source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *  Heavily modified by Simo Sorce                  2010.
   6  *  Copyright Andrew Bartlett                       2011.
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23 #include "libsmb/namequery.h"
  24 #include "../lib/util/tevent_ntstatus.h"
  25 #include "librpc/gen_ndr/ndr_epmapper_c.h"
  26 #include "../librpc/gen_ndr/ndr_dssetup.h"
  27 #include "../libcli/auth/schannel.h"
  28 #include "../libcli/auth/netlogon_creds_cli.h"
  29 #include "auth_generic.h"
  30 #include "librpc/gen_ndr/ndr_dcerpc.h"
  31 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  32 #include "librpc/gen_ndr/auth.h"
  33 #include "librpc/rpc/dcerpc.h"
  34 #include "librpc/rpc/dcerpc_util.h"
  35 #include "rpc_dce.h"
  36 #include "cli_pipe.h"
  37 #include "libsmb/libsmb.h"
  38 #include "auth/gensec/gensec.h"
  39 #include "auth/credentials/credentials.h"
  40 #include "auth/auth_util.h"
  41 #include "../libcli/smb/smbXcli_base.h"
  42 #include "lib/tsocket/tsocket.h"
  43 #include "libcli/named_pipe_auth/npa_tstream.h"
  44 #include "librpc/gen_ndr/ndr_winreg.h"
  45 #include "local_np.h"
  46
  47 #undef DBGC_CLASS
  48 #define DBGC_CLASS DBGC_RPC_CLI
  49
  50 /********************************************************************
  51  Pipe description for a DEBUG
  52  ********************************************************************/
  53 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
  54                                    struct rpc_pipe_client *cli)
  55 {
  56         char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
  57         if (result == NULL) {
  58                 return "pipe";
  59         }
  60         return result;
  61 }
  62
  63 /********************************************************************
  64  Rpc pipe call id.
  65  ********************************************************************/
  66
  67 static uint32_t get_rpc_call_id(void)
  68 {
  69         static uint32_t call_id = 0;
  70         return ++call_id;
  71 }
  72
  73 /*******************************************************************
  74  Use SMBreadX to get rest of one fragment's worth of rpc data.
  75  Reads the whole size or give an error message
  76  ********************************************************************/
  77
  78 struct rpc_read_state {
  79         struct tevent_context *ev;
  80         struct rpc_cli_transport *transport;
  81         uint8_t *data;
  82         size_t size;
  83         size_t num_read;
  84 };
  85
  86 static void rpc_read_done(struct tevent_req *subreq);
  87
  88 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
  89                                         struct tevent_context *ev,
  90                                         struct rpc_cli_transport *transport,
  91                                         uint8_t *data, size_t size)
  92 {
  93         struct tevent_req *req, *subreq;
  94         struct rpc_read_state *state;
  95
  96         req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
  97         if (req == NULL) {
  98                 return NULL;
  99         }
 100         state->ev = ev;
 101         state->transport = transport;
 102         state->data = data;
 103         state->size = size;
 104         state->num_read = 0;
 105
 106         DBG_INFO("data_to_read: %zu\n", size);
 107
 108         subreq = transport->read_send(state, ev, (uint8_t *)data, size,
 109                                       transport->priv);
 110         if (subreq == NULL) {
 111                 goto fail;
 112         }
 113         tevent_req_set_callback(subreq, rpc_read_done, req);
 114         return req;
 115
 116  fail:
 117         TALLOC_FREE(req);
 118         return NULL;
 119 }
 120
 121 static void rpc_read_done(struct tevent_req *subreq)
 122 {
 123         struct tevent_req *req = tevent_req_callback_data(
 124                 subreq, struct tevent_req);
 125         struct rpc_read_state *state = tevent_req_data(
 126                 req, struct rpc_read_state);
 127         NTSTATUS status;
 128         ssize_t received;
 129
 130         status = state->transport->read_recv(subreq, &received);
 131         TALLOC_FREE(subreq);
 132         if (tevent_req_nterror(req, status)) {
 133                 return;
 134         }
 135
 136         state->num_read += received;
 137         if (state->num_read == state->size) {
 138                 tevent_req_done(req);
 139                 return;
 140         }
 141
 142         subreq = state->transport->read_send(state, state->ev,
 143                                              state->data + state->num_read,
 144                                              state->size - state->num_read,
 145                                              state->transport->priv);
 146         if (tevent_req_nomem(subreq, req)) {
 147                 return;
 148         }
 149         tevent_req_set_callback(subreq, rpc_read_done, req);
 150 }
 151
 152 static NTSTATUS rpc_read_recv(struct tevent_req *req)
 153 {
 154         return tevent_req_simple_recv_ntstatus(req);
 155 }
 156
 157 struct rpc_write_state {
 158         struct tevent_context *ev;
 159         struct rpc_cli_transport *transport;
 160         const uint8_t *data;
 161         size_t size;
 162         size_t num_written;
 163 };
 164
 165 static void rpc_write_done(struct tevent_req *subreq);
 166
 167 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
 168                                          struct tevent_context *ev,
 169                                          struct rpc_cli_transport *transport,
 170                                          const uint8_t *data, size_t size)
 171 {
 172         struct tevent_req *req, *subreq;
 173         struct rpc_write_state *state;
 174
 175         req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
 176         if (req == NULL) {
 177                 return NULL;
 178         }
 179         state->ev = ev;
 180         state->transport = transport;
 181         state->data = data;
 182         state->size = size;
 183         state->num_written = 0;
 184
 185         DBG_INFO("data_to_write: %zu\n", size);
 186
 187         subreq = transport->write_send(state, ev, data, size, transport->priv);
 188         if (tevent_req_nomem(subreq, req)) {
 189                 return tevent_req_post(req, ev);
 190         }
 191         tevent_req_set_callback(subreq, rpc_write_done, req);
 192         return req;
 193 }
 194
 195 static void rpc_write_done(struct tevent_req *subreq)
 196 {
 197         struct tevent_req *req = tevent_req_callback_data(
 198                 subreq, struct tevent_req);
 199         struct rpc_write_state *state = tevent_req_data(
 200                 req, struct rpc_write_state);
 201         NTSTATUS status;
 202         ssize_t written;
 203
 204         status = state->transport->write_recv(subreq, &written);
 205         TALLOC_FREE(subreq);
 206         if (tevent_req_nterror(req, status)) {
 207                 return;
 208         }
 209
 210         state->num_written += written;
 211
 212         if (state->num_written == state->size) {
 213                 tevent_req_done(req);
 214                 return;
 215         }
 216
 217         subreq = state->transport->write_send(state, state->ev,
 218                                               state->data + state->num_written,
 219                                               state->size - state->num_written,
 220                                               state->transport->priv);
 221         if (tevent_req_nomem(subreq, req)) {
 222                 return;
 223         }
 224         tevent_req_set_callback(subreq, rpc_write_done, req);
 225 }
 226
 227 static NTSTATUS rpc_write_recv(struct tevent_req *req)
 228 {
 229         return tevent_req_simple_recv_ntstatus(req);
 230 }
 231
 232
 233 /****************************************************************************
 234  Try and get a PDU's worth of data from current_pdu. If not, then read more
 235  from the wire.
 236  ****************************************************************************/
 237
 238 struct get_complete_frag_state {
 239         struct tevent_context *ev;
 240         struct rpc_pipe_client *cli;
 241         uint16_t frag_len;
 242         DATA_BLOB *pdu;
 243 };
 244
 245 static void get_complete_frag_got_header(struct tevent_req *subreq);
 246 static void get_complete_frag_got_rest(struct tevent_req *subreq);
 247
 248 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
 249                                                  struct tevent_context *ev,
 250                                                  struct rpc_pipe_client *cli,
 251                                                  DATA_BLOB *pdu)
 252 {
 253         struct tevent_req *req, *subreq;
 254         struct get_complete_frag_state *state;
 255         size_t received;
 256
 257         req = tevent_req_create(mem_ctx, &state,
 258                                 struct get_complete_frag_state);
 259         if (req == NULL) {
 260                 return NULL;
 261         }
 262         state->ev = ev;
 263         state->cli = cli;
 264         state->frag_len = RPC_HEADER_LEN;
 265         state->pdu = pdu;
 266
 267         received = pdu->length;
 268         if (received < RPC_HEADER_LEN) {
 269                 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
 270                         tevent_req_oom(req);
 271                         return tevent_req_post(req, ev);
 272                 }
 273                 subreq = rpc_read_send(state, state->ev,
 274                                         state->cli->transport,
 275                                         pdu->data + received,
 276                                         RPC_HEADER_LEN - received);
 277                 if (tevent_req_nomem(subreq, req)) {
 278                         return tevent_req_post(req, ev);
 279                 }
 280                 tevent_req_set_callback(subreq, get_complete_frag_got_header,
 281                                         req);
 282                 return req;
 283         }
 284
 285         state->frag_len = dcerpc_get_frag_length(pdu);
 286         if (state->frag_len < RPC_HEADER_LEN) {
 287                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
 288                 return tevent_req_post(req, ev);
 289         }
 290
 291         if (received >= state->frag_len) {
 292                 /*
 293                  * Got the whole fragment
 294                  */
 295                 tevent_req_done(req);
 296                 return tevent_req_post(req, ev);
 297         }
 298
 299         if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
 300                 tevent_req_oom(req);
 301                 return tevent_req_post(req, ev);
 302         }
 303
 304         subreq = rpc_read_send(
 305                 state,
 306                 state->ev,
 307                 state->cli->transport,
 308                 pdu->data + received,
 309                 state->frag_len - received);
 310         if (tevent_req_nomem(subreq, req)) {
 311                 return tevent_req_post(req, ev);
 312         }
 313         tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
 314         return req;
 315 }
 316
 317 static void get_complete_frag_got_header(struct tevent_req *subreq)
 318 {
 319         struct tevent_req *req = tevent_req_callback_data(
 320                 subreq, struct tevent_req);
 321         struct get_complete_frag_state *state = tevent_req_data(
 322                 req, struct get_complete_frag_state);
 323         NTSTATUS status;
 324
 325         status = rpc_read_recv(subreq);
 326         TALLOC_FREE(subreq);
 327         if (tevent_req_nterror(req, status)) {
 328                 return;
 329         }
 330
 331         state->frag_len = dcerpc_get_frag_length(state->pdu);
 332         if (state->frag_len < RPC_HEADER_LEN) {
 333                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
 334                 return;
 335         }
 336
 337         if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
 338                 tevent_req_oom(req);
 339                 return;
 340         }
 341
 342         /*
 343          * We're here in this piece of code because we've read exactly
 344          * RPC_HEADER_LEN bytes into state->pdu.
 345          */
 346
 347         subreq = rpc_read_send(state, state->ev, state->cli->transport,
 348                                 state->pdu->data + RPC_HEADER_LEN,
 349                                 state->frag_len - RPC_HEADER_LEN);
 350         if (tevent_req_nomem(subreq, req)) {
 351                 return;
 352         }
 353         tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
 354 }
 355
 356 static void get_complete_frag_got_rest(struct tevent_req *subreq)
 357 {
 358         NTSTATUS status = rpc_read_recv(subreq);
 359         return tevent_req_simple_finish_ntstatus(subreq, status);
 360 }
 361
 362 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
 363 {
 364         return tevent_req_simple_recv_ntstatus(req);
 365 }
 366
 367 /****************************************************************************
 368  Do basic authentication checks on an incoming pdu.
 369  ****************************************************************************/
 370
 371 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
 372                                                 struct rpc_pipe_client *cli,
 373                                                 struct ncacn_packet *pkt,
 374                                                 DATA_BLOB *pdu,
 375                                                 uint8_t expected_pkt_type,
 376                                                 uint32_t call_id,
 377                                                 DATA_BLOB *rdata,
 378                                                 DATA_BLOB *reply_pdu)
 379 {
 380         const struct dcerpc_response *r = NULL;
 381         DATA_BLOB tmp_stub = { .data = NULL };
 382         NTSTATUS ret;
 383
 384         /*
 385          * Point the return values at the real data including the RPC
 386          * header. Just in case the caller wants it.
 387          */
 388         *rdata = *pdu;
 389
 390         if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
 391             !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
 392                 /*
 393                  * TODO: do we still need this hack which was introduced
 394                  * in commit a42afcdcc7ab9aa9ed193ae36d3dbb10843447f0.
 395                  *
 396                  * I don't even know what AS/U might be...
 397                  */
 398                 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
 399                           "fragment first/last ON.\n"));
 400                 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
 401         }
 402
 403         /* Ensure we have the correct type. */
 404         switch (pkt->ptype) {
 405         case DCERPC_PKT_BIND_NAK:
 406                 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
 407                           rpccli_pipe_txt(talloc_tos(), cli)));
 408
 409                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 410                                                 DCERPC_PKT_BIND_NAK,
 411                                                 0, /* max_auth_info */
 412                                                 DCERPC_PFC_FLAG_FIRST |
 413                                                 DCERPC_PFC_FLAG_LAST,
 414                                                 0); /* optional flags */
 415                 if (!NT_STATUS_IS_OK(ret)) {
 416                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 417                                   "RPC packet type - %u, expected %u: %s\n",
 418                                   rpccli_pipe_txt(talloc_tos(), cli),
 419                                   pkt->ptype, expected_pkt_type,
 420                                   nt_errstr(ret)));
 421                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 422                         return ret;
 423                 }
 424
 425                 /* Use this for now... */
 426                 return NT_STATUS_NETWORK_ACCESS_DENIED;
 427
 428         case DCERPC_PKT_BIND_ACK:
 429                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 430                                         expected_pkt_type,
 431                                         pkt->u.bind_ack.auth_info.length,
 432                                         DCERPC_PFC_FLAG_FIRST |
 433                                         DCERPC_PFC_FLAG_LAST,
 434                                         DCERPC_PFC_FLAG_CONC_MPX |
 435                                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
 436                 if (!NT_STATUS_IS_OK(ret)) {
 437                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 438                                   "RPC packet type - %u, expected %u: %s\n",
 439                                   rpccli_pipe_txt(talloc_tos(), cli),
 440                                   pkt->ptype, expected_pkt_type,
 441                                   nt_errstr(ret)));
 442                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 443                         return ret;
 444                 }
 445
 446                 break;
 447
 448         case DCERPC_PKT_ALTER_RESP:
 449                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 450                                         expected_pkt_type,
 451                                         pkt->u.alter_resp.auth_info.length,
 452                                         DCERPC_PFC_FLAG_FIRST |
 453                                         DCERPC_PFC_FLAG_LAST,
 454                                         DCERPC_PFC_FLAG_CONC_MPX |
 455                                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
 456                 if (!NT_STATUS_IS_OK(ret)) {
 457                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 458                                   "RPC packet type - %u, expected %u: %s\n",
 459                                   rpccli_pipe_txt(talloc_tos(), cli),
 460                                   pkt->ptype, expected_pkt_type,
 461                                   nt_errstr(ret)));
 462                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 463                         return ret;
 464                 }
 465
 466                 break;
 467
 468         case DCERPC_PKT_RESPONSE:
 469
 470                 r = &pkt->u.response;
 471
 472                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 473                                                 expected_pkt_type,
 474                                                 r->stub_and_verifier.length,
 475                                                 0, /* required_flags */
 476                                                 DCERPC_PFC_FLAG_FIRST |
 477                                                 DCERPC_PFC_FLAG_LAST);
 478                 if (!NT_STATUS_IS_OK(ret)) {
 479                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 480                                   "RPC packet type - %u, expected %u: %s\n",
 481                                   rpccli_pipe_txt(talloc_tos(), cli),
 482                                   pkt->ptype, expected_pkt_type,
 483                                   nt_errstr(ret)));
 484                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 485                         return ret;
 486                 }
 487
 488                 tmp_stub.data = r->stub_and_verifier.data;
 489                 tmp_stub.length = r->stub_and_verifier.length;
 490
 491                 /* Here's where we deal with incoming sign/seal. */
 492                 ret = dcerpc_check_auth(cli->auth, pkt,
 493                                         &tmp_stub,
 494                                         DCERPC_RESPONSE_LENGTH,
 495                                         pdu);
 496                 if (!NT_STATUS_IS_OK(ret)) {
 497                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 498                                   "RPC packet type - %u, expected %u: %s\n",
 499                                   rpccli_pipe_txt(talloc_tos(), cli),
 500                                   pkt->ptype, expected_pkt_type,
 501                                   nt_errstr(ret)));
 502                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 503                         return ret;
 504                 }
 505
 506                 /* Point the return values at the NDR data. */
 507                 *rdata = tmp_stub;
 508
 509                 DEBUG(10, ("Got pdu len %lu, data_len %lu\n",
 510                            (long unsigned int)pdu->length,
 511                            (long unsigned int)rdata->length));
 512
 513                 /*
 514                  * If this is the first reply, and the allocation hint is
 515                  * reasonable, try and set up the reply_pdu DATA_BLOB to the
 516                  * correct size.
