source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *  Heavily modified by Simo Sorce                  2010.
   6  *  Copyright Andrew Bartlett                       2011.
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23 #include "../lib/util/tevent_ntstatus.h"
  24 #include "librpc/gen_ndr/ndr_epmapper_c.h"
  25 #include "../librpc/gen_ndr/ndr_dssetup.h"
  26 #include "../libcli/auth/schannel.h"
  27 #include "../libcli/auth/netlogon_creds_cli.h"
  28 #include "auth_generic.h"
  29 #include "librpc/gen_ndr/ndr_dcerpc.h"
  30 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  31 #include "librpc/rpc/dcerpc.h"
  32 #include "rpc_dce.h"
  33 #include "cli_pipe.h"
  34 #include "libsmb/libsmb.h"
  35 #include "auth/gensec/gensec.h"
  36 #include "auth/credentials/credentials.h"
  37 #include "../libcli/smb/smbXcli_base.h"
  38
  39 #undef DBGC_CLASS
  40 #define DBGC_CLASS DBGC_RPC_CLI
  41
  42 /********************************************************************
  43  Pipe description for a DEBUG
  44  ********************************************************************/
  45 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
  46                                    struct rpc_pipe_client *cli)
  47 {
  48         char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
  49         if (result == NULL) {
  50                 return "pipe";
  51         }
  52         return result;
  53 }
  54
  55 /********************************************************************
  56  Rpc pipe call id.
  57  ********************************************************************/
  58
  59 static uint32_t get_rpc_call_id(void)
  60 {
  61         static uint32_t call_id = 0;
  62         return ++call_id;
  63 }
  64
  65 /*******************************************************************
  66  Use SMBreadX to get rest of one fragment's worth of rpc data.
  67  Reads the whole size or give an error message
  68  ********************************************************************/
  69
  70 struct rpc_read_state {
  71         struct tevent_context *ev;
  72         struct rpc_cli_transport *transport;
  73         uint8_t *data;
  74         size_t size;
  75         size_t num_read;
  76 };
  77
  78 static void rpc_read_done(struct tevent_req *subreq);
  79
  80 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
  81                                         struct tevent_context *ev,
  82                                         struct rpc_cli_transport *transport,
  83                                         uint8_t *data, size_t size)
  84 {
  85         struct tevent_req *req, *subreq;
  86         struct rpc_read_state *state;
  87
  88         req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
  89         if (req == NULL) {
  90                 return NULL;
  91         }
  92         state->ev = ev;
  93         state->transport = transport;
  94         state->data = data;
  95         state->size = size;
  96         state->num_read = 0;
  97
  98         DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
  99
 100         subreq = transport->read_send(state, ev, (uint8_t *)data, size,
 101                                       transport->priv);
 102         if (subreq == NULL) {
 103                 goto fail;
 104         }
 105         tevent_req_set_callback(subreq, rpc_read_done, req);
 106         return req;
 107
 108  fail:
 109         TALLOC_FREE(req);
 110         return NULL;
 111 }
 112
 113 static void rpc_read_done(struct tevent_req *subreq)
 114 {
 115         struct tevent_req *req = tevent_req_callback_data(
 116                 subreq, struct tevent_req);
 117         struct rpc_read_state *state = tevent_req_data(
 118                 req, struct rpc_read_state);
 119         NTSTATUS status;
 120         ssize_t received;
 121
 122         status = state->transport->read_recv(subreq, &received);
 123         TALLOC_FREE(subreq);
 124         if (!NT_STATUS_IS_OK(status)) {
 125                 tevent_req_nterror(req, status);
 126                 return;
 127         }
 128
 129         state->num_read += received;
 130         if (state->num_read == state->size) {
 131                 tevent_req_done(req);
 132                 return;
 133         }
 134
 135         subreq = state->transport->read_send(state, state->ev,
 136                                              state->data + state->num_read,
 137                                              state->size - state->num_read,
 138                                              state->transport->priv);
 139         if (tevent_req_nomem(subreq, req)) {
 140                 return;
 141         }
 142         tevent_req_set_callback(subreq, rpc_read_done, req);
 143 }
 144
 145 static NTSTATUS rpc_read_recv(struct tevent_req *req)
 146 {
 147         return tevent_req_simple_recv_ntstatus(req);
 148 }
 149
 150 struct rpc_write_state {
 151         struct tevent_context *ev;
 152         struct rpc_cli_transport *transport;
 153         const uint8_t *data;
 154         size_t size;
 155         size_t num_written;
 156 };
 157
 158 static void rpc_write_done(struct tevent_req *subreq);
 159
 160 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
 161                                          struct tevent_context *ev,
 162                                          struct rpc_cli_transport *transport,
 163                                          const uint8_t *data, size_t size)
 164 {
 165         struct tevent_req *req, *subreq;
 166         struct rpc_write_state *state;
 167
 168         req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
 169         if (req == NULL) {
 170                 return NULL;
 171         }
 172         state->ev = ev;
 173         state->transport = transport;
 174         state->data = data;
 175         state->size = size;
 176         state->num_written = 0;
 177
 178         DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
 179
 180         subreq = transport->write_send(state, ev, data, size, transport->priv);
 181         if (subreq == NULL) {
 182                 goto fail;
 183         }
 184         tevent_req_set_callback(subreq, rpc_write_done, req);
 185         return req;
 186  fail:
 187         TALLOC_FREE(req);
 188         return NULL;
 189 }
 190
 191 static void rpc_write_done(struct tevent_req *subreq)
 192 {
 193         struct tevent_req *req = tevent_req_callback_data(
 194                 subreq, struct tevent_req);
 195         struct rpc_write_state *state = tevent_req_data(
 196                 req, struct rpc_write_state);
 197         NTSTATUS status;
 198         ssize_t written;
 199
 200         status = state->transport->write_recv(subreq, &written);
 201         TALLOC_FREE(subreq);
 202         if (!NT_STATUS_IS_OK(status)) {
 203                 tevent_req_nterror(req, status);
 204                 return;
 205         }
 206
 207         state->num_written += written;
 208
 209         if (state->num_written == state->size) {
 210                 tevent_req_done(req);
 211                 return;
 212         }
 213
 214         subreq = state->transport->write_send(state, state->ev,
 215                                               state->data + state->num_written,
 216                                               state->size - state->num_written,
 217                                               state->transport->priv);
 218         if (tevent_req_nomem(subreq, req)) {
 219                 return;
 220         }
 221         tevent_req_set_callback(subreq, rpc_write_done, req);
 222 }
 223
 224 static NTSTATUS rpc_write_recv(struct tevent_req *req)
 225 {
 226         return tevent_req_simple_recv_ntstatus(req);
 227 }
 228
 229
 230 /****************************************************************************
 231  Try and get a PDU's worth of data from current_pdu. If not, then read more
 232  from the wire.
 233  ****************************************************************************/
 234
 235 struct get_complete_frag_state {
 236         struct tevent_context *ev;
 237         struct rpc_pipe_client *cli;
 238         uint16_t frag_len;
 239         DATA_BLOB *pdu;
 240 };
 241
 242 static void get_complete_frag_got_header(struct tevent_req *subreq);
 243 static void get_complete_frag_got_rest(struct tevent_req *subreq);
 244
 245 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
 246                                                  struct tevent_context *ev,
 247                                                  struct rpc_pipe_client *cli,
 248                                                  DATA_BLOB *pdu)
 249 {
 250         struct tevent_req *req, *subreq;
 251         struct get_complete_frag_state *state;
 252         size_t received;
 253         NTSTATUS status;
 254
 255         req = tevent_req_create(mem_ctx, &state,
 256                                 struct get_complete_frag_state);
 257         if (req == NULL) {
 258                 return NULL;
 259         }
 260         state->ev = ev;
 261         state->cli = cli;
 262         state->frag_len = RPC_HEADER_LEN;
 263         state->pdu = pdu;
 264
 265         received = pdu->length;
 266         if (received < RPC_HEADER_LEN) {
 267                 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
 268                         status = NT_STATUS_NO_MEMORY;
 269                         goto post_status;
 270                 }
 271                 subreq = rpc_read_send(state, state->ev,
 272                                         state->cli->transport,
 273                                         pdu->data + received,
 274                                         RPC_HEADER_LEN - received);
 275                 if (subreq == NULL) {
 276                         status = NT_STATUS_NO_MEMORY;
 277                         goto post_status;
 278                 }
 279                 tevent_req_set_callback(subreq, get_complete_frag_got_header,
 280                                         req);
 281                 return req;
 282         }
 283
 284         state->frag_len = dcerpc_get_frag_length(pdu);
 285         if (state->frag_len < RPC_HEADER_LEN) {
 286                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
 287                 return tevent_req_post(req, ev);
 288         }
 289
 290         /*
 291          * Ensure we have frag_len bytes of data.
 292          */
 293         if (received < state->frag_len) {
 294                 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
 295                         status = NT_STATUS_NO_MEMORY;
 296                         goto post_status;
 297                 }
 298                 subreq = rpc_read_send(state, state->ev,
 299                                         state->cli->transport,
 300                                         pdu->data + received,
 301                                         state->frag_len - received);
 302                 if (subreq == NULL) {
 303                         status = NT_STATUS_NO_MEMORY;
 304                         goto post_status;
 305                 }
 306                 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
 307                                         req);
 308                 return req;
 309         }
 310
 311         status = NT_STATUS_OK;
 312  post_status:
 313         if (NT_STATUS_IS_OK(status)) {
 314                 tevent_req_done(req);
 315         } else {
 316                 tevent_req_nterror(req, status);
 317         }
 318         return tevent_req_post(req, ev);
 319 }
 320
 321 static void get_complete_frag_got_header(struct tevent_req *subreq)
 322 {
 323         struct tevent_req *req = tevent_req_callback_data(
 324                 subreq, struct tevent_req);
 325         struct get_complete_frag_state *state = tevent_req_data(
 326                 req, struct get_complete_frag_state);
 327         NTSTATUS status;
 328
 329         status = rpc_read_recv(subreq);
 330         TALLOC_FREE(subreq);
 331         if (!NT_STATUS_IS_OK(status)) {
 332                 tevent_req_nterror(req, status);
 333                 return;
 334         }
 335
 336         state->frag_len = dcerpc_get_frag_length(state->pdu);
 337         if (state->frag_len < RPC_HEADER_LEN) {
 338                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
 339                 return;
 340         }
 341
 342         if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
 343                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 344                 return;
 345         }
 346
 347         /*
 348          * We're here in this piece of code because we've read exactly
 349          * RPC_HEADER_LEN bytes into state->pdu.
 350          */
 351
 352         subreq = rpc_read_send(state, state->ev, state->cli->transport,
 353                                 state->pdu->data + RPC_HEADER_LEN,
 354                                 state->frag_len - RPC_HEADER_LEN);
 355         if (tevent_req_nomem(subreq, req)) {
 356                 return;
 357         }
 358         tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
 359 }
 360
 361 static void get_complete_frag_got_rest(struct tevent_req *subreq)
 362 {
 363         struct tevent_req *req = tevent_req_callback_data(
 364                 subreq, struct tevent_req);
 365         NTSTATUS status;
 366
 367         status = rpc_read_recv(subreq);
 368         TALLOC_FREE(subreq);
 369         if (!NT_STATUS_IS_OK(status)) {
 370                 tevent_req_nterror(req, status);
 371                 return;
 372         }
 373         tevent_req_done(req);
 374 }
 375
 376 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
 377 {
 378         return tevent_req_simple_recv_ntstatus(req);
 379 }
 380
 381 /****************************************************************************
 382  Do basic authentication checks on an incoming pdu.
 383  ****************************************************************************/
 384
 385 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
 386                                                 struct rpc_pipe_client *cli,
 387                                                 struct ncacn_packet *pkt,
 388                                                 DATA_BLOB *pdu,
 389                                                 uint8_t expected_pkt_type,
 390                                                 uint32_t call_id,
 391                                                 DATA_BLOB *rdata,
 392                                                 DATA_BLOB *reply_pdu)
 393 {
 394         const struct dcerpc_response *r = NULL;
 395         DATA_BLOB tmp_stub = data_blob_null;
 396         NTSTATUS ret = NT_STATUS_OK;
 397
 398         /*
 399          * Point the return values at the real data including the RPC
 400          * header. Just in case the caller wants it.
 401          */
 402         *rdata = *pdu;
 403
 404         if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
 405             !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
 406                 /*
 407                  * TODO: do we still need this hack which was introduced
 408                  * in commit a42afcdcc7ab9aa9ed193ae36d3dbb10843447f0.
 409                  *
 410                  * I don't even know what AS/U might be...
