source/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                       1998.
   7  *  Copyright (C) Jeremy Allison                    1999.
   8  *  Copyright (C) Andrew Bartlett                   2003.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 #include "includes.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_RPC_CLI
  29
  30 extern struct pipe_id_info pipe_names[];
  31
  32 static void get_auth_type_level(int pipe_auth_flags, int *auth_type, int *auth_level)
  33 {
  34         *auth_type = 0;
  35         *auth_level = 0;
  36         if (pipe_auth_flags & AUTH_PIPE_SEAL) {
  37                 *auth_level = RPC_PIPE_AUTH_SEAL_LEVEL;
  38         } else if (pipe_auth_flags & AUTH_PIPE_SIGN) {
  39                 *auth_level = RPC_PIPE_AUTH_SIGN_LEVEL;
  40         }
  41
  42         if (pipe_auth_flags & AUTH_PIPE_NETSEC) {
  43                 *auth_type = NETSEC_AUTH_TYPE;
  44         } else if (pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
  45                 *auth_type = NTLMSSP_AUTH_TYPE;
  46         }
  47 }
  48
  49 /********************************************************************
  50  Rpc pipe call id.
  51  ********************************************************************/
  52
  53 static uint32 get_rpc_call_id(void)
  54 {
  55         static uint32 call_id = 0;
  56         return ++call_id;
  57 }
  58
  59 /*******************************************************************
  60  Use SMBreadX to get rest of one fragment's worth of rpc data.
  61  ********************************************************************/
  62
  63 static BOOL rpc_read(struct cli_state *cli, prs_struct *rdata, uint32 data_to_read, uint32 *rdata_offset)
  64 {
  65         size_t size = (size_t)cli->max_recv_frag;
  66         int stream_offset = 0;
  67         int num_read;
  68         char *pdata;
  69         int extra_data_size = ((int)*rdata_offset) + ((int)data_to_read) - (int)prs_data_size(rdata);
  70
  71         DEBUG(5,("rpc_read: data_to_read: %u rdata offset: %u extra_data_size: %d\n",
  72                 (int)data_to_read, (unsigned int)*rdata_offset, extra_data_size));
  73
  74         /*
  75          * Grow the buffer if needed to accommodate the data to be read.
  76          */
  77
  78         if (extra_data_size > 0) {
  79                 if(!prs_force_grow(rdata, (uint32)extra_data_size)) {
  80                         DEBUG(0,("rpc_read: Failed to grow parse struct by %d bytes.\n", extra_data_size ));
  81                         return False;
  82                 }
  83                 DEBUG(5,("rpc_read: grew buffer by %d bytes to %u\n", extra_data_size, prs_data_size(rdata) ));
  84         }
  85
  86         pdata = prs_data_p(rdata) + *rdata_offset;
  87
  88         do /* read data using SMBreadX */
  89         {
  90                 uint32 ecode;
  91                 uint8 eclass;
  92
  93                 if (size > (size_t)data_to_read)
  94                         size = (size_t)data_to_read;
  95
  96                 num_read = (int)cli_read(cli, cli->nt_pipe_fnum, pdata, (off_t)stream_offset, size);
  97
  98                 DEBUG(5,("rpc_read: num_read = %d, read offset: %d, to read: %d\n",
  99                           num_read, stream_offset, data_to_read));
 100
 101                 if (cli_is_dos_error(cli)) {
 102                         cli_dos_error(cli, &eclass, &ecode);
 103                         if (eclass != ERRDOS && ecode != ERRmoredata) {
 104                                 DEBUG(0,("rpc_read: Error %d/%u in cli_read\n",
 105                                          eclass, (unsigned int)ecode));
 106                                 return False;
 107                         }
 108                 }
 109
 110                 data_to_read -= num_read;
 111                 stream_offset += num_read;
 112                 pdata += num_read;
 113
 114         } while (num_read > 0 && data_to_read > 0);
 115         /* && err == (0x80000000 | STATUS_BUFFER_OVERFLOW)); */
 116
 117         /*
 118          * Update the current offset into rdata by the amount read.
 119          */
 120         *rdata_offset += stream_offset;
 121
 122         return True;
 123 }
 124
 125 /****************************************************************************
 126  Checks the header. This will set the endian bit in the rdata prs_struct. JRA.
 127  ****************************************************************************/
 128
 129 static BOOL rpc_check_hdr(prs_struct *rdata, RPC_HDR *rhdr,
 130                           BOOL *first, BOOL *last, uint32 *len)
 131 {
 132         DEBUG(5,("rpc_check_hdr: rdata->data_size = %u\n", (uint32)prs_data_size(rdata) ));
 133
 134         /* Next call sets endian bit. */
 135
 136         if(!smb_io_rpc_hdr("rpc_hdr   ", rhdr, rdata, 0)) {
 137                 DEBUG(0,("rpc_check_hdr: Failed to unmarshall RPC_HDR.\n"));
 138                 return False;
 139         }
 140
 141         if (prs_offset(rdata) != RPC_HEADER_LEN) {
 142                 DEBUG(0,("rpc_check_hdr: offset was %x, should be %x.\n", prs_offset(rdata), RPC_HEADER_LEN));
 143                 return False;
 144         }
 145
 146         (*first) = ((rhdr->flags & RPC_FLG_FIRST) != 0);
 147         (*last) = ((rhdr->flags & RPC_FLG_LAST ) != 0);
 148         (*len) = (uint32)rhdr->frag_len - prs_data_size(rdata);
 149
 150         return (rhdr->pkt_type != RPC_FAULT);
 151 }
 152
 153 /****************************************************************************
 154  Verify data on an rpc pipe.
 155  The VERIFY & SEAL code is only executed on packets that look like this :
 156
 157  Request/Response PDU's look like the following...
 158
 159  |<------------------PDU len----------------------------------------------->|
 160  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 161
 162  +------------+-----------------+-------------+---------------+-------------+
 163  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 164  +------------+-----------------+-------------+---------------+-------------+
 165
 166  Never on bind requests/responses.
 167  ****************************************************************************/
 168
 169 static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata,
 170                           uint32 fragment_start, int len, int auth_len, uint8 pkt_type,
 171                           int *pauth_padding_len)
 172 {
 173
 174         /*
 175          * The following is that length of the data we must sign or seal.
 176          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
 177          * preceeding the auth_data.
 178          */
 179
 180         int data_len = len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 181
 182         /*
 183          * The start of the data to sign/seal is just after the RPC headers.
