source/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                  1997-1998,
   7  *  Copyright (C) Jeremy Allison                    1999,
   8  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2003.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 #undef DBGC_CLASS
  44 #define DBGC_CLASS DBGC_RPC_SRV
  45
  46 /*************************************************************
  47  HACK Alert!
  48  We need to transfer the session key from one rpc bind to the
  49  next. This is the way the netlogon schannel works.
  50 **************************************************************/
  51 struct dcinfo last_dcinfo;
  52
  53 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  54 {
  55     unsigned char *hash = p->ntlmssp_hash;
  56     unsigned char index_i = hash[256];
  57     unsigned char index_j = hash[257];
  58     int ind;
  59
  60     for( ind = 0; ind < len; ind++) {
  61         unsigned char tc;
  62         unsigned char t;
  63
  64         index_i++;
  65         index_j += hash[index_i];
  66
  67         tc = hash[index_i];
  68         hash[index_i] = hash[index_j];
  69         hash[index_j] = tc;
  70
  71         t = hash[index_i] + hash[index_j];
  72         data[ind] = data[ind] ^ hash[t];
  73     }
  74
  75     hash[256] = index_i;
  76     hash[257] = index_j;
  77 }
  78
  79 /*******************************************************************
  80  Generate the next PDU to be returned from the data in p->rdata.
  81  We cheat here as this function doesn't handle the special auth
  82  footers of the authenticated bind response reply.
  83  ********************************************************************/
  84
  85 BOOL create_next_pdu(pipes_struct *p)
  86 {
  87         RPC_HDR_RESP hdr_resp;
  88         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  89         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  90         uint32 data_len;
  91         uint32 data_space_available;
  92         uint32 data_len_left;
  93         prs_struct outgoing_pdu;
  94         uint32 data_pos;
  95
  96         /*
  97          * If we're in the fault state, keep returning fault PDU's until
  98          * the pipe gets closed. JRA.
  99          */
 100
 101         if(p->fault_state) {
 102                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 103                 return True;
 104         }
 105
 106         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 107
 108         /* Change the incoming request header to a response. */
 109         p->hdr.pkt_type = RPC_RESPONSE;
 110
 111         /* Set up rpc header flags. */
 112         if (p->out_data.data_sent_length == 0)
 113                 p->hdr.flags = RPC_FLG_FIRST;
 114         else
 115                 p->hdr.flags = 0;
 116
 117         /*
 118          * Work out how much we can fit in a single PDU.
 119          */
 120
 121         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 122         if(p->ntlmssp_auth_validated)
 123                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 124
 125         if(p->netsec_auth_validated)
 126                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN);
 127
 128         /*
 129          * The amount we send is the minimum of the available
 130          * space and the amount left to send.
 131          */
 132
 133         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 134
 135         /*
 136          * Ensure there really is data left to send.
 137          */
 138
 139         if(!data_len_left) {
 140                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 141                 return False;
 142         }
 143
 144         data_len = MIN(data_len_left, data_space_available);
 145
 146         /*
 147          * Set up the alloc hint. This should be the data left to
 148          * send.
 149          */
 150
 151         hdr_resp.alloc_hint = data_len_left;
 152
 153         /*
 154          * Set up the header lengths.
 155          */
 156
 157         if (p->ntlmssp_auth_validated) {
 158                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 159                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 160                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 161         } else if (p->netsec_auth_validated) {
 162                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 163                         RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN;
 164                 p->hdr.auth_len = RPC_AUTH_NETSEC_CHK_LEN;
 165         } else {
 166                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 167                 p->hdr.auth_len = 0;
 168         }
 169
 170         /*
 171          * Work out if this PDU will be the last.
 172          */
 173
 174         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 175                 p->hdr.flags |= RPC_FLG_LAST;
 176
 177         /*
 178          * Init the parse struct to point at the outgoing
 179          * data.
 180          */
 181
 182         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 183         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 184
 185         /* Store the header in the data stream. */
 186         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 187                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 188                 prs_mem_free(&outgoing_pdu);
 189                 return False;
 190         }
 191
 192         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 193                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 194                 prs_mem_free(&outgoing_pdu);
 195                 return False;
 196         }
 197
 198         /* Store the current offset. */
 199         data_pos = prs_offset(&outgoing_pdu);
 200
 201         /* Copy the data into the PDU. */
 202
 203         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 204                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 205                 prs_mem_free(&outgoing_pdu);
 206                 return False;
 207         }
 208
 209         if (p->ntlmssp_auth_validated) {
 210                 uint32 crc32 = 0;
 211                 char *data;
 212
 213                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 214                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 215
 216                 /*
 217                  * Set data to point to where we copied the data into.
