source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *  Heavily modified by Simo Sorce                  2010.
   6  *  Copyright Andrew Bartlett                       2011.
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23 #include "../lib/util/tevent_ntstatus.h"
  24 #include "librpc/gen_ndr/ndr_epmapper_c.h"
  25 #include "../librpc/gen_ndr/ndr_dssetup.h"
  26 #include "../libcli/auth/schannel.h"
  27 #include "auth_generic.h"
  28 #include "librpc/gen_ndr/ndr_dcerpc.h"
  29 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  30 #include "librpc/rpc/dcerpc.h"
  31 #include "rpc_dce.h"
  32 #include "cli_pipe.h"
  33 #include "libsmb/libsmb.h"
  34 #include "auth/gensec/gensec.h"
  35 #include "auth/credentials/credentials.h"
  36 #include "../libcli/smb/smbXcli_base.h"
  37
  38 #undef DBGC_CLASS
  39 #define DBGC_CLASS DBGC_RPC_CLI
  40
  41 /********************************************************************
  42  Pipe description for a DEBUG
  43  ********************************************************************/
  44 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
  45                                    struct rpc_pipe_client *cli)
  46 {
  47         char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
  48         if (result == NULL) {
  49                 return "pipe";
  50         }
  51         return result;
  52 }
  53
  54 /********************************************************************
  55  Rpc pipe call id.
  56  ********************************************************************/
  57
  58 static uint32 get_rpc_call_id(void)
  59 {
  60         static uint32 call_id = 0;
  61         return ++call_id;
  62 }
  63
  64 /*******************************************************************
  65  Use SMBreadX to get rest of one fragment's worth of rpc data.
  66  Reads the whole size or give an error message
  67  ********************************************************************/
  68
  69 struct rpc_read_state {
  70         struct tevent_context *ev;
  71         struct rpc_cli_transport *transport;
  72         uint8_t *data;
  73         size_t size;
  74         size_t num_read;
  75 };
  76
  77 static void rpc_read_done(struct tevent_req *subreq);
  78
  79 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
  80                                         struct tevent_context *ev,
  81                                         struct rpc_cli_transport *transport,
  82                                         uint8_t *data, size_t size)
  83 {
  84         struct tevent_req *req, *subreq;
  85         struct rpc_read_state *state;
  86
  87         req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
  88         if (req == NULL) {
  89                 return NULL;
  90         }
  91         state->ev = ev;
  92         state->transport = transport;
  93         state->data = data;
  94         state->size = size;
  95         state->num_read = 0;
  96
  97         DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
  98
  99         subreq = transport->read_send(state, ev, (uint8_t *)data, size,
 100                                       transport->priv);
 101         if (subreq == NULL) {
 102                 goto fail;
 103         }
 104         tevent_req_set_callback(subreq, rpc_read_done, req);
 105         return req;
 106
 107  fail:
 108         TALLOC_FREE(req);
 109         return NULL;
 110 }
 111
 112 static void rpc_read_done(struct tevent_req *subreq)
 113 {
 114         struct tevent_req *req = tevent_req_callback_data(
 115                 subreq, struct tevent_req);
 116         struct rpc_read_state *state = tevent_req_data(
 117                 req, struct rpc_read_state);
 118         NTSTATUS status;
 119         ssize_t received;
 120
 121         status = state->transport->read_recv(subreq, &received);
 122         TALLOC_FREE(subreq);
 123         if (!NT_STATUS_IS_OK(status)) {
 124                 tevent_req_nterror(req, status);
 125                 return;
 126         }
 127
 128         state->num_read += received;
 129         if (state->num_read == state->size) {
 130                 tevent_req_done(req);
 131                 return;
 132         }
 133
 134         subreq = state->transport->read_send(state, state->ev,
 135                                              state->data + state->num_read,
 136                                              state->size - state->num_read,
 137                                              state->transport->priv);
 138         if (tevent_req_nomem(subreq, req)) {
 139                 return;
 140         }
 141         tevent_req_set_callback(subreq, rpc_read_done, req);
 142 }
 143
 144 static NTSTATUS rpc_read_recv(struct tevent_req *req)
 145 {
 146         return tevent_req_simple_recv_ntstatus(req);
 147 }
 148
 149 struct rpc_write_state {
 150         struct tevent_context *ev;
 151         struct rpc_cli_transport *transport;
 152         const uint8_t *data;
 153         size_t size;
 154         size_t num_written;
 155 };
 156
 157 static void rpc_write_done(struct tevent_req *subreq);
 158
 159 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
 160                                          struct tevent_context *ev,
 161                                          struct rpc_cli_transport *transport,
 162                                          const uint8_t *data, size_t size)
 163 {
 164         struct tevent_req *req, *subreq;
 165         struct rpc_write_state *state;
 166
 167         req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
 168         if (req == NULL) {
 169                 return NULL;
 170         }
 171         state->ev = ev;
 172         state->transport = transport;
 173         state->data = data;
 174         state->size = size;
 175         state->num_written = 0;
 176
 177         DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
 178
 179         subreq = transport->write_send(state, ev, data, size, transport->priv);
 180         if (subreq == NULL) {
 181                 goto fail;
 182         }
 183         tevent_req_set_callback(subreq, rpc_write_done, req);
 184         return req;
 185  fail:
 186         TALLOC_FREE(req);
 187         return NULL;
 188 }
 189
 190 static void rpc_write_done(struct tevent_req *subreq)
 191 {
 192         struct tevent_req *req = tevent_req_callback_data(
 193                 subreq, struct tevent_req);
 194         struct rpc_write_state *state = tevent_req_data(
 195                 req, struct rpc_write_state);
 196         NTSTATUS status;
 197         ssize_t written;
 198
 199         status = state->transport->write_recv(subreq, &written);
 200         TALLOC_FREE(subreq);
 201         if (!NT_STATUS_IS_OK(status)) {
 202                 tevent_req_nterror(req, status);
 203                 return;
 204         }
 205
 206         state->num_written += written;
 207
 208         if (state->num_written == state->size) {
 209                 tevent_req_done(req);
 210                 return;
 211         }
 212
 213         subreq = state->transport->write_send(state, state->ev,
 214                                               state->data + state->num_written,
 215                                               state->size - state->num_written,
 216                                               state->transport->priv);
 217         if (tevent_req_nomem(subreq, req)) {
 218                 return;
 219         }
 220         tevent_req_set_callback(subreq, rpc_write_done, req);
 221 }
 222
 223 static NTSTATUS rpc_write_recv(struct tevent_req *req)
 224 {
 225         return tevent_req_simple_recv_ntstatus(req);
 226 }
 227
 228
 229 /****************************************************************************
 230  Try and get a PDU's worth of data from current_pdu. If not, then read more
 231  from the wire.
 232  ****************************************************************************/
 233
 234 struct get_complete_frag_state {
 235         struct tevent_context *ev;
 236         struct rpc_pipe_client *cli;
 237         uint16_t frag_len;
 238         DATA_BLOB *pdu;
 239 };
 240
 241 static void get_complete_frag_got_header(struct tevent_req *subreq);
 242 static void get_complete_frag_got_rest(struct tevent_req *subreq);
 243
 244 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
 245                                                  struct tevent_context *ev,
 246                                                  struct rpc_pipe_client *cli,
 247                                                  DATA_BLOB *pdu)
 248 {
 249         struct tevent_req *req, *subreq;
 250         struct get_complete_frag_state *state;
 251         size_t received;
 252         NTSTATUS status;
 253
 254         req = tevent_req_create(mem_ctx, &state,
 255                                 struct get_complete_frag_state);
 256         if (req == NULL) {
 257                 return NULL;
 258         }
 259         state->ev = ev;
 260         state->cli = cli;
 261         state->frag_len = RPC_HEADER_LEN;
 262         state->pdu = pdu;
 263
 264         received = pdu->length;
 265         if (received < RPC_HEADER_LEN) {
 266                 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
 267                         status = NT_STATUS_NO_MEMORY;
 268                         goto post_status;
 269                 }
 270                 subreq = rpc_read_send(state, state->ev,
 271                                         state->cli->transport,
 272                                         pdu->data + received,
 273                                         RPC_HEADER_LEN - received);
 274                 if (subreq == NULL) {
 275                         status = NT_STATUS_NO_MEMORY;
 276                         goto post_status;
 277                 }
 278                 tevent_req_set_callback(subreq, get_complete_frag_got_header,
 279                                         req);
 280                 return req;
 281         }
 282
 283         state->frag_len = dcerpc_get_frag_length(pdu);
 284
 285         /*
 286          * Ensure we have frag_len bytes of data.
 287          */
 288         if (received < state->frag_len) {
 289                 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
 290                         status = NT_STATUS_NO_MEMORY;
 291                         goto post_status;
 292                 }
 293                 subreq = rpc_read_send(state, state->ev,
 294                                         state->cli->transport,
 295                                         pdu->data + received,
 296                                         state->frag_len - received);
 297                 if (subreq == NULL) {
 298                         status = NT_STATUS_NO_MEMORY;
 299                         goto post_status;
 300                 }
 301                 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
 302                                         req);
 303                 return req;
 304         }
 305
 306         status = NT_STATUS_OK;
 307  post_status:
 308         if (NT_STATUS_IS_OK(status)) {
 309                 tevent_req_done(req);
 310         } else {
 311                 tevent_req_nterror(req, status);
 312         }
 313         return tevent_req_post(req, ev);
 314 }
 315
 316 static void get_complete_frag_got_header(struct tevent_req *subreq)
 317 {
 318         struct tevent_req *req = tevent_req_callback_data(
 319                 subreq, struct tevent_req);
 320         struct get_complete_frag_state *state = tevent_req_data(
 321                 req, struct get_complete_frag_state);
 322         NTSTATUS status;
 323
 324         status = rpc_read_recv(subreq);
 325         TALLOC_FREE(subreq);
 326         if (!NT_STATUS_IS_OK(status)) {
 327                 tevent_req_nterror(req, status);
 328                 return;
 329         }
 330
 331         state->frag_len = dcerpc_get_frag_length(state->pdu);
 332
 333         if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
 334                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 335                 return;
 336         }
 337
 338         /*
 339          * We're here in this piece of code because we've read exactly
 340          * RPC_HEADER_LEN bytes into state->pdu.
 341          */
 342
 343         subreq = rpc_read_send(state, state->ev, state->cli->transport,
 344                                 state->pdu->data + RPC_HEADER_LEN,
 345                                 state->frag_len - RPC_HEADER_LEN);
 346         if (tevent_req_nomem(subreq, req)) {
 347                 return;
 348         }
 349         tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
 350 }
 351
 352 static void get_complete_frag_got_rest(struct tevent_req *subreq)
 353 {
 354         struct tevent_req *req = tevent_req_callback_data(
 355                 subreq, struct tevent_req);
 356         NTSTATUS status;
 357
 358         status = rpc_read_recv(subreq);
 359         TALLOC_FREE(subreq);
 360         if (!NT_STATUS_IS_OK(status)) {
 361                 tevent_req_nterror(req, status);
 362                 return;
 363         }
 364         tevent_req_done(req);
 365 }
 366
 367 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
 368 {
 369         return tevent_req_simple_recv_ntstatus(req);
 370 }
 371
 372 /****************************************************************************
 373  Do basic authentication checks on an incoming pdu.
 374  ****************************************************************************/
 375
 376 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
 377                                                 struct rpc_pipe_client *cli,
 378                                                 struct ncacn_packet *pkt,
 379                                                 DATA_BLOB *pdu,
 380                                                 uint8_t expected_pkt_type,
 381                                                 DATA_BLOB *rdata,
 382                                                 DATA_BLOB *reply_pdu)
 383 {
 384         struct dcerpc_response *r;
 385         NTSTATUS ret = NT_STATUS_OK;
 386         size_t pad_len = 0;
 387
 388         /*
 389          * Point the return values at the real data including the RPC
 390          * header. Just in case the caller wants it.