 411                  */
 412                 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
 413                           "fragment first/last ON.\n"));
 414                 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
 415         }
 416
 417         /* Ensure we have the correct type. */
 418         switch (pkt->ptype) {
 419         case DCERPC_PKT_BIND_NAK:
 420                 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
 421                           rpccli_pipe_txt(talloc_tos(), cli)));
 422
 423                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 424                                                 DCERPC_PKT_BIND_NAK,
 425                                                 0, /* max_auth_info */
 426                                                 DCERPC_PFC_FLAG_FIRST |
 427                                                 DCERPC_PFC_FLAG_LAST,
 428                                                 0); /* optional flags */
 429                 if (!NT_STATUS_IS_OK(ret)) {
 430                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 431                                   "RPC packet type - %u, expected %u: %s\n",
 432                                   rpccli_pipe_txt(talloc_tos(), cli),
 433                                   pkt->ptype, expected_pkt_type,
 434                                   nt_errstr(ret)));
 435                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 436                         return ret;
 437                 }
 438
 439                 /* Use this for now... */
 440                 return NT_STATUS_NETWORK_ACCESS_DENIED;
 441
 442         case DCERPC_PKT_BIND_ACK:
 443                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 444                                         expected_pkt_type,
 445                                         pkt->u.bind_ack.auth_info.length,
 446                                         DCERPC_PFC_FLAG_FIRST |
 447                                         DCERPC_PFC_FLAG_LAST,
 448                                         DCERPC_PFC_FLAG_CONC_MPX |
 449                                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
 450                 if (!NT_STATUS_IS_OK(ret)) {
 451                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 452                                   "RPC packet type - %u, expected %u: %s\n",
 453                                   rpccli_pipe_txt(talloc_tos(), cli),
 454                                   pkt->ptype, expected_pkt_type,
 455                                   nt_errstr(ret)));
 456                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 457                         return ret;
 458                 }
 459
 460                 break;
 461
 462         case DCERPC_PKT_ALTER_RESP:
 463                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 464                                         expected_pkt_type,
 465                                         pkt->u.alter_resp.auth_info.length,
 466                                         DCERPC_PFC_FLAG_FIRST |
 467                                         DCERPC_PFC_FLAG_LAST,
 468                                         DCERPC_PFC_FLAG_CONC_MPX |
 469                                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
 470                 if (!NT_STATUS_IS_OK(ret)) {
 471                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 472                                   "RPC packet type - %u, expected %u: %s\n",
 473                                   rpccli_pipe_txt(talloc_tos(), cli),
 474                                   pkt->ptype, expected_pkt_type,
 475                                   nt_errstr(ret)));
 476                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 477                         return ret;
 478                 }
 479
 480                 break;
 481
 482         case DCERPC_PKT_RESPONSE:
 483
 484                 r = &pkt->u.response;
 485
 486                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 487                                                 expected_pkt_type,
 488                                                 r->stub_and_verifier.length,
 489                                                 0, /* required_flags */
 490                                                 DCERPC_PFC_FLAG_FIRST |
 491                                                 DCERPC_PFC_FLAG_LAST);
 492                 if (!NT_STATUS_IS_OK(ret)) {
 493                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 494                                   "RPC packet type - %u, expected %u: %s\n",
 495                                   rpccli_pipe_txt(talloc_tos(), cli),
 496                                   pkt->ptype, expected_pkt_type,
 497                                   nt_errstr(ret)));
 498                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 499                         return ret;
 500                 }
 501
 502                 tmp_stub.data = r->stub_and_verifier.data;
 503                 tmp_stub.length = r->stub_and_verifier.length;
 504
 505                 /* Here's where we deal with incoming sign/seal. */
 506                 ret = dcerpc_check_auth(cli->auth, pkt,
 507                                         &tmp_stub,
 508                                         DCERPC_RESPONSE_LENGTH,
 509                                         pdu);
 510                 if (!NT_STATUS_IS_OK(ret)) {
 511                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 512                                   "RPC packet type - %u, expected %u: %s\n",
 513                                   rpccli_pipe_txt(talloc_tos(), cli),
 514                                   pkt->ptype, expected_pkt_type,
 515                                   nt_errstr(ret)));
 516                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 517                         return ret;
 518                 }
 519
 520                 /* Point the return values at the NDR data. */
 521                 *rdata = tmp_stub;
 522
 523                 DEBUG(10, ("Got pdu len %lu, data_len %lu\n",
 524                            (long unsigned int)pdu->length,
 525                            (long unsigned int)rdata->length));
 526
 527                 /*
 528                  * If this is the first reply, and the allocation hint is
 529                  * reasonable, try and set up the reply_pdu DATA_BLOB to the
 530                  * correct size.
 531                  */
 532
 533                 if ((reply_pdu->length == 0) &&
 534                     r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
 535                         if (!data_blob_realloc(mem_ctx, reply_pdu,
 536                                                         r->alloc_hint)) {
 537                                 DEBUG(0, ("reply alloc hint %d too "
 538                                           "large to allocate\n",
 539                                           (int)r->alloc_hint));
 540                                 return NT_STATUS_NO_MEMORY;
 541                         }
 542                 }
 543
 544                 break;
 545
 546         case DCERPC_PKT_FAULT:
 547
 548                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 549                                                 DCERPC_PKT_FAULT,
 550                                                 0, /* max_auth_info */
 551                                                 DCERPC_PFC_FLAG_FIRST |
 552                                                 DCERPC_PFC_FLAG_LAST,
 553                                                 DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
 554                 if (!NT_STATUS_IS_OK(ret)) {
 555                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 556                                   "RPC packet type - %u, expected %u: %s\n",
 557                                   rpccli_pipe_txt(talloc_tos(), cli),
 558                                   pkt->ptype, expected_pkt_type,
 559                                   nt_errstr(ret)));
 560                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 561                         return ret;
 562                 }
 563
 564                 DEBUG(1, (__location__ ": RPC fault code %s received "
 565                           "from %s!\n",
 566                           dcerpc_errstr(talloc_tos(),
 567                           pkt->u.fault.status),
 568                           rpccli_pipe_txt(talloc_tos(), cli)));
 569
 570                 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
 571
 572         default:
 573                 DEBUG(0, (__location__ "Unknown packet type %u received "
 574                           "from %s!\n",
 575                           (unsigned int)pkt->ptype,
 576                           rpccli_pipe_txt(talloc_tos(), cli)));
 577                 return NT_STATUS_RPC_PROTOCOL_ERROR;
 578         }
 579
 580
 581         if (pkt->call_id != call_id) {
 582                 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
 583                           "RPC call_id - %u, not %u\n",
 584                           rpccli_pipe_txt(talloc_tos(), cli),
 585                           pkt->call_id, call_id));
 586                 return NT_STATUS_RPC_PROTOCOL_ERROR;
 587         }
 588
 589         return NT_STATUS_OK;
 590 }
 591
 592 /****************************************************************************
 593  Call a remote api on an arbitrary pipe.  takes param, data and setup buffers.
 594 ****************************************************************************/
 595
 596 struct cli_api_pipe_state {
 597         struct tevent_context *ev;
 598         struct rpc_cli_transport *transport;
 599         uint8_t *rdata;
 600         uint32_t rdata_len;
 601 };
 602
 603 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
 604 static void cli_api_pipe_write_done(struct tevent_req *subreq);
 605 static void cli_api_pipe_read_done(struct tevent_req *subreq);
 606
 607 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
 608                                             struct tevent_context *ev,
 609                                             struct rpc_cli_transport *transport,
 610                                             uint8_t *data, size_t data_len,
 611                                             uint32_t max_rdata_len)
 612 {
 613         struct tevent_req *req, *subreq;
 614         struct cli_api_pipe_state *state;
 615         NTSTATUS status;
 616
 617         req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
 618         if (req == NULL) {
 619                 return NULL;
 620         }
 621         state->ev = ev;
 622         state->transport = transport;
 623
 624         if (max_rdata_len < RPC_HEADER_LEN) {
 625                 /*
 626                  * For a RPC reply we always need at least RPC_HEADER_LEN
 627                  * bytes. We check this here because we will receive
 628                  * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
 629                  */
 630                 status = NT_STATUS_INVALID_PARAMETER;
 631                 goto post_status;
 632         }
 633
 634         if (transport->trans_send != NULL) {
 635                 subreq = transport->trans_send(state, ev, data, data_len,
 636                                                max_rdata_len, transport->priv);
 637                 if (subreq == NULL) {
 638                         goto fail;
 639                 }
 640                 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
 641                 return req;
 642         }
 643
 644         /*
 645          * If the transport does not provide a "trans" routine, i.e. for
 646          * example the ncacn_ip_tcp transport, do the write/read step here.
 647          */
 648
 649         subreq = rpc_write_send(state, ev, transport, data, data_len);
 650         if (subreq == NULL) {
 651                 goto fail;
 652         }
 653         tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
 654         return req;
 655
 656  post_status:
 657         tevent_req_nterror(req, status);
 658         return tevent_req_post(req, ev);
 659  fail:
 660         TALLOC_FREE(req);
 661         return NULL;
 662 }
 663
 664 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
 665 {
 666         struct tevent_req *req = tevent_req_callback_data(
 667                 subreq, struct tevent_req);
 668         struct cli_api_pipe_state *state = tevent_req_data(
 669                 req, struct cli_api_pipe_state);
 670         NTSTATUS status;
 671
 672         status = state->transport->trans_recv(subreq, state, &state->rdata,
 673                                               &state->rdata_len);
 674         TALLOC_FREE(subreq);
 675         if (!NT_STATUS_IS_OK(status)) {
 676                 tevent_req_nterror(req, status);
 677                 return;
 678         }
 679         tevent_req_done(req);
 680 }
 681
 682 static void cli_api_pipe_write_done(struct tevent_req *subreq)
 683 {
 684         struct tevent_req *req = tevent_req_callback_data(
 685                 subreq, struct tevent_req);
 686         struct cli_api_pipe_state *state = tevent_req_data(
 687                 req, struct cli_api_pipe_state);
 688         NTSTATUS status;
 689
 690         status = rpc_write_recv(subreq);
 691         TALLOC_FREE(subreq);
 692         if (!NT_STATUS_IS_OK(status)) {
 693                 tevent_req_nterror(req, status);
 694                 return;
 695         }
 696
 697         state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
 698         if (tevent_req_nomem(state->rdata, req)) {
 699                 return;
 700         }
 701
 702         /*
 703          * We don't need to use rpc_read_send here, the upper layer will cope
 704          * with a short read, transport->trans_send could also return less
 705          * than state->max_rdata_len.
 706          */
 707         subreq = state->transport->read_send(state, state->ev, state->rdata,
 708                                              RPC_HEADER_LEN,
 709                                              state->transport->priv);
 710         if (tevent_req_nomem(subreq, req)) {
 711                 return;
 712         }
 713         tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
 714 }
 715
 716 static void cli_api_pipe_read_done(struct tevent_req *subreq)
 717 {
 718         struct tevent_req *req = tevent_req_callback_data(
 719                 subreq, struct tevent_req);
 720         struct cli_api_pipe_state *state = tevent_req_data(
 721                 req, struct cli_api_pipe_state);
 722         NTSTATUS status;
 723         ssize_t received;
 724
 725         status = state->transport->read_recv(subreq, &received);
 726         TALLOC_FREE(subreq);
 727         if (!NT_STATUS_IS_OK(status)) {
 728                 tevent_req_nterror(req, status);
 729                 return;
 730         }
 731         state->rdata_len = received;
 732         tevent_req_done(req);
 733 }
 734
 735 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 736                                   uint8_t **prdata, uint32_t *prdata_len)
 737 {
 738         struct cli_api_pipe_state *state = tevent_req_data(
 739                 req, struct cli_api_pipe_state);
 740         NTSTATUS status;
 741
 742         if (tevent_req_is_nterror(req, &status)) {
 743                 return status;
 744         }
 745
 746         *prdata = talloc_move(mem_ctx, &state->rdata);
 747         *prdata_len = state->rdata_len;
 748         return NT_STATUS_OK;
 749 }
 750
 751 /****************************************************************************
 752  Send data on an rpc pipe via trans. The data must be the last
 753  pdu fragment of an NDR data stream.
 754
 755  Receive response data from an rpc pipe, which may be large...
 756
 757  Read the first fragment: unfortunately have to use SMBtrans for the first
 758  bit, then SMBreadX for subsequent bits.
 759
 760  If first fragment received also wasn't the last fragment, continue
 761  getting fragments until we _do_ receive the last fragment.
 762
 763  Request/Response PDU's look like the following...
 764
 765  |<------------------PDU len----------------------------------------------->|
 766  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 767
 768  +------------+-----------------+-------------+---------------+-------------+
 769  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 770  +------------+-----------------+-------------+---------------+-------------+
 771
 772  Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
 773  signing & sealing being negotiated.
 774
 775  ****************************************************************************/
 776
 777 struct rpc_api_pipe_state {
 778         struct tevent_context *ev;
 779         struct rpc_pipe_client *cli;
 780         uint8_t expected_pkt_type;
 781         uint32_t call_id;
 782
 783         DATA_BLOB incoming_frag;
 784         struct ncacn_packet *pkt;
 785
 786         /* Incoming reply */
 787         DATA_BLOB reply_pdu;
 788         size_t reply_pdu_offset;
 789         uint8_t endianess;
 790 };
 791
 792 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
 793 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
 794 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
 795
 796 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
 797                                             struct tevent_context *ev,
 798                                             struct rpc_pipe_client *cli,
 799                                             DATA_BLOB *data, /* Outgoing PDU */
 800                                             uint8_t expected_pkt_type,
 801                                             uint32_t call_id)
 802 {
 803         struct tevent_req *req, *subreq;
 804         struct rpc_api_pipe_state *state;
 805         uint16_t max_recv_frag;
 806         NTSTATUS status;
 807
 808         req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
 809         if (req == NULL) {
 810                 return NULL;
 811         }
 812         state->ev = ev;
 813         state->cli = cli;
 814         state->expected_pkt_type = expected_pkt_type;
 815         state->call_id = call_id;
 816         state->endianess = DCERPC_DREP_LE;
 817
 818         /*
 819          * Ensure we're not sending too much.