 218                  */
 219
 220                 data = prs_data_p(&outgoing_pdu) + data_pos;
 221
 222                 if (auth_seal) {
 223                         crc32 = crc32_calc_buffer(data, data_len);
 224                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 225                 }
 226
 227                 if (auth_seal || auth_verify) {
 228                         RPC_HDR_AUTH auth_info;
 229
 230                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL,
 231                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 232                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 233                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 234                                 prs_mem_free(&outgoing_pdu);
 235                                 return False;
 236                         }
 237                 }
 238
 239                 if (auth_verify) {
 240                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 241                         char *auth_data = prs_data_p(&outgoing_pdu);
 242
 243                         p->ntlmssp_seq_num++;
 244                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 245                                         crc32, p->ntlmssp_seq_num++);
 246                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 247                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 248                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 249                                 prs_mem_free(&outgoing_pdu);
 250                                 return False;
 251                         }
 252                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 253                 }
 254         }
 255
 256         if (p->netsec_auth_validated) {
 257                 int auth_type, auth_level;
 258                 char *data;
 259                 RPC_HDR_AUTH auth_info;
 260
 261                 RPC_AUTH_NETSEC_CHK verf;
 262                 prs_struct rverf;
 263                 prs_struct rauth;
 264
 265                 data = prs_data_p(&outgoing_pdu) + data_pos;
 266                 /* Check it's the type of reply we were expecting to decode */
 267
 268                 get_auth_type_level(p->netsec_auth.auth_flags, &auth_type, &auth_level);
 269                 init_rpc_hdr_auth(&auth_info, auth_type, auth_level,
 270                                   RPC_HDR_AUTH_LEN, 1);
 271
 272                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 273                         DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 274                         prs_mem_free(&outgoing_pdu);
 275                         return False;
 276                 }
 277
 278                 prs_init(&rverf, 0, p->mem_ctx, MARSHALL);
 279                 prs_init(&rauth, 0, p->mem_ctx, MARSHALL);
 280
 281                 netsec_encode(&p->netsec_auth,
 282                               p->netsec_auth.auth_flags,
 283                               SENDER_IS_ACCEPTOR,
 284                               &verf, data, data_len);
 285
 286                 smb_io_rpc_auth_netsec_chk("", &verf, &outgoing_pdu, 0);
 287
 288                 p->netsec_auth.seq_num++;
 289         }
 290
 291         /*
 292          * Setup the counts for this PDU.
 293          */
 294
 295         p->out_data.data_sent_length += data_len;
 296         p->out_data.current_pdu_len = p->hdr.frag_len;
 297         p->out_data.current_pdu_sent = 0;
 298
 299         prs_mem_free(&outgoing_pdu);
 300         return True;
 301 }
 302
 303 /*******************************************************************
 304  Process an NTLMSSP authentication response.
 305  If this function succeeds, the user has been authenticated
 306  and their domain, name and calling workstation stored in
 307  the pipe struct.
 308  The initial challenge is stored in p->challenge.
 309  *******************************************************************/
 310
 311 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 312 {
 313         uchar lm_owf[24];
 314         uchar nt_owf[128];
 315         int nt_pw_len;
 316         int lm_pw_len;
 317         fstring user_name;
 318         fstring domain;
 319         fstring wks;
 320
 321         NTSTATUS nt_status;
 322
 323         struct auth_context *auth_context = NULL;
 324         auth_usersupplied_info *user_info = NULL;
 325         auth_serversupplied_info *server_info = NULL;
 326
 327         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 328
 329         memset(p->user_name, '\0', sizeof(p->user_name));
 330         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 331         memset(p->domain, '\0', sizeof(p->domain));
 332         memset(p->wks, '\0', sizeof(p->wks));
 333
 334         /* Set up for non-authenticated user. */
 335         delete_nt_token(&p->pipe_user.nt_user_token);
 336         p->pipe_user.ngroups = 0;
 337         SAFE_FREE( p->pipe_user.groups);
 338
 339         /*
 340          * Setup an empty password for a guest user.
 341          */
 342
 343         /*
 344          * We always negotiate UNICODE.
 345          */
 346
 347         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 348                 rpcstr_pull(user_name, ntlmssp_resp->user, sizeof(fstring), ntlmssp_resp->hdr_usr.str_str_len*2, 0 );
 349                 rpcstr_pull(domain, ntlmssp_resp->domain, sizeof(fstring), ntlmssp_resp->hdr_domain.str_str_len*2, 0);
 350                 rpcstr_pull(wks, ntlmssp_resp->wks, sizeof(fstring), ntlmssp_resp->hdr_wks.str_str_len*2, 0);
 351         } else {
 352                 pull_ascii_fstring(user_name, ntlmssp_resp->user);
 353                 pull_ascii_fstring(domain, ntlmssp_resp->domain);
 354                 pull_ascii_fstring(wks, ntlmssp_resp->wks);
 355         }
 356
 357         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 358
 359         nt_pw_len = MIN(sizeof(nt_owf), ntlmssp_resp->hdr_nt_resp.str_str_len);
 360         lm_pw_len = MIN(sizeof(lm_owf), ntlmssp_resp->hdr_lm_resp.str_str_len);
 361
 362         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 363         memcpy(nt_owf, ntlmssp_resp->nt_resp, nt_pw_len);
 364
 365 #ifdef DEBUG_PASSWORD
 366         DEBUG(100,("lm, nt owfs, chal\n"));
 367         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 368         dump_data(100, (char *)nt_owf, nt_pw_len);
 369         dump_data(100, (char *)p->challenge, 8);
 370 #endif
 371
 372         /*
 373          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 374          */
 375
 376         if (*user_name) {
 377
 378                 /*
 379                  * Do the length checking only if user is not NULL.
 380                  */
 381
 382                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 383                         return False;
 384                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 385                         return False;
 386                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 387                         return False;
 388                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 389                         return False;
 390                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 391                         return False;
 392
 393         }
 394
 395         make_auth_context_fixed(&auth_context, (uchar*)p->challenge);
 396
 397         if (!make_user_info_netlogon_network(&user_info,
 398                                              user_name, domain, wks,
 399                                              lm_owf, lm_pw_len,
 400                                              nt_owf, nt_pw_len)) {
 401                 DEBUG(0,("make_user_info_netlogon_network failed!  Failing authenticaion.\n"));
 402                 return False;
 403         }
 404
 405         nt_status = auth_context->check_ntlm_password(auth_context, user_info, &server_info);
 406
 407         (auth_context->free)(&auth_context);
 408         free_user_info(&user_info);
 409
 410         p->ntlmssp_auth_validated = NT_STATUS_IS_OK(nt_status);
 411
 412         if (!p->ntlmssp_auth_validated) {
 413                 DEBUG(1,("api_pipe_ntlmssp_verify: User [%s]\\[%s] from machine %s \
 414 failed authentication on named pipe %s.\n", domain, user_name, wks, p->name ));
 415                 free_server_info(&server_info);
 416                 return False;
 417         }
 418
 419         /*
 420          * Set up the sign/seal data.
