source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31
  32 extern struct pipe_id_info pipe_names[];
  33 extern struct current_user current_user;
  34
  35 #undef DBGC_CLASS
  36 #define DBGC_CLASS DBGC_RPC_SRV
  37
  38 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  39 {
  40         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  41
  42         if (a) {
  43                 auth_ntlmssp_end(&a);
  44         }
  45         auth->a_u.auth_ntlmssp_state = NULL;
  46 }
  47
  48 /*******************************************************************
  49  Generate the next PDU to be returned from the data in p->rdata.
  50  Handle NTLMSSP.
  51  ********************************************************************/
  52
  53 static BOOL create_next_pdu_ntlmssp(pipes_struct *p)
  54 {
  55         RPC_HDR_RESP hdr_resp;
  56         uint32 ss_padding_len = 0;
  57         uint32 data_space_available;
  58         uint32 data_len_left;
  59         uint32 data_len;
  60         prs_struct outgoing_pdu;
  61         NTSTATUS status;
  62         DATA_BLOB auth_blob;
  63         RPC_HDR_AUTH auth_info;
  64         uint8 auth_type, auth_level;
  65         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  66
  67         /*
  68          * If we're in the fault state, keep returning fault PDU's until
  69          * the pipe gets closed. JRA.
  70          */
  71
  72         if(p->fault_state) {
  73                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  74                 return True;
  75         }
  76
  77         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  78
  79         /* Change the incoming request header to a response. */
  80         p->hdr.pkt_type = RPC_RESPONSE;
  81
  82         /* Set up rpc header flags. */
  83         if (p->out_data.data_sent_length == 0) {
  84                 p->hdr.flags = RPC_FLG_FIRST;
  85         } else {
  86                 p->hdr.flags = 0;
  87         }
  88
  89         /*
  90          * Work out how much we can fit in a single PDU.
  91          */
  92
  93         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  94
  95         /*
  96          * Ensure there really is data left to send.
  97          */
  98
  99         if(!data_len_left) {
 100                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 101                 return False;
 102         }
 103
 104         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 105                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 106
 107         /*
 108          * The amount we send is the minimum of the available
 109          * space and the amount left to send.
 110          */
 111
 112         data_len = MIN(data_len_left, data_space_available);
 113
 114         /*
 115          * Set up the alloc hint. This should be the data left to
 116          * send.
 117          */
 118
 119         hdr_resp.alloc_hint = data_len_left;
 120
 121         /*
 122          * Work out if this PDU will be the last.
 123          */
 124
 125         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 126                 p->hdr.flags |= RPC_FLG_LAST;
 127                 if (data_len_left % 8) {
 128                         ss_padding_len = 8 - (data_len_left % 8);
 129                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 130                                 ss_padding_len ));
 131                 }
 132         }
 133
 134         /*
 135          * Set up the header lengths.
 136          */
 137
 138         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 139                         data_len + ss_padding_len +
 140                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 141         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 142
 143
 144         /*
 145          * Init the parse struct to point at the outgoing
 146          * data.
 147          */
 148
 149         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 150         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 151
 152         /* Store the header in the data stream. */
 153         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 154                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 155                 prs_mem_free(&outgoing_pdu);
 156                 return False;
 157         }
 158
 159         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 160                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 161                 prs_mem_free(&outgoing_pdu);
 162                 return False;
 163         }
 164
 165         /* Copy the data into the PDU. */
 166
 167         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 168                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 169                 prs_mem_free(&outgoing_pdu);
 170                 return False;
 171         }
 172
 173         /* Copy the sign/seal padding data. */
 174         if (ss_padding_len) {
 175                 char pad[8];
 176
 177                 memset(pad, '\0', 8);
 178                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 179                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 180                                         (unsigned int)ss_padding_len));
 181                         prs_mem_free(&outgoing_pdu);
 182                         return False;
 183                 }
 184         }
 185
 186
 187         /* Now write out the auth header and null blob. */
 188         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 189                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 190         } else {
 191                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 192         }
 193         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 194                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 195         } else {
 196                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 197         }
 198
 199         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 200         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 201                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 202                 prs_mem_free(&outgoing_pdu);
 203                 return False;
 204         }
 205
 206         /* Generate the sign blob. */
 207
 208         switch (p->auth.auth_level) {
 209                 case PIPE_AUTH_LEVEL_PRIVACY:
 210                         /* Data portion is encrypted. */
 211                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 212                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 213                                                         data_len + ss_padding_len,
 214                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 215                                                         (size_t)prs_offset(&outgoing_pdu),
 216                                                         &auth_blob);
 217                         if (!NT_STATUS_IS_OK(status)) {
 218                                 data_blob_free(&auth_blob);
 219                                 prs_mem_free(&outgoing_pdu);
 220                                 return False;
 221                         }
 222                         break;
 223                 case PIPE_AUTH_LEVEL_INTEGRITY:
 224                         /* Data is signed. */
 225                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 226                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 227                                                         data_len + ss_padding_len,
 228                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 229                                                         (size_t)prs_offset(&outgoing_pdu),
 230                                                         &auth_blob);
 231                         if (!NT_STATUS_IS_OK(status)) {
 232                                 data_blob_free(&auth_blob);
 233                                 prs_mem_free(&outgoing_pdu);
 234                                 return False;
 235                         }
 236                         break;
 237                 default:
 238                         prs_mem_free(&outgoing_pdu);
 239                         return False;
 240         }
 241
 242         /* Append the auth blob. */
 243         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 244                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 245                                 (unsigned int)NTLMSSP_SIG_SIZE));
 246                 data_blob_free(&auth_blob);
 247                 prs_mem_free(&outgoing_pdu);
 248                 return False;
 249         }
 250
 251         data_blob_free(&auth_blob);
 252
 253         /*
 254          * Setup the counts for this PDU.
 255          */
 256
 257         p->out_data.data_sent_length += data_len;
 258         p->out_data.current_pdu_len = p->hdr.frag_len;
 259         p->out_data.current_pdu_sent = 0;
 260
 261         prs_mem_free(&outgoing_pdu);
 262         return True;
 263 }
 264
 265 /*******************************************************************
 266  Generate the next PDU to be returned from the data in p->rdata.
 267  Return an schannel authenticated fragment.
 268  ********************************************************************/
 269
 270 static BOOL create_next_pdu_schannel(pipes_struct *p)
 271 {
 272         RPC_HDR_RESP hdr_resp;
 273         uint32 ss_padding_len = 0;
 274         uint32 data_len;
 275         uint32 data_space_available;
 276         uint32 data_len_left;
 277         prs_struct outgoing_pdu;
 278         uint32 data_pos;
 279
 280         /*
 281          * If we're in the fault state, keep returning fault PDU's until
 282          * the pipe gets closed. JRA.
 283          */
 284
 285         if(p->fault_state) {
 286                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 287                 return True;
 288         }
 289
 290         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 291
 292         /* Change the incoming request header to a response. */
 293         p->hdr.pkt_type = RPC_RESPONSE;
 294
 295         /* Set up rpc header flags. */
 296         if (p->out_data.data_sent_length == 0) {
 297                 p->hdr.flags = RPC_FLG_FIRST;
 298         } else {
 299                 p->hdr.flags = 0;
 300         }
 301
 302         /*
 303          * Work out how much we can fit in a single PDU.
 304          */
 305
 306         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 307
 308         /*
 309          * Ensure there really is data left to send.
 310          */
 311
 312         if(!data_len_left) {
 313                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 314                 return False;
 315         }
 316
 317         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 318                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 319
 320         /*
 321          * The amount we send is the minimum of the available
 322          * space and the amount left to send.
