,("data_len: %x data_calc_len: %x\n", data_len,
 922                            prs_offset(&outgoing_packet)));
 923
 924                 if (flags & RPC_FLG_LAST)
 925                         ret = rpc_api_pipe(cli, &outgoing_packet, rdata);
 926                 else {
 927                         cli_write(cli, cli->nt_pipe_fnum, 0x0008,
 928                                    prs_data_p(&outgoing_packet),
 929                                    data_sent, data_len);
 930                 }
 931                 prs_mem_free(&outgoing_packet);
 932                 data_sent += send_size;
 933                 data_left -= send_size;
 934         }
 935         /* Also capture received data */
 936         slprintf(dump_name, sizeof(dump_name) - 1, "reply_%s",
 937                  cli_pipe_get_name(cli));
 938         prs_dump(dump_name, op_num, rdata);
 939
 940         return ret;
 941 }
 942
 943 /****************************************************************************
 944  Set the handle state.
 945 ****************************************************************************/
 946
 947 static BOOL rpc_pipe_set_hnd_state(struct cli_state *cli, const char *pipe_name, uint16 device_state)
 948 {
 949         BOOL state_set = False;
 950         char param[2];
 951         uint16 setup[2]; /* only need 2 uint16 setup parameters */
 952         char *rparam = NULL;
 953         char *rdata = NULL;
 954         uint32 rparam_len, rdata_len;
 955
 956         if (pipe_name == NULL)
 957                 return False;
 958
 959         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
 960         cli->nt_pipe_fnum, pipe_name, device_state));
 961
 962         /* create parameters: device state */
 963         SSVAL(param, 0, device_state);
 964
 965         /* create setup parameters. */
 966         setup[0] = 0x0001;
 967         setup[1] = cli->nt_pipe_fnum; /* pipe file handle.  got this from an SMBOpenX. */
 968
 969         /* send the data on \PIPE\ */
 970         if (cli_api_pipe(cli, "\\PIPE\\",
 971                     setup, 2, 0,                /* setup, length, max */
 972                     param, 2, 0,                /* param, length, max */
 973                     NULL, 0, 1024,              /* data, length, max */
 974                     &rparam, &rparam_len,        /* return param, length */
 975                     &rdata, &rdata_len))         /* return data, length */
 976         {
 977                 DEBUG(5, ("Set Handle state: return OK\n"));
 978                 state_set = True;
 979         }
 980
 981         SAFE_FREE(rparam);
 982         SAFE_FREE(rdata);
 983
 984         return state_set;
 985 }
 986
 987 /****************************************************************************
 988  check the rpc bind acknowledge response
 989 ****************************************************************************/
 990
 991 int get_pipe_index( const char *pipe_name )
 992 {
 993         int pipe_idx = 0;
 994
 995         while (pipe_names[pipe_idx].client_pipe != NULL) {
 996                 if (strequal(pipe_name, pipe_names[pipe_idx].client_pipe ))
 997                         return pipe_idx;
 998                 pipe_idx++;
 999         };
1000
1001         return -1;
1002 }
1003
1004
1005 /****************************************************************************
1006  check the rpc bind acknowledge response
1007 ****************************************************************************/
1008
1009 const char* get_pipe_name_from_index( const int pipe_index )
1010 {
1011
1012         if ( (pipe_index < 0) || (pipe_index >= PI_MAX_PIPES) )
1013                 return NULL;
1014
1015         return pipe_names[pipe_index].client_pipe;
1016 }
1017
1018 /****************************************************************************
1019  Check to see if this pipe index points to one of
1020  the pipes only supported by Win2k
1021  ****************************************************************************/
1022
1023 BOOL is_win2k_pipe( const int pipe_idx )
1024 {
1025         switch ( pipe_idx )
1026         {
1027                 case PI_LSARPC_DS:
1028                         return True;
1029         }
1030
1031         return False;
1032 }
1033
1034 /****************************************************************************
1035  check the rpc bind acknowledge response
1036 ****************************************************************************/
1037
