source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "librpc/gen_ndr/cli_epmapper.h"
  22 #include "../librpc/gen_ndr/ndr_schannel.h"
  23 #include "../librpc/gen_ndr/ndr_dssetup.h"
  24 #include "../librpc/gen_ndr/ndr_netlogon.h"
  25 #include "../libcli/auth/schannel.h"
  26 #include "../libcli/auth/spnego.h"
  27 #include "smb_krb5.h"
  28 #include "../libcli/auth/ntlmssp.h"
  29 #include "ntlmssp_wrap.h"
  30 #include "rpc_client/cli_netlogon.h"
  31 #include "librpc/gen_ndr/ndr_dcerpc.h"
  32 #include "librpc/rpc/dcerpc.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_RPC_CLI
  36
  37 /********************************************************************
  38  Pipe description for a DEBUG
  39  ********************************************************************/
  40 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
  41                                    struct rpc_pipe_client *cli)
  42 {
  43         char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
  44         if (result == NULL) {
  45                 return "pipe";
  46         }
  47         return result;
  48 }
  49
  50 /********************************************************************
  51  Rpc pipe call id.
  52  ********************************************************************/
  53
  54 static uint32 get_rpc_call_id(void)
  55 {
  56         static uint32 call_id = 0;
  57         return ++call_id;
  58 }
  59
  60 /*******************************************************************
  61  Use SMBreadX to get rest of one fragment's worth of rpc data.
  62  Reads the whole size or give an error message
  63  ********************************************************************/
  64
  65 struct rpc_read_state {
  66         struct event_context *ev;
  67         struct rpc_cli_transport *transport;
  68         uint8_t *data;
  69         size_t size;
  70         size_t num_read;
  71 };
  72
  73 static void rpc_read_done(struct tevent_req *subreq);
  74
  75 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
  76                                         struct event_context *ev,
  77                                         struct rpc_cli_transport *transport,
  78                                         uint8_t *data, size_t size)
  79 {
  80         struct tevent_req *req, *subreq;
  81         struct rpc_read_state *state;
  82
  83         req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
  84         if (req == NULL) {
  85                 return NULL;
  86         }
  87         state->ev = ev;
  88         state->transport = transport;
  89         state->data = data;
  90         state->size = size;
  91         state->num_read = 0;
  92
  93         DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
  94
  95         subreq = transport->read_send(state, ev, (uint8_t *)data, size,
  96                                       transport->priv);
  97         if (subreq == NULL) {
  98                 goto fail;
  99         }
 100         tevent_req_set_callback(subreq, rpc_read_done, req);
 101         return req;
 102
 103  fail:
 104         TALLOC_FREE(req);
 105         return NULL;
 106 }
 107
 108 static void rpc_read_done(struct tevent_req *subreq)
 109 {
 110         struct tevent_req *req = tevent_req_callback_data(
 111                 subreq, struct tevent_req);
 112         struct rpc_read_state *state = tevent_req_data(
 113                 req, struct rpc_read_state);
 114         NTSTATUS status;
 115         ssize_t received;
 116
 117         status = state->transport->read_recv(subreq, &received);
 118         TALLOC_FREE(subreq);
 119         if (!NT_STATUS_IS_OK(status)) {
 120                 tevent_req_nterror(req, status);
 121                 return;
 122         }
 123
 124         state->num_read += received;
 125         if (state->num_read == state->size) {
 126                 tevent_req_done(req);
 127                 return;
 128         }
 129
 130         subreq = state->transport->read_send(state, state->ev,
 131                                              state->data + state->num_read,
 132                                              state->size - state->num_read,
 133                                              state->transport->priv);
 134         if (tevent_req_nomem(subreq, req)) {
 135                 return;
 136         }
 137         tevent_req_set_callback(subreq, rpc_read_done, req);
 138 }
 139
 140 static NTSTATUS rpc_read_recv(struct tevent_req *req)
 141 {
 142         return tevent_req_simple_recv_ntstatus(req);
 143 }
 144
 145 struct rpc_write_state {
 146         struct event_context *ev;
 147         struct rpc_cli_transport *transport;
 148         const uint8_t *data;
 149         size_t size;
 150         size_t num_written;
 151 };
 152
 153 static void rpc_write_done(struct tevent_req *subreq);
 154
 155 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
 156                                          struct event_context *ev,
 157                                          struct rpc_cli_transport *transport,
 158                                          const uint8_t *data, size_t size)
 159 {
 160         struct tevent_req *req, *subreq;
 161         struct rpc_write_state *state;
 162
 163         req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
 164         if (req == NULL) {
 165                 return NULL;
 166         }
 167         state->ev = ev;
 168         state->transport = transport;
 169         state->data = data;
 170         state->size = size;
 171         state->num_written = 0;
 172
 173         DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
 174
 175         subreq = transport->write_send(state, ev, data, size, transport->priv);
 176         if (subreq == NULL) {
 177                 goto fail;
 178         }
 179         tevent_req_set_callback(subreq, rpc_write_done, req);
 180         return req;
 181  fail:
 182         TALLOC_FREE(req);
 183         return NULL;
 184 }
 185
 186 static void rpc_write_done(struct tevent_req *subreq)
 187 {
 188         struct tevent_req *req = tevent_req_callback_data(
 189                 subreq, struct tevent_req);
 190         struct rpc_write_state *state = tevent_req_data(
 191                 req, struct rpc_write_state);
 192         NTSTATUS status;
 193         ssize_t written;
 194
 195         status = state->transport->write_recv(subreq, &written);
 196         TALLOC_FREE(subreq);
 197         if (!NT_STATUS_IS_OK(status)) {
 198                 tevent_req_nterror(req, status);
 199                 return;
 200         }
 201
 202         state->num_written += written;
 203
 204         if (state->num_written == state->size) {
 205                 tevent_req_done(req);
 206                 return;
 207         }
 208
 209         subreq = state->transport->write_send(state, state->ev,
 210                                               state->data + state->num_written,
 211                                               state->size - state->num_written,
 212                                               state->transport->priv);
 213         if (tevent_req_nomem(subreq, req)) {
 214                 return;
 215         }
 216         tevent_req_set_callback(subreq, rpc_write_done, req);
 217 }
 218
 219 static NTSTATUS rpc_write_recv(struct tevent_req *req)
 220 {
 221         return tevent_req_simple_recv_ntstatus(req);
 222 }
 223
 224
 225 /****************************************************************************
 226  Try and get a PDU's worth of data from current_pdu. If not, then read more
 227  from the wire.
 228  ****************************************************************************/
 229
 230 struct get_complete_frag_state {
 231         struct event_context *ev;
 232         struct rpc_pipe_client *cli;
 233         uint16_t frag_len;
 234         DATA_BLOB *pdu;
 235 };
 236
 237 static void get_complete_frag_got_header(struct tevent_req *subreq);
 238 static void get_complete_frag_got_rest(struct tevent_req *subreq);
 239
 240 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
 241                                                  struct event_context *ev,
 242                                                  struct rpc_pipe_client *cli,
 243                                                  DATA_BLOB *pdu)
 244 {
 245         struct tevent_req *req, *subreq;
 246         struct get_complete_frag_state *state;
 247         size_t received;
 248         NTSTATUS status;
 249
 250         req = tevent_req_create(mem_ctx, &state,
 251                                 struct get_complete_frag_state);
 252         if (req == NULL) {
 253                 return NULL;
 254         }
 255         state->ev = ev;
 256         state->cli = cli;
 257         state->frag_len = RPC_HEADER_LEN;
 258         state->pdu = pdu;
 259
 260         received = pdu->length;
 261         if (received < RPC_HEADER_LEN) {
 262                 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
 263                         status = NT_STATUS_NO_MEMORY;
 264                         goto post_status;
 265                 }
 266                 subreq = rpc_read_send(state, state->ev,
 267                                         state->cli->transport,
 268                                         pdu->data + received,
 269                                         RPC_HEADER_LEN - received);
 270                 if (subreq == NULL) {
 271                         status = NT_STATUS_NO_MEMORY;
 272                         goto post_status;
 273                 }
 274                 tevent_req_set_callback(subreq, get_complete_frag_got_header,
 275                                         req);
 276                 return req;
 277         }
 278
 279         state->frag_len = dcerpc_get_frag_length(pdu);
 280
 281         /*
 282          * Ensure we have frag_len bytes of data.
 283          */
 284         if (received < state->frag_len) {
 285                 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
 286                         status = NT_STATUS_NO_MEMORY;
 287                         goto post_status;
 288                 }
 289                 subreq = rpc_read_send(state, state->ev,
 290                                         state->cli->transport,
 291                                         pdu->data + received,
 292                                         state->frag_len - received);
 293                 if (subreq == NULL) {
 294                         status = NT_STATUS_NO_MEMORY;
 295                         goto post_status;
 296                 }
 297                 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
 298                                         req);
 299                 return req;
 300         }
 301
 302         status = NT_STATUS_OK;
 303  post_status:
 304         if (NT_STATUS_IS_OK(status)) {
 305                 tevent_req_done(req);
 306         } else {
 307                 tevent_req_nterror(req, status);
 308         }
 309         return tevent_req_post(req, ev);
 310 }
 311
 312 static void get_complete_frag_got_header(struct tevent_req *subreq)
 313 {
 314         struct tevent_req *req = tevent_req_callback_data(
 315                 subreq, struct tevent_req);
 316         struct get_complete_frag_state *state = tevent_req_data(
 317                 req, struct get_complete_frag_state);
 318         NTSTATUS status;
 319
 320         status = rpc_read_recv(subreq);
 321         TALLOC_FREE(subreq);
 322         if (!NT_STATUS_IS_OK(status)) {
 323                 tevent_req_nterror(req, status);
 324                 return;
 325         }
 326
 327         state->frag_len = dcerpc_get_frag_length(state->pdu);
 328
 329         if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
 330                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 331                 return;
 332         }
 333
 334         /*
 335          * We're here in this piece of code because we've read exactly
 336          * RPC_HEADER_LEN bytes into state->pdu.
 337          */
 338
 339         subreq = rpc_read_send(state, state->ev, state->cli->transport,
 340                                 state->pdu->data + RPC_HEADER_LEN,
 341                                 state->frag_len - RPC_HEADER_LEN);
 342         if (tevent_req_nomem(subreq, req)) {
 343                 return;
 344         }
 345         tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
 346 }
 347
 348 static void get_complete_frag_got_rest(struct tevent_req *subreq)
 349 {
 350         struct tevent_req *req = tevent_req_callback_data(
 351                 subreq, struct tevent_req);
 352         NTSTATUS status;
 353
 354         status = rpc_read_recv(subreq);
 355         TALLOC_FREE(subreq);
 356         if (!NT_STATUS_IS_OK(status)) {
 357                 tevent_req_nterror(req, status);
 358                 return;
 359         }
 360         tevent_req_done(req);
 361 }
 362
 363 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
 364 {
 365         return tevent_req_simple_recv_ntstatus(req);
 366 }
 367
 368 /****************************************************************************
 369  NTLMSSP specific sign/seal.
 370  Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
 371  In fact I should probably abstract these into identical pieces of code... JRA.
 372  ****************************************************************************/
 373
 374 static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli,
 375                                         struct ncacn_packet *pkt,
 376                                         DATA_BLOB *pdu,
 377                                         uint8 *p_ss_padding_len)
 378 {
 379         struct dcerpc_auth auth_info;
 380         DATA_BLOB blob;
 381         NTSTATUS status;
 382
 383         if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
 384             || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
 385                 return NT_STATUS_OK;
 386         }
 387
 388         if (!cli->auth->a_u.auth_ntlmssp_state) {
 389                 return NT_STATUS_INVALID_PARAMETER;
 390         }
 391
 392         /* Ensure there's enough data for an authenticated response. */
 393         if ((pkt->auth_length > RPC_MAX_PDU_FRAG_LEN) ||
 394             (pkt->frag_length < DCERPC_RESPONSE_LENGTH
 395                                 + DCERPC_AUTH_TRAILER_LENGTH
 396                                 + pkt->auth_length)) {
 397                 DEBUG(0, ("auth_len %u is too long.\n",
 398                           (unsigned int)pkt->auth_length));
 399                 return NT_STATUS_BUFFER_TOO_SMALL;
 400         }
 401
 402         /* get the auth blob at the end of the packet */
 403         blob = data_blob_const(pdu->data + pkt->frag_length
 404                                 - DCERPC_AUTH_TRAILER_LENGTH
 405                                 - pkt->auth_length,
 406                                DCERPC_AUTH_TRAILER_LENGTH
 407                                 + pkt->auth_length);
 408
 409         status = dcerpc_pull_dcerpc_auth(cli, &blob, &auth_info, false);
 410         if (!NT_STATUS_IS_OK(status)) {
 411                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall dcerpc_auth.\n"));
 412                 return status;
 413         }
 414
 415         /* Ensure auth_pad_len fits into the packet. */
 416         if (pkt->frag_length < DCERPC_RESPONSE_LENGTH
 417                                 + auth_info.auth_pad_length
 418                                 + DCERPC_AUTH_TRAILER_LENGTH
 419                                 + pkt->auth_length) {
 420                 DEBUG(0,("cli_pipe_verify_ntlmssp: auth_info.auth_pad_len "
 421                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
 422                         (unsigned int)auth_info.auth_pad_length,
 423                         (unsigned int)pkt->auth_length,
 424                         (unsigned int)pkt->frag_length));
 425                 return NT_STATUS_BUFFER_TOO_SMALL;
 426         }
 427
 428         /*
 429          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
 430          * after the RPC header.