 820          */
 821         if (data->length > cli->max_xmit_frag) {
 822                 status = NT_STATUS_INVALID_PARAMETER;
 823                 goto post_status;
 824         }
 825
 826         DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
 827
 828         if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
 829                 subreq = rpc_write_send(state, ev, cli->transport,
 830                                         data->data, data->length);
 831                 if (subreq == NULL) {
 832                         goto fail;
 833                 }
 834                 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
 835                 return req;
 836         }
 837
 838         /* get the header first, then fetch the rest once we have
 839          * the frag_length available */
 840         max_recv_frag = RPC_HEADER_LEN;
 841
 842         subreq = cli_api_pipe_send(state, ev, cli->transport,
 843                                    data->data, data->length, max_recv_frag);
 844         if (subreq == NULL) {
 845                 goto fail;
 846         }
 847         tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
 848         return req;
 849
 850  post_status:
 851         tevent_req_nterror(req, status);
 852         return tevent_req_post(req, ev);
 853  fail:
 854         TALLOC_FREE(req);
 855         return NULL;
 856 }
 857
 858 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
 859 {
 860         struct tevent_req *req =
 861                 tevent_req_callback_data(subreq,
 862                 struct tevent_req);
 863         NTSTATUS status;
 864
 865         status = rpc_write_recv(subreq);
 866         TALLOC_FREE(subreq);
 867         if (!NT_STATUS_IS_OK(status)) {
 868                 tevent_req_nterror(req, status);
 869                 return;
 870         }
 871
 872         tevent_req_done(req);
 873 }
 874
 875 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
 876 {
 877         struct tevent_req *req = tevent_req_callback_data(
 878                 subreq, struct tevent_req);
 879         struct rpc_api_pipe_state *state = tevent_req_data(
 880                 req, struct rpc_api_pipe_state);
 881         NTSTATUS status;
 882         uint8_t *rdata = NULL;
 883         uint32_t rdata_len = 0;
 884
 885         status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
 886         TALLOC_FREE(subreq);
 887         if (!NT_STATUS_IS_OK(status)) {
 888                 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
 889                 tevent_req_nterror(req, status);
 890                 return;
 891         }
 892
 893         if (rdata == NULL) {
 894                 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
 895                          rpccli_pipe_txt(talloc_tos(), state->cli)));
 896                 tevent_req_done(req);
 897                 return;
 898         }
 899
 900         /*
 901          * Move data on state->incoming_frag.
 902          */
 903         state->incoming_frag.data = talloc_move(state, &rdata);
 904         state->incoming_frag.length = rdata_len;
 905         if (!state->incoming_frag.data) {
 906                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 907                 return;
 908         }
 909
 910         /* Ensure we have enough data for a pdu. */
 911         subreq = get_complete_frag_send(state, state->ev, state->cli,
 912                                         &state->incoming_frag);
 913         if (tevent_req_nomem(subreq, req)) {
 914                 return;
 915         }
 916         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
 917 }
 918
 919 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
 920 {
 921         struct tevent_req *req = tevent_req_callback_data(
 922                 subreq, struct tevent_req);
 923         struct rpc_api_pipe_state *state = tevent_req_data(
 924                 req, struct rpc_api_pipe_state);
 925         NTSTATUS status;
 926         DATA_BLOB rdata = data_blob_null;
 927
 928         status = get_complete_frag_recv(subreq);
 929         TALLOC_FREE(subreq);
 930         if (!NT_STATUS_IS_OK(status)) {
 931                 DEBUG(5, ("get_complete_frag failed: %s\n",
 932                           nt_errstr(status)));
 933                 tevent_req_nterror(req, status);
 934                 return;
 935         }
 936
 937         state->pkt = talloc(state, struct ncacn_packet);
 938         if (!state->pkt) {
 939                 /*
 940                  * TODO: do a real async disconnect ...
 941                  *
 942                  * For now do it sync...
 943                  */
 944                 TALLOC_FREE(state->cli->transport);
 945                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 946                 return;
 947         }
 948
 949         status = dcerpc_pull_ncacn_packet(state->pkt,
 950                                           &state->incoming_frag,
 951                                           state->pkt);
 952         if (!NT_STATUS_IS_OK(status)) {
 953                 /*
 954                  * TODO: do a real async disconnect ...
 955                  *
 956                  * For now do it sync...
 957                  */
 958                 TALLOC_FREE(state->cli->transport);
 959                 tevent_req_nterror(req, status);
 960                 return;
 961         }
 962
 963         if (DEBUGLEVEL >= 10) {
 964                 NDR_PRINT_DEBUG(ncacn_packet, state->pkt);
 965         }
 966
 967         status = cli_pipe_validate_current_pdu(state,
 968                                                 state->cli, state->pkt,
 969                                                 &state->incoming_frag,
 970                                                 state->expected_pkt_type,
 971                                                 state->call_id,
 972                                                 &rdata,
 973                                                 &state->reply_pdu);
 974
 975         DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
 976                   (unsigned)state->incoming_frag.length,
 977                   (unsigned)state->reply_pdu_offset,
 978                   nt_errstr(status)));
 979
 980         if (state->pkt->ptype != DCERPC_PKT_FAULT && !NT_STATUS_IS_OK(status)) {
 981                 /*
 982                  * TODO: do a real async disconnect ...
 983                  *
 984                  * For now do it sync...
 985                  */
 986                 TALLOC_FREE(state->cli->transport);
 987         } else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTOCOL_ERROR)) {
 988                 /*
 989                  * TODO: do a real async disconnect ...
 990                  *
 991                  * For now do it sync...
 992                  */
 993                 TALLOC_FREE(state->cli->transport);
 994         } else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
 995                 /*
 996                  * TODO: do a real async disconnect ...
 997                  *
 998                  * For now do it sync...
 999                  */
1000                 TALLOC_FREE(state->cli->transport);
1001         }
1002         if (!NT_STATUS_IS_OK(status)) {
1003                 tevent_req_nterror(req, status);
1004                 return;
1005         }
1006
1007         if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
1008             && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
1009                 /*
1010                  * Set the data type correctly for big-endian data on the
1011                  * first packet.
1012                  */
1013                 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
1014                           "big-endian.\n",
1015                           rpccli_pipe_txt(talloc_tos(), state->cli)));
1016                 state->endianess = 0x00; /* BIG ENDIAN */
1017         }
1018         /*
1019          * Check endianness on subsequent packets.
1020          */
1021         if (state->endianess != state->pkt->drep[0]) {
1022                 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
1023                          "%s\n",
1024                          state->endianess?"little":"big",
1025                          state->pkt->drep[0]?"little":"big"));
1026                 /*
1027                  * TODO: do a real async disconnect ...
1028                  *
1029                  * For now do it sync...
1030                  */
1031                 TALLOC_FREE(state->cli->transport);
1032                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1033                 return;
1034         }
1035
1036         if (state->reply_pdu_offset + rdata.length > MAX_RPC_DATA_SIZE) {
1037                 /*
1038                  * TODO: do a real async disconnect ...
1039                  *
1040                  * For now do it sync...
1041                  */
1042                 TALLOC_FREE(state->cli->transport);
1043                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1044                 return;
1045         }
1046
1047         /* Now copy the data portion out of the pdu into rbuf. */
1048         if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
1049                 if (!data_blob_realloc(NULL, &state->reply_pdu,
1050                                 state->reply_pdu_offset + rdata.length)) {
1051                         /*
1052                          * TODO: do a real async disconnect ...
1053                          *
1054                          * For now do it sync...
1055                          */
1056                         TALLOC_FREE(state->cli->transport);
1057                         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1058                         return;
1059                 }
1060         }
1061
1062         memcpy(state->reply_pdu.data + state->reply_pdu_offset,
1063                 rdata.data, rdata.length);
1064         state->reply_pdu_offset += rdata.length;
1065
1066         /* reset state->incoming_frag, there is no need to free it,
1067          * it will be reallocated to the right size the next time
1068          * it is used */
1069         state->incoming_frag.length = 0;
1070
1071         if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1072                 /* make sure the pdu length is right now that we
1073                  * have all the data available (alloc hint may
1074                  * have allocated more than was actually used) */
1075                 state->reply_pdu.length = state->reply_pdu_offset;
1076                 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1077                           rpccli_pipe_txt(talloc_tos(), state->cli),
1078                           (unsigned)state->reply_pdu.length));
1079                 tevent_req_done(req);
1080                 return;
1081         }
1082
1083         subreq = get_complete_frag_send(state, state->ev, state->cli,
1084                                         &state->incoming_frag);
1085         if (subreq == NULL) {
1086                 /*
1087                  * TODO: do a real async disconnect ...
1088                  *
1089                  * For now do it sync...
1090                  */
1091                 TALLOC_FREE(state->cli->transport);
1092         }
1093         if (tevent_req_nomem(subreq, req)) {
1094                 return;
1095         }
1096         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1097 }
1098
1099 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1100                                   struct ncacn_packet **pkt,
1101                                   DATA_BLOB *reply_pdu)
1102 {
1103         struct rpc_api_pipe_state *state = tevent_req_data(
1104                 req, struct rpc_api_pipe_state);
1105         NTSTATUS status;
1106
1107         if (tevent_req_is_nterror(req, &status)) {
1108                 return status;
1109         }
1110
1111         /* return data to caller and assign it ownership of memory */
1112         if (reply_pdu) {
1113                 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1114                 reply_pdu->length = state->reply_pdu.length;
1115                 state->reply_pdu.length = 0;
1116         } else {
1117                 data_blob_free(&state->reply_pdu);
1118         }
1119
1120         if (pkt) {
1121                 *pkt = talloc_steal(mem_ctx, state->pkt);
1122         }
1123
1124         return NT_STATUS_OK;
1125 }
1126
1127 /*******************************************************************
1128  Creates NTLMSSP auth bind.
1129  ********************************************************************/
1130
1131 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1132                                                  TALLOC_CTX *mem_ctx,
1133                                                  DATA_BLOB *auth_token,
1134                                                  bool *client_hdr_signing)
1135 {
1136         struct gensec_security *gensec_security;
1137         DATA_BLOB null_blob = data_blob_null;
1138         NTSTATUS status;
1139
1140         gensec_security = cli->auth->auth_ctx;
1141
1142         DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
1143         status = gensec_update(gensec_security, mem_ctx, null_blob, auth_token);
1144
1145         if (!NT_STATUS_IS_OK(status) &&
1146             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
1147         {
1148                 return status;
1149         }
1150
1151         if (client_hdr_signing == NULL) {
1152                 return status;
1153         }
1154
1155         if (cli->auth->auth_level < DCERPC_AUTH_LEVEL_PACKET) {
1156                 *client_hdr_signing = false;
1157                 return status;
1158         }
1159
1160         *client_hdr_signing = gensec_have_feature(gensec_security,
1161                                                 GENSEC_FEATURE_SIGN_PKT_HEADER);
1162
1163         return status;
1164 }
1165
1166 /*******************************************************************
1167  Creates the internals of a DCE/RPC bind request or alter context PDU.
1168  ********************************************************************/
1169
1170 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1171                                                 enum dcerpc_pkt_type ptype,
1172                                                 uint32_t rpc_call_id,
1173                                                 const struct ndr_syntax_id *abstract,
1174                                                 const struct ndr_syntax_id *transfer,
1175                                                 const DATA_BLOB *auth_info,
1176                                                 bool client_hdr_signing,
1177                                                 DATA_BLOB *blob)
1178 {
1179         uint16_t auth_len = auth_info->length;
1180         NTSTATUS status;
1181         union dcerpc_payload u;
1182         struct dcerpc_ctx_list ctx_list;
1183         uint8_t pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1184
1185         if (auth_len) {
1186                 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1187         }
1188
1189         if (client_hdr_signing) {
1190                 pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
1191         }
1192
1193         ctx_list.context_id = 0;
1194         ctx_list.num_transfer_syntaxes = 1;
1195         ctx_list.abstract_syntax = *abstract;
1196         ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1197
1198         u.bind.max_xmit_frag    = RPC_MAX_PDU_FRAG_LEN;
1199         u.bind.max_recv_frag    = RPC_MAX_PDU_FRAG_LEN;
1200         u.bind.assoc_group_id   = 0x0;
1201         u.bind.num_contexts     = 1;
1202         u.bind.ctx_list         = &ctx_list;
1203         u.bind.auth_info        = *auth_info;
1204
1205         status = dcerpc_push_ncacn_packet(mem_ctx,
1206                                           ptype, pfc_flags,
1207                                           auth_len,
1208                                           rpc_call_id,
1209                                           &u,
1210                                           blob);
1211         if (!NT_STATUS_IS_OK(status)) {
1212                 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1213                 return status;
1214         }
1215
1216         return NT_STATUS_OK;
1217 }
1218
1219 /*******************************************************************
1220  Creates a DCE/RPC bind request.
1221  ********************************************************************/
1222
1223 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1224                                     struct rpc_pipe_client *cli,
1225                                     struct pipe_auth_data *auth,
1226                                     uint32_t rpc_call_id,
1227                                     const struct ndr_syntax_id *abstract,
1228                                     const struct ndr_syntax_id *transfer,
1229                                     DATA_BLOB *rpc_out)
1230 {
1231         DATA_BLOB auth_token = data_blob_null;
1232         DATA_BLOB auth_info = data_blob_null;
1233         NTSTATUS ret = NT_STATUS_OK;
1234
1235         switch (auth->auth_type) {
1236         case DCERPC_AUTH_TYPE_NONE:
1237                 break;
1238
1239         default:
1240                 ret = create_generic_auth_rpc_bind_req(cli, mem_ctx,
1241                                                        &auth_token,
1242                                                        &auth->client_hdr_signing);
1243
1244                 if (!NT_STATUS_IS_OK(ret) &&
1245                     !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1246                         return ret;
1247                 }
1248                 break;
1249         }
1250
1251         if (auth_token.length != 0) {
1252                 ret = dcerpc_push_dcerpc_auth(cli,
1253                                                 auth->auth_type,
1254                                                 auth->auth_level,
1255                                                 0, /* auth_pad_length */
1256                                                 auth->auth_context_id,
1257                                                 &auth_token,
1258                                                 &auth_info);
1259                 if (!NT_STATUS_IS_OK(ret)) {
1260                         return ret;
1261                 }
1262                 data_blob_free(&auth_token);
1263         }
1264
1265         ret = create_bind_or_alt_ctx_internal(mem_ctx,
1266                                               DCERPC_PKT_BIND,
1267                                               rpc_call_id,
1268                                               abstract,
1269                                               transfer,
1270                                               &auth_info,
1271                                               auth->client_hdr_signing,
1272                                               rpc_out);
1273         return ret;
1274 }
1275
1276 /*******************************************************************
1277  External interface.
1278  Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1279  Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1280  and deals with signing/sealing details.