 517                  */
 518
 519                 if ((reply_pdu->length == 0) &&
 520                     r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
 521                         if (!data_blob_realloc(mem_ctx, reply_pdu,
 522                                                         r->alloc_hint)) {
 523                                 DEBUG(0, ("reply alloc hint %d too "
 524                                           "large to allocate\n",
 525                                           (int)r->alloc_hint));
 526                                 return NT_STATUS_NO_MEMORY;
 527                         }
 528                 }
 529
 530                 break;
 531
 532         case DCERPC_PKT_FAULT:
 533
 534                 ret = dcerpc_verify_ncacn_packet_header(pkt,
 535                                                 DCERPC_PKT_FAULT,
 536                                                 0, /* max_auth_info */
 537                                                 DCERPC_PFC_FLAG_FIRST |
 538                                                 DCERPC_PFC_FLAG_LAST,
 539                                                 DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
 540                 if (!NT_STATUS_IS_OK(ret)) {
 541                         DEBUG(1, (__location__ ": Connection to %s got an unexpected "
 542                                   "RPC packet type - %u, expected %u: %s\n",
 543                                   rpccli_pipe_txt(talloc_tos(), cli),
 544                                   pkt->ptype, expected_pkt_type,
 545                                   nt_errstr(ret)));
 546                         NDR_PRINT_DEBUG(ncacn_packet, pkt);
 547                         return ret;
 548                 }
 549
 550                 DEBUG(1, (__location__ ": RPC fault code %s received "
 551                           "from %s!\n",
 552                           dcerpc_errstr(talloc_tos(),
 553                           pkt->u.fault.status),
 554                           rpccli_pipe_txt(talloc_tos(), cli)));
 555
 556                 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
 557
 558         default:
 559                 DEBUG(0, (__location__ "Unknown packet type %u received "
 560                           "from %s!\n",
 561                           (unsigned int)pkt->ptype,
 562                           rpccli_pipe_txt(talloc_tos(), cli)));
 563                 return NT_STATUS_RPC_PROTOCOL_ERROR;
 564         }
 565
 566
 567         if (pkt->call_id != call_id) {
 568                 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
 569                           "RPC call_id - %u, not %u\n",
 570                           rpccli_pipe_txt(talloc_tos(), cli),
 571                           pkt->call_id, call_id));
 572                 return NT_STATUS_RPC_PROTOCOL_ERROR;
 573         }
 574
 575         return NT_STATUS_OK;
 576 }
 577
 578 /****************************************************************************
 579  Call a remote api on an arbitrary pipe.  takes param, data and setup buffers.
 580 ****************************************************************************/
 581
 582 struct cli_api_pipe_state {
 583         struct tevent_context *ev;
 584         struct rpc_cli_transport *transport;
 585         uint8_t *rdata;
 586         uint32_t rdata_len;
 587 };
 588
 589 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
 590 static void cli_api_pipe_write_done(struct tevent_req *subreq);
 591 static void cli_api_pipe_read_done(struct tevent_req *subreq);
 592
 593 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
 594                                             struct tevent_context *ev,
 595                                             struct rpc_cli_transport *transport,
 596                                             uint8_t *data, size_t data_len,
 597                                             uint32_t max_rdata_len)
 598 {
 599         struct tevent_req *req, *subreq;
 600         struct cli_api_pipe_state *state;
 601
 602         req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
 603         if (req == NULL) {
 604                 return NULL;
 605         }
 606         state->ev = ev;
 607         state->transport = transport;
 608
 609         if (max_rdata_len < RPC_HEADER_LEN) {
 610                 /*
 611                  * For a RPC reply we always need at least RPC_HEADER_LEN
 612                  * bytes. We check this here because we will receive
 613                  * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
 614                  */
 615                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 616                 return tevent_req_post(req, ev);
 617         }
 618
 619         if (transport->trans_send != NULL) {
 620                 subreq = transport->trans_send(state, ev, data, data_len,
 621                                                max_rdata_len, transport->priv);
 622                 if (tevent_req_nomem(subreq, req)) {
 623                         return tevent_req_post(req, ev);
 624                 }
 625                 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
 626                 return req;
 627         }
 628
 629         /*
 630          * If the transport does not provide a "trans" routine, i.e. for
 631          * example the ncacn_ip_tcp transport, do the write/read step here.
 632          */
 633
 634         subreq = rpc_write_send(state, ev, transport, data, data_len);
 635         if (tevent_req_nomem(subreq, req)) {
 636                 return tevent_req_post(req, ev);
 637         }
 638         tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
 639         return req;
 640 }
 641
 642 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
 643 {
 644         struct tevent_req *req = tevent_req_callback_data(
 645                 subreq, struct tevent_req);
 646         struct cli_api_pipe_state *state = tevent_req_data(
 647                 req, struct cli_api_pipe_state);
 648         NTSTATUS status;
 649
 650         status = state->transport->trans_recv(subreq, state, &state->rdata,
 651                                               &state->rdata_len);
 652         TALLOC_FREE(subreq);
 653         if (tevent_req_nterror(req, status)) {
 654                 return;
 655         }
 656         tevent_req_done(req);
 657 }
 658
 659 static void cli_api_pipe_write_done(struct tevent_req *subreq)
 660 {
 661         struct tevent_req *req = tevent_req_callback_data(
 662                 subreq, struct tevent_req);
 663         struct cli_api_pipe_state *state = tevent_req_data(
 664                 req, struct cli_api_pipe_state);
 665         NTSTATUS status;
 666
 667         status = rpc_write_recv(subreq);
 668         TALLOC_FREE(subreq);
 669         if (tevent_req_nterror(req, status)) {
 670                 return;
 671         }
 672
 673         state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
 674         if (tevent_req_nomem(state->rdata, req)) {
 675                 return;
 676         }
 677
 678         /*
 679          * We don't need to use rpc_read_send here, the upper layer will cope
 680          * with a short read, transport->trans_send could also return less
 681          * than state->max_rdata_len.
 682          */
 683         subreq = state->transport->read_send(state, state->ev, state->rdata,
 684                                              RPC_HEADER_LEN,
 685                                              state->transport->priv);
 686         if (tevent_req_nomem(subreq, req)) {
 687                 return;
 688         }
 689         tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
 690 }
 691
 692 static void cli_api_pipe_read_done(struct tevent_req *subreq)
 693 {
 694         struct tevent_req *req = tevent_req_callback_data(
 695                 subreq, struct tevent_req);
 696         struct cli_api_pipe_state *state = tevent_req_data(
 697                 req, struct cli_api_pipe_state);
 698         NTSTATUS status;
 699         ssize_t received;
 700
 701         status = state->transport->read_recv(subreq, &received);
 702         TALLOC_FREE(subreq);
 703         if (tevent_req_nterror(req, status)) {
 704                 return;
 705         }
 706         state->rdata_len = received;
 707         tevent_req_done(req);
 708 }
 709
 710 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 711                                   uint8_t **prdata, uint32_t *prdata_len)
 712 {
 713         struct cli_api_pipe_state *state = tevent_req_data(
 714                 req, struct cli_api_pipe_state);
 715         NTSTATUS status;
 716
 717         if (tevent_req_is_nterror(req, &status)) {
 718                 return status;
 719         }
 720
 721         *prdata = talloc_move(mem_ctx, &state->rdata);
 722         *prdata_len = state->rdata_len;
 723         return NT_STATUS_OK;
 724 }
 725
 726 /****************************************************************************
 727  Send data on an rpc pipe via trans. The data must be the last
 728  pdu fragment of an NDR data stream.
 729
 730  Receive response data from an rpc pipe, which may be large...
 731
 732  Read the first fragment: unfortunately have to use SMBtrans for the first
 733  bit, then SMBreadX for subsequent bits.
 734
 735  If first fragment received also wasn't the last fragment, continue
 736  getting fragments until we _do_ receive the last fragment.
 737
 738  Request/Response PDU's look like the following...
 739
 740  |<------------------PDU len----------------------------------------------->|
 741  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 742
 743  +------------+-----------------+-------------+---------------+-------------+
 744  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 745  +------------+-----------------+-------------+---------------+-------------+
 746
 747  Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
 748  signing & sealing being negotiated.
 749
 750  ****************************************************************************/
 751
 752 struct rpc_api_pipe_state {
 753         struct tevent_context *ev;
 754         struct rpc_pipe_client *cli;
 755         uint8_t expected_pkt_type;
 756         uint32_t call_id;
 757
 758         DATA_BLOB incoming_frag;
 759         struct ncacn_packet *pkt;
 760
 761         /* Incoming reply */
 762         DATA_BLOB reply_pdu;
 763         size_t reply_pdu_offset;
 764         uint8_t endianness;
 765 };
 766
 767 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
 768 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
 769 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
 770
 771 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
 772                                             struct tevent_context *ev,
 773                                             struct rpc_pipe_client *cli,
 774                                             DATA_BLOB *data, /* Outgoing PDU */
 775                                             uint8_t expected_pkt_type,
 776                                             uint32_t call_id)
 777 {
 778         struct tevent_req *req, *subreq;
 779         struct rpc_api_pipe_state *state;
 780         uint16_t max_recv_frag;
 781
 782         req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
 783         if (req == NULL) {
 784                 return NULL;
 785         }
 786         state->ev = ev;
 787         state->cli = cli;
 788         state->expected_pkt_type = expected_pkt_type;
 789         state->call_id = call_id;
 790         state->endianness = DCERPC_DREP_LE;
 791
 792         /*
 793          * Ensure we're not sending too much.
 794          */
 795         if (data->length > cli->max_xmit_frag) {
 796                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 797                 return tevent_req_post(req, ev);
 798         }
 799
 800         DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
 801
 802         if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
 803                 subreq = rpc_write_send(state, ev, cli->transport,
 804                                         data->data, data->length);
 805                 if (tevent_req_nomem(subreq, req)) {
 806                         return tevent_req_post(req, ev);
 807                 }
 808                 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
 809                 return req;
 810         }
 811
 812         /* get the header first, then fetch the rest once we have
 813          * the frag_length available */
 814         max_recv_frag = RPC_HEADER_LEN;
 815
 816         subreq = cli_api_pipe_send(state, ev, cli->transport,
 817                                    data->data, data->length, max_recv_frag);
 818         if (tevent_req_nomem(subreq, req)) {
 819                 return tevent_req_post(req, ev);
 820         }
 821         tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
 822         return req;
 823 }
 824
 825 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
 826 {
 827         NTSTATUS status = rpc_write_recv(subreq);
 828         return tevent_req_simple_finish_ntstatus(subreq, status);
 829 }
 830
 831 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
 832 {
 833         struct tevent_req *req = tevent_req_callback_data(
 834                 subreq, struct tevent_req);
 835         struct rpc_api_pipe_state *state = tevent_req_data(
 836                 req, struct rpc_api_pipe_state);
 837         NTSTATUS status;
 838         uint8_t *rdata = NULL;
 839         uint32_t rdata_len = 0;
 840
 841         status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
 842         TALLOC_FREE(subreq);
 843         if (tevent_req_nterror(req, status)) {;
 844                 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
 845                 return;
 846         }
 847
 848         if (rdata == NULL) {
 849                 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
 850                          rpccli_pipe_txt(talloc_tos(), state->cli)));
 851                 tevent_req_done(req);
 852                 return;
 853         }
 854
 855         /*
 856          * Move data on state->incoming_frag.
 857          */
 858         state->incoming_frag.data = talloc_move(state, &rdata);
 859         state->incoming_frag.length = rdata_len;
 860         if (!state->incoming_frag.data) {
 861                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 862                 return;
 863         }
 864
 865         /* Ensure we have enough data for a pdu. */
 866         subreq = get_complete_frag_send(state, state->ev, state->cli,
 867                                         &state->incoming_frag);
 868         if (tevent_req_nomem(subreq, req)) {
 869                 return;
 870         }
 871         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
 872 }
 873
 874 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
 875 {
 876         struct tevent_req *req = tevent_req_callback_data(
 877                 subreq, struct tevent_req);
 878         struct rpc_api_pipe_state *state = tevent_req_data(
 879                 req, struct rpc_api_pipe_state);
 880         NTSTATUS status;
 881         DATA_BLOB rdata = { .data = NULL };
 882
 883         status = get_complete_frag_recv(subreq);
 884         TALLOC_FREE(subreq);
 885         if (tevent_req_nterror(req, status)) {
 886                 DEBUG(5, ("get_complete_frag failed: %s\n",
 887                           nt_errstr(status)));
 888                 return;
 889         }
 890
 891         state->pkt = talloc(state, struct ncacn_packet);
 892         if (!state->pkt) {
 893                 /*
 894                  * TODO: do a real async disconnect ...
 895                  *
 896                  * For now do it sync...
 897                  */
 898                 TALLOC_FREE(state->cli->transport);
 899                 tevent_req_oom(req);
 900                 return;
 901         }
 902
 903         status = dcerpc_pull_ncacn_packet(state->pkt,
 904                                           &state->incoming_frag,
 905                                           state->pkt);
 906         if (tevent_req_nterror(req, status)) {
 907                 /*
 908                  * TODO: do a real async disconnect ...
 909                  *
 910                  * For now do it sync...
 911                  */
 912                 TALLOC_FREE(state->cli->transport);
 913                 return;
 914         }
 915
 916         if (DEBUGLEVEL >= 10) {
 917                 NDR_PRINT_DEBUG(ncacn_packet, state->pkt);
 918         }
 919
 920         status = cli_pipe_validate_current_pdu(state,
 921                                                 state->cli, state->pkt,
 922                                                 &state->incoming_frag,
 923                                                 state->expected_pkt_type,
 924                                                 state->call_id,
 925                                                 &rdata,
 926                                                 &state->reply_pdu);
 927
 928         DBG_DEBUG("got frag len of %zu at offset %zu: %s\n",
 929                   state->incoming_frag.length,
 930                   state->reply_pdu_offset,
 931                   nt_errstr(status));
 932
 933         if (state->pkt->ptype != DCERPC_PKT_FAULT && !NT_STATUS_IS_OK(status)) {
 934                 /*
 935                  * TODO: do a real async disconnect ...
 936                  *
 937                  * For now do it sync...