 431          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
 432          * functions as NTLMv2 checks the rpc headers also.
 433          */
 434
 435         switch (cli->auth->auth_level) {
 436         case DCERPC_AUTH_LEVEL_PRIVACY:
 437                 /* Data is encrypted. */
 438                 status = auth_ntlmssp_unseal_packet(
 439                                         cli->auth->a_u.auth_ntlmssp_state,
 440                                         pdu->data + DCERPC_RESPONSE_LENGTH,
 441                                         pkt->frag_length
 442                                                 - DCERPC_RESPONSE_LENGTH
 443                                                 - DCERPC_AUTH_TRAILER_LENGTH
 444                                                 - pkt->auth_length,
 445                                         pdu->data,
 446                                         pkt->frag_length - pkt->auth_length,
 447                                         &auth_info.credentials);
 448                 if (!NT_STATUS_IS_OK(status)) {
 449                         DEBUG(0, ("failed to unseal packet from %s."
 450                                   " Error was %s.\n",
 451                                   rpccli_pipe_txt(talloc_tos(), cli),
 452                                   nt_errstr(status)));
 453                         return status;
 454                 }
 455                 break;
 456
 457         case DCERPC_AUTH_LEVEL_INTEGRITY:
 458                 /* Data is signed. */
 459                 status = auth_ntlmssp_check_packet(
 460                                         cli->auth->a_u.auth_ntlmssp_state,
 461                                         pdu->data + DCERPC_RESPONSE_LENGTH,
 462                                         pkt->frag_length
 463                                                 - DCERPC_RESPONSE_LENGTH
 464                                                 - DCERPC_AUTH_TRAILER_LENGTH
 465                                                 - pkt->auth_length,
 466                                         pdu->data,
 467                                         pkt->frag_length - pkt->auth_length,
 468                                         &auth_info.credentials);
 469                 if (!NT_STATUS_IS_OK(status)) {
 470                         DEBUG(0, ("check signing failed on packet from %s."
 471                                   " Error was %s.\n",
 472                                   rpccli_pipe_txt(talloc_tos(), cli),
 473                                   nt_errstr(status)));
 474                         return status;
 475                 }
 476                 break;
 477
 478         default:
 479                 DEBUG(0, ("cli_pipe_verify_ntlmssp: unknown internal "
 480                           "auth level %d\n", cli->auth->auth_level));
 481                 return NT_STATUS_INVALID_INFO_CLASS;
 482         }
 483
 484         /*
 485          * Remember the padding length. We must remove it from the real data
 486          * stream once the sign/seal is done.
 487          */
 488
 489         *p_ss_padding_len = auth_info.auth_pad_length;
 490
 491         return NT_STATUS_OK;
 492 }
 493
 494 /****************************************************************************
 495  schannel specific sign/seal.
 496  ****************************************************************************/
 497
 498 static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli,
 499                                          struct ncacn_packet *pkt,
 500                                          DATA_BLOB *pdu,
 501                                          uint8 *p_ss_padding_len)
 502 {
 503         struct dcerpc_auth auth_info;
 504         DATA_BLOB blob;
 505         NTSTATUS status;
 506
 507         if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
 508             || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
 509                 return NT_STATUS_OK;
 510         }
 511
 512         if (pkt->auth_length < NL_AUTH_SIGNATURE_SIZE) {
 513                 DEBUG(0, ("auth_len %u.\n", (unsigned int)pkt->auth_length));
 514                 return NT_STATUS_INVALID_PARAMETER;
 515         }
 516
 517         if (!cli->auth->a_u.schannel_auth) {
 518                 return NT_STATUS_INVALID_PARAMETER;
 519         }
 520
 521         /* Ensure there's enough data for an authenticated response. */
 522         if ((pkt->auth_length > RPC_MAX_PDU_FRAG_LEN) ||
 523             (pkt->frag_length < DCERPC_RESPONSE_LENGTH
 524                                 + DCERPC_AUTH_TRAILER_LENGTH
 525                                 + pkt->auth_length)) {
 526                 DEBUG(0, ("auth_len %u is too long.\n",
 527                           (unsigned int)pkt->auth_length));
 528                 return NT_STATUS_INVALID_PARAMETER;
 529         }
 530
 531         /* get the auth blob at the end of the packet */
 532         blob = data_blob_const(pdu->data + pkt->frag_length
 533                                 - DCERPC_AUTH_TRAILER_LENGTH
 534                                 - pkt->auth_length,
 535                                DCERPC_AUTH_TRAILER_LENGTH
 536                                 + pkt->auth_length);
 537
 538
 539         status = dcerpc_pull_dcerpc_auth(cli, &blob, &auth_info, false);
 540         if (!NT_STATUS_IS_OK(status)) {
 541                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall dcerpc_auth.\n"));
 542                 return status;
 543         }
 544
 545         /* Ensure auth_pad_len fits into the packet. */
 546         if (pkt->frag_length < DCERPC_RESPONSE_LENGTH
 547                                 + auth_info.auth_pad_length
 548                                 + DCERPC_AUTH_TRAILER_LENGTH
 549                                 + pkt->auth_length) {
 550                 DEBUG(0,("cli_pipe_verify_schannel: auth_info.auth_pad_len "
 551                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
 552                         (unsigned int)auth_info.auth_pad_length,
 553                         (unsigned int)pkt->auth_length,
 554                         (unsigned int)pkt->frag_length));
 555                 return NT_STATUS_BUFFER_TOO_SMALL;
 556         }
 557
 558         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
 559                 DEBUG(0, ("Invalid auth info %d on schannel\n",
 560                           auth_info.auth_type));
 561                 return NT_STATUS_BUFFER_TOO_SMALL;
 562         }
 563
 564         if (DEBUGLEVEL >= 10) {
 565                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &auth_info.credentials);
 566         }
 567
 568         switch (cli->auth->auth_level) {
 569         case DCERPC_AUTH_LEVEL_PRIVACY:
 570                 status = netsec_incoming_packet(
 571                                         cli->auth->a_u.schannel_auth,
 572                                         talloc_tos(),
 573                                         true,
 574                                         pdu->data + DCERPC_RESPONSE_LENGTH,
 575                                         pkt->frag_length
 576                                                 - DCERPC_RESPONSE_LENGTH
 577                                                 - DCERPC_AUTH_TRAILER_LENGTH
 578                                                 - pkt->auth_length,
 579                                         &auth_info.credentials);
 580                 break;
 581         case DCERPC_AUTH_LEVEL_INTEGRITY:
 582                 status = netsec_incoming_packet(
 583                                         cli->auth->a_u.schannel_auth,
 584                                         talloc_tos(),
 585                                         false,
 586                                         pdu->data + DCERPC_RESPONSE_LENGTH,
 587                                         pkt->frag_length
 588                                                 - DCERPC_RESPONSE_LENGTH
 589                                                 - DCERPC_AUTH_TRAILER_LENGTH
 590                                                 - pkt->auth_length,
 591                                         &auth_info.credentials);
 592                 break;
 593         default:
 594                 status = NT_STATUS_INTERNAL_ERROR;
 595                 break;
 596         }
 597
 598         if (!NT_STATUS_IS_OK(status)) {
 599                 DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
 600                                 "Connection to %s (%s).\n",
 601                                 rpccli_pipe_txt(talloc_tos(), cli),
 602                                 nt_errstr(status)));
 603                 return NT_STATUS_INVALID_PARAMETER;
 604         }
 605
 606         /*
 607          * Remember the padding length. We must remove it from the real data
 608          * stream once the sign/seal is done.
 609          */
 610
 611         *p_ss_padding_len = auth_info.auth_pad_length;
 612
 613         return NT_STATUS_OK;
 614 }
 615
 616 /****************************************************************************
 617  Do the authentication checks on an incoming pdu. Check sign and unseal etc.
 618  ****************************************************************************/
 619
 620 static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli,
 621                                                 struct ncacn_packet *pkt,
 622                                                 DATA_BLOB *pdu,
 623                                                 uint8 *p_ss_padding_len)
 624 {
 625         NTSTATUS ret = NT_STATUS_OK;
 626
 627         /* Paranioa checks for auth_len. */
 628         if (pkt->auth_length) {
 629                 if (pkt->auth_length > pkt->frag_length) {
 630                         return NT_STATUS_INVALID_PARAMETER;
 631                 }
 632
 633                 if ((pkt->auth_length
 634                      + (unsigned int)DCERPC_AUTH_TRAILER_LENGTH
 635                                                 < pkt->auth_length) ||
 636                     (pkt->auth_length
 637                      + (unsigned int)DCERPC_AUTH_TRAILER_LENGTH
 638                         < (unsigned int)DCERPC_AUTH_TRAILER_LENGTH)) {
 639                         /* Integer wrap attempt. */
 640                         return NT_STATUS_INVALID_PARAMETER;
 641                 }
 642         }
 643
 644         /*
 645          * Now we have a complete RPC request PDU fragment, try and verify any auth data.
 646          */
 647
 648         switch(cli->auth->auth_type) {
 649         case PIPE_AUTH_TYPE_NONE:
 650                 if (pkt->auth_length) {
 651                         DEBUG(3, ("cli_pipe_validate_rpc_response: "
 652                                   "Connection to %s - got non-zero "
 653                                   "auth len %u.\n",
 654                                 rpccli_pipe_txt(talloc_tos(), cli),
 655                                 (unsigned int)pkt->auth_length));
 656                         return NT_STATUS_INVALID_PARAMETER;
 657                 }
 658                 break;
 659
 660         case PIPE_AUTH_TYPE_NTLMSSP:
 661         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 662                 ret = cli_pipe_verify_ntlmssp(cli, pkt, pdu,
 663                                                 p_ss_padding_len);
 664                 if (!NT_STATUS_IS_OK(ret)) {
 665                         return ret;
 666                 }
 667                 break;
 668
 669         case PIPE_AUTH_TYPE_SCHANNEL:
 670                 ret = cli_pipe_verify_schannel(cli, pkt, pdu,
 671                                                 p_ss_padding_len);
 672                 if (!NT_STATUS_IS_OK(ret)) {
 673                         return ret;
 674                 }
 675                 break;
 676
 677         case PIPE_AUTH_TYPE_KRB5:
 678         case PIPE_AUTH_TYPE_SPNEGO_KRB5:
 679         default:
 680                 DEBUG(3, ("cli_pipe_validate_rpc_response: Connection "
 681                           "to %s - unknown internal auth type %u.\n",
 682                           rpccli_pipe_txt(talloc_tos(), cli),
 683                           cli->auth->auth_type ));
 684                 return NT_STATUS_INVALID_INFO_CLASS;
 685         }
 686
 687         return NT_STATUS_OK;
 688 }
 689
 690 /****************************************************************************
 691  Do basic authentication checks on an incoming pdu.
 692  ****************************************************************************/
 693
 694 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
 695                                                 struct rpc_pipe_client *cli,
 696                                                 struct ncacn_packet *pkt,
 697                                                 DATA_BLOB *pdu,
 698                                                 uint8_t expected_pkt_type,
 699                                                 DATA_BLOB *rdata,
 700                                                 DATA_BLOB *reply_pdu)
 701 {
 702         NTSTATUS ret = NT_STATUS_OK;
 703         uint8 ss_padding_len = 0;
 704
 705         ret = dcerpc_pull_ncacn_packet(cli, pdu, pkt, false);
 706         if (!NT_STATUS_IS_OK(ret)) {
 707                 return ret;
 708         }
 709
 710         if (pdu->length != pkt->frag_length) {
 711                 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
 712                           (unsigned int)pdu->length,
 713                           (unsigned int)pkt->frag_length));
 714                 return NT_STATUS_INVALID_PARAMETER;
 715         }
 716
 717         /*
 718          * Point the return values at the real data including the RPC
 719          * header. Just in case the caller wants it.
