X-Git-Url: http://git.samba.org/?a=blobdiff_plain;f=source4%2Flibrpc%2Frpc%2Fdcerpc_smb.c;h=71faeb4b3feed3a3cf33167fa506390fe657fc19;hb=ecb31505878be358d1101a42106eda35bb48b4c7;hp=a5570a4ea9b7dd95b7f99e9b5a179aa83f709844;hpb=9b7b5e5c516155d9606cc92bd22a958a8435ef48;p=mat%2Fsamba.git

diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c
index a5570a4ea9..71faeb4b3f 100644
--- a/source4/librpc/rpc/dcerpc_smb.c
+++ b/source4/librpc/rpc/dcerpc_smb.c
@@ -1,13 +1,14 @@
 /* 
    Unix SMB/CIFS implementation.
-   raw dcerpc operations
+
+   dcerpc over SMB transport
 
    Copyright (C) Tim Potter 2003
    Copyright (C) Andrew Tridgell 2003
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
@@ -16,308 +17,583 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 #include "includes.h"
-
-
-/* 
-   open a rpc connection to a named pipe 
+#include "libcli/raw/libcliraw.h"
+#include "libcli/composite/composite.h"
+#include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
+#include "librpc/rpc/rpc_common.h"
+#include "../libcli/smb/smbXcli_base.h"
+
+/* transport private information used by SMB pipe transport */
+struct smb_private {
+	uint16_t fnum;
+	struct smbcli_tree *tree;
+	DATA_BLOB session_key;
+	const char *server_name;
+	bool dead;
+};
+
+
+/*
+  tell the dcerpc layer that the transport is dead
 */
-NTSTATUS dcerpc_pipe_open_smb(struct dcerpc_pipe *p, 
-			      const char *pipe_name,
-			      const char *pipe_uuid, 
-			      uint32 pipe_version)
+static void pipe_dead(struct dcecli_connection *c, NTSTATUS status)
 {
-        NTSTATUS status;
-	char *name = NULL;
-	union smb_open io;
-	TALLOC_CTX *mem_ctx;
+	struct smb_private *smb = (struct smb_private *)c->transport.private_data;
 
-	asprintf(&name, "\\%s", pipe_name);
-	if (!name) {
-		return NT_STATUS_NO_MEMORY;
+	if (smb->dead) {
+		return;
 	}
 
-	io.ntcreatex.level = RAW_OPEN_NTCREATEX;
-	io.ntcreatex.in.flags = 0;
-	io.ntcreatex.in.root_fid = 0;
-	io.ntcreatex.in.access_mask = 
-		STD_RIGHT_READ_CONTROL_ACCESS | 
-		SA_RIGHT_FILE_WRITE_ATTRIBUTES | 
-		SA_RIGHT_FILE_WRITE_EA | 
-		GENERIC_RIGHTS_FILE_READ |
-		GENERIC_RIGHTS_FILE_WRITE;
-	io.ntcreatex.in.file_attr = 0;
-	io.ntcreatex.in.alloc_size = 0;
-	io.ntcreatex.in.share_access = 
-		NTCREATEX_SHARE_ACCESS_READ |
-		NTCREATEX_SHARE_ACCESS_WRITE;
-	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
-	io.ntcreatex.in.create_options = 0;
-	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_IMPERSONATION;
-	io.ntcreatex.in.security_flags = 0;
-	io.ntcreatex.in.fname = name;
-
-	mem_ctx = talloc_init("torture_rpc_connection");
-	if (!mem_ctx) {
-		return NT_STATUS_NO_MEMORY;
-	}
-	status = smb_raw_open(p->tree, mem_ctx, &io);
-	free(name);
-	talloc_destroy(mem_ctx);
+	smb->dead = true;
 
-	if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
- 
-	p->fnum = io.ntcreatex.out.fnum;
-
-	/* bind to the pipe, using the pipe_name as the key */
-	status = dcerpc_bind_byuuid(p, pipe_uuid, pipe_version);
+	if (NT_STATUS_EQUAL(NT_STATUS_UNSUCCESSFUL, status)) {
+		status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
+	}
 