 323          */
 324
 325         data_len = MIN(data_len_left, data_space_available);
 326
 327         /*
 328          * Set up the alloc hint. This should be the data left to
 329          * send.
 330          */
 331
 332         hdr_resp.alloc_hint = data_len_left;
 333
 334         /*
 335          * Work out if this PDU will be the last.
 336          */
 337
 338         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 339                 p->hdr.flags |= RPC_FLG_LAST;
 340                 if (data_len_left % 8) {
 341                         ss_padding_len = 8 - (data_len_left % 8);
 342                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 343                                 ss_padding_len ));
 344                 }
 345         }
 346
 347         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 348                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 349         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 350
 351         /*
 352          * Init the parse struct to point at the outgoing
 353          * data.
 354          */
 355
 356         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 357         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 358
 359         /* Store the header in the data stream. */
 360         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 361                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 362                 prs_mem_free(&outgoing_pdu);
 363                 return False;
 364         }
 365
 366         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 367                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 368                 prs_mem_free(&outgoing_pdu);
 369                 return False;
 370         }
 371
 372         /* Store the current offset. */
 373         data_pos = prs_offset(&outgoing_pdu);
 374
 375         /* Copy the data into the PDU. */
 376
 377         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 378                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 379                 prs_mem_free(&outgoing_pdu);
 380                 return False;
 381         }
 382
 383         /* Copy the sign/seal padding data. */
 384         if (ss_padding_len) {
 385                 char pad[8];
 386                 memset(pad, '\0', 8);
 387                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 388                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 389                         prs_mem_free(&outgoing_pdu);
 390                         return False;
 391                 }
 392         }
 393
 394         {
 395                 /*
 396                  * Schannel processing.
 397                  */
 398                 char *data;
 399                 RPC_HDR_AUTH auth_info;
 400                 RPC_AUTH_SCHANNEL_CHK verf;
 401
 402                 data = prs_data_p(&outgoing_pdu) + data_pos;
 403                 /* Check it's the type of reply we were expecting to decode */
 404
 405                 init_rpc_hdr_auth(&auth_info,
 406                                 RPC_SCHANNEL_AUTH_TYPE,
 407                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 408                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 409                                 ss_padding_len, 1);
 410
 411                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 412                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 413                         prs_mem_free(&outgoing_pdu);
 414                         return False;
 415                 }
 416
 417                 schannel_encode(p->auth.a_u.schannel_auth,
 418                               p->auth.auth_level,
 419                               SENDER_IS_ACCEPTOR,
 420                               &verf, data, data_len + ss_padding_len);
 421
 422                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 423                                 &verf, &outgoing_pdu, 0)) {
 424                         prs_mem_free(&outgoing_pdu);
 425                         return False;
 426                 }
 427
 428                 p->auth.a_u.schannel_auth->seq_num++;
 429         }
 430
 431         /*
 432          * Setup the counts for this PDU.
 433          */
 434
 435         p->out_data.data_sent_length += data_len;
 436         p->out_data.current_pdu_len = p->hdr.frag_len;
 437         p->out_data.current_pdu_sent = 0;
 438
 439         prs_mem_free(&outgoing_pdu);
 440         return True;
 441 }
 442
 443 /*******************************************************************
 444  Generate the next PDU to be returned from the data in p->rdata.
 445  No authentication done.
 446 ********************************************************************/
 447
 448 static BOOL create_next_pdu_noauth(pipes_struct *p)
 449 {
 450         RPC_HDR_RESP hdr_resp;
 451         uint32 data_len;
 452         uint32 data_space_available;
 453         uint32 data_len_left;
 454         prs_struct outgoing_pdu;
 455
 456         /*
 457          * If we're in the fault state, keep returning fault PDU's until
 458          * the pipe gets closed. JRA.
 459          */
 460
 461         if(p->fault_state) {
 462                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 463                 return True;
 464         }
 465
 466         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 467
 468         /* Change the incoming request header to a response. */
 469         p->hdr.pkt_type = RPC_RESPONSE;
 470
 471         /* Set up rpc header flags. */
 472         if (p->out_data.data_sent_length == 0) {
 473                 p->hdr.flags = RPC_FLG_FIRST;
 474         } else {
 475                 p->hdr.flags = 0;
 476         }
 477
 478         /*
 479          * Work out how much we can fit in a single PDU.
 480          */
 481
 482         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 483
 484         /*
 485          * Ensure there really is data left to send.
 486          */
 487
 488         if(!data_len_left) {
 489                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 490                 return False;
 491         }
 492
 493         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 494
 495         /*
 496          * The amount we send is the minimum of the available
 497          * space and the amount left to send.
 498          */
 499
 500         data_len = MIN(data_len_left, data_space_available);
 501
 502         /*
 503          * Set up the alloc hint. This should be the data left to
 504          * send.
 505          */
 506
 507         hdr_resp.alloc_hint = data_len_left;
 508
 509         /*
 510          * Work out if this PDU will be the last.
 511          */
 512
 513         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 514                 p->hdr.flags |= RPC_FLG_LAST;
 515         }
 516
 517         /*
 518          * Set up the header lengths.
 519          */
 520
 521         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 522         p->hdr.auth_len = 0;
 523
 524         /*
 525          * Init the parse struct to point at the outgoing
 526          * data.
 527          */
 528
 529         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 530         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 531
 532         /* Store the header in the data stream. */
 533         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 534                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 535                 prs_mem_free(&outgoing_pdu);
 536                 return False;
 537         }
 538
 539         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 540                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 541                 prs_mem_free(&outgoing_pdu);
 542                 return False;
 543         }
 544
 545         /* Copy the data into the PDU. */
 546
 547         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 548                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 549                 prs_mem_free(&outgoing_pdu);
 550                 return False;
 551         }
 552
 553         /*
 554          * Setup the counts for this PDU.
 555          */
 556
 557         p->out_data.data_sent_length += data_len;
 558         p->out_data.current_pdu_len = p->hdr.frag_len;
 559         p->out_data.current_pdu_sent = 0;
 560
 561         prs_mem_free(&outgoing_pdu);
 562         return True;
 563 }
 564
 565 /*******************************************************************
 566  Generate the next PDU to be returned from the data in p->rdata.
 567 ********************************************************************/
 568
 569 BOOL create_next_pdu(pipes_struct *p)
 570 {
 571         switch(p->auth.auth_level) {
 572                 case PIPE_AUTH_LEVEL_NONE:
 573                 case PIPE_AUTH_LEVEL_CONNECT:
 574                         /* This is incorrect for auth level connect. Fixme. JRA */
 575                         return create_next_pdu_noauth(p);
 576
 577                 default:
 578                         switch(p->auth.auth_type) {
 579                                 case PIPE_AUTH_TYPE_NTLMSSP:
 580                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 581                                         return create_next_pdu_ntlmssp(p);
 582                                 case PIPE_AUTH_TYPE_SCHANNEL:
 583                                         return create_next_pdu_schannel(p);
 584                                 default:
 585                                         break;
 586                         }
 587         }
 588
 589         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 590                         (unsigned int)p->auth.auth_level,
 591                         (unsigned int)p->auth.auth_type));
 592         return False;
 593 }
 594
 595 /*******************************************************************
 596  Process an NTLMSSP authentication response.
 597  If this function succeeds, the user has been authenticated
 598  and their domain, name and calling workstation stored in
 599  the pipe struct.