 391          */
 392         *rdata = *pdu;
 393
 394         /* Ensure we have the correct type. */
 395         switch (pkt->ptype) {
 396         case DCERPC_PKT_ALTER_RESP:
 397         case DCERPC_PKT_BIND_ACK:
 398
 399                 /* Client code never receives this kind of packets */
 400                 break;
 401
 402
 403         case DCERPC_PKT_RESPONSE:
 404
 405                 r = &pkt->u.response;
 406
 407                 /* Here's where we deal with incoming sign/seal. */
 408                 ret = dcerpc_check_auth(cli->auth, pkt,
 409                                         &r->stub_and_verifier,
 410                                         DCERPC_RESPONSE_LENGTH,
 411                                         pdu, &pad_len);
 412                 if (!NT_STATUS_IS_OK(ret)) {
 413                         return ret;
 414                 }
 415
 416                 if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
 417                         return NT_STATUS_BUFFER_TOO_SMALL;
 418                 }
 419
 420                 /* Point the return values at the NDR data. */
 421                 rdata->data = r->stub_and_verifier.data;
 422
 423                 if (pkt->auth_length) {
 424                         /* We've already done integer wrap tests in
 425                          * dcerpc_check_auth(). */
 426                         rdata->length = r->stub_and_verifier.length
 427                                          - pad_len
 428                                          - DCERPC_AUTH_TRAILER_LENGTH
 429                                          - pkt->auth_length;
 430                 } else {
 431                         rdata->length = r->stub_and_verifier.length;
 432                 }
 433
 434                 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
 435                            (long unsigned int)pdu->length,
 436                            (long unsigned int)rdata->length,
 437                            (unsigned int)pad_len));
 438
 439                 /*
 440                  * If this is the first reply, and the allocation hint is
 441                  * reasonable, try and set up the reply_pdu DATA_BLOB to the
 442                  * correct size.
 443                  */
 444
 445                 if ((reply_pdu->length == 0) &&
 446                     r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
 447                         if (!data_blob_realloc(mem_ctx, reply_pdu,
 448                                                         r->alloc_hint)) {
 449                                 DEBUG(0, ("reply alloc hint %d too "
 450                                           "large to allocate\n",
 451                                           (int)r->alloc_hint));
 452                                 return NT_STATUS_NO_MEMORY;
 453                         }
 454                 }
 455
 456                 break;
 457
 458         case DCERPC_PKT_BIND_NAK:
 459                 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
 460                           rpccli_pipe_txt(talloc_tos(), cli)));
 461                 /* Use this for now... */
 462                 return NT_STATUS_NETWORK_ACCESS_DENIED;
 463
 464         case DCERPC_PKT_FAULT:
 465
 466                 DEBUG(1, (__location__ ": RPC fault code %s received "
 467                           "from %s!\n",
 468                           dcerpc_errstr(talloc_tos(),
 469                           pkt->u.fault.status),
 470                           rpccli_pipe_txt(talloc_tos(), cli)));
 471
 472                 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
 473
 474         default:
 475                 DEBUG(0, (__location__ "Unknown packet type %u received "
 476                           "from %s!\n",
 477                           (unsigned int)pkt->ptype,
 478                           rpccli_pipe_txt(talloc_tos(), cli)));
 479                 return NT_STATUS_INVALID_INFO_CLASS;
 480         }
 481
 482         if (pkt->ptype != expected_pkt_type) {
 483                 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
 484                           "RPC packet type - %u, not %u\n",
 485                           rpccli_pipe_txt(talloc_tos(), cli),
 486                           pkt->ptype, expected_pkt_type));
 487                 return NT_STATUS_INVALID_INFO_CLASS;
 488         }
 489
 490         /* Do this just before return - we don't want to modify any rpc header
 491            data before now as we may have needed to do cryptographic actions on
 492            it before. */
 493
 494         if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
 495             !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
 496                 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
 497                           "fragment first/last ON.\n"));
 498                 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
 499         }
 500
 501         return NT_STATUS_OK;
 502 }
 503
 504 /****************************************************************************
 505  Call a remote api on an arbitrary pipe.  takes param, data and setup buffers.
 506 ****************************************************************************/
 507
 508 struct cli_api_pipe_state {
 509         struct tevent_context *ev;
 510         struct rpc_cli_transport *transport;
 511         uint8_t *rdata;
 512         uint32_t rdata_len;
 513 };
 514
 515 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
 516 static void cli_api_pipe_write_done(struct tevent_req *subreq);
 517 static void cli_api_pipe_read_done(struct tevent_req *subreq);
 518
 519 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
 520                                             struct tevent_context *ev,
 521                                             struct rpc_cli_transport *transport,
 522                                             uint8_t *data, size_t data_len,
 523                                             uint32_t max_rdata_len)
 524 {
 525         struct tevent_req *req, *subreq;
 526         struct cli_api_pipe_state *state;
 527         NTSTATUS status;
 528
 529         req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
 530         if (req == NULL) {
 531                 return NULL;
 532         }
 533         state->ev = ev;
 534         state->transport = transport;
 535
 536         if (max_rdata_len < RPC_HEADER_LEN) {
 537                 /*
 538                  * For a RPC reply we always need at least RPC_HEADER_LEN
 539                  * bytes. We check this here because we will receive
 540                  * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
 541                  */
 542                 status = NT_STATUS_INVALID_PARAMETER;
 543                 goto post_status;
 544         }
 545
 546         if (transport->trans_send != NULL) {
 547                 subreq = transport->trans_send(state, ev, data, data_len,
 548                                                max_rdata_len, transport->priv);
 549                 if (subreq == NULL) {
 550                         goto fail;
 551                 }
 552                 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
 553                 return req;
 554         }
 555
 556         /*
 557          * If the transport does not provide a "trans" routine, i.e. for
 558          * example the ncacn_ip_tcp transport, do the write/read step here.
 559          */
 560
 561         subreq = rpc_write_send(state, ev, transport, data, data_len);
 562         if (subreq == NULL) {
 563                 goto fail;
 564         }
 565         tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
 566         return req;
 567
 568  post_status:
 569         tevent_req_nterror(req, status);
 570         return tevent_req_post(req, ev);
 571  fail:
 572         TALLOC_FREE(req);
 573         return NULL;
 574 }
 575
 576 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
 577 {
 578         struct tevent_req *req = tevent_req_callback_data(
 579                 subreq, struct tevent_req);
 580         struct cli_api_pipe_state *state = tevent_req_data(
 581                 req, struct cli_api_pipe_state);
 582         NTSTATUS status;
 583
 584         status = state->transport->trans_recv(subreq, state, &state->rdata,
 585                                               &state->rdata_len);
 586         TALLOC_FREE(subreq);
 587         if (!NT_STATUS_IS_OK(status)) {
 588                 tevent_req_nterror(req, status);
 589                 return;
 590         }
 591         tevent_req_done(req);
 592 }
 593
 594 static void cli_api_pipe_write_done(struct tevent_req *subreq)
 595 {
 596         struct tevent_req *req = tevent_req_callback_data(
 597                 subreq, struct tevent_req);
 598         struct cli_api_pipe_state *state = tevent_req_data(
 599                 req, struct cli_api_pipe_state);
 600         NTSTATUS status;
 601
 602         status = rpc_write_recv(subreq);
 603         TALLOC_FREE(subreq);
 604         if (!NT_STATUS_IS_OK(status)) {
 605                 tevent_req_nterror(req, status);
 606                 return;
 607         }
 608
 609         state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
 610         if (tevent_req_nomem(state->rdata, req)) {
 611                 return;
 612         }
 613
 614         /*
 615          * We don't need to use rpc_read_send here, the upper layer will cope
 616          * with a short read, transport->trans_send could also return less
 617          * than state->max_rdata_len.
 618          */
 619         subreq = state->transport->read_send(state, state->ev, state->rdata,
 620                                              RPC_HEADER_LEN,
 621                                              state->transport->priv);
 622         if (tevent_req_nomem(subreq, req)) {
 623                 return;
 624         }
 625         tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
 626 }
 627
 628 static void cli_api_pipe_read_done(struct tevent_req *subreq)
 629 {
 630         struct tevent_req *req = tevent_req_callback_data(
 631                 subreq, struct tevent_req);
 632         struct cli_api_pipe_state *state = tevent_req_data(
 633                 req, struct cli_api_pipe_state);
 634         NTSTATUS status;
 635         ssize_t received;
 636
 637         status = state->transport->read_recv(subreq, &received);
 638         TALLOC_FREE(subreq);
 639         if (!NT_STATUS_IS_OK(status)) {
 640                 tevent_req_nterror(req, status);
 641                 return;
 642         }
 643         state->rdata_len = received;
 644         tevent_req_done(req);
 645 }
 646
 647 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 648                                   uint8_t **prdata, uint32_t *prdata_len)
 649 {
 650         struct cli_api_pipe_state *state = tevent_req_data(
 651                 req, struct cli_api_pipe_state);
 652         NTSTATUS status;
 653
 654         if (tevent_req_is_nterror(req, &status)) {
 655                 return status;
 656         }
 657
 658         *prdata = talloc_move(mem_ctx, &state->rdata);
 659         *prdata_len = state->rdata_len;
 660         return NT_STATUS_OK;
 661 }
 662
 663 /****************************************************************************
 664  Send data on an rpc pipe via trans. The data must be the last
 665  pdu fragment of an NDR data stream.
 666
 667  Receive response data from an rpc pipe, which may be large...
 668
 669  Read the first fragment: unfortunately have to use SMBtrans for the first
 670  bit, then SMBreadX for subsequent bits.
 671
 672  If first fragment received also wasn't the last fragment, continue
 673  getting fragments until we _do_ receive the last fragment.
 674
 675  Request/Response PDU's look like the following...
 676
 677  |<------------------PDU len----------------------------------------------->|
 678  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 679
 680  +------------+-----------------+-------------+---------------+-------------+
 681  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 682  +------------+-----------------+-------------+---------------+-------------+
 683
 684  Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
 685  signing & sealing being negotiated.
 686
 687  ****************************************************************************/
 688
 689 struct rpc_api_pipe_state {
 690         struct tevent_context *ev;
 691         struct rpc_pipe_client *cli;
 692         uint8_t expected_pkt_type;
 693
 694         DATA_BLOB incoming_frag;
 695         struct ncacn_packet *pkt;
 696
 697         /* Incoming reply */
 698         DATA_BLOB reply_pdu;
 699         size_t reply_pdu_offset;
 700         uint8_t endianess;
 701 };
 702
 703 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
 704 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
 705 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
 706
 707 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
 708                                             struct tevent_context *ev,
 709                                             struct rpc_pipe_client *cli,
 710                                             DATA_BLOB *data, /* Outgoing PDU */
 711                                             uint8_t expected_pkt_type)
 712 {
 713         struct tevent_req *req, *subreq;
 714         struct rpc_api_pipe_state *state;
 715         uint16_t max_recv_frag;
 716         NTSTATUS status;
 717
 718         req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
 719         if (req == NULL) {
 720                 return NULL;
 721         }
 722         state->ev = ev;
 723         state->cli = cli;
 724         state->expected_pkt_type = expected_pkt_type;
 725         state->endianess = DCERPC_DREP_LE;
 726
 727         /*
 728          * Ensure we're not sending too much.
 729          */
 730         if (data->length > cli->max_xmit_frag) {
 731                 status = NT_STATUS_INVALID_PARAMETER;
 732                 goto post_status;
 733         }
 734
 735         DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
 736
 737         if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
 738                 subreq = rpc_write_send(state, ev, cli->transport,
 739                                         data->data, data->length);
 740                 if (subreq == NULL) {
 741                         goto fail;
 742                 }
 743                 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
 744                 return req;
 745         }
 746
 747         /* get the header first, then fetch the rest once we have
 748          * the frag_length available */
 749         max_recv_frag = RPC_HEADER_LEN;
 750
 751         subreq = cli_api_pipe_send(state, ev, cli->transport,
 752                                    data->data, data->length, max_recv_frag);
 753         if (subreq == NULL) {
 754                 goto fail;
 755         }
 756         tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
 757         return req;
 758
 759  post_status:
 760         tevent_req_nterror(req, status);
 761         return tevent_req_post(req, ev);
 762  fail:
 763         TALLOC_FREE(req);
 764         return NULL;
 765 }
 766
 767 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
 768 {
 769         struct tevent_req *req =
 770                 tevent_req_callback_data(subreq,
 771                 struct tevent_req);
 772         NTSTATUS status;
 773
 774         status = rpc_write_recv(subreq);
 775         TALLOC_FREE(subreq);
 776         if (!NT_STATUS_IS_OK(status)) {
 777                 tevent_req_nterror(req, status);
 778                 return;
 779         }
 780
 781         tevent_req_done(req);
 782 }
 783
 784 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
 785 {
 786         struct tevent_req *req = tevent_req_callback_data(
 787                 subreq, struct tevent_req);
 788         struct rpc_api_pipe_state *state = tevent_req_data(
 789                 req, struct rpc_api_pipe_state);
 790         NTSTATUS status;
 791         uint8_t *rdata = NULL;
 792         uint32_t rdata_len = 0;
 793
 794         status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
 795         TALLOC_FREE(subreq);
 796         if (!NT_STATUS_IS_OK(status)) {
 797                 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
 798                 tevent_req_nterror(req, status);
 799                 return;
 800         }
 801
 802         if (rdata == NULL) {
 803                 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
 804                          rpccli_pipe_txt(talloc_tos(), state->cli)));
 805                 tevent_req_done(req);
 806                 return;
 807         }
 808
 809         /*
 810          * Move data on state->incoming_frag.