-	if (!NT_STATUS_IS_OK(status)) {
-		union smb_close c;
-		c.close.level = RAW_CLOSE_CLOSE;
-		c.close.in.fnum = p->fnum;
-		c.close.in.write_time = 0;
-		smb_raw_close(p->tree, &c);
+	if (NT_STATUS_EQUAL(NT_STATUS_OK, status)) {
+		status = NT_STATUS_END_OF_FILE;
 	}
 
-        return status;
+	if (c->transport.recv_data) {
+		c->transport.recv_data(c, NULL, status);
+	}
 }
 
 
-struct cli_request *dcerpc_raw_send(struct dcerpc_pipe *p, DATA_BLOB *blob)
+/* 
+   this holds the state of an in-flight call
+*/
+struct smb_read_state {
+	struct dcecli_connection *c;
+	struct smbcli_request *req;
+	size_t received;
+	DATA_BLOB data;
+	union smb_read *io;
+};
+
+/*
+  called when a read request has completed
+*/
+static void smb_read_callback(struct smbcli_request *req)
 {
-	struct smb_trans2 trans;
-	uint16 setup[2];
-	struct cli_request *req;
-	TALLOC_CTX *mem_ctx;
+	struct dcecli_connection *c;
+	struct smb_private *smb;
+	struct smb_read_state *state;
+	union smb_read *io;
+	uint16_t frag_length;
+	NTSTATUS status;
 
-	mem_ctx = talloc_init("dcerpc_raw_send");
-	if (!mem_ctx) return NULL;
+	state = talloc_get_type(req->async.private_data, struct smb_read_state);
+	smb = talloc_get_type(state->c->transport.private_data, struct smb_private);
+	io = state->io;
+	c = state->c;
 
-	trans.in.data = *blob;
-	trans.in.params = data_blob(NULL, 0);
-	
-	setup[0] = TRANSACT_DCERPCCMD;
-	setup[1] = p->fnum;
+	status = smb_raw_read_recv(state->req, io);
+	if (NT_STATUS_IS_ERR(status)) {
+		talloc_free(state);
+		pipe_dead(c, status);
+		return;
+	}
 
-	trans.in.max_param = 0;
-	trans.in.max_data = 0x8000;
-	trans.in.max_setup = 0;
-	trans.in.setup_count = 2;
-	trans.in.flags = 0;
-	trans.in.timeout = 0;
-	trans.in.setup = setup;
-	trans.in.trans_name = "\\PIPE\\";
+	state->received += io->readx.out.nread;
 
-	req = smb_raw_trans_send(p->tree, &trans);
+	if (state->received < 16) {
+		DEBUG(0,("dcerpc_smb: short packet (length %d) in read callback!\n",
+			 (int)state->received));
+		talloc_free(state);
+		pipe_dead(c, NT_STATUS_INFO_LENGTH_MISMATCH);
+		return;
+	}
 
-	talloc_destroy(mem_ctx);
+	frag_length = dcerpc_get_frag_length(&state->data);
 
-	return req;
-}
+	if (frag_length <= state->received) {
+		DATA_BLOB data = state->data;
+		data.length = state->received;
+		talloc_steal(state->c, data.data);
+		talloc_free(state);
+		c->transport.recv_data(c, &data, NT_STATUS_OK);
+		return;
+	}
 
+	/* initiate another read request, as we only got part of a fragment */
+	state->data.data = talloc_realloc(state, state->data.data, uint8_t, frag_length);
 
-NTSTATUS dcerpc_raw_recv(struct dcerpc_pipe *p, 
-			 struct cli_request *req,
-			 TALLOC_CTX *mem_ctx,
-			 DATA_BLOB *blob)
-{
-	struct smb_trans2 trans;
-	NTSTATUS status;
-	uint16 frag_length;
-	DATA_BLOB payload;
-
-	status = smb_raw_trans_recv(req, mem_ctx, &trans);
-	/* STATUS_BUFFER_OVERFLOW means that there is more data
-	   available via SMBreadX */
-	if (!NT_STATUS_IS_OK(status) && 
-	    !NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
-		return status;
+	io->readx.in.mincnt = MIN(state->c->srv_max_xmit_frag, 
+				  frag_length - state->received);
+	io->readx.in.maxcnt = io->readx.in.mincnt;
+	io->readx.out.data = state->data.data + state->received;
+
+	state->req = smb_raw_read_send(smb->tree, io);
+	if (state->req == NULL) {
+		talloc_free(state);
+		pipe_dead(c, NT_STATUS_NO_MEMORY);
+		return;
 	}
 