 184          */
 185         char *reply_data = prs_data_p(rdata) + fragment_start + RPC_HEADER_LEN + RPC_HDR_REQ_LEN;
 186
 187         RPC_HDR_AUTH rhdr_auth;
 188
 189         char *dp = prs_data_p(rdata) + fragment_start + len -
 190                 RPC_HDR_AUTH_LEN - auth_len;
 191         prs_struct auth_verf;
 192
 193         *pauth_padding_len = 0;
 194
 195         if (auth_len == 0) {
 196                 if (cli->pipe_auth_flags == 0) {
 197                         /* move along, nothing to see here */
 198                         return True;
 199                 }
 200
 201                 DEBUG(2, ("No authenticaton header recienved on reply, but this pipe is authenticated\n"));
 202                 return False;
 203         }
 204
 205         DEBUG(5,("rpc_auth_pipe: pkt_type: %d len: %d auth_len: %d NTLMSSP %s schannel %s sign %s seal %s \n",
 206                  pkt_type, len, auth_len,
 207                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP),
 208                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_NETSEC),
 209                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_SIGN),
 210                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_SEAL)));
 211
 212         if (dp - prs_data_p(rdata) > prs_data_size(rdata)) {
 213                 DEBUG(0,("rpc_auth_pipe: schannel auth data > data size !\n"));
 214                 return False;
 215         }
 216
 217         DEBUG(10,("rpc_auth_pipe: packet:\n"));
 218         dump_data(100, dp, auth_len);
 219
 220         prs_init(&auth_verf, 0, cli->mem_ctx, UNMARSHALL);
 221
 222         /* The endinness must be preserved. JRA. */
 223         prs_set_endian_data( &auth_verf, rdata->bigendian_data);
 224
 225         /* Point this new parse struct at the auth section of the main
 226            parse struct - rather than copying it.  Avoids needing to
 227            free it on every error
 228         */
 229         prs_give_memory(&auth_verf, dp, RPC_HDR_AUTH_LEN + auth_len, False /* not dynamic */);
 230         prs_set_offset(&auth_verf, 0);
 231
 232         {
 233                 int auth_type;
 234                 int auth_level;
 235                 if (!smb_io_rpc_hdr_auth("auth_hdr", &rhdr_auth, &auth_verf, 0)) {
 236                         DEBUG(0, ("rpc_auth_pipe: Could not parse auth header\n"));
 237                         return False;
 238                 }
 239
 240                 /* Let the caller know how much padding at the end of the data */
 241                 *pauth_padding_len = rhdr_auth.padding;
 242
 243                 /* Check it's the type of reply we were expecting to decode */
 244
 245                 get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 246                 if (rhdr_auth.auth_type != auth_type) {
 247                         DEBUG(0, ("BAD auth type %d (should be %d)\n",
 248                                   rhdr_auth.auth_type, auth_type));
 249                         return False;
 250                 }
 251
 252                 if (rhdr_auth.auth_level != auth_level) {
 253                         DEBUG(0, ("BAD auth level %d (should be %d)\n",
 254                                   rhdr_auth.auth_level, auth_level));
 255                         return False;
 256                 }
 257         }
 258
 259         if (pkt_type == RPC_BINDACK) {
 260                 if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 261                         /* copy the next auth_len bytes into a buffer for
 262                            later use */
 263
 264                         DATA_BLOB ntlmssp_verf = data_blob(NULL, auth_len);
 265
 266                         /* save the reply away, for use a little later */
 267                         prs_copy_data_out((char *)ntlmssp_verf.data, &auth_verf, auth_len);
 268
 269
 270                         return (NT_STATUS_IS_OK(ntlmssp_client_store_response(cli->ntlmssp_pipe_state,
 271                                                                               ntlmssp_verf)));
 272                 }
 273                 else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 274                         /* nothing to do here - we don't seem to be able to
 275                            validate the bindack based on VL's comments */
 276                         return True;
 277                 }
 278         }
 279
 280         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 281                 NTSTATUS nt_status;
 282                 DATA_BLOB sig;
 283                 if ((cli->pipe_auth_flags & AUTH_PIPE_SIGN) ||
 284                     (cli->pipe_auth_flags & AUTH_PIPE_SEAL)) {
 285                         if (auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) {
 286                                 DEBUG(0,("rpc_auth_pipe: wrong ntlmssp auth len %d\n", auth_len));
 287                                 return False;
 288                         }
 289                         sig = data_blob(NULL, auth_len);
 290                         prs_copy_data_out((char *)sig.data, &auth_verf, auth_len);
 291                 }
 292
 293                 /*
 294                  * Unseal any sealed data in the PDU, not including the
 295                  * 8 byte auth_header or the auth_data.
 296                  */
 297
 298                 /*
 299                  * Now unseal and check the auth verifier in the auth_data at
 300                  * the end of the packet.
 301                  */
 302
 303                 if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) {
 304                         if (data_len < 0) {
 305                                 DEBUG(1, ("Can't unseal - data_len < 0!!\n"));
 306                                 return False;
 307                         }
 308                         nt_status = ntlmssp_client_unseal_packet(cli->ntlmssp_pipe_state,
 309                                                                  (unsigned char *)reply_data, data_len,
 310                                                                  &sig);
 311                 }
 312                 else if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
 313                         nt_status = ntlmssp_client_check_packet(cli->ntlmssp_pipe_state,
 314                                                                 (const unsigned char *)reply_data, data_len,
 315                                                                 &sig);
 316                 }
 317
 318                 data_blob_free(&sig);
 319
 320                 if (!NT_STATUS_IS_OK(nt_status)) {
 321                         DEBUG(0, ("rpc_auth_pipe: could not validate "
 322                                   "incoming NTLMSSP packet!\n"));
 323                         return False;
 324                 }
 325         }
 326
 327         if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 328                 RPC_AUTH_NETSEC_CHK chk;
 329
 330                 if (auth_len != RPC_AUTH_NETSEC_CHK_LEN) {
 331                         DEBUG(0,("rpc_auth_pipe: wrong schannel auth len %d\n", auth_len));
 332                         return False;
 333                 }
 334
 335                 if (!smb_io_rpc_auth_netsec_chk("schannel_auth_sign",
 336                                                 &chk, &auth_verf, 0)) {
 337                         DEBUG(0, ("rpc_auth_pipe: schannel unmarshalling "
 338                                   "RPC_AUTH_NETSECK_CHK failed\n"));
 339                         return False;
 340                 }
 341
 342                 if (!netsec_decode(&cli->auth_info,
 343                                    cli->pipe_auth_flags,
 344                                    SENDER_IS_ACCEPTOR,
 345                                    &chk, reply_data, data_len)) {
 346                         DEBUG(0, ("rpc_auth_pipe: Could not decode schannel\n"));
 347                         return False;
 348                 }
 349
 350                 cli->auth_info.seq_num++;
 351
 352         }
 353         return True;
 354 }
 355
 356
 357 /****************************************************************************
 358  Send data on an rpc pipe via trans, which *must* be the last fragment.
 359  receive response data from an rpc pipe, which may be large...
 360
 361  Read the first fragment: unfortunately have to use SMBtrans for the first
 362  bit, then SMBreadX for subsequent bits.
 363
 364  If first fragment received also wasn't the last fragment, continue
 365  getting fragments until we _do_ receive the last fragment.
 366
 367  Request/Response PDU's look like the following...
 368
 369  |<------------------PDU len----------------------------------------------->|
 370  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 371
 372  +------------+-----------------+-------------+---------------+-------------+
 373  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 374  +------------+-----------------+-------------+---------------+-------------+
 375
 376  Where the presence of the AUTH_HDR and AUTH are dependent on the
 377  signing & sealing being negotiated.
 378
 379  ****************************************************************************/
 380
 381 static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rdata,
 382                          uint8 expected_pkt_type)
 383 {
 384         uint32 len;
 385         char *rparam = NULL;
 386         uint32 rparam_len = 0;
 387         uint16 setup[2];
 388         BOOL first = True;
 389         BOOL last  = True;
 390         RPC_HDR rhdr;
 391         char *pdata = data ? prs_data_p(data) : NULL;
 392         uint32 data_len = data ? prs_offset(data) : 0;
 393         char *prdata = NULL;
 394         uint32 rdata_len = 0;
 395         uint32 current_offset = 0;
 396         uint32 fragment_start = 0;
 397         uint32 max_data = cli->max_xmit_frag ? cli->max_xmit_frag : 1024;
 398         int auth_padding_len = 0;
 399
 400         /* Create setup parameters - must be in native byte order. */
 401
 402         setup[0] = TRANSACT_DCERPCCMD;
 403         setup[1] = cli->nt_pipe_fnum; /* Pipe file handle. */
 404
 405         DEBUG(5,("rpc_api_pipe: fnum:%x\n", (int)cli->nt_pipe_fnum));
 406
 407         /* Send the RPC request and receive a response.  For short RPC
 408            calls (about 1024 bytes or so) the RPC request and response
 409            appears in a SMBtrans request and response.  Larger RPC
 410            responses are received further on. */
 411
 412         if (!cli_api_pipe(cli, "\\PIPE\\",
 413                   setup, 2, 0,                     /* Setup, length, max */
 414                   NULL, 0, 0,                      /* Params, length, max */
 415                   pdata, data_len, max_data,       /* data, length, max */
 416                   &rparam, &rparam_len,            /* return params, len */
 417                   &prdata, &rdata_len))            /* return data, len */
 418         {
 419                 DEBUG(0, ("cli_pipe: return critical error. Error was %s\n", cli_errstr(cli)));
 420                 return False;
 421         }
 422
 423         /* Throw away returned params - we know we won't use them. */
 424
 425         SAFE_FREE(rparam);
 426
 427         if (prdata == NULL) {
 428                 DEBUG(0,("rpc_api_pipe: pipe %x failed to return data.\n",
 429                         (int)cli->nt_pipe_fnum));
 430                 return False;
 431         }
 432
 433         /*
 434          * Give this memory as dynamically allocated to the return parse
 435          * struct.