 811          */
 812         state->incoming_frag.data = talloc_move(state, &rdata);
 813         state->incoming_frag.length = rdata_len;
 814         if (!state->incoming_frag.data) {
 815                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 816                 return;
 817         }
 818
 819         /* Ensure we have enough data for a pdu. */
 820         subreq = get_complete_frag_send(state, state->ev, state->cli,
 821                                         &state->incoming_frag);
 822         if (tevent_req_nomem(subreq, req)) {
 823                 return;
 824         }
 825         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
 826 }
 827
 828 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
 829 {
 830         struct tevent_req *req = tevent_req_callback_data(
 831                 subreq, struct tevent_req);
 832         struct rpc_api_pipe_state *state = tevent_req_data(
 833                 req, struct rpc_api_pipe_state);
 834         NTSTATUS status;
 835         DATA_BLOB rdata = data_blob_null;
 836
 837         status = get_complete_frag_recv(subreq);
 838         TALLOC_FREE(subreq);
 839         if (!NT_STATUS_IS_OK(status)) {
 840                 DEBUG(5, ("get_complete_frag failed: %s\n",
 841                           nt_errstr(status)));
 842                 tevent_req_nterror(req, status);
 843                 return;
 844         }
 845
 846         state->pkt = talloc(state, struct ncacn_packet);
 847         if (!state->pkt) {
 848                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 849                 return;
 850         }
 851
 852         status = dcerpc_pull_ncacn_packet(state->pkt,
 853                                           &state->incoming_frag,
 854                                           state->pkt,
 855                                           !state->endianess);
 856         if (!NT_STATUS_IS_OK(status)) {
 857                 tevent_req_nterror(req, status);
 858                 return;
 859         }
 860
 861         if (state->incoming_frag.length != state->pkt->frag_length) {
 862                 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
 863                           (unsigned int)state->incoming_frag.length,
 864                           (unsigned int)state->pkt->frag_length));
 865                 tevent_req_nterror(req,  NT_STATUS_INVALID_PARAMETER);
 866                 return;
 867         }
 868
 869         status = cli_pipe_validate_current_pdu(state,
 870                                                 state->cli, state->pkt,
 871                                                 &state->incoming_frag,
 872                                                 state->expected_pkt_type,
 873                                                 &rdata,
 874                                                 &state->reply_pdu);
 875
 876         DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
 877                   (unsigned)state->incoming_frag.length,
 878                   (unsigned)state->reply_pdu_offset,
 879                   nt_errstr(status)));
 880
 881         if (!NT_STATUS_IS_OK(status)) {
 882                 tevent_req_nterror(req, status);
 883                 return;
 884         }
 885
 886         if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
 887             && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
 888                 /*
 889                  * Set the data type correctly for big-endian data on the
 890                  * first packet.
 891                  */
 892                 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
 893                           "big-endian.\n",
 894                           rpccli_pipe_txt(talloc_tos(), state->cli)));
 895                 state->endianess = 0x00; /* BIG ENDIAN */
 896         }
 897         /*
 898          * Check endianness on subsequent packets.
 899          */
 900         if (state->endianess != state->pkt->drep[0]) {
 901                 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
 902                          "%s\n",
 903                          state->endianess?"little":"big",
 904                          state->pkt->drep[0]?"little":"big"));
 905                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 906                 return;
 907         }
 908
 909         /* Now copy the data portion out of the pdu into rbuf. */
 910         if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
 911                 if (!data_blob_realloc(NULL, &state->reply_pdu,
 912                                 state->reply_pdu_offset + rdata.length)) {
 913                         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 914                         return;
 915                 }
 916         }
 917
 918         memcpy(state->reply_pdu.data + state->reply_pdu_offset,
 919                 rdata.data, rdata.length);
 920         state->reply_pdu_offset += rdata.length;
 921
 922         /* reset state->incoming_frag, there is no need to free it,
 923          * it will be reallocated to the right size the next time
 924          * it is used */
 925         state->incoming_frag.length = 0;
 926
 927         if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
 928                 /* make sure the pdu length is right now that we
 929                  * have all the data available (alloc hint may
 930                  * have allocated more than was actually used) */
 931                 state->reply_pdu.length = state->reply_pdu_offset;
 932                 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
 933                           rpccli_pipe_txt(talloc_tos(), state->cli),
 934                           (unsigned)state->reply_pdu.length));
 935                 tevent_req_done(req);
 936                 return;
 937         }
 938
 939         subreq = get_complete_frag_send(state, state->ev, state->cli,
 940                                         &state->incoming_frag);
 941         if (tevent_req_nomem(subreq, req)) {
 942                 return;
 943         }
 944         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
 945 }
 946
 947 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 948                                   struct ncacn_packet **pkt,
 949                                   DATA_BLOB *reply_pdu)
 950 {
 951         struct rpc_api_pipe_state *state = tevent_req_data(
 952                 req, struct rpc_api_pipe_state);
 953         NTSTATUS status;
 954
 955         if (tevent_req_is_nterror(req, &status)) {
 956                 return status;
 957         }
 958
 959         /* return data to caller and assign it ownership of memory */
 960         if (reply_pdu) {
 961                 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
 962                 reply_pdu->length = state->reply_pdu.length;
 963                 state->reply_pdu.length = 0;
 964         } else {
 965                 data_blob_free(&state->reply_pdu);
 966         }
 967
 968         if (pkt) {
 969                 *pkt = talloc_steal(mem_ctx, state->pkt);
 970         }
 971
 972         return NT_STATUS_OK;
 973 }
 974
 975 /*******************************************************************
 976  Creates NTLMSSP auth bind.
 977  ********************************************************************/
 978
 979 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
 980                                                  TALLOC_CTX *mem_ctx,
 981                                                  DATA_BLOB *auth_token)
 982 {
 983         struct gensec_security *gensec_security;
 984         DATA_BLOB null_blob = data_blob_null;
 985
 986         gensec_security = talloc_get_type_abort(cli->auth->auth_ctx,
 987                                         struct gensec_security);
 988
 989         DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
 990         return gensec_update(gensec_security, mem_ctx, NULL, null_blob, auth_token);
 991 }
 992
 993 /*******************************************************************
 994  Creates the internals of a DCE/RPC bind request or alter context PDU.
 995  ********************************************************************/
 996
 997 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
 998                                                 enum dcerpc_pkt_type ptype,
 999                                                 uint32 rpc_call_id,
1000                                                 const struct ndr_syntax_id *abstract,
1001                                                 const struct ndr_syntax_id *transfer,
1002                                                 const DATA_BLOB *auth_info,
1003                                                 DATA_BLOB *blob)
1004 {
1005         uint16 auth_len = auth_info->length;
1006         NTSTATUS status;
1007         union dcerpc_payload u;
1008         struct dcerpc_ctx_list ctx_list;
1009
1010         if (auth_len) {
1011                 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1012         }
1013
1014         ctx_list.context_id = 0;
1015         ctx_list.num_transfer_syntaxes = 1;
1016         ctx_list.abstract_syntax = *abstract;
1017         ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1018
1019         u.bind.max_xmit_frag    = RPC_MAX_PDU_FRAG_LEN;
1020         u.bind.max_recv_frag    = RPC_MAX_PDU_FRAG_LEN;
1021         u.bind.assoc_group_id   = 0x0;
1022         u.bind.num_contexts     = 1;
1023         u.bind.ctx_list         = &ctx_list;
1024         u.bind.auth_info        = *auth_info;
1025
1026         status = dcerpc_push_ncacn_packet(mem_ctx,
1027                                           ptype,
1028                                           DCERPC_PFC_FLAG_FIRST |
1029                                           DCERPC_PFC_FLAG_LAST,
1030                                           auth_len,
1031                                           rpc_call_id,
1032                                           &u,
1033                                           blob);
1034         if (!NT_STATUS_IS_OK(status)) {
1035                 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1036                 return status;
1037         }
1038
1039         return NT_STATUS_OK;
1040 }
1041
1042 /*******************************************************************
1043  Creates a DCE/RPC bind request.
1044  ********************************************************************/
1045
1046 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1047                                     struct rpc_pipe_client *cli,
1048                                     struct pipe_auth_data *auth,
1049                                     uint32 rpc_call_id,
1050                                     const struct ndr_syntax_id *abstract,
1051                                     const struct ndr_syntax_id *transfer,
1052                                     DATA_BLOB *rpc_out)
1053 {
1054         DATA_BLOB auth_token = data_blob_null;
1055         DATA_BLOB auth_info = data_blob_null;
1056         NTSTATUS ret = NT_STATUS_OK;
1057
1058         switch (auth->auth_type) {
1059         case DCERPC_AUTH_TYPE_SCHANNEL:
1060         case DCERPC_AUTH_TYPE_NTLMSSP:
1061         case DCERPC_AUTH_TYPE_KRB5:
1062         case DCERPC_AUTH_TYPE_SPNEGO:
1063                 ret = create_generic_auth_rpc_bind_req(cli, mem_ctx, &auth_token);
1064
1065                 if (!NT_STATUS_IS_OK(ret) &&
1066                     !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1067                         return ret;
1068                 }
1069                 break;
1070
1071         case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1072                 auth_token = data_blob_talloc(mem_ctx,
1073                                               "NCALRPC_AUTH_TOKEN",
1074                                               18);
1075                 break;
1076
1077         case DCERPC_AUTH_TYPE_NONE:
1078                 break;
1079
1080         default:
1081                 /* "Can't" happen. */
1082                 return NT_STATUS_INVALID_INFO_CLASS;
1083         }
1084
1085         if (auth_token.length != 0) {
1086                 ret = dcerpc_push_dcerpc_auth(cli,
1087                                                 auth->auth_type,
1088                                                 auth->auth_level,
1089                                                 0, /* auth_pad_length */
1090                                                 1, /* auth_context_id */
1091                                                 &auth_token,
1092                                                 &auth_info);
1093                 if (!NT_STATUS_IS_OK(ret)) {
1094                         return ret;
1095                 }
1096                 data_blob_free(&auth_token);
1097         }
1098
1099         ret = create_bind_or_alt_ctx_internal(mem_ctx,
1100                                               DCERPC_PKT_BIND,
1101                                               rpc_call_id,
1102                                               abstract,
1103                                               transfer,
1104                                               &auth_info,
1105                                               rpc_out);
1106         return ret;
1107 }
1108
1109 /*******************************************************************
1110  External interface.
1111  Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1112  Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1113  and deals with signing/sealing details.