1281  ********************************************************************/
1282
1283 struct rpc_api_pipe_req_state {
1284         struct tevent_context *ev;
1285         struct rpc_pipe_client *cli;
1286         uint8_t op_num;
1287         uint32_t call_id;
1288         const DATA_BLOB *req_data;
1289         const struct GUID *object_uuid;
1290         uint32_t req_data_sent;
1291         DATA_BLOB req_trailer;
1292         uint32_t req_trailer_sent;
1293         bool verify_bitmask1;
1294         bool verify_pcontext;
1295         DATA_BLOB rpc_out;
1296         DATA_BLOB reply_pdu;
1297 };
1298
1299 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1300 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1301 static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state);
1302 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1303                                   bool *is_last_frag);
1304
1305 static struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1306                                          struct tevent_context *ev,
1307                                          struct rpc_pipe_client *cli,
1308                                          uint8_t op_num,
1309                                          const struct GUID *object_uuid,
1310                                          const DATA_BLOB *req_data)
1311 {
1312         struct tevent_req *req, *subreq;
1313         struct rpc_api_pipe_req_state *state;
1314         NTSTATUS status;
1315         bool is_last_frag;
1316
1317         req = tevent_req_create(mem_ctx, &state,
1318                                 struct rpc_api_pipe_req_state);
1319         if (req == NULL) {
1320                 return NULL;
1321         }
1322         state->ev = ev;
1323         state->cli = cli;
1324         state->op_num = op_num;
1325         state->object_uuid = object_uuid;
1326         state->req_data = req_data;
1327         state->req_data_sent = 0;
1328         state->call_id = get_rpc_call_id();
1329         state->reply_pdu = data_blob_null;
1330         state->rpc_out = data_blob_null;
1331
1332         if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1333                                         + RPC_MAX_SIGN_SIZE) {
1334                 /* Server is screwed up ! */
1335                 status = NT_STATUS_INVALID_PARAMETER;
1336                 goto post_status;
1337         }
1338
1339         status = prepare_verification_trailer(state);
1340         if (!NT_STATUS_IS_OK(status)) {
1341                 goto post_status;
1342         }
1343
1344         status = prepare_next_frag(state, &is_last_frag);
1345         if (!NT_STATUS_IS_OK(status)) {
1346                 goto post_status;
1347         }
1348
1349         if (is_last_frag) {
1350                 subreq = rpc_api_pipe_send(state, ev, state->cli,
1351                                            &state->rpc_out,
1352                                            DCERPC_PKT_RESPONSE,
1353                                            state->call_id);
1354                 if (subreq == NULL) {
1355                         goto fail;
1356                 }
1357                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1358         } else {
1359                 subreq = rpc_write_send(state, ev, cli->transport,
1360                                         state->rpc_out.data,
1361                                         state->rpc_out.length);
1362                 if (subreq == NULL) {
1363                         goto fail;
1364                 }
1365                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1366                                         req);
1367         }
1368         return req;
1369
1370  post_status:
1371         tevent_req_nterror(req, status);
1372         return tevent_req_post(req, ev);
1373  fail:
1374         TALLOC_FREE(req);
1375         return NULL;
1376 }
1377
1378 static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state)
1379 {
1380         struct pipe_auth_data *a = state->cli->auth;
1381         struct dcerpc_sec_verification_trailer *t;
1382         struct dcerpc_sec_vt *c = NULL;
1383         struct ndr_push *ndr = NULL;
1384         enum ndr_err_code ndr_err;
1385         size_t align = 0;
1386         size_t pad = 0;
1387
1388         if (a == NULL) {
1389                 return NT_STATUS_OK;
1390         }
1391
1392         if (a->auth_level < DCERPC_AUTH_LEVEL_PACKET) {
1393                 return NT_STATUS_OK;
1394         }
1395
1396         t = talloc_zero(state, struct dcerpc_sec_verification_trailer);
1397         if (t == NULL) {
1398                 return NT_STATUS_NO_MEMORY;
1399         }
1400
1401         if (!a->verified_bitmask1) {
1402                 t->commands = talloc_realloc(t, t->commands,
1403                                              struct dcerpc_sec_vt,
1404                                              t->count.count + 1);
1405                 if (t->commands == NULL) {
1406                         return NT_STATUS_NO_MEMORY;
1407                 }
1408                 c = &t->commands[t->count.count++];
1409                 ZERO_STRUCTP(c);
1410
1411                 c->command = DCERPC_SEC_VT_COMMAND_BITMASK1;
1412                 if (a->client_hdr_signing) {
1413                         c->u.bitmask1 = DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING;
1414                 }
1415                 state->verify_bitmask1 = true;
1416         }
1417
1418         if (!state->cli->verified_pcontext) {
1419                 t->commands = talloc_realloc(t, t->commands,
1420                                              struct dcerpc_sec_vt,
1421                                              t->count.count + 1);
1422                 if (t->commands == NULL) {
1423                         return NT_STATUS_NO_MEMORY;
1424                 }
1425                 c = &t->commands[t->count.count++];
1426                 ZERO_STRUCTP(c);
1427
1428                 c->command = DCERPC_SEC_VT_COMMAND_PCONTEXT;
1429                 c->u.pcontext.abstract_syntax = state->cli->abstract_syntax;
1430                 c->u.pcontext.transfer_syntax = state->cli->transfer_syntax;
1431
1432                 state->verify_pcontext = true;
1433         }
1434
1435         if (!a->hdr_signing) {
1436                 t->commands = talloc_realloc(t, t->commands,
1437                                              struct dcerpc_sec_vt,
1438                                              t->count.count + 1);
1439                 if (t->commands == NULL) {
1440                         return NT_STATUS_NO_MEMORY;
1441                 }
1442                 c = &t->commands[t->count.count++];
1443                 ZERO_STRUCTP(c);
1444
1445                 c->command = DCERPC_SEC_VT_COMMAND_HEADER2;
1446                 c->u.header2.ptype = DCERPC_PKT_REQUEST;
1447                 c->u.header2.drep[0] = DCERPC_DREP_LE;
1448                 c->u.header2.drep[1] = 0;
1449                 c->u.header2.drep[2] = 0;
1450                 c->u.header2.drep[3] = 0;
1451                 c->u.header2.call_id = state->call_id;
1452                 c->u.header2.context_id = 0;
1453                 c->u.header2.opnum = state->op_num;
1454         }
1455
1456         if (t->count.count == 0) {
1457                 TALLOC_FREE(t);
1458                 return NT_STATUS_OK;
1459         }
1460
1461         c = &t->commands[t->count.count - 1];
1462         c->command |= DCERPC_SEC_VT_COMMAND_END;
1463
1464         if (DEBUGLEVEL >= 10) {
1465                 NDR_PRINT_DEBUG(dcerpc_sec_verification_trailer, t);
1466         }
1467
1468         ndr = ndr_push_init_ctx(state);
1469         if (ndr == NULL) {
1470                 return NT_STATUS_NO_MEMORY;
1471         }
1472
1473         ndr_err = ndr_push_dcerpc_sec_verification_trailer(ndr,
1474                                                 NDR_SCALARS | NDR_BUFFERS,
1475                                                 t);
1476         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1477                 return ndr_map_error2ntstatus(ndr_err);
1478         }
1479         state->req_trailer = ndr_push_blob(ndr);
1480
1481         align = state->req_data->length & 0x3;
1482         if (align > 0) {
1483                 pad = 4 - align;
1484         }
1485         if (pad > 0) {
1486                 bool ok;
1487                 uint8_t *p;
1488                 const uint8_t zeros[4] = { 0, };
1489
1490                 ok = data_blob_append(ndr, &state->req_trailer, zeros, pad);
1491                 if (!ok) {
1492                         return NT_STATUS_NO_MEMORY;
1493                 }
1494
1495                 /* move the padding to the start */
1496                 p = state->req_trailer.data;
1497                 memmove(p + pad, p, state->req_trailer.length - pad);
1498                 memset(p, 0, pad);
1499         }
1500
1501         return NT_STATUS_OK;
1502 }
1503
1504 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1505                                   bool *is_last_frag)
1506 {
1507         size_t auth_len;
1508         size_t frag_len;
1509         uint8_t flags = 0;
1510         size_t pad_len;
1511         size_t data_left;
1512         size_t data_thistime;
1513         size_t trailer_left;
1514         size_t trailer_thistime = 0;
1515         size_t total_left;
1516         size_t total_thistime;
1517         NTSTATUS status;
1518         bool ok;
1519         union dcerpc_payload u;
1520
1521         data_left = state->req_data->length - state->req_data_sent;
1522         trailer_left = state->req_trailer.length - state->req_trailer_sent;
1523         total_left = data_left + trailer_left;
1524         if ((total_left < data_left) || (total_left < trailer_left)) {
1525                 /*
1526                  * overflow
1527                  */
1528                 return NT_STATUS_INVALID_PARAMETER_MIX;
1529         }
1530
1531         status = dcerpc_guess_sizes(state->cli->auth,
1532                                     DCERPC_REQUEST_LENGTH, total_left,
1533                                     state->cli->max_xmit_frag,
1534                                     &total_thistime,
1535                                     &frag_len, &auth_len, &pad_len);
1536         if (!NT_STATUS_IS_OK(status)) {
1537                 return status;
1538         }
1539
1540         if (state->req_data_sent == 0) {
1541                 flags = DCERPC_PFC_FLAG_FIRST;
1542         }
1543
1544         if (total_thistime == total_left) {
1545                 flags |= DCERPC_PFC_FLAG_LAST;
1546         }
1547
1548         data_thistime = MIN(total_thistime, data_left);
1549         if (data_thistime < total_thistime) {
1550                 trailer_thistime = total_thistime - data_thistime;
1551         }
1552
1553         data_blob_free(&state->rpc_out);
1554
1555         ZERO_STRUCT(u.request);
1556
1557         u.request.alloc_hint    = total_left;
1558         u.request.context_id    = 0;
1559         u.request.opnum         = state->op_num;
1560
1561         if (state->object_uuid) {
1562                 flags |= DCERPC_PFC_FLAG_OBJECT_UUID;
1563                 u.request.object.object = *state->object_uuid;
1564                 frag_len += ndr_size_GUID(state->object_uuid, 0);
1565         }
1566
1567         status = dcerpc_push_ncacn_packet(state,
1568                                           DCERPC_PKT_REQUEST,
1569                                           flags,
1570                                           auth_len,
1571                                           state->call_id,
1572                                           &u,
1573                                           &state->rpc_out);
1574         if (!NT_STATUS_IS_OK(status)) {
1575                 return status;
1576         }
1577
1578         /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1579          * compute it right for requests because the auth trailer is missing
1580          * at this stage */
1581         dcerpc_set_frag_length(&state->rpc_out, frag_len);
1582
1583         if (data_thistime > 0) {
1584                 /* Copy in the data. */
1585                 ok = data_blob_append(NULL, &state->rpc_out,
1586                                 state->req_data->data + state->req_data_sent,
1587                                 data_thistime);
1588                 if (!ok) {
1589                         return NT_STATUS_NO_MEMORY;
1590                 }
1591                 state->req_data_sent += data_thistime;
1592         }
1593
1594         if (trailer_thistime > 0) {
1595                 /* Copy in the verification trailer. */
1596                 ok = data_blob_append(NULL, &state->rpc_out,
1597                                 state->req_trailer.data + state->req_trailer_sent,
1598                                 trailer_thistime);
1599                 if (!ok) {
1600                         return NT_STATUS_NO_MEMORY;
1601                 }
1602                 state->req_trailer_sent += trailer_thistime;
1603         }
1604
1605         switch (state->cli->auth->auth_level) {
1606         case DCERPC_AUTH_LEVEL_NONE:
1607         case DCERPC_AUTH_LEVEL_CONNECT:
1608                 break;
1609         case DCERPC_AUTH_LEVEL_PACKET:
1610         case DCERPC_AUTH_LEVEL_INTEGRITY:
1611         case DCERPC_AUTH_LEVEL_PRIVACY:
1612                 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1613                                                 &state->rpc_out);
1614                 if (!NT_STATUS_IS_OK(status)) {
1615                         return status;
1616                 }
1617                 break;
1618         default:
1619                 return NT_STATUS_INVALID_PARAMETER;
1620         }
1621
1622         *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1623
1624         return status;
1625 }
1626
1627 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1628 {
1629         struct tevent_req *req = tevent_req_callback_data(
1630                 subreq, struct tevent_req);
1631         struct rpc_api_pipe_req_state *state = tevent_req_data(
1632                 req, struct rpc_api_pipe_req_state);
1633         NTSTATUS status;
1634         bool is_last_frag;
1635
1636         status = rpc_write_recv(subreq);
1637         TALLOC_FREE(subreq);
1638         if (!NT_STATUS_IS_OK(status)) {
1639                 tevent_req_nterror(req, status);
1640                 return;
1641         }
1642
1643         status = prepare_next_frag(state, &is_last_frag);
1644         if (!NT_STATUS_IS_OK(status)) {
1645                 tevent_req_nterror(req, status);
1646                 return;
1647         }
1648
1649         if (is_last_frag) {
1650                 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1651                                            &state->rpc_out,
1652                                            DCERPC_PKT_RESPONSE,
1653                                            state->call_id);
1654                 if (tevent_req_nomem(subreq, req)) {
1655                         return;
1656                 }
1657                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1658         } else {
1659                 subreq = rpc_write_send(state, state->ev,
1660                                         state->cli->transport,
1661                                         state->rpc_out.data,
1662                                         state->rpc_out.length);
1663                 if (tevent_req_nomem(subreq, req)) {
1664                         return;
1665                 }
1666                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1667                                         req);
1668         }
1669 }
1670
1671 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1672 {
1673         struct tevent_req *req = tevent_req_callback_data(
1674                 subreq, struct tevent_req);
1675         struct rpc_api_pipe_req_state *state = tevent_req_data(
1676                 req, struct rpc_api_pipe_req_state);
1677         NTSTATUS status;
1678
1679         status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1680         TALLOC_FREE(subreq);
1681         if (!NT_STATUS_IS_OK(status)) {
1682                 tevent_req_nterror(req, status);
1683                 return;
1684         }
1685
1686         if (state->cli->auth == NULL) {
1687                 tevent_req_done(req);
1688                 return;
1689         }
1690
1691         if (state->verify_bitmask1) {
1692                 state->cli->auth->verified_bitmask1 = true;
1693         }
1694
1695         if (state->verify_pcontext) {
1696                 state->cli->verified_pcontext = true;
1697         }
1698
1699         tevent_req_done(req);
1700 }
1701
1702 static NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1703                                DATA_BLOB *reply_pdu)
1704 {
1705         struct rpc_api_pipe_req_state *state = tevent_req_data(
1706                 req, struct rpc_api_pipe_req_state);
1707         NTSTATUS status;
1708
1709         if (tevent_req_is_nterror(req, &status)) {
1710                 /*
1711                  * We always have to initialize to reply pdu, even if there is
1712                  * none. The rpccli_* caller routines expect this.