 436          */
 437
 438         prs_give_memory(rdata, prdata, rdata_len, True);
 439         current_offset = rdata_len;
 440
 441         /* This next call sets the endian bit correctly in rdata. */
 442
 443         if (!rpc_check_hdr(rdata, &rhdr, &first, &last, &len)) {
 444                 prs_mem_free(rdata);
 445                 return False;
 446         }
 447
 448         if (rhdr.pkt_type == RPC_BINDACK) {
 449                 if (!last && !first) {
 450                         DEBUG(5,("rpc_api_pipe: bug in server (AS/U?), setting fragment first/last ON.\n"));
 451                         first = True;
 452                         last = True;
 453                 }
 454         }
 455
 456         if (rhdr.pkt_type == RPC_BINDNACK) {
 457                 DEBUG(3, ("Bind NACK received on pipe %x!\n", (int)cli->nt_pipe_fnum));
 458                 prs_mem_free(rdata);
 459                 return False;
 460         }
 461
 462         if (rhdr.pkt_type == RPC_RESPONSE) {
 463                 RPC_HDR_RESP rhdr_resp;
 464                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, rdata, 0)) {
 465                         DEBUG(5,("rpc_api_pipe: failed to unmarshal RPC_HDR_RESP.\n"));
 466                         prs_mem_free(rdata);
 467                         return False;
 468                 }
 469         }
 470
 471         if (rhdr.pkt_type != expected_pkt_type) {
 472                 DEBUG(3, ("Connection to pipe %x got an unexpected RPC packet type - %d, not %d\n", (int)cli->nt_pipe_fnum, rhdr.pkt_type, expected_pkt_type));
 473                 prs_mem_free(rdata);
 474                 return False;
 475         }
 476
 477         DEBUG(5,("rpc_api_pipe: len left: %u smbtrans read: %u\n",
 478                   (unsigned int)len, (unsigned int)rdata_len ));
 479
 480         /* check if data to be sent back was too large for one SMBtrans */
 481         /* err status is only informational: the _real_ check is on the
 482            length */
 483
 484         if (len > 0) {
 485                 /* || err == (0x80000000 | STATUS_BUFFER_OVERFLOW)) */
 486
 487                 /* Read the remaining part of the first response fragment */
 488
 489                 if (!rpc_read(cli, rdata, len, &current_offset)) {
 490                         prs_mem_free(rdata);
 491                         return False;
 492                 }
 493         }
 494
 495         /*
 496          * Now we have a complete PDU, check the auth struct if any was sent.
 497          */
 498
 499         if(!rpc_auth_pipe(cli, rdata, fragment_start, rhdr.frag_len,
 500                           rhdr.auth_len, rhdr.pkt_type, &auth_padding_len)) {
 501                 prs_mem_free(rdata);
 502                 return False;
 503         }
 504
 505         if (rhdr.auth_len != 0) {
 506                 /*
 507                  * Drop the auth footers from the current offset.
 508                  * We need this if there are more fragments.
 509                  * The auth footers consist of the auth_data and the
 510                  * preceeding 8 byte auth_header.
 511                  */
 512                 current_offset -= (auth_padding_len + RPC_HDR_AUTH_LEN + rhdr.auth_len);
 513         }
 514
 515         /*
 516          * Only one rpc fragment, and it has been read.
 517          */
 518
 519         if (first && last) {
 520                 DEBUG(6,("rpc_api_pipe: fragment first and last both set\n"));
 521                 return True;
 522         }
 523
 524         /*
 525          * Read more fragments using SMBreadX until we get one with the
 526          * last bit set.
 527          */
 528
 529         while (!last) {
 530                 RPC_HDR_RESP rhdr_resp;
 531                 int num_read;
 532                 char hdr_data[RPC_HEADER_LEN+RPC_HDR_RESP_LEN];
 533                 prs_struct hps;
 534                 uint8 eclass;
 535                 uint32 ecode;
 536
 537                 /*
 538                  * First read the header of the next PDU.
 539                  */
 540
 541                 prs_init(&hps, 0, cli->mem_ctx, UNMARSHALL);
 542                 prs_give_memory(&hps, hdr_data, sizeof(hdr_data), False);
 543
 544                 num_read = cli_read(cli, cli->nt_pipe_fnum, hdr_data, 0, RPC_HEADER_LEN+RPC_HDR_RESP_LEN);
 545                 if (cli_is_dos_error(cli)) {
 546                         cli_dos_error(cli, &eclass, &ecode);
 547                         if (eclass != ERRDOS && ecode != ERRmoredata) {
 548                                 DEBUG(0,("rpc_api_pipe: cli_read error : %d/%d\n", eclass, ecode));
 549                                 return False;
 550                         }
 551                 }
 552
 553                 DEBUG(5,("rpc_api_pipe: read header (size:%d)\n", num_read));
 554
 555                 if (num_read != RPC_HEADER_LEN+RPC_HDR_RESP_LEN) {
 556                         DEBUG(0,("rpc_api_pipe: Error : requested %d bytes, got %d.\n",
 557                                 RPC_HEADER_LEN+RPC_HDR_RESP_LEN, num_read ));
 558                         return False;
 559                 }
 560
 561                 /* This call sets the endianness in hps. */
 562
 563                 if (!rpc_check_hdr(&hps, &rhdr, &first, &last, &len))
 564                         return False;
 565
 566                 /* Ensure the endianness in rdata is set correctly - must be same as hps. */
 567
 568                 if (hps.bigendian_data != rdata->bigendian_data) {
 569                         DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to %s\n",
 570                                 rdata->bigendian_data ? "big" : "little",
 571                                 hps.bigendian_data ? "big" : "little" ));
 572                         return False;
 573                 }
 574
 575                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, &hps, 0)) {
 576                         DEBUG(0,("rpc_api_pipe: Error in unmarshalling RPC_HDR_RESP.\n"));
 577                         return False;
 578                 }
 579
 580                 if (first) {
 581                         DEBUG(0,("rpc_api_pipe: secondary PDU rpc header has 'first' set !\n"));
 582                         return False;
 583                 }
 584
 585                 /*
 586                  * Now read the rest of the PDU.
 587                  */
 588
 589                 if (!rpc_read(cli, rdata, len, &current_offset)) {
 590                         prs_mem_free(rdata);
 591                         return False;
 592                 }
 593
 594                 fragment_start = current_offset - len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 595
 596                 /*
 597                  * Verify any authentication footer.
 598                  */
 599
 600
 601                 if(!rpc_auth_pipe(cli, rdata, fragment_start, rhdr.frag_len,
 602                                   rhdr.auth_len, rhdr.pkt_type, &auth_padding_len)) {
 603                         prs_mem_free(rdata);
 604                         return False;
 605                 }
 606
 607                 if (rhdr.auth_len != 0 ) {
 608
 609                         /*
 610                          * Drop the auth footers from the current offset.
 611                          * The auth footers consist of the auth_data and the
 612                          * preceeding 8 byte auth_header.
 613                          * We need this if there are more fragments.
 614                          */
 615                         current_offset -= (auth_padding_len + RPC_HDR_AUTH_LEN + rhdr.auth_len);
 616                 }
 617         }
 618
 619         return True;
 620 }
 621
 622 /*******************************************************************
 623  creates a DCE/RPC bind request
 624
 625  - initialises the parse structure.
 626  - dynamically allocates the header data structure
 627  - caller is expected to free the header data structure once used.