1114  ********************************************************************/
1115
1116 struct rpc_api_pipe_req_state {
1117         struct tevent_context *ev;
1118         struct rpc_pipe_client *cli;
1119         uint8_t op_num;
1120         uint32_t call_id;
1121         DATA_BLOB *req_data;
1122         uint32_t req_data_sent;
1123         DATA_BLOB rpc_out;
1124         DATA_BLOB reply_pdu;
1125 };
1126
1127 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1128 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1129 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1130                                   bool *is_last_frag);
1131
1132 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1133                                          struct tevent_context *ev,
1134                                          struct rpc_pipe_client *cli,
1135                                          uint8_t op_num,
1136                                          DATA_BLOB *req_data)
1137 {
1138         struct tevent_req *req, *subreq;
1139         struct rpc_api_pipe_req_state *state;
1140         NTSTATUS status;
1141         bool is_last_frag;
1142
1143         req = tevent_req_create(mem_ctx, &state,
1144                                 struct rpc_api_pipe_req_state);
1145         if (req == NULL) {
1146                 return NULL;
1147         }
1148         state->ev = ev;
1149         state->cli = cli;
1150         state->op_num = op_num;
1151         state->req_data = req_data;
1152         state->req_data_sent = 0;
1153         state->call_id = get_rpc_call_id();
1154         state->reply_pdu = data_blob_null;
1155         state->rpc_out = data_blob_null;
1156
1157         if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1158                                         + RPC_MAX_SIGN_SIZE) {
1159                 /* Server is screwed up ! */
1160                 status = NT_STATUS_INVALID_PARAMETER;
1161                 goto post_status;
1162         }
1163
1164         status = prepare_next_frag(state, &is_last_frag);
1165         if (!NT_STATUS_IS_OK(status)) {
1166                 goto post_status;
1167         }
1168
1169         if (is_last_frag) {
1170                 subreq = rpc_api_pipe_send(state, ev, state->cli,
1171                                            &state->rpc_out,
1172                                            DCERPC_PKT_RESPONSE);
1173                 if (subreq == NULL) {
1174                         goto fail;
1175                 }
1176                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1177         } else {
1178                 subreq = rpc_write_send(state, ev, cli->transport,
1179                                         state->rpc_out.data,
1180                                         state->rpc_out.length);
1181                 if (subreq == NULL) {
1182                         goto fail;
1183                 }
1184                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1185                                         req);
1186         }
1187         return req;
1188
1189  post_status:
1190         tevent_req_nterror(req, status);
1191         return tevent_req_post(req, ev);
1192  fail:
1193         TALLOC_FREE(req);
1194         return NULL;
1195 }
1196
1197 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1198                                   bool *is_last_frag)
1199 {
1200         size_t data_sent_thistime;
1201         size_t auth_len;
1202         size_t frag_len;
1203         uint8_t flags = 0;
1204         size_t pad_len;
1205         size_t data_left;
1206         NTSTATUS status;
1207         union dcerpc_payload u;
1208
1209         data_left = state->req_data->length - state->req_data_sent;
1210
1211         status = dcerpc_guess_sizes(state->cli->auth,
1212                                     DCERPC_REQUEST_LENGTH, data_left,
1213                                     state->cli->max_xmit_frag,
1214                                     CLIENT_NDR_PADDING_SIZE,
1215                                     &data_sent_thistime,
1216                                     &frag_len, &auth_len, &pad_len);
1217         if (!NT_STATUS_IS_OK(status)) {
1218                 return status;
1219         }
1220
1221         if (state->req_data_sent == 0) {
1222                 flags = DCERPC_PFC_FLAG_FIRST;
1223         }
1224
1225         if (data_sent_thistime == data_left) {
1226                 flags |= DCERPC_PFC_FLAG_LAST;
1227         }
1228
1229         data_blob_free(&state->rpc_out);
1230
1231         ZERO_STRUCT(u.request);
1232
1233         u.request.alloc_hint    = state->req_data->length;
1234         u.request.context_id    = 0;
1235         u.request.opnum         = state->op_num;
1236
1237         status = dcerpc_push_ncacn_packet(state,
1238                                           DCERPC_PKT_REQUEST,
1239                                           flags,
1240                                           auth_len,
1241                                           state->call_id,
1242                                           &u,
1243                                           &state->rpc_out);
1244         if (!NT_STATUS_IS_OK(status)) {
1245                 return status;
1246         }
1247
1248         /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1249          * compute it right for requests because the auth trailer is missing
1250          * at this stage */
1251         dcerpc_set_frag_length(&state->rpc_out, frag_len);
1252
1253         /* Copy in the data. */
1254         if (!data_blob_append(NULL, &state->rpc_out,
1255                                 state->req_data->data + state->req_data_sent,
1256                                 data_sent_thistime)) {
1257                 return NT_STATUS_NO_MEMORY;
1258         }
1259
1260         switch (state->cli->auth->auth_level) {
1261         case DCERPC_AUTH_LEVEL_NONE:
1262         case DCERPC_AUTH_LEVEL_CONNECT:
1263         case DCERPC_AUTH_LEVEL_PACKET:
1264                 break;
1265         case DCERPC_AUTH_LEVEL_INTEGRITY:
1266         case DCERPC_AUTH_LEVEL_PRIVACY:
1267                 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1268                                                 &state->rpc_out);
1269                 if (!NT_STATUS_IS_OK(status)) {
1270                         return status;
1271                 }
1272                 break;
1273         default:
1274                 return NT_STATUS_INVALID_PARAMETER;
1275         }
1276
1277         state->req_data_sent += data_sent_thistime;
1278         *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1279
1280         return status;
1281 }
1282
1283 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1284 {
1285         struct tevent_req *req = tevent_req_callback_data(
1286                 subreq, struct tevent_req);
1287         struct rpc_api_pipe_req_state *state = tevent_req_data(
1288                 req, struct rpc_api_pipe_req_state);
1289         NTSTATUS status;
1290         bool is_last_frag;
1291
1292         status = rpc_write_recv(subreq);
1293         TALLOC_FREE(subreq);
1294         if (!NT_STATUS_IS_OK(status)) {
1295                 tevent_req_nterror(req, status);
1296                 return;
1297         }
1298
1299         status = prepare_next_frag(state, &is_last_frag);
1300         if (!NT_STATUS_IS_OK(status)) {
1301                 tevent_req_nterror(req, status);
1302                 return;
1303         }
1304
1305         if (is_last_frag) {
1306                 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1307                                            &state->rpc_out,
1308                                            DCERPC_PKT_RESPONSE);
1309                 if (tevent_req_nomem(subreq, req)) {
1310                         return;
1311                 }
1312                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1313         } else {
1314                 subreq = rpc_write_send(state, state->ev,
1315                                         state->cli->transport,
1316                                         state->rpc_out.data,
1317                                         state->rpc_out.length);
1318                 if (tevent_req_nomem(subreq, req)) {
1319                         return;
1320                 }
1321                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1322                                         req);
1323         }
1324 }
1325
1326 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1327 {
1328         struct tevent_req *req = tevent_req_callback_data(
1329                 subreq, struct tevent_req);
1330         struct rpc_api_pipe_req_state *state = tevent_req_data(
1331                 req, struct rpc_api_pipe_req_state);
1332         NTSTATUS status;
1333
1334         status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1335         TALLOC_FREE(subreq);
1336         if (!NT_STATUS_IS_OK(status)) {
1337                 tevent_req_nterror(req, status);
1338                 return;
1339         }
1340         tevent_req_done(req);
1341 }
1342
1343 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1344                                DATA_BLOB *reply_pdu)
1345 {
1346         struct rpc_api_pipe_req_state *state = tevent_req_data(
1347                 req, struct rpc_api_pipe_req_state);
1348         NTSTATUS status;
1349
1350         if (tevent_req_is_nterror(req, &status)) {
1351                 /*
1352                  * We always have to initialize to reply pdu, even if there is
1353                  * none. The rpccli_* caller routines expect this.
1354                  */
1355                 *reply_pdu = data_blob_null;
1356                 return status;
1357         }
1358
1359         /* return data to caller and assign it ownership of memory */
1360         reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1361         reply_pdu->length = state->reply_pdu.length;
1362         state->reply_pdu.length = 0;
1363
1364         return NT_STATUS_OK;
1365 }
1366
1367 /****************************************************************************
1368  Check the rpc bind acknowledge response.
1369 ****************************************************************************/
1370
1371 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1372                                 const struct ndr_syntax_id *transfer)
1373 {
1374         struct dcerpc_ack_ctx ctx;
1375
1376         if (r->secondary_address_size == 0) {
1377                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1378         }
1379
1380         if (r->num_results < 1 || !r->ctx_list) {
1381                 return false;
1382         }
1383
1384         ctx = r->ctx_list[0];
1385
1386         /* check the transfer syntax */
1387         if ((ctx.syntax.if_version != transfer->if_version) ||
1388              (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1389                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1390                 return False;
1391         }
1392
1393         if (r->num_results != 0x1 || ctx.result != 0) {
1394                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1395                           r->num_results, ctx.reason));
1396         }
1397
1398         DEBUG(5,("check_bind_response: accepted!\n"));
1399         return True;
1400 }
1401
1402 /*******************************************************************
1403  Creates a DCE/RPC bind authentication response.
1404  This is the packet that is sent back to the server once we
1405  have received a BIND-ACK, to finish the third leg of
1406  the authentication handshake.
1407  ********************************************************************/
1408
1409 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1410                                 struct rpc_pipe_client *cli,
1411                                 uint32 rpc_call_id,
1412                                 enum dcerpc_AuthType auth_type,
1413                                 enum dcerpc_AuthLevel auth_level,
1414                                 DATA_BLOB *pauth_blob,
1415                                 DATA_BLOB *rpc_out)
1416 {
1417         NTSTATUS status;
1418         union dcerpc_payload u;
1419
1420         u.auth3._pad = 0;
1421
1422         status = dcerpc_push_dcerpc_auth(mem_ctx,
1423                                          auth_type,
1424                                          auth_level,
1425                                          0, /* auth_pad_length */
1426                                          1, /* auth_context_id */
1427                                          pauth_blob,
1428                                          &u.auth3.auth_info);
1429         if (!NT_STATUS_IS_OK(status)) {
1430                 return status;
1431         }
1432
1433         status = dcerpc_push_ncacn_packet(mem_ctx,
1434                                           DCERPC_PKT_AUTH3,
1435                                           DCERPC_PFC_FLAG_FIRST |
1436                                           DCERPC_PFC_FLAG_LAST,
1437                                           pauth_blob->length,
1438                                           rpc_call_id,
1439                                           &u,
1440                                           rpc_out);
1441         data_blob_free(&u.auth3.auth_info);
1442         if (!NT_STATUS_IS_OK(status)) {
1443                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1444                 return status;
1445         }
1446
1447         return NT_STATUS_OK;
1448 }
1449
1450 /*******************************************************************
1451  Creates a DCE/RPC bind alter context authentication request which
1452  may contain a spnego auth blobl
1453  ********************************************************************/
1454
1455 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1456                                         enum dcerpc_AuthType auth_type,
1457                                         enum dcerpc_AuthLevel auth_level,
1458                                         uint32 rpc_call_id,
1459                                         const struct ndr_syntax_id *abstract,
1460                                         const struct ndr_syntax_id *transfer,
1461                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1462                                         DATA_BLOB *rpc_out)
1463 {
1464         DATA_BLOB auth_info;
1465         NTSTATUS status;
1466
1467         status = dcerpc_push_dcerpc_auth(mem_ctx,
1468                                          auth_type,
1469                                          auth_level,
1470                                          0, /* auth_pad_length */
1471                                          1, /* auth_context_id */
1472                                          pauth_blob,
1473                                          &auth_info);
1474         if (!NT_STATUS_IS_OK(status)) {
1475                 return status;
1476         }
1477
1478         status = create_bind_or_alt_ctx_internal(mem_ctx,
1479                                                  DCERPC_PKT_ALTER,
1480                                                  rpc_call_id,
1481                                                  abstract,
1482                                                  transfer,
1483                                                  &auth_info,
1484                                                  rpc_out);
1485         data_blob_free(&auth_info);
1486         return status;
1487 }
1488
1489 /****************************************************************************