 938                  */
 939                 TALLOC_FREE(state->cli->transport);
 940         } else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTOCOL_ERROR)) {
 941                 /*
 942                  * TODO: do a real async disconnect ...
 943                  *
 944                  * For now do it sync...
 945                  */
 946                 TALLOC_FREE(state->cli->transport);
 947         } else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
 948                 /*
 949                  * TODO: do a real async disconnect ...
 950                  *
 951                  * For now do it sync...
 952                  */
 953                 TALLOC_FREE(state->cli->transport);
 954         }
 955         if (tevent_req_nterror(req, status)) {
 956                 return;
 957         }
 958
 959         if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
 960             && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
 961                 /*
 962                  * Set the data type correctly for big-endian data on the
 963                  * first packet.
 964                  */
 965                 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
 966                           "big-endian.\n",
 967                           rpccli_pipe_txt(talloc_tos(), state->cli)));
 968                 state->endianness = 0x00; /* BIG ENDIAN */
 969         }
 970         /*
 971          * Check endianness on subsequent packets.
 972          */
 973         if (state->endianness != state->pkt->drep[0]) {
 974                 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
 975                          "%s\n",
 976                          state->endianness?"little":"big",
 977                          state->pkt->drep[0]?"little":"big"));
 978                 /*
 979                  * TODO: do a real async disconnect ...
 980                  *
 981                  * For now do it sync...
 982                  */
 983                 TALLOC_FREE(state->cli->transport);
 984                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
 985                 return;
 986         }
 987
 988         if (state->reply_pdu_offset + rdata.length > MAX_RPC_DATA_SIZE) {
 989                 /*
 990                  * TODO: do a real async disconnect ...
 991                  *
 992                  * For now do it sync...
 993                  */
 994                 TALLOC_FREE(state->cli->transport);
 995                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
 996                 return;
 997         }
 998
 999         /* Now copy the data portion out of the pdu into rbuf. */
1000         if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
1001                 if (!data_blob_realloc(NULL, &state->reply_pdu,
1002                                 state->reply_pdu_offset + rdata.length)) {
1003                         /*
1004                          * TODO: do a real async disconnect ...
1005                          *
1006                          * For now do it sync...
1007                          */
1008                         TALLOC_FREE(state->cli->transport);
1009                         tevent_req_oom(req);
1010                         return;
1011                 }
1012         }
1013
1014         memcpy(state->reply_pdu.data + state->reply_pdu_offset,
1015                 rdata.data, rdata.length);
1016         state->reply_pdu_offset += rdata.length;
1017
1018         /* reset state->incoming_frag, there is no need to free it,
1019          * it will be reallocated to the right size the next time
1020          * it is used */
1021         state->incoming_frag.length = 0;
1022
1023         if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1024                 /* make sure the pdu length is right now that we
1025                  * have all the data available (alloc hint may
1026                  * have allocated more than was actually used) */
1027                 state->reply_pdu.length = state->reply_pdu_offset;
1028                 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1029                           rpccli_pipe_txt(talloc_tos(), state->cli),
1030                           (unsigned)state->reply_pdu.length));
1031                 tevent_req_done(req);
1032                 return;
1033         }
1034
1035         subreq = get_complete_frag_send(state, state->ev, state->cli,
1036                                         &state->incoming_frag);
1037         if (subreq == NULL) {
1038                 /*
1039                  * TODO: do a real async disconnect ...
1040                  *
1041                  * For now do it sync...
1042                  */
1043                 TALLOC_FREE(state->cli->transport);
1044         }
1045         if (tevent_req_nomem(subreq, req)) {
1046                 return;
1047         }
1048         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1049 }
1050
1051 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1052                                   struct ncacn_packet **pkt,
1053                                   DATA_BLOB *reply_pdu)
1054 {
1055         struct rpc_api_pipe_state *state = tevent_req_data(
1056                 req, struct rpc_api_pipe_state);
1057         NTSTATUS status;
1058
1059         if (tevent_req_is_nterror(req, &status)) {
1060                 return status;
1061         }
1062
1063         /* return data to caller and assign it ownership of memory */
1064         if (reply_pdu) {
1065                 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1066                 reply_pdu->length = state->reply_pdu.length;
1067                 state->reply_pdu.length = 0;
1068         } else {
1069                 data_blob_free(&state->reply_pdu);
1070         }
1071
1072         if (pkt) {
1073                 *pkt = talloc_steal(mem_ctx, state->pkt);
1074         }
1075
1076         return NT_STATUS_OK;
1077 }
1078
1079 /*******************************************************************
1080  Creates NTLMSSP auth bind.
1081  ********************************************************************/
1082
1083 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1084                                                  TALLOC_CTX *mem_ctx,
1085                                                  DATA_BLOB *auth_token,
1086                                                  bool *client_hdr_signing)
1087 {
1088         struct gensec_security *gensec_security;
1089         DATA_BLOB null_blob = { .data = NULL };
1090         NTSTATUS status;
1091
1092         gensec_security = cli->auth->auth_ctx;
1093
1094         DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
1095         status = gensec_update(gensec_security, mem_ctx, null_blob, auth_token);
1096
1097         if (!NT_STATUS_IS_OK(status) &&
1098             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
1099         {
1100                 return status;
1101         }
1102
1103         if (client_hdr_signing == NULL) {
1104                 return status;
1105         }
1106
1107         if (cli->auth->auth_level < DCERPC_AUTH_LEVEL_PACKET) {
1108                 *client_hdr_signing = false;
1109                 return status;
1110         }
1111
1112         *client_hdr_signing = gensec_have_feature(gensec_security,
1113                                                 GENSEC_FEATURE_SIGN_PKT_HEADER);
1114
1115         return status;
1116 }
1117
1118 /*******************************************************************
1119  Creates the internals of a DCE/RPC bind request or alter context PDU.
1120  ********************************************************************/
1121
1122 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1123                                                 enum dcerpc_pkt_type ptype,
1124                                                 uint32_t rpc_call_id,
1125                                                 const struct ndr_syntax_id *abstract,
1126                                                 const struct ndr_syntax_id *transfer,
1127                                                 const DATA_BLOB *auth_info,
1128                                                 bool client_hdr_signing,
1129                                                 DATA_BLOB *blob)
1130 {
1131         uint16_t auth_len = auth_info->length;
1132         NTSTATUS status;
1133         struct ndr_syntax_id bind_time_features = dcerpc_construct_bind_time_features(
1134                         DCERPC_BIND_TIME_SECURITY_CONTEXT_MULTIPLEXING |
1135                         DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN);
1136         struct dcerpc_ctx_list ctx_list[2] = {
1137                 [0] = {
1138                         .context_id = 0,
1139                         .num_transfer_syntaxes = 1,
1140                         .abstract_syntax = *abstract,
1141                         .transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer),
1142                 },
1143                 [1] = {
1144                         .context_id = 1,
1145                         .num_transfer_syntaxes = 1,
1146                         .abstract_syntax = *abstract,
1147                         .transfer_syntaxes = &bind_time_features,
1148                 },
1149         };
1150         union dcerpc_payload u = {
1151                 .bind.max_xmit_frag     = RPC_MAX_PDU_FRAG_LEN,
1152                 .bind.max_recv_frag     = RPC_MAX_PDU_FRAG_LEN,
1153                 .bind.num_contexts      = ptype == DCERPC_PKT_BIND ? 2 : 1,
1154                 .bind.ctx_list          = ctx_list,
1155                 .bind.auth_info         = *auth_info,
1156         };
1157         uint8_t pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1158
1159         if (auth_len) {
1160                 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1161         }
1162
1163         if (client_hdr_signing) {
1164                 pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
1165         }
1166
1167         status = dcerpc_push_ncacn_packet(mem_ctx,
1168                                           ptype, pfc_flags,
1169                                           auth_len,
1170                                           rpc_call_id,
1171                                           &u,
1172                                           blob);
1173         if (!NT_STATUS_IS_OK(status)) {
1174                 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1175                 return status;
1176         }
1177
1178         return NT_STATUS_OK;
1179 }
1180
1181 /*******************************************************************
1182  Creates a DCE/RPC bind request.
1183  ********************************************************************/
1184
1185 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1186                                     struct rpc_pipe_client *cli,
1187                                     struct pipe_auth_data *auth,
1188                                     uint32_t rpc_call_id,
1189                                     const struct ndr_syntax_id *abstract,
1190                                     const struct ndr_syntax_id *transfer,
1191                                     DATA_BLOB *rpc_out)
1192 {
1193         DATA_BLOB auth_token = { .data = NULL };
1194         DATA_BLOB auth_info = { .data = NULL };
1195         NTSTATUS ret;
1196
1197         if (auth->auth_type != DCERPC_AUTH_TYPE_NONE) {
1198                 ret = create_generic_auth_rpc_bind_req(
1199                         cli, mem_ctx, &auth_token, &auth->client_hdr_signing);
1200
1201                 if (!NT_STATUS_IS_OK(ret) &&
1202                     !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1203                         return ret;
1204                 }
1205         }
1206
1207         if (auth_token.length != 0) {
1208                 ret = dcerpc_push_dcerpc_auth(cli,
1209                                                 auth->auth_type,
1210                                                 auth->auth_level,
1211                                                 0, /* auth_pad_length */
1212                                                 auth->auth_context_id,
1213                                                 &auth_token,
1214                                                 &auth_info);
1215                 if (!NT_STATUS_IS_OK(ret)) {
1216                         return ret;
1217                 }
1218                 data_blob_free(&auth_token);
1219         }
1220
1221         ret = create_bind_or_alt_ctx_internal(mem_ctx,
1222                                               DCERPC_PKT_BIND,
1223                                               rpc_call_id,
1224                                               abstract,
1225                                               transfer,
1226                                               &auth_info,
1227                                               auth->client_hdr_signing,
1228                                               rpc_out);
1229         data_blob_free(&auth_info);
1230
1231         return ret;
1232 }
1233
1234 /*******************************************************************
1235  External interface.
1236  Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1237  Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1238  and deals with signing/sealing details.
1239  ********************************************************************/
1240
1241 struct rpc_api_pipe_req_state {
1242         struct tevent_context *ev;
1243         struct rpc_pipe_client *cli;
1244         uint8_t op_num;
1245         uint32_t call_id;
1246         const DATA_BLOB *req_data;
1247         const struct GUID *object_uuid;
1248         uint32_t req_data_sent;
1249         DATA_BLOB req_trailer;
1250         uint32_t req_trailer_sent;
1251         bool verify_bitmask1;
1252         bool verify_pcontext;
1253         DATA_BLOB rpc_out;
1254         DATA_BLOB reply_pdu;
1255 };
1256
1257 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1258 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1259 static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state);
1260 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1261                                   bool *is_last_frag);
1262
1263 static struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1264                                          struct tevent_context *ev,
1265                                          struct rpc_pipe_client *cli,
1266                                          uint8_t op_num,
1267                                          const struct GUID *object_uuid,
1268                                          const DATA_BLOB *req_data)
1269 {
1270         struct tevent_req *req, *subreq;
1271         struct rpc_api_pipe_req_state *state;
1272         NTSTATUS status;
1273         bool is_last_frag;
1274
1275         req = tevent_req_create(mem_ctx, &state,
1276                                 struct rpc_api_pipe_req_state);
1277         if (req == NULL) {
1278                 return NULL;
1279         }
1280         state->ev = ev;
1281         state->cli = cli;
1282         state->op_num = op_num;
1283         state->object_uuid = object_uuid;
1284         state->req_data = req_data;
1285         state->call_id = get_rpc_call_id();
1286
1287         if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1288                                         + RPC_MAX_SIGN_SIZE) {
1289                 /* Server is screwed up ! */
1290                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1291                 return tevent_req_post(req, ev);
1292         }
1293
1294         status = prepare_verification_trailer(state);
1295         if (tevent_req_nterror(req, status)) {
1296                 return tevent_req_post(req, ev);
1297         }
1298
1299         status = prepare_next_frag(state, &is_last_frag);
1300         if (tevent_req_nterror(req, status)) {
1301                 return tevent_req_post(req, ev);
1302         }
1303
1304         if (is_last_frag) {
1305                 subreq = rpc_api_pipe_send(state, ev, state->cli,
1306                                            &state->rpc_out,
1307                                            DCERPC_PKT_RESPONSE,
1308                                            state->call_id);
1309                 if (tevent_req_nomem(subreq, req)) {
1310                         return tevent_req_post(req, ev);
1311                 }
1312                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1313         } else {
1314                 subreq = rpc_write_send(state, ev, cli->transport,
1315                                         state->rpc_out.data,
1316                                         state->rpc_out.length);
1317                 if (tevent_req_nomem(subreq, req)) {
1318                         return tevent_req_post(req, ev);
1319                 }
1320                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1321                                         req);
1322         }
1323         return req;
1324 }
1325
1326 static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state)
1327 {
1328         struct pipe_auth_data *a = state->cli->auth;
1329         struct dcerpc_sec_verification_trailer *t;
1330         struct ndr_push *ndr = NULL;
1331         enum ndr_err_code ndr_err;
1332         size_t align = 0;
1333         size_t pad = 0;
1334
1335         if (a == NULL) {
1336                 return NT_STATUS_OK;
1337         }
1338
1339         if (a->auth_level < DCERPC_AUTH_LEVEL_PACKET) {
1340                 return NT_STATUS_OK;
1341         }
1342
1343         t = talloc_zero(state, struct dcerpc_sec_verification_trailer);
1344         if (t == NULL) {
1345                 return NT_STATUS_NO_MEMORY;
1346         }
1347
1348         if (!a->verified_bitmask1) {
1349                 t->commands = talloc_realloc(t, t->commands,
1350                                              struct dcerpc_sec_vt,
1351                                              t->count.count + 1);
1352                 if (t->commands == NULL) {
1353                         return NT_STATUS_NO_MEMORY;
1354                 }
1355                 t->commands[t->count.count++] = (struct dcerpc_sec_vt) {
1356                         .command = DCERPC_SEC_VT_COMMAND_BITMASK1,
1357                         .u.bitmask1 = (a->client_hdr_signing) ?