 628
 629  ********************************************************************/
 630
 631 static NTSTATUS create_rpc_bind_req(struct cli_state *cli, prs_struct *rpc_out,
 632                                     uint32 rpc_call_id,
 633                                     RPC_IFACE *abstract, RPC_IFACE *transfer,
 634                                     const char *my_name, const char *domain)
 635 {
 636         RPC_HDR hdr;
 637         RPC_HDR_RB hdr_rb;
 638         RPC_HDR_AUTH hdr_auth;
 639         int auth_len = 0;
 640         int auth_type, auth_level;
 641         size_t saved_hdr_offset = 0;
 642
 643         prs_struct auth_info;
 644         prs_init(&auth_info, RPC_HDR_AUTH_LEN, /* we will need at least this much */
 645                 prs_get_mem_context(rpc_out), MARSHALL);
 646
 647         if (cli->pipe_auth_flags) {
 648                 get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 649
 650                 /*
 651                  * Create the auth structs we will marshall.
 652                  */
 653
 654                 init_rpc_hdr_auth(&hdr_auth, auth_type, auth_level, 0x00, 1);
 655
 656                 /*
 657                  * Now marshall the data into the temporary parse_struct.
 658                  */
 659
 660                 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &auth_info, 0)) {
 661                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_AUTH.\n"));
 662                         prs_mem_free(&auth_info);
 663                         return NT_STATUS_NO_MEMORY;
 664                 }
 665                 saved_hdr_offset = prs_offset(&auth_info);
 666         }
 667
 668         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 669
 670                 NTSTATUS nt_status;
 671                 DATA_BLOB null_blob = data_blob(NULL, 0);
 672                 DATA_BLOB request;
 673
 674                 DEBUG(5, ("Processing NTLMSSP Negotiate\n"));
 675                 nt_status = ntlmssp_client_update(cli->ntlmssp_pipe_state,
 676                                                   null_blob,
 677                                                   &request);
 678
 679                 if (!NT_STATUS_EQUAL(nt_status,
 680                                      NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 681                         prs_mem_free(&auth_info);
 682                         return nt_status;
 683                 }
 684
 685                 /* Auth len in the rpc header doesn't include auth_header. */
 686                 auth_len = request.length;
 687                 prs_copy_data_in(&auth_info, (char *)request.data, request.length);
 688
 689                 DEBUG(5, ("NTLMSSP Negotiate:\n"));
 690                 dump_data(5, (const char *)request.data, request.length);
 691
 692                 data_blob_free(&request);
 693
 694         } else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 695                 RPC_AUTH_NETSEC_NEG netsec_neg;
 696
 697                 /* Use lp_workgroup() if domain not specified */
 698
 699                 if (!domain || !domain[0]) {
 700                         DEBUG(10,("create_rpc_bind_req: no domain; assuming my own\n"));
 701                         domain = lp_workgroup();
 702                 }
 703
 704                 init_rpc_auth_netsec_neg(&netsec_neg, domain, my_name);
 705
 706                 /*
 707                  * Now marshall the data into the temporary parse_struct.
 708                  */
 709
 710                 if(!smb_io_rpc_auth_netsec_neg("netsec_neg",
 711                                                &netsec_neg, &auth_info, 0)) {
 712                         DEBUG(0,("Failed to marshall RPC_AUTH_NETSEC_NEG.\n"));
 713                         prs_mem_free(&auth_info);
 714                         return NT_STATUS_NO_MEMORY;
 715                 }
 716
 717                 /* Auth len in the rpc header doesn't include auth_header. */
 718                 auth_len = prs_offset(&auth_info) - saved_hdr_offset;
 719         }
 720
 721         /* Create the request RPC_HDR */
 722         init_rpc_hdr(&hdr, RPC_BIND, 0x3, rpc_call_id,
 723                 RPC_HEADER_LEN + RPC_HDR_RB_LEN + prs_offset(&auth_info),
 724                 auth_len);
 725
 726         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
 727                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR.\n"));
 728                 prs_mem_free(&auth_info);
 729                 return NT_STATUS_NO_MEMORY;
 730         }
 731
 732         /* create the bind request RPC_HDR_RB */
 733         init_rpc_hdr_rb(&hdr_rb, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN, 0x0,
 734                         0x1, 0x0, 0x1, abstract, transfer);
 735
 736         /* Marshall the bind request data */
 737         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
 738                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_RB.\n"));
 739                 prs_mem_free(&auth_info);
 740                 return NT_STATUS_NO_MEMORY;
 741         }
 742
 743         /*
 744          * Grow the outgoing buffer to store any auth info.
 745          */
 746
 747         if(auth_len != 0) {
 748                 if(!prs_append_prs_data( rpc_out, &auth_info)) {
 749                         DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 750                         prs_mem_free(&auth_info);
 751                         return NT_STATUS_NO_MEMORY;
 752                 }
 753         }
 754         prs_mem_free(&auth_info);
 755         return NT_STATUS_OK;
 756 }
 757
 758 /*******************************************************************
 759  Creates a DCE/RPC bind authentication response.
 760  This is the packet that is sent back to the server once we
 761  have received a BIND-ACK, to finish the third leg of
 762  the authentication handshake.
 763  ********************************************************************/
 764
 765 static NTSTATUS create_rpc_bind_resp(struct cli_state *cli,
 766                                  uint32 rpc_call_id,
 767                                  prs_struct *rpc_out)
 768 {
 769         NTSTATUS nt_status;
 770         RPC_HDR hdr;
 771         RPC_HDR_AUTHA hdr_autha;
 772         DATA_BLOB ntlmssp_null_response = data_blob(NULL, 0);
 773         DATA_BLOB ntlmssp_reply;
 774         int auth_type, auth_level;
 775
 776         /* The response is picked up from the internal cache,
 777            where it was placed by the rpc_auth_pipe() code */
 778         nt_status = ntlmssp_client_update(cli->ntlmssp_pipe_state,
 779                                           ntlmssp_null_response,
 780                                           &ntlmssp_reply);
 781
 782         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 783                 return nt_status;
 784         }
 785
 786         /* Create the request RPC_HDR */
 787         init_rpc_hdr(&hdr, RPC_BINDRESP, 0x0, rpc_call_id,
 788                      RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN + ntlmssp_reply.length,
 789                      ntlmssp_reply.length );
 790
 791         /* Marshall it. */
 792         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
 793                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR.\n"));
 794                 data_blob_free(&ntlmssp_reply);
 795                 return NT_STATUS_NO_MEMORY;
 796         }
 797
 798         get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 799
 800         /* Create the request RPC_HDR_AUTHA */
 801         init_rpc_hdr_autha(&hdr_autha, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN,
 802                            auth_type, auth_level, 0x00);
 803
 804         if(!smb_io_rpc_hdr_autha("hdr_autha", &hdr_autha, rpc_out, 0)) {
 805                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR_AUTHA.\n"));
 806                 data_blob_free(&ntlmssp_reply);
 807                 return NT_STATUS_NO_MEMORY;
 808         }
 809
 810         /*
 811          * Append the auth data to the outgoing buffer.
 812          */
 813
 814         if(!prs_copy_data_in(rpc_out, (char *)ntlmssp_reply.data, ntlmssp_reply.length)) {
 815                 DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 816                 data_blob_free(&ntlmssp_reply);
 817                 return NT_STATUS_NO_MEMORY;
 818         }
 819
 820         if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
 821                 nt_status = ntlmssp_client_sign_init(cli->ntlmssp_pipe_state);
 822
 823                 if (!NT_STATUS_IS_OK(nt_status)) {
 824                         return nt_status;
 825                 }
 826         }
 827
 828         data_blob_free(&ntlmssp_reply);
 829         return NT_STATUS_OK;
 830 }
 831
 832
 833 /*******************************************************************
 834  Creates a DCE/RPC request.
 835  ********************************************************************/
 836
 837 static uint32 create_rpc_request(prs_struct *rpc_out, uint8 op_num, int data_len, int auth_len, uint8 flags, uint32 oldid, uint32 data_left)
 838 {
 839         uint32 alloc_hint;
 840         RPC_HDR     hdr;
 841         RPC_HDR_REQ hdr_req;
 842         uint32 callid = oldid ? oldid : get_rpc_call_id();
 843
 844         DEBUG(5,("create_rpc_request: opnum: 0x%x data_len: 0x%x\n", op_num, data_len));
 845
 846         /* create the rpc header RPC_HDR */
 847         init_rpc_hdr(&hdr, RPC_REQUEST, flags,
 848                      callid, data_len, auth_len);
 849
 850         /*
 851          * The alloc hint should be the amount of data, not including
 852          * RPC headers & footers.