1490  Do an rpc bind.
1491 ****************************************************************************/
1492
1493 struct rpc_pipe_bind_state {
1494         struct tevent_context *ev;
1495         struct rpc_pipe_client *cli;
1496         DATA_BLOB rpc_out;
1497         bool auth3;
1498         uint32_t rpc_call_id;
1499 };
1500
1501 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1502 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1503                                    struct rpc_pipe_bind_state *state,
1504                                    DATA_BLOB *credentials);
1505 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1506                                      struct rpc_pipe_bind_state *state,
1507                                      DATA_BLOB *credentials);
1508
1509 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1510                                       struct tevent_context *ev,
1511                                       struct rpc_pipe_client *cli,
1512                                       struct pipe_auth_data *auth)
1513 {
1514         struct tevent_req *req, *subreq;
1515         struct rpc_pipe_bind_state *state;
1516         NTSTATUS status;
1517
1518         req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1519         if (req == NULL) {
1520                 return NULL;
1521         }
1522
1523         DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1524                 rpccli_pipe_txt(talloc_tos(), cli),
1525                 (unsigned int)auth->auth_type,
1526                 (unsigned int)auth->auth_level ));
1527
1528         state->ev = ev;
1529         state->cli = cli;
1530         state->rpc_call_id = get_rpc_call_id();
1531
1532         cli->auth = talloc_move(cli, &auth);
1533
1534         /* Marshall the outgoing data. */
1535         status = create_rpc_bind_req(state, cli,
1536                                      cli->auth,
1537                                      state->rpc_call_id,
1538                                      &cli->abstract_syntax,
1539                                      &cli->transfer_syntax,
1540                                      &state->rpc_out);
1541
1542         if (!NT_STATUS_IS_OK(status) &&
1543             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1544                 goto post_status;
1545         }
1546
1547         subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1548                                    DCERPC_PKT_BIND_ACK);
1549         if (subreq == NULL) {
1550                 goto fail;
1551         }
1552         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1553         return req;
1554
1555  post_status:
1556         tevent_req_nterror(req, status);
1557         return tevent_req_post(req, ev);
1558  fail:
1559         TALLOC_FREE(req);
1560         return NULL;
1561 }
1562
1563 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1564 {
1565         struct tevent_req *req = tevent_req_callback_data(
1566                 subreq, struct tevent_req);
1567         struct rpc_pipe_bind_state *state = tevent_req_data(
1568                 req, struct rpc_pipe_bind_state);
1569         struct pipe_auth_data *pauth = state->cli->auth;
1570         struct gensec_security *gensec_security;
1571         struct ncacn_packet *pkt = NULL;
1572         struct dcerpc_auth auth;
1573         DATA_BLOB auth_token = data_blob_null;
1574         NTSTATUS status;
1575
1576         status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1577         TALLOC_FREE(subreq);
1578         if (!NT_STATUS_IS_OK(status)) {
1579                 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1580                           rpccli_pipe_txt(talloc_tos(), state->cli),
1581                           nt_errstr(status)));
1582                 tevent_req_nterror(req, status);
1583                 return;
1584         }
1585
1586         if (state->auth3) {
1587                 tevent_req_done(req);
1588                 return;
1589         }
1590
1591         if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1592                 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1593                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1594                 return;
1595         }
1596
1597         state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1598         state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1599
1600         switch(pauth->auth_type) {
1601
1602         case DCERPC_AUTH_TYPE_NONE:
1603         case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1604         case DCERPC_AUTH_TYPE_SCHANNEL:
1605                 /* Bind complete. */
1606                 tevent_req_done(req);
1607                 return;
1608
1609         case DCERPC_AUTH_TYPE_NTLMSSP:
1610         case DCERPC_AUTH_TYPE_SPNEGO:
1611         case DCERPC_AUTH_TYPE_KRB5:
1612                 /* Paranoid lenght checks */
1613                 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1614                                                 + pkt->auth_length) {
1615                         tevent_req_nterror(req,
1616                                         NT_STATUS_INFO_LENGTH_MISMATCH);
1617                         return;
1618                 }
1619                 /* get auth credentials */
1620                 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1621                                                  &pkt->u.bind_ack.auth_info,
1622                                                  &auth, false);
1623                 if (!NT_STATUS_IS_OK(status)) {
1624                         DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1625                                   nt_errstr(status)));
1626                         tevent_req_nterror(req, status);
1627                         return;
1628                 }
1629                 break;
1630
1631         default:
1632                 goto err_out;
1633         }
1634
1635         /*
1636          * For authenticated binds we may need to do 3 or 4 leg binds.
1637          */
1638
1639         switch(pauth->auth_type) {
1640
1641         case DCERPC_AUTH_TYPE_NONE:
1642         case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1643         case DCERPC_AUTH_TYPE_SCHANNEL:
1644                 /* Bind complete. */
1645                 tevent_req_done(req);
1646                 return;
1647
1648         case DCERPC_AUTH_TYPE_NTLMSSP:
1649         case DCERPC_AUTH_TYPE_KRB5:
1650         case DCERPC_AUTH_TYPE_SPNEGO:
1651                 gensec_security = talloc_get_type_abort(pauth->auth_ctx,
1652                                                 struct gensec_security);
1653                 status = gensec_update(gensec_security, state, NULL,
1654                                        auth.credentials, &auth_token);
1655                 if (NT_STATUS_EQUAL(status,
1656                                     NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1657                         status = rpc_bind_next_send(req, state,
1658                                                         &auth_token);
1659                 } else if (NT_STATUS_IS_OK(status)) {
1660                         if (auth_token.length == 0) {
1661                                 /* Bind complete. */
1662                                 tevent_req_done(req);
1663                                 return;
1664                         }
1665                         status = rpc_bind_finish_send(req, state,
1666                                                         &auth_token);
1667                 }
1668                 break;
1669
1670         default:
1671                 goto err_out;
1672         }
1673
1674         if (!NT_STATUS_IS_OK(status)) {
1675                 tevent_req_nterror(req, status);
1676         }
1677         return;
1678
1679 err_out:
1680         DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
1681                  (unsigned int)state->cli->auth->auth_type));
1682         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
1683 }
1684
1685 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1686                                    struct rpc_pipe_bind_state *state,
1687                                    DATA_BLOB *auth_token)
1688 {
1689         struct pipe_auth_data *auth = state->cli->auth;
1690         struct tevent_req *subreq;
1691         NTSTATUS status;
1692
1693         /* Now prepare the alter context pdu. */
1694         data_blob_free(&state->rpc_out);
1695
1696         status = create_rpc_alter_context(state,
1697                                           auth->auth_type,
1698                                           auth->auth_level,
1699                                           state->rpc_call_id,
1700                                           &state->cli->abstract_syntax,
1701                                           &state->cli->transfer_syntax,
1702                                           auth_token,
1703                                           &state->rpc_out);
1704         if (!NT_STATUS_IS_OK(status)) {
1705                 return status;
1706         }
1707
1708         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1709                                    &state->rpc_out, DCERPC_PKT_ALTER_RESP);
1710         if (subreq == NULL) {
1711                 return NT_STATUS_NO_MEMORY;
1712         }
1713         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1714         return NT_STATUS_OK;
1715 }
1716
1717 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1718                                      struct rpc_pipe_bind_state *state,
1719                                      DATA_BLOB *auth_token)
1720 {
1721         struct pipe_auth_data *auth = state->cli->auth;
1722         struct tevent_req *subreq;
1723         NTSTATUS status;
1724
1725         state->auth3 = true;
1726
1727         /* Now prepare the auth3 context pdu. */
1728         data_blob_free(&state->rpc_out);
1729
1730         status = create_rpc_bind_auth3(state, state->cli,
1731                                         state->rpc_call_id,
1732                                         auth->auth_type,
1733                                         auth->auth_level,
1734                                         auth_token,
1735                                         &state->rpc_out);
1736         if (!NT_STATUS_IS_OK(status)) {
1737                 return status;
1738         }
1739
1740         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1741                                    &state->rpc_out, DCERPC_PKT_AUTH3);
1742         if (subreq == NULL) {
1743                 return NT_STATUS_NO_MEMORY;
1744         }
1745         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1746         return NT_STATUS_OK;
1747 }
1748
1749 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
1750 {
1751         return tevent_req_simple_recv_ntstatus(req);
1752 }
1753
1754 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
1755                        struct pipe_auth_data *auth)
1756 {
1757         TALLOC_CTX *frame = talloc_stackframe();
1758         struct tevent_context *ev;
1759         struct tevent_req *req;
1760         NTSTATUS status = NT_STATUS_OK;
1761
1762         ev = samba_tevent_context_init(frame);
1763         if (ev == NULL) {
1764                 status = NT_STATUS_NO_MEMORY;
1765                 goto fail;
1766         }
1767
1768         req = rpc_pipe_bind_send(frame, ev, cli, auth);
1769         if (req == NULL) {
1770                 status = NT_STATUS_NO_MEMORY;
1771                 goto fail;
1772         }
1773
1774         if (!tevent_req_poll(req, ev)) {
1775                 status = map_nt_error_from_unix(errno);
1776                 goto fail;
1777         }
1778
1779         status = rpc_pipe_bind_recv(req);
1780  fail:
1781         TALLOC_FREE(frame);
1782         return status;
1783 }
1784
1785 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
1786
1787 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
1788                                 unsigned int timeout)
1789 {
1790         unsigned int old;
1791
1792         if (rpc_cli->transport == NULL) {
1793                 return RPCCLI_DEFAULT_TIMEOUT;
1794         }
1795
1796         if (rpc_cli->transport->set_timeout == NULL) {
1797                 return RPCCLI_DEFAULT_TIMEOUT;
1798         }
1799
1800         old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
1801         if (old == 0) {
1802                 return RPCCLI_DEFAULT_TIMEOUT;
1803         }
1804
1805         return old;
1806 }
1807
1808 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
1809 {
1810         if (rpc_cli == NULL) {
1811                 return false;
1812         }
1813
1814         if (rpc_cli->transport == NULL) {
1815                 return false;
1816         }
1817
1818         return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
1819 }
1820
1821 struct rpccli_bh_state {
1822         struct rpc_pipe_client *rpc_cli;
1823 };
1824
1825 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
1826 {
1827         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1828                                      struct rpccli_bh_state);
1829
1830         return rpccli_is_connected(hs->rpc_cli);
1831 }
1832
1833 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
1834                                       uint32_t timeout)
1835 {
1836         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1837                                      struct rpccli_bh_state);
1838
1839         return rpccli_set_timeout(hs->rpc_cli, timeout);
1840 }
1841
1842 static void rpccli_bh_auth_info(struct dcerpc_binding_handle *h,
1843                                 enum dcerpc_AuthType *auth_type,
1844                                 enum dcerpc_AuthLevel *auth_level)
1845 {
1846         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1847                                      struct rpccli_bh_state);
1848
1849         if (hs->rpc_cli == NULL) {
1850                 return;
1851         }
1852
1853         if (hs->rpc_cli->auth == NULL) {
1854                 return;
1855         }
1856
1857         *auth_type = hs->rpc_cli->auth->auth_type;
1858         *auth_level = hs->rpc_cli->auth->auth_level;
1859 }
1860
1861 struct rpccli_bh_raw_call_state {
1862         DATA_BLOB in_data;
1863         DATA_BLOB out_data;
1864         uint32_t out_flags;
1865 };
1866
1867 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
1868
1869 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
1870                                                   struct tevent_context *ev,
1871                                                   struct dcerpc_binding_handle *h,
1872                                                   const struct GUID *object,
1873                                                   uint32_t opnum,
1874                                                   uint32_t in_flags,
1875                                                   const uint8_t *in_data,
1876                                                   size_t in_length)
1877 {
1878         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1879                                      struct rpccli_bh_state);
1880         struct tevent_req *req;
1881         struct rpccli_bh_raw_call_state *state;
1882         bool ok;
1883         struct tevent_req *subreq;
1884
1885         req = tevent_req_create(mem_ctx, &state,
1886                                 struct rpccli_bh_raw_call_state);
1887         if (req == NULL) {
1888                 return NULL;
1889         }
1890         state->in_data.data = discard_const_p(uint8_t, in_data);
1891         state->in_data.length = in_length;
1892
1893         ok = rpccli_bh_is_connected(h);
1894         if (!ok) {
1895                 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
1896                 return tevent_req_post(req, ev);
1897         }
1898
1899         subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
1900                                        opnum, &state->in_data);
1901         if (tevent_req_nomem(subreq, req)) {
1902                 return tevent_req_post(req, ev);
1903         }
1904         tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
1905
1906         return req;
1907 }
1908
1909 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
1910 {
1911         struct tevent_req *req =
1912                 tevent_req_callback_data(subreq,
1913                 struct tevent_req);
1914         struct rpccli_bh_raw_call_state *state =
1915                 tevent_req_data(req,
1916                 struct rpccli_bh_raw_call_state);
1917         NTSTATUS status;
1918
1919         state->out_flags = 0;
1920
1921         /* TODO: support bigendian responses */
1922
1923         status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
1924         TALLOC_FREE(subreq);
1925         if (!NT_STATUS_IS_OK(status)) {
1926                 tevent_req_nterror(req, status);
1927                 return;
1928         }
1929
1930         tevent_req_done(req);
1931 }
1932
1933 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
1934                                         TALLOC_CTX *mem_ctx,
1935                                         uint8_t **out_data,
1936                                         size_t *out_length,
1937                                         uint32_t *out_flags)
1938 {
1939         struct rpccli_bh_raw_call_state *state =
1940                 tevent_req_data(req,
1941                 struct rpccli_bh_raw_call_state);
1942         NTSTATUS status;
1943
1944         if (tevent_req_is_nterror(req, &status)) {
1945                 tevent_req_received(req);
1946                 return status;
1947         }
1948
1949         *out_data = talloc_move(mem_ctx, &state->out_data.data);
1950         *out_length = state->out_data.length;
1951         *out_flags = state->out_flags;
1952         tevent_req_received(req);
1953         return NT_STATUS_OK;
1954 }
1955
1956 struct rpccli_bh_disconnect_state {
1957         uint8_t _dummy;
1958 };
1959
1960 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
1961                                                 struct tevent_context *ev,
1962                                                 struct dcerpc_binding_handle *h)
1963 {
1964         struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1965                                      struct rpccli_bh_state);
1966         struct tevent_req *req;
1967         struct rpccli_bh_disconnect_state *state;
1968         bool ok;
1969
1970         req = tevent_req_create(mem_ctx, &state,
1971                                 struct rpccli_bh_disconnect_state);
1972         if (req == NULL) {
1973                 return NULL;
1974         }
1975
1976         ok = rpccli_bh_is_connected(h);
1977         if (!ok) {
1978                 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
1979                 return tevent_req_post(req, ev);
1980         }
1981
1982         /*
1983          * TODO: do a real async disconnect ...