 720          */
 721         *rdata = *pdu;
 722
 723         /* Ensure we have the correct type. */
 724         switch (pkt->ptype) {
 725         case DCERPC_PKT_ALTER_RESP:
 726         case DCERPC_PKT_BIND_ACK:
 727
 728                 /* Alter context and bind ack share the same packet definitions. */
 729                 break;
 730
 731
 732         case DCERPC_PKT_RESPONSE:
 733
 734                 /* Here's where we deal with incoming sign/seal. */
 735                 ret = cli_pipe_validate_rpc_response(cli, pkt, pdu,
 736                                                      &ss_padding_len);
 737                 if (!NT_STATUS_IS_OK(ret)) {
 738                         return ret;
 739                 }
 740
 741                 /* Point the return values at the NDR data.
 742                  * Remember to remove any ss padding. */
 743                 rdata->data = pdu->data + DCERPC_RESPONSE_LENGTH;
 744
 745                 if (pdu->length < DCERPC_RESPONSE_LENGTH + ss_padding_len) {
 746                         return NT_STATUS_BUFFER_TOO_SMALL;
 747                 }
 748
 749                 rdata->length = pdu->length
 750                                         - DCERPC_RESPONSE_LENGTH
 751                                         - ss_padding_len;
 752
 753                 /* Remember to remove the auth footer. */
 754                 if (pkt->auth_length) {
 755                         /* We've already done integer wrap tests on auth_len in
 756                                 cli_pipe_validate_rpc_response(). */
 757                         if (rdata->length < DCERPC_AUTH_TRAILER_LENGTH
 758                                                         + pkt->auth_length) {
 759                                 return NT_STATUS_BUFFER_TOO_SMALL;
 760                         }
 761                         rdata->length -= (DCERPC_AUTH_TRAILER_LENGTH
 762                                                         + pkt->auth_length);
 763                 }
 764
 765                 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
 766                            (long unsigned int)pdu->length,
 767                            (long unsigned int)rdata->length,
 768                            (unsigned int)ss_padding_len));
 769
 770                 /*
 771                  * If this is the first reply, and the allocation hint is
 772                  * reasonable, try and set up the reply_pdu DATA_BLOB to the
 773                  * correct size.
 774                  */
 775
 776                 if ((reply_pdu->length == 0) &&
 777                     pkt->u.response.alloc_hint &&
 778                     (pkt->u.response.alloc_hint < 15*1024*1024)) {
 779                         if (!data_blob_realloc(mem_ctx, reply_pdu,
 780                                                 pkt->u.response.alloc_hint)) {
 781                                 DEBUG(0, ("reply alloc hint %d too "
 782                                           "large to allocate\n",
 783                                     (int)pkt->u.response.alloc_hint));
 784                                 return NT_STATUS_NO_MEMORY;
 785                         }
 786                 }
 787
 788                 break;
 789
 790         case DCERPC_PKT_BIND_NAK:
 791                 DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
 792                           "received from %s!\n",
 793                           rpccli_pipe_txt(talloc_tos(), cli)));
 794                 /* Use this for now... */
 795                 return NT_STATUS_NETWORK_ACCESS_DENIED;
 796
 797         case DCERPC_PKT_FAULT:
 798
 799                 DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
 800                           "code %s received from %s!\n",
 801                           dcerpc_errstr(talloc_tos(),
 802                           pkt->u.fault.status),
 803                         rpccli_pipe_txt(talloc_tos(), cli)));
 804
 805                 if (NT_STATUS_IS_OK(NT_STATUS(pkt->u.fault.status))) {
 806                         return NT_STATUS_UNSUCCESSFUL;
 807                 } else {
 808                         return NT_STATUS(pkt->u.fault.status);
 809                 }
 810
 811         default:
 812                 DEBUG(0, ("Unknown packet type %u received from %s!\n",
 813                         (unsigned int)pkt->ptype,
 814                         rpccli_pipe_txt(talloc_tos(), cli)));
 815                 return NT_STATUS_INVALID_INFO_CLASS;
 816         }
 817
 818         if (pkt->ptype != expected_pkt_type) {
 819                 DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
 820                           "got an unexpected RPC packet type - %u, not %u\n",
 821                         rpccli_pipe_txt(talloc_tos(), cli),
 822                         pkt->ptype,
 823                         expected_pkt_type));
 824                 return NT_STATUS_INVALID_INFO_CLASS;
 825         }
 826
 827         /* Do this just before return - we don't want to modify any rpc header
 828            data before now as we may have needed to do cryptographic actions on
 829            it before. */
 830
 831         if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
 832             !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
 833                 DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
 834                         "setting fragment first/last ON.\n"));
 835                 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST |
 836                                         DCERPC_PFC_FLAG_LAST;
 837         }
 838
 839         return NT_STATUS_OK;
 840 }
 841
 842 /****************************************************************************
 843  Call a remote api on an arbitrary pipe.  takes param, data and setup buffers.
 844 ****************************************************************************/
 845
 846 struct cli_api_pipe_state {
 847         struct event_context *ev;
 848         struct rpc_cli_transport *transport;
 849         uint8_t *rdata;
 850         uint32_t rdata_len;
 851 };
 852
 853 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
 854 static void cli_api_pipe_write_done(struct tevent_req *subreq);
 855 static void cli_api_pipe_read_done(struct tevent_req *subreq);
 856
 857 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
 858                                             struct event_context *ev,
 859                                             struct rpc_cli_transport *transport,
 860                                             uint8_t *data, size_t data_len,
 861                                             uint32_t max_rdata_len)
 862 {
 863         struct tevent_req *req, *subreq;
 864         struct cli_api_pipe_state *state;
 865         NTSTATUS status;
 866
 867         req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
 868         if (req == NULL) {
 869                 return NULL;
 870         }
 871         state->ev = ev;
 872         state->transport = transport;
 873
 874         if (max_rdata_len < RPC_HEADER_LEN) {
 875                 /*
 876                  * For a RPC reply we always need at least RPC_HEADER_LEN
 877                  * bytes. We check this here because we will receive
 878                  * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
 879                  */
 880                 status = NT_STATUS_INVALID_PARAMETER;
 881                 goto post_status;
 882         }
 883
 884         if (transport->trans_send != NULL) {
 885                 subreq = transport->trans_send(state, ev, data, data_len,
 886                                                max_rdata_len, transport->priv);
 887                 if (subreq == NULL) {
 888                         goto fail;
 889                 }
 890                 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
 891                 return req;
 892         }
 893
 894         /*
 895          * If the transport does not provide a "trans" routine, i.e. for
 896          * example the ncacn_ip_tcp transport, do the write/read step here.
 897          */
 898
 899         subreq = rpc_write_send(state, ev, transport, data, data_len);
 900         if (subreq == NULL) {
 901                 goto fail;
 902         }
 903         tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
 904         return req;
 905
 906  post_status:
 907         tevent_req_nterror(req, status);
 908         return tevent_req_post(req, ev);
 909  fail:
 910         TALLOC_FREE(req);
 911         return NULL;
 912 }
 913
 914 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
 915 {
 916         struct tevent_req *req = tevent_req_callback_data(
 917                 subreq, struct tevent_req);
 918         struct cli_api_pipe_state *state = tevent_req_data(
 919                 req, struct cli_api_pipe_state);
 920         NTSTATUS status;
 921
 922         status = state->transport->trans_recv(subreq, state, &state->rdata,
 923                                               &state->rdata_len);
 924         TALLOC_FREE(subreq);
 925         if (!NT_STATUS_IS_OK(status)) {
 926                 tevent_req_nterror(req, status);
 927                 return;
 928         }
 929         tevent_req_done(req);
 930 }
 931
 932 static void cli_api_pipe_write_done(struct tevent_req *subreq)
 933 {
 934         struct tevent_req *req = tevent_req_callback_data(
 935                 subreq, struct tevent_req);
 936         struct cli_api_pipe_state *state = tevent_req_data(
 937                 req, struct cli_api_pipe_state);
 938         NTSTATUS status;
 939
 940         status = rpc_write_recv(subreq);
 941         TALLOC_FREE(subreq);
 942         if (!NT_STATUS_IS_OK(status)) {
 943                 tevent_req_nterror(req, status);
 944                 return;
 945         }
 946
 947         state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
 948         if (tevent_req_nomem(state->rdata, req)) {
 949                 return;
 950         }
 951
 952         /*
 953          * We don't need to use rpc_read_send here, the upper layer will cope
 954          * with a short read, transport->trans_send could also return less
 955          * than state->max_rdata_len.
 956          */
 957         subreq = state->transport->read_send(state, state->ev, state->rdata,
 958                                              RPC_HEADER_LEN,
 959                                              state->transport->priv);
 960         if (tevent_req_nomem(subreq, req)) {
 961                 return;
 962         }
 963         tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
 964 }
 965
 966 static void cli_api_pipe_read_done(struct tevent_req *subreq)
 967 {
 968         struct tevent_req *req = tevent_req_callback_data(
 969                 subreq, struct tevent_req);
 970         struct cli_api_pipe_state *state = tevent_req_data(
 971                 req, struct cli_api_pipe_state);
 972         NTSTATUS status;
 973         ssize_t received;
 974
 975         status = state->transport->read_recv(subreq, &received);
 976         TALLOC_FREE(subreq);
 977         if (!NT_STATUS_IS_OK(status)) {
 978                 tevent_req_nterror(req, status);
 979                 return;
 980         }
 981         state->rdata_len = received;
 982         tevent_req_done(req);
 983 }
 984
 985 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 986                                   uint8_t **prdata, uint32_t *prdata_len)
 987 {
 988         struct cli_api_pipe_state *state = tevent_req_data(
 989                 req, struct cli_api_pipe_state);
 990         NTSTATUS status;
 991
 992         if (tevent_req_is_nterror(req, &status)) {
 993                 return status;
 994         }
 995
 996         *prdata = talloc_move(mem_ctx, &state->rdata);
 997         *prdata_len = state->rdata_len;
 998         return NT_STATUS_OK;
 999 }
1000
1001 /****************************************************************************
1002  Send data on an rpc pipe via trans. The data must be the last
1003  pdu fragment of an NDR data stream.
1004
1005  Receive response data from an rpc pipe, which may be large...
1006
1007  Read the first fragment: unfortunately have to use SMBtrans for the first
1008  bit, then SMBreadX for subsequent bits.
1009
1010  If first fragment received also wasn't the last fragment, continue
1011  getting fragments until we _do_ receive the last fragment.