-	payload = trans.out.data;
+	state->req->async.fn = smb_read_callback;
+	state->req->async.private_data = state;
+}
+
+/*
+  trigger a read request from the server, possibly with some initial
+  data in the read buffer
+*/
+static NTSTATUS send_read_request_continue(struct dcecli_connection *c, DATA_BLOB *blob)
+{
+	struct smb_private *smb = (struct smb_private *)c->transport.private_data;
+	union smb_read *io;
+	struct smb_read_state *state;
+	struct smbcli_request *req;
 
-	if (trans.out.data.length < 16 || 
-	    !NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
-		goto done;
+	state = talloc(smb, struct smb_read_state);
+	if (state == NULL) {
+		return NT_STATUS_NO_MEMORY;
 	}
 
-	/* we might have recieved a partial fragment, in which case we
-	   need to pull the rest of it */
-	frag_length = SVAL(payload.data, 8);
-	if (frag_length <= payload.length) {
-		goto done;
+	state->c = c;
+	if (blob == NULL) {
+		state->received = 0;
+		state->data = data_blob_talloc(state, NULL, 0x2000);
+	} else {
+		uint32_t frag_length = blob->length>=16?
+			dcerpc_get_frag_length(blob):0x2000;
+		state->received = blob->length;
+		state->data = data_blob_talloc(state, NULL, frag_length);
+		if (!state->data.data) {
+			talloc_free(state);
+			return NT_STATUS_NO_MEMORY;
+		}
+		memcpy(state->data.data, blob->data, blob->length);
 	}
 
-	/* make sure the payload can hold the whole fragment */
-	payload.data = talloc_realloc(mem_ctx, payload.data, frag_length);
-	if (!payload.data) {
+	state->io = talloc(state, union smb_read);
+
+	io = state->io;
+	io->generic.level = RAW_READ_READX;
+	io->readx.in.file.fnum = smb->fnum;
+	io->readx.in.mincnt = state->data.length - state->received;
+	io->readx.in.maxcnt = io->readx.in.mincnt;
+	io->readx.in.offset = 0;
+	io->readx.in.remaining = 0;
+	io->readx.in.read_for_execute = false;
+	io->readx.out.data = state->data.data + state->received;
+	req = smb_raw_read_send(smb->tree, io);
+	if (req == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	/* the rest of the data is available via SMBreadX */
-	while (frag_length > payload.length) {
-		uint32 n;
-		union smb_read io;
+	req->async.fn = smb_read_callback;
+	req->async.private_data = state;
 
-		n = frag_length - payload.length;
-		if (n > 0xFF00) {
-			n = 0xFF00;
-		}
+	state->req = req;
 
-		io.generic.level = RAW_READ_READX;
-		io.readx.in.fnum = p->fnum;
-		io.readx.in.mincnt = n;
-		io.readx.in.maxcnt = n;
-		io.readx.in.offset = 0;
-		io.readx.in.remaining = 0;
-		io.readx.out.data = payload.data + payload.length;
-		status = smb_raw_read(p->tree, &io);
-		if (!NT_STATUS_IS_OK(status) &&
-		    !NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
-			break;
-		}
-		
-		n = io.readx.out.nread;
-		if (n == 0) {
-			status = NT_STATUS_UNSUCCESSFUL;
-			break;
-		}
-		
-		payload.length += n;
+	return NT_STATUS_OK;
+}
 
-		/* if the SMBreadX returns NT_STATUS_OK then there
-		   isn't any more data to be read */
-		if (NT_STATUS_IS_OK(status)) {
-			break;
-		}
-	}
 
-done:
-	if (blob) {
-		*blob = payload;
-	}
+/*
+  trigger a read request from the server
+*/
+static NTSTATUS send_read_request(struct dcecli_connection *c)
+{
+	struct smb_private *smb = (struct smb_private *)c->transport.private_data;
 