 853          */
 854
 855         if (auth_len != 0)
 856                 alloc_hint = data_len - RPC_HEADER_LEN - RPC_HDR_AUTH_LEN - auth_len;
 857         else
 858                 alloc_hint = data_len - RPC_HEADER_LEN;
 859
 860         DEBUG(10,("create_rpc_request: data_len: %x auth_len: %x alloc_hint: %x\n",
 861                    data_len, auth_len, alloc_hint));
 862
 863         /* Create the rpc request RPC_HDR_REQ */
 864         init_rpc_hdr_req(&hdr_req, alloc_hint, op_num);
 865
 866         /* stream-time... */
 867         if(!smb_io_rpc_hdr("hdr    ", &hdr, rpc_out, 0))
 868                 return 0;
 869
 870         if(!smb_io_rpc_hdr_req("hdr_req", &hdr_req, rpc_out, 0))
 871                 return 0;
 872
 873         if (prs_offset(rpc_out) != RPC_HEADER_LEN + RPC_HDR_REQ_LEN)
 874                 return 0;
 875
 876         return callid;
 877 }
 878
 879 /*******************************************************************
 880  Puts an auth header into an rpc request.
 881  ********************************************************************/
 882
 883 static BOOL create_auth_hdr(prs_struct *outgoing_packet,
 884                             int auth_type,
 885                             int auth_level, int padding)
 886 {
 887         RPC_HDR_AUTH hdr_auth;
 888
 889         init_rpc_hdr_auth(&hdr_auth, auth_type, auth_level,
 890                           padding, 1);
 891         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth,
 892                                 outgoing_packet, 0)) {
 893                 DEBUG(0,("create_auth_hdr:Failed to marshal RPC_HDR_AUTH.\n"));
 894                 return False;
 895         }
 896         return True;
 897 }
 898
 899 /**
 900  * Send a request on an RPC pipe and get a response.
 901  *
 902  * @param data NDR contents of the request to be sent.
 903  * @param rdata Unparsed NDR response data.
 904 **/
 905
 906 BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num,
 907                       prs_struct *data, prs_struct *rdata)
 908 {
 909         uint32 auth_len, real_auth_len, auth_hdr_len, max_data, data_left, data_sent;
 910         NTSTATUS nt_status;
 911         BOOL ret = False;
 912         uint32 callid = 0;
 913         fstring dump_name;
 914
 915         auth_len = 0;
 916         real_auth_len = 0;
 917         auth_hdr_len = 0;
 918
 919         if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
 920                 if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 921                         auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 922                 }
 923                 if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 924                         auth_len = RPC_AUTH_NETSEC_CHK_LEN;
 925                 }
 926                 auth_hdr_len = RPC_HDR_AUTH_LEN;
 927         }
 928
 929         /*
 930          * calc how much actual data we can send in a PDU fragment
 931          */
 932         max_data = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 933                 auth_hdr_len - auth_len - 8;
 934
 935         for (data_left = prs_offset(data), data_sent = 0; data_left > 0;) {
 936                 prs_struct outgoing_packet;
 937                 prs_struct sec_blob;
 938                 uint32 data_len, send_size;
 939                 uint8 flags = 0;
 940                 uint32 auth_padding = 0;
 941                 RPC_AUTH_NETSEC_CHK verf;
 942                 DATA_BLOB sign_blob;
 943
 944                 /*
 945                  * how much will we send this time
 946                  */
 947                 send_size = MIN(data_left, max_data);
 948
 949                 if (!prs_init(&sec_blob, send_size, /* will need at least this much */
 950                               cli->mem_ctx, MARSHALL)) {
 951                         DEBUG(0,("Could not malloc %u bytes",
 952                                  send_size+auth_padding));
 953                         return False;
 954                 }
 955
 956                 if(!prs_append_some_prs_data(&sec_blob, data,
 957                                              data_sent, send_size)) {
 958                         DEBUG(0,("Failed to append data to netsec blob\n"));
 959                         prs_mem_free(&sec_blob);
 960                         return False;
 961                 }
 962
 963                 /*
 964                  * NT expects the data that is sealed to be 8-byte
 965                  * aligned. The padding must be encrypted as well and
 966                  * taken into account when generating the
 967                  * authentication verifier. The amount of padding must
 968                  * be stored in the auth header.
 969                  */
 970
 971                 if (cli->pipe_auth_flags) {
 972                         size_t data_and_padding_size;
 973                         int auth_type;
 974                         int auth_level;
 975                         prs_align_uint64(&sec_blob);
 976
 977                         get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 978
 979                         data_and_padding_size = prs_offset(&sec_blob);
 980                         auth_padding = data_and_padding_size - send_size;
 981
 982                         /* insert the auth header */
 983
 984                         if(!create_auth_hdr(&sec_blob, auth_type, auth_level, auth_padding)) {
 985                                 prs_mem_free(&sec_blob);
 986                                 return False;
 987                         }
 988
 989                         /* create an NTLMSSP signature */
 990                         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 991                                 /*
 992                                  * Seal the outgoing data if requested.
 993                                  */
 994                                 if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) {
 995
 996                                         nt_status = ntlmssp_client_seal_packet(cli->ntlmssp_pipe_state,
 997                                                                                (unsigned char*)prs_data_p(&sec_blob),
 998                                                                                data_and_padding_size,
 999                                                                                &sign_blob);
1000                                         if (!NT_STATUS_IS_OK(nt_status)) {
1001                                                 prs_mem_free(&sec_blob);
1002                                                 return False;
1003                                         }
1004                                 }
1005                                 else if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
1006
1007                                         nt_status = ntlmssp_client_sign_packet(cli->ntlmssp_pipe_state,
1008                                                                                (unsigned char*)prs_data_p(&sec_blob),
1009                                                                                data_and_padding_size, &sign_blob);
1010                                         if (!NT_STATUS_IS_OK(nt_status)) {
1011                                                 prs_mem_free(&sec_blob);
1012                                                 return False;
1013                                         }
1014                                 }
1015
1016
1017                                 /* write auth footer onto the packet */
1018                                 real_auth_len = sign_blob.length;
1019
1020                                 prs_copy_data_in(&sec_blob, (char *)sign_blob.data, sign_blob.length);
1021                                 data_blob_free(&sign_blob);
1022
1023                         }
1024                         else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
1025                                 static const uchar netsec_sig[8] = NETSEC_SIGNATURE;
1026                                 static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 };
1027                                 size_t parse_offset_marker;
1028                                 DEBUG(10,("SCHANNEL seq_num=%d\n", cli->auth_info.seq_num));
1029
1030                                 init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes,
1031                                                          nullbytes, nullbytes);
1032
1033                                 netsec_encode(&cli->auth_info,
1034                                               cli->pipe_auth_flags,
1035                                               SENDER_IS_INITIATOR,
1036                                               &verf,
1037                                               prs_data_p(&sec_blob),
1038                                               data_and_padding_size);
1039
1040                                 cli->auth_info.seq_num++;
1041
1042                                 /* write auth footer onto the packet */
1043
1044                                 parse_offset_marker = prs_offset(&sec_blob);
1045                                 if (!smb_io_rpc_auth_netsec_chk("", &verf,
1046                                                                 &sec_blob, 0)) {
1047                                         prs_mem_free(&sec_blob);
1048                                         return False;
1049                                 }
1050                                 real_auth_len = prs_offset(&sec_blob) - parse_offset_marker;
1051                         }
1052                 }
1053
1054                 data_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + prs_offset(&sec_blob);
1055
1056                 /*
1057                  * Malloc parse struct to hold it (and enough for alignments).