1012
1013  Request/Response PDU's look like the following...
1014
1015  |<------------------PDU len----------------------------------------------->|
1016  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
1017
1018  +------------+-----------------+-------------+---------------+-------------+
1019  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
1020  +------------+-----------------+-------------+---------------+-------------+
1021
1022  Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
1023  signing & sealing being negotiated.
1024
1025  ****************************************************************************/
1026
1027 struct rpc_api_pipe_state {
1028         struct event_context *ev;
1029         struct rpc_pipe_client *cli;
1030         uint8_t expected_pkt_type;
1031
1032         DATA_BLOB incoming_frag;
1033         struct ncacn_packet *pkt;
1034
1035         /* Incoming reply */
1036         DATA_BLOB reply_pdu;
1037         size_t reply_pdu_offset;
1038         uint8_t endianess;
1039 };
1040
1041 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
1042 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
1043
1044 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
1045                                             struct event_context *ev,
1046                                             struct rpc_pipe_client *cli,
1047                                             DATA_BLOB *data, /* Outgoing PDU */
1048                                             uint8_t expected_pkt_type)
1049 {
1050         struct tevent_req *req, *subreq;
1051         struct rpc_api_pipe_state *state;
1052         uint16_t max_recv_frag;
1053         NTSTATUS status;
1054
1055         req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
1056         if (req == NULL) {
1057                 return NULL;
1058         }
1059         state->ev = ev;
1060         state->cli = cli;
1061         state->expected_pkt_type = expected_pkt_type;
1062         state->incoming_frag = data_blob_null;
1063         state->reply_pdu = data_blob_null;
1064         state->reply_pdu_offset = 0;
1065         state->endianess = DCERPC_DREP_LE;
1066
1067         /*
1068          * Ensure we're not sending too much.
1069          */
1070         if (data->length > cli->max_xmit_frag) {
1071                 status = NT_STATUS_INVALID_PARAMETER;
1072                 goto post_status;
1073         }
1074
1075         DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
1076
1077         /* get the header first, then fetch the rest once we have
1078          * the frag_length available */
1079         max_recv_frag = RPC_HEADER_LEN;
1080
1081         subreq = cli_api_pipe_send(state, ev, cli->transport,
1082                                    data->data, data->length, max_recv_frag);
1083         if (subreq == NULL) {
1084                 goto fail;
1085         }
1086         tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
1087         return req;
1088
1089  post_status:
1090         tevent_req_nterror(req, status);
1091         return tevent_req_post(req, ev);
1092  fail:
1093         TALLOC_FREE(req);
1094         return NULL;
1095 }
1096
1097 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
1098 {
1099         struct tevent_req *req = tevent_req_callback_data(
1100                 subreq, struct tevent_req);
1101         struct rpc_api_pipe_state *state = tevent_req_data(
1102                 req, struct rpc_api_pipe_state);
1103         NTSTATUS status;
1104         uint8_t *rdata = NULL;
1105         uint32_t rdata_len = 0;
1106
1107         status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
1108         TALLOC_FREE(subreq);
1109         if (!NT_STATUS_IS_OK(status)) {
1110                 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
1111                 tevent_req_nterror(req, status);
1112                 return;
1113         }
1114
1115         if (rdata == NULL) {
1116                 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
1117                          rpccli_pipe_txt(talloc_tos(), state->cli)));
1118                 tevent_req_done(req);
1119                 return;
1120         }
1121
1122         /*
1123          * Move data on state->incoming_frag.
1124          */
1125         state->incoming_frag.data = talloc_move(state, &rdata);
1126         state->incoming_frag.length = rdata_len;
1127         if (!state->incoming_frag.data) {
1128                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1129                 return;
1130         }
1131
1132         /* Ensure we have enough data for a pdu. */
1133         subreq = get_complete_frag_send(state, state->ev, state->cli,
1134                                         &state->incoming_frag);
1135         if (tevent_req_nomem(subreq, req)) {
1136                 return;
1137         }
1138         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1139 }
1140
1141 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
1142 {
1143         struct tevent_req *req = tevent_req_callback_data(
1144                 subreq, struct tevent_req);
1145         struct rpc_api_pipe_state *state = tevent_req_data(
1146                 req, struct rpc_api_pipe_state);
1147         NTSTATUS status;
1148         DATA_BLOB rdata = data_blob_null;
1149
1150         status = get_complete_frag_recv(subreq);
1151         TALLOC_FREE(subreq);
1152         if (!NT_STATUS_IS_OK(status)) {
1153                 DEBUG(5, ("get_complete_frag failed: %s\n",
1154                           nt_errstr(status)));
1155                 tevent_req_nterror(req, status);
1156                 return;
1157         }
1158
1159         state->pkt = talloc(state, struct ncacn_packet);
1160         if (!state->pkt) {
1161                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1162                 return;
1163         }
1164
1165         status = cli_pipe_validate_current_pdu(state,
1166                                                 state->cli, state->pkt,
1167                                                 &state->incoming_frag,
1168                                                 state->expected_pkt_type,
1169                                                 &rdata,
1170                                                 &state->reply_pdu);
1171
1172         DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
1173                   (unsigned)state->incoming_frag.length,
1174                   (unsigned)state->reply_pdu_offset,
1175                   nt_errstr(status)));
1176
1177         if (!NT_STATUS_IS_OK(status)) {
1178                 tevent_req_nterror(req, status);
1179                 return;
1180         }
1181
1182         if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
1183             && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
1184                 /*
1185                  * Set the data type correctly for big-endian data on the
1186                  * first packet.
1187                  */
1188                 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
1189                           "big-endian.\n",
1190                           rpccli_pipe_txt(talloc_tos(), state->cli)));
1191                 state->endianess = 0x00; /* BIG ENDIAN */
1192         }
1193         /*
1194          * Check endianness on subsequent packets.
1195          */
1196         if (state->endianess != state->pkt->drep[0]) {
1197                 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
1198                          "%s\n",
1199                          state->endianess?"little":"big",
1200                          state->pkt->drep[0]?"little":"big"));
1201                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1202                 return;
1203         }
1204
1205         /* Now copy the data portion out of the pdu into rbuf. */
1206         if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
1207                 if (!data_blob_realloc(NULL, &state->reply_pdu,
1208                                 state->reply_pdu_offset + rdata.length)) {
1209                         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1210                         return;
1211                 }
1212         }
1213
1214         memcpy(state->reply_pdu.data + state->reply_pdu_offset,
1215                 rdata.data, rdata.length);
1216         state->reply_pdu_offset += rdata.length;
1217
1218         /* reset state->incoming_frag, there is no need to free it,
1219          * it will be reallocated to the right size the next time
1220          * it is used */
1221         state->incoming_frag.length = 0;
1222
1223         if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1224                 /* make sure the pdu length is right now that we
1225                  * have all the data available (alloc hint may
1226                  * have allocated more than was actually used) */
1227                 state->reply_pdu.length = state->reply_pdu_offset;
1228                 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1229                           rpccli_pipe_txt(talloc_tos(), state->cli),
1230                           (unsigned)state->reply_pdu.length));
1231                 tevent_req_done(req);
1232                 return;
1233         }
1234
1235         subreq = get_complete_frag_send(state, state->ev, state->cli,
1236                                         &state->incoming_frag);
1237         if (tevent_req_nomem(subreq, req)) {
1238                 return;
1239         }
1240         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1241 }
1242
1243 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1244                                   struct ncacn_packet **pkt,
1245                                   DATA_BLOB *reply_pdu)
1246 {
1247         struct rpc_api_pipe_state *state = tevent_req_data(
1248                 req, struct rpc_api_pipe_state);
1249         NTSTATUS status;
1250
1251         if (tevent_req_is_nterror(req, &status)) {
1252                 return status;
1253         }
1254
1255         /* return data to caller and assign it ownership of memory */
1256         if (reply_pdu) {
1257                 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1258                 reply_pdu->length = state->reply_pdu.length;
1259                 state->reply_pdu.length = 0;
1260         } else {
1261                 data_blob_free(&state->reply_pdu);
1262         }
1263
1264         if (pkt) {
1265                 *pkt = talloc_steal(mem_ctx, state->pkt);
1266         }
1267
1268         return NT_STATUS_OK;
1269 }
1270
1271 /*******************************************************************
1272  Creates krb5 auth bind.
1273  ********************************************************************/
1274
1275 static NTSTATUS create_krb5_auth_bind_req(struct rpc_pipe_client *cli,
1276                                           enum dcerpc_AuthLevel auth_level,
1277                                           DATA_BLOB *auth_info)
1278 {
1279 #ifdef HAVE_KRB5
1280         int ret;
1281         NTSTATUS status;
1282         struct kerberos_auth_struct *a = cli->auth->a_u.kerberos_auth;
1283         DATA_BLOB tkt = data_blob_null;
1284         DATA_BLOB tkt_wrapped = data_blob_null;
1285
1286         DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
1287                 a->service_principal ));
1288
1289         /* Create the ticket for the service principal and return it in a gss-api wrapped blob. */
1290
1291         ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
1292                         &a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL, NULL);
1293
1294         if (ret) {
1295                 DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
1296                         "failed with %s\n",
1297                         a->service_principal,
1298                         error_message(ret) ));
1299
1300                 data_blob_free(&tkt);
1301                 return NT_STATUS_INVALID_PARAMETER;
1302         }
1303
1304         /* wrap that up in a nice GSS-API wrapping */
1305         tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
1306
1307         data_blob_free(&tkt);
1308
1309         status = dcerpc_push_dcerpc_auth(cli,
1310                                          DCERPC_AUTH_TYPE_KRB5,
1311                                          auth_level,
1312                                          0, /* auth_pad_length */
1313                                          1, /* auth_context_id */
1314                                          &tkt_wrapped,
1315                                          auth_info);
1316         if (!NT_STATUS_IS_OK(status)) {
1317                 data_blob_free(&tkt_wrapped);
1318                 return status;
1319         }
1320
1321         DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
1322         dump_data(5, tkt_wrapped.data, tkt_wrapped.length);
1323
1324         return NT_STATUS_OK;
1325 #else
1326         return NT_STATUS_INVALID_PARAMETER;
1327 #endif
1328 }
1329
1330 /*******************************************************************
1331  Creates SPNEGO NTLMSSP auth bind.
1332  ********************************************************************/
1333
1334 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1335                                                         enum dcerpc_AuthLevel auth_level,
1336                                                         DATA_BLOB *auth_info)
1337 {
1338         NTSTATUS status;
1339         DATA_BLOB null_blob = data_blob_null;
1340         DATA_BLOB request = data_blob_null;
1341         DATA_BLOB spnego_msg = data_blob_null;
1342         const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
1343
1344         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1345         status = auth_ntlmssp_update(cli->auth->a_u.auth_ntlmssp_state,
1346                                         null_blob,
1347                                         &request);
1348
1349         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1350                 data_blob_free(&request);
1351                 return status;
1352         }
1353
1354         /* Wrap this in SPNEGO. */
1355         spnego_msg = spnego_gen_negTokenInit(talloc_tos(), OIDs_ntlm, &request, NULL);
1356
1357         data_blob_free(&request);
1358
1359         status = dcerpc_push_dcerpc_auth(cli,
1360                                          DCERPC_AUTH_TYPE_SPNEGO,
1361                                          auth_level,
1362                                          0, /* auth_pad_length */
1363                                          1, /* auth_context_id */
1364                                          &spnego_msg,
1365                                          auth_info);
1366
1367         if (!NT_STATUS_IS_OK(status)) {
1368                 data_blob_free(&spnego_msg);
1369                 return status;
1370         }
1371
1372         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1373         dump_data(5, spnego_msg.data, spnego_msg.length);
1374         data_blob_free(&spnego_msg);
1375
1376         return NT_STATUS_OK;
1377 }
1378
1379 /*******************************************************************
1380  Creates NTLMSSP auth bind.
1381  ********************************************************************/
1382
1383 static NTSTATUS create_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1384                                                  enum dcerpc_AuthLevel auth_level,
1385                                                  DATA_BLOB *auth_info)
1386 {
1387         NTSTATUS status;
1388         DATA_BLOB null_blob = data_blob_null;
1389         DATA_BLOB request = data_blob_null;
1390
1391         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1392         status = auth_ntlmssp_update(cli->auth->a_u.auth_ntlmssp_state,
1393                                         null_blob,
1394                                         &request);
1395
1396         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1397                 data_blob_free(&request);
1398                 return status;
1399         }
1400
1401         status = dcerpc_push_dcerpc_auth(cli,
1402                                          DCERPC_AUTH_TYPE_NTLMSSP,
1403                                          auth_level,
1404                                          0, /* auth_pad_length */
1405                                          1, /* auth_context_id */
1406                                          &request,
1407                                          auth_info);
1408         if (!NT_STATUS_IS_OK(status)) {
1409                 data_blob_free(&request);
1410                 return status;
1411         }
1412
1413         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1414         dump_data(5, request.data, request.length);
1415
1416         return NT_STATUS_OK;
1417 }
1418
1419 /*******************************************************************
1420  Creates schannel auth bind.
1421  ********************************************************************/
1422
1423 static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1424                                                   enum dcerpc_AuthLevel auth_level,
1425                                                   DATA_BLOB *auth_info)
1426 {
1427         NTSTATUS status;
1428         struct NL_AUTH_MESSAGE r;
1429         DATA_BLOB schannel_blob;
1430
1431         /* Use lp_workgroup() if domain not specified */
1432
1433         if (!cli->auth->domain || !cli->auth->domain[0]) {
1434                 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1435                 if (cli->auth->domain == NULL) {
1436                         return NT_STATUS_NO_MEMORY;
1437                 }
1438         }
1439
1440         /*
1441          * Now marshall the data into the auth parse_struct.