1984          *
1985          * For now the caller needs to free rpc_cli
1986          */
1987         hs->rpc_cli = NULL;
1988
1989         tevent_req_done(req);
1990         return tevent_req_post(req, ev);
1991 }
1992
1993 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
1994 {
1995         NTSTATUS status;
1996
1997         if (tevent_req_is_nterror(req, &status)) {
1998                 tevent_req_received(req);
1999                 return status;
2000         }
2001
2002         tevent_req_received(req);
2003         return NT_STATUS_OK;
2004 }
2005
2006 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2007 {
2008         return true;
2009 }
2010
2011 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2012                                    int ndr_flags,
2013                                    const void *_struct_ptr,
2014                                    const struct ndr_interface_call *call)
2015 {
2016         void *struct_ptr = discard_const(_struct_ptr);
2017
2018         if (DEBUGLEVEL < 10) {
2019                 return;
2020         }
2021
2022         if (ndr_flags & NDR_IN) {
2023                 ndr_print_function_debug(call->ndr_print,
2024                                          call->name,
2025                                          ndr_flags,
2026                                          struct_ptr);
2027         }
2028         if (ndr_flags & NDR_OUT) {
2029                 ndr_print_function_debug(call->ndr_print,
2030                                          call->name,
2031                                          ndr_flags,
2032                                          struct_ptr);
2033         }
2034 }
2035
2036 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2037         .name                   = "rpccli",
2038         .is_connected           = rpccli_bh_is_connected,
2039         .set_timeout            = rpccli_bh_set_timeout,
2040         .auth_info              = rpccli_bh_auth_info,
2041         .raw_call_send          = rpccli_bh_raw_call_send,
2042         .raw_call_recv          = rpccli_bh_raw_call_recv,
2043         .disconnect_send        = rpccli_bh_disconnect_send,
2044         .disconnect_recv        = rpccli_bh_disconnect_recv,
2045
2046         .ref_alloc              = rpccli_bh_ref_alloc,
2047         .do_ndr_print           = rpccli_bh_do_ndr_print,
2048 };
2049
2050 /* initialise a rpc_pipe_client binding handle */
2051 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c,
2052                                         const struct GUID *object,
2053                                         const struct ndr_interface_table *table)
2054 {
2055         struct dcerpc_binding_handle *h;
2056         struct rpccli_bh_state *hs;
2057
2058         h = dcerpc_binding_handle_create(c,
2059                                          &rpccli_bh_ops,
2060                                          object,
2061                                          table,
2062                                          &hs,
2063                                          struct rpccli_bh_state,
2064                                          __location__);
2065         if (h == NULL) {
2066                 return NULL;
2067         }
2068         hs->rpc_cli = c;
2069
2070         return h;
2071 }
2072
2073 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2074                                   struct pipe_auth_data **presult)
2075 {
2076         struct pipe_auth_data *result;
2077
2078         result = talloc(mem_ctx, struct pipe_auth_data);
2079         if (result == NULL) {
2080                 return NT_STATUS_NO_MEMORY;
2081         }
2082
2083         result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
2084         result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
2085
2086         result->user_name = talloc_strdup(result, "");
2087         result->domain = talloc_strdup(result, "");
2088         if ((result->user_name == NULL) || (result->domain == NULL)) {
2089                 TALLOC_FREE(result);
2090                 return NT_STATUS_NO_MEMORY;
2091         }
2092
2093         *presult = result;
2094         return NT_STATUS_OK;
2095 }
2096
2097 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2098                                struct pipe_auth_data **presult)
2099 {
2100         struct pipe_auth_data *result;
2101
2102         result = talloc(mem_ctx, struct pipe_auth_data);
2103         if (result == NULL) {
2104                 return NT_STATUS_NO_MEMORY;
2105         }
2106
2107         result->auth_type = DCERPC_AUTH_TYPE_NONE;
2108         result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2109
2110         result->user_name = talloc_strdup(result, "");
2111         result->domain = talloc_strdup(result, "");
2112         if ((result->user_name == NULL) || (result->domain == NULL)) {
2113                 TALLOC_FREE(result);
2114                 return NT_STATUS_NO_MEMORY;
2115         }
2116
2117         *presult = result;
2118         return NT_STATUS_OK;
2119 }
2120
2121 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2122                                          enum dcerpc_AuthType auth_type,
2123                                          enum dcerpc_AuthLevel auth_level,
2124                                          const char *server,
2125                                          const char *target_service,
2126                                          const char *domain,
2127                                          const char *username,
2128                                          const char *password,
2129                                          enum credentials_use_kerberos use_kerberos,
2130                                          struct netlogon_creds_CredentialState *creds,
2131                                          struct pipe_auth_data **presult)
2132 {
2133         struct auth_generic_state *auth_generic_ctx;
2134         struct pipe_auth_data *result;
2135         NTSTATUS status;
2136
2137         result = talloc(mem_ctx, struct pipe_auth_data);
2138         if (result == NULL) {
2139                 return NT_STATUS_NO_MEMORY;
2140         }
2141
2142         result->auth_type = auth_type;
2143         result->auth_level = auth_level;
2144
2145         result->user_name = talloc_strdup(result, username);
2146         result->domain = talloc_strdup(result, domain);
2147         if ((result->user_name == NULL) || (result->domain == NULL)) {
2148                 status = NT_STATUS_NO_MEMORY;
2149                 goto fail;
2150         }
2151
2152         status = auth_generic_client_prepare(result,
2153                                              &auth_generic_ctx);
2154         if (!NT_STATUS_IS_OK(status)) {
2155                 goto fail;
2156         }
2157
2158         status = auth_generic_set_username(auth_generic_ctx, username);
2159         if (!NT_STATUS_IS_OK(status)) {
2160                 goto fail;
2161         }
2162
2163         status = auth_generic_set_domain(auth_generic_ctx, domain);
2164         if (!NT_STATUS_IS_OK(status)) {
2165                 goto fail;
2166         }
2167
2168         status = auth_generic_set_password(auth_generic_ctx, password);
2169         if (!NT_STATUS_IS_OK(status)) {
2170                 goto fail;
2171         }
2172
2173         status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2174         if (!NT_STATUS_IS_OK(status)) {
2175                 goto fail;
2176         }
2177
2178         status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2179         if (!NT_STATUS_IS_OK(status)) {
2180                 goto fail;
2181         }
2182
2183         cli_credentials_set_kerberos_state(auth_generic_ctx->credentials, use_kerberos);
2184         cli_credentials_set_netlogon_creds(auth_generic_ctx->credentials, creds);
2185
2186         status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2187         if (!NT_STATUS_IS_OK(status)) {
2188                 goto fail;
2189         }
2190
2191         result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2192         talloc_free(auth_generic_ctx);
2193         *presult = result;
2194         return NT_STATUS_OK;
2195
2196  fail:
2197         TALLOC_FREE(result);
2198         return status;
2199 }
2200
2201 /**
2202  * Create an rpc pipe client struct, connecting to a tcp port.
2203  */
2204 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2205                                        const struct sockaddr_storage *ss_addr,
2206                                        uint16_t port,
2207                                        const struct ndr_interface_table *table,
2208                                        struct rpc_pipe_client **presult)
2209 {
2210         struct rpc_pipe_client *result;
2211         struct sockaddr_storage addr;
2212         NTSTATUS status;
2213         int fd;
2214
2215         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2216         if (result == NULL) {
2217                 return NT_STATUS_NO_MEMORY;
2218         }
2219
2220         result->abstract_syntax = table->syntax_id;
2221         result->transfer_syntax = ndr_transfer_syntax_ndr;
2222
2223         result->desthost = talloc_strdup(result, host);
2224         result->srv_name_slash = talloc_asprintf_strupper_m(
2225                 result, "\\\\%s", result->desthost);
2226         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2227                 status = NT_STATUS_NO_MEMORY;
2228                 goto fail;
2229         }
2230
2231         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2232         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2233
2234         if (ss_addr == NULL) {
2235                 if (!resolve_name(host, &addr, NBT_NAME_SERVER, false)) {
2236                         status = NT_STATUS_NOT_FOUND;
2237                         goto fail;
2238                 }
2239         } else {
2240                 addr = *ss_addr;
2241         }
2242
2243         status = open_socket_out(&addr, port, 60*1000, &fd);
2244         if (!NT_STATUS_IS_OK(status)) {
2245                 goto fail;
2246         }
2247         set_socket_options(fd, lp_socket_options());
2248
2249         status = rpc_transport_sock_init(result, fd, &result->transport);
2250         if (!NT_STATUS_IS_OK(status)) {
2251                 close(fd);
2252                 goto fail;
2253         }
2254
2255         result->transport->transport = NCACN_IP_TCP;
2256
2257         result->binding_handle = rpccli_bh_create(result, NULL, table);
2258         if (result->binding_handle == NULL) {
2259                 TALLOC_FREE(result);
2260                 return NT_STATUS_NO_MEMORY;
2261         }
2262
2263         *presult = result;
2264         return NT_STATUS_OK;
2265
2266  fail:
2267         TALLOC_FREE(result);
2268         return status;
2269 }
2270
2271 /**
2272  * Determine the tcp port on which a dcerpc interface is listening
2273  * for the ncacn_ip_tcp transport via the endpoint mapper of the
2274  * target host.