 421          */
 422
 423         {
 424                 uchar p24[24];
 425                 NTLMSSPOWFencrypt(server_info->first_8_lm_hash, lm_owf, p24);
 426                 {
 427                         unsigned char j = 0;
 428                         int ind;
 429
 430                         unsigned char k2[8];
 431
 432                         memcpy(k2, p24, 5);
 433                         k2[5] = 0xe5;
 434                         k2[6] = 0x38;
 435                         k2[7] = 0xb0;
 436
 437                         for (ind = 0; ind < 256; ind++)
 438                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 439
 440                         for( ind = 0; ind < 256; ind++) {
 441                                 unsigned char tc;
 442
 443                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 444
 445                                 tc = p->ntlmssp_hash[ind];
 446                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 447                                 p->ntlmssp_hash[j] = tc;
 448                         }
 449
 450                         p->ntlmssp_hash[256] = 0;
 451                         p->ntlmssp_hash[257] = 0;
 452                 }
 453
 454                 dump_data_pw("NTLMSSP hash (v1)\n", p->ntlmssp_hash,
 455                              sizeof(p->ntlmssp_hash));
 456
 457 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 458                 p->ntlmssp_seq_num = 0;
 459
 460         }
 461
 462         fstrcpy(p->user_name, user_name);
 463         fstrcpy(p->pipe_user_name, server_info->unix_name);
 464         fstrcpy(p->domain, domain);
 465         fstrcpy(p->wks, wks);
 466
 467         /*
 468          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 469          */
 470
 471         memcpy(p->session_key, server_info->session_key, sizeof(p->session_key));
 472
 473         p->pipe_user.uid = server_info->uid;
 474         p->pipe_user.gid = server_info->gid;
 475
 476         p->pipe_user.ngroups = server_info->n_groups;
 477         if (p->pipe_user.ngroups) {
 478                 if (!(p->pipe_user.groups = memdup(server_info->groups, sizeof(gid_t) * p->pipe_user.ngroups))) {
 479                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 480                         free_server_info(&server_info);
 481                         return False;
 482                 }
 483         }
 484
 485         if (server_info->ptok)
 486                 p->pipe_user.nt_user_token = dup_nt_token(server_info->ptok);
 487         else {
 488                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 489                 p->pipe_user.nt_user_token = NULL;
 490                 free_server_info(&server_info);
 491                 return False;
 492         }
 493
 494         p->ntlmssp_auth_validated = True;
 495
 496         free_server_info(&server_info);
 497         return True;
 498 }
 499
 500 /*******************************************************************
 501  The switch table for the pipe names and the functions to handle them.
 502  *******************************************************************/
 503
 504 struct rpc_table
 505 {
 506   struct
 507   {
 508     const char *clnt;
 509     const char *srv;
 510   } pipe;
 511   struct api_struct *cmds;
 512   int n_cmds;
 513 };
 514
 515 static struct rpc_table *rpc_lookup;
 516 static int rpc_lookup_size;
 517
 518 /*******************************************************************
 519  This is the client reply to our challenge for an authenticated
 520  bind request. The challenge we sent is in p->challenge.
 521 *******************************************************************/
 522
 523 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 524 {
 525         RPC_HDR_AUTHA autha_info;
 526         RPC_AUTH_VERIFIER auth_verifier;
 527         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 528
 529         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 530
 531         if (p->hdr.auth_len == 0) {
 532                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 533                 return False;
 534         }
 535
 536         /*
 537          * Decode the authentication verifier response.
 538          */
 539
 540         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 541                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 542                 return False;
 543         }
 544
 545         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != RPC_PIPE_AUTH_SEAL_LEVEL) {
 546                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 547                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 548                 return False;
 549         }
 550
 551         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 552                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 553                 return False;
 554         }
 555
 556         /*
 557          * Ensure this is a NTLMSSP_AUTH packet type.
 558          */
 559
 560         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 561                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 562                 return False;
 563         }
 564
 565         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 566                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 567                 return False;
 568         }
 569
 570         /*
 571          * The following call actually checks the challenge/response data.
 572          * for correctness against the given DOMAIN\user name.
 573          */
 574
 575         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 576                 return False;
 577
 578         p->pipe_bound = True
 579 ;
 580         return True;
 581 }
 582
 583 /*******************************************************************
 584  Marshall a bind_nak pdu.
 585 *******************************************************************/
 586
 587 static BOOL setup_bind_nak(pipes_struct *p)
 588 {
 589         prs_struct outgoing_rpc;
 590         RPC_HDR nak_hdr;
 591         uint16 zero = 0;
 592
 593         /* Free any memory in the current return data buffer. */
 594         prs_mem_free(&p->out_data.rdata);
 595
 596         /*
 597          * Marshall directly into the outgoing PDU space. We
 598          * must do this as we need to set to the bind response
 599          * header and are never sending more than one PDU here.
 600          */
 601
 602         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 603         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 604
 605
 606         /*
 607          * Initialize a bind_nak header.