1442          */
1443
1444         r.MessageType                   = NL_NEGOTIATE_REQUEST;
1445         r.Flags                         = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1446                                           NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1447         r.oem_netbios_domain.a          = cli->auth->domain;
1448         r.oem_netbios_computer.a        = global_myname();
1449
1450         status = dcerpc_push_schannel_bind(cli, &r, &schannel_blob);
1451         if (!NT_STATUS_IS_OK(status)) {
1452                 return status;
1453         }
1454
1455         status = dcerpc_push_dcerpc_auth(cli,
1456                                          DCERPC_AUTH_TYPE_SCHANNEL,
1457                                          auth_level,
1458                                          0, /* auth_pad_length */
1459                                          1, /* auth_context_id */
1460                                          &schannel_blob,
1461                                          auth_info);
1462         if (!NT_STATUS_IS_OK(status)) {
1463                 return status;
1464         }
1465
1466         return NT_STATUS_OK;
1467 }
1468
1469 /*******************************************************************
1470  Creates the internals of a DCE/RPC bind request or alter context PDU.
1471  ********************************************************************/
1472
1473 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1474                                                 enum dcerpc_pkt_type ptype,
1475                                                 uint32 rpc_call_id,
1476                                                 const struct ndr_syntax_id *abstract,
1477                                                 const struct ndr_syntax_id *transfer,
1478                                                 const DATA_BLOB *auth_info,
1479                                                 DATA_BLOB *blob)
1480 {
1481         uint16 auth_len = auth_info->length;
1482         NTSTATUS status;
1483         union dcerpc_payload u;
1484         struct dcerpc_ctx_list ctx_list;
1485
1486         if (auth_len) {
1487                 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1488         }
1489
1490         ctx_list.context_id = 0;
1491         ctx_list.num_transfer_syntaxes = 1;
1492         ctx_list.abstract_syntax = *abstract;
1493         ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1494
1495         u.bind.max_xmit_frag    = RPC_MAX_PDU_FRAG_LEN;
1496         u.bind.max_recv_frag    = RPC_MAX_PDU_FRAG_LEN;
1497         u.bind.assoc_group_id   = 0x0;
1498         u.bind.num_contexts     = 1;
1499         u.bind.ctx_list         = &ctx_list;
1500         u.bind.auth_info        = *auth_info;
1501
1502         status = dcerpc_push_ncacn_packet(mem_ctx,
1503                                           ptype,
1504                                           DCERPC_PFC_FLAG_FIRST |
1505                                           DCERPC_PFC_FLAG_LAST,
1506                                           auth_len,
1507                                           rpc_call_id,
1508                                           &u,
1509                                           blob);
1510         if (!NT_STATUS_IS_OK(status)) {
1511                 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1512                 return status;
1513         }
1514
1515         return NT_STATUS_OK;
1516 }
1517
1518 /*******************************************************************
1519  Creates a DCE/RPC bind request.
1520  ********************************************************************/
1521
1522 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1523                                     struct rpc_pipe_client *cli,
1524                                     uint32 rpc_call_id,
1525                                     const struct ndr_syntax_id *abstract,
1526                                     const struct ndr_syntax_id *transfer,
1527                                     enum pipe_auth_type auth_type,
1528                                     enum dcerpc_AuthLevel auth_level,
1529                                     DATA_BLOB *rpc_out)
1530 {
1531         DATA_BLOB auth_info = data_blob_null;
1532         NTSTATUS ret = NT_STATUS_OK;
1533
1534         switch (auth_type) {
1535                 case PIPE_AUTH_TYPE_SCHANNEL:
1536                         ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &auth_info);
1537                         if (!NT_STATUS_IS_OK(ret)) {
1538                                 return ret;
1539                         }
1540                         break;
1541
1542                 case PIPE_AUTH_TYPE_NTLMSSP:
1543                         ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &auth_info);
1544                         if (!NT_STATUS_IS_OK(ret)) {
1545                                 return ret;
1546                         }
1547                         break;
1548
1549                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1550                         ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &auth_info);
1551                         if (!NT_STATUS_IS_OK(ret)) {
1552                                 return ret;
1553                         }
1554                         break;
1555
1556                 case PIPE_AUTH_TYPE_KRB5:
1557                         ret = create_krb5_auth_bind_req(cli, auth_level, &auth_info);
1558                         if (!NT_STATUS_IS_OK(ret)) {
1559                                 return ret;
1560                         }
1561                         break;
1562
1563                 case PIPE_AUTH_TYPE_NONE:
1564                         break;
1565
1566                 default:
1567                         /* "Can't" happen. */
1568                         return NT_STATUS_INVALID_INFO_CLASS;
1569         }
1570
1571         ret = create_bind_or_alt_ctx_internal(mem_ctx,
1572                                               DCERPC_PKT_BIND,
1573                                               rpc_call_id,
1574                                               abstract,
1575                                               transfer,
1576                                               &auth_info,
1577                                               rpc_out);
1578         return ret;
1579 }
1580
1581 /*******************************************************************
1582  Create and add the NTLMSSP sign/seal auth header and data.
1583  ********************************************************************/
1584
1585 static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
1586                                         uint32 ss_padding_len,
1587                                         DATA_BLOB *rpc_out)
1588 {
1589         DATA_BLOB auth_info;
1590         NTSTATUS status;
1591         DATA_BLOB auth_blob = data_blob_null;
1592         uint16_t data_and_pad_len = rpc_out->length - DCERPC_RESPONSE_LENGTH;
1593
1594         if (!cli->auth->a_u.auth_ntlmssp_state) {
1595                 return NT_STATUS_INVALID_PARAMETER;
1596         }
1597
1598         /* marshall the dcerpc_auth with an actually empty auth_blob.
1599          * this is needed because the ntmlssp signature includes the
1600          * auth header */
1601         status = dcerpc_push_dcerpc_auth(rpc_out->data,
1602                                         map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
1603                                         cli->auth->auth_level,
1604                                         ss_padding_len,
1605                                         1 /* context id. */,
1606                                         &auth_blob,
1607                                         &auth_info);
1608         if (!NT_STATUS_IS_OK(status)) {
1609                 return status;
1610         }
1611
1612         /* append the header */
1613         if (!data_blob_append(NULL, rpc_out,
1614                                 auth_info.data, auth_info.length)) {
1615                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
1616                           (unsigned int)auth_info.length));
1617                 return NT_STATUS_NO_MEMORY;
1618         }
1619         data_blob_free(&auth_info);
1620
1621         switch (cli->auth->auth_level) {
1622         case DCERPC_AUTH_LEVEL_PRIVACY:
1623                 /* Data portion is encrypted. */
1624                 status = auth_ntlmssp_seal_packet(cli->auth->a_u.auth_ntlmssp_state,
1625                                              rpc_out->data,
1626                                              rpc_out->data
1627                                                 + DCERPC_RESPONSE_LENGTH,
1628                                              data_and_pad_len,
1629                                              rpc_out->data,
1630                                              rpc_out->length,
1631                                              &auth_blob);
1632                 if (!NT_STATUS_IS_OK(status)) {
1633                         return status;
1634                 }
1635                 break;
1636
1637         case DCERPC_AUTH_LEVEL_INTEGRITY:
1638                 /* Data is signed. */
1639                 status = auth_ntlmssp_sign_packet(cli->auth->a_u.auth_ntlmssp_state,
1640                                              rpc_out->data,
1641                                              rpc_out->data
1642                                                 + DCERPC_RESPONSE_LENGTH,
1643                                              data_and_pad_len,
1644                                              rpc_out->data,
1645                                              rpc_out->length,
1646                                              &auth_blob);
1647                 if (!NT_STATUS_IS_OK(status)) {
1648                         return status;
1649                 }
1650                 break;
1651
1652         default:
1653                 /* Can't happen. */
1654                 smb_panic("bad auth level");
1655                 /* Notreached. */
1656                 return NT_STATUS_INVALID_PARAMETER;
1657         }
1658
1659         /* Finally attach the blob. */
1660         if (!data_blob_append(NULL, rpc_out,
1661                                 auth_blob.data, auth_blob.length)) {
1662                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
1663                           (unsigned int)auth_info.length));
1664                 return NT_STATUS_NO_MEMORY;
1665         }
1666         data_blob_free(&auth_blob);
1667
1668         return NT_STATUS_OK;
1669 }
1670
1671 /*******************************************************************
1672  Create and add the schannel sign/seal auth header and data.
1673  ********************************************************************/
1674
1675 static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
1676                                         uint32 ss_padding_len,
1677                                         DATA_BLOB *rpc_out)
1678 {
1679         DATA_BLOB auth_info;
1680         struct schannel_state *sas = cli->auth->a_u.schannel_auth;
1681         uint8_t *data_p = rpc_out->data + DCERPC_RESPONSE_LENGTH;
1682         size_t data_and_pad_len = rpc_out->length
1683                                         - DCERPC_RESPONSE_LENGTH;
1684         DATA_BLOB blob;
1685         NTSTATUS status;
1686
1687         if (!sas) {
1688                 return NT_STATUS_INVALID_PARAMETER;
1689         }
1690
1691         DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
1692                         sas->seq_num));
1693
1694         switch (cli->auth->auth_level) {
1695         case DCERPC_AUTH_LEVEL_PRIVACY:
1696                 status = netsec_outgoing_packet(sas,
1697                                                 rpc_out->data,
1698                                                 true,
1699                                                 data_p,
1700                                                 data_and_pad_len,
1701                                                 &blob);
1702                 break;
1703         case DCERPC_AUTH_LEVEL_INTEGRITY:
1704                 status = netsec_outgoing_packet(sas,
1705                                                 rpc_out->data,
1706                                                 false,
1707                                                 data_p,
1708                                                 data_and_pad_len,
1709                                                 &blob);
1710                 break;
1711         default:
1712                 status = NT_STATUS_INTERNAL_ERROR;
1713                 break;
1714         }
1715
1716         if (!NT_STATUS_IS_OK(status)) {
1717                 DEBUG(1,("add_schannel_auth_footer: failed to process packet: %s\n",
1718                         nt_errstr(status)));
1719                 return status;
1720         }
1721
1722         if (DEBUGLEVEL >= 10) {
1723                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
1724         }
1725
1726         /* Finally marshall the blob. */
1727         status = dcerpc_push_dcerpc_auth(rpc_out->data,
1728                    map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
1729                                         cli->auth->auth_level,
1730                                         ss_padding_len,
1731                                         1 /* context id. */,
1732                                         &blob,
1733                                         &auth_info);
1734         if (!NT_STATUS_IS_OK(status)) {
1735                 return status;
1736         }
1737         data_blob_free(&blob);
1738
1739         if (!data_blob_append(NULL, rpc_out,
1740                                 auth_info.data, auth_info.length)) {
1741                 return NT_STATUS_NO_MEMORY;
1742         }
1743         data_blob_free(&auth_info);
1744
1745         return NT_STATUS_OK;
1746 }
1747
1748 /*******************************************************************
1749  Calculate how much data we're going to send in this packet, also
1750  work out any sign/seal padding length.