2275  */
2276 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2277                                       const struct sockaddr_storage *addr,
2278                                       const struct ndr_interface_table *table,
2279                                       uint16_t *pport)
2280 {
2281         NTSTATUS status;
2282         struct rpc_pipe_client *epm_pipe = NULL;
2283         struct dcerpc_binding_handle *epm_handle = NULL;
2284         struct pipe_auth_data *auth = NULL;
2285         struct dcerpc_binding *map_binding = NULL;
2286         struct dcerpc_binding *res_binding = NULL;
2287         struct epm_twr_t *map_tower = NULL;
2288         struct epm_twr_t *res_towers = NULL;
2289         struct policy_handle *entry_handle = NULL;
2290         uint32_t num_towers = 0;
2291         uint32_t max_towers = 1;
2292         struct epm_twr_p_t towers;
2293         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2294         uint32_t result = 0;
2295
2296         if (pport == NULL) {
2297                 status = NT_STATUS_INVALID_PARAMETER;
2298                 goto done;
2299         }
2300
2301         if (ndr_syntax_id_equal(&table->syntax_id,
2302                                 &ndr_table_epmapper.syntax_id)) {
2303                 *pport = 135;
2304                 status = NT_STATUS_OK;
2305                 goto done;
2306         }
2307
2308         /* open the connection to the endpoint mapper */
2309         status = rpc_pipe_open_tcp_port(tmp_ctx, host, addr, 135,
2310                                         &ndr_table_epmapper,
2311                                         &epm_pipe);
2312
2313         if (!NT_STATUS_IS_OK(status)) {
2314                 goto done;
2315         }
2316         epm_handle = epm_pipe->binding_handle;
2317
2318         status = rpccli_anon_bind_data(tmp_ctx, &auth);
2319         if (!NT_STATUS_IS_OK(status)) {
2320                 goto done;
2321         }
2322
2323         status = rpc_pipe_bind(epm_pipe, auth);
2324         if (!NT_STATUS_IS_OK(status)) {
2325                 goto done;
2326         }
2327
2328         /* create tower for asking the epmapper */
2329
2330         map_binding = talloc_zero(tmp_ctx, struct dcerpc_binding);
2331         if (map_binding == NULL) {
2332                 status = NT_STATUS_NO_MEMORY;
2333                 goto done;
2334         }
2335
2336         map_binding->transport = NCACN_IP_TCP;
2337         map_binding->object = table->syntax_id;
2338         map_binding->host = host; /* needed? */
2339         map_binding->endpoint = "0"; /* correct? needed? */
2340
2341         map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2342         if (map_tower == NULL) {
2343                 status = NT_STATUS_NO_MEMORY;
2344                 goto done;
2345         }
2346
2347         status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2348                                             &(map_tower->tower));
2349         if (!NT_STATUS_IS_OK(status)) {
2350                 goto done;
2351         }
2352
2353         /* allocate further parameters for the epm_Map call */
2354
2355         res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2356         if (res_towers == NULL) {
2357                 status = NT_STATUS_NO_MEMORY;
2358                 goto done;
2359         }
2360         towers.twr = res_towers;
2361
2362         entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2363         if (entry_handle == NULL) {
2364                 status = NT_STATUS_NO_MEMORY;
2365                 goto done;
2366         }
2367
2368         /* ask the endpoint mapper for the port */
2369
2370         status = dcerpc_epm_Map(epm_handle,
2371                                 tmp_ctx,
2372                                 discard_const_p(struct GUID,
2373                                               &(table->syntax_id.uuid)),
2374                                 map_tower,
2375                                 entry_handle,
2376                                 max_towers,
2377                                 &num_towers,
2378                                 &towers,
2379                                 &result);
2380
2381         if (!NT_STATUS_IS_OK(status)) {
2382                 goto done;
2383         }
2384
2385         if (result != EPMAPPER_STATUS_OK) {
2386                 status = NT_STATUS_UNSUCCESSFUL;
2387                 goto done;
2388         }
2389
2390         if (num_towers != 1) {
2391                 status = NT_STATUS_UNSUCCESSFUL;
2392                 goto done;
2393         }
2394
2395         /* extract the port from the answer */
2396
2397         status = dcerpc_binding_from_tower(tmp_ctx,
2398                                            &(towers.twr->tower),
2399                                            &res_binding);
2400         if (!NT_STATUS_IS_OK(status)) {
2401                 goto done;
2402         }
2403
2404         /* are further checks here necessary? */
2405         if (res_binding->transport != NCACN_IP_TCP) {
2406                 status = NT_STATUS_UNSUCCESSFUL;
2407                 goto done;
2408         }
2409
2410         *pport = (uint16_t)atoi(res_binding->endpoint);
2411
2412 done:
2413         TALLOC_FREE(tmp_ctx);
2414         return status;
2415 }
2416
2417 /**
2418  * Create a rpc pipe client struct, connecting to a host via tcp.
2419  * The port is determined by asking the endpoint mapper on the given
2420  * host.
2421  */
2422 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2423                            const struct sockaddr_storage *addr,
2424                            const struct ndr_interface_table *table,
2425                            struct rpc_pipe_client **presult)
2426 {
2427         NTSTATUS status;
2428         uint16_t port = 0;
2429
2430         status = rpc_pipe_get_tcp_port(host, addr, table, &port);
2431         if (!NT_STATUS_IS_OK(status)) {
2432                 return status;
2433         }
2434
2435         return rpc_pipe_open_tcp_port(mem_ctx, host, addr, port,
2436                                       table, presult);
2437 }
2438
2439 /********************************************************************
2440  Create a rpc pipe client struct, connecting to a unix domain socket
2441  ********************************************************************/
2442 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2443                                const struct ndr_interface_table *table,
2444                                struct rpc_pipe_client **presult)
2445 {
2446         struct rpc_pipe_client *result;
2447         struct sockaddr_un addr;
2448         NTSTATUS status;
2449         int fd;
2450         socklen_t salen;
2451
2452         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2453         if (result == NULL) {
2454                 return NT_STATUS_NO_MEMORY;
2455         }
2456
2457         result->abstract_syntax = table->syntax_id;
2458         result->transfer_syntax = ndr_transfer_syntax_ndr;
2459
2460         result->desthost = get_myname(result);
2461         result->srv_name_slash = talloc_asprintf_strupper_m(
2462                 result, "\\\\%s", result->desthost);
2463         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2464                 status = NT_STATUS_NO_MEMORY;
2465                 goto fail;
2466         }
2467
2468         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2469         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2470
2471         fd = socket(AF_UNIX, SOCK_STREAM, 0);
2472         if (fd == -1) {
2473                 status = map_nt_error_from_unix(errno);
2474                 goto fail;
2475         }
2476
2477         ZERO_STRUCT(addr);
2478         addr.sun_family = AF_UNIX;
2479         strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2480         salen = sizeof(struct sockaddr_un);
2481
2482         if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
2483                 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2484                           strerror(errno)));
2485                 close(fd);
2486                 return map_nt_error_from_unix(errno);
2487         }
2488
2489         status = rpc_transport_sock_init(result, fd, &result->transport);
2490         if (!NT_STATUS_IS_OK(status)) {
2491                 close(fd);
2492                 goto fail;
2493         }
2494
2495         result->transport->transport = NCALRPC;
2496
2497         result->binding_handle = rpccli_bh_create(result, NULL, table);
2498         if (result->binding_handle == NULL) {
2499                 TALLOC_FREE(result);
2500                 return NT_STATUS_NO_MEMORY;
2501         }
2502
2503         *presult = result;
2504         return NT_STATUS_OK;
2505
2506  fail:
2507         TALLOC_FREE(result);
2508         return status;
2509 }
2510
2511 struct rpc_pipe_client_np_ref {
2512         struct cli_state *cli;
2513         struct rpc_pipe_client *pipe;
2514 };
2515
2516 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2517 {
2518         DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2519         return 0;
2520 }
2521
2522 /****************************************************************************
2523  Open a named pipe over SMB to a remote server.
2524  *
2525  * CAVEAT CALLER OF THIS FUNCTION:
2526  *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2527  *    so be sure that this function is called AFTER any structure (vs pointer)
2528  *    assignment of the cli.  In particular, libsmbclient does structure
2529  *    assignments of cli, which invalidates the data in the returned
2530  *    rpc_pipe_client if this function is called before the structure assignment
2531  *    of cli.
2532  *
2533  ****************************************************************************/
2534
2535 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2536                                  const struct ndr_interface_table *table,
2537                                  struct rpc_pipe_client **presult)
2538 {
2539         struct rpc_pipe_client *result;
2540         NTSTATUS status;
2541         struct rpc_pipe_client_np_ref *np_ref;
2542
2543         /* sanity check to protect against crashes */
2544
2545         if ( !cli ) {
2546                 return NT_STATUS_INVALID_HANDLE;
2547         }
2548
2549         result = talloc_zero(NULL, struct rpc_pipe_client);
2550         if (result == NULL) {
2551                 return NT_STATUS_NO_MEMORY;
2552         }
2553
2554         result->abstract_syntax = table->syntax_id;
2555         result->transfer_syntax = ndr_transfer_syntax_ndr;
2556         result->desthost = talloc_strdup(result, smbXcli_conn_remote_name(cli->conn));
2557         result->srv_name_slash = talloc_asprintf_strupper_m(
2558                 result, "\\\\%s", result->desthost);
2559
2560         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2561         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2562
2563         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2564                 TALLOC_FREE(result);
2565                 return NT_STATUS_NO_MEMORY;
2566         }
2567
2568         status = rpc_transport_np_init(result, cli, table,
2569                                        &result->transport);
2570         if (!NT_STATUS_IS_OK(status)) {
2571                 TALLOC_FREE(result);
2572                 return status;
2573         }
2574
2575         result->transport->transport = NCACN_NP;
2576
2577         np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2578         if (np_ref == NULL) {
2579                 TALLOC_FREE(result);
2580                 return NT_STATUS_NO_MEMORY;
2581         }
2582         np_ref->cli = cli;
2583         np_ref->pipe = result;
2584
2585         DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2586         talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2587
2588         result->binding_handle = rpccli_bh_create(result, NULL, table);
2589         if (result->binding_handle == NULL) {
2590                 TALLOC_FREE(result);
2591                 return NT_STATUS_NO_MEMORY;
2592         }
2593
2594         *presult = result;
2595         return NT_STATUS_OK;
2596 }
2597
2598 /****************************************************************************
2599  Open a pipe to a remote server.
2600  ****************************************************************************/
2601
2602 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2603                                   enum dcerpc_transport_t transport,
2604                                   const struct ndr_interface_table *table,
2605                                   struct rpc_pipe_client **presult)
2606 {
2607         switch (transport) {
2608         case NCACN_IP_TCP:
2609                 return rpc_pipe_open_tcp(NULL,
2610                                          smbXcli_conn_remote_name(cli->conn),
2611                                          smbXcli_conn_remote_sockaddr(cli->conn),
2612                                          table, presult);
2613         case NCACN_NP:
2614                 return rpc_pipe_open_np(cli, table, presult);
2615         default:
2616                 return NT_STATUS_NOT_IMPLEMENTED;
2617         }
2618 }
2619
2620 /****************************************************************************
2621  Open a named pipe to an SMB server and bind anonymously.
2622  ****************************************************************************/
2623
2624 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2625                                             enum dcerpc_transport_t transport,
2626                                             const struct ndr_interface_table *table,
2627                                             struct rpc_pipe_client **presult)
2628 {
2629         struct rpc_pipe_client *result;
2630         struct pipe_auth_data *auth;
2631         NTSTATUS status;
2632
2633         status = cli_rpc_pipe_open(cli, transport, table, &result);
2634         if (!NT_STATUS_IS_OK(status)) {
2635                 return status;
2636         }
2637
2638         status = rpccli_anon_bind_data(result, &auth);
2639         if (!NT_STATUS_IS_OK(status)) {
2640                 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2641                           nt_errstr(status)));
2642                 TALLOC_FREE(result);
2643                 return status;
2644         }
2645
2646         /*
2647          * This is a bit of an abstraction violation due to the fact that an
2648          * anonymous bind on an authenticated SMB inherits the user/domain
2649          * from the enclosing SMB creds
2650          */
2651
2652         TALLOC_FREE(auth->user_name);
2653         TALLOC_FREE(auth->domain);
2654
2655         auth->user_name = talloc_strdup(auth, cli->user_name);
2656         auth->domain = talloc_strdup(auth, cli->domain);
2657
2658         if (transport == NCACN_NP) {
2659                 struct smbXcli_session *session;
2660
2661                 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2662                         session = cli->smb2.session;
2663                 } else {
2664                         session = cli->smb1.session;
2665                 }
2666
2667                 status = smbXcli_session_application_key(session, auth,
2668                                                 &auth->transport_session_key);
2669                 if (!NT_STATUS_IS_OK(status)) {
2670                         auth->transport_session_key = data_blob_null;
2671                 }
2672         }
2673
2674         if ((auth->user_name == NULL) || (auth->domain == NULL)) {
2675                 TALLOC_FREE(result);
2676                 return NT_STATUS_NO_MEMORY;
2677         }
2678
2679         status = rpc_pipe_bind(result, auth);
2680         if (!NT_STATUS_IS_OK(status)) {
2681                 int lvl = 0;
2682                 if (ndr_syntax_id_equal(&table->syntax_id,
2683                                         &ndr_table_dssetup.syntax_id)) {
2684                         /* non AD domains just don't have this pipe, avoid
2685                          * level 0 statement in that case - gd */
2686                         lvl = 3;
2687                 }
2688                 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2689                             "%s failed with error %s\n",
2690                             table->name,
2691                             nt_errstr(status) ));
2692                 TALLOC_FREE(result);
2693                 return status;
2694         }
2695
2696         DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2697                   "%s and bound anonymously.\n",
2698                   table->name,
2699                   result->desthost));
2700
2701         *presult = result;
2702         return NT_STATUS_OK;
2703 }
2704
2705 /****************************************************************************
2706  ****************************************************************************/
2707
2708 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2709                                   const struct ndr_interface_table *table,
2710                                   struct rpc_pipe_client **presult)
2711 {
2712         return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2713                                                   table, presult);
2714 }
2715
2716 /****************************************************************************
2717  Open a named pipe to an SMB server and bind using the mech specified
2718  ****************************************************************************/
2719
2720 NTSTATUS cli_rpc_pipe_open_generic_auth(struct cli_state *cli,
2721                                         const struct ndr_interface_table *table,
2722                                         enum dcerpc_transport_t transport,
2723                                         enum dcerpc_AuthType auth_type,
2724                                         enum dcerpc_AuthLevel auth_level,
2725                                         const char *server,
2726                                         const char *domain,
2727                                         const char *username,
2728                                         const char *password,
2729                                         struct rpc_pipe_client **presult)
2730 {
2731         struct rpc_pipe_client *result;
2732         struct pipe_auth_data *auth = NULL;
2733         const char *target_service = table->authservices->names[0];
2734
2735         NTSTATUS status;
2736
2737         status = cli_rpc_pipe_open(cli, transport, table, &result);
2738         if (!NT_STATUS_IS_OK(status)) {
2739                 return status;
2740         }
2741
2742         status = rpccli_generic_bind_data(result,
2743                                           auth_type, auth_level,
2744                                           server, target_service,
2745                                           domain, username, password,
2746                                           CRED_AUTO_USE_KERBEROS,
2747                                           NULL,
2748                                           &auth);
2749         if (!NT_STATUS_IS_OK(status)) {
2750                 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
2751                           nt_errstr(status)));
2752                 goto err;
2753         }
2754
2755         status = rpc_pipe_bind(result, auth);
2756         if (!NT_STATUS_IS_OK(status)) {
2757                 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
2758                         nt_errstr(status) ));
2759                 goto err;
2760         }
2761
2762         DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
2763                 "machine %s and bound as user %s\\%s.\n", table->name,
2764                   result->desthost, domain, username));
2765
2766         *presult = result;
2767         return NT_STATUS_OK;
2768
2769   err:
2770
2771         TALLOC_FREE(result);
2772         return status;
2773 }
2774
2775 /****************************************************************************