 600 *******************************************************************/
 601
 602 static BOOL pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 603 {
 604         DATA_BLOB reply;
 605         NTSTATUS status;
 606         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 607
 608         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n", p->name));
 609
 610         ZERO_STRUCT(reply);
 611
 612         memset(p->user_name, '\0', sizeof(p->user_name));
 613         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 614         memset(p->domain, '\0', sizeof(p->domain));
 615         memset(p->wks, '\0', sizeof(p->wks));
 616
 617         /* Set up for non-authenticated user. */
 618         TALLOC_FREE(p->pipe_user.nt_user_token);
 619         p->pipe_user.ut.ngroups = 0;
 620         SAFE_FREE( p->pipe_user.ut.groups);
 621
 622         /* this has to be done as root in order to verify the password */
 623         become_root();
 624         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 625         unbecome_root();
 626
 627         /* Don't generate a reply. */
 628         data_blob_free(&reply);
 629
 630         if (!NT_STATUS_IS_OK(status)) {
 631                 return False;
 632         }
 633
 634         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 635            ensure the underlying NTLMSSP flags are also set. If not we should
 636            refuse the bind. */
 637
 638         if (p->auth.auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
 639                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 640                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 641                                 "but client declined signing.\n",
 642                                         p->name ));
 643                         return False;
 644                 }
 645         }
 646         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 647                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 648                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 649                                 "but client declined sealing.\n",
 650                                         p->name ));
 651                         return False;
 652                 }
 653         }
 654
 655         fstrcpy(p->user_name, a->ntlmssp_state->user);
 656         fstrcpy(p->pipe_user_name, a->server_info->unix_name);
 657         fstrcpy(p->domain, a->ntlmssp_state->domain);
 658         fstrcpy(p->wks, a->ntlmssp_state->workstation);
 659
 660         DEBUG(5,("pipe_ntlmssp_verify_final: OK: user: %s domain: %s workstation: %s\n",
 661                 p->user_name, p->domain, p->wks));
 662
 663         /*
 664          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 665          */
 666
 667         p->pipe_user.ut.uid = a->server_info->uid;
 668         p->pipe_user.ut.gid = a->server_info->gid;
 669
 670         /*
 671          * Copy the session key from the ntlmssp state.
 672          */
 673
 674         data_blob_free(&p->session_key);
 675         p->session_key = data_blob(a->ntlmssp_state->session_key.data, a->ntlmssp_state->session_key.length);
 676         if (!p->session_key.data) {
 677                 return False;
 678         }
 679
 680         p->pipe_user.ut.ngroups = a->server_info->n_groups;
 681         if (p->pipe_user.ut.ngroups) {
 682                 if (!(p->pipe_user.ut.groups = (gid_t *)memdup(a->server_info->groups,
 683                                                 sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
 684                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 685                         return False;
 686                 }
 687         }
 688
 689         if (a->server_info->ptok) {
 690                 p->pipe_user.nt_user_token =
 691                         dup_nt_token(NULL, a->server_info->ptok);
 692         } else {
 693                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 694                 p->pipe_user.nt_user_token = NULL;
 695                 return False;
 696         }
 697
 698         return True;
 699 }
 700
 701 /*******************************************************************
 702  The switch table for the pipe names and the functions to handle them.
 703 *******************************************************************/
 704
 705 struct rpc_table {
 706         struct {
 707                 const char *clnt;
 708                 const char *srv;
 709         } pipe;
 710         struct api_struct *cmds;
 711         int n_cmds;
 712 };
 713
 714 static struct rpc_table *rpc_lookup;
 715 static int rpc_lookup_size;
 716
 717 /*******************************************************************
 718  This is the "stage3" NTLMSSP response after a bind request and reply.
 719 *******************************************************************/
 720
 721 BOOL api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 722 {
 723         RPC_HDR_AUTH auth_info;
 724         uint32 pad;
 725         DATA_BLOB blob;
 726
 727         ZERO_STRUCT(blob);
 728
 729         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 730
 731         if (p->hdr.auth_len == 0) {
 732                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 733                 goto err;
 734         }
 735
 736         /* 4 bytes padding. */
 737         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 738                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 739                 goto err;
 740         }
 741
 742         /*
 743          * Decode the authentication verifier response.
 744          */
 745
 746         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 747                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 748                 goto err;
 749         }
 750
 751         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 752                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 753                         (unsigned int)auth_info.auth_type ));
 754                 return False;
 755         }
 756
 757         blob = data_blob(NULL,p->hdr.auth_len);
 758
 759         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 760                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 761                         (unsigned int)p->hdr.auth_len ));
 762                 goto err;
 763         }
 764
 765         /*
 766          * The following call actually checks the challenge/response data.
 767          * for correctness against the given DOMAIN\user name.
 768          */
 769
 770         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 771                 goto err;
 772         }
 773
 774         data_blob_free(&blob);
 775
 776         p->pipe_bound = True;
 777
 778         return True;
 779
 780  err:
 781
 782         data_blob_free(&blob);
 783         free_pipe_ntlmssp_auth_data(&p->auth);
 784         p->auth.a_u.auth_ntlmssp_state = NULL;
 785
 786         return False;
 787 }
 788
 789 /*******************************************************************
 790  Marshall a bind_nak pdu.
 791 *******************************************************************/
 792
 793 static BOOL setup_bind_nak(pipes_struct *p)
 794 {
 795         prs_struct outgoing_rpc;
 796         RPC_HDR nak_hdr;
 797         uint16 zero = 0;
 798
 799         /* Free any memory in the current return data buffer. */
 800         prs_mem_free(&p->out_data.rdata);
 801
 802         /*
 803          * Marshall directly into the outgoing PDU space. We
 804          * must do this as we need to set to the bind response
 805          * header and are never sending more than one PDU here.
 806          */
 807
 808         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 809         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 810
 811         /*
 812          * Initialize a bind_nak header.
 813          */
 814
 815         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 816                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 817
 818         /*
 819          * Marshall the header into the outgoing PDU.
 820          */
 821
 822         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 823                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 824                 prs_mem_free(&outgoing_rpc);
 825                 return False;
 826         }
 827
 828         /*
 829          * Now add the reject reason.
 830          */
 831
 832         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 833                 prs_mem_free(&outgoing_rpc);
 834                 return False;
 835         }
 836
 837         p->out_data.data_sent_length = 0;
 838         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 839         p->out_data.current_pdu_sent = 0;
 840
 841         if (p->auth.auth_data_free_func) {
 842                 (*p->auth.auth_data_free_func)(&p->auth);
 843         }
 844         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 845         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 846         p->pipe_bound = False;
 847
 848         return True;
 849 }
 850
 851 /*******************************************************************
 852  Marshall a fault pdu.
 853 *******************************************************************/
 854
 855 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 856 {
 857         prs_struct outgoing_pdu;
 858         RPC_HDR fault_hdr;
 859         RPC_HDR_RESP hdr_resp;
 860         RPC_HDR_FAULT fault_resp;
 861
 862         /* Free any memory in the current return data buffer. */
 863         prs_mem_free(&p->out_data.rdata);
 864
 865         /*
 866          * Marshall directly into the outgoing PDU space. We
 867          * must do this as we need to set to the bind response
 868          * header and are never sending more than one PDU here.
 869          */
 870
 871         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 872         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 873
 874         /*
 875          * Initialize a fault header.
 876          */
 877
 878         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 879             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 880
 881         /*
 882          * Initialize the HDR_RESP and FAULT parts of the PDU.
 883          */
 884
 885         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 886
 887         fault_resp.status = status;
 888         fault_resp.reserved = 0;
 889
 890         /*
 891          * Marshall the header into the outgoing PDU.