 608          */
 609
 610         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 611             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 612
 613         /*
 614          * Marshall the header into the outgoing PDU.
 615          */
 616
 617         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 618                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 619                 prs_mem_free(&outgoing_rpc);
 620                 return False;
 621         }
 622
 623         /*
 624          * Now add the reject reason.
 625          */
 626
 627         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 628                 prs_mem_free(&outgoing_rpc);
 629         return False;
 630         }
 631
 632         p->out_data.data_sent_length = 0;
 633         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 634         p->out_data.current_pdu_sent = 0;
 635
 636         p->pipe_bound = False;
 637
 638         return True;
 639 }
 640
 641 /*******************************************************************
 642  Marshall a fault pdu.
 643 *******************************************************************/
 644
 645 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 646 {
 647         prs_struct outgoing_pdu;
 648         RPC_HDR fault_hdr;
 649         RPC_HDR_RESP hdr_resp;
 650         RPC_HDR_FAULT fault_resp;
 651
 652         /* Free any memory in the current return data buffer. */
 653         prs_mem_free(&p->out_data.rdata);
 654
 655         /*
 656          * Marshall directly into the outgoing PDU space. We
 657          * must do this as we need to set to the bind response
 658          * header and are never sending more than one PDU here.
 659          */
 660
 661         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 662         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 663
 664         /*
 665          * Initialize a fault header.
 666          */
 667
 668         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 669             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 670
 671         /*
 672          * Initialize the HDR_RESP and FAULT parts of the PDU.
 673          */
 674
 675         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 676
 677         fault_resp.status = status;
 678         fault_resp.reserved = 0;
 679
 680         /*
 681          * Marshall the header into the outgoing PDU.
 682          */
 683
 684         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 685                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 686                 prs_mem_free(&outgoing_pdu);
 687                 return False;
 688         }
 689
 690         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 691                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 692                 prs_mem_free(&outgoing_pdu);
 693                 return False;
 694         }
 695
 696         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 697                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 698                 prs_mem_free(&outgoing_pdu);
 699                 return False;
 700         }
 701
 702         p->out_data.data_sent_length = 0;
 703         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 704         p->out_data.current_pdu_sent = 0;
 705
 706         prs_mem_free(&outgoing_pdu);
 707         return True;
 708 }
 709
 710 /*******************************************************************
 711  Ensure a bind request has the correct abstract & transfer interface.
 712  Used to reject unknown binds from Win2k.
 713 *******************************************************************/
 714
 715 BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 716                     RPC_IFACE* transfer, uint32 context_id)
 717 {
 718         extern struct pipe_id_info pipe_names[];
 719         char *pipe_name = p->name;
 720         int i=0;
 721         fstring pname;
 722
 723         fstrcpy(pname,"\\PIPE\\");
 724         fstrcat(pname,pipe_name);
 725
 726         DEBUG(3,("check_bind_req for %s\n", pname));
 727
 728         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 729
 730         for ( i=0; pipe_names[i].client_pipe; i++ )
 731         {
 732                 if ( strequal(pipe_names[i].client_pipe, pname)
 733                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 734                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(struct uuid)) == 0)
 735                         && (transfer->version == pipe_names[i].trans_syntax.version)
 736                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(struct uuid)) == 0) )
 737                 {
 738                         struct api_struct       *fns = NULL;
 739                         int                     n_fns = 0;
 740                         PIPE_RPC_FNS            *context_fns;
 741
 742                         if ( !(context_fns = malloc(sizeof(PIPE_RPC_FNS))) ) {
 743                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 744                                 return False;
 745                         }
 746
 747                         /* save the RPC function table associated with this bind */
 748
 749                         get_pipe_fns(i, &fns, &n_fns);
 750
 751                         context_fns->cmds = fns;
 752                         context_fns->n_cmds = n_fns;
 753                         context_fns->context_id = context_id;
 754
 755                         /* add to the list of open contexts */
 756
 757                         DLIST_ADD( p->contexts, context_fns );
 758
 759                         break;
 760                 }
 761         }
 762
 763         if(pipe_names[i].client_pipe == NULL)
 764                 return False;
 765
 766         return True;
 767 }
 768
 769 /*******************************************************************
 770  Register commands to an RPC pipe
 771 *******************************************************************/
 772 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
 773 {
 774         struct rpc_table *rpc_entry;
 775
 776         if (!clnt || !srv || !cmds) {
 777                 return NT_STATUS_INVALID_PARAMETER;
 778         }
 779
 780         if (version != SMB_RPC_INTERFACE_VERSION) {
 781                 DEBUG(0,("Can't register rpc commands!\n"
 782                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
 783                          ", while this version of samba uses version %d!\n",
 784                          version,SMB_RPC_INTERFACE_VERSION));
 785                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 786         }
 787
 788         /* TODO:
 789          *
 790          * we still need to make sure that don't register the same commands twice!!!