1358                                 DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING :
1359                                 0,
1360                 };
1361                 state->verify_bitmask1 = true;
1362         }
1363
1364         if (!state->cli->verified_pcontext) {
1365                 t->commands = talloc_realloc(t, t->commands,
1366                                              struct dcerpc_sec_vt,
1367                                              t->count.count + 1);
1368                 if (t->commands == NULL) {
1369                         return NT_STATUS_NO_MEMORY;
1370                 }
1371                 t->commands[t->count.count++] = (struct dcerpc_sec_vt) {
1372                         .command = DCERPC_SEC_VT_COMMAND_PCONTEXT,
1373                         .u.pcontext.abstract_syntax =
1374                                 state->cli->abstract_syntax,
1375                         .u.pcontext.transfer_syntax =
1376                                 state->cli->transfer_syntax,
1377                 };
1378                 state->verify_pcontext = true;
1379         }
1380
1381         if (!a->hdr_signing) {
1382                 t->commands = talloc_realloc(t, t->commands,
1383                                              struct dcerpc_sec_vt,
1384                                              t->count.count + 1);
1385                 if (t->commands == NULL) {
1386                         return NT_STATUS_NO_MEMORY;
1387                 }
1388                 t->commands[t->count.count++] = (struct dcerpc_sec_vt) {
1389                         .command = DCERPC_SEC_VT_COMMAND_HEADER2,
1390                         .u.header2.ptype = DCERPC_PKT_REQUEST,
1391                         .u.header2.drep[0] = DCERPC_DREP_LE,
1392                         .u.header2.call_id = state->call_id,
1393                         .u.header2.context_id = 0,
1394                         .u.header2.opnum = state->op_num,
1395                 };
1396         }
1397
1398         if (t->count.count == 0) {
1399                 TALLOC_FREE(t);
1400                 return NT_STATUS_OK;
1401         }
1402
1403         t->commands[t->count.count - 1].command |= DCERPC_SEC_VT_COMMAND_END;
1404
1405         if (DEBUGLEVEL >= 10) {
1406                 NDR_PRINT_DEBUG(dcerpc_sec_verification_trailer, t);
1407         }
1408
1409         ndr = ndr_push_init_ctx(state);
1410         if (ndr == NULL) {
1411                 return NT_STATUS_NO_MEMORY;
1412         }
1413
1414         ndr_err = ndr_push_dcerpc_sec_verification_trailer(ndr,
1415                                                 NDR_SCALARS | NDR_BUFFERS,
1416                                                 t);
1417         TALLOC_FREE(t);
1418         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1419                 return ndr_map_error2ntstatus(ndr_err);
1420         }
1421         state->req_trailer = ndr_push_blob(ndr);
1422
1423         align = state->req_data->length & 0x3;
1424         if (align > 0) {
1425                 pad = 4 - align;
1426         }
1427         if (pad > 0) {
1428                 bool ok;
1429                 uint8_t *p;
1430                 const uint8_t zeros[4] = { 0, };
1431
1432                 ok = data_blob_append(ndr, &state->req_trailer, zeros, pad);
1433                 if (!ok) {
1434                         return NT_STATUS_NO_MEMORY;
1435                 }
1436
1437                 /* move the padding to the start */
1438                 p = state->req_trailer.data;
1439                 memmove(p + pad, p, state->req_trailer.length - pad);
1440                 memset(p, 0, pad);
1441         }
1442
1443         return NT_STATUS_OK;
1444 }
1445
1446 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1447                                   bool *is_last_frag)
1448 {
1449         size_t auth_len;
1450         size_t frag_len;
1451         uint8_t flags = 0;
1452         size_t pad_len;
1453         size_t data_left;
1454         size_t data_thistime;
1455         size_t trailer_left;
1456         size_t trailer_thistime = 0;
1457         size_t total_left;
1458         size_t total_thistime;
1459         NTSTATUS status;
1460         bool ok;
1461         union dcerpc_payload u;
1462
1463         data_left = state->req_data->length - state->req_data_sent;
1464         trailer_left = state->req_trailer.length - state->req_trailer_sent;
1465         total_left = data_left + trailer_left;
1466         if ((total_left < data_left) || (total_left < trailer_left)) {
1467                 /*
1468                  * overflow
1469                  */
1470                 return NT_STATUS_INVALID_PARAMETER_MIX;
1471         }
1472
1473         status = dcerpc_guess_sizes(state->cli->auth,
1474                                     DCERPC_REQUEST_LENGTH, total_left,
1475                                     state->cli->max_xmit_frag,
1476                                     &total_thistime,
1477                                     &frag_len, &auth_len, &pad_len);
1478         if (!NT_STATUS_IS_OK(status)) {
1479                 return status;
1480         }
1481
1482         if (state->req_data_sent == 0) {
1483                 flags = DCERPC_PFC_FLAG_FIRST;
1484         }
1485
1486         if (total_thistime == total_left) {
1487                 flags |= DCERPC_PFC_FLAG_LAST;
1488         }
1489
1490         data_thistime = MIN(total_thistime, data_left);
1491         if (data_thistime < total_thistime) {
1492                 trailer_thistime = total_thistime - data_thistime;
1493         }
1494
1495         data_blob_free(&state->rpc_out);
1496
1497         u = (union dcerpc_payload) {
1498                 .request.alloc_hint     = total_left,
1499                 .request.context_id     = 0,
1500                 .request.opnum          = state->op_num,
1501         };
1502
1503         if (state->object_uuid) {
1504                 flags |= DCERPC_PFC_FLAG_OBJECT_UUID;
1505                 u.request.object.object = *state->object_uuid;
1506                 frag_len += ndr_size_GUID(state->object_uuid, 0);
1507         }
1508
1509         status = dcerpc_push_ncacn_packet(state,
1510                                           DCERPC_PKT_REQUEST,
1511                                           flags,
1512                                           auth_len,
1513                                           state->call_id,
1514                                           &u,
1515                                           &state->rpc_out);
1516         if (!NT_STATUS_IS_OK(status)) {
1517                 return status;
1518         }
1519
1520         /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1521          * compute it right for requests because the auth trailer is missing
1522          * at this stage */
1523         dcerpc_set_frag_length(&state->rpc_out, frag_len);
1524
1525         if (data_thistime > 0) {
1526                 /* Copy in the data. */
1527                 ok = data_blob_append(NULL, &state->rpc_out,
1528                                 state->req_data->data + state->req_data_sent,
1529                                 data_thistime);
1530                 if (!ok) {
1531                         return NT_STATUS_NO_MEMORY;
1532                 }
1533                 state->req_data_sent += data_thistime;
1534         }
1535
1536         if (trailer_thistime > 0) {
1537                 /* Copy in the verification trailer. */
1538                 ok = data_blob_append(NULL, &state->rpc_out,
1539                                 state->req_trailer.data + state->req_trailer_sent,
1540                                 trailer_thistime);
1541                 if (!ok) {
1542                         return NT_STATUS_NO_MEMORY;
1543                 }
1544                 state->req_trailer_sent += trailer_thistime;
1545         }
1546
1547         switch (state->cli->auth->auth_level) {
1548         case DCERPC_AUTH_LEVEL_NONE:
1549         case DCERPC_AUTH_LEVEL_CONNECT:
1550                 break;
1551         case DCERPC_AUTH_LEVEL_PACKET:
1552         case DCERPC_AUTH_LEVEL_INTEGRITY:
1553         case DCERPC_AUTH_LEVEL_PRIVACY:
1554                 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1555                                                 &state->rpc_out);
1556                 if (!NT_STATUS_IS_OK(status)) {
1557                         return status;
1558                 }
1559                 break;
1560         default:
1561                 return NT_STATUS_INVALID_PARAMETER;
1562         }
1563
1564         *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1565
1566         return status;
1567 }
1568
1569 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1570 {
1571         struct tevent_req *req = tevent_req_callback_data(
1572                 subreq, struct tevent_req);
1573         struct rpc_api_pipe_req_state *state = tevent_req_data(
1574                 req, struct rpc_api_pipe_req_state);
1575         NTSTATUS status;
1576         bool is_last_frag;
1577
1578         status = rpc_write_recv(subreq);
1579         TALLOC_FREE(subreq);
1580         if (tevent_req_nterror(req, status)) {
1581                 return;
1582         }
1583
1584         status = prepare_next_frag(state, &is_last_frag);
1585         if (tevent_req_nterror(req, status)) {
1586                 return;
1587         }
1588
1589         if (is_last_frag) {
1590                 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1591                                            &state->rpc_out,
1592                                            DCERPC_PKT_RESPONSE,
1593                                            state->call_id);
1594                 if (tevent_req_nomem(subreq, req)) {
1595                         return;
1596                 }
1597                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1598         } else {
1599                 subreq = rpc_write_send(state, state->ev,
1600                                         state->cli->transport,
1601                                         state->rpc_out.data,
1602                                         state->rpc_out.length);
1603                 if (tevent_req_nomem(subreq, req)) {
1604                         return;
1605                 }
1606                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1607                                         req);
1608         }
1609 }
1610
1611 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1612 {
1613         struct tevent_req *req = tevent_req_callback_data(
1614                 subreq, struct tevent_req);
1615         struct rpc_api_pipe_req_state *state = tevent_req_data(
1616                 req, struct rpc_api_pipe_req_state);
1617         NTSTATUS status;
1618
1619         status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1620         TALLOC_FREE(subreq);
1621         if (tevent_req_nterror(req, status)) {
1622                 return;
1623         }
1624
1625         if (state->cli->auth == NULL) {
1626                 tevent_req_done(req);
1627                 return;
1628         }
1629
1630         if (state->verify_bitmask1) {
1631                 state->cli->auth->verified_bitmask1 = true;
1632         }
1633
1634         if (state->verify_pcontext) {
1635                 state->cli->verified_pcontext = true;
1636         }
1637
1638         tevent_req_done(req);
1639 }
1640
1641 static NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1642                                DATA_BLOB *reply_pdu)
1643 {
1644         struct rpc_api_pipe_req_state *state = tevent_req_data(
1645                 req, struct rpc_api_pipe_req_state);
1646         NTSTATUS status;
1647
1648         if (tevent_req_is_nterror(req, &status)) {
1649                 /*
1650                  * We always have to initialize to reply pdu, even if there is
1651                  * none. The rpccli_* caller routines expect this.
1652                  */
1653                 *reply_pdu = data_blob_null;
1654                 return status;
1655         }
1656
1657         /* return data to caller and assign it ownership of memory */
1658         reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1659         reply_pdu->length = state->reply_pdu.length;
1660         state->reply_pdu.length = 0;
1661
1662         return NT_STATUS_OK;
1663 }
1664
1665 /****************************************************************************
1666  Check the rpc bind acknowledge response.
1667 ****************************************************************************/
1668
1669 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1670                                 struct rpc_pipe_client *cli)
1671 {
1672         const struct ndr_syntax_id *transfer = &cli->transfer_syntax;
1673         struct dcerpc_ack_ctx ctx;
1674         bool equal;
1675
1676         if (r->secondary_address_size == 0) {
1677                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)\n"));
1678         }
1679
1680         if (r->num_results < 1 || !r->ctx_list) {
1681                 return false;
1682         }
1683
1684         ctx = r->ctx_list[0];
1685
1686         /* check the transfer syntax */
1687         equal = ndr_syntax_id_equal(&ctx.syntax, transfer);
1688         if (!equal) {
1689                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1690                 return False;
1691         }
1692
1693         if (ctx.result != DCERPC_BIND_ACK_RESULT_ACCEPTANCE) {
1694                 DBG_NOTICE("bind denied result: %d reason: %x\n",
1695                            ctx.result, ctx.reason.value);
1696                 return false;
1697         }
1698
1699         if (r->num_results >= 2) {
1700                 const struct dcerpc_ack_ctx *neg = &r->ctx_list[1];
1701
1702                 if (neg->result == DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK) {
1703                         cli->bind_time_features = neg->reason.negotiate;
1704                 } else {
1705                         DBG_DEBUG("bind_time_feature failed - "
1706                                   "result: %d reason %x\n",
1707                                   neg->result, neg->reason.value);
1708                 }
1709         }
1710
1711         DEBUG(5,("check_bind_response: accepted!\n"));
1712         return True;
1713 }
1714
1715 /*******************************************************************
1716  Creates a DCE/RPC bind authentication response.
1717  This is the packet that is sent back to the server once we
1718  have received a BIND-ACK, to finish the third leg of
1719  the authentication handshake.
1720  ********************************************************************/
1721
1722 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1723                                 struct rpc_pipe_client *cli,
1724                                 struct pipe_auth_data *auth,
1725                                 uint32_t rpc_call_id,
1726                                 DATA_BLOB *pauth_blob,
1727                                 DATA_BLOB *rpc_out)
1728 {
1729         NTSTATUS status;
1730         union dcerpc_payload u = { .auth3._pad = 0, };
1731
1732         status = dcerpc_push_dcerpc_auth(mem_ctx,
1733                                          auth->auth_type,
1734                                          auth->auth_level,
1735                                          0, /* auth_pad_length */
1736                                          auth->auth_context_id,
1737                                          pauth_blob,
1738                                          &u.auth3.auth_info);
1739         if (!NT_STATUS_IS_OK(status)) {
1740                 return status;
1741         }
1742
1743         status = dcerpc_push_ncacn_packet(mem_ctx,
1744                                           DCERPC_PKT_AUTH3,
1745                                           DCERPC_PFC_FLAG_FIRST |
1746                                           DCERPC_PFC_FLAG_LAST,
1747                                           pauth_blob->length,
1748                                           rpc_call_id,
1749                                           &u,
1750                                           rpc_out);
1751         data_blob_free(&u.auth3.auth_info);
1752         if (!NT_STATUS_IS_OK(status)) {
1753                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1754                 return status;
1755         }
1756
1757         return NT_STATUS_OK;
1758 }
1759
1760 /*******************************************************************
1761  Creates a DCE/RPC bind alter context authentication request which
1762  may contain a spnego auth blob
1763  ********************************************************************/
1764
1765 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1766                                         struct pipe_auth_data *auth,
1767                                         uint32_t rpc_call_id,
1768                                         const struct ndr_syntax_id *abstract,
1769                                         const struct ndr_syntax_id *transfer,
1770                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1771                                         DATA_BLOB *rpc_out)
1772 {
1773         DATA_BLOB auth_info;
1774         NTSTATUS status;
1775
1776         status = dcerpc_push_dcerpc_auth(mem_ctx,
1777                                          auth->auth_type,
1778                                          auth->auth_level,
1779                                          0, /* auth_pad_length */
1780                                          auth->auth_context_id,
1781                                          pauth_blob,
1782                                          &auth_info);
1783         if (!NT_STATUS_IS_OK(status)) {
1784                 return status;
1785         }
1786
1787         status = create_bind_or_alt_ctx_internal(mem_ctx,
1788                                                  DCERPC_PKT_ALTER,
1789                                                  rpc_call_id,
1790                                                  abstract,
1791                                                  transfer,
1792                                                  &auth_info,
1793                                                  false, /* client_hdr_signing */
1794                                                  rpc_out);
1795         data_blob_free(&auth_info);
1796         return status;
1797 }
1798
1799 /****************************************************************************