1058                  */
1059                 if(!prs_init(&outgoing_packet, data_len + 8,
1060                              cli->mem_ctx, MARSHALL)) {
1061                         DEBUG(0,("rpc_api_pipe_req: Failed to malloc %u bytes.\n", (unsigned int)data_len ));
1062                         return False;
1063                 }
1064
1065                 if (data_left == prs_offset(data))
1066                         flags |= RPC_FLG_FIRST;
1067
1068                 if (data_left <= max_data)
1069                         flags |= RPC_FLG_LAST;
1070                 /*
1071                  * Write out the RPC header and the request header.
1072                  */
1073                 if(!(callid = create_rpc_request(&outgoing_packet, op_num,
1074                                                  data_len, real_auth_len, flags,
1075                                                  callid, data_left))) {
1076                         DEBUG(0,("rpc_api_pipe_req: Failed to create RPC request.\n"));
1077                         prs_mem_free(&outgoing_packet);
1078                         prs_mem_free(&sec_blob);
1079                         return False;
1080                 }
1081
1082                 prs_append_prs_data(&outgoing_packet, &sec_blob);
1083                 prs_mem_free(&sec_blob);
1084
1085                 DEBUG(100,("data_len: %x data_calc_len: %x\n", data_len,
1086                            prs_offset(&outgoing_packet)));
1087
1088                 if (flags & RPC_FLG_LAST)
1089                         ret = rpc_api_pipe(cli, &outgoing_packet,
1090                                            rdata, RPC_RESPONSE);
1091                 else {
1092                         cli_write(cli, cli->nt_pipe_fnum, 0x0008,
1093                                    prs_data_p(&outgoing_packet),
1094                                    data_sent, data_len);
1095                 }
1096                 prs_mem_free(&outgoing_packet);
1097                 data_sent += send_size;
1098                 data_left -= send_size;
1099         }
1100         /* Also capture received data */
1101         slprintf(dump_name, sizeof(dump_name) - 1, "reply_%s",
1102                  cli_pipe_get_name(cli));
1103         prs_dump(dump_name, op_num, rdata);
1104
1105         return ret;
1106 }
1107
1108 /****************************************************************************
1109  Set the handle state.
1110 ****************************************************************************/
1111
1112 static BOOL rpc_pipe_set_hnd_state(struct cli_state *cli, const char *pipe_name, uint16 device_state)
1113 {
1114         BOOL state_set = False;
1115         char param[2];
1116         uint16 setup[2]; /* only need 2 uint16 setup parameters */
1117         char *rparam = NULL;
1118         char *rdata = NULL;
1119         uint32 rparam_len, rdata_len;
1120
1121         if (pipe_name == NULL)
1122                 return False;
1123
1124         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
1125         cli->nt_pipe_fnum, pipe_name, device_state));
1126
1127         /* create parameters: device state */
1128         SSVAL(param, 0, device_state);
1129
1130         /* create setup parameters. */
1131         setup[0] = 0x0001;
1132         setup[1] = cli->nt_pipe_fnum; /* pipe file handle.  got this from an SMBOpenX. */
1133
1134         /* send the data on \PIPE\ */
1135         if (cli_api_pipe(cli, "\\PIPE\\",
1136                     setup, 2, 0,                /* setup, length, max */
1137                     param, 2, 0,                /* param, length, max */
1138                     NULL, 0, 1024,              /* data, length, max */
1139                     &rparam, &rparam_len,        /* return param, length */
1140                     &rdata, &rdata_len))         /* return data, length */
1141         {
1142                 DEBUG(5, ("Set Handle state: return OK\n"));
1143                 state_set = True;
1144         }
1145
1146         SAFE_FREE(rparam);
1147         SAFE_FREE(rdata);
1148
1149         return state_set;
1150 }
1151
1152 /****************************************************************************
1153  check the rpc bind acknowledge response
1154 ****************************************************************************/
1155
1156 int get_pipe_index( const char *pipe_name )
1157 {
1158         int pipe_idx = 0;
1159
1160         while (pipe_names[pipe_idx].client_pipe != NULL) {
1161                 if (strequal(pipe_name, pipe_names[pipe_idx].client_pipe ))
1162                         return pipe_idx;
1163                 pipe_idx++;
1164         };
1165
1166         return -1;
1167 }
1168
1169
1170 /****************************************************************************
1171  check the rpc bind acknowledge response
1172 ****************************************************************************/
1173
1174 const char* get_pipe_name_from_index( const int pipe_index )
1175 {
1176
1177         if ( (pipe_index < 0) || (pipe_index >= PI_MAX_PIPES) )
1178                 return NULL;
1179
1180         return pipe_names[pipe_index].client_pipe;
1181 }
1182
1183 /****************************************************************************
1184  Check to see if this pipe index points to one of
1185  the pipes only supported by Win2k
1186  ****************************************************************************/
1187
1188 BOOL is_win2k_pipe( const int pipe_idx )
1189 {
1190         switch ( pipe_idx )
1191         {
1192                 case PI_LSARPC_DS:
1193                         return True;
1194         }
1195
1196         return False;
1197 }
1198
1199 /****************************************************************************
1200  check the rpc bind acknowledge response
1201 ****************************************************************************/
1202
1203 static BOOL valid_pipe_name(const int pipe_idx, RPC_IFACE *abstract, RPC_IFACE *transfer)
1204 {
1205         if ( pipe_idx >= PI_MAX_PIPES ) {
1206                 DEBUG(0,("valid_pipe_name: Programmer error!  Invalid pipe index [%d]\n",
1207                         pipe_idx));
1208                 return False;
1209         }
1210
1211         DEBUG(5,("Bind Abstract Syntax: "));
1212         dump_data(5, (char*)&(pipe_names[pipe_idx].abstr_syntax),
1213                   sizeof(pipe_names[pipe_idx].abstr_syntax));
1214         DEBUG(5,("Bind Transfer Syntax: "));
1215         dump_data(5, (char*)&(pipe_names[pipe_idx].trans_syntax),
1216                   sizeof(pipe_names[pipe_idx].trans_syntax));
1217
1218         /* copy the required syntaxes out so we can do the right bind */
1219
1220         *transfer = pipe_names[pipe_idx].trans_syntax;
1221         *abstract = pipe_names[pipe_idx].abstr_syntax;
1222
1223         return True;
1224 }
1225
1226 /****************************************************************************
1227  check the rpc bind acknowledge response
1228 ****************************************************************************/
1229
1230 static BOOL check_bind_response(RPC_HDR_BA *hdr_ba, const int pipe_idx, RPC_IFACE *transfer)
1231 {
1232         int i = 0;
1233
1234         if ( hdr_ba->addr.len <= 0)
1235                 return False;
1236
1237         if ( !strequal(hdr_ba->addr.str, pipe_names[pipe_idx].server_pipe ))
1238         {
1239                 DEBUG(4,("bind_rpc_pipe: pipe_name %s != expected pipe %s.  oh well!\n",
1240                          pipe_names[i].server_pipe ,hdr_ba->addr.str));
1241                 return False;
1242         }
1243
1244         DEBUG(5,("bind_rpc_pipe: server pipe_name found: %s\n", pipe_names[i].server_pipe ));
1245
1246         if (pipe_names[pipe_idx].server_pipe == NULL) {
1247                 DEBUG(2,("bind_rpc_pipe: pipe name %s unsupported\n", hdr_ba->addr.str));
1248                 return False;
1249         }
1250
1251         /* check the transfer syntax */
1252         if ((hdr_ba->transfer.version != transfer->version) ||
1253              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1254                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1255                 return False;
1256         }
1257
1258         /* lkclXXXX only accept one result: check the result(s) */
1259         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
1260                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1261                           hdr_ba->res.num_results, hdr_ba->res.reason));
1262         }
1263
1264         DEBUG(5,("bind_rpc_pipe: accepted!\n"));
1265         return True;
1266 }
1267
1268 /****************************************************************************