1751  ********************************************************************/
1752
1753 static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
1754                                         uint32 data_left,
1755                                         uint16 *p_frag_len,
1756                                         uint16 *p_auth_len,
1757                                         uint32 *p_ss_padding)
1758 {
1759         uint32 data_space, data_len;
1760
1761 #if 0
1762         if ((data_left > 0) && (sys_random() % 2)) {
1763                 data_left = MAX(data_left/2, 1);
1764         }
1765 #endif
1766
1767         switch (cli->auth->auth_level) {
1768                 case DCERPC_AUTH_LEVEL_NONE:
1769                 case DCERPC_AUTH_LEVEL_CONNECT:
1770                         data_space = cli->max_xmit_frag - DCERPC_REQUEST_LENGTH;
1771                         data_len = MIN(data_space, data_left);
1772                         *p_ss_padding = 0;
1773                         *p_auth_len = 0;
1774                         *p_frag_len = DCERPC_REQUEST_LENGTH + data_len;
1775                         return data_len;
1776
1777                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1778                 case DCERPC_AUTH_LEVEL_PRIVACY:
1779                         /* Treat the same for all authenticated rpc requests. */
1780                         switch(cli->auth->auth_type) {
1781                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1782                                 case PIPE_AUTH_TYPE_NTLMSSP:
1783                                         *p_auth_len = NTLMSSP_SIG_SIZE;
1784                                         break;
1785                                 case PIPE_AUTH_TYPE_SCHANNEL:
1786                                         *p_auth_len = NL_AUTH_SIGNATURE_SIZE;
1787                                         break;
1788                                 default:
1789                                         smb_panic("bad auth type");
1790                                         break;
1791                         }
1792
1793                         data_space = cli->max_xmit_frag
1794                                         - DCERPC_REQUEST_LENGTH
1795                                         - DCERPC_AUTH_TRAILER_LENGTH
1796                                         - *p_auth_len;
1797
1798                         data_len = MIN(data_space, data_left);
1799                         *p_ss_padding = 0;
1800                         if (data_len % CLIENT_NDR_PADDING_SIZE) {
1801                                 *p_ss_padding = CLIENT_NDR_PADDING_SIZE - (data_len % CLIENT_NDR_PADDING_SIZE);
1802                         }
1803                         *p_frag_len = DCERPC_REQUEST_LENGTH
1804                                         + data_len + *p_ss_padding
1805                                         + DCERPC_AUTH_TRAILER_LENGTH
1806                                         + *p_auth_len;
1807                         return data_len;
1808
1809                 default:
1810                         smb_panic("bad auth level");
1811                         /* Notreached. */
1812                         return 0;
1813         }
1814 }
1815
1816 /*******************************************************************
1817  External interface.
1818  Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1819  Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1820  and deals with signing/sealing details.
1821  ********************************************************************/
1822
1823 struct rpc_api_pipe_req_state {
1824         struct event_context *ev;
1825         struct rpc_pipe_client *cli;
1826         uint8_t op_num;
1827         uint32_t call_id;
1828         DATA_BLOB *req_data;
1829         uint32_t req_data_sent;
1830         DATA_BLOB rpc_out;
1831         DATA_BLOB reply_pdu;
1832 };
1833
1834 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1835 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1836 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1837                                   bool *is_last_frag);
1838
1839 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1840                                          struct event_context *ev,
1841                                          struct rpc_pipe_client *cli,
1842                                          uint8_t op_num,
1843                                          DATA_BLOB *req_data)
1844 {
1845         struct tevent_req *req, *subreq;
1846         struct rpc_api_pipe_req_state *state;
1847         NTSTATUS status;
1848         bool is_last_frag;
1849
1850         req = tevent_req_create(mem_ctx, &state,
1851                                 struct rpc_api_pipe_req_state);
1852         if (req == NULL) {
1853                 return NULL;
1854         }
1855         state->ev = ev;
1856         state->cli = cli;
1857         state->op_num = op_num;
1858         state->req_data = req_data;
1859         state->req_data_sent = 0;
1860         state->call_id = get_rpc_call_id();
1861         state->reply_pdu = data_blob_null;
1862         state->rpc_out = data_blob_null;
1863
1864         if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1865                                         + RPC_MAX_SIGN_SIZE) {
1866                 /* Server is screwed up ! */
1867                 status = NT_STATUS_INVALID_PARAMETER;
1868                 goto post_status;
1869         }
1870
1871         status = prepare_next_frag(state, &is_last_frag);
1872         if (!NT_STATUS_IS_OK(status)) {
1873                 goto post_status;
1874         }
1875
1876         if (is_last_frag) {
1877                 subreq = rpc_api_pipe_send(state, ev, state->cli,
1878                                            &state->rpc_out,
1879                                            DCERPC_PKT_RESPONSE);
1880                 if (subreq == NULL) {
1881                         goto fail;
1882                 }
1883                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1884         } else {
1885                 subreq = rpc_write_send(state, ev, cli->transport,
1886                                         state->rpc_out.data,
1887                                         state->rpc_out.length);
1888                 if (subreq == NULL) {
1889                         goto fail;
1890                 }
1891                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1892                                         req);
1893         }
1894         return req;
1895
1896  post_status:
1897         tevent_req_nterror(req, status);
1898         return tevent_req_post(req, ev);
1899  fail:
1900         TALLOC_FREE(req);
1901         return NULL;
1902 }
1903
1904 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1905                                   bool *is_last_frag)
1906 {
1907         uint32_t data_sent_thistime;
1908         uint16_t auth_len;
1909         uint16_t frag_len;
1910         uint8_t flags = 0;
1911         uint32_t ss_padding;
1912         uint32_t data_left;
1913         char pad[8] = { 0, };
1914         NTSTATUS status;
1915         union dcerpc_payload u;
1916
1917         data_left = state->req_data->length - state->req_data_sent;
1918
1919         data_sent_thistime = calculate_data_len_tosend(
1920                 state->cli, data_left, &frag_len, &auth_len, &ss_padding);
1921
1922         if (state->req_data_sent == 0) {
1923                 flags = DCERPC_PFC_FLAG_FIRST;
1924         }
1925
1926         if (data_sent_thistime == data_left) {
1927                 flags |= DCERPC_PFC_FLAG_LAST;
1928         }
1929
1930         data_blob_free(&state->rpc_out);
1931
1932         ZERO_STRUCT(u.request);
1933
1934         u.request.alloc_hint    = state->req_data->length;
1935         u.request.context_id    = 0;
1936         u.request.opnum         = state->op_num;
1937
1938         status = dcerpc_push_ncacn_packet(state,
1939                                           DCERPC_PKT_REQUEST,
1940                                           flags,
1941                                           auth_len,
1942                                           state->call_id,
1943                                           &u,
1944                                           &state->rpc_out);
1945         if (!NT_STATUS_IS_OK(status)) {
1946                 return status;
1947         }
1948
1949         /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1950          * compute it right for requests */
1951         dcerpc_set_frag_length(&state->rpc_out, frag_len);
1952
1953         /* Copy in the data, plus any ss padding. */
1954         if (!data_blob_append(NULL, &state->rpc_out,
1955                                 state->req_data->data + state->req_data_sent,
1956                                 data_sent_thistime)) {
1957                 return NT_STATUS_NO_MEMORY;
1958         }
1959
1960         if (ss_padding) {
1961                 /* Copy the sign/seal padding data. */
1962                 if (!data_blob_append(NULL, &state->rpc_out,
1963                                         pad, ss_padding)) {
1964                         return NT_STATUS_NO_MEMORY;
1965                 }
1966         }
1967
1968         /* Generate any auth sign/seal and add the auth footer. */
1969         switch (state->cli->auth->auth_type) {
1970         case PIPE_AUTH_TYPE_NONE:
1971                 status = NT_STATUS_OK;
1972                 break;
1973         case PIPE_AUTH_TYPE_NTLMSSP:
1974         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1975                 status = add_ntlmssp_auth_footer(state->cli, ss_padding,
1976                                                  &state->rpc_out);
1977                 break;
1978         case PIPE_AUTH_TYPE_SCHANNEL:
1979                 status = add_schannel_auth_footer(state->cli, ss_padding,
1980                                                   &state->rpc_out);
1981                 break;
1982         default:
1983                 status = NT_STATUS_INVALID_PARAMETER;
1984                 break;
1985         }
1986
1987         state->req_data_sent += data_sent_thistime;
1988         *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1989
1990         return status;
1991 }
1992
1993 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1994 {
1995         struct tevent_req *req = tevent_req_callback_data(
1996                 subreq, struct tevent_req);
1997         struct rpc_api_pipe_req_state *state = tevent_req_data(
1998                 req, struct rpc_api_pipe_req_state);
1999         NTSTATUS status;
2000         bool is_last_frag;
2001
2002         status = rpc_write_recv(subreq);
2003         TALLOC_FREE(subreq);
2004         if (!NT_STATUS_IS_OK(status)) {
2005                 tevent_req_nterror(req, status);
2006                 return;
2007         }
2008
2009         status = prepare_next_frag(state, &is_last_frag);
2010         if (!NT_STATUS_IS_OK(status)) {
2011                 tevent_req_nterror(req, status);
2012                 return;
2013         }
2014
2015         if (is_last_frag) {
2016                 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2017                                            &state->rpc_out,
2018                                            DCERPC_PKT_RESPONSE);
2019                 if (tevent_req_nomem(subreq, req)) {
2020                         return;
2021                 }
2022                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
2023         } else {
2024                 subreq = rpc_write_send(state, state->ev,
2025                                         state->cli->transport,
2026                                         state->rpc_out.data,
2027                                         state->rpc_out.length);
2028                 if (tevent_req_nomem(subreq, req)) {
2029                         return;
2030                 }
2031                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
2032                                         req);
2033         }
2034 }
2035
2036 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
2037 {
2038         struct tevent_req *req = tevent_req_callback_data(
2039                 subreq, struct tevent_req);
2040         struct rpc_api_pipe_req_state *state = tevent_req_data(
2041                 req, struct rpc_api_pipe_req_state);
2042         NTSTATUS status;
2043
2044         status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
2045         TALLOC_FREE(subreq);
2046         if (!NT_STATUS_IS_OK(status)) {
2047                 tevent_req_nterror(req, status);
2048                 return;
2049         }
2050         tevent_req_done(req);
2051 }
2052
2053 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2054                                DATA_BLOB *reply_pdu)
2055 {
2056         struct rpc_api_pipe_req_state *state = tevent_req_data(
2057                 req, struct rpc_api_pipe_req_state);
2058         NTSTATUS status;
2059
2060         if (tevent_req_is_nterror(req, &status)) {
2061                 /*
2062                  * We always have to initialize to reply pdu, even if there is
2063                  * none. The rpccli_* caller routines expect this.