 791          *
 792          * --metze
 793          */
 794
 795         /* We use a temporary variable because this call can fail and
 796            rpc_lookup will still be valid afterwards.  It could then succeed if
 797            called again later */
 798         rpc_entry = realloc(rpc_lookup,
 799                             ++rpc_lookup_size*sizeof(struct rpc_table));
 800         if (NULL == rpc_entry) {
 801                 rpc_lookup_size--;
 802                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
 803                 return NT_STATUS_NO_MEMORY;
 804         } else {
 805                 rpc_lookup = rpc_entry;
 806         }
 807
 808         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
 809         ZERO_STRUCTP(rpc_entry);
 810         rpc_entry->pipe.clnt = strdup(clnt);
 811         rpc_entry->pipe.srv = strdup(srv);
 812         rpc_entry->cmds = realloc(rpc_entry->cmds,
 813                                   (rpc_entry->n_cmds + size) *
 814                                   sizeof(struct api_struct));
 815         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds,
 816                size * sizeof(struct api_struct));
 817         rpc_entry->n_cmds += size;
 818
 819         return NT_STATUS_OK;
 820 }
 821
 822 /*******************************************************************
 823  Respond to a pipe bind request.
 824 *******************************************************************/
 825
 826 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 827 {
 828         RPC_HDR_BA hdr_ba;
 829         RPC_HDR_RB hdr_rb;
 830         RPC_HDR_AUTH auth_info;
 831         uint16 assoc_gid;
 832         fstring ack_pipe_name;
 833         prs_struct out_hdr_ba;
 834         prs_struct out_auth;
 835         prs_struct outgoing_rpc;
 836         int i = 0;
 837         int auth_len = 0;
 838         enum RPC_PKT_TYPE reply_pkt_type;
 839
 840         p->ntlmssp_auth_requested = False;
 841         p->netsec_auth_validated = False;
 842
 843         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 844
 845         /*
 846          * Try and find the correct pipe name to ensure
 847          * that this is a pipe name we support.
 848          */
 849
 850
 851         for (i = 0; i < rpc_lookup_size; i++) {
 852                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 853                   DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 854                             rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 855                   fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 856                   break;
 857                 }
 858         }
 859
 860         if (i == rpc_lookup_size) {
 861                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
 862                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 863                                 p->name ));
 864                        if(!setup_bind_nak(p))
 865                                return False;
 866                        return True;
 867                 }
 868
 869                 for (i = 0; i < rpc_lookup_size; i++) {
 870                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 871                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 872                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 873                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 874                                break;
 875                        }
 876                 }
 877
 878                 if (i == rpc_lookup_size) {
 879                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
 880                         return False;
 881                 }
 882         }
 883
 884         /* decode the bind request */
 885         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 886                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 887                 return False;
 888         }
 889
 890         /*
 891          * Check if this is an authenticated request.
 892          */
 893
 894         if (p->hdr.auth_len != 0) {
 895                 RPC_AUTH_VERIFIER auth_verifier;
 896                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 897
 898                 /*
 899                  * Decode the authentication verifier.
 900                  */
 901
 902                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 903                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 904                         return False;
 905                 }
 906
 907                 if(auth_info.auth_type == NTLMSSP_AUTH_TYPE) {
 908
 909                         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 910                                 DEBUG(0,("api_pipe_bind_req: unable to "
 911                                          "unmarshall RPC_HDR_AUTH struct.\n"));
 912                                 return False;
 913                         }
 914
 915                         if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 916                                 DEBUG(0,("api_pipe_bind_req: "
 917                                          "auth_verifier.signature != NTLMSSP\n"));
 918                                 return False;
 919                         }
 920
 921                         if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 922                                 DEBUG(0,("api_pipe_bind_req: "
 923                                          "auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 924                                          auth_verifier.msg_type));
 925                                 return False;
 926                         }
 927
 928                         if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 929                                 DEBUG(0,("api_pipe_bind_req: "
 930                                          "Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 931                                 return False;
 932                         }
 933
 934                         p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 935                         p->ntlmssp_auth_requested = True;
 936
 937                 } else if (auth_info.auth_type == NETSEC_AUTH_TYPE) {
 938
 939                         RPC_AUTH_NETSEC_NEG neg;
 940                         struct netsec_auth_struct *a = &(p->netsec_auth);
 941
 942                         if (!smb_io_rpc_auth_netsec_neg("", &neg, rpc_in_p, 0)) {
 943                                 DEBUG(0,("api_pipe_bind_req: "
 944                                          "Could not unmarshal SCHANNEL auth neg\n"));
 945                                 return False;
 946                         }
 947
 948                         p->netsec_auth_validated = True;
 949
 950                         memset(a->sess_key, 0, sizeof(a->sess_key));
 951                         memcpy(a->sess_key, last_dcinfo.sess_key, sizeof(last_dcinfo.sess_key));
 952
 953                         a->seq_num = 0;
 954
 955                         DEBUG(10,("schannel auth: domain [%s] myname [%s]\n",
 956                                   neg.domain, neg.myname));
 957
 958                 } else {
 959                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 960                                  auth_info.auth_type ));
 961                         return False;
 962                 }
 963         }
 964
 965         switch(p->hdr.pkt_type) {
 966                 case RPC_BIND:
 967                         /* name has to be \PIPE\xxxxx */
 968                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 969                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 970                         reply_pkt_type = RPC_BINDACK;
 971                         break;
 972                 case RPC_ALTCONT:
 973                         /* secondary address CAN be NULL
 974                          * as the specs say it's ignored.
 975                          * It MUST NULL to have the spoolss working.
 976                          */
 977                         fstrcpy(ack_pipe_name,"");
 978                         reply_pkt_type = RPC_ALTCONTRESP;
 979                         break;
 980                 default:
 981                         return False;
 982         }
 983
 984         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 985
 986         /*
 987          * Marshall directly into the outgoing PDU space. We
 988          * must do this as we need to set to the bind response
 989          * header and are never sending more than one PDU here.
 990          */
 991
 992         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 993         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 994
 995         /*
 996          * Setup the memory to marshall the ba header, and the
 997          * auth footers.