1800  Do an rpc bind.
1801 ****************************************************************************/
1802
1803 struct rpc_pipe_bind_state {
1804         struct tevent_context *ev;
1805         struct rpc_pipe_client *cli;
1806         DATA_BLOB rpc_out;
1807         bool auth3;
1808         uint32_t rpc_call_id;
1809 };
1810
1811 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1812 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1813                                    struct rpc_pipe_bind_state *state,
1814                                    DATA_BLOB *credentials);
1815 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1816                                      struct rpc_pipe_bind_state *state,
1817                                      DATA_BLOB *credentials);
1818
1819 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1820                                       struct tevent_context *ev,
1821                                       struct rpc_pipe_client *cli,
1822                                       struct pipe_auth_data *auth)
1823 {
1824         struct tevent_req *req, *subreq;
1825         struct rpc_pipe_bind_state *state;
1826         NTSTATUS status;
1827
1828         req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1829         if (req == NULL) {
1830                 return NULL;
1831         }
1832
1833         DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1834                 rpccli_pipe_txt(talloc_tos(), cli),
1835                 (unsigned int)auth->auth_type,
1836                 (unsigned int)auth->auth_level ));
1837
1838         state->ev = ev;
1839         state->cli = cli;
1840         state->rpc_call_id = get_rpc_call_id();
1841
1842         cli->auth = talloc_move(cli, &auth);
1843
1844         /* Marshall the outgoing data. */
1845         status = create_rpc_bind_req(state, cli,
1846                                      cli->auth,
1847                                      state->rpc_call_id,
1848                                      &cli->abstract_syntax,
1849                                      &cli->transfer_syntax,
1850                                      &state->rpc_out);
1851
1852         if (!NT_STATUS_IS_OK(status) &&
1853             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1854                 tevent_req_nterror(req, status);
1855                 return tevent_req_post(req, ev);
1856         }
1857
1858         subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1859                                    DCERPC_PKT_BIND_ACK, state->rpc_call_id);
1860         if (tevent_req_nomem(subreq, req)) {
1861                 return tevent_req_post(req, ev);
1862         }
1863         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1864         return req;
1865 }
1866
1867 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1868 {
1869         struct tevent_req *req = tevent_req_callback_data(
1870                 subreq, struct tevent_req);
1871         struct rpc_pipe_bind_state *state = tevent_req_data(
1872                 req, struct rpc_pipe_bind_state);
1873         struct pipe_auth_data *pauth = state->cli->auth;
1874         struct gensec_security *gensec_security;
1875         struct ncacn_packet *pkt = NULL;
1876         struct dcerpc_auth auth;
1877         DATA_BLOB auth_token = { .data = NULL };
1878         NTSTATUS status;
1879
1880         status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1881         TALLOC_FREE(subreq);
1882         if (tevent_req_nterror(req, status)) {
1883                 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1884                           rpccli_pipe_txt(talloc_tos(), state->cli),
1885                           nt_errstr(status)));
1886                 return;
1887         }
1888
1889         if (state->auth3) {
1890                 tevent_req_done(req);
1891                 return;
1892         }
1893
1894         if (!check_bind_response(&pkt->u.bind_ack, state->cli)) {
1895                 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1896                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1897                 return;
1898         }
1899
1900         if (pkt->ptype == DCERPC_PKT_BIND_ACK) {
1901                 if (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN) {
1902                         if (pauth->client_hdr_signing) {
1903                                 pauth->hdr_signing = true;
1904                         }
1905                 }
1906         }
1907
1908         state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1909
1910         if (pauth->auth_type == DCERPC_AUTH_TYPE_NONE) {
1911                 /* Bind complete. */
1912                 tevent_req_done(req);
1913                 return;
1914         }
1915
1916         if (pkt->auth_length == 0) {
1917                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1918                 return;
1919         }
1920
1921         /* get auth credentials */
1922         status = dcerpc_pull_auth_trailer(pkt, talloc_tos(),
1923                                           &pkt->u.bind_ack.auth_info,
1924                                           &auth, NULL, true);
1925         if (tevent_req_nterror(req, status)) {
1926                 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1927                           nt_errstr(status)));
1928                 return;
1929         }
1930
1931         if (auth.auth_type != pauth->auth_type) {
1932                 DBG_ERR("Auth type %u mismatch expected %u.\n",
1933                         auth.auth_type, pauth->auth_type);
1934                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1935                 return;
1936         }
1937
1938         if (auth.auth_level != pauth->auth_level) {
1939                 DBG_ERR("Auth level %u mismatch expected %u.\n",
1940                         auth.auth_level, pauth->auth_level);
1941                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1942                 return;
1943         }
1944
1945         if (auth.auth_context_id != pauth->auth_context_id) {
1946                 DBG_ERR("Auth context id %"PRIu32" mismatch "
1947                         "expected %"PRIu32".\n",
1948                         auth.auth_context_id,
1949                         pauth->auth_context_id);
1950                 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1951                 return;
1952         }
1953
1954         /*
1955          * For authenticated binds we may need to do 3 or 4 leg binds.
1956          */
1957
1958         if (pauth->auth_type == DCERPC_AUTH_TYPE_NONE) {
1959                 /* Bind complete. */
1960                 tevent_req_done(req);
1961                 return;
1962         }
1963
1964         gensec_security = pauth->auth_ctx;
1965
1966         status = gensec_update(gensec_security, state,
1967                                auth.credentials, &auth_token);
1968         if (NT_STATUS_EQUAL(status,
1969                             NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1970                 status = rpc_bind_next_send(req, state,
1971                                             &auth_token);
1972         } else if (NT_STATUS_IS_OK(status)) {
1973                 if (pauth->hdr_signing) {
1974                         gensec_want_feature(gensec_security,
1975                                             GENSEC_FEATURE_SIGN_PKT_HEADER);
1976                 }
1977
1978                 if (auth_token.length == 0) {
1979                         /* Bind complete. */
1980                         tevent_req_done(req);
1981                         return;
1982                 }
1983                 status = rpc_bind_finish_send(req, state,
1984                                               &auth_token);
1985         }
1986
1987         if (!NT_STATUS_IS_OK(status)) {
1988                 tevent_req_nterror(req, status);
1989         }
1990         return;
1991 }
1992
1993 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1994                                    struct rpc_pipe_bind_state *state,
1995                                    DATA_BLOB *auth_token)
1996 {
1997         struct pipe_auth_data *auth = state->cli->auth;
1998         struct tevent_req *subreq;
1999         NTSTATUS status;
2000
2001         /* Now prepare the alter context pdu. */
2002         data_blob_free(&state->rpc_out);
2003
2004         status = create_rpc_alter_context(state, auth,
2005                                           state->rpc_call_id,
2006                                           &state->cli->abstract_syntax,
2007                                           &state->cli->transfer_syntax,
2008                                           auth_token,
2009                                           &state->rpc_out);
2010         if (!NT_STATUS_IS_OK(status)) {
2011                 return status;
2012         }
2013
2014         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2015                                    &state->rpc_out, DCERPC_PKT_ALTER_RESP,
2016                                    state->rpc_call_id);
2017         if (subreq == NULL) {
2018                 return NT_STATUS_NO_MEMORY;
2019         }
2020         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2021         return NT_STATUS_OK;
2022 }
2023
2024 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
2025                                      struct rpc_pipe_bind_state *state,
2026                                      DATA_BLOB *auth_token)
2027 {
2028         struct pipe_auth_data *auth = state->cli->auth;
2029         struct tevent_req *subreq;
2030         NTSTATUS status;
2031
2032         state->auth3 = true;
2033
2034         /* Now prepare the auth3 context pdu. */
2035         data_blob_free(&state->rpc_out);
2036
2037         status = create_rpc_bind_auth3(state, state->cli, auth,
2038                                         state->rpc_call_id,
2039                                         auth_token,
2040                                         &state->rpc_out);
2041         if (!NT_STATUS_IS_OK(status)) {
2042                 return status;
2043         }
2044
2045         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2046                                    &state->rpc_out, DCERPC_PKT_AUTH3,
2047                                    state->rpc_call_id);
2048         if (subreq == NULL) {
2049                 return NT_STATUS_NO_MEMORY;
2050         }
2051         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2052         return NT_STATUS_OK;
2053 }
2054
2055 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
2056 {
2057         return tevent_req_simple_recv_ntstatus(req);
2058 }
2059
2060 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
2061                        struct pipe_auth_data *auth)
2062 {
2063         TALLOC_CTX *frame = talloc_stackframe();
2064         struct tevent_context *ev;
2065         struct tevent_req *req;
2066         NTSTATUS status = NT_STATUS_OK;
2067
2068         ev = samba_tevent_context_init(frame);
2069         if (ev == NULL) {
2070                 status = NT_STATUS_NO_MEMORY;
2071                 goto fail;
2072         }
2073
2074         req = rpc_pipe_bind_send(frame, ev, cli, auth);
2075         if (req == NULL) {
2076                 status = NT_STATUS_NO_MEMORY;
2077                 goto fail;
2078         }
2079
2080         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2081                 goto fail;
2082         }
2083
2084         status = rpc_pipe_bind_recv(req);
2085  fail:
2086         TALLOC_FREE(frame);
2087         return status;
2088 }
2089
2090 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
2091
2092 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
2093                                 unsigned int timeout)
2094 {
2095         if (rpc_cli == NULL) {
2096                 return RPCCLI_DEFAULT_TIMEOUT;
2097         }
2098
2099         if (rpc_cli->binding_handle == NULL) {
2100                 return RPCCLI_DEFAULT_TIMEOUT;
2101         }
2102
2103         return dcerpc_binding_handle_set_timeout(rpc_cli->binding_handle,
2104                                                  timeout);
2105 }
2106
2107 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
2108 {
2109         if (rpc_cli == NULL) {
2110                 return false;
2111         }
2112
2113         if (rpc_cli->binding_handle == NULL) {
2114                 return false;
2115         }
2116
2117         return dcerpc_binding_handle_is_connected(rpc_cli->binding_handle);
2118 }
2119
2120 struct rpccli_bh_state {
2121         struct rpc_pipe_client *rpc_cli;
2122 };
2123
2124 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
2125 {
2126         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2127                                      struct rpccli_bh_state);
2128         struct rpc_cli_transport *transport = hs->rpc_cli->transport;
2129
2130         if (transport == NULL) {
2131                 return false;
2132         }
2133
2134         if (transport->is_connected == NULL) {
2135                 return false;
2136         }
2137
2138         return transport->is_connected(transport->priv);
2139 }
2140
2141 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
2142                                       uint32_t timeout)
2143 {
2144         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2145                                      struct rpccli_bh_state);
2146         struct rpc_cli_transport *transport = hs->rpc_cli->transport;
2147         unsigned int old;
2148
2149         if (transport == NULL) {
2150                 return RPCCLI_DEFAULT_TIMEOUT;
2151         }
2152
2153         if (transport->set_timeout == NULL) {
2154                 return RPCCLI_DEFAULT_TIMEOUT;
2155         }
2156
2157         old = transport->set_timeout(transport->priv, timeout);
2158         if (old == 0) {
2159                 return RPCCLI_DEFAULT_TIMEOUT;
2160         }
2161
2162         return old;
2163 }
2164
2165 static void rpccli_bh_auth_info(struct dcerpc_binding_handle *h,
2166                                 enum dcerpc_AuthType *auth_type,
2167                                 enum dcerpc_AuthLevel *auth_level)
2168 {
2169         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2170                                      struct rpccli_bh_state);
2171
2172         if (hs->rpc_cli == NULL) {
2173                 return;
2174         }
2175
2176         if (hs->rpc_cli->auth == NULL) {
2177                 return;
2178         }
2179
2180         *auth_type = hs->rpc_cli->auth->auth_type;
2181         *auth_level = hs->rpc_cli->auth->auth_level;
2182 }
2183
2184 struct rpccli_bh_raw_call_state {
2185         DATA_BLOB in_data;
2186         DATA_BLOB out_data;
2187         uint32_t out_flags;
2188 };
2189
2190 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
2191
2192 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
2193                                                   struct tevent_context *ev,
2194                                                   struct dcerpc_binding_handle *h,
2195                                                   const struct GUID *object,
2196                                                   uint32_t opnum,
2197                                                   uint32_t in_flags,
2198                                                   const uint8_t *in_data,
2199                                                   size_t in_length)
2200 {
2201         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2202                                      struct rpccli_bh_state);
2203         struct tevent_req *req;
2204         struct rpccli_bh_raw_call_state *state;
2205         bool ok;
2206         struct tevent_req *subreq;
2207
2208         req = tevent_req_create(mem_ctx, &state,
2209                                 struct rpccli_bh_raw_call_state);
2210         if (req == NULL) {
2211                 return NULL;
2212         }
2213         state->in_data.data = discard_const_p(uint8_t, in_data);
2214         state->in_data.length = in_length;
2215
2216         ok = rpccli_bh_is_connected(h);
2217         if (!ok) {
2218                 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2219                 return tevent_req_post(req, ev);
2220         }
2221
2222         subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
2223                                        opnum, object, &state->in_data);
2224         if (tevent_req_nomem(subreq, req)) {
2225                 return tevent_req_post(req, ev);
2226         }
2227         tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
2228
2229         return req;
2230 }
2231
2232 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
2233 {
2234         struct tevent_req *req =
2235                 tevent_req_callback_data(subreq,
2236                 struct tevent_req);
2237         struct rpccli_bh_raw_call_state *state =
2238                 tevent_req_data(req,
2239                 struct rpccli_bh_raw_call_state);
2240         NTSTATUS status;
2241
2242         state->out_flags = 0;
2243
2244         /* TODO: support bigendian responses */
2245
2246         status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
2247         TALLOC_FREE(subreq);
2248         if (tevent_req_nterror(req, status)) {
2249                 return;
2250         }
2251
2252         tevent_req_done(req);
2253 }
2254
2255 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
2256                                         TALLOC_CTX *mem_ctx,
2257                                         uint8_t **out_data,
2258                                         size_t *out_length,
2259                                         uint32_t *out_flags)
2260 {
2261         struct rpccli_bh_raw_call_state *state =
2262                 tevent_req_data(req,
2263                 struct rpccli_bh_raw_call_state);
2264         NTSTATUS status;
2265
2266         if (tevent_req_is_nterror(req, &status)) {
2267                 tevent_req_received(req);
2268                 return status;
2269         }
2270
2271         *out_data = talloc_move(mem_ctx, &state->out_data.data);
2272         *out_length = state->out_data.length;
2273         *out_flags = state->out_flags;
2274         tevent_req_received(req);
2275         return NT_STATUS_OK;
2276 }
2277
2278 struct rpccli_bh_disconnect_state {
2279         uint8_t _dummy;
2280 };
2281
2282 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
2283                                                 struct tevent_context *ev,
2284                                                 struct dcerpc_binding_handle *h)
2285 {
2286         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2287                                      struct rpccli_bh_state);
2288         struct tevent_req *req;
2289         struct rpccli_bh_disconnect_state *state;
2290         bool ok;
2291
2292         req = tevent_req_create(mem_ctx, &state,
2293                                 struct rpccli_bh_disconnect_state);
2294         if (req == NULL) {
2295                 return NULL;
2296         }
2297
2298         ok = rpccli_bh_is_connected(h);
2299         if (!ok) {
2300                 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2301                 return tevent_req_post(req, ev);
2302         }
2303
2304         /*
2305          * TODO: do a real async disconnect ...
2306          *
2307          * For now we do it sync...