1713                  */
1714                 *reply_pdu = data_blob_null;
1715                 return status;
1716         }
1717
1718         /* return data to caller and assign it ownership of memory */
1719         reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1720         reply_pdu->length = state->reply_pdu.length;
1721         state->reply_pdu.length = 0;
1722
1723         return NT_STATUS_OK;
1724 }
1725
1726 /****************************************************************************
1727  Check the rpc bind acknowledge response.
1728 ****************************************************************************/
1729
1730 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1731                                 const struct ndr_syntax_id *transfer)
1732 {
1733         struct dcerpc_ack_ctx ctx;
1734
1735         if (r->secondary_address_size == 0) {
1736                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1737         }
1738
1739         if (r->num_results < 1 || !r->ctx_list) {
1740                 return false;
1741         }
1742
1743         ctx = r->ctx_list[0];
1744
1745         /* check the transfer syntax */
1746         if ((ctx.syntax.if_version != transfer->if_version) ||
1747              (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1748                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1749                 return False;
1750         }
1751
1752         if (r->num_results != 0x1 || ctx.result != 0) {
1753                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1754                           r->num_results, ctx.reason.value));
1755         }
1756
1757         DEBUG(5,("check_bind_response: accepted!\n"));
1758         return True;
1759 }
1760
1761 /*******************************************************************
1762  Creates a DCE/RPC bind authentication response.
1763  This is the packet that is sent back to the server once we
1764  have received a BIND-ACK, to finish the third leg of
1765  the authentication handshake.
1766  ********************************************************************/
1767
1768 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1769                                 struct rpc_pipe_client *cli,
1770                                 struct pipe_auth_data *auth,
1771                                 uint32_t rpc_call_id,
1772                                 DATA_BLOB *pauth_blob,
1773                                 DATA_BLOB *rpc_out)
1774 {
1775         NTSTATUS status;
1776         union dcerpc_payload u;
1777
1778         u.auth3._pad = 0;
1779
1780         status = dcerpc_push_dcerpc_auth(mem_ctx,
1781                                          auth->auth_type,
1782                                          auth->auth_level,
1783                                          0, /* auth_pad_length */
1784                                          auth->auth_context_id,
1785                                          pauth_blob,
1786                                          &u.auth3.auth_info);
1787         if (!NT_STATUS_IS_OK(status)) {
1788                 return status;
1789         }
1790
1791         status = dcerpc_push_ncacn_packet(mem_ctx,
1792                                           DCERPC_PKT_AUTH3,
1793                                           DCERPC_PFC_FLAG_FIRST |
1794                                           DCERPC_PFC_FLAG_LAST,
1795                                           pauth_blob->length,
1796                                           rpc_call_id,
1797                                           &u,
1798                                           rpc_out);
1799         data_blob_free(&u.auth3.auth_info);
1800         if (!NT_STATUS_IS_OK(status)) {
1801                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1802                 return status;
1803         }
1804
1805         return NT_STATUS_OK;
1806 }
1807
1808 /*******************************************************************
1809  Creates a DCE/RPC bind alter context authentication request which
1810  may contain a spnego auth blobl
1811  ********************************************************************/
1812
1813 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1814                                         struct pipe_auth_data *auth,
1815                                         uint32_t rpc_call_id,
1816                                         const struct ndr_syntax_id *abstract,
1817                                         const struct ndr_syntax_id *transfer,
1818                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1819                                         DATA_BLOB *rpc_out)
1820 {
1821         DATA_BLOB auth_info;
1822         NTSTATUS status;
1823
1824         status = dcerpc_push_dcerpc_auth(mem_ctx,
1825                                          auth->auth_type,
1826                                          auth->auth_level,
1827                                          0, /* auth_pad_length */
1828                                          auth->auth_context_id,
1829                                          pauth_blob,
1830                                          &auth_info);
1831         if (!NT_STATUS_IS_OK(status)) {
1832                 return status;
1833         }
1834
1835         status = create_bind_or_alt_ctx_internal(mem_ctx,
1836                                                  DCERPC_PKT_ALTER,
1837                                                  rpc_call_id,
1838                                                  abstract,
1839                                                  transfer,
1840                                                  &auth_info,
1841                                                  false, /* client_hdr_signing */
1842                                                  rpc_out);
1843         data_blob_free(&auth_info);
1844         return status;
1845 }
1846
1847 /****************************************************************************
1848  Do an rpc bind.
1849 ****************************************************************************/
1850
1851 struct rpc_pipe_bind_state {
1852         struct tevent_context *ev;
1853         struct rpc_pipe_client *cli;
1854         DATA_BLOB rpc_out;
1855         bool auth3;
1856         uint32_t rpc_call_id;
1857 };
1858
1859 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1860 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1861                                    struct rpc_pipe_bind_state *state,
1862                                    DATA_BLOB *credentials);
1863 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1864                                      struct rpc_pipe_bind_state *state,
1865                                      DATA_BLOB *credentials);
1866
1867 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1868                                       struct tevent_context *ev,
1869                                       struct rpc_pipe_client *cli,
1870                                       struct pipe_auth_data *auth)
1871 {
1872         struct tevent_req *req, *subreq;
1873         struct rpc_pipe_bind_state *state;
1874         NTSTATUS status;
1875
1876         req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1877         if (req == NULL) {
1878                 return NULL;
1879         }
1880
1881         DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1882                 rpccli_pipe_txt(talloc_tos(), cli),
1883                 (unsigned int)auth->auth_type,
1884                 (unsigned int)auth->auth_level ));
1885
1886         state->ev = ev;
1887         state->cli = cli;
1888         state->rpc_call_id = get_rpc_call_id();
1889
1890         cli->auth = talloc_move(cli, &auth);
1891
1892         /* Marshall the outgoing data. */
1893         status = create_rpc_bind_req(state, cli,
1894                                      cli->auth,
1895                                      state->rpc_call_id,
1896                                      &cli->abstract_syntax,
1897                                      &cli->transfer_syntax,
1898                                      &state->rpc_out);
1899
1900         if (!NT_STATUS_IS_OK(status) &&
1901             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1902                 goto post_status;
1903         }
1904
1905         subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1906                                    DCERPC_PKT_BIND_ACK, state->rpc_call_id);
1907         if (subreq == NULL) {
1908                 goto fail;
1909         }
1910         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1911         return req;
1912
1913  post_status:
1914         tevent_req_nterror(req, status);
1915         return tevent_req_post(req, ev);
1916  fail:
1917         TALLOC_FREE(req);
1918         return NULL;
1919 }
1920
1921 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1922 {
1923         struct tevent_req *req = tevent_req_callback_data(
1924                 subreq, struct tevent_req);
1925         struct rpc_pipe_bind_state *state = tevent_req_data(
1926                 req, struct rpc_pipe_bind_state);
1927         struct pipe_auth_data *pauth = state->cli->auth;
1928         struct gensec_security *gensec_security;
1929         struct ncacn_packet *pkt = NULL;
1930         struct dcerpc_auth auth;
1931         DATA_BLOB auth_token = data_blob_null;
1932         NTSTATUS status;
1933
1934         status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1935         TALLOC_FREE(subreq);
1936         if (!NT_STATUS_IS_OK(status)) {
1937                 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1938                           rpccli_pipe_txt(talloc_tos(), state->cli),
1939                           nt_errstr(status)));
1940                 tevent_req_nterror(req, status);
1941                 return;
1942         }
1943
1944         if (state->auth3) {
1945                 tevent_req_done(req);
1946                 return;
1947         }
1948
1949         if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1950                 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1951                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1952                 return;
1953         }
1954
1955         if (pkt->ptype == DCERPC_PKT_BIND_ACK) {
1956                 if (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN) {
1957                         if (pauth->client_hdr_signing) {
1958                                 pauth->hdr_signing = true;
1959                         }
1960                 }
1961         }
1962
1963         state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1964
1965         switch(pauth->auth_type) {
1966
1967         case DCERPC_AUTH_TYPE_NONE:
1968                 /* Bind complete. */
1969                 tevent_req_done(req);
1970                 return;
1971
1972         default:
1973                 if (pkt->auth_length == 0) {
1974                         tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1975                         return;
1976                 }
1977
1978                 /* get auth credentials */
1979                 status = dcerpc_pull_auth_trailer(pkt, talloc_tos(),
1980                                                   &pkt->u.bind_ack.auth_info,
1981                                                   &auth, NULL, true);
1982                 if (!NT_STATUS_IS_OK(status)) {
1983                         DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1984                                   nt_errstr(status)));
1985                         tevent_req_nterror(req, status);
1986                         return;
1987                 }
1988
1989                 if (auth.auth_type != pauth->auth_type) {
1990                         DEBUG(0, (__location__ " Auth type %u mismatch expected %u.\n",
1991                                   auth.auth_type, pauth->auth_type));
1992                         tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1993                         return;
1994                 }
1995
1996                 if (auth.auth_level != pauth->auth_level) {
1997                         DEBUG(0, (__location__ " Auth level %u mismatch expected %u.\n",
1998                                   auth.auth_level, pauth->auth_level));
1999                         tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
2000                         return;
2001                 }
2002
2003                 if (auth.auth_context_id != pauth->auth_context_id) {
2004                         DEBUG(0, (__location__ " Auth context id %u mismatch expected %u.\n",
2005                                   (unsigned)auth.auth_context_id,
2006                                   (unsigned)pauth->auth_context_id));
2007                         tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
2008                         return;
2009                 }
2010
2011                 break;
2012         }
2013
2014         /*
2015          * For authenticated binds we may need to do 3 or 4 leg binds.