 998          */
 999
1000         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1001                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1002                 prs_mem_free(&outgoing_rpc);
1003                 return False;
1004         }
1005
1006         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1007                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
1008                 prs_mem_free(&outgoing_rpc);
1009                 prs_mem_free(&out_hdr_ba);
1010                 return False;
1011         }
1012
1013         if (p->ntlmssp_auth_requested)
1014                 assoc_gid = 0x7a77;
1015         else
1016                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1017
1018         /*
1019          * Create the bind response struct.
1020          */
1021
1022         /* If the requested abstract synt uuid doesn't match our client pipe,
1023                 reject the bind_ack & set the transfer interface synt to all 0's,
1024                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1025                 unknown to NT4)
1026                 Needed when adding entries to a DACL from NT5 - SK */
1027
1028         if(check_bind_req(p, &hdr_rb.abstract, &hdr_rb.transfer, hdr_rb.context_id ))
1029         {
1030                 init_rpc_hdr_ba(&hdr_ba,
1031                         MAX_PDU_FRAG_LEN,
1032                         MAX_PDU_FRAG_LEN,
1033                         assoc_gid,
1034                         ack_pipe_name,
1035                         0x1, 0x0, 0x0,
1036                         &hdr_rb.transfer);
1037         } else {
1038                 RPC_IFACE null_interface;
1039                 ZERO_STRUCT(null_interface);
1040                 /* Rejection reason: abstract syntax not supported */
1041                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
1042                                         MAX_PDU_FRAG_LEN, assoc_gid,
1043                                         ack_pipe_name, 0x1, 0x2, 0x1,
1044                                         &null_interface);
1045         }
1046
1047         /*
1048          * and marshall it.
1049          */
1050
1051         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1052                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1053                 goto err_exit;
1054         }
1055
1056         /*
1057          * Now the authentication.
1058          */
1059
1060         if (p->ntlmssp_auth_requested) {
1061                 RPC_AUTH_VERIFIER auth_verifier;
1062                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
1063
1064                 generate_random_buffer(p->challenge, 8, False);
1065
1066                 /*** Authentication info ***/
1067
1068                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, RPC_HDR_AUTH_LEN, 1);
1069                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1070                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1071                         goto err_exit;
1072                 }
1073
1074                 /*** NTLMSSP verifier ***/
1075
1076                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
1077                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
1078                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1079                         goto err_exit;
1080                 }
1081
1082                 /* NTLMSSP challenge ***/
1083
1084                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
1085                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
1086                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
1087                         goto err_exit;
1088                 }
1089
1090                 /* Auth len in the rpc header doesn't include auth_header. */
1091                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1092         }
1093
1094         if (p->netsec_auth_validated) {
1095                 RPC_AUTH_VERIFIER auth_verifier;
1096                 uint32 flags;
1097
1098                 /* The client opens a second RPC NETLOGON pipe without
1099                    doing a auth2. The credentials for the schannel are
1100                    re-used from the auth2 the client did before. */
1101                 p->dc = last_dcinfo;
1102
1103                 init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, RPC_HDR_AUTH_LEN, 1);
1104                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1105                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1106                         goto err_exit;
1107                 }
1108
1109                 /*** NETSEC verifier ***/
1110
1111                 init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1112                 if(!smb_io_rpc_netsec_verifier("", &auth_verifier, &out_auth, 0)) {
1113                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1114                         goto err_exit;
1115                 }
1116
1117                 prs_align(&out_auth);
1118
1119                 flags = 5;
1120                 if(!prs_uint32("flags ", &out_auth, 0, &flags))
1121                         goto err_exit;
1122
1123                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1124         }
1125
1126         /*
1127          * Create the header, now we know the length.
1128          */
1129
1130         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
1131                         p->hdr.call_id,
1132                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1133                         auth_len);
1134
1135         /*
1136          * Marshall the header into the outgoing PDU.
1137          */
1138
1139         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1140                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1141                 goto err_exit;
1142         }
1143
1144         /*
1145          * Now add the RPC_HDR_BA and any auth needed.
1146          */
1147
1148         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1149                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1150                 goto err_exit;
1151         }
1152
1153         if((p->ntlmssp_auth_requested|p->netsec_auth_validated) &&
1154            !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1155                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1156                 goto err_exit;
1157         }
1158
1159         if(!p->ntlmssp_auth_requested)
1160                 p->pipe_bound = True;
1161
1162         /*
1163          * Setup the lengths for the initial reply.
1164          */
1165
1166         p->out_data.data_sent_length = 0;
1167         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1168         p->out_data.current_pdu_sent = 0;
1169
1170         prs_mem_free(&out_hdr_ba);
1171         prs_mem_free(&out_auth);
1172
1173         return True;
1174
1175   err_exit:
1176
1177         prs_mem_free(&outgoing_rpc);
1178         prs_mem_free(&out_hdr_ba);
1179         prs_mem_free(&out_auth);
1180         return False;
1181 }
1182
1183 /****************************************************************************
1184  Deal with sign & seal processing on an RPC request.
1185 ****************************************************************************/
1186
1187 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1188 {
1189         /*
1190          * We always negotiate the following two bits....
1191          */
1192         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1193         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1194         int data_len;
1195         int auth_len;
1196         uint32 old_offset;
1197         uint32 crc32 = 0;
1198
1199         auth_len = p->hdr.auth_len;
1200
1201         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1202                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1203                 return False;
1204         }
1205
1206         /*
1207          * The following is that length of the data we must verify or unseal.
1208          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1209          * preceeding the auth_data.
1210          */
1211
1212         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1213                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1214
1215         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1216                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1217
1218         if (auth_seal) {
1219                 /*
1220                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1221                  * has already been consumed.