1038 static BOOL valid_pipe_name(const int pipe_idx, RPC_IFACE *abstract, RPC_IFACE *transfer)
1039 {
1040         if ( pipe_idx >= PI_MAX_PIPES ) {
1041                 DEBUG(0,("valid_pipe_name: Programmer error!  Invalid pipe index [%d]\n",
1042                         pipe_idx));
1043                 return False;
1044         }
1045
1046         DEBUG(5,("Bind Abstract Syntax: "));
1047         dump_data(5, (char*)&(pipe_names[pipe_idx].abstr_syntax),
1048                   sizeof(pipe_names[pipe_idx].abstr_syntax));
1049         DEBUG(5,("Bind Transfer Syntax: "));
1050         dump_data(5, (char*)&(pipe_names[pipe_idx].trans_syntax),
1051                   sizeof(pipe_names[pipe_idx].trans_syntax));
1052
1053         /* copy the required syntaxes out so we can do the right bind */
1054
1055         *transfer = pipe_names[pipe_idx].trans_syntax;
1056         *abstract = pipe_names[pipe_idx].abstr_syntax;
1057
1058         return True;
1059 }
1060
1061 /****************************************************************************
1062  check the rpc bind acknowledge response
1063 ****************************************************************************/
1064
1065 static BOOL check_bind_response(RPC_HDR_BA *hdr_ba, const int pipe_idx, RPC_IFACE *transfer)
1066 {
1067         int i = 0;
1068
1069         if ( hdr_ba->addr.len <= 0)
1070                 return False;
1071
1072         if ( !strequal(hdr_ba->addr.str, pipe_names[pipe_idx].server_pipe ))
1073         {
1074                 DEBUG(4,("bind_rpc_pipe: pipe_name %s != expected pipe %s.  oh well!\n",
1075                          pipe_names[i].server_pipe ,hdr_ba->addr.str));
1076                 return False;
1077         }
1078
1079         DEBUG(5,("bind_rpc_pipe: server pipe_name found: %s\n", pipe_names[i].server_pipe ));
1080
1081         if (pipe_names[pipe_idx].server_pipe == NULL) {
1082                 DEBUG(2,("bind_rpc_pipe: pipe name %s unsupported\n", hdr_ba->addr.str));
1083                 return False;
1084         }
1085
1086         /* check the transfer syntax */
1087         if ((hdr_ba->transfer.version != transfer->version) ||
1088              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1089                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1090                 return False;
1091         }
1092
1093         /* lkclXXXX only accept one result: check the result(s) */
1094         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
1095                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1096                           hdr_ba->res.num_results, hdr_ba->res.reason));
1097         }
1098
1099         DEBUG(5,("bind_rpc_pipe: accepted!\n"));
1100         return True;
1101 }
1102
1103 /****************************************************************************
1104  Create and send the third packet in an RPC auth.
1105 ****************************************************************************/
1106
1107 static BOOL rpc_send_auth_reply(struct cli_state *cli, prs_struct *rdata, uint32 rpc_call_id)
1108 {
1109         RPC_HDR_AUTH rhdr_auth;
1110         RPC_AUTH_VERIFIER rhdr_verf;
1111         RPC_AUTH_NTLMSSP_CHAL rhdr_chal;
1112         char buffer[MAX_PDU_FRAG_LEN];
1113         prs_struct rpc_out;
1114         ssize_t ret;
1115
1116         unsigned char p24[24];
1117         unsigned char lm_owf[24];
1118         unsigned char lm_hash[16];
1119
1120         if(!smb_io_rpc_hdr_auth("", &rhdr_auth, rdata, 0)) {
1121                 DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_HDR_AUTH.\n"));
1122                 return False;
1123         }
1124         if(!smb_io_rpc_auth_verifier("", &rhdr_verf, rdata, 0)) {
1125                 DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_AUTH_VERIFIER.\n"));
1126                 return False;
1127         }
1128         if(!smb_io_rpc_auth_ntlmssp_chal("", &rhdr_chal, rdata, 0)) {
1129                 DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_AUTH_NTLMSSP_CHAL.\n"));
1130                 return False;
1131         }
1132
1133         cli->ntlmssp_cli_flgs = rhdr_chal.neg_flags;
1134
1135         pwd_make_lm_nt_owf(&cli->pwd, rhdr_chal.challenge);
1136
1137         prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL);
1138
1139         prs_give_memory( &rpc_out, buffer, sizeof(buffer), False);
1140
1141         create_rpc_bind_resp(&cli->pwd, cli->domain,
1142                              cli->user_name, global_myname(),