 892          */
 893
 894         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 895                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 896                 prs_mem_free(&outgoing_pdu);
 897                 return False;
 898         }
 899
 900         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 901                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 902                 prs_mem_free(&outgoing_pdu);
 903                 return False;
 904         }
 905
 906         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 907                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 908                 prs_mem_free(&outgoing_pdu);
 909                 return False;
 910         }
 911
 912         p->out_data.data_sent_length = 0;
 913         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 914         p->out_data.current_pdu_sent = 0;
 915
 916         prs_mem_free(&outgoing_pdu);
 917         return True;
 918 }
 919
 920 #if 0
 921 /*******************************************************************
 922  Marshall a cancel_ack pdu.
 923  We should probably check the auth-verifier here.
 924 *******************************************************************/
 925
 926 BOOL setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 927 {
 928         prs_struct outgoing_pdu;
 929         RPC_HDR ack_reply_hdr;
 930
 931         /* Free any memory in the current return data buffer. */
 932         prs_mem_free(&p->out_data.rdata);
 933
 934         /*
 935          * Marshall directly into the outgoing PDU space. We
 936          * must do this as we need to set to the bind response
 937          * header and are never sending more than one PDU here.
 938          */
 939
 940         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 941         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 942
 943         /*
 944          * Initialize a cancel_ack header.
 945          */
 946
 947         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 948                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 949
 950         /*
 951          * Marshall the header into the outgoing PDU.
 952          */
 953
 954         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 955                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 956                 prs_mem_free(&outgoing_pdu);
 957                 return False;
 958         }
 959
 960         p->out_data.data_sent_length = 0;
 961         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 962         p->out_data.current_pdu_sent = 0;
 963
 964         prs_mem_free(&outgoing_pdu);
 965         return True;
 966 }
 967 #endif
 968
 969 /*******************************************************************
 970  Ensure a bind request has the correct abstract & transfer interface.
 971  Used to reject unknown binds from Win2k.
 972 *******************************************************************/
 973
 974 BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 975                     RPC_IFACE* transfer, uint32 context_id)
 976 {
 977         char *pipe_name = p->name;
 978         int i=0;
 979         fstring pname;
 980
 981         fstrcpy(pname,"\\PIPE\\");
 982         fstrcat(pname,pipe_name);
 983
 984         DEBUG(3,("check_bind_req for %s\n", pname));
 985
 986         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 987
 988         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 989                 DEBUG(10,("checking %s\n", pipe_names[i].client_pipe));
 990                 if ( strequal(pipe_names[i].client_pipe, pname)
 991                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 992                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(struct GUID)) == 0)
 993                         && (transfer->version == pipe_names[i].trans_syntax.version)
 994                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(struct GUID)) == 0) ) {
 995                         struct api_struct       *fns = NULL;
 996                         int                     n_fns = 0;
 997                         PIPE_RPC_FNS            *context_fns;
 998
 999                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
1000                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1001                                 return False;
1002                         }
1003
1004                         /* save the RPC function table associated with this bind */
1005
1006                         get_pipe_fns(i, &fns, &n_fns);
1007
1008                         context_fns->cmds = fns;
1009                         context_fns->n_cmds = n_fns;
1010                         context_fns->context_id = context_id;
1011
1012                         /* add to the list of open contexts */
1013
1014                         DLIST_ADD( p->contexts, context_fns );
1015
1016                         break;
1017                 }
1018         }
1019
1020         if(pipe_names[i].client_pipe == NULL) {
1021                 return False;
1022         }
1023
1024         return True;
1025 }
1026
1027 /*******************************************************************
1028  Register commands to an RPC pipe
1029 *******************************************************************/
1030
1031 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
1032 {
1033         struct rpc_table *rpc_entry;
1034
1035         if (!clnt || !srv || !cmds) {
1036                 return NT_STATUS_INVALID_PARAMETER;
1037         }
1038
1039         if (version != SMB_RPC_INTERFACE_VERSION) {
1040                 DEBUG(0,("Can't register rpc commands!\n"
1041                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1042                          ", while this version of samba uses version %d!\n",
1043                          version,SMB_RPC_INTERFACE_VERSION));
1044                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1045         }
1046
1047         /* TODO:
1048          *
1049          * we still need to make sure that don't register the same commands twice!!!
1050          *
1051          * --metze
1052          */
1053
1054         /* We use a temporary variable because this call can fail and
1055            rpc_lookup will still be valid afterwards.  It could then succeed if
1056            called again later */
1057         rpc_lookup_size++;
1058         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1059         if (NULL == rpc_entry) {
1060                 rpc_lookup_size--;
1061                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1062                 return NT_STATUS_NO_MEMORY;
1063         } else {
1064                 rpc_lookup = rpc_entry;
1065         }
1066
1067         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1068         ZERO_STRUCTP(rpc_entry);
1069         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1070         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1071         rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
1072         if (!rpc_entry->cmds) {
1073                 return NT_STATUS_NO_MEMORY;
1074         }
1075         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
1076         rpc_entry->n_cmds += size;
1077
1078         return NT_STATUS_OK;
1079 }
1080
1081 /*******************************************************************
1082  Handle a SPNEGO krb5 bind auth.
1083 *******************************************************************/
1084
1085 static BOOL pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1086                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1087 {
1088         return False;
1089 }
1090
1091 /*******************************************************************
1092  Handle the first part of a SPNEGO bind auth.
1093 *******************************************************************/
1094
1095 static BOOL pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1096                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1097 {
1098         DATA_BLOB blob;
1099         DATA_BLOB secblob;
1100         DATA_BLOB response;
1101         DATA_BLOB chal;
1102         char *OIDs[ASN1_MAX_OIDS];
1103         int i;
1104         NTSTATUS status;
1105         BOOL got_kerberos_mechanism = False;
1106         AUTH_NTLMSSP_STATE *a = NULL;
1107         RPC_HDR_AUTH auth_info;
1108
1109         ZERO_STRUCT(secblob);
1110         ZERO_STRUCT(chal);
1111         ZERO_STRUCT(response);
1112
1113         /* Grab the SPNEGO blob. */
1114         blob = data_blob(NULL,p->hdr.auth_len);
1115
1116         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1117                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1118                         (unsigned int)p->hdr.auth_len ));
1119                 goto err;
1120         }
1121
1122         if (blob.data[0] != ASN1_APPLICATION(0)) {
1123                 goto err;
1124         }
1125
1126         /* parse out the OIDs and the first sec blob */
1127         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1128                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1129                 goto err;
1130         }
1131
1132         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1133                 got_kerberos_mechanism = True;
1134         }
1135
1136         for (i=0;OIDs[i];i++) {
1137                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1138                 SAFE_FREE(OIDs[i]);
1139         }
1140         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1141
1142         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1143                 BOOL ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1144                 data_blob_free(&secblob);
1145                 data_blob_free(&blob);
1146                 return ret;
1147         }
1148
1149         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1150                 /* Free any previous auth type. */
1151                 free_pipe_ntlmssp_auth_data(&p->auth);
1152         }
1153
1154         /* Initialize the NTLM engine. */
1155         status = auth_ntlmssp_start(&a);
1156         if (!NT_STATUS_IS_OK(status)) {
1157                 goto err;
1158         }
1159
1160         /*
1161          * Pass the first security blob of data to it.
1162          * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1163          * which means we need another packet to complete the bind.