2308          */
2309         TALLOC_FREE(hs->rpc_cli->transport);
2310         hs->rpc_cli = NULL;
2311
2312         tevent_req_done(req);
2313         return tevent_req_post(req, ev);
2314 }
2315
2316 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2317 {
2318         return tevent_req_simple_recv_ntstatus(req);
2319 }
2320
2321 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2322 {
2323         return true;
2324 }
2325
2326 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2327                                    ndr_flags_type ndr_flags,
2328                                    const void *_struct_ptr,
2329                                    const struct ndr_interface_call *call)
2330 {
2331         void *struct_ptr = discard_const(_struct_ptr);
2332
2333         if (DEBUGLEVEL < 10) {
2334                 return;
2335         }
2336
2337         if (ndr_flags & NDR_IN) {
2338                 ndr_print_function_debug(call->ndr_print,
2339                                          call->name,
2340                                          ndr_flags,
2341                                          struct_ptr);
2342         }
2343         if (ndr_flags & NDR_OUT) {
2344                 ndr_print_function_debug(call->ndr_print,
2345                                          call->name,
2346                                          ndr_flags,
2347                                          struct_ptr);
2348         }
2349 }
2350
2351 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2352         .name                   = "rpccli",
2353         .is_connected           = rpccli_bh_is_connected,
2354         .set_timeout            = rpccli_bh_set_timeout,
2355         .auth_info              = rpccli_bh_auth_info,
2356         .raw_call_send          = rpccli_bh_raw_call_send,
2357         .raw_call_recv          = rpccli_bh_raw_call_recv,
2358         .disconnect_send        = rpccli_bh_disconnect_send,
2359         .disconnect_recv        = rpccli_bh_disconnect_recv,
2360
2361         .ref_alloc              = rpccli_bh_ref_alloc,
2362         .do_ndr_print           = rpccli_bh_do_ndr_print,
2363 };
2364
2365 /* initialise a rpc_pipe_client binding handle */
2366 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c,
2367                                         const struct GUID *object,
2368                                         const struct ndr_interface_table *table)
2369 {
2370         struct dcerpc_binding_handle *h;
2371         struct rpccli_bh_state *hs;
2372
2373         h = dcerpc_binding_handle_create(c,
2374                                          &rpccli_bh_ops,
2375                                          object,
2376                                          table,
2377                                          &hs,
2378                                          struct rpccli_bh_state,
2379                                          __location__);
2380         if (h == NULL) {
2381                 return NULL;
2382         }
2383         hs->rpc_cli = c;
2384
2385         return h;
2386 }
2387
2388 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2389                                struct pipe_auth_data **presult)
2390 {
2391         struct pipe_auth_data *result;
2392         struct auth_generic_state *auth_generic_ctx;
2393         NTSTATUS status;
2394
2395         result = talloc_zero(mem_ctx, struct pipe_auth_data);
2396         if (result == NULL) {
2397                 return NT_STATUS_NO_MEMORY;
2398         }
2399
2400         result->auth_type = DCERPC_AUTH_TYPE_NONE;
2401         result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2402         result->auth_context_id = 0;
2403
2404         status = auth_generic_client_prepare(result,
2405                                              &auth_generic_ctx);
2406         if (!NT_STATUS_IS_OK(status)) {
2407                 DEBUG(1, ("Failed to create auth_generic context: %s\n",
2408                           nt_errstr(status)));
2409         }
2410
2411         status = auth_generic_set_username(auth_generic_ctx, "");
2412         if (!NT_STATUS_IS_OK(status)) {
2413                 DEBUG(1, ("Failed to set username: %s\n",
2414                           nt_errstr(status)));
2415         }
2416
2417         status = auth_generic_set_domain(auth_generic_ctx, "");
2418         if (!NT_STATUS_IS_OK(status)) {
2419                 DEBUG(1, ("Failed to set domain: %s\n",
2420                           nt_errstr(status)));
2421                 return status;
2422         }
2423
2424         status = gensec_set_credentials(auth_generic_ctx->gensec_security,
2425                                         auth_generic_ctx->credentials);
2426         if (!NT_STATUS_IS_OK(status)) {
2427                 DEBUG(1, ("Failed to set GENSEC credentials: %s\n",
2428                           nt_errstr(status)));
2429                 return status;
2430         }
2431         talloc_unlink(auth_generic_ctx, auth_generic_ctx->credentials);
2432         auth_generic_ctx->credentials = NULL;
2433
2434         result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2435         talloc_free(auth_generic_ctx);
2436         *presult = result;
2437         return NT_STATUS_OK;
2438 }
2439
2440 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2441                                          enum dcerpc_AuthType auth_type,
2442                                          enum dcerpc_AuthLevel auth_level,
2443                                          const char *server,
2444                                          const char *target_service,
2445                                          const char *domain,
2446                                          const char *username,
2447                                          const char *password,
2448                                          enum credentials_use_kerberos use_kerberos,
2449                                          struct netlogon_creds_CredentialState *creds,
2450                                          struct pipe_auth_data **presult)
2451 {
2452         struct auth_generic_state *auth_generic_ctx;
2453         struct pipe_auth_data *result;
2454         NTSTATUS status;
2455
2456         result = talloc_zero(mem_ctx, struct pipe_auth_data);
2457         if (result == NULL) {
2458                 return NT_STATUS_NO_MEMORY;
2459         }
2460
2461         result->auth_type = auth_type;
2462         result->auth_level = auth_level;
2463         result->auth_context_id = 1;
2464
2465         status = auth_generic_client_prepare(result,
2466                                              &auth_generic_ctx);
2467         if (!NT_STATUS_IS_OK(status)) {
2468                 goto fail;
2469         }
2470
2471         status = auth_generic_set_username(auth_generic_ctx, username);
2472         if (!NT_STATUS_IS_OK(status)) {
2473                 goto fail;
2474         }
2475
2476         status = auth_generic_set_domain(auth_generic_ctx, domain);
2477         if (!NT_STATUS_IS_OK(status)) {
2478                 goto fail;
2479         }
2480
2481         status = auth_generic_set_password(auth_generic_ctx, password);
2482         if (!NT_STATUS_IS_OK(status)) {
2483                 goto fail;
2484         }
2485
2486         status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2487         if (!NT_STATUS_IS_OK(status)) {
2488                 goto fail;
2489         }
2490
2491         status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2492         if (!NT_STATUS_IS_OK(status)) {
2493                 goto fail;
2494         }
2495
2496         cli_credentials_set_kerberos_state(auth_generic_ctx->credentials,
2497                                            use_kerberos,
2498                                            CRED_SPECIFIED);
2499         cli_credentials_set_netlogon_creds(auth_generic_ctx->credentials, creds);
2500
2501         status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2502         if (!NT_STATUS_IS_OK(status)) {
2503                 goto fail;
2504         }
2505
2506         result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2507         talloc_free(auth_generic_ctx);
2508         *presult = result;
2509         return NT_STATUS_OK;
2510
2511  fail:
2512         TALLOC_FREE(result);
2513         return status;
2514 }
2515
2516 /* This routine steals the creds pointer that is passed in */
2517 static NTSTATUS rpccli_generic_bind_data_from_creds(TALLOC_CTX *mem_ctx,
2518                                                     enum dcerpc_AuthType auth_type,
2519                                                     enum dcerpc_AuthLevel auth_level,
2520                                                     const char *server,
2521                                                     const char *target_service,
2522                                                     struct cli_credentials *creds,
2523                                                     struct pipe_auth_data **presult)
2524 {
2525         struct auth_generic_state *auth_generic_ctx;
2526         struct pipe_auth_data *result;
2527         NTSTATUS status;
2528
2529         result = talloc_zero(mem_ctx, struct pipe_auth_data);
2530         if (result == NULL) {
2531                 return NT_STATUS_NO_MEMORY;
2532         }
2533
2534         result->auth_type = auth_type;
2535         result->auth_level = auth_level;
2536         result->auth_context_id = 1;
2537
2538         status = auth_generic_client_prepare(result,
2539                                              &auth_generic_ctx);
2540         if (!NT_STATUS_IS_OK(status)) {
2541                 goto fail;
2542         }
2543
2544         status = auth_generic_set_creds(auth_generic_ctx, creds);
2545         if (!NT_STATUS_IS_OK(status)) {
2546                 goto fail;
2547         }
2548
2549         status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2550         if (!NT_STATUS_IS_OK(status)) {
2551                 goto fail;
2552         }
2553
2554         status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2555         if (!NT_STATUS_IS_OK(status)) {
2556                 goto fail;
2557         }
2558
2559         status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2560         if (!NT_STATUS_IS_OK(status)) {
2561                 goto fail;
2562         }
2563
2564         result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2565         talloc_free(auth_generic_ctx);
2566         *presult = result;
2567         return NT_STATUS_OK;
2568
2569  fail:
2570         TALLOC_FREE(result);
2571         return status;
2572 }
2573
2574 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2575                                   struct pipe_auth_data **presult)
2576 {
2577         return rpccli_generic_bind_data(mem_ctx,
2578                                         DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM,
2579                                         DCERPC_AUTH_LEVEL_CONNECT,
2580                                         NULL, /* server */
2581                                         "host", /* target_service */
2582                                         NAME_NT_AUTHORITY, /* domain */
2583                                         "SYSTEM",
2584                                         NULL, /* password */
2585                                         CRED_USE_KERBEROS_DISABLED,
2586                                         NULL, /* netlogon_creds_CredentialState */
2587                                         presult);
2588 }
2589
2590 /**
2591  * Create an rpc pipe client struct, connecting to a tcp port.
2592  */
2593 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2594                                        const struct sockaddr_storage *ss_addr,
2595                                        uint16_t port,
2596                                        const struct ndr_interface_table *table,
2597                                        struct rpc_pipe_client **presult)
2598 {
2599         struct rpc_pipe_client *result;
2600         struct sockaddr_storage addr;
2601         NTSTATUS status;
2602         int fd;
2603
2604         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2605         if (result == NULL) {
2606                 return NT_STATUS_NO_MEMORY;
2607         }
2608
2609         result->abstract_syntax = table->syntax_id;
2610         result->transfer_syntax = ndr_transfer_syntax_ndr;
2611
2612         result->desthost = talloc_strdup(result, host);
2613         if (result->desthost == NULL) {
2614                 status = NT_STATUS_NO_MEMORY;
2615                 goto fail;
2616         }
2617
2618         result->srv_name_slash = talloc_asprintf_strupper_m(
2619                 result, "\\\\%s", result->desthost);
2620         if (result->srv_name_slash == NULL) {
2621                 status = NT_STATUS_NO_MEMORY;
2622                 goto fail;
2623         }
2624
2625         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2626
2627         if (ss_addr == NULL) {
2628                 if (!resolve_name(host, &addr, NBT_NAME_SERVER, false)) {
2629                         status = NT_STATUS_NOT_FOUND;
2630                         goto fail;
2631                 }
2632         } else {
2633                 addr = *ss_addr;
2634         }
2635
2636         status = open_socket_out(&addr, port, 60*1000, &fd);
2637         if (!NT_STATUS_IS_OK(status)) {
2638                 goto fail;
2639         }
2640         set_socket_options(fd, lp_socket_options());
2641
2642         status = rpc_transport_sock_init(result, fd, &result->transport);
2643         if (!NT_STATUS_IS_OK(status)) {
2644                 close(fd);
2645                 goto fail;
2646         }
2647
2648         result->transport->transport = NCACN_IP_TCP;
2649
2650         result->binding_handle = rpccli_bh_create(result, NULL, table);
2651         if (result->binding_handle == NULL) {
2652                 TALLOC_FREE(result);
2653                 return NT_STATUS_NO_MEMORY;
2654         }
2655
2656         *presult = result;
2657         return NT_STATUS_OK;
2658
2659  fail:
2660         TALLOC_FREE(result);
2661         return status;
2662 }
2663
2664 static NTSTATUS rpccli_epm_map_binding(
2665         struct dcerpc_binding_handle *epm_connection,
2666         struct dcerpc_binding *binding,
2667         TALLOC_CTX *mem_ctx,
2668         char **pendpoint)
2669 {
2670         TALLOC_CTX *frame = talloc_stackframe();
2671         enum dcerpc_transport_t transport =
2672                 dcerpc_binding_get_transport(binding);
2673         enum dcerpc_transport_t res_transport;
2674         struct dcerpc_binding *res_binding = NULL;
2675         struct epm_twr_t *map_tower = NULL;
2676         struct epm_twr_p_t res_towers = { .twr = NULL };
2677         struct policy_handle *entry_handle = NULL;
2678         uint32_t num_towers = 0;
2679         const uint32_t max_towers = 1;
2680         const char *endpoint = NULL;
2681         char *tmp = NULL;
2682         uint32_t result;
2683         NTSTATUS status;
2684
2685         map_tower = talloc_zero(frame, struct epm_twr_t);
2686         if (map_tower == NULL) {
2687                 goto nomem;
2688         }
2689
2690         status = dcerpc_binding_build_tower(
2691                 frame, binding, &(map_tower->tower));
2692         if (!NT_STATUS_IS_OK(status)) {
2693                 DBG_DEBUG("dcerpc_binding_build_tower failed: %s\n",
2694                           nt_errstr(status));
2695                 goto done;
2696         }
2697
2698         res_towers.twr = talloc_array(frame, struct epm_twr_t, max_towers);
2699         if (res_towers.twr == NULL) {
2700                 goto nomem;
2701         }
2702
2703         entry_handle = talloc_zero(frame, struct policy_handle);
2704         if (entry_handle == NULL) {
2705                 goto nomem;
2706         }
2707
2708         status = dcerpc_epm_Map(
2709                 epm_connection,
2710                 frame,
2711                 NULL,
2712                 map_tower,
2713                 entry_handle,
2714                 max_towers,
2715                 &num_towers,
2716                 &res_towers,
2717                 &result);
2718
2719         if (!NT_STATUS_IS_OK(status)) {
2720                 DBG_DEBUG("dcerpc_epm_Map failed: %s\n", nt_errstr(status));
2721                 goto done;
2722         }
2723
2724         if (result != EPMAPPER_STATUS_OK) {
2725                 DBG_DEBUG("dcerpc_epm_Map returned %"PRIu32"\n", result);
2726                 status = NT_STATUS_NOT_FOUND;
2727                 goto done;
2728         }
2729
2730         if (num_towers != 1) {
2731                 DBG_DEBUG("dcerpc_epm_Map returned %"PRIu32" towers\n",
2732                           num_towers);
2733                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2734                 goto done;
2735         }
2736
2737         status = dcerpc_binding_from_tower(
2738                 frame, &(res_towers.twr->tower), &res_binding);
2739         if (!NT_STATUS_IS_OK(status)) {
2740                 DBG_DEBUG("dcerpc_binding_from_tower failed: %s\n",
2741                           nt_errstr(status));
2742                 goto done;
2743         }
2744
2745         res_transport = dcerpc_binding_get_transport(res_binding);
2746         if (res_transport != transport) {
2747                 DBG_DEBUG("dcerpc_epm_Map returned transport %d, "
2748                           "expected %d\n",
2749                           (int)res_transport,
2750                           (int)transport);
2751                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2752                 goto done;
2753         }
2754
2755         endpoint = dcerpc_binding_get_string_option(res_binding, "endpoint");
2756         if (endpoint == NULL) {
2757                 DBG_DEBUG("dcerpc_epm_Map returned no endpoint\n");
2758                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2759                 goto done;
2760         }
2761
2762         tmp = talloc_strdup(mem_ctx, endpoint);
2763         if (tmp == NULL) {
2764                 goto nomem;
2765         }
2766         *pendpoint = tmp;
2767
2768         status = NT_STATUS_OK;
2769         goto done;
2770
2771 nomem:
2772         status = NT_STATUS_NO_MEMORY;
2773 done:
2774         TALLOC_FREE(frame);
2775         return status;
2776 }
2777
2778 static NTSTATUS rpccli_epm_map_interface(
2779         struct dcerpc_binding_handle *epm_connection,
2780         enum dcerpc_transport_t transport,
2781         const struct ndr_syntax_id *iface,
2782         TALLOC_CTX *mem_ctx,
2783         char **pendpoint)
2784 {
2785         struct dcerpc_binding *binding = NULL;
2786         char *endpoint = NULL;
2787         NTSTATUS status;
2788
2789         status = dcerpc_parse_binding(mem_ctx, "", &binding);
2790         if (!NT_STATUS_IS_OK(status)) {
2791                 DBG_DEBUG("dcerpc_parse_binding failed: %s\n",
2792                           nt_errstr(status));
2793                 goto done;
2794         }
2795
2796         status = dcerpc_binding_set_transport(binding, transport);
2797         if (!NT_STATUS_IS_OK(status)) {
2798                 DBG_DEBUG("dcerpc_binding_set_transport failed: %s\n",
2799                           nt_errstr(status));
2800                 goto done;
2801         }
2802
2803         status = dcerpc_binding_set_abstract_syntax(binding, iface);
2804         if (!NT_STATUS_IS_OK(status)) {
2805                 DBG_DEBUG("dcerpc_binding_set_abstract_syntax failed: %s\n",
2806                           nt_errstr(status));
2807                 goto done;
2808         }
2809
2810         status = rpccli_epm_map_binding(
2811                 epm_connection, binding, mem_ctx, &endpoint);
2812         if (!NT_STATUS_IS_OK(status)) {
2813                 DBG_DEBUG("rpccli_epm_map_binding failed: %s\n",
2814                           nt_errstr(status));
2815                 goto done;
2816         }
2817         *pendpoint = endpoint;
2818
2819 done:
2820         TALLOC_FREE(binding);
2821         return status;
2822 }
2823
2824 /**
2825  * Determine the tcp port on which a dcerpc interface is listening
2826  * for the ncacn_ip_tcp transport via the endpoint mapper of the
2827  * target host.