-	return status;
-}
+	if (smb->dead) {
+		return NT_STATUS_CONNECTION_DISCONNECTED;
+	}
 
-NTSTATUS dcerpc_raw_packet(struct dcerpc_pipe *p, 
-			   TALLOC_CTX *mem_ctx,
-			   DATA_BLOB *request_blob,
-			   DATA_BLOB *reply_blob)
-{
-	struct cli_request *req;
-	req = dcerpc_raw_send(p, request_blob);
-	return dcerpc_raw_recv(p, req, mem_ctx, reply_blob);
+	return send_read_request_continue(c, NULL);
 }
-	      
 
 /* 
-   retrieve a secondary pdu from a pipe 
+   this holds the state of an in-flight trans call
 */
-NTSTATUS dcerpc_raw_packet_secondary(struct dcerpc_pipe *p, 
-				     TALLOC_CTX *mem_ctx,
-				     DATA_BLOB *blob)
+struct smb_trans_state {
+	struct dcecli_connection *c;
+	struct smbcli_request *req;
+	struct smb_trans2 *trans;
+};
+
+/*
+  called when a trans request has completed
+*/
+static void smb_trans_callback(struct smbcli_request *req)
 {
-	union smb_read io;
-	uint32 n = 0x2000;
-	uint32 frag_length;
+	struct smb_trans_state *state = (struct smb_trans_state *)req->async.private_data;
+	struct dcecli_connection *c = state->c;
 	NTSTATUS status;
 
-	*blob = data_blob_talloc(mem_ctx, NULL, n);
-	if (!blob->data) {
-		return NT_STATUS_NO_MEMORY;
+	status = smb_raw_trans_recv(req, state, state->trans);
+
+	if (NT_STATUS_IS_ERR(status)) {
+		pipe_dead(c, status);
+		return;
 	}
 
-	io.generic.level = RAW_READ_READX;
-	io.readx.in.fnum = p->fnum;
-	io.readx.in.mincnt = n;
-	io.readx.in.maxcnt = n;
-	io.readx.in.offset = 0;
-	io.readx.in.remaining = 0;
-	io.readx.out.data = blob->data;
-
-	status = smb_raw_read(p->tree, &io);
-	if (!NT_STATUS_IS_OK(status) &&
-	    !NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
-		return status;
+	if (!NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
+		DATA_BLOB data = state->trans->out.data;
+		talloc_steal(c, data.data);
+		talloc_free(state);
+		c->transport.recv_data(c, &data, NT_STATUS_OK);
+		return;
 	}
 
-	blob->length = io.readx.out.nread;
+	/* there is more to receive - setup a readx */
+	send_read_request_continue(c, &state->trans->out.data);
+	talloc_free(state);
+}
 
-	if (blob->length < 16) {
-		return status;
+/*
+  send a SMBtrans style request
+*/
+static NTSTATUS smb_send_trans_request(struct dcecli_connection *c, DATA_BLOB *blob)
+{
+        struct smb_private *smb = (struct smb_private *)c->transport.private_data;
+        struct smb_trans2 *trans;
+        uint16_t setup[2];
+	struct smb_trans_state *state;
+	uint16_t max_data;
+
+	state = talloc(c, struct smb_trans_state);
+	if (state == NULL) {
+		return NT_STATUS_NO_MEMORY;
 	}
 
-	frag_length = SVAL(blob->data, 8);
-	if (frag_length <= blob->length) {
-		return status;
+	state->c = c;
+	state->trans = talloc(state, struct smb_trans2);
+	trans = state->trans;
+
+        trans->in.data = *blob;
+        trans->in.params = data_blob(NULL, 0);
+        
+        setup[0] = TRANSACT_DCERPCCMD;
+        setup[1] = smb->fnum;
+
+	if (c->srv_max_xmit_frag > 0) {
+	        max_data = MIN(UINT16_MAX, c->srv_max_xmit_frag);
+	} else {
+		max_data = UINT16_MAX;
 	}
 