2776  External interface.
2777  Open a named pipe to an SMB server and bind using schannel (bind type 68)
2778  using session_key. sign and seal.
2779
2780  The *pdc will be stolen onto this new pipe
2781  ****************************************************************************/
2782
2783 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
2784                                              const struct ndr_interface_table *table,
2785                                              enum dcerpc_transport_t transport,
2786                                              enum dcerpc_AuthLevel auth_level,
2787                                              const char *domain,
2788                                              struct netlogon_creds_CredentialState **pdc,
2789                                              struct rpc_pipe_client **_rpccli)
2790 {
2791         struct rpc_pipe_client *rpccli;
2792         struct pipe_auth_data *rpcauth;
2793         NTSTATUS status;
2794         NTSTATUS result;
2795         struct netlogon_creds_CredentialState save_creds;
2796         struct netr_Authenticator auth;
2797         struct netr_Authenticator return_auth;
2798         union netr_Capabilities capabilities;
2799         const char *target_service = table->authservices->names[0];
2800
2801         status = cli_rpc_pipe_open(cli, transport, table, &rpccli);
2802         if (!NT_STATUS_IS_OK(status)) {
2803                 return status;
2804         }
2805
2806         status = rpccli_generic_bind_data(rpccli,
2807                                           DCERPC_AUTH_TYPE_SCHANNEL,
2808                                           auth_level,
2809                                           NULL,
2810                                           target_service,
2811                                           domain,
2812                                           (*pdc)->computer_name,
2813                                           NULL,
2814                                           CRED_AUTO_USE_KERBEROS,
2815                                           *pdc,
2816                                           &rpcauth);
2817         if (!NT_STATUS_IS_OK(status)) {
2818                 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
2819                           nt_errstr(status)));
2820                 TALLOC_FREE(rpccli);
2821                 return status;
2822         }
2823
2824         /*
2825          * The credentials on a new netlogon pipe are the ones we are passed
2826          * in - copy them over
2827          *
2828          * This may get overwritten... in rpc_pipe_bind()...
2829          */
2830         rpccli->dc = netlogon_creds_copy(rpccli, *pdc);
2831         if (rpccli->dc == NULL) {
2832                 TALLOC_FREE(rpccli);
2833                 return NT_STATUS_NO_MEMORY;
2834         }
2835
2836         status = rpc_pipe_bind(rpccli, rpcauth);
2837         if (!NT_STATUS_IS_OK(status)) {
2838                 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
2839                           "cli_rpc_pipe_bind failed with error %s\n",
2840                           nt_errstr(status) ));
2841                 TALLOC_FREE(rpccli);
2842                 return status;
2843         }
2844
2845         if (!ndr_syntax_id_equal(&table->syntax_id, &ndr_table_netlogon.syntax_id)) {
2846                 goto done;
2847         }
2848
2849         save_creds = *rpccli->dc;
2850         ZERO_STRUCT(return_auth);
2851         ZERO_STRUCT(capabilities);
2852
2853         netlogon_creds_client_authenticator(&save_creds, &auth);
2854
2855         status = dcerpc_netr_LogonGetCapabilities(rpccli->binding_handle,
2856                                                   talloc_tos(),
2857                                                   rpccli->srv_name_slash,
2858                                                   save_creds.computer_name,
2859                                                   &auth, &return_auth,
2860                                                   1, &capabilities,
2861                                                   &result);
2862         if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
2863                 if (save_creds.negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
2864                         DEBUG(5, ("AES was negotiated and the error was %s - "
2865                                   "downgrade detected\n",
2866                                   nt_errstr(status)));
2867                         TALLOC_FREE(rpccli);
2868                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2869                 }
2870
2871                 /* This is probably an old Samba Version */
2872                 DEBUG(5, ("We are checking against an NT or old Samba - %s\n",
2873                           nt_errstr(status)));
2874                 goto done;
2875         }
2876
2877         if (!NT_STATUS_IS_OK(status)) {
2878                 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities failed with %s\n",
2879                           nt_errstr(status)));
2880                 TALLOC_FREE(rpccli);
2881                 return status;
2882         }
2883
2884         if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
2885                 if (save_creds.negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
2886                         /* This means AES isn't supported. */
2887                         DEBUG(5, ("AES was negotiated and the result was %s - "
2888                                   "downgrade detected\n",
2889                                   nt_errstr(result)));
2890                         TALLOC_FREE(rpccli);
2891                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2892                 }
2893
2894                 /* This is probably an old Windows version */
2895                 DEBUG(5, ("We are checking against an win2k3 or Samba - %s\n",
2896                           nt_errstr(result)));
2897                 goto done;
2898         }
2899
2900         /*
2901          * We need to check the credential state here, cause win2k3 and earlier
2902          * returns NT_STATUS_NOT_IMPLEMENTED
2903          */
2904         if (!netlogon_creds_client_check(&save_creds, &return_auth.cred)) {
2905                 /*
2906                  * Server replied with bad credential. Fail.
2907                  */
2908                 DEBUG(0,("cli_rpc_pipe_open_schannel_with_key: server %s "
2909                          "replied with bad credential\n",
2910                          rpccli->desthost));
2911                 TALLOC_FREE(rpccli);
2912                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2913         }
2914         *rpccli->dc = save_creds;
2915
2916         if (!NT_STATUS_IS_OK(result)) {
2917                 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities failed with %s\n",
2918                           nt_errstr(result)));
2919                 TALLOC_FREE(rpccli);
2920                 return result;
2921         }
2922
2923         if (!(save_creds.negotiate_flags & NETLOGON_NEG_SUPPORTS_AES)) {
2924                 /* This means AES isn't supported. */
2925                 DEBUG(5, ("AES is not negotiated, but netr_LogonGetCapabilities "
2926                           "was OK - downgrade detected\n"));
2927                 TALLOC_FREE(rpccli);
2928                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2929         }
2930
2931         if (save_creds.negotiate_flags != capabilities.server_capabilities) {
2932                 DEBUG(0, ("The client capabilities don't match the server "
2933                           "capabilities: local[0x%08X] remote[0x%08X]\n",
2934                           save_creds.negotiate_flags,
2935                           capabilities.server_capabilities));
2936                 TALLOC_FREE(rpccli);
2937                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2938         }
2939
2940 done:
2941         DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
2942                   "for domain %s and bound using schannel.\n",
2943                   table->name,
2944                   rpccli->desthost, domain));
2945
2946         *_rpccli = rpccli;
2947         return NT_STATUS_OK;
2948 }
2949
2950 NTSTATUS cli_rpc_pipe_open_spnego(struct cli_state *cli,
2951                                   const struct ndr_interface_table *table,
2952                                   enum dcerpc_transport_t transport,
2953                                   const char *oid,
2954                                   enum dcerpc_AuthLevel auth_level,
2955                                   const char *server,
2956                                   const char *domain,
2957                                   const char *username,
2958                                   const char *password,
2959                                   struct rpc_pipe_client **presult)
2960 {
2961         struct rpc_pipe_client *result;
2962         struct pipe_auth_data *auth = NULL;
2963         const char *target_service = table->authservices->names[0];
2964
2965         NTSTATUS status;
2966         enum credentials_use_kerberos use_kerberos;
2967
2968         if (strcmp(oid, GENSEC_OID_KERBEROS5) == 0) {
2969                 use_kerberos = CRED_MUST_USE_KERBEROS;
2970         } else if (strcmp(oid, GENSEC_OID_NTLMSSP) == 0) {
2971                 use_kerberos = CRED_DONT_USE_KERBEROS;
2972         } else {
2973                 return NT_STATUS_INVALID_PARAMETER;
2974         }
2975
2976         status = cli_rpc_pipe_open(cli, transport, table, &result);
2977         if (!NT_STATUS_IS_OK(status)) {
2978                 return status;
2979         }
2980
2981         status = rpccli_generic_bind_data(result,
2982                                           DCERPC_AUTH_TYPE_SPNEGO, auth_level,
2983                                           server, target_service,
2984                                           domain, username, password,
2985                                           use_kerberos, NULL,
2986                                           &auth);
2987         if (!NT_STATUS_IS_OK(status)) {
2988                 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
2989                           nt_errstr(status)));
2990                 goto err;
2991         }
2992
2993         status = rpc_pipe_bind(result, auth);
2994         if (!NT_STATUS_IS_OK(status)) {
2995                 DEBUG(0, ("cli_rpc_pipe_open_spnego: cli_rpc_pipe_bind failed with error %s\n",
2996                         nt_errstr(status) ));
2997                 goto err;
2998         }
2999
3000         DEBUG(10,("cli_rpc_pipe_open_spnego: opened pipe %s to "
3001                   "machine %s.\n", table->name,
3002                   result->desthost));
3003
3004         *presult = result;
3005         return NT_STATUS_OK;
3006
3007   err:
3008
3009         TALLOC_FREE(result);
3010         return status;
3011 }
3012
3013 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3014                              struct rpc_pipe_client *cli,
3015                              DATA_BLOB *session_key)
3016 {
3017         NTSTATUS status;
3018         struct pipe_auth_data *a;
3019         struct gensec_security *gensec_security;
3020         DATA_BLOB sk = data_blob_null;
3021         bool make_dup = false;
3022
3023         if (!session_key || !cli) {
3024                 return NT_STATUS_INVALID_PARAMETER;
3025         }
3026
3027         a = cli->auth;
3028
3029         if (a == NULL) {
3030                 return NT_STATUS_INVALID_PARAMETER;
3031         }
3032
3033         switch (cli->auth->auth_type) {
3034         case DCERPC_AUTH_TYPE_SPNEGO:
3035         case DCERPC_AUTH_TYPE_NTLMSSP:
3036         case DCERPC_AUTH_TYPE_KRB5:
3037                 gensec_security = talloc_get_type_abort(a->auth_ctx,
3038                                                 struct gensec_security);
3039                 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3040                 if (!NT_STATUS_IS_OK(status)) {
3041                         return status;
3042                 }
3043                 make_dup = false;
3044                 break;
3045         case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
3046         case DCERPC_AUTH_TYPE_NONE:
3047                 sk = data_blob_const(a->transport_session_key.data,
3048                                      a->transport_session_key.length);
3049                 make_dup = true;
3050                 break;
3051         default:
3052                 break;
3053         }
3054
3055         if (!sk.data) {
3056                 return NT_STATUS_NO_USER_SESSION_KEY;
3057         }
3058
3059         if (make_dup) {
3060                 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3061         } else {
3062                 *session_key = sk;
3063         }
3064
3065         return NT_STATUS_OK;
3066 }