1222                  */
1223                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1224                 dump_data_pw("NTLMSSP hash (v1)\n", p->ntlmssp_hash,
1225                              sizeof(p->ntlmssp_hash));
1226
1227                 dump_data_pw("Incoming RPC PDU (NTLMSSP sealed)\n",
1228                              (const unsigned char *)data, data_len);
1229                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1230                 dump_data_pw("Incoming RPC PDU (NTLMSSP unsealed)\n",
1231                              (const unsigned char *)data, data_len);
1232                 crc32 = crc32_calc_buffer(data, data_len);
1233         }
1234
1235         old_offset = prs_offset(rpc_in);
1236
1237         if (auth_seal || auth_verify) {
1238                 RPC_HDR_AUTH auth_info;
1239
1240                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1241                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1242                                 (unsigned int)old_offset + data_len ));
1243                         return False;
1244                 }
1245
1246                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1247                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1248                         return False;
1249                 }
1250         }
1251
1252         if (auth_verify) {
1253                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1254                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1255
1256                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1257
1258                 /*
1259                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1260                  * incoming buffer.
1261                  */
1262                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1263                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1264                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1265                         return False;
1266                 }
1267
1268                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1269                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1270                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1271                         return False;
1272                 }
1273
1274                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1275                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1276                         return False;
1277                 }
1278         }
1279
1280         /*
1281          * Return the current pointer to the data offset.
1282          */
1283
1284         if(!prs_set_offset(rpc_in, old_offset)) {
1285                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1286                         (unsigned int)old_offset ));
1287                 return False;
1288         }
1289
1290         return True;
1291 }
1292
1293 /****************************************************************************
1294  Deal with schannel processing on an RPC request.
1295 ****************************************************************************/
1296 BOOL api_pipe_netsec_process(pipes_struct *p, prs_struct *rpc_in)
1297 {
1298         /*
1299          * We always negotiate the following two bits....
1300          */
1301         int data_len;
1302         int auth_len;
1303         uint32 old_offset;
1304         RPC_HDR_AUTH auth_info;
1305         RPC_AUTH_NETSEC_CHK netsec_chk;
1306
1307
1308         auth_len = p->hdr.auth_len;
1309
1310         if (auth_len != RPC_AUTH_NETSEC_CHK_LEN) {
1311                 DEBUG(0,("Incorrect auth_len %d.\n", auth_len ));
1312                 return False;
1313         }
1314
1315         /*
1316          * The following is that length of the data we must verify or unseal.
1317          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1318          * preceeding the auth_data.
1319          */
1320
1321         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1322                 RPC_HDR_AUTH_LEN - auth_len;
1323
1324         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
1325
1326         old_offset = prs_offset(rpc_in);
1327
1328         if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1329                 DEBUG(0,("cannot move offset to %u.\n",
1330                          (unsigned int)old_offset + data_len ));
1331                 return False;
1332         }
1333
1334         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1335                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
1336                 return False;
1337         }
1338
1339         if (auth_info.auth_type != NETSEC_AUTH_TYPE) {
1340                 DEBUG(0,("Invalid auth info %d on schannel\n",
1341                          auth_info.auth_type));
1342                 return False;
1343         }
1344
1345         if (auth_info.auth_level == RPC_PIPE_AUTH_SEAL_LEVEL) {
1346                 p->netsec_auth.auth_flags = AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL;
1347         } else if (auth_info.auth_level == RPC_PIPE_AUTH_SIGN_LEVEL) {
1348                 p->netsec_auth.auth_flags = AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN;
1349         } else {
1350                 DEBUG(0,("Invalid auth level %d on schannel\n",
1351                          auth_info.auth_level));
1352                 return False;
1353         }
1354
1355         if(!smb_io_rpc_auth_netsec_chk("", &netsec_chk, rpc_in, 0)) {
1356                 DEBUG(0,("failed to unmarshal RPC_AUTH_NETSEC_CHK.\n"));
1357                 return False;
1358         }
1359
1360         if (!netsec_decode(&p->netsec_auth,
1361                            p->netsec_auth.auth_flags,
1362                            SENDER_IS_INITIATOR,
1363                            &netsec_chk,
1364                            prs_data_p(rpc_in)+old_offset, data_len)) {
1365                 DEBUG(0,("failed to decode PDU\n"));
1366                 return False;
1367         }
1368
1369         /*
1370          * Return the current pointer to the data offset.
1371          */
1372
1373         if(!prs_set_offset(rpc_in, old_offset)) {
1374                 DEBUG(0,("failed to set offset back to %u\n",
1375                          (unsigned int)old_offset ));
1376                 return False;
1377         }
1378
1379         /* The sequence number gets incremented on both send and receive. */
1380         p->netsec_auth.seq_num++;
1381
1382         return True;
1383 }
1384
1385 /****************************************************************************
1386  Return a user struct for a pipe user.
1387 ****************************************************************************/
1388
1389 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1390 {
1391         if (p->ntlmssp_auth_validated) {
1392                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1393         } else {
1394                 extern struct current_user current_user;
1395                 memcpy(user, &current_user, sizeof(struct current_user));
1396         }
1397
1398         return user;
1399 }
1400
1401 /****************************************************************************
1402  Find the set of RPC functions associated with this context_id
1403 ****************************************************************************/
1404
1405 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1406 {
1407         PIPE_RPC_FNS *fns = NULL;
1408         PIPE_RPC_FNS *tmp = NULL;
1409
1410         if ( !list ) {
1411                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1412                 return NULL;
1413         }
1414
1415         for (tmp=list; tmp; tmp=tmp->next ) {
1416                 if ( tmp->context_id == context_id )
1417                         break;
1418         }
1419
1420         fns = tmp;
1421
1422         return fns;
1423 }
1424
1425 /****************************************************************************
1426  memory cleanup
1427 ****************************************************************************/
1428
1429 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
1430 {
1431         PIPE_RPC_FNS *tmp = list;
1432         PIPE_RPC_FNS *tmp2;
1433
1434         while (tmp) {
1435                 tmp2 = tmp->next;
1436                 SAFE_FREE(tmp);
1437                 tmp = tmp2;
1438         }
1439
1440         return;
1441 }
1442
1443 /****************************************************************************
1444  Find the correct RPC function to call for this request.
1445  If the pipe is authenticated then become the correct UNIX user
1446  before doing the call.