2828  */
2829 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2830                                       const struct sockaddr_storage *addr,
2831                                       const struct ndr_interface_table *table,
2832                                       uint16_t *pport)
2833 {
2834         NTSTATUS status;
2835         struct rpc_pipe_client *epm_pipe = NULL;
2836         struct pipe_auth_data *auth = NULL;
2837         char *endpoint = NULL;
2838         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2839
2840         if (pport == NULL) {
2841                 status = NT_STATUS_INVALID_PARAMETER;
2842                 goto done;
2843         }
2844
2845         if (ndr_syntax_id_equal(&table->syntax_id,
2846                                 &ndr_table_epmapper.syntax_id)) {
2847                 *pport = 135;
2848                 status = NT_STATUS_OK;
2849                 goto done;
2850         }
2851
2852         /* open the connection to the endpoint mapper */
2853         status = rpc_pipe_open_tcp_port(tmp_ctx, host, addr, 135,
2854                                         &ndr_table_epmapper,
2855                                         &epm_pipe);
2856
2857         if (!NT_STATUS_IS_OK(status)) {
2858                 goto done;
2859         }
2860
2861         status = rpccli_anon_bind_data(tmp_ctx, &auth);
2862         if (!NT_STATUS_IS_OK(status)) {
2863                 goto done;
2864         }
2865
2866         status = rpc_pipe_bind(epm_pipe, auth);
2867         if (!NT_STATUS_IS_OK(status)) {
2868                 goto done;
2869         }
2870
2871         status = rpccli_epm_map_interface(
2872                 epm_pipe->binding_handle,
2873                 NCACN_IP_TCP,
2874                 &table->syntax_id,
2875                 tmp_ctx,
2876                 &endpoint);
2877         if (!NT_STATUS_IS_OK(status)) {
2878                 DBG_DEBUG("rpccli_epm_map_interface failed: %s\n",
2879                           nt_errstr(status));
2880                 goto done;
2881         }
2882
2883         *pport = (uint16_t)atoi(endpoint);
2884
2885 done:
2886         TALLOC_FREE(tmp_ctx);
2887         return status;
2888 }
2889
2890 /**
2891  * Create a rpc pipe client struct, connecting to a host via tcp.
2892  * The port is determined by asking the endpoint mapper on the given
2893  * host.
2894  */
2895 static NTSTATUS rpc_pipe_open_tcp(
2896         TALLOC_CTX *mem_ctx,
2897         const char *host,
2898         const struct sockaddr_storage *addr,
2899         const struct ndr_interface_table *table,
2900         struct rpc_pipe_client **presult)
2901 {
2902         NTSTATUS status;
2903         uint16_t port = 0;
2904
2905         status = rpc_pipe_get_tcp_port(host, addr, table, &port);
2906         if (!NT_STATUS_IS_OK(status)) {
2907                 return status;
2908         }
2909
2910         return rpc_pipe_open_tcp_port(mem_ctx, host, addr, port,
2911                                       table, presult);
2912 }
2913
2914 static NTSTATUS rpc_pipe_get_ncalrpc_name(
2915         const struct ndr_syntax_id *iface,
2916         TALLOC_CTX *mem_ctx,
2917         char **psocket_name)
2918 {
2919         TALLOC_CTX *frame = talloc_stackframe();
2920         struct rpc_pipe_client *epm_pipe = NULL;
2921         struct pipe_auth_data *auth = NULL;
2922         NTSTATUS status = NT_STATUS_OK;
2923         bool is_epm;
2924
2925         is_epm = ndr_syntax_id_equal(iface, &ndr_table_epmapper.syntax_id);
2926         if (is_epm) {
2927                 char *endpoint = talloc_strdup(mem_ctx, "EPMAPPER");
2928                 if (endpoint == NULL) {
2929                         status = NT_STATUS_NO_MEMORY;
2930                         goto done;
2931                 }
2932                 *psocket_name = endpoint;
2933                 goto done;
2934         }
2935
2936         status = rpc_pipe_open_ncalrpc(
2937                 frame, &ndr_table_epmapper, &epm_pipe);
2938         if (!NT_STATUS_IS_OK(status)) {
2939                 DBG_DEBUG("rpc_pipe_open_ncalrpc failed: %s\n",
2940                           nt_errstr(status));
2941                 goto done;
2942         }
2943
2944         status = rpccli_anon_bind_data(epm_pipe, &auth);
2945         if (!NT_STATUS_IS_OK(status)) {
2946                 DBG_DEBUG("rpccli_anon_bind_data failed: %s\n",
2947                           nt_errstr(status));
2948                 goto done;
2949         }
2950
2951         status = rpc_pipe_bind(epm_pipe, auth);
2952         if (!NT_STATUS_IS_OK(status)) {
2953                 DBG_DEBUG("rpc_pipe_bind failed: %s\n", nt_errstr(status));
2954                 goto done;
2955         }
2956
2957         status = rpccli_epm_map_interface(
2958                 epm_pipe->binding_handle,
2959                 NCALRPC,
2960                 iface,
2961                 mem_ctx,
2962                 psocket_name);
2963         if (!NT_STATUS_IS_OK(status)) {
2964                 DBG_DEBUG("rpccli_epm_map_interface failed: %s\n",
2965                           nt_errstr(status));
2966         }
2967
2968 done:
2969         TALLOC_FREE(frame);
2970         return status;
2971 }
2972
2973 /********************************************************************
2974  Create a rpc pipe client struct, connecting to a unix domain socket
2975  ********************************************************************/
2976 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx,
2977                                const struct ndr_interface_table *table,
2978                                struct rpc_pipe_client **presult)
2979 {
2980         char *socket_name = NULL;
2981         struct rpc_pipe_client *result;
2982         struct sockaddr_un addr = { .sun_family = AF_UNIX };
2983         socklen_t salen = sizeof(addr);
2984         int pathlen;
2985         NTSTATUS status;
2986         int fd = -1;
2987
2988         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2989         if (result == NULL) {
2990                 return NT_STATUS_NO_MEMORY;
2991         }
2992
2993         status = rpc_pipe_get_ncalrpc_name(
2994                 &table->syntax_id, result, &socket_name);
2995         if (!NT_STATUS_IS_OK(status)) {
2996                 DBG_DEBUG("rpc_pipe_get_ncalrpc_name failed: %s\n",
2997                           nt_errstr(status));
2998                 goto fail;
2999         }
3000
3001         pathlen = snprintf(
3002                 addr.sun_path,
3003                 sizeof(addr.sun_path),
3004                 "%s/%s",
3005                 lp_ncalrpc_dir(),
3006                 socket_name);
3007         if ((pathlen < 0) || ((size_t)pathlen >= sizeof(addr.sun_path))) {
3008                 DBG_DEBUG("socket_path for %s too long\n", socket_name);
3009                 status = NT_STATUS_NAME_TOO_LONG;
3010                 goto fail;
3011         }
3012         TALLOC_FREE(socket_name);
3013
3014         result->abstract_syntax = table->syntax_id;
3015         result->transfer_syntax = ndr_transfer_syntax_ndr;
3016
3017         result->desthost = get_myname(result);
3018         if (result->desthost == NULL) {
3019                 status = NT_STATUS_NO_MEMORY;
3020                 goto fail;
3021         }
3022
3023         result->srv_name_slash = talloc_asprintf_strupper_m(
3024                 result, "\\\\%s", result->desthost);
3025         if (result->srv_name_slash == NULL) {
3026                 status = NT_STATUS_NO_MEMORY;
3027                 goto fail;
3028         }
3029
3030         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3031
3032         fd = socket(AF_UNIX, SOCK_STREAM, 0);
3033         if (fd == -1) {
3034                 status = map_nt_error_from_unix(errno);
3035                 goto fail;
3036         }
3037
3038         if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
3039                 DBG_WARNING("connect(%s) failed: %s\n",
3040                             addr.sun_path,
3041                             strerror(errno));
3042                 status = map_nt_error_from_unix(errno);
3043                 goto fail;
3044         }
3045
3046         status = rpc_transport_sock_init(result, fd, &result->transport);
3047         if (!NT_STATUS_IS_OK(status)) {
3048                 goto fail;
3049         }
3050         fd = -1;
3051
3052         result->transport->transport = NCALRPC;
3053
3054         result->binding_handle = rpccli_bh_create(result, NULL, table);
3055         if (result->binding_handle == NULL) {
3056                 status = NT_STATUS_NO_MEMORY;
3057                 goto fail;
3058         }
3059
3060         *presult = result;
3061         return NT_STATUS_OK;
3062
3063  fail:
3064         if (fd != -1) {
3065                 close(fd);
3066         }
3067         TALLOC_FREE(result);
3068         return status;
3069 }
3070
3071 NTSTATUS rpc_pipe_open_local_np(
3072         TALLOC_CTX *mem_ctx,
3073         const struct ndr_interface_table *table,
3074         const char *remote_client_name,
3075         const struct tsocket_address *remote_client_addr,
3076         const char *local_server_name,
3077         const struct tsocket_address *local_server_addr,
3078         const struct auth_session_info *session_info,
3079         struct rpc_pipe_client **presult)
3080 {
3081         struct rpc_pipe_client *result = NULL;
3082         struct pipe_auth_data *auth = NULL;
3083         const char *pipe_name = NULL;
3084         struct tstream_context *npa_stream = NULL;
3085         NTSTATUS status = NT_STATUS_NO_MEMORY;
3086         int ret;
3087
3088         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
3089         if (result == NULL) {
3090                 goto fail;
3091         }
3092         result->abstract_syntax = table->syntax_id;
3093         result->transfer_syntax = ndr_transfer_syntax_ndr;
3094         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3095
3096         pipe_name = dcerpc_default_transport_endpoint(
3097                 result, NCACN_NP, table);
3098         if (pipe_name == NULL) {
3099                 DBG_DEBUG("dcerpc_default_transport_endpoint failed\n");
3100                 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3101                 goto fail;
3102         }
3103
3104         if (local_server_name == NULL) {
3105                 result->desthost = get_myname(result);
3106         } else {
3107                 result->desthost = talloc_strdup(result, local_server_name);
3108         }
3109         if (result->desthost == NULL) {
3110                 goto fail;
3111         }
3112         result->srv_name_slash = talloc_asprintf_strupper_m(
3113                 result, "\\\\%s", result->desthost);
3114         if (result->srv_name_slash == NULL) {
3115                 goto fail;
3116         }
3117
3118         ret = local_np_connect(
3119                 pipe_name,
3120                 NCALRPC,
3121                 remote_client_name,
3122                 remote_client_addr,
3123                 local_server_name,
3124                 local_server_addr,
3125                 session_info,
3126                 true,
3127                 result,
3128                 &npa_stream);
3129         if (ret != 0) {
3130                 DBG_DEBUG("local_np_connect for %s and "
3131                           "user %s\\%s failed: %s\n",
3132                           pipe_name,
3133                           session_info->info->domain_name,
3134                           session_info->info->account_name,
3135                           strerror(ret));
3136                 status = map_nt_error_from_unix(ret);
3137                 goto fail;
3138         }
3139
3140         status = rpc_transport_tstream_init(
3141                 result, &npa_stream, &result->transport);
3142         if (!NT_STATUS_IS_OK(status)) {
3143                 DBG_DEBUG("rpc_transport_tstream_init failed: %s\n",
3144                           nt_errstr(status));
3145                 goto fail;
3146         }
3147
3148         result->binding_handle = rpccli_bh_create(result, NULL, table);
3149         if (result->binding_handle == NULL) {
3150                 status = NT_STATUS_NO_MEMORY;
3151                 DBG_DEBUG("Failed to create binding handle.\n");
3152                 goto fail;
3153         }
3154
3155         status = rpccli_anon_bind_data(result, &auth);
3156         if (!NT_STATUS_IS_OK(status)) {
3157                 DBG_DEBUG("rpccli_anon_bind_data failed: %s\n",
3158                           nt_errstr(status));
3159                 goto fail;
3160         }
3161
3162         status = rpc_pipe_bind(result, auth);
3163         if (!NT_STATUS_IS_OK(status)) {
3164                 DBG_DEBUG("rpc_pipe_bind failed: %s\n", nt_errstr(status));
3165                 goto fail;
3166         }
3167
3168         *presult = result;
3169         return NT_STATUS_OK;
3170
3171 fail:
3172         TALLOC_FREE(result);
3173         return status;
3174 }
3175
3176 struct rpc_pipe_client_np_ref {
3177         struct cli_state *cli;
3178         struct rpc_pipe_client *pipe;
3179 };
3180
3181 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
3182 {
3183         DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
3184         return 0;
3185 }
3186
3187 /****************************************************************************
3188  Open a named pipe over SMB to a remote server.
3189  *
3190  * CAVEAT CALLER OF THIS FUNCTION:
3191  *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
3192  *    so be sure that this function is called AFTER any structure (vs pointer)
3193  *    assignment of the cli.  In particular, libsmbclient does structure
3194  *    assignments of cli, which invalidates the data in the returned
3195  *    rpc_pipe_client if this function is called before the structure assignment
3196  *    of cli.