2064                  */
2065                 *reply_pdu = data_blob_null;
2066                 return status;
2067         }
2068
2069         /* return data to caller and assign it ownership of memory */
2070         reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
2071         reply_pdu->length = state->reply_pdu.length;
2072         state->reply_pdu.length = 0;
2073
2074         return NT_STATUS_OK;
2075 }
2076
2077 #if 0
2078 /****************************************************************************
2079  Set the handle state.
2080 ****************************************************************************/
2081
2082 static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
2083                                    const char *pipe_name, uint16 device_state)
2084 {
2085         bool state_set = False;
2086         char param[2];
2087         uint16 setup[2]; /* only need 2 uint16 setup parameters */
2088         char *rparam = NULL;
2089         char *rdata = NULL;
2090         uint32 rparam_len, rdata_len;
2091
2092         if (pipe_name == NULL)
2093                 return False;
2094
2095         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
2096                  cli->fnum, pipe_name, device_state));
2097
2098         /* create parameters: device state */
2099         SSVAL(param, 0, device_state);
2100
2101         /* create setup parameters. */
2102         setup[0] = 0x0001;
2103         setup[1] = cli->fnum; /* pipe file handle.  got this from an SMBOpenX. */
2104
2105         /* send the data on \PIPE\ */
2106         if (cli_api_pipe(cli->cli, "\\PIPE\\",
2107                     setup, 2, 0,                /* setup, length, max */
2108                     param, 2, 0,                /* param, length, max */
2109                     NULL, 0, 1024,              /* data, length, max */
2110                     &rparam, &rparam_len,        /* return param, length */
2111                     &rdata, &rdata_len))         /* return data, length */
2112         {
2113                 DEBUG(5, ("Set Handle state: return OK\n"));
2114                 state_set = True;
2115         }
2116
2117         SAFE_FREE(rparam);
2118         SAFE_FREE(rdata);
2119
2120         return state_set;
2121 }
2122 #endif
2123
2124 /****************************************************************************
2125  Check the rpc bind acknowledge response.
2126 ****************************************************************************/
2127
2128 static bool check_bind_response(const struct dcerpc_bind_ack *r,
2129                                 const struct ndr_syntax_id *transfer)
2130 {
2131         struct dcerpc_ack_ctx ctx;
2132
2133         if (r->secondary_address_size == 0) {
2134                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
2135         }
2136
2137         if (r->num_results < 1 || !r->ctx_list) {
2138                 return false;
2139         }
2140
2141         ctx = r->ctx_list[0];
2142
2143         /* check the transfer syntax */
2144         if ((ctx.syntax.if_version != transfer->if_version) ||
2145              (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
2146                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
2147                 return False;
2148         }
2149
2150         if (r->num_results != 0x1 || ctx.result != 0) {
2151                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
2152                           r->num_results, ctx.reason));
2153         }
2154
2155         DEBUG(5,("check_bind_response: accepted!\n"));
2156         return True;
2157 }
2158
2159 /*******************************************************************
2160  Creates a DCE/RPC bind authentication response.
2161  This is the packet that is sent back to the server once we
2162  have received a BIND-ACK, to finish the third leg of
2163  the authentication handshake.
2164  ********************************************************************/
2165
2166 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
2167                                 struct rpc_pipe_client *cli,
2168                                 uint32 rpc_call_id,
2169                                 enum pipe_auth_type auth_type,
2170                                 enum dcerpc_AuthLevel auth_level,
2171                                 DATA_BLOB *pauth_blob,
2172                                 DATA_BLOB *rpc_out)
2173 {
2174         NTSTATUS status;
2175         union dcerpc_payload u;
2176
2177         u.auth3._pad = 0;
2178
2179         status = dcerpc_push_dcerpc_auth(mem_ctx,
2180                         map_pipe_auth_type_to_rpc_auth_type(auth_type),
2181                                          auth_level,
2182                                          0, /* auth_pad_length */
2183                                          1, /* auth_context_id */
2184                                          pauth_blob,
2185                                          &u.auth3.auth_info);
2186         if (!NT_STATUS_IS_OK(status)) {
2187                 return status;
2188         }
2189
2190         status = dcerpc_push_ncacn_packet(mem_ctx,
2191                                           DCERPC_PKT_AUTH3,
2192                                           DCERPC_PFC_FLAG_FIRST |
2193                                           DCERPC_PFC_FLAG_LAST,
2194                                           pauth_blob->length,
2195                                           rpc_call_id,
2196                                           &u,
2197                                           rpc_out);
2198         data_blob_free(&u.auth3.auth_info);
2199         if (!NT_STATUS_IS_OK(status)) {
2200                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
2201                 return status;
2202         }
2203
2204         return NT_STATUS_OK;
2205 }
2206
2207 /*******************************************************************
2208  Creates a DCE/RPC bind alter context authentication request which
2209  may contain a spnego auth blobl
2210  ********************************************************************/
2211
2212 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
2213                                         uint32 rpc_call_id,
2214                                         const struct ndr_syntax_id *abstract,
2215                                         const struct ndr_syntax_id *transfer,
2216                                         enum dcerpc_AuthLevel auth_level,
2217                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
2218                                         DATA_BLOB *rpc_out)
2219 {
2220         DATA_BLOB auth_info;
2221         NTSTATUS status;
2222
2223         status = dcerpc_push_dcerpc_auth(mem_ctx,
2224                                          DCERPC_AUTH_TYPE_SPNEGO,
2225                                          auth_level,
2226                                          0, /* auth_pad_length */
2227                                          1, /* auth_context_id */
2228                                          pauth_blob,
2229                                          &auth_info);
2230         if (!NT_STATUS_IS_OK(status)) {
2231                 return status;
2232         }
2233
2234         status = create_bind_or_alt_ctx_internal(mem_ctx,
2235                                                  DCERPC_PKT_ALTER,
2236                                                  rpc_call_id,
2237                                                  abstract,
2238                                                  transfer,
2239                                                  &auth_info,
2240                                                  rpc_out);
2241         data_blob_free(&auth_info);
2242         return status;
2243 }
2244
2245 /****************************************************************************
2246  Do an rpc bind.
2247 ****************************************************************************/
2248
2249 struct rpc_pipe_bind_state {
2250         struct event_context *ev;
2251         struct rpc_pipe_client *cli;
2252         DATA_BLOB rpc_out;
2253         uint32_t rpc_call_id;
2254 };
2255
2256 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
2257 static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
2258                                            struct rpc_pipe_bind_state *state,
2259                                            struct ncacn_packet *r);
2260 static void rpc_bind_auth3_write_done(struct tevent_req *subreq);
2261 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
2262                                                     struct rpc_pipe_bind_state *state,
2263                                                     struct ncacn_packet *r,
2264                                                     DATA_BLOB *reply_pdu);
2265 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq);
2266
2267 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
2268                                       struct event_context *ev,
2269                                       struct rpc_pipe_client *cli,
2270                                       struct pipe_auth_data *auth)
2271 {
2272         struct tevent_req *req, *subreq;
2273         struct rpc_pipe_bind_state *state;
2274         NTSTATUS status;
2275
2276         req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
2277         if (req == NULL) {
2278                 return NULL;
2279         }
2280
2281         DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
2282                 rpccli_pipe_txt(talloc_tos(), cli),
2283                 (unsigned int)auth->auth_type,
2284                 (unsigned int)auth->auth_level ));
2285
2286         state->ev = ev;
2287         state->cli = cli;
2288         state->rpc_call_id = get_rpc_call_id();
2289         state->rpc_out = data_blob_null;
2290
2291         cli->auth = talloc_move(cli, &auth);
2292
2293         /* Marshall the outgoing data. */
2294         status = create_rpc_bind_req(state, cli,
2295                                      state->rpc_call_id,
2296                                      &cli->abstract_syntax,
2297                                      &cli->transfer_syntax,
2298                                      cli->auth->auth_type,
2299                                      cli->auth->auth_level,
2300                                      &state->rpc_out);
2301
2302         if (!NT_STATUS_IS_OK(status)) {
2303                 goto post_status;
2304         }
2305
2306         subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
2307                                    DCERPC_PKT_BIND_ACK);
2308         if (subreq == NULL) {
2309                 goto fail;
2310         }
2311         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2312         return req;
2313
2314  post_status:
2315         tevent_req_nterror(req, status);
2316         return tevent_req_post(req, ev);
2317  fail:
2318         TALLOC_FREE(req);
2319         return NULL;
2320 }
2321
2322 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
2323 {
2324         struct tevent_req *req = tevent_req_callback_data(
2325                 subreq, struct tevent_req);
2326         struct rpc_pipe_bind_state *state = tevent_req_data(
2327                 req, struct rpc_pipe_bind_state);
2328         DATA_BLOB reply_pdu;
2329         struct ncacn_packet *pkt;
2330         NTSTATUS status;
2331
2332         status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, &reply_pdu);
2333         TALLOC_FREE(subreq);
2334         if (!NT_STATUS_IS_OK(status)) {
2335                 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
2336                           rpccli_pipe_txt(talloc_tos(), state->cli),
2337                           nt_errstr(status)));
2338                 tevent_req_nterror(req, status);
2339                 return;
2340         }
2341
2342         if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
2343                 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
2344                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2345                 return;
2346         }
2347
2348         state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
2349         state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
2350
2351         /*
2352          * For authenticated binds we may need to do 3 or 4 leg binds.
2353          */
2354
2355         switch(state->cli->auth->auth_type) {
2356
2357         case PIPE_AUTH_TYPE_NONE:
2358         case PIPE_AUTH_TYPE_SCHANNEL:
2359                 /* Bind complete. */
2360                 tevent_req_done(req);
2361                 break;
2362
2363         case PIPE_AUTH_TYPE_NTLMSSP:
2364                 /* Need to send AUTH3 packet - no reply. */
2365                 status = rpc_finish_auth3_bind_send(req, state, pkt);
2366                 if (!NT_STATUS_IS_OK(status)) {
2367                         tevent_req_nterror(req, status);
2368                 }
2369                 break;
2370
2371         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2372                 /* Need to send alter context request and reply. */
2373                 status = rpc_finish_spnego_ntlmssp_bind_send(req, state, pkt,
2374                                                              &reply_pdu);
2375                 if (!NT_STATUS_IS_OK(status)) {
2376                         tevent_req_nterror(req, status);
2377                 }
2378                 break;
2379
2380         case PIPE_AUTH_TYPE_KRB5:
2381                 /* */
2382
2383         default:
2384                 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
2385                          (unsigned int)state->cli->auth->auth_type));
2386                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2387         }
2388 }
2389
2390 static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
2391                                            struct rpc_pipe_bind_state *state,
2392                                            struct ncacn_packet *r)
2393 {
2394         DATA_BLOB client_reply = data_blob_null;
2395         struct dcerpc_auth auth;
2396         struct tevent_req *subreq;
2397         NTSTATUS status;
2398
2399         if ((r->auth_length == 0)
2400             || (r->frag_length < DCERPC_AUTH_TRAILER_LENGTH
2401                                         + r->auth_length)) {
2402                 return NT_STATUS_INVALID_PARAMETER;
2403         }
2404
2405         status = dcerpc_pull_dcerpc_auth(talloc_tos(),
2406                                          &r->u.bind_ack.auth_info,
2407                                          &auth, false);
2408         if (!NT_STATUS_IS_OK(status)) {
2409                 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
2410                           nt_errstr(status)));
2411                 return status;
2412         }
2413
2414         /* TODO - check auth_type/auth_level match. */
2415
2416         status = auth_ntlmssp_update(state->cli->auth->a_u.auth_ntlmssp_state,
2417                                 auth.credentials, &client_reply);
2418
2419         if (!NT_STATUS_IS_OK(status)) {
2420                 DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
2421                           "blob failed: %s.\n", nt_errstr(status)));
2422                 return status;
2423         }
2424
2425         data_blob_free(&state->rpc_out);
2426
2427         status = create_rpc_bind_auth3(state,
2428                                        state->cli, state->rpc_call_id,
2429                                        state->cli->auth->auth_type,
2430                                        state->cli->auth->auth_level,
2431                                        &client_reply, &state->rpc_out);
2432         data_blob_free(&client_reply);
2433
2434         if (!NT_STATUS_IS_OK(status)) {
2435                 return status;
2436         }
2437
2438         subreq = rpc_write_send(state, state->ev, state->cli->transport,
2439                                 state->rpc_out.data, state->rpc_out.length);
2440         if (subreq == NULL) {
2441                 return NT_STATUS_NO_MEMORY;
2442         }
2443         tevent_req_set_callback(subreq, rpc_bind_auth3_write_done, req);
2444         return NT_STATUS_OK;
2445 }
2446
2447 static void rpc_bind_auth3_write_done(struct tevent_req *subreq)
2448 {
2449         struct tevent_req *req = tevent_req_callback_data(
2450                 subreq, struct tevent_req);
2451         NTSTATUS status;
2452
2453         status = rpc_write_recv(subreq);
2454         TALLOC_FREE(subreq);
2455         if (!NT_STATUS_IS_OK(status)) {
2456                 tevent_req_nterror(req, status);
2457                 return;
2458         }
2459         tevent_req_done(req);
2460 }
2461
2462 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
2463                                                     struct rpc_pipe_bind_state *state,
2464                                                     struct ncacn_packet *r,
2465                                                     DATA_BLOB *reply_pdu)
2466 {
2467         DATA_BLOB server_ntlm_response = data_blob_null;
2468         DATA_BLOB client_reply = data_blob_null;
2469         DATA_BLOB tmp_blob = data_blob_null;
2470         struct dcerpc_auth auth_info;
2471         DATA_BLOB auth_blob;
2472         struct tevent_req *subreq;
2473         NTSTATUS status;
2474
2475         if ((r->auth_length == 0)
2476             || (r->frag_length < DCERPC_AUTH_TRAILER_LENGTH
2477                                         + r->auth_length)) {
2478                 return NT_STATUS_INVALID_PARAMETER;
2479         }
2480
2481         /* Process the returned NTLMSSP blob first. */
2482         auth_blob = data_blob_const(reply_pdu->data
2483                                         + r->frag_length
2484                                         - DCERPC_AUTH_TRAILER_LENGTH
2485                                         - r->auth_length,
2486                                     DCERPC_AUTH_TRAILER_LENGTH
2487                                         + r->auth_length);
2488
2489         status = dcerpc_pull_dcerpc_auth(state, &auth_blob, &auth_info, false);
2490         if (!NT_STATUS_IS_OK(status)) {
2491                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
2492                 return status;
2493         }
2494
2495         /*
2496          * The server might give us back two challenges - tmp_blob is for the
2497          * second.