1164          */
1165
1166         status = auth_ntlmssp_update(a, secblob, &chal);
1167
1168         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1169                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1170                 goto err;
1171         }
1172
1173         /* Generate the response blob we need for step 2 of the bind. */
1174         response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1175
1176         /* Copy the blob into the pout_auth parse struct */
1177         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1178         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1179                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1180                 goto err;
1181         }
1182
1183         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1184                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1185                 goto err;
1186         }
1187
1188         p->auth.a_u.auth_ntlmssp_state = a;
1189         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1190         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1191
1192         data_blob_free(&blob);
1193         data_blob_free(&secblob);
1194         data_blob_free(&chal);
1195         data_blob_free(&response);
1196
1197         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1198         return True;
1199
1200  err:
1201
1202         data_blob_free(&blob);
1203         data_blob_free(&secblob);
1204         data_blob_free(&chal);
1205         data_blob_free(&response);
1206
1207         p->auth.a_u.auth_ntlmssp_state = NULL;
1208
1209         return False;
1210 }
1211
1212 /*******************************************************************
1213  Handle the second part of a SPNEGO bind auth.
1214 *******************************************************************/
1215
1216 static BOOL pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1217                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1218 {
1219         RPC_HDR_AUTH auth_info;
1220         DATA_BLOB spnego_blob;
1221         DATA_BLOB auth_blob;
1222         DATA_BLOB auth_reply;
1223         DATA_BLOB response;
1224         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1225
1226         ZERO_STRUCT(spnego_blob);
1227         ZERO_STRUCT(auth_blob);
1228         ZERO_STRUCT(auth_reply);
1229         ZERO_STRUCT(response);
1230
1231         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1232                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1233                 goto err;
1234         }
1235
1236         /* Grab the SPNEGO blob. */
1237         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1238
1239         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1240                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1241                         (unsigned int)p->hdr.auth_len ));
1242                 goto err;
1243         }
1244
1245         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1246                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1247                 goto err;
1248         }
1249
1250         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1251                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1252                 goto err;
1253         }
1254
1255         /*
1256          * The following call actually checks the challenge/response data.
1257          * for correctness against the given DOMAIN\user name.
1258          */
1259
1260         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1261                 goto err;
1262         }
1263
1264         data_blob_free(&spnego_blob);
1265         data_blob_free(&auth_blob);
1266
1267         /* Generate the spnego "accept completed" blob - no incoming data. */
1268         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1269
1270         /* Copy the blob into the pout_auth parse struct */
1271         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1272         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1273                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1274                 goto err;
1275         }
1276
1277         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1278                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1279                 goto err;
1280         }
1281
1282         data_blob_free(&auth_reply);
1283         data_blob_free(&response);
1284
1285         p->pipe_bound = True;
1286
1287         return True;
1288
1289  err:
1290
1291         data_blob_free(&spnego_blob);
1292         data_blob_free(&auth_blob);
1293         data_blob_free(&auth_reply);
1294         data_blob_free(&response);
1295
1296         free_pipe_ntlmssp_auth_data(&p->auth);
1297         p->auth.a_u.auth_ntlmssp_state = NULL;
1298
1299         return False;
1300 }
1301
1302 /*******************************************************************
1303  Handle an schannel bind auth.
1304 *******************************************************************/
1305
1306 static BOOL pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1307                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1308 {
1309         RPC_HDR_AUTH auth_info;
1310         RPC_AUTH_SCHANNEL_NEG neg;
1311         RPC_AUTH_VERIFIER auth_verifier;
1312         BOOL ret;
1313         struct dcinfo *pdcinfo;
1314         uint32 flags;
1315
1316         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1317                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1318                 return False;
1319         }
1320
1321         /*
1322          * The neg.myname key here must match the remote computer name
1323          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1324          * operations that use credentials.
1325          */
1326
1327         become_root();
1328         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1329         unbecome_root();
1330
1331         if (!ret) {
1332                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1333                 return False;
1334         }
1335
1336         p->auth.a_u.schannel_auth = TALLOC_P(p->pipe_state_mem_ctx, struct schannel_auth_struct);
1337         if (!p->auth.a_u.schannel_auth) {
1338                 TALLOC_FREE(pdcinfo);
1339                 return False;
1340         }
1341
1342         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1343         memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1344                         sizeof(pdcinfo->sess_key));
1345
1346         TALLOC_FREE(pdcinfo);
1347
1348         p->auth.a_u.schannel_auth->seq_num = 0;
1349
1350         /*
1351          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1352          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1353          * struct of the person who opened the pipe. I need to test this further. JRA.
1354          */
1355
1356         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1357         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1358                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1359                 return False;
1360         }
1361
1362         /*** SCHANNEL verifier ***/
1363
1364         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1365         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1366                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1367                 return False;
1368         }
1369
1370         prs_align(pout_auth);
1371
1372         flags = 5;
1373         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1374                 return False;
1375         }
1376
1377         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1378                 neg.domain, neg.myname));
1379
1380         /* We're finished with this bind - no more packets. */
1381         p->auth.auth_data_free_func = NULL;
1382         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1383
1384         p->pipe_bound = True;
1385
1386         return True;
1387 }
1388
1389 /*******************************************************************
1390  Handle an NTLMSSP bind auth.
1391 *******************************************************************/
1392
1393 static BOOL pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1394                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1395 {
1396         RPC_HDR_AUTH auth_info;
1397         DATA_BLOB blob;
1398         DATA_BLOB response;
1399         NTSTATUS status;
1400         AUTH_NTLMSSP_STATE *a = NULL;
1401
1402         ZERO_STRUCT(blob);
1403         ZERO_STRUCT(response);
1404
1405         /* Grab the NTLMSSP blob. */
1406         blob = data_blob(NULL,p->hdr.auth_len);
1407
1408         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1409                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1410                         (unsigned int)p->hdr.auth_len ));
1411                 goto err;
1412         }
1413
1414         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1415                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1416                 goto err;
1417         }
1418
1419         /* We have an NTLMSSP blob. */
1420         status = auth_ntlmssp_start(&a);
1421         if (!NT_STATUS_IS_OK(status)) {
1422                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1423                         nt_errstr(status) ));
1424                 goto err;
1425         }
1426
1427         status = auth_ntlmssp_update(a, blob, &response);
1428         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1429                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1430                         nt_errstr(status) ));
1431                 goto err;
1432         }
1433
1434         data_blob_free(&blob);
1435
1436         /* Copy the blob into the pout_auth parse struct */
1437         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1438         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1439                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1440                 goto err;
1441         }
1442
1443         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1444                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1445                 goto err;
1446         }
1447
1448         p->auth.a_u.auth_ntlmssp_state = a;
1449         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1450         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1451
1452         data_blob_free(&blob);
1453         data_blob_free(&response);
1454
1455         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1456
1457         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1458         return True;
1459
1460   err:
1461
1462         data_blob_free(&blob);
1463         data_blob_free(&response);
1464
1465         free_pipe_ntlmssp_auth_data(&p->auth);
1466         p->auth.a_u.auth_ntlmssp_state = NULL;
1467         return False;
1468 }
1469
1470 /*******************************************************************
1471  Respond to a pipe bind request.
1472 *******************************************************************/
1473
1474 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1475 {
1476         RPC_HDR_BA hdr_ba;
1477         RPC_HDR_RB hdr_rb;
1478         RPC_HDR_AUTH auth_info;
1479         uint16 assoc_gid;
1480         fstring ack_pipe_name;
1481         prs_struct out_hdr_ba;
1482         prs_struct out_auth;
1483         prs_struct outgoing_rpc;
1484         int i = 0;
1485         int auth_len = 0;
1486         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1487
1488         /* No rebinds on a bound pipe - use alter context. */
1489         if (p->pipe_bound) {
1490                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1491                 return setup_bind_nak(p);
1492         }
1493
1494         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1495
1496         /*
1497          * Marshall directly into the outgoing PDU space. We
1498          * must do this as we need to set to the bind response
1499          * header and are never sending more than one PDU here.
1500          */
1501
1502         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1503
1504         /*
1505          * Setup the memory to marshall the ba header, and the
1506          * auth footers.