2016          */
2017
2018         switch(pauth->auth_type) {
2019
2020         case DCERPC_AUTH_TYPE_NONE:
2021                 /* Bind complete. */
2022                 tevent_req_done(req);
2023                 return;
2024
2025         default:
2026                 gensec_security = pauth->auth_ctx;
2027
2028
2029                 status = gensec_update(gensec_security, state,
2030                                        auth.credentials, &auth_token);
2031                 if (NT_STATUS_EQUAL(status,
2032                                     NT_STATUS_MORE_PROCESSING_REQUIRED)) {
2033                         status = rpc_bind_next_send(req, state,
2034                                                         &auth_token);
2035                 } else if (NT_STATUS_IS_OK(status)) {
2036                         if (pauth->hdr_signing) {
2037                                 gensec_want_feature(gensec_security,
2038                                                     GENSEC_FEATURE_SIGN_PKT_HEADER);
2039                         }
2040
2041                         if (auth_token.length == 0) {
2042                                 /* Bind complete. */
2043                                 tevent_req_done(req);
2044                                 return;
2045                         }
2046                         status = rpc_bind_finish_send(req, state,
2047                                                         &auth_token);
2048                 }
2049                 break;
2050         }
2051
2052         if (!NT_STATUS_IS_OK(status)) {
2053                 tevent_req_nterror(req, status);
2054         }
2055         return;
2056 }
2057
2058 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
2059                                    struct rpc_pipe_bind_state *state,
2060                                    DATA_BLOB *auth_token)
2061 {
2062         struct pipe_auth_data *auth = state->cli->auth;
2063         struct tevent_req *subreq;
2064         NTSTATUS status;
2065
2066         /* Now prepare the alter context pdu. */
2067         data_blob_free(&state->rpc_out);
2068
2069         status = create_rpc_alter_context(state, auth,
2070                                           state->rpc_call_id,
2071                                           &state->cli->abstract_syntax,
2072                                           &state->cli->transfer_syntax,
2073                                           auth_token,
2074                                           &state->rpc_out);
2075         if (!NT_STATUS_IS_OK(status)) {
2076                 return status;
2077         }
2078
2079         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2080                                    &state->rpc_out, DCERPC_PKT_ALTER_RESP,
2081                                    state->rpc_call_id);
2082         if (subreq == NULL) {
2083                 return NT_STATUS_NO_MEMORY;
2084         }
2085         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2086         return NT_STATUS_OK;
2087 }
2088
2089 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
2090                                      struct rpc_pipe_bind_state *state,
2091                                      DATA_BLOB *auth_token)
2092 {
2093         struct pipe_auth_data *auth = state->cli->auth;
2094         struct tevent_req *subreq;
2095         NTSTATUS status;
2096
2097         state->auth3 = true;
2098
2099         /* Now prepare the auth3 context pdu. */
2100         data_blob_free(&state->rpc_out);
2101
2102         status = create_rpc_bind_auth3(state, state->cli, auth,
2103                                         state->rpc_call_id,
2104                                         auth_token,
2105                                         &state->rpc_out);
2106         if (!NT_STATUS_IS_OK(status)) {
2107                 return status;
2108         }
2109
2110         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2111                                    &state->rpc_out, DCERPC_PKT_AUTH3,
2112                                    state->rpc_call_id);
2113         if (subreq == NULL) {
2114                 return NT_STATUS_NO_MEMORY;
2115         }
2116         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2117         return NT_STATUS_OK;
2118 }
2119
2120 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
2121 {
2122         return tevent_req_simple_recv_ntstatus(req);
2123 }
2124
2125 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
2126                        struct pipe_auth_data *auth)
2127 {
2128         TALLOC_CTX *frame = talloc_stackframe();
2129         struct tevent_context *ev;
2130         struct tevent_req *req;
2131         NTSTATUS status = NT_STATUS_OK;
2132
2133         ev = samba_tevent_context_init(frame);
2134         if (ev == NULL) {
2135                 status = NT_STATUS_NO_MEMORY;
2136                 goto fail;
2137         }
2138
2139         req = rpc_pipe_bind_send(frame, ev, cli, auth);
2140         if (req == NULL) {
2141                 status = NT_STATUS_NO_MEMORY;
2142                 goto fail;
2143         }
2144
2145         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2146                 goto fail;
2147         }
2148
2149         status = rpc_pipe_bind_recv(req);
2150  fail:
2151         TALLOC_FREE(frame);
2152         return status;
2153 }
2154
2155 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
2156
2157 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
2158                                 unsigned int timeout)
2159 {
2160         unsigned int old;
2161
2162         if (rpc_cli->transport == NULL) {
2163                 return RPCCLI_DEFAULT_TIMEOUT;
2164         }
2165
2166         if (rpc_cli->transport->set_timeout == NULL) {
2167                 return RPCCLI_DEFAULT_TIMEOUT;
2168         }
2169
2170         old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
2171         if (old == 0) {
2172                 return RPCCLI_DEFAULT_TIMEOUT;
2173         }
2174
2175         return old;
2176 }
2177
2178 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
2179 {
2180         if (rpc_cli == NULL) {
2181                 return false;
2182         }
2183
2184         if (rpc_cli->transport == NULL) {
2185                 return false;
2186         }
2187
2188         return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
2189 }
2190
2191 struct rpccli_bh_state {
2192         struct rpc_pipe_client *rpc_cli;
2193 };
2194
2195 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
2196 {
2197         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2198                                      struct rpccli_bh_state);
2199
2200         return rpccli_is_connected(hs->rpc_cli);
2201 }
2202
2203 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
2204                                       uint32_t timeout)
2205 {
2206         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2207                                      struct rpccli_bh_state);
2208
2209         return rpccli_set_timeout(hs->rpc_cli, timeout);
2210 }
2211
2212 static void rpccli_bh_auth_info(struct dcerpc_binding_handle *h,
2213                                 enum dcerpc_AuthType *auth_type,
2214                                 enum dcerpc_AuthLevel *auth_level)
2215 {
2216         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2217                                      struct rpccli_bh_state);
2218
2219         if (hs->rpc_cli == NULL) {
2220                 return;
2221         }
2222
2223         if (hs->rpc_cli->auth == NULL) {
2224                 return;
2225         }
2226
2227         *auth_type = hs->rpc_cli->auth->auth_type;
2228         *auth_level = hs->rpc_cli->auth->auth_level;
2229 }
2230
2231 struct rpccli_bh_raw_call_state {
2232         DATA_BLOB in_data;
2233         DATA_BLOB out_data;
2234         uint32_t out_flags;
2235 };
2236
2237 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
2238
2239 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
2240                                                   struct tevent_context *ev,
2241                                                   struct dcerpc_binding_handle *h,
2242                                                   const struct GUID *object,
2243                                                   uint32_t opnum,
2244                                                   uint32_t in_flags,
2245                                                   const uint8_t *in_data,
2246                                                   size_t in_length)
2247 {
2248         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2249                                      struct rpccli_bh_state);
2250         struct tevent_req *req;
2251         struct rpccli_bh_raw_call_state *state;
2252         bool ok;
2253         struct tevent_req *subreq;
2254
2255         req = tevent_req_create(mem_ctx, &state,
2256                                 struct rpccli_bh_raw_call_state);
2257         if (req == NULL) {
2258                 return NULL;
2259         }
2260         state->in_data.data = discard_const_p(uint8_t, in_data);
2261         state->in_data.length = in_length;
2262
2263         ok = rpccli_bh_is_connected(h);
2264         if (!ok) {
2265                 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2266                 return tevent_req_post(req, ev);
2267         }
2268
2269         subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
2270                                        opnum, object, &state->in_data);
2271         if (tevent_req_nomem(subreq, req)) {
2272                 return tevent_req_post(req, ev);
2273         }
2274         tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
2275
2276         return req;
2277 }
2278
2279 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
2280 {
2281         struct tevent_req *req =
2282                 tevent_req_callback_data(subreq,
2283                 struct tevent_req);
2284         struct rpccli_bh_raw_call_state *state =
2285                 tevent_req_data(req,
2286                 struct rpccli_bh_raw_call_state);
2287         NTSTATUS status;
2288
2289         state->out_flags = 0;
2290
2291         /* TODO: support bigendian responses */
2292
2293         status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
2294         TALLOC_FREE(subreq);
2295         if (!NT_STATUS_IS_OK(status)) {
2296                 tevent_req_nterror(req, status);
2297                 return;
2298         }
2299
2300         tevent_req_done(req);
2301 }
2302
2303 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
2304                                         TALLOC_CTX *mem_ctx,
2305                                         uint8_t **out_data,
2306                                         size_t *out_length,
2307                                         uint32_t *out_flags)
2308 {
2309         struct rpccli_bh_raw_call_state *state =
2310                 tevent_req_data(req,
2311                 struct rpccli_bh_raw_call_state);
2312         NTSTATUS status;
2313
2314         if (tevent_req_is_nterror(req, &status)) {
2315                 tevent_req_received(req);
2316                 return status;
2317         }
2318
2319         *out_data = talloc_move(mem_ctx, &state->out_data.data);
2320         *out_length = state->out_data.length;
2321         *out_flags = state->out_flags;
2322         tevent_req_received(req);
2323         return NT_STATUS_OK;
2324 }
2325
2326 struct rpccli_bh_disconnect_state {
2327         uint8_t _dummy;
2328 };
2329
2330 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
2331                                                 struct tevent_context *ev,
2332                                                 struct dcerpc_binding_handle *h)
2333 {
2334         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2335                                      struct rpccli_bh_state);
2336         struct tevent_req *req;
2337         struct rpccli_bh_disconnect_state *state;
2338         bool ok;
2339
2340         req = tevent_req_create(mem_ctx, &state,
2341                                 struct rpccli_bh_disconnect_state);
2342         if (req == NULL) {
2343                 return NULL;
2344         }
2345
2346         ok = rpccli_bh_is_connected(h);
2347         if (!ok) {
2348                 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2349                 return tevent_req_post(req, ev);
2350         }
2351
2352         /*
2353          * TODO: do a real async disconnect ...
2354          *
2355          * For now we do it sync...
2356          */
2357         TALLOC_FREE(hs->rpc_cli->transport);
2358         hs->rpc_cli = NULL;
2359
2360         tevent_req_done(req);
2361         return tevent_req_post(req, ev);
2362 }
2363
2364 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2365 {
2366         NTSTATUS status;
2367
2368         if (tevent_req_is_nterror(req, &status)) {
2369                 tevent_req_received(req);
2370                 return status;
2371         }
2372
2373         tevent_req_received(req);
2374         return NT_STATUS_OK;
2375 }
2376
2377 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2378 {
2379         return true;
2380 }
2381
2382 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2383                                    int ndr_flags,
2384                                    const void *_struct_ptr,
2385                                    const struct ndr_interface_call *call)
2386 {
2387         void *struct_ptr = discard_const(_struct_ptr);
2388
2389         if (DEBUGLEVEL < 10) {
2390                 return;
2391         }
2392
2393         if (ndr_flags & NDR_IN) {
2394                 ndr_print_function_debug(call->ndr_print,
2395                                          call->name,
2396                                          ndr_flags,
2397                                          struct_ptr);
2398         }
2399         if (ndr_flags & NDR_OUT) {
2400                 ndr_print_function_debug(call->ndr_print,
2401                                          call->name,
2402                                          ndr_flags,
2403                                          struct_ptr);
2404         }
2405 }
2406
2407 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2408         .name                   = "rpccli",
2409         .is_connected           = rpccli_bh_is_connected,
2410         .set_timeout            = rpccli_bh_set_timeout,
2411         .auth_info              = rpccli_bh_auth_info,
2412         .raw_call_send          = rpccli_bh_raw_call_send,
2413         .raw_call_recv          = rpccli_bh_raw_call_recv,
2414         .disconnect_send        = rpccli_bh_disconnect_send,
2415         .disconnect_recv        = rpccli_bh_disconnect_recv,
2416
2417         .ref_alloc              = rpccli_bh_ref_alloc,
2418         .do_ndr_print           = rpccli_bh_do_ndr_print,
2419 };
2420
2421 /* initialise a rpc_pipe_client binding handle */
2422 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c,
2423                                         const struct GUID *object,
2424                                         const struct ndr_interface_table *table)
2425 {
2426         struct dcerpc_binding_handle *h;
2427         struct rpccli_bh_state *hs;
2428
2429         h = dcerpc_binding_handle_create(c,
2430                                          &rpccli_bh_ops,
2431                                          object,
2432                                          table,
2433                                          &hs,
2434                                          struct rpccli_bh_state,
2435                                          __location__);
2436         if (h == NULL) {
2437                 return NULL;
2438         }
2439         hs->rpc_cli = c;
2440
2441         return h;
2442 }
2443
2444 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2445                                struct pipe_auth_data **presult)
2446 {
2447         struct pipe_auth_data *result;
2448         struct auth_generic_state *auth_generic_ctx;
2449         NTSTATUS status;
2450
2451         result = talloc_zero(mem_ctx, struct pipe_auth_data);
2452         if (result == NULL) {
2453                 return NT_STATUS_NO_MEMORY;
2454         }
2455
2456         result->auth_type = DCERPC_AUTH_TYPE_NONE;
2457         result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2458         result->auth_context_id = 0;
2459
2460         status = auth_generic_client_prepare(result,
2461                                              &auth_generic_ctx);
2462         if (!NT_STATUS_IS_OK(status)) {
2463                 DEBUG(1, ("Failed to create auth_generic context: %s\n",
2464                           nt_errstr(status)));
2465         }
2466
2467         status = auth_generic_set_username(auth_generic_ctx, "");
2468         if (!NT_STATUS_IS_OK(status)) {
2469                 DEBUG(1, ("Failed to set username: %s\n",
2470                           nt_errstr(status)));
2471         }
2472
2473         status = auth_generic_set_domain(auth_generic_ctx, "");
2474         if (!NT_STATUS_IS_OK(status)) {
2475                 DEBUG(1, ("Failed to set domain: %s\n",
2476                           nt_errstr(status)));
2477                 return status;
2478         }
2479
2480         status = gensec_set_credentials(auth_generic_ctx->gensec_security,
2481                                         auth_generic_ctx->credentials);
2482         if (!NT_STATUS_IS_OK(status)) {
2483                 DEBUG(1, ("Failed to set GENSEC credentials: %s\n",
2484                           nt_errstr(status)));
2485                 return status;
2486         }
2487         talloc_unlink(auth_generic_ctx, auth_generic_ctx->credentials);
2488         auth_generic_ctx->credentials = NULL;
2489
2490         result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2491         talloc_free(auth_generic_ctx);
2492         *presult = result;
2493         return NT_STATUS_OK;
2494 }
2495
2496 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2497                                          enum dcerpc_AuthType auth_type,
2498                                          enum dcerpc_AuthLevel auth_level,
2499                                          const char *server,
2500                                          const char *target_service,
2501                                          const char *domain,
2502                                          const char *username,
2503                                          const char *password,
2504                                          enum credentials_use_kerberos use_kerberos,
2505                                          struct netlogon_creds_CredentialState *creds,
2506                                          struct pipe_auth_data **presult)
2507 {
2508         struct auth_generic_state *auth_generic_ctx;
2509         struct pipe_auth_data *result;
2510         NTSTATUS status;
2511
2512         result = talloc_zero(mem_ctx, struct pipe_auth_data);
2513         if (result == NULL) {
2514                 return NT_STATUS_NO_MEMORY;
2515         }
2516
2517         result->auth_type = auth_type;
2518         result->auth_level = auth_level;
2519         result->auth_context_id = 1;
2520
2521         status = auth_generic_client_prepare(result,
2522                                              &auth_generic_ctx);
2523         if (!NT_STATUS_IS_OK(status)) {
2524                 goto fail;
2525         }
2526
2527         status = auth_generic_set_username(auth_generic_ctx, username);
2528         if (!NT_STATUS_IS_OK(status)) {
2529                 goto fail;
2530         }
2531
2532         status = auth_generic_set_domain(auth_generic_ctx, domain);
2533         if (!NT_STATUS_IS_OK(status)) {
2534                 goto fail;
2535         }
2536
2537         status = auth_generic_set_password(auth_generic_ctx, password);
2538         if (!NT_STATUS_IS_OK(status)) {
2539                 goto fail;
2540         }
2541
2542         status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2543         if (!NT_STATUS_IS_OK(status)) {
2544                 goto fail;
2545         }
2546
2547         status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2548         if (!NT_STATUS_IS_OK(status)) {
2549                 goto fail;
2550         }
2551
2552         cli_credentials_set_kerberos_state(auth_generic_ctx->credentials, use_kerberos);
2553         cli_credentials_set_netlogon_creds(auth_generic_ctx->credentials, creds);
2554
2555         status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2556         if (!NT_STATUS_IS_OK(status)) {
2557                 goto fail;
2558         }
2559
2560         result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2561         talloc_free(auth_generic_ctx);
2562         *presult = result;
2563         return NT_STATUS_OK;
2564
2565  fail:
2566         TALLOC_FREE(result);
2567         return status;
2568 }
2569
2570 /* This routine steals the creds pointer that is passed in */
2571 static NTSTATUS rpccli_generic_bind_data_from_creds(TALLOC_CTX *mem_ctx,
2572                                                     enum dcerpc_AuthType auth_type,
2573                                                     enum dcerpc_AuthLevel auth_level,
2574                                                     const char *server,
2575                                                     const char *target_service,
2576                                                     struct cli_credentials *creds,
2577                                                     struct pipe_auth_data **presult)
2578 {
2579         struct auth_generic_state *auth_generic_ctx;
2580         struct pipe_auth_data *result;
2581         NTSTATUS status;
2582
2583         result = talloc_zero(mem_ctx, struct pipe_auth_data);
2584         if (result == NULL) {
2585                 return NT_STATUS_NO_MEMORY;
2586         }
2587
2588         result->auth_type = auth_type;
2589         result->auth_level = auth_level;
2590         result->auth_context_id = 1;
2591
2592         status = auth_generic_client_prepare(result,
2593                                              &auth_generic_ctx);
2594         if (!NT_STATUS_IS_OK(status)) {
2595                 goto fail;
2596         }
2597
2598         status = auth_generic_set_creds(auth_generic_ctx, creds);
2599         if (!NT_STATUS_IS_OK(status)) {
2600                 goto fail;
2601         }
2602
2603         status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2604         if (!NT_STATUS_IS_OK(status)) {
2605                 goto fail;
2606         }
2607
2608         status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2609         if (!NT_STATUS_IS_OK(status)) {
2610                 goto fail;
2611         }
2612
2613         status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2614         if (!NT_STATUS_IS_OK(status)) {
2615                 goto fail;
2616         }
2617
2618         result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2619         talloc_free(auth_generic_ctx);
2620         *presult = result;
2621         return NT_STATUS_OK;
2622
2623  fail:
2624         TALLOC_FREE(result);
2625         return status;
2626 }
2627
2628 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2629                                   struct pipe_auth_data **presult)
2630 {
2631         return rpccli_generic_bind_data(mem_ctx,
2632                                         DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM,
2633                                         DCERPC_AUTH_LEVEL_CONNECT,
2634                                         NULL, /* server */
2635                                         "host", /* target_service */
2636                                         NAME_NT_AUTHORITY, /* domain */
2637                                         "SYSTEM",
2638                                         NULL, /* password */
2639                                         CRED_DONT_USE_KERBEROS,
2640                                         NULL, /* netlogon_creds_CredentialState */
2641                                         presult);
2642 }
2643
2644 /**
2645  * Create an rpc pipe client struct, connecting to a tcp port.