-	blob->data = talloc_realloc(mem_ctx, blob->data, frag_length);
-	if (!blob->data) {
+        trans->in.max_param = 0;
+        trans->in.max_data = max_data;
+        trans->in.max_setup = 0;
+        trans->in.setup_count = 2;
+        trans->in.flags = 0;
+        trans->in.timeout = 0;
+        trans->in.setup = setup;
+        trans->in.trans_name = "\\PIPE\\";
+
+        state->req = smb_raw_trans_send(smb->tree, trans);
+	if (state->req == NULL) {
+		talloc_free(state);
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	while (frag_length > blob->length &&
-	       NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
+	state->req->async.fn = smb_trans_callback;
+	state->req->async.private_data = state;
 
-		n = frag_length - blob->length;
-		if (n > 0xFF00) {
-			n = 0xFF00;
-		}
+	talloc_steal(state, state->req);
 
-		io.readx.in.mincnt = n;
-		io.readx.in.maxcnt = n;
-		io.readx.out.data = blob->data + blob->length;
-		status = smb_raw_read(p->tree, &io);
+        return NT_STATUS_OK;
+}
 
-		if (!NT_STATUS_IS_OK(status) &&
-		    !NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
-			return status;
-		}
-		
-		n = io.readx.out.nread;
-		blob->length += n;
-	}
+/*
+  called when a write request has completed
+*/
+static void smb_write_callback(struct smbcli_request *req)
+{
+	struct dcecli_connection *c = (struct dcecli_connection *)req->async.private_data;
+	union smb_write io;
+	NTSTATUS status;
 
-	return status;
-}
+	ZERO_STRUCT(io);
+	io.generic.level = RAW_WRITE_WRITEX;
 
+	status = smb_raw_write_recv(req, &io);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("dcerpc_smb: write callback error: %s\n",
+			nt_errstr(status)));
+		pipe_dead(c, status);
+	}
+}
 
 /* 
-   send an initial pdu in a multi-pdu sequence
+   send a packet to the server
 */
-NTSTATUS dcerpc_raw_packet_initial(struct dcerpc_pipe *p, 
-				   TALLOC_CTX *mem_ctx,
-				   DATA_BLOB *blob)
+static NTSTATUS smb_send_request(struct dcecli_connection *c, DATA_BLOB *blob, 
+				 bool trigger_read)
 {
+	struct smb_private *smb = (struct smb_private *)c->transport.private_data;
 	union smb_write io;
-	NTSTATUS status;
+	struct smbcli_request *req;
+
+	if (!smb || smb->dead) {
+		return NT_STATUS_CONNECTION_DISCONNECTED;
+	}
+
+	if (trigger_read) {
+		return smb_send_trans_request(c, blob);
+	}
 
 	io.generic.level = RAW_WRITE_WRITEX;
-	io.writex.in.fnum = p->fnum;
+	io.writex.in.file.fnum = smb->fnum;
 	io.writex.in.offset = 0;
 	io.writex.in.wmode = PIPE_START_MESSAGE;
 	io.writex.in.remaining = blob->length;
 	io.writex.in.count = blob->length;
 	io.writex.in.data = blob->data;
 
-	status = smb_raw_write(p->tree, &io);
-	if (NT_STATUS_IS_OK(status)) {
-		return status;
+	/* we must not timeout at the smb level for rpc requests, as otherwise
+	   signing/sealing can be messed up */
+	smb->tree->session->transport->options.request_timeout = 0;
+
+	req = smb_raw_write_send(smb->tree, &io);
+	if (req == NULL) {
+		return NT_STATUS_NO_MEMORY;
 	}
 
-	/* make sure it accepted it all */
-	if (io.writex.out.nwritten != blob->length) {
-		return NT_STATUS_UNSUCCESSFUL;
+	req->async.fn = smb_write_callback;
+	req->async.private_data = c;
+
+	return NT_STATUS_OK;
+}
+
+
+static void free_request(struct smbcli_request *req)
+{
+	talloc_free(req);
+}
+
+/* 
+   shutdown SMB pipe connection
+*/
+static NTSTATUS smb_shutdown_pipe(struct dcecli_connection *c, NTSTATUS status)
+{
+	struct smb_private *smb = (struct smb_private *)c->transport.private_data;
+	union smb_close io;
+	struct smbcli_request *req;
+
+	/* maybe we're still starting up */
+	if (!smb) return status;
+
+	io.close.level = RAW_CLOSE_CLOSE;
+	io.close.in.file.fnum = smb->fnum;
+	io.close.in.write_time = 0;
+	req = smb_raw_close_send(smb->tree, &io);
+	if (req != NULL) {
+		/* we don't care if this fails, so just free it if it succeeds */
+		req->async.fn = free_request;
 	}
 