1507          */
1508
1509         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1510                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1511                 prs_mem_free(&outgoing_rpc);
1512                 return False;
1513         }
1514
1515         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1516                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1517                 prs_mem_free(&outgoing_rpc);
1518                 prs_mem_free(&out_hdr_ba);
1519                 return False;
1520         }
1521
1522         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1523
1524         /*
1525          * Try and find the correct pipe name to ensure
1526          * that this is a pipe name we support.
1527          */
1528
1529
1530         for (i = 0; i < rpc_lookup_size; i++) {
1531                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1532                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1533                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1534                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1535                         break;
1536                 }
1537         }
1538
1539         if (i == rpc_lookup_size) {
1540                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1541                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1542                                 p->name ));
1543                         prs_mem_free(&outgoing_rpc);
1544                         prs_mem_free(&out_hdr_ba);
1545                         prs_mem_free(&out_auth);
1546
1547                         return setup_bind_nak(p);
1548                 }
1549
1550                 for (i = 0; i < rpc_lookup_size; i++) {
1551                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1552                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1553                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1554                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1555                                break;
1556                        }
1557                 }
1558
1559                 if (i == rpc_lookup_size) {
1560                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1561                         goto err_exit;
1562                 }
1563         }
1564
1565         /* decode the bind request */
1566         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1567                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
1568                 goto err_exit;
1569         }
1570
1571         /* name has to be \PIPE\xxxxx */
1572         fstrcpy(ack_pipe_name, "\\PIPE\\");
1573         fstrcat(ack_pipe_name, p->pipe_srv_name);
1574
1575         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1576
1577         /*
1578          * Check if this is an authenticated bind request.
1579          */
1580
1581         if (p->hdr.auth_len) {
1582                 /*
1583                  * Decode the authentication verifier.
1584                  */
1585
1586                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1587                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1588                         goto err_exit;
1589                 }
1590
1591                 auth_type = auth_info.auth_type;
1592
1593                 /* Work out if we have to sign or seal etc. */
1594                 switch (auth_info.auth_level) {
1595                         case RPC_AUTH_LEVEL_INTEGRITY:
1596                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1597                                 break;
1598                         case RPC_AUTH_LEVEL_PRIVACY:
1599                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1600                                 break;
1601                         default:
1602                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1603                                         (unsigned int)auth_info.auth_level ));
1604                                 goto err_exit;
1605                 }
1606         } else {
1607                 ZERO_STRUCT(auth_info);
1608         }
1609
1610         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1611
1612         switch(auth_type) {
1613                 case RPC_NTLMSSP_AUTH_TYPE:
1614                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1615                                 goto err_exit;
1616                         }
1617                         assoc_gid = 0x7a77;
1618                         break;
1619
1620                 case RPC_SCHANNEL_AUTH_TYPE:
1621                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1622                                 goto err_exit;
1623                         }
1624                         break;
1625
1626                 case RPC_SPNEGO_AUTH_TYPE:
1627                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1628                                 goto err_exit;
1629                         }
1630                         break;
1631
1632                 case RPC_ANONYMOUS_AUTH_TYPE:
1633                         /* Unauthenticated bind request. */
1634                         /* Get the authenticated pipe user from current_user */
1635                         if (!copy_current_user(&p->pipe_user, &current_user)) {
1636                                 DEBUG(10, ("Could not copy current user\n"));
1637                                 goto err_exit;
1638                         }
1639                         /* We're finished - no more packets. */
1640                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1641                         /* We must set the pipe auth_level here also. */
1642                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1643                         p->pipe_bound = True;
1644                         /* The session key was initialized from the SMB
1645                          * session in make_internal_rpc_pipe_p */
1646                         break;
1647
1648                 default:
1649                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1650                         goto err_exit;
1651         }
1652
1653         /*
1654          * Create the bind response struct.
1655          */
1656
1657         /* If the requested abstract synt uuid doesn't match our client pipe,
1658                 reject the bind_ack & set the transfer interface synt to all 0's,
1659                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1660                 unknown to NT4)
1661                 Needed when adding entries to a DACL from NT5 - SK */
1662
1663         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1664                                 hdr_rb.rpc_context[0].context_id )) {
1665                 init_rpc_hdr_ba(&hdr_ba,
1666                         RPC_MAX_PDU_FRAG_LEN,
1667                         RPC_MAX_PDU_FRAG_LEN,
1668                         assoc_gid,
1669                         ack_pipe_name,
1670                         0x1, 0x0, 0x0,
1671                         &hdr_rb.rpc_context[0].transfer[0]);
1672         } else {
1673                 RPC_IFACE null_interface;
1674                 ZERO_STRUCT(null_interface);
1675                 /* Rejection reason: abstract syntax not supported */
1676                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1677                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1678                                         ack_pipe_name, 0x1, 0x2, 0x1,
1679                                         &null_interface);
1680                 p->pipe_bound = False;
1681         }
1682
1683         /*
1684          * and marshall it.
1685          */
1686
1687         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1688                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1689                 goto err_exit;
1690         }
1691
1692         /*
1693          * Create the header, now we know the length.
1694          */
1695
1696         if (prs_offset(&out_auth)) {
1697                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1698         }
1699
1700         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1701                         p->hdr.call_id,
1702                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1703                         auth_len);
1704
1705         /*
1706          * Marshall the header into the outgoing PDU.
1707          */
1708
1709         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1710                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1711                 goto err_exit;
1712         }
1713
1714         /*
1715          * Now add the RPC_HDR_BA and any auth needed.
1716          */
1717
1718         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1719                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1720                 goto err_exit;
1721         }
1722
1723         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1724                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1725                 goto err_exit;
1726         }
1727
1728         /*
1729          * Setup the lengths for the initial reply.
1730          */
1731
1732         p->out_data.data_sent_length = 0;
1733         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1734         p->out_data.current_pdu_sent = 0;
1735
1736         prs_mem_free(&out_hdr_ba);
1737         prs_mem_free(&out_auth);
1738
1739         return True;
1740
1741   err_exit:
1742
1743         prs_mem_free(&outgoing_rpc);
1744         prs_mem_free(&out_hdr_ba);
1745         prs_mem_free(&out_auth);
1746         return setup_bind_nak(p);
1747 }
1748
1749 /****************************************************************************
1750  Deal with an alter context call. Can be third part of 3 leg auth request for
1751  SPNEGO calls.
1752 ****************************************************************************/
1753
1754 BOOL api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1755 {
1756         RPC_HDR_BA hdr_ba;
1757         RPC_HDR_RB hdr_rb;
1758         RPC_HDR_AUTH auth_info;
1759         uint16 assoc_gid;
1760         fstring ack_pipe_name;
1761         prs_struct out_hdr_ba;
1762         prs_struct out_auth;
1763         prs_struct outgoing_rpc;
1764         int auth_len = 0;
1765
1766         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1767
1768         /*
1769          * Marshall directly into the outgoing PDU space. We
1770          * must do this as we need to set to the bind response
1771          * header and are never sending more than one PDU here.
1772          */
1773
1774         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1775
1776         /*
1777          * Setup the memory to marshall the ba header, and the
1778          * auth footers.
1779          */
1780
1781         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1782                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1783                 prs_mem_free(&outgoing_rpc);
1784                 return False;
1785         }
1786
1787         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1788                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1789                 prs_mem_free(&outgoing_rpc);
1790                 prs_mem_free(&out_hdr_ba);
1791                 return False;
1792         }
1793
1794         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1795
1796         /* decode the alter context request */
1797         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1798                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1799                 goto err_exit;
1800         }
1801
1802         /* secondary address CAN be NULL
1803          * as the specs say it's ignored.
1804          * It MUST be NULL to have the spoolss working.