3197  *
3198  ****************************************************************************/
3199
3200 struct rpc_pipe_open_np_state {
3201         struct cli_state *cli;
3202         const struct ndr_interface_table *table;
3203         struct rpc_pipe_client *result;
3204 };
3205
3206 static void rpc_pipe_open_np_done(struct tevent_req *subreq);
3207
3208 struct tevent_req *rpc_pipe_open_np_send(
3209         TALLOC_CTX *mem_ctx,
3210         struct tevent_context *ev,
3211         struct cli_state *cli,
3212         const struct ndr_interface_table *table)
3213 {
3214         struct tevent_req *req = NULL, *subreq = NULL;
3215         struct rpc_pipe_open_np_state *state = NULL;
3216         struct rpc_pipe_client *result = NULL;
3217
3218         req = tevent_req_create(
3219                 mem_ctx, &state, struct rpc_pipe_open_np_state);
3220         if (req == NULL) {
3221                 return NULL;
3222         }
3223         state->cli = cli;
3224         state->table = table;
3225
3226         state->result = talloc_zero(state, struct rpc_pipe_client);
3227         if (tevent_req_nomem(state->result, req)) {
3228                 return tevent_req_post(req, ev);
3229         }
3230         result = state->result;
3231
3232         result->abstract_syntax = table->syntax_id;
3233         result->transfer_syntax = ndr_transfer_syntax_ndr;
3234
3235         result->desthost = talloc_strdup(
3236                 result, smbXcli_conn_remote_name(cli->conn));
3237         if (tevent_req_nomem(result->desthost, req)) {
3238                 return tevent_req_post(req, ev);
3239         }
3240
3241         result->srv_name_slash = talloc_asprintf_strupper_m(
3242                 result, "\\\\%s", result->desthost);
3243         if (tevent_req_nomem(result->srv_name_slash, req)) {
3244                 return tevent_req_post(req, ev);
3245         }
3246
3247         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3248
3249         subreq = rpc_transport_np_init_send(state, ev, cli, table);
3250         if (tevent_req_nomem(subreq, req)) {
3251                 return tevent_req_post(req, ev);
3252         }
3253         tevent_req_set_callback(subreq, rpc_pipe_open_np_done, req);
3254         return req;
3255 }
3256
3257 static void rpc_pipe_open_np_done(struct tevent_req *subreq)
3258 {
3259         struct tevent_req *req = tevent_req_callback_data(
3260                 subreq, struct tevent_req);
3261         struct rpc_pipe_open_np_state *state = tevent_req_data(
3262                 req, struct rpc_pipe_open_np_state);
3263         struct rpc_pipe_client *result = state->result;
3264         struct rpc_pipe_client_np_ref *np_ref = NULL;
3265         NTSTATUS status;
3266
3267         status = rpc_transport_np_init_recv(
3268                 subreq, result, &result->transport);
3269         TALLOC_FREE(subreq);
3270         if (tevent_req_nterror(req, status)) {
3271                 return;
3272         }
3273
3274         result->transport->transport = NCACN_NP;
3275
3276         np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
3277         if (tevent_req_nomem(np_ref, req)) {
3278                 return;
3279         }
3280         np_ref->cli = state->cli;
3281         np_ref->pipe = result;
3282
3283         DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
3284         talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
3285
3286         result->binding_handle = rpccli_bh_create(result, NULL, state->table);
3287         if (tevent_req_nomem(result->binding_handle, req)) {
3288                 return;
3289         }
3290
3291         tevent_req_done(req);
3292 }
3293
3294 NTSTATUS rpc_pipe_open_np_recv(
3295         struct tevent_req *req,
3296         TALLOC_CTX *mem_ctx,
3297         struct rpc_pipe_client **_result)
3298 {
3299         struct rpc_pipe_open_np_state *state = tevent_req_data(
3300                 req, struct rpc_pipe_open_np_state);
3301         NTSTATUS status;
3302
3303         if (tevent_req_is_nterror(req, &status)) {
3304                 return status;
3305         }
3306         *_result = talloc_move(mem_ctx, &state->result);
3307         return NT_STATUS_OK;
3308 }
3309
3310 NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
3311                           const struct ndr_interface_table *table,
3312                           struct rpc_pipe_client **presult)
3313 {
3314         struct tevent_context *ev = NULL;
3315         struct tevent_req *req = NULL;
3316         NTSTATUS status = NT_STATUS_NO_MEMORY;
3317
3318         ev = samba_tevent_context_init(cli);
3319         if (ev == NULL) {
3320                 goto fail;
3321         }
3322         req = rpc_pipe_open_np_send(ev, ev, cli, table);
3323         if (req == NULL) {
3324                 goto fail;
3325         }
3326         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
3327                 goto fail;
3328         }
3329         status = rpc_pipe_open_np_recv(req, NULL, presult);
3330 fail:
3331         TALLOC_FREE(req);
3332         TALLOC_FREE(ev);
3333         return status;
3334 }
3335
3336 /****************************************************************************
3337  Open a pipe to a remote server.
3338  ****************************************************************************/
3339
3340 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3341                                   enum dcerpc_transport_t transport,
3342                                   const struct ndr_interface_table *table,
3343                                   const char *remote_name,
3344                                   const struct sockaddr_storage *remote_sockaddr,
3345                                   struct rpc_pipe_client **presult)
3346 {
3347         switch (transport) {
3348         case NCACN_IP_TCP:
3349                 return rpc_pipe_open_tcp(NULL,
3350                                          remote_name,
3351                                          remote_sockaddr,
3352                                          table, presult);
3353         case NCACN_NP:
3354                 return rpc_pipe_open_np(cli, table, presult);
3355         default:
3356                 return NT_STATUS_NOT_IMPLEMENTED;
3357         }
3358 }
3359
3360 /****************************************************************************
3361  Open a named pipe to an SMB server and bind anonymously.
3362  ****************************************************************************/
3363
3364 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
3365                                             enum dcerpc_transport_t transport,
3366                                             const struct ndr_interface_table *table,
3367                                             const char *remote_name,
3368                                             const struct sockaddr_storage *remote_sockaddr,
3369                                             struct rpc_pipe_client **presult)
3370 {
3371         struct rpc_pipe_client *result;
3372         struct pipe_auth_data *auth;
3373         NTSTATUS status;
3374
3375         status = cli_rpc_pipe_open(cli,
3376                                    transport,
3377                                    table,
3378                                    remote_name,
3379                                    remote_sockaddr,
3380                                    &result);
3381         if (!NT_STATUS_IS_OK(status)) {
3382                 return status;
3383         }
3384
3385         status = rpccli_anon_bind_data(result, &auth);
3386         if (!NT_STATUS_IS_OK(status)) {
3387                 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3388                           nt_errstr(status)));
3389                 TALLOC_FREE(result);
3390                 return status;
3391         }
3392
3393         /*
3394          * This is a bit of an abstraction violation due to the fact that an
3395          * anonymous bind on an authenticated SMB inherits the user/domain
3396          * from the enclosing SMB creds
3397          */
3398
3399         if (transport == NCACN_NP) {
3400                 struct smbXcli_session *session;
3401
3402                 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
3403                         session = cli->smb2.session;
3404                 } else {
3405                         session = cli->smb1.session;
3406                 }
3407
3408                 status = smbXcli_session_application_key(session, auth,
3409                                                 &auth->transport_session_key);
3410                 if (!NT_STATUS_IS_OK(status)) {
3411                         auth->transport_session_key = data_blob_null;
3412                 }
3413         }
3414
3415         status = rpc_pipe_bind(result, auth);
3416         if (!NT_STATUS_IS_OK(status)) {
3417                 int lvl = 0;
3418                 if (ndr_syntax_id_equal(&table->syntax_id,
3419                                         &ndr_table_dssetup.syntax_id)) {
3420                         /* non AD domains just don't have this pipe, avoid
3421                          * level 0 statement in that case - gd */
3422                         lvl = 3;
3423                 }
3424                 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3425                             "%s failed with error %s\n",
3426                             table->name,
3427                             nt_errstr(status) ));
3428                 TALLOC_FREE(result);
3429                 return status;
3430         }
3431
3432         DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3433                   "%s and bound anonymously.\n",
3434                   table->name,
3435                   result->desthost));
3436
3437         *presult = result;
3438         return NT_STATUS_OK;
3439 }
3440
3441 /****************************************************************************
3442  ****************************************************************************/
3443
3444 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3445                                   const struct ndr_interface_table *table,
3446                                   struct rpc_pipe_client **presult)
3447 {
3448         const char *remote_name = smbXcli_conn_remote_name(cli->conn);
3449         const struct sockaddr_storage *remote_sockaddr =
3450                 smbXcli_conn_remote_sockaddr(cli->conn);
3451
3452         return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
3453                                                   table,
3454                                                   remote_name,
3455                                                   remote_sockaddr,
3456                                                   presult);
3457 }
3458
3459 /****************************************************************************
3460  Open a named pipe to an SMB server and bind using the mech specified
3461
3462  This routine references the creds pointer that is passed in
3463  ****************************************************************************/
3464
3465 NTSTATUS cli_rpc_pipe_open_with_creds(struct cli_state *cli,
3466                                       const struct ndr_interface_table *table,
3467                                       enum dcerpc_transport_t transport,
3468                                       enum dcerpc_AuthType auth_type,
3469                                       enum dcerpc_AuthLevel auth_level,
3470                                       const char *server,
3471                                       const struct sockaddr_storage *remote_sockaddr,
3472                                       struct cli_credentials *creds,
3473                                       struct rpc_pipe_client **presult)
3474 {
3475         struct rpc_pipe_client *result;
3476         struct pipe_auth_data *auth = NULL;
3477         const char *target_service = table->authservices->names[0];
3478         NTSTATUS status;
3479
3480         status = cli_rpc_pipe_open(cli,
3481                                    transport,
3482                                    table,
3483                                    server,
3484                                    remote_sockaddr,
3485                                    &result);
3486         if (!NT_STATUS_IS_OK(status)) {
3487                 return status;
3488         }
3489
3490         status = rpccli_generic_bind_data_from_creds(result,
3491                                                      auth_type, auth_level,
3492                                                      server, target_service,
3493                                                      creds,
3494                                                      &auth);
3495         if (!NT_STATUS_IS_OK(status)) {
3496                 DBG_ERR("rpccli_generic_bind_data_from_creds returned %s\n",
3497                         nt_errstr(status));
3498                 goto err;
3499         }
3500
3501         status = rpc_pipe_bind(result, auth);
3502         if (!NT_STATUS_IS_OK(status)) {
3503                 DBG_ERR("cli_rpc_pipe_bind failed with error %s\n",
3504                         nt_errstr(status));
3505                 goto err;
3506         }
3507
3508         DBG_DEBUG("opened pipe %s to machine %s and bound as user %s.\n",
3509                   table->name,
3510                   result->desthost,
3511                   cli_credentials_get_unparsed_name(creds, talloc_tos()));
3512
3513         *presult = result;
3514         return NT_STATUS_OK;
3515
3516   err:
3517
3518         TALLOC_FREE(result);
3519         return status;
3520 }
3521
3522 NTSTATUS cli_rpc_pipe_open_bind_schannel(
3523         struct cli_state *cli,
3524         const struct ndr_interface_table *table,
3525         enum dcerpc_transport_t transport,
3526         struct netlogon_creds_cli_context *netlogon_creds,
3527         const char *remote_name,
3528         const struct sockaddr_storage *remote_sockaddr,
3529         struct rpc_pipe_client **_rpccli)
3530 {
3531         struct rpc_pipe_client *rpccli;
3532         struct pipe_auth_data *rpcauth;
3533         const char *target_service = table->authservices->names[0];
3534         struct cli_credentials *cli_creds;
3535         enum dcerpc_AuthLevel auth_level;
3536         NTSTATUS status;
3537
3538         status = cli_rpc_pipe_open(cli,
3539                                    transport,
3540                                    table,
3541                                    remote_name,
3542                                    remote_sockaddr,
3543                                    &rpccli);
3544         if (!NT_STATUS_IS_OK(status)) {
3545                 return status;
3546         }
3547
3548         auth_level = netlogon_creds_cli_auth_level(netlogon_creds);
3549
3550         status = netlogon_creds_bind_cli_credentials(
3551                 netlogon_creds, rpccli, &cli_creds);
3552         if (!NT_STATUS_IS_OK(status)) {
3553                 DBG_DEBUG("netlogon_creds_bind_cli_credentials failed: %s\n",
3554                           nt_errstr(status));
3555                 TALLOC_FREE(rpccli);
3556                 return status;
3557         }
3558
3559         status = rpccli_generic_bind_data_from_creds(rpccli,
3560                                                      DCERPC_AUTH_TYPE_SCHANNEL,
3561                                                      auth_level,
3562                                                      rpccli->desthost,
3563                                                      target_service,
3564                                                      cli_creds,
3565                                                      &rpcauth);
3566         if (!NT_STATUS_IS_OK(status)) {
3567                 DEBUG(0, ("rpccli_generic_bind_data_from_creds returned %s\n",
3568                           nt_errstr(status)));
3569                 TALLOC_FREE(rpccli);
3570                 return status;
3571         }
3572
3573         status = rpc_pipe_bind(rpccli, rpcauth);
3574
3575         /* No TALLOC_FREE, gensec takes references */
3576         talloc_unlink(rpccli, cli_creds);
3577         cli_creds = NULL;
3578
3579         if (!NT_STATUS_IS_OK(status)) {
3580                 DBG_DEBUG("rpc_pipe_bind failed with error %s\n",
3581                           nt_errstr(status));
3582                 TALLOC_FREE(rpccli);
3583                 return status;
3584         }
3585
3586         *_rpccli = rpccli;
3587
3588         return NT_STATUS_OK;
3589 }
3590
3591 NTSTATUS cli_rpc_pipe_open_schannel_with_creds(struct cli_state *cli,
3592                                                const struct ndr_interface_table *table,
3593                                                enum dcerpc_transport_t transport,
3594                                                struct netlogon_creds_cli_context *netlogon_creds,
3595                                                const char *remote_name,
3596                                                const struct sockaddr_storage *remote_sockaddr,
3597                                                struct rpc_pipe_client **_rpccli)
3598 {
3599         TALLOC_CTX *frame = talloc_stackframe();
3600         struct rpc_pipe_client *rpccli;
3601         struct netlogon_creds_cli_lck *lck;
3602         NTSTATUS status;
3603
3604         status = netlogon_creds_cli_lck(
3605                 netlogon_creds, NETLOGON_CREDS_CLI_LCK_EXCLUSIVE,
3606                 frame, &lck);
3607         if (!NT_STATUS_IS_OK(status)) {
3608                 DBG_WARNING("netlogon_creds_cli_lck returned %s\n",
3609                             nt_errstr(status));
3610                 TALLOC_FREE(frame);
3611                 return status;
3612         }
3613
3614         status = cli_rpc_pipe_open_bind_schannel(cli,
3615                                                  table,
3616                                                  transport,
3617                                                  netlogon_creds,
3618                                                  remote_name,
3619                                                  remote_sockaddr,
3620                                                  &rpccli);
3621         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3622                 netlogon_creds_cli_delete_lck(netlogon_creds);
3623         }
3624         if (!NT_STATUS_IS_OK(status)) {
3625                 DBG_DEBUG("cli_rpc_pipe_open_bind_schannel failed: %s\n",
3626                           nt_errstr(status));
3627                 TALLOC_FREE(frame);
3628                 return status;
3629         }
3630
3631         if (ndr_syntax_id_equal(&table->syntax_id,
3632                                 &ndr_table_netlogon.syntax_id)) {
3633                 status = netlogon_creds_cli_check(netlogon_creds,
3634                                                   rpccli->binding_handle,
3635                                                   NULL);
3636                 if (!NT_STATUS_IS_OK(status)) {
3637                         DEBUG(0, ("netlogon_creds_cli_check failed with %s\n",
3638                                   nt_errstr(status)));
3639                         TALLOC_FREE(frame);
3640                         return status;
3641                 }
3642         }
3643
3644         DBG_DEBUG("opened pipe %s to machine %s with key %s "
3645                   "and bound using schannel.\n",
3646                   table->name, rpccli->desthost,
3647                   netlogon_creds_cli_debug_string(netlogon_creds, lck));
3648
3649         TALLOC_FREE(frame);
3650
3651         *_rpccli = rpccli;
3652         return NT_STATUS_OK;
3653 }
3654
3655 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3656                              struct rpc_pipe_client *cli,
3657                              DATA_BLOB *session_key)
3658 {
3659         NTSTATUS status;
3660         struct pipe_auth_data *a;
3661         struct gensec_security *gensec_security;
3662         DATA_BLOB sk = { .data = NULL };
3663         bool make_dup = false;
3664
3665         if (!session_key || !cli) {
3666                 return NT_STATUS_INVALID_PARAMETER;
3667         }
3668
3669         a = cli->auth;
3670
3671         if (a == NULL) {
3672                 return NT_STATUS_INVALID_PARAMETER;
3673         }
3674
3675         switch (cli->auth->auth_type) {
3676         case DCERPC_AUTH_TYPE_NONE:
3677                 sk = data_blob_const(a->transport_session_key.data,
3678                                      a->transport_session_key.length);
3679                 make_dup = true;
3680                 break;
3681         default:
3682                 gensec_security = a->auth_ctx;
3683                 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3684                 if (!NT_STATUS_IS_OK(status)) {
3685                         return status;
3686                 }
3687                 make_dup = false;
3688                 break;
3689         }
3690
3691         if (!sk.data) {
3692                 return NT_STATUS_NO_USER_SESSION_KEY;
3693         }
3694
3695         if (make_dup) {
3696                 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3697         } else {
3698                 *session_key = sk;
3699         }
3700
3701         return NT_STATUS_OK;
3702 }