+	talloc_free(smb);
+	c->transport.private_data = NULL;
+
 	return status;
 }
+
+/*
+  return SMB server name (called name)
+*/
+static const char *smb_peer_name(struct dcecli_connection *c)
+{
+	struct smb_private *smb = (struct smb_private *)c->transport.private_data;
+	if (smb == NULL) return "";
+	return smb->server_name;
+}
+
+/*
+  return remote name we make the actual connection (good for kerberos) 
+*/
+static const char *smb_target_hostname(struct dcecli_connection *c)
+{
+	struct smb_private *smb = talloc_get_type(c->transport.private_data, struct smb_private);
+	if (smb == NULL) return "";
+	return smbXcli_conn_remote_name(smb->tree->session->transport->conn);
+}
+
+/*
+  fetch the user session key 
+*/
+static NTSTATUS smb_session_key(struct dcecli_connection *c, DATA_BLOB *session_key)
+{
+	struct smb_private *smb = (struct smb_private *)c->transport.private_data;
+
+	if (smb == NULL) return NT_STATUS_CONNECTION_DISCONNECTED;
+
+	if (smb->session_key.length == 0) {
+		return NT_STATUS_NO_USER_SESSION_KEY;
+	}
+
+	*session_key = smb->session_key;
+	return NT_STATUS_OK;
+}
+
+struct pipe_open_smb_state {
+	union smb_open *open;
+	struct dcecli_connection *c;
+	struct smbcli_tree *tree;
+	struct composite_context *ctx;
+};
+
+static void pipe_open_recv(struct smbcli_request *req);
+
+struct composite_context *dcerpc_pipe_open_smb_send(struct dcerpc_pipe *p, 
+						    struct smbcli_tree *tree,
+						    const char *pipe_name)
+{
+	struct composite_context *ctx;
+	struct pipe_open_smb_state *state;
+	struct smbcli_request *req;
+	struct dcecli_connection *c = p->conn;
+
+	/* if we don't have a binding on this pipe yet, then create one */
+	if (p->binding == NULL) {
+		NTSTATUS status;
+		const char *r = smbXcli_conn_remote_name(tree->session->transport->conn);
+		char *s;
+		SMB_ASSERT(r != NULL);
+		s = talloc_asprintf(p, "ncacn_np:%s", r);
+		if (s == NULL) return NULL;
+		status = dcerpc_parse_binding(p, s, &p->binding);
+		talloc_free(s);
+		if (!NT_STATUS_IS_OK(status)) {
+			return NULL;
+		}
+	}
+
+	ctx = composite_create(c, c->event_ctx);
+	if (ctx == NULL) return NULL;
+
+	state = talloc(ctx, struct pipe_open_smb_state);
+	if (composite_nomem(state, ctx)) return ctx;
+	ctx->private_data = state;
+
+	state->c = c;
+	state->tree = tree;
+	state->ctx = ctx;
+
+	state->open = talloc(state, union smb_open);
+	if (composite_nomem(state->open, ctx)) return ctx;
+
+	state->open->ntcreatex.level = RAW_OPEN_NTCREATEX;
+	state->open->ntcreatex.in.flags = 0;
+	state->open->ntcreatex.in.root_fid.fnum = 0;
+	state->open->ntcreatex.in.access_mask = 
+		SEC_STD_READ_CONTROL |
+		SEC_FILE_WRITE_ATTRIBUTE |
+		SEC_FILE_WRITE_EA |
+		SEC_FILE_READ_DATA |
+		SEC_FILE_WRITE_DATA;
+	state->open->ntcreatex.in.file_attr = 0;
+	state->open->ntcreatex.in.alloc_size = 0;
+	state->open->ntcreatex.in.share_access = 
+		NTCREATEX_SHARE_ACCESS_READ |
+		NTCREATEX_SHARE_ACCESS_WRITE;
+	state->open->ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
+	state->open->ntcreatex.in.create_options = 0;