2646  */
2647 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2648                                        const struct sockaddr_storage *ss_addr,
2649                                        uint16_t port,
2650                                        const struct ndr_interface_table *table,
2651                                        struct rpc_pipe_client **presult)
2652 {
2653         struct rpc_pipe_client *result;
2654         struct sockaddr_storage addr;
2655         NTSTATUS status;
2656         int fd;
2657
2658         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2659         if (result == NULL) {
2660                 return NT_STATUS_NO_MEMORY;
2661         }
2662
2663         result->abstract_syntax = table->syntax_id;
2664         result->transfer_syntax = ndr_transfer_syntax_ndr;
2665
2666         result->desthost = talloc_strdup(result, host);
2667         result->srv_name_slash = talloc_asprintf_strupper_m(
2668                 result, "\\\\%s", result->desthost);
2669         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2670                 status = NT_STATUS_NO_MEMORY;
2671                 goto fail;
2672         }
2673
2674         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2675
2676         if (ss_addr == NULL) {
2677                 if (!resolve_name(host, &addr, NBT_NAME_SERVER, false)) {
2678                         status = NT_STATUS_NOT_FOUND;
2679                         goto fail;
2680                 }
2681         } else {
2682                 addr = *ss_addr;
2683         }
2684
2685         status = open_socket_out(&addr, port, 60*1000, &fd);
2686         if (!NT_STATUS_IS_OK(status)) {
2687                 goto fail;
2688         }
2689         set_socket_options(fd, lp_socket_options());
2690
2691         status = rpc_transport_sock_init(result, fd, &result->transport);
2692         if (!NT_STATUS_IS_OK(status)) {
2693                 close(fd);
2694                 goto fail;
2695         }
2696
2697         result->transport->transport = NCACN_IP_TCP;
2698
2699         result->binding_handle = rpccli_bh_create(result, NULL, table);
2700         if (result->binding_handle == NULL) {
2701                 TALLOC_FREE(result);
2702                 return NT_STATUS_NO_MEMORY;
2703         }
2704
2705         *presult = result;
2706         return NT_STATUS_OK;
2707
2708  fail:
2709         TALLOC_FREE(result);
2710         return status;
2711 }
2712
2713 /**
2714  * Determine the tcp port on which a dcerpc interface is listening
2715  * for the ncacn_ip_tcp transport via the endpoint mapper of the
2716  * target host.
2717  */
2718 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2719                                       const struct sockaddr_storage *addr,
2720                                       const struct ndr_interface_table *table,
2721                                       uint16_t *pport)
2722 {
2723         NTSTATUS status;
2724         struct rpc_pipe_client *epm_pipe = NULL;
2725         struct dcerpc_binding_handle *epm_handle = NULL;
2726         struct pipe_auth_data *auth = NULL;
2727         struct dcerpc_binding *map_binding = NULL;
2728         struct dcerpc_binding *res_binding = NULL;
2729         enum dcerpc_transport_t transport;
2730         const char *endpoint = NULL;
2731         struct epm_twr_t *map_tower = NULL;
2732         struct epm_twr_t *res_towers = NULL;
2733         struct policy_handle *entry_handle = NULL;
2734         uint32_t num_towers = 0;
2735         uint32_t max_towers = 1;
2736         struct epm_twr_p_t towers;
2737         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2738         uint32_t result = 0;
2739
2740         if (pport == NULL) {
2741                 status = NT_STATUS_INVALID_PARAMETER;
2742                 goto done;
2743         }
2744
2745         if (ndr_syntax_id_equal(&table->syntax_id,
2746                                 &ndr_table_epmapper.syntax_id)) {
2747                 *pport = 135;
2748                 status = NT_STATUS_OK;
2749                 goto done;
2750         }
2751
2752         /* open the connection to the endpoint mapper */
2753         status = rpc_pipe_open_tcp_port(tmp_ctx, host, addr, 135,
2754                                         &ndr_table_epmapper,
2755                                         &epm_pipe);
2756
2757         if (!NT_STATUS_IS_OK(status)) {
2758                 goto done;
2759         }
2760         epm_handle = epm_pipe->binding_handle;
2761
2762         status = rpccli_anon_bind_data(tmp_ctx, &auth);
2763         if (!NT_STATUS_IS_OK(status)) {
2764                 goto done;
2765         }
2766
2767         status = rpc_pipe_bind(epm_pipe, auth);
2768         if (!NT_STATUS_IS_OK(status)) {
2769                 goto done;
2770         }
2771
2772         /* create tower for asking the epmapper */
2773
2774         status = dcerpc_parse_binding(tmp_ctx, "ncacn_ip_tcp:[135]",
2775                                       &map_binding);
2776         if (!NT_STATUS_IS_OK(status)) {
2777                 goto done;
2778         }
2779
2780         status = dcerpc_binding_set_abstract_syntax(map_binding,
2781                                                     &table->syntax_id);
2782         if (!NT_STATUS_IS_OK(status)) {
2783                 goto done;
2784         }
2785
2786         map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2787         if (map_tower == NULL) {
2788                 status = NT_STATUS_NO_MEMORY;
2789                 goto done;
2790         }
2791
2792         status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2793                                             &(map_tower->tower));
2794         if (!NT_STATUS_IS_OK(status)) {
2795                 goto done;
2796         }
2797
2798         /* allocate further parameters for the epm_Map call */
2799
2800         res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2801         if (res_towers == NULL) {
2802                 status = NT_STATUS_NO_MEMORY;
2803                 goto done;
2804         }
2805         towers.twr = res_towers;
2806
2807         entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2808         if (entry_handle == NULL) {
2809                 status = NT_STATUS_NO_MEMORY;
2810                 goto done;
2811         }
2812
2813         /* ask the endpoint mapper for the port */
2814
2815         status = dcerpc_epm_Map(epm_handle,
2816                                 tmp_ctx,
2817                                 discard_const_p(struct GUID,
2818                                               &(table->syntax_id.uuid)),
2819                                 map_tower,
2820                                 entry_handle,
2821                                 max_towers,
2822                                 &num_towers,
2823                                 &towers,
2824                                 &result);
2825
2826         if (!NT_STATUS_IS_OK(status)) {
2827                 goto done;
2828         }
2829
2830         if (result != EPMAPPER_STATUS_OK) {
2831                 status = NT_STATUS_UNSUCCESSFUL;
2832                 goto done;
2833         }
2834
2835         if (num_towers != 1) {
2836                 status = NT_STATUS_UNSUCCESSFUL;
2837                 goto done;
2838         }
2839
2840         /* extract the port from the answer */
2841
2842         status = dcerpc_binding_from_tower(tmp_ctx,
2843                                            &(towers.twr->tower),
2844                                            &res_binding);
2845         if (!NT_STATUS_IS_OK(status)) {
2846                 goto done;
2847         }
2848
2849         transport = dcerpc_binding_get_transport(res_binding);
2850         endpoint = dcerpc_binding_get_string_option(res_binding, "endpoint");
2851
2852         /* are further checks here necessary? */
2853         if (transport != NCACN_IP_TCP) {
2854                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2855                 goto done;
2856         }
2857
2858         if (endpoint == NULL) {
2859                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2860                 goto done;
2861         }
2862
2863         *pport = (uint16_t)atoi(endpoint);
2864
2865 done:
2866         TALLOC_FREE(tmp_ctx);
2867         return status;
2868 }
2869
2870 /**
2871  * Create a rpc pipe client struct, connecting to a host via tcp.
2872  * The port is determined by asking the endpoint mapper on the given
2873  * host.
2874  */
2875 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2876                            const struct sockaddr_storage *addr,
2877                            const struct ndr_interface_table *table,
2878                            struct rpc_pipe_client **presult)
2879 {
2880         NTSTATUS status;
2881         uint16_t port = 0;
2882
2883         status = rpc_pipe_get_tcp_port(host, addr, table, &port);
2884         if (!NT_STATUS_IS_OK(status)) {
2885                 return status;
2886         }
2887
2888         return rpc_pipe_open_tcp_port(mem_ctx, host, addr, port,
2889                                       table, presult);
2890 }
2891
2892 /********************************************************************
2893  Create a rpc pipe client struct, connecting to a unix domain socket
2894  ********************************************************************/
2895 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2896                                const struct ndr_interface_table *table,
2897                                struct rpc_pipe_client **presult)
2898 {
2899         struct rpc_pipe_client *result;
2900         struct sockaddr_un addr;
2901         NTSTATUS status;
2902         int fd;
2903         socklen_t salen;
2904
2905         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2906         if (result == NULL) {
2907                 return NT_STATUS_NO_MEMORY;
2908         }
2909
2910         result->abstract_syntax = table->syntax_id;
2911         result->transfer_syntax = ndr_transfer_syntax_ndr;
2912
2913         result->desthost = get_myname(result);
2914         result->srv_name_slash = talloc_asprintf_strupper_m(
2915                 result, "\\\\%s", result->desthost);
2916         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2917                 status = NT_STATUS_NO_MEMORY;
2918                 goto fail;
2919         }
2920
2921         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2922
2923         fd = socket(AF_UNIX, SOCK_STREAM, 0);
2924         if (fd == -1) {
2925                 status = map_nt_error_from_unix(errno);
2926                 goto fail;
2927         }
2928
2929         ZERO_STRUCT(addr);
2930         addr.sun_family = AF_UNIX;
2931         strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2932         salen = sizeof(struct sockaddr_un);
2933
2934         if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
2935                 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2936                           strerror(errno)));
2937                 close(fd);
2938                 return map_nt_error_from_unix(errno);
2939         }
2940
2941         status = rpc_transport_sock_init(result, fd, &result->transport);
2942         if (!NT_STATUS_IS_OK(status)) {
2943                 close(fd);
2944                 goto fail;
2945         }
2946
2947         result->transport->transport = NCALRPC;
2948
2949         result->binding_handle = rpccli_bh_create(result, NULL, table);
2950         if (result->binding_handle == NULL) {
2951                 TALLOC_FREE(result);
2952                 return NT_STATUS_NO_MEMORY;
2953         }
2954
2955         *presult = result;
2956         return NT_STATUS_OK;
2957
2958  fail:
2959         TALLOC_FREE(result);
2960         return status;
2961 }
2962
2963 struct rpc_pipe_client_np_ref {
2964         struct cli_state *cli;
2965         struct rpc_pipe_client *pipe;
2966 };
2967
2968 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2969 {
2970         DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2971         return 0;
2972 }
2973
2974 /****************************************************************************
2975  Open a named pipe over SMB to a remote server.
2976  *
2977  * CAVEAT CALLER OF THIS FUNCTION:
2978  *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2979  *    so be sure that this function is called AFTER any structure (vs pointer)
2980  *    assignment of the cli.  In particular, libsmbclient does structure
2981  *    assignments of cli, which invalidates the data in the returned
2982  *    rpc_pipe_client if this function is called before the structure assignment
2983  *    of cli.