1269  Create and send the third packet in an RPC auth.
1270 ****************************************************************************/
1271
1272 static BOOL rpc_send_auth_reply(struct cli_state *cli, prs_struct *rdata, uint32 rpc_call_id)
1273 {
1274         prs_struct rpc_out;
1275         ssize_t ret;
1276
1277         prs_init(&rpc_out, RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN, /* need at least this much */
1278                  cli->mem_ctx, MARSHALL);
1279
1280         create_rpc_bind_resp(cli, rpc_call_id,
1281                              &rpc_out);
1282
1283         if ((ret = cli_write(cli, cli->nt_pipe_fnum, 0x8, prs_data_p(&rpc_out),
1284                         0, (size_t)prs_offset(&rpc_out))) != (ssize_t)prs_offset(&rpc_out)) {
1285                 DEBUG(0,("rpc_send_auth_reply: cli_write failed. Return was %d\n", (int)ret));
1286                 prs_mem_free(&rpc_out);
1287                 return False;
1288         }
1289
1290         prs_mem_free(&rpc_out);
1291         return True;
1292 }
1293
1294 /****************************************************************************
1295  Do an rpc bind.
1296 ****************************************************************************/
1297
1298 static BOOL rpc_pipe_bind(struct cli_state *cli, int pipe_idx, const char *my_name)
1299 {
1300         RPC_IFACE abstract;
1301         RPC_IFACE transfer;
1302         prs_struct rpc_out;
1303         prs_struct rdata;
1304         uint32 rpc_call_id;
1305         char buffer[MAX_PDU_FRAG_LEN];
1306
1307         if ( (pipe_idx < 0) || (pipe_idx >= PI_MAX_PIPES) )
1308                 return False;
1309
1310         DEBUG(5,("Bind RPC Pipe[%x]: %s\n", cli->nt_pipe_fnum, pipe_names[pipe_idx].client_pipe));
1311
1312         if (!valid_pipe_name(pipe_idx, &abstract, &transfer))
1313                 return False;
1314
1315         prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL);
1316
1317         /*
1318          * Use the MAX_PDU_FRAG_LEN buffer to store the bind request.
1319          */
1320
1321         prs_give_memory( &rpc_out, buffer, sizeof(buffer), False);
1322
1323         rpc_call_id = get_rpc_call_id();
1324
1325         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
1326                 NTSTATUS nt_status;
1327                 fstring password;
1328
1329                 DEBUG(5, ("NTLMSSP authenticated pipe selected\n"));
1330
1331                 nt_status = ntlmssp_client_start(&cli->ntlmssp_pipe_state);
1332
1333                 if (!NT_STATUS_IS_OK(nt_status))
1334                         return False;
1335
1336                 nt_status = ntlmssp_set_username(cli->ntlmssp_pipe_state,
1337                                                  cli->user_name);
1338                 if (!NT_STATUS_IS_OK(nt_status))
1339                         return False;
1340
1341                 nt_status = ntlmssp_set_domain(cli->ntlmssp_pipe_state,
1342                                                cli->domain);
1343                 if (!NT_STATUS_IS_OK(nt_status))
1344                         return False;
1345
1346                 pwd_get_cleartext(&cli->pwd, password);
1347                 nt_status = ntlmssp_set_password(cli->ntlmssp_pipe_state,
1348                                                  password);
1349                 if (!NT_STATUS_IS_OK(nt_status))
1350                         return False;
1351
1352                 if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
1353                         cli->ntlmssp_pipe_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
1354                 }
1355
1356                 if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) {
1357                         cli->ntlmssp_pipe_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
1358                 }
1359         } else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
1360                 cli->auth_info.seq_num = 0;
1361         }
1362
1363         /* Marshall the outgoing data. */
1364         create_rpc_bind_req(cli, &rpc_out, rpc_call_id,
1365                             &abstract, &transfer,
1366                             global_myname(), cli->domain);
1367
1368         /* Initialize the incoming data struct. */
1369         prs_init(&rdata, 0, cli->mem_ctx, UNMARSHALL);
1370
1371         /* send data on \PIPE\.  receive a response */
1372         if (rpc_api_pipe(cli, &rpc_out, &rdata, RPC_BINDACK)) {
1373                 RPC_HDR_BA   hdr_ba;
1374
1375                 DEBUG(5, ("rpc_pipe_bind: rpc_api_pipe returned OK.\n"));
1376
1377                 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &rdata, 0)) {
1378                         DEBUG(0,("rpc_pipe_bind: Failed to unmarshall RPC_HDR_BA.\n"));
1379                         prs_mem_free(&rdata);
1380                         return False;
1381                 }
1382
1383                 if(!check_bind_response(&hdr_ba, pipe_idx, &transfer)) {
1384                         DEBUG(2,("rpc_pipe_bind: check_bind_response failed.\n"));
1385                         prs_mem_free(&rdata);
1386                         return False;
1387                 }
1388
1389                 cli->max_xmit_frag = hdr_ba.bba.max_tsize;
1390                 cli->max_recv_frag = hdr_ba.bba.max_rsize;
1391
1392                 /*
1393                  * If we're doing NTLMSSP auth we need to send a reply to
1394                  * the bind-ack to complete the 3-way challenge response
1395                  * handshake.
1396                  */
1397
1398                 if ((cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP)
1399                     && !rpc_send_auth_reply(cli, &rdata, rpc_call_id)) {
1400                         DEBUG(0,("rpc_pipe_bind: rpc_send_auth_reply failed.\n"));
1401                         prs_mem_free(&rdata);
1402                         return False;
1403                 }
1404                 prs_mem_free(&rdata);
1405                 return True;
1406         }
1407
1408         return False;
1409 }
1410
1411 /****************************************************************************
1412  Open a session.
1413  ****************************************************************************/
1414
1415 BOOL cli_nt_session_open(struct cli_state *cli, const int pipe_idx)
1416 {
1417         int fnum;
1418
1419         /* At the moment we can't have more than one pipe open over
1420            a cli connection. )-: */
1421
1422         SMB_ASSERT(cli->nt_pipe_fnum == 0);
1423
1424         /* The pipe index must fall within our array */
1425
1426         SMB_ASSERT((pipe_idx >= 0) && (pipe_idx < PI_MAX_PIPES));
1427
1428         if (cli->capabilities & CAP_NT_SMBS) {
1429                 if ((fnum = cli_nt_create(cli, &pipe_names[pipe_idx].client_pipe[5], DESIRED_ACCESS_PIPE)) == -1) {
1430                         DEBUG(0,("cli_nt_session_open: cli_nt_create failed on pipe %s to machine %s.  Error was %s\n",
1431                                  &pipe_names[pipe_idx].client_pipe[5], cli->desthost, cli_errstr(cli)));
1432                         return False;
1433                 }
1434
1435                 cli->nt_pipe_fnum = (uint16)fnum;
1436         } else {
1437                 if ((fnum = cli_open(cli, pipe_names[pipe_idx].client_pipe, O_CREAT|O_RDWR, DENY_NONE)) == -1) {
1438                         DEBUG(0,("cli_nt_session_open: cli_open failed on pipe %s to machine %s.  Error was %s\n",
1439                                  pipe_names[pipe_idx].client_pipe, cli->desthost, cli_errstr(cli)));
1440                         return False;
1441                 }
1442
1443                 cli->nt_pipe_fnum = (uint16)fnum;
1444
1445                 /**************** Set Named Pipe State ***************/
1446                 if (!rpc_pipe_set_hnd_state(cli, pipe_names[pipe_idx].client_pipe, 0x4300)) {
1447                         DEBUG(0,("cli_nt_session_open: pipe hnd state failed.  Error was %s\n",
1448                                   cli_errstr(cli)));
1449                         cli_close(cli, cli->nt_pipe_fnum);
1450                         return False;
1451                 }
1452         }
1453
1454         /******************* bind request on pipe *****************/
1455
1456         if (!rpc_pipe_bind(cli, pipe_idx, global_myname())) {
1457                 DEBUG(2,("cli_nt_session_open: rpc bind to %s failed\n",
1458                          get_pipe_name_from_index(pipe_idx)));
1459                 cli_close(cli, cli->nt_pipe_fnum);
1460                 return False;
1461         }
1462
1463         /*
1464          * Setup the remote server name prefixed by \ and the machine account name.