1805          */
1806         fstrcpy(ack_pipe_name,"");
1807
1808         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1809
1810         /*
1811          * Check if this is an authenticated alter context request.
1812          */
1813
1814         if (p->hdr.auth_len != 0) {
1815                 /*
1816                  * Decode the authentication verifier.
1817                  */
1818
1819                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1820                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1821                         goto err_exit;
1822                 }
1823
1824                 /*
1825                  * Currently only the SPNEGO auth type uses the alter ctx
1826                  * response in place of the NTLMSSP auth3 type.
1827                  */
1828
1829                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1830                         /* We can only finish if the pipe is unbound. */
1831                         if (!p->pipe_bound) {
1832                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1833                                         goto err_exit;
1834                                 }
1835                         } else {
1836                                 goto err_exit;
1837                         }
1838                 }
1839         } else {
1840                 ZERO_STRUCT(auth_info);
1841         }
1842
1843         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1844
1845         /*
1846          * Create the bind response struct.
1847          */
1848
1849         /* If the requested abstract synt uuid doesn't match our client pipe,
1850                 reject the bind_ack & set the transfer interface synt to all 0's,
1851                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1852                 unknown to NT4)
1853                 Needed when adding entries to a DACL from NT5 - SK */
1854
1855         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1856                                 hdr_rb.rpc_context[0].context_id )) {
1857                 init_rpc_hdr_ba(&hdr_ba,
1858                         RPC_MAX_PDU_FRAG_LEN,
1859                         RPC_MAX_PDU_FRAG_LEN,
1860                         assoc_gid,
1861                         ack_pipe_name,
1862                         0x1, 0x0, 0x0,
1863                         &hdr_rb.rpc_context[0].transfer[0]);
1864         } else {
1865                 RPC_IFACE null_interface;
1866                 ZERO_STRUCT(null_interface);
1867                 /* Rejection reason: abstract syntax not supported */
1868                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1869                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1870                                         ack_pipe_name, 0x1, 0x2, 0x1,
1871                                         &null_interface);
1872                 p->pipe_bound = False;
1873         }
1874
1875         /*
1876          * and marshall it.
1877          */
1878
1879         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1880                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1881                 goto err_exit;
1882         }
1883
1884         /*
1885          * Create the header, now we know the length.
1886          */
1887
1888         if (prs_offset(&out_auth)) {
1889                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1890         }
1891
1892         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1893                         p->hdr.call_id,
1894                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1895                         auth_len);
1896
1897         /*
1898          * Marshall the header into the outgoing PDU.
1899          */
1900
1901         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1902                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1903                 goto err_exit;
1904         }
1905
1906         /*
1907          * Now add the RPC_HDR_BA and any auth needed.
1908          */
1909
1910         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1911                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1912                 goto err_exit;
1913         }
1914
1915         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1916                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1917                 goto err_exit;
1918         }
1919
1920         /*
1921          * Setup the lengths for the initial reply.
1922          */
1923
1924         p->out_data.data_sent_length = 0;
1925         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1926         p->out_data.current_pdu_sent = 0;
1927
1928         prs_mem_free(&out_hdr_ba);
1929         prs_mem_free(&out_auth);
1930
1931         return True;
1932
1933   err_exit:
1934
1935         prs_mem_free(&outgoing_rpc);
1936         prs_mem_free(&out_hdr_ba);
1937         prs_mem_free(&out_auth);
1938         return setup_bind_nak(p);
1939 }
1940
1941 /****************************************************************************
1942  Deal with NTLMSSP sign & seal processing on an RPC request.
1943 ****************************************************************************/
1944
1945 BOOL api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1946                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1947 {
1948         RPC_HDR_AUTH auth_info;
1949         uint32 auth_len = p->hdr.auth_len;
1950         uint32 save_offset = prs_offset(rpc_in);
1951         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1952         unsigned char *data = NULL;
1953         size_t data_len;
1954         unsigned char *full_packet_data = NULL;
1955         size_t full_packet_data_len;
1956         DATA_BLOB auth_blob;
1957
1958         *pstatus = NT_STATUS_OK;
1959
1960         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
1961                 return True;
1962         }
1963
1964         if (!a) {
1965                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1966                 return False;
1967         }
1968
1969         /* Ensure there's enough data for an authenticated request. */
1970         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
1971                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
1972                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
1973                         (unsigned int)auth_len ));
1974                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1975                 return False;
1976         }
1977
1978         /*
1979          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
1980          * after the RPC header.
1981          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
1982          * functions as NTLMv2 checks the rpc headers also.
1983          */
1984
1985         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
1986         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
1987
1988         full_packet_data = p->in_data.current_in_pdu;
1989         full_packet_data_len = p->hdr.frag_len - auth_len;
1990
1991         /* Pull the auth header and the following data into a blob. */
1992         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
1993                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
1994                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
1995                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1996                 return False;
1997         }
1998
1999         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2000                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2001                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2002                 return False;
2003         }
2004
2005         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2006         auth_blob.length = auth_len;
2007
2008         switch (p->auth.auth_level) {
2009                 case PIPE_AUTH_LEVEL_PRIVACY:
2010                         /* Data is encrypted. */
2011                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2012                                                         data, data_len,
2013                                                         full_packet_data,
2014                                                         full_packet_data_len,
2015                                                         &auth_blob);
2016                         if (!NT_STATUS_IS_OK(*pstatus)) {
2017                                 return False;
2018                         }
2019                         break;
2020                 case PIPE_AUTH_LEVEL_INTEGRITY:
2021                         /* Data is signed. */
2022                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2023                                                         data, data_len,
2024                                                         full_packet_data,
2025                                                         full_packet_data_len,
2026                                                         &auth_blob);
2027                         if (!NT_STATUS_IS_OK(*pstatus)) {
2028                                 return False;
2029                         }
2030                         break;
2031                 default:
2032                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2033                         return False;
2034         }
2035
2036         /*
2037          * Return the current pointer to the data offset.
2038          */
2039
2040         if(!prs_set_offset(rpc_in, save_offset)) {
2041                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2042                         (unsigned int)save_offset ));
2043                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2044                 return False;
2045         }
2046
2047         /*
2048          * Remember the padding length. We must remove it from the real data
2049          * stream once the sign/seal is done.
2050          */
2051
2052         *p_ss_padding_len = auth_info.auth_pad_len;
2053
2054         return True;
2055 }
2056
2057 /****************************************************************************
2058  Deal with schannel processing on an RPC request.
2059 ****************************************************************************/
2060
2061 BOOL api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2062 {
2063         uint32 data_len;
2064         uint32 auth_len;
2065         uint32 save_offset = prs_offset(rpc_in);
2066         RPC_HDR_AUTH auth_info;
2067         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2068
2069         auth_len = p->hdr.auth_len;
2070
2071         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2072                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2073                 return False;
2074         }
2075
2076         /*
2077          * The following is that length of the data we must verify or unseal.
2078          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2079          * preceeding the auth_data.
2080          */
2081
2082         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2083                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2084                         (unsigned int)p->hdr.frag_len,
2085                         (unsigned int)auth_len ));
2086                 return False;
2087         }
2088
2089         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2090                 RPC_HDR_AUTH_LEN - auth_len;
2091
2092         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2093
2094         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2095                 DEBUG(0,("cannot move offset to %u.\n",
2096                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2097                 return False;
2098         }
2099
2100         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2101                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2102                 return False;
2103         }
2104
2105         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2106                 DEBUG(0,("Invalid auth info %d on schannel\n",
2107                          auth_info.auth_type));
2108                 return False;
2109         }
2110
2111         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2112                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2113                 return False;
2114         }
2115
2116         if (!schannel_decode(p->auth.a_u.schannel_auth,
2117                            p->auth.auth_level,
2118                            SENDER_IS_INITIATOR,
2119                            &schannel_chk,
2120                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2121                 DEBUG(3,("failed to decode PDU\n"));
2122                 return False;
2123         }
2124
2125         /*
2126          * Return the current pointer to the data offset.