1143                              cli->ntlmssp_cli_flgs, rpc_call_id,
1144                              &rpc_out);
1145
1146         pwd_get_lm_nt_owf(&cli->pwd, lm_owf, NULL);
1147         pwd_get_lm_nt_16(&cli->pwd, lm_hash, NULL);
1148
1149         NTLMSSPOWFencrypt(lm_hash, lm_owf, p24);
1150
1151         {
1152                 unsigned char j = 0;
1153                 int ind;
1154                 unsigned char k2[8];
1155
1156                 memcpy(k2, p24, 5);
1157                 k2[5] = 0xe5;
1158                 k2[6] = 0x38;
1159                 k2[7] = 0xb0;
1160
1161                 for (ind = 0; ind < 256; ind++)
1162                         cli->ntlmssp_hash[ind] = (unsigned char)ind;
1163
1164                 for( ind = 0; ind < 256; ind++) {
1165                         unsigned char tc;
1166
1167                         j += (cli->ntlmssp_hash[ind] + k2[ind%8]);
1168
1169                         tc = cli->ntlmssp_hash[ind];
1170                         cli->ntlmssp_hash[ind] = cli->ntlmssp_hash[j];
1171                         cli->ntlmssp_hash[j] = tc;
1172                 }
1173
1174                 cli->ntlmssp_hash[256] = 0;
1175                 cli->ntlmssp_hash[257] = 0;
1176         }
1177
1178         memset((char *)lm_hash, '\0', sizeof(lm_hash));
1179
1180         if ((ret = cli_write(cli, cli->nt_pipe_fnum, 0x8, prs_data_p(&rpc_out),
1181                         0, (size_t)prs_offset(&rpc_out))) != (ssize_t)prs_offset(&rpc_out)) {
1182                 DEBUG(0,("rpc_send_auth_reply: cli_write failed. Return was %d\n", (int)ret));
1183                 return False;
1184         }
1185
1186         cli->ntlmssp_srv_flgs = rhdr_chal.neg_flags;
1187         return True;
1188 }
1189
1190 /****************************************************************************
1191  Do an rpc bind.
1192 ****************************************************************************/
1193
1194 BOOL rpc_pipe_bind(struct cli_state *cli, int pipe_idx, const char *my_name)
1195 {
1196         RPC_IFACE abstract;
1197         RPC_IFACE transfer;
1198         prs_struct rpc_out;
1199         prs_struct rdata;
1200         BOOL do_auth = (cli->ntlmssp_cli_flgs != 0);
1201         uint32 rpc_call_id;
1202         char buffer[MAX_PDU_FRAG_LEN];
1203
1204         if ( (pipe_idx < 0) || (pipe_idx >= PI_MAX_PIPES) )
1205                 return False;
1206
1207         DEBUG(5,("Bind RPC Pipe[%x]: %s\n", cli->nt_pipe_fnum, pipe_names[pipe_idx].client_pipe));
1208
1209         if (!valid_pipe_name(pipe_idx, &abstract, &transfer))
1210                 return False;
1211
1212         prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL);
1213
1214         /*
1215          * Use the MAX_PDU_FRAG_LEN buffer to store the bind request.
1216          */
1217
1218         prs_give_memory( &rpc_out, buffer, sizeof(buffer), False);
1219
1220         rpc_call_id = get_rpc_call_id();
1221
1222         /* Marshall the outgoing data. */
1223         create_rpc_bind_req(&rpc_out, do_auth, rpc_call_id,
1224                             &abstract, &transfer,
1225                             global_myname(), cli->domain, cli->ntlmssp_cli_flgs);
1226
1227         /* Initialize the incoming data struct. */
1228         prs_init(&rdata, 0, cli->mem_ctx, UNMARSHALL);
1229
1230         /* send data on \PIPE\.  receive a response */
1231         if (rpc_api_pipe(cli, &rpc_out, &rdata)) {
1232                 RPC_HDR_BA   hdr_ba;
1233
1234                 DEBUG(5, ("rpc_pipe_bind: rpc_api_pipe returned OK.\n"));
1235
1236                 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &rdata, 0)) {
1237                         DEBUG(0,("rpc_pipe_bind: Failed to unmarshall RPC_HDR_BA.\n"));
1238                         prs_mem_free(&rdata);
1239                         return False;
1240                 }
1241
1242                 if(!check_bind_response(&hdr_ba, pipe_idx, &transfer)) {
1243                         DEBUG(2,("rpc_pipe_bind: check_bind_response failed.\n"));
1244                         prs_mem_free(&rdata);
1245                         return False;
1246                 }
1247
1248                 cli->max_xmit_frag = hdr_ba.bba.max_tsize;
1249                 cli->max_recv_frag = hdr_ba.bba.max_rsize;
1250
1251                 /*
1252                  * If we're doing NTLMSSP auth we need to send a reply to
1253                  * the bind-ack to complete the 3-way challenge response
1254                  * handshake.