1447 ****************************************************************************/
1448
1449 BOOL api_pipe_request(pipes_struct *p)
1450 {
1451         BOOL ret = False;
1452         PIPE_RPC_FNS *pipe_fns;
1453
1454         if (p->ntlmssp_auth_validated) {
1455
1456                 if(!become_authenticated_pipe_user(p)) {
1457                         prs_mem_free(&p->out_data.rdata);
1458                         return False;
1459                 }
1460         }
1461
1462         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
1463
1464         /* get the set of RPC functions for this context */
1465
1466         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
1467
1468         if ( pipe_fns ) {
1469                 set_current_rpc_talloc(p->mem_ctx);
1470                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
1471                 set_current_rpc_talloc(NULL);
1472         }
1473         else {
1474                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
1475                         p->hdr_req.context_id, p->name));
1476         }
1477
1478         if(p->ntlmssp_auth_validated)
1479                 unbecome_authenticated_pipe_user();
1480
1481         return ret;
1482 }
1483
1484 /*******************************************************************
1485  Calls the underlying RPC function for a named pipe.
1486  ********************************************************************/
1487
1488 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
1489                 const struct api_struct *api_rpc_cmds, int n_cmds)
1490 {
1491         int fn_num;
1492         fstring name;
1493         uint32 offset1, offset2;
1494
1495         /* interpret the command */
1496         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1497
1498         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1499         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1500
1501         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1502                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1503                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1504                         break;
1505                 }
1506         }
1507
1508         if (fn_num == n_cmds) {
1509                 /*
1510                  * For an unknown RPC just return a fault PDU but
1511                  * return True to allow RPC's on the pipe to continue
1512                  * and not put the pipe into fault state. JRA.
1513                  */
1514                 DEBUG(4, ("unknown\n"));
1515                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
1516                 return True;
1517         }
1518
1519         offset1 = prs_offset(&p->out_data.rdata);
1520
1521         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1522                 fn_num, api_rpc_cmds[fn_num].fn));
1523         /* do the actual command */
1524         if(!api_rpc_cmds[fn_num].fn(p)) {
1525                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1526                 prs_mem_free(&p->out_data.rdata);
1527                 return False;
1528         }
1529
1530         if (p->bad_handle_fault_state) {
1531                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1532                 p->bad_handle_fault_state = False;
1533                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
1534                 return True;
1535         }
1536
1537         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1538         offset2 = prs_offset(&p->out_data.rdata);
1539         prs_set_offset(&p->out_data.rdata, offset1);
1540         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1541         prs_set_offset(&p->out_data.rdata, offset2);
1542
1543         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1544
1545         /* Check for buffer underflow in rpc parsing */
1546
1547         if ((DEBUGLEVEL >= 10) &&
1548             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
1549                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
1550                 char *data;
1551
1552                 data = malloc(data_len);
1553
1554                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1555                 if (data) {
1556                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
1557                         SAFE_FREE(data);
1558                 }
1559
1560         }
1561
1562         return True;
1563 }
1564
1565 /*******************************************************************
1566 *******************************************************************/
1567
1568 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
1569 {
1570         struct api_struct *cmds = NULL;
1571         int               n_cmds = 0;
1572
1573         switch ( idx ) {
1574                 case PI_LSARPC:
1575                         lsa_get_pipe_fns( &cmds, &n_cmds );
1576                         break;
1577                 case PI_LSARPC_DS:
1578                         lsa_ds_get_pipe_fns( &cmds, &n_cmds );
1579                         break;
1580                 case PI_SAMR:
1581                         samr_get_pipe_fns( &cmds, &n_cmds );
1582                         break;
1583                 case PI_NETLOGON:
1584                         netlog_get_pipe_fns( &cmds, &n_cmds );
1585                         break;
1586                 case PI_SRVSVC:
1587                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
1588                         break;
1589                 case PI_WKSSVC:
1590                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
1591                         break;
1592                 case PI_WINREG:
1593                         reg_get_pipe_fns( &cmds, &n_cmds );
1594                         break;
1595                 case PI_SPOOLSS:
1596                         spoolss_get_pipe_fns( &cmds, &n_cmds );
1597                         break;
1598                 case PI_NETDFS:
1599                         netdfs_get_pipe_fns( &cmds, &n_cmds );
1600                         break;
1601 #ifdef DEVELOPER
1602                 case PI_ECHO:
1603                         echo_get_pipe_fns( &cmds, &n_cmds );
1604                         break;
1605 #endif
1606                 case PI_EPM:
1607                         epm_get_pipe_fns( &cmds, &n_cmds );
1608                         break;
1609                 default:
1610                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
1611         }
1612
1613         *fns = cmds;
1614         *n_fns = n_cmds;
1615
1616         return;
1617 }
1618
1619