2127          */
2128
2129         if(!prs_set_offset(rpc_in, save_offset)) {
2130                 DEBUG(0,("failed to set offset back to %u\n",
2131                          (unsigned int)save_offset ));
2132                 return False;
2133         }
2134
2135         /* The sequence number gets incremented on both send and receive. */
2136         p->auth.a_u.schannel_auth->seq_num++;
2137
2138         /*
2139          * Remember the padding length. We must remove it from the real data
2140          * stream once the sign/seal is done.
2141          */
2142
2143         *p_ss_padding_len = auth_info.auth_pad_len;
2144
2145         return True;
2146 }
2147
2148 /****************************************************************************
2149  Return a user struct for a pipe user.
2150 ****************************************************************************/
2151
2152 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2153 {
2154         if (p->pipe_bound &&
2155                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2156                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2157                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2158         } else {
2159                 memcpy(user, &current_user, sizeof(struct current_user));
2160         }
2161
2162         return user;
2163 }
2164
2165 /****************************************************************************
2166  Find the set of RPC functions associated with this context_id
2167 ****************************************************************************/
2168
2169 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2170 {
2171         PIPE_RPC_FNS *fns = NULL;
2172         PIPE_RPC_FNS *tmp = NULL;
2173
2174         if ( !list ) {
2175                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2176                 return NULL;
2177         }
2178
2179         for (tmp=list; tmp; tmp=tmp->next ) {
2180                 if ( tmp->context_id == context_id )
2181                         break;
2182         }
2183
2184         fns = tmp;
2185
2186         return fns;
2187 }
2188
2189 /****************************************************************************
2190  Memory cleanup.
2191 ****************************************************************************/
2192
2193 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2194 {
2195         PIPE_RPC_FNS *tmp = list;
2196         PIPE_RPC_FNS *tmp2;
2197
2198         while (tmp) {
2199                 tmp2 = tmp->next;
2200                 SAFE_FREE(tmp);
2201                 tmp = tmp2;
2202         }
2203
2204         return;
2205 }
2206
2207 /****************************************************************************
2208  Find the correct RPC function to call for this request.
2209  If the pipe is authenticated then become the correct UNIX user
2210  before doing the call.
2211 ****************************************************************************/
2212
2213 BOOL api_pipe_request(pipes_struct *p)
2214 {
2215         BOOL ret = False;
2216         BOOL changed_user = False;
2217         PIPE_RPC_FNS *pipe_fns;
2218
2219         if (p->pipe_bound &&
2220                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2221                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2222                 if(!become_authenticated_pipe_user(p)) {
2223                         prs_mem_free(&p->out_data.rdata);
2224                         return False;
2225                 }
2226                 changed_user = True;
2227         }
2228
2229         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2230
2231         /* get the set of RPC functions for this context */
2232
2233         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2234
2235         if ( pipe_fns ) {
2236                 TALLOC_CTX *frame = talloc_stackframe();
2237                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2238                 TALLOC_FREE(frame);
2239         }
2240         else {
2241                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2242                         p->hdr_req.context_id, p->name));
2243         }
2244
2245         if (changed_user) {
2246                 unbecome_authenticated_pipe_user();
2247         }
2248
2249         return ret;
2250 }
2251
2252 /*******************************************************************
2253  Calls the underlying RPC function for a named pipe.
2254  ********************************************************************/
2255
2256 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
2257                 const struct api_struct *api_rpc_cmds, int n_cmds)
2258 {
2259         int fn_num;
2260         fstring name;
2261         uint32 offset1, offset2;
2262
2263         /* interpret the command */
2264         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2265
2266         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2267         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2268
2269         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2270                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2271                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2272                         break;
2273                 }
2274         }
2275
2276         if (fn_num == n_cmds) {
2277                 /*
2278                  * For an unknown RPC just return a fault PDU but
2279                  * return True to allow RPC's on the pipe to continue
2280                  * and not put the pipe into fault state. JRA.
2281                  */
2282                 DEBUG(4, ("unknown\n"));
2283                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2284                 return True;
2285         }
2286
2287         offset1 = prs_offset(&p->out_data.rdata);
2288
2289         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2290                 fn_num, api_rpc_cmds[fn_num].fn));
2291         /* do the actual command */
2292         if(!api_rpc_cmds[fn_num].fn(p)) {
2293                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2294                 prs_mem_free(&p->out_data.rdata);
2295                 return False;
2296         }
2297
2298         if (p->bad_handle_fault_state) {
2299                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2300                 p->bad_handle_fault_state = False;
2301                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2302                 return True;
2303         }
2304
2305         if (p->rng_fault_state) {
2306                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2307                 p->rng_fault_state = False;
2308                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2309                 return True;
2310         }
2311
2312         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2313         offset2 = prs_offset(&p->out_data.rdata);
2314         prs_set_offset(&p->out_data.rdata, offset1);
2315         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2316         prs_set_offset(&p->out_data.rdata, offset2);
2317
2318         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2319
2320         /* Check for buffer underflow in rpc parsing */
2321
2322         if ((DEBUGLEVEL >= 10) &&
2323             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2324                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2325                 char *data = (char *)SMB_MALLOC(data_len);
2326
2327                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2328                 if (data) {
2329                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2330                         SAFE_FREE(data);
2331                 }
2332
2333         }
2334
2335         return True;
2336 }
2337
2338 /*******************************************************************
2339 *******************************************************************/
2340
2341 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2342 {
2343         struct api_struct *cmds = NULL;
2344         int               n_cmds = 0;
2345
2346         switch ( idx ) {
2347                 case PI_LSARPC:
2348                         lsa_get_pipe_fns( &cmds, &n_cmds );
2349                         break;
2350                 case PI_LSARPC_DS:
2351                         lsa_ds_get_pipe_fns( &cmds, &n_cmds );
2352                         break;
2353                 case PI_SAMR:
2354                         samr_get_pipe_fns( &cmds, &n_cmds );
2355                         break;
2356                 case PI_NETLOGON:
2357                         netlog_get_pipe_fns( &cmds, &n_cmds );
2358                         break;
2359                 case PI_SRVSVC:
2360                         srvsvc2_get_pipe_fns( &cmds, &n_cmds );
2361                         break;
2362                 case PI_WKSSVC:
2363                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2364                         break;
2365                 case PI_WINREG:
2366                         winreg_get_pipe_fns( &cmds, &n_cmds );
2367                         break;
2368                 case PI_SPOOLSS:
2369                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2370                         break;
2371                 case PI_NETDFS:
2372                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2373                         break;
2374                 case PI_SVCCTL:
2375                         svcctl2_get_pipe_fns( &cmds, &n_cmds );
2376                         break;
2377                 case PI_EVENTLOG:
2378                         eventlog2_get_pipe_fns( &cmds, &n_cmds );
2379                         break;
2380                 case PI_NTSVCS:
2381                         ntsvcs_get_pipe_fns( &cmds, &n_cmds );
2382                         break;
2383 #ifdef DEVELOPER
2384                 case PI_RPCECHO:
2385                         rpcecho_get_pipe_fns( &cmds, &n_cmds );
2386                         break;
2387 #endif
2388                 default:
2389                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2390         }
2391
2392         *fns = cmds;
2393         *n_fns = n_cmds;
2394
2395         return;
2396 }