1465          */
1466
1467         fstrcpy(cli->srv_name_slash, "\\\\");
1468         fstrcat(cli->srv_name_slash, cli->desthost);
1469         strupper_m(cli->srv_name_slash);
1470
1471         fstrcpy(cli->clnt_name_slash, "\\\\");
1472         fstrcat(cli->clnt_name_slash, global_myname());
1473         strupper_m(cli->clnt_name_slash);
1474
1475         fstrcpy(cli->mach_acct, global_myname());
1476         fstrcat(cli->mach_acct, "$");
1477         strupper_m(cli->mach_acct);
1478
1479         /* Remember which pipe we're talking to */
1480         fstrcpy(cli->pipe_name, pipe_names[pipe_idx].client_pipe);
1481
1482         return True;
1483 }
1484
1485
1486 /****************************************************************************
1487  Open a session to the NETLOGON pipe using schannel.
1488
1489  (Assumes that the netlogon pipe is already open)
1490  ****************************************************************************/
1491
1492 NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan,
1493                                    const uchar trust_password[16])
1494 {
1495         NTSTATUS result;
1496         /* The 7 here seems to be required to get Win2k not to downgrade us
1497            to NT4.  Actually, anything other than 1ff would seem to do... */
1498         uint32 neg_flags = 0x000701ff;
1499         int fnum;
1500
1501         cli_nt_netlogon_netsec_session_close(cli);
1502
1503         if (lp_client_schannel() != False)
1504                 neg_flags |= NETLOGON_NEG_SCHANNEL;
1505
1506         result = cli_nt_setup_creds(cli, sec_chan, trust_password,
1507                                     &neg_flags, 2);
1508
1509         if (!NT_STATUS_IS_OK(result)) {
1510                 cli_nt_session_close(cli);
1511                 return result;
1512         }
1513
1514         if ((lp_client_schannel() == True) &&
1515             ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
1516
1517                 DEBUG(3, ("Server did not offer schannel\n"));
1518                 cli_nt_session_close(cli);
1519                 return NT_STATUS_UNSUCCESSFUL;
1520         }
1521
1522         if ((lp_client_schannel() == False) ||
1523             ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
1524                 return NT_STATUS_OK;
1525
1526                 /* keep the existing connection to NETLOGON open */
1527
1528         }
1529
1530         /* Server offered schannel, so try it. */
1531
1532         memcpy(cli->auth_info.sess_key, cli->sess_key,
1533                sizeof(cli->auth_info.sess_key));
1534
1535         cli->saved_netlogon_pipe_fnum = cli->nt_pipe_fnum;
1536
1537         cli->pipe_auth_flags = AUTH_PIPE_NETSEC;
1538         cli->pipe_auth_flags |= AUTH_PIPE_SIGN;
1539         cli->pipe_auth_flags |= AUTH_PIPE_SEAL;
1540
1541         if (cli->capabilities & CAP_NT_SMBS) {
1542
1543                 /* The secure channel connection must be opened on the same
1544                    session (TCP connection) as the one the challenge was
1545                    requested from. */
1546                 if ((fnum = cli_nt_create(cli, PIPE_NETLOGON_PLAIN,
1547                                           DESIRED_ACCESS_PIPE)) == -1) {
1548                         DEBUG(0,("cli_nt_create failed to %s machine %s. "
1549                                  "Error was %s\n",
1550                                  PIPE_NETLOGON, cli->desthost,
1551                                  cli_errstr(cli)));
1552                         return NT_STATUS_UNSUCCESSFUL;
1553                 }
1554
1555                 cli->nt_pipe_fnum = (uint16)fnum;
1556         } else {
1557                 if ((fnum = cli_open(cli, PIPE_NETLOGON,
1558                                      O_CREAT|O_RDWR, DENY_NONE)) == -1) {
1559                         DEBUG(0,("cli_open failed on pipe %s to machine %s. "
1560                                  "Error was %s\n",
1561                                  PIPE_NETLOGON, cli->desthost,
1562                                  cli_errstr(cli)));
1563                         return NT_STATUS_UNSUCCESSFUL;
1564                 }
1565
1566                 cli->nt_pipe_fnum = (uint16)fnum;
1567
1568                 /**************** Set Named Pipe State ***************/
1569                 if (!rpc_pipe_set_hnd_state(cli, PIPE_NETLOGON, 0x4300)) {
1570                         DEBUG(0,("Pipe hnd state failed.  Error was %s\n",
1571                                   cli_errstr(cli)));
1572                         cli_close(cli, cli->nt_pipe_fnum);
1573                         return NT_STATUS_UNSUCCESSFUL;
1574                 }
1575         }
1576
1577         if (!rpc_pipe_bind(cli, PI_NETLOGON, global_myname())) {
1578                 DEBUG(2,("rpc bind to %s failed\n", PIPE_NETLOGON));
1579                 cli_close(cli, cli->nt_pipe_fnum);
1580                 return NT_STATUS_UNSUCCESSFUL;
1581         }
1582
1583         return NT_STATUS_OK;
1584 }
1585
1586
1587 NTSTATUS cli_nt_setup_netsec(struct cli_state *cli, int sec_chan,
1588                              const uchar trust_password[16])
1589 {
1590         NTSTATUS result;
1591         /* The 7 here seems to be required to get Win2k not to downgrade us
1592            to NT4.  Actually, anything other than 1ff would seem to do... */
1593         uint32 neg_flags = 0x000701ff;
1594         cli->pipe_auth_flags = 0;
1595
1596         if (lp_client_schannel() == False) {
1597                 return NT_STATUS_OK;
1598         }
1599
1600         if (!cli_nt_session_open(cli, PI_NETLOGON)) {
1601                 DEBUG(0, ("Could not initialise %s\n",
1602                           get_pipe_name_from_index(PI_NETLOGON)));
1603                 return NT_STATUS_UNSUCCESSFUL;
1604         }
1605
1606         if (lp_client_schannel() != False)
1607                 neg_flags |= NETLOGON_NEG_SCHANNEL;
1608
1609         neg_flags |= NETLOGON_NEG_SCHANNEL;
1610
1611         result = cli_nt_setup_creds(cli, sec_chan, trust_password,
1612                                     &neg_flags, 2);
1613
1614         if (!(neg_flags & NETLOGON_NEG_SCHANNEL)
1615             && lp_client_schannel() == True) {
1616                 DEBUG(1, ("Could not negotiate SCHANNEL with the DC!\n"));
1617                 result = NT_STATUS_UNSUCCESSFUL;
1618         }
1619
1620         if (!NT_STATUS_IS_OK(result)) {
1621                 ZERO_STRUCT(cli->auth_info.sess_key);
1622                 ZERO_STRUCT(cli->sess_key);
1623                 cli->pipe_auth_flags = 0;
1624                 cli_nt_session_close(cli);
1625                 return result;
1626         }
1627
1628         memcpy(cli->auth_info.sess_key, cli->sess_key,
1629                sizeof(cli->auth_info.sess_key));
1630
1631         cli->saved_netlogon_pipe_fnum = cli->nt_pipe_fnum;
1632         cli->nt_pipe_fnum = 0;
1633
1634         /* doing schannel, not per-user auth */
1635         cli->pipe_auth_flags = AUTH_PIPE_NETSEC | AUTH_PIPE_SIGN | AUTH_PIPE_SEAL;
1636
1637         return NT_STATUS_OK;
1638 }
1639
1640 const char *cli_pipe_get_name(struct cli_state *cli)
1641 {
1642         return cli->pipe_name;
1643 }
1644
1645