1255                  */
1256
1257                 if (do_auth && !rpc_send_auth_reply(cli, &rdata, rpc_call_id)) {
1258                         DEBUG(0,("rpc_pipe_bind: rpc_send_auth_reply failed.\n"));
1259                         prs_mem_free(&rdata);
1260                         return False;
1261                 }
1262         }
1263
1264         prs_mem_free(&rdata);
1265         return True;
1266 }
1267
1268 /****************************************************************************
1269  Set ntlmssp negotiation flags.
1270  ****************************************************************************/
1271
1272 void cli_nt_set_ntlmssp_flgs(struct cli_state *cli, uint32 ntlmssp_flgs)
1273 {
1274         cli->ntlmssp_cli_flgs = ntlmssp_flgs;
1275 }
1276
1277
1278 /****************************************************************************
1279  Open a session.
1280  ****************************************************************************/
1281
1282 BOOL cli_nt_session_open(struct cli_state *cli, const int pipe_idx)
1283 {
1284         int fnum;
1285
1286         SMB_ASSERT(cli->nt_pipe_fnum == 0);
1287
1288         /* The pipe index must fall within our array */
1289
1290         SMB_ASSERT((pipe_idx >= 0) && (pipe_idx < PI_MAX_PIPES));
1291
1292         if (cli->capabilities & CAP_NT_SMBS) {
1293                 if ((fnum = cli_nt_create(cli, &pipe_names[pipe_idx].client_pipe[5], DESIRED_ACCESS_PIPE)) == -1) {
1294                         DEBUG(0,("cli_nt_session_open: cli_nt_create failed on pipe %s to machine %s.  Error was %s\n",
1295                                  &pipe_names[pipe_idx].client_pipe[5], cli->desthost, cli_errstr(cli)));
1296                         return False;
1297                 }
1298
1299                 cli->nt_pipe_fnum = (uint16)fnum;
1300         } else {
1301                 if ((fnum = cli_open(cli, pipe_names[pipe_idx].client_pipe, O_CREAT|O_RDWR, DENY_NONE)) == -1) {
1302                         DEBUG(0,("cli_nt_session_open: cli_open failed on pipe %s to machine %s.  Error was %s\n",
1303                                  pipe_names[pipe_idx].client_pipe, cli->desthost, cli_errstr(cli)));
1304                         return False;
1305                 }
1306
1307                 cli->nt_pipe_fnum = (uint16)fnum;
1308
1309                 /**************** Set Named Pipe State ***************/
1310                 if (!rpc_pipe_set_hnd_state(cli, pipe_names[pipe_idx].client_pipe, 0x4300)) {
1311                         DEBUG(0,("cli_nt_session_open: pipe hnd state failed.  Error was %s\n",
1312                                   cli_errstr(cli)));
1313                         cli_close(cli, cli->nt_pipe_fnum);
1314                         return False;
1315                 }
1316         }
1317
1318         /******************* bind request on pipe *****************/
1319
1320         if (!rpc_pipe_bind(cli, pipe_idx, global_myname())) {
1321                 DEBUG(2,("cli_nt_session_open: rpc bind to %s failed\n",
1322                          get_pipe_name_from_index(pipe_idx)));
1323                 cli_close(cli, cli->nt_pipe_fnum);
1324                 return False;
1325         }
1326
1327         /*
1328          * Setup the remote server name prefixed by \ and the machine account name.
1329          */
1330
1331         fstrcpy(cli->srv_name_slash, "\\\\");
1332         fstrcat(cli->srv_name_slash, cli->desthost);
1333         strupper(cli->srv_name_slash);
1334
1335         fstrcpy(cli->clnt_name_slash, "\\\\");
1336         fstrcat(cli->clnt_name_slash, global_myname());
1337         strupper(cli->clnt_name_slash);
1338
1339         fstrcpy(cli->mach_acct, global_myname());
1340         fstrcat(cli->mach_acct, "$");
1341         strupper(cli->mach_acct);
1342
1343         /* Remember which pipe we're talking to */
1344         fstrcpy(cli->pipe_name, pipe_names[pipe_idx].client_pipe);
1345
1346         return True;
1347 }
1348
1349
1350 const char *cli_pipe_get_name(struct cli_state *cli)
1351 {
1352         return cli->pipe_name;
1353 }
1354
1355
1356 /****************************************************************************
1357 close the session
1358 ****************************************************************************/
1359
1360 void cli_nt_session_close(struct cli_state *cli)
1361 {
1362         cli_close(cli, cli->nt_pipe_fnum);
1363         cli->nt_pipe_fnum = 0;
1364 }