2984  *
2985  ****************************************************************************/
2986
2987 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2988                                  const struct ndr_interface_table *table,
2989                                  struct rpc_pipe_client **presult)
2990 {
2991         struct rpc_pipe_client *result;
2992         NTSTATUS status;
2993         struct rpc_pipe_client_np_ref *np_ref;
2994
2995         /* sanity check to protect against crashes */
2996
2997         if ( !cli ) {
2998                 return NT_STATUS_INVALID_HANDLE;
2999         }
3000
3001         result = talloc_zero(NULL, struct rpc_pipe_client);
3002         if (result == NULL) {
3003                 return NT_STATUS_NO_MEMORY;
3004         }
3005
3006         result->abstract_syntax = table->syntax_id;
3007         result->transfer_syntax = ndr_transfer_syntax_ndr;
3008         result->desthost = talloc_strdup(result, smbXcli_conn_remote_name(cli->conn));
3009         result->srv_name_slash = talloc_asprintf_strupper_m(
3010                 result, "\\\\%s", result->desthost);
3011
3012         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3013
3014         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3015                 TALLOC_FREE(result);
3016                 return NT_STATUS_NO_MEMORY;
3017         }
3018
3019         status = rpc_transport_np_init(result, cli, table,
3020                                        &result->transport);
3021         if (!NT_STATUS_IS_OK(status)) {
3022                 TALLOC_FREE(result);
3023                 return status;
3024         }
3025
3026         result->transport->transport = NCACN_NP;
3027
3028         np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
3029         if (np_ref == NULL) {
3030                 TALLOC_FREE(result);
3031                 return NT_STATUS_NO_MEMORY;
3032         }
3033         np_ref->cli = cli;
3034         np_ref->pipe = result;
3035
3036         DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
3037         talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
3038
3039         result->binding_handle = rpccli_bh_create(result, NULL, table);
3040         if (result->binding_handle == NULL) {
3041                 TALLOC_FREE(result);
3042                 return NT_STATUS_NO_MEMORY;
3043         }
3044
3045         *presult = result;
3046         return NT_STATUS_OK;
3047 }
3048
3049 /****************************************************************************
3050  Open a pipe to a remote server.
3051  ****************************************************************************/
3052
3053 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3054                                   enum dcerpc_transport_t transport,
3055                                   const struct ndr_interface_table *table,
3056                                   struct rpc_pipe_client **presult)
3057 {
3058         switch (transport) {
3059         case NCACN_IP_TCP:
3060                 return rpc_pipe_open_tcp(NULL,
3061                                          smbXcli_conn_remote_name(cli->conn),
3062                                          smbXcli_conn_remote_sockaddr(cli->conn),
3063                                          table, presult);
3064         case NCACN_NP:
3065                 return rpc_pipe_open_np(cli, table, presult);
3066         default:
3067                 return NT_STATUS_NOT_IMPLEMENTED;
3068         }
3069 }
3070
3071 /****************************************************************************
3072  Open a named pipe to an SMB server and bind anonymously.
3073  ****************************************************************************/
3074
3075 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
3076                                             enum dcerpc_transport_t transport,
3077                                             const struct ndr_interface_table *table,
3078                                             struct rpc_pipe_client **presult)
3079 {
3080         struct rpc_pipe_client *result;
3081         struct pipe_auth_data *auth;
3082         NTSTATUS status;
3083
3084         status = cli_rpc_pipe_open(cli, transport, table, &result);
3085         if (!NT_STATUS_IS_OK(status)) {
3086                 return status;
3087         }
3088
3089         status = rpccli_anon_bind_data(result, &auth);
3090         if (!NT_STATUS_IS_OK(status)) {
3091                 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3092                           nt_errstr(status)));
3093                 TALLOC_FREE(result);
3094                 return status;
3095         }
3096
3097         /*
3098          * This is a bit of an abstraction violation due to the fact that an
3099          * anonymous bind on an authenticated SMB inherits the user/domain
3100          * from the enclosing SMB creds
3101          */
3102
3103         if (transport == NCACN_NP) {
3104                 struct smbXcli_session *session;
3105
3106                 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
3107                         session = cli->smb2.session;
3108                 } else {
3109                         session = cli->smb1.session;
3110                 }
3111
3112                 status = smbXcli_session_application_key(session, auth,
3113                                                 &auth->transport_session_key);
3114                 if (!NT_STATUS_IS_OK(status)) {
3115                         auth->transport_session_key = data_blob_null;
3116                 }
3117         }
3118
3119         status = rpc_pipe_bind(result, auth);
3120         if (!NT_STATUS_IS_OK(status)) {
3121                 int lvl = 0;
3122                 if (ndr_syntax_id_equal(&table->syntax_id,
3123                                         &ndr_table_dssetup.syntax_id)) {
3124                         /* non AD domains just don't have this pipe, avoid
3125                          * level 0 statement in that case - gd */
3126                         lvl = 3;
3127                 }
3128                 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3129                             "%s failed with error %s\n",
3130                             table->name,
3131                             nt_errstr(status) ));
3132                 TALLOC_FREE(result);
3133                 return status;
3134         }
3135
3136         DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3137                   "%s and bound anonymously.\n",
3138                   table->name,
3139                   result->desthost));
3140
3141         *presult = result;
3142         return NT_STATUS_OK;
3143 }
3144
3145 /****************************************************************************
3146  ****************************************************************************/
3147
3148 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3149                                   const struct ndr_interface_table *table,
3150                                   struct rpc_pipe_client **presult)
3151 {
3152         return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
3153                                                   table, presult);
3154 }
3155
3156 /****************************************************************************
3157  Open a named pipe to an SMB server and bind using the mech specified
3158
3159  This routine references the creds pointer that is passed in
3160  ****************************************************************************/
3161
3162 NTSTATUS cli_rpc_pipe_open_with_creds(struct cli_state *cli,
3163                                       const struct ndr_interface_table *table,
3164                                       enum dcerpc_transport_t transport,
3165                                       enum dcerpc_AuthType auth_type,
3166                                       enum dcerpc_AuthLevel auth_level,
3167                                       const char *server,
3168                                       struct cli_credentials *creds,
3169                                       struct rpc_pipe_client **presult)
3170 {
3171         struct rpc_pipe_client *result;
3172         struct pipe_auth_data *auth = NULL;
3173         const char *target_service = table->authservices->names[0];
3174
3175         NTSTATUS status;
3176
3177         status = cli_rpc_pipe_open(cli, transport, table, &result);
3178         if (!NT_STATUS_IS_OK(status)) {
3179                 return status;
3180         }
3181
3182         status = rpccli_generic_bind_data_from_creds(result,
3183                                                      auth_type, auth_level,
3184                                                      server, target_service,
3185                                                      creds,
3186                                                      &auth);
3187         if (!NT_STATUS_IS_OK(status)) {
3188                 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
3189                           nt_errstr(status)));
3190                 goto err;
3191         }
3192
3193         status = rpc_pipe_bind(result, auth);
3194         if (!NT_STATUS_IS_OK(status)) {
3195                 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
3196                         nt_errstr(status) ));
3197                 goto err;
3198         }
3199
3200         DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
3201                 "machine %s and bound as user %s.\n", table->name,
3202                   result->desthost, cli_credentials_get_unparsed_name(creds, talloc_tos())));
3203
3204         *presult = result;
3205         return NT_STATUS_OK;
3206
3207   err:
3208
3209         TALLOC_FREE(result);
3210         return status;
3211 }
3212
3213 /****************************************************************************
3214  Open a named pipe to an SMB server and bind using the mech specified
3215
3216  This routine steals the creds pointer that is passed in
3217  ****************************************************************************/
3218
3219 NTSTATUS cli_rpc_pipe_open_generic_auth(struct cli_state *cli,
3220                                         const struct ndr_interface_table *table,
3221                                         enum dcerpc_transport_t transport,
3222                                         enum credentials_use_kerberos use_kerberos,
3223                                         enum dcerpc_AuthType auth_type,
3224                                         enum dcerpc_AuthLevel auth_level,
3225                                         const char *server,
3226                                         const char *domain,
3227                                         const char *username,
3228                                         const char *password,
3229                                         struct rpc_pipe_client **presult)
3230 {
3231         struct rpc_pipe_client *result;
3232         struct pipe_auth_data *auth = NULL;
3233         const char *target_service = table->authservices->names[0];
3234
3235         NTSTATUS status;
3236
3237         status = cli_rpc_pipe_open(cli, transport, table, &result);
3238         if (!NT_STATUS_IS_OK(status)) {
3239                 return status;
3240         }
3241
3242         status = rpccli_generic_bind_data(result,
3243                                           auth_type, auth_level,
3244                                           server, target_service,
3245                                           domain, username, password,
3246                                           CRED_AUTO_USE_KERBEROS,
3247                                           NULL,
3248                                           &auth);
3249         if (!NT_STATUS_IS_OK(status)) {
3250                 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
3251                           nt_errstr(status)));
3252                 goto err;
3253         }
3254
3255         status = rpc_pipe_bind(result, auth);
3256         if (!NT_STATUS_IS_OK(status)) {
3257                 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
3258                         nt_errstr(status) ));
3259                 goto err;
3260         }
3261
3262         DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
3263                 "machine %s and bound as user %s\\%s.\n", table->name,
3264                   result->desthost, domain, username));
3265
3266         *presult = result;
3267         return NT_STATUS_OK;
3268
3269   err:
3270
3271         TALLOC_FREE(result);
3272         return status;
3273 }
3274
3275 NTSTATUS cli_rpc_pipe_open_schannel_with_creds(struct cli_state *cli,
3276                                                const struct ndr_interface_table *table,
3277                                                enum dcerpc_transport_t transport,
3278                                                struct cli_credentials *cli_creds,
3279                                                struct netlogon_creds_cli_context *netlogon_creds,
3280                                                struct rpc_pipe_client **_rpccli)
3281 {
3282         struct rpc_pipe_client *rpccli;
3283         struct pipe_auth_data *rpcauth;
3284         const char *target_service = table->authservices->names[0];
3285         struct netlogon_creds_CredentialState *ncreds = NULL;
3286         enum dcerpc_AuthLevel auth_level;
3287         NTSTATUS status;
3288         int rpc_pipe_bind_dbglvl = 0;
3289
3290         status = cli_rpc_pipe_open(cli, transport, table, &rpccli);
3291         if (!NT_STATUS_IS_OK(status)) {
3292                 return status;
3293         }
3294
3295         status = netlogon_creds_cli_lock(netlogon_creds, rpccli, &ncreds);
3296         if (!NT_STATUS_IS_OK(status)) {
3297                 DEBUG(0, ("netlogon_creds_cli_lock returned %s\n",
3298                           nt_errstr(status)));
3299                 TALLOC_FREE(rpccli);
3300                 return status;
3301         }
3302
3303         auth_level = netlogon_creds_cli_auth_level(netlogon_creds);
3304
3305         cli_credentials_set_netlogon_creds(cli_creds, ncreds);
3306
3307         status = rpccli_generic_bind_data_from_creds(rpccli,
3308                                                      DCERPC_AUTH_TYPE_SCHANNEL,
3309                                                      auth_level,
3310                                                      rpccli->desthost,
3311                                                      target_service,
3312                                                      cli_creds,
3313                                                      &rpcauth);
3314         if (!NT_STATUS_IS_OK(status)) {
3315                 DEBUG(0, ("rpccli_generic_bind_data_from_creds returned %s\n",
3316                           nt_errstr(status)));
3317                 TALLOC_FREE(rpccli);
3318                 return status;
3319         }
3320
3321         status = rpc_pipe_bind(rpccli, rpcauth);
3322         cli_credentials_set_netlogon_creds(cli_creds, NULL);
3323         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3324                 rpc_pipe_bind_dbglvl = 1;
3325                 netlogon_creds_cli_delete(netlogon_creds, &ncreds);
3326         }
3327         if (!NT_STATUS_IS_OK(status)) {
3328                 DEBUG(rpc_pipe_bind_dbglvl,
3329                       ("%s: rpc_pipe_bind failed with error %s\n",
3330                        __func__, nt_errstr(status)));
3331                 TALLOC_FREE(rpccli);
3332                 return status;
3333         }
3334
3335         TALLOC_FREE(ncreds);
3336
3337         if (!ndr_syntax_id_equal(&table->syntax_id, &ndr_table_netlogon.syntax_id)) {
3338                 goto done;
3339         }
3340
3341         status = netlogon_creds_cli_check(netlogon_creds,
3342                                           rpccli->binding_handle);
3343         if (!NT_STATUS_IS_OK(status)) {
3344                 DEBUG(0, ("netlogon_creds_cli_check failed with %s\n",
3345                           nt_errstr(status)));
3346                 TALLOC_FREE(rpccli);
3347                 return status;
3348         }
3349
3350
3351 done:
3352         DEBUG(10,("%s: opened pipe %s to machine %s "
3353                   "for domain %s and bound using schannel.\n",
3354                   __func__, table->name,
3355                   rpccli->desthost, cli_credentials_get_domain(cli_creds)));
3356
3357         *_rpccli = rpccli;
3358         return NT_STATUS_OK;
3359 }
3360
3361 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3362                              struct rpc_pipe_client *cli,
3363                              DATA_BLOB *session_key)
3364 {
3365         NTSTATUS status;
3366         struct pipe_auth_data *a;
3367         struct gensec_security *gensec_security;
3368         DATA_BLOB sk = data_blob_null;
3369         bool make_dup = false;
3370
3371         if (!session_key || !cli) {
3372                 return NT_STATUS_INVALID_PARAMETER;
3373         }
3374
3375         a = cli->auth;
3376
3377         if (a == NULL) {
3378                 return NT_STATUS_INVALID_PARAMETER;
3379         }
3380
3381         switch (cli->auth->auth_type) {
3382         case DCERPC_AUTH_TYPE_NONE:
3383                 sk = data_blob_const(a->transport_session_key.data,
3384                                      a->transport_session_key.length);
3385                 make_dup = true;
3386                 break;
3387         default:
3388                 gensec_security = a->auth_ctx;
3389                 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3390                 if (!NT_STATUS_IS_OK(status)) {
3391                         return status;
3392                 }
3393                 make_dup = false;
3394                 break;
3395         }
3396
3397         if (!sk.data) {
3398                 return NT_STATUS_NO_USER_SESSION_KEY;
3399         }
3400
3401         if (make_dup) {
3402                 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3403         } else {
3404                 *session_key = sk;
3405         }
3406
3407         return NT_STATUS_OK;
3408 }