+	state->open->ntcreatex.in.impersonation =
+		NTCREATEX_IMPERSONATION_IMPERSONATION;
+	state->open->ntcreatex.in.security_flags = 0;
+
+	if ((strncasecmp(pipe_name, "/pipe/", 6) == 0) || 
+	    (strncasecmp(pipe_name, "\\pipe\\", 6) == 0)) {
+		pipe_name += 6;
+	}
+	state->open->ntcreatex.in.fname =
+		(pipe_name[0] == '\\') ?
+		talloc_strdup(state->open, pipe_name) :
+		talloc_asprintf(state->open, "\\%s", pipe_name);
+	if (composite_nomem(state->open->ntcreatex.in.fname, ctx)) return ctx;
+
+	req = smb_raw_open_send(tree, state->open);
+	composite_continue_smb(ctx, req, pipe_open_recv, state);
+	return ctx;
+}
+
+static void pipe_open_recv(struct smbcli_request *req)
+{
+	struct pipe_open_smb_state *state = talloc_get_type(req->async.private_data,
+					    struct pipe_open_smb_state);
+	struct composite_context *ctx = state->ctx;
+	struct dcecli_connection *c = state->c;
+	struct smb_private *smb;
+	
+	ctx->status = smb_raw_open_recv(req, state, state->open);
+	if (!composite_is_ok(ctx)) return;
+
+	/*
+	  fill in the transport methods
+	*/
+	c->transport.transport       = NCACN_NP;
+	c->transport.private_data    = NULL;
+	c->transport.shutdown_pipe   = smb_shutdown_pipe;
+	c->transport.peer_name       = smb_peer_name;
+	c->transport.target_hostname = smb_target_hostname;
+
+	c->transport.send_request    = smb_send_request;
+	c->transport.send_read       = send_read_request;
+	c->transport.recv_data       = NULL;
+	
+	/* Over-ride the default session key with the SMB session key */
+	c->security_state.session_key = smb_session_key;
+
+	smb = talloc(c, struct smb_private);
+	if (composite_nomem(smb, ctx)) return;
+
+	smb->fnum	= state->open->ntcreatex.out.file.fnum;
+	smb->tree	= talloc_reference(smb, state->tree);
+	smb->server_name= strupper_talloc(smb,
+		smbXcli_conn_remote_name(state->tree->session->transport->conn));
+	if (composite_nomem(smb->server_name, ctx)) return;
+	smb->dead	= false;
+
+	ctx->status = smbXcli_session_application_key(state->tree->session->smbXcli,
+						      smb, &smb->session_key);
+	if (NT_STATUS_EQUAL(ctx->status, NT_STATUS_NO_USER_SESSION_KEY)) {
+		smb->session_key = data_blob_null;
+		ctx->status = NT_STATUS_OK;
+	}
+	if (!composite_is_ok(ctx)) return;
+
+	c->transport.private_data = smb;
+
+	composite_done(ctx);
+}
+
+NTSTATUS dcerpc_pipe_open_smb_recv(struct composite_context *c)
+{
+	NTSTATUS status = composite_wait(c);
+	talloc_free(c);
+	return status;
+}
+
+_PUBLIC_ NTSTATUS dcerpc_pipe_open_smb(struct dcerpc_pipe *p,
+			      struct smbcli_tree *tree,
+			      const char *pipe_name)
+{
+	struct composite_context *ctx =	dcerpc_pipe_open_smb_send(p, tree,
+								  pipe_name);
+	return dcerpc_pipe_open_smb_recv(ctx);
+}
+
+/*
+  return the SMB tree used for a dcerpc over SMB pipe
+*/
+_PUBLIC_ struct smbcli_tree *dcerpc_smb_tree(struct dcecli_connection *c)
+{
+	struct smb_private *smb;
+
+	if (c->transport.transport != NCACN_NP) return NULL;
+
+	smb = talloc_get_type(c->transport.private_data, struct smb_private);
+	if (!smb) return NULL;
+
+	return smb->tree;
+}