2498          */
2499         if (!spnego_parse_challenge(auth_info.credentials,
2500                                     &server_ntlm_response, &tmp_blob)) {
2501                 data_blob_free(&server_ntlm_response);
2502                 data_blob_free(&tmp_blob);
2503                 return NT_STATUS_INVALID_PARAMETER;
2504         }
2505
2506         /* We're finished with the server spnego response and the tmp_blob. */
2507         data_blob_free(&tmp_blob);
2508
2509         status = auth_ntlmssp_update(state->cli->auth->a_u.auth_ntlmssp_state,
2510                                 server_ntlm_response, &client_reply);
2511
2512         /* Finished with the server_ntlm response */
2513         data_blob_free(&server_ntlm_response);
2514
2515         if (!NT_STATUS_IS_OK(status)) {
2516                 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
2517                           "using server blob failed.\n"));
2518                 data_blob_free(&client_reply);
2519                 return status;
2520         }
2521
2522         /* SPNEGO wrap the client reply. */
2523         tmp_blob = spnego_gen_auth(client_reply);
2524         data_blob_free(&client_reply);
2525         client_reply = tmp_blob;
2526         tmp_blob = data_blob_null;
2527
2528         /* Now prepare the alter context pdu. */
2529         data_blob_free(&state->rpc_out);
2530
2531         status = create_rpc_alter_context(state,
2532                                           state->rpc_call_id,
2533                                           &state->cli->abstract_syntax,
2534                                           &state->cli->transfer_syntax,
2535                                           state->cli->auth->auth_level,
2536                                           &client_reply,
2537                                           &state->rpc_out);
2538         data_blob_free(&client_reply);
2539
2540         if (!NT_STATUS_IS_OK(status)) {
2541                 return status;
2542         }
2543
2544         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2545                                    &state->rpc_out, DCERPC_PKT_ALTER_RESP);
2546         if (subreq == NULL) {
2547                 return NT_STATUS_NO_MEMORY;
2548         }
2549         tevent_req_set_callback(subreq, rpc_bind_ntlmssp_api_done, req);
2550         return NT_STATUS_OK;
2551 }
2552
2553 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq)
2554 {
2555         struct tevent_req *req = tevent_req_callback_data(
2556                 subreq, struct tevent_req);
2557         struct rpc_pipe_bind_state *state = tevent_req_data(
2558                 req, struct rpc_pipe_bind_state);
2559         DATA_BLOB tmp_blob = data_blob_null;
2560         struct ncacn_packet *pkt;
2561         struct dcerpc_auth auth;
2562         NTSTATUS status;
2563
2564         status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
2565         TALLOC_FREE(subreq);
2566         if (!NT_STATUS_IS_OK(status)) {
2567                 tevent_req_nterror(req, status);
2568                 return;
2569         }
2570
2571         status = dcerpc_pull_dcerpc_auth(pkt,
2572                                          &pkt->u.alter_resp.auth_info,
2573                                          &auth, false);
2574         if (!NT_STATUS_IS_OK(status)) {
2575                 tevent_req_nterror(req, status);
2576                 return;
2577         }
2578
2579         /* Check we got a valid auth response. */
2580         if (!spnego_parse_auth_response(auth.credentials,
2581                                         NT_STATUS_OK,
2582                                         OID_NTLMSSP, &tmp_blob)) {
2583                 data_blob_free(&tmp_blob);
2584                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
2585                 return;
2586         }
2587
2588         data_blob_free(&tmp_blob);
2589
2590         DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
2591                  "%s.\n", rpccli_pipe_txt(talloc_tos(), state->cli)));
2592         tevent_req_done(req);
2593 }
2594
2595 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
2596 {
2597         return tevent_req_simple_recv_ntstatus(req);
2598 }
2599
2600 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
2601                        struct pipe_auth_data *auth)
2602 {
2603         TALLOC_CTX *frame = talloc_stackframe();
2604         struct event_context *ev;
2605         struct tevent_req *req;
2606         NTSTATUS status = NT_STATUS_OK;
2607
2608         ev = event_context_init(frame);
2609         if (ev == NULL) {
2610                 status = NT_STATUS_NO_MEMORY;
2611                 goto fail;
2612         }
2613
2614         req = rpc_pipe_bind_send(frame, ev, cli, auth);
2615         if (req == NULL) {
2616                 status = NT_STATUS_NO_MEMORY;
2617                 goto fail;
2618         }
2619
2620         if (!tevent_req_poll(req, ev)) {
2621                 status = map_nt_error_from_unix(errno);
2622                 goto fail;
2623         }
2624
2625         status = rpc_pipe_bind_recv(req);
2626  fail:
2627         TALLOC_FREE(frame);
2628         return status;
2629 }
2630
2631 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
2632
2633 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
2634                                 unsigned int timeout)
2635 {
2636         unsigned int old;
2637
2638         if (rpc_cli->transport == NULL) {
2639                 return RPCCLI_DEFAULT_TIMEOUT;
2640         }
2641
2642         if (rpc_cli->transport->set_timeout == NULL) {
2643                 return RPCCLI_DEFAULT_TIMEOUT;
2644         }
2645
2646         old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
2647         if (old == 0) {
2648                 return RPCCLI_DEFAULT_TIMEOUT;
2649         }
2650
2651         return old;
2652 }
2653
2654 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
2655 {
2656         if (rpc_cli == NULL) {
2657                 return false;
2658         }
2659
2660         if (rpc_cli->transport == NULL) {
2661                 return false;
2662         }
2663
2664         return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
2665 }
2666
2667 bool rpccli_get_pwd_hash(struct rpc_pipe_client *rpc_cli, uint8_t nt_hash[16])
2668 {
2669         struct cli_state *cli;
2670
2671         if ((rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_NTLMSSP)
2672             || (rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP)) {
2673                 memcpy(nt_hash, auth_ntlmssp_get_nt_hash(rpc_cli->auth->a_u.auth_ntlmssp_state), 16);
2674                 return true;
2675         }
2676
2677         cli = rpc_pipe_np_smb_conn(rpc_cli);
2678         if (cli == NULL) {
2679                 return false;
2680         }
2681         E_md4hash(cli->password ? cli->password : "", nt_hash);
2682         return true;
2683 }
2684
2685 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2686                                struct pipe_auth_data **presult)
2687 {
2688         struct pipe_auth_data *result;
2689
2690         result = talloc(mem_ctx, struct pipe_auth_data);
2691         if (result == NULL) {
2692                 return NT_STATUS_NO_MEMORY;
2693         }
2694
2695         result->auth_type = PIPE_AUTH_TYPE_NONE;
2696         result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2697
2698         result->user_name = talloc_strdup(result, "");
2699         result->domain = talloc_strdup(result, "");
2700         if ((result->user_name == NULL) || (result->domain == NULL)) {
2701                 TALLOC_FREE(result);
2702                 return NT_STATUS_NO_MEMORY;
2703         }
2704
2705         *presult = result;
2706         return NT_STATUS_OK;
2707 }
2708
2709 static int cli_auth_ntlmssp_data_destructor(struct pipe_auth_data *auth)
2710 {
2711         TALLOC_FREE(auth->a_u.auth_ntlmssp_state);
2712         return 0;
2713 }
2714
2715 static NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
2716                                   enum pipe_auth_type auth_type,
2717                                   enum dcerpc_AuthLevel auth_level,
2718                                   const char *domain,
2719                                   const char *username,
2720                                   const char *password,
2721                                   struct pipe_auth_data **presult)
2722 {
2723         struct pipe_auth_data *result;
2724         NTSTATUS status;
2725
2726         result = talloc(mem_ctx, struct pipe_auth_data);
2727         if (result == NULL) {
2728                 return NT_STATUS_NO_MEMORY;
2729         }
2730
2731         result->auth_type = auth_type;
2732         result->auth_level = auth_level;
2733
2734         result->user_name = talloc_strdup(result, username);
2735         result->domain = talloc_strdup(result, domain);
2736         if ((result->user_name == NULL) || (result->domain == NULL)) {
2737                 status = NT_STATUS_NO_MEMORY;
2738                 goto fail;
2739         }
2740
2741         status = auth_ntlmssp_client_start(NULL,
2742                                       global_myname(),
2743                                       lp_workgroup(),
2744                                       lp_client_ntlmv2_auth(),
2745                                       &result->a_u.auth_ntlmssp_state);
2746         if (!NT_STATUS_IS_OK(status)) {
2747                 goto fail;
2748         }
2749
2750         talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
2751
2752         status = auth_ntlmssp_set_username(result->a_u.auth_ntlmssp_state,
2753                                            username);
2754         if (!NT_STATUS_IS_OK(status)) {
2755                 goto fail;
2756         }
2757
2758         status = auth_ntlmssp_set_domain(result->a_u.auth_ntlmssp_state,
2759                                          domain);
2760         if (!NT_STATUS_IS_OK(status)) {
2761                 goto fail;
2762         }
2763
2764         status = auth_ntlmssp_set_password(result->a_u.auth_ntlmssp_state,
2765                                            password);
2766         if (!NT_STATUS_IS_OK(status)) {
2767                 goto fail;
2768         }
2769
2770         /*
2771          * Turn off sign+seal to allow selected auth level to turn it back on.
2772          */
2773         auth_ntlmssp_and_flags(result->a_u.auth_ntlmssp_state,
2774                                                 ~(NTLMSSP_NEGOTIATE_SIGN |
2775                                                   NTLMSSP_NEGOTIATE_SEAL));
2776
2777         if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
2778                 auth_ntlmssp_or_flags(result->a_u.auth_ntlmssp_state,
2779                                                 NTLMSSP_NEGOTIATE_SIGN);
2780         } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
2781                 auth_ntlmssp_or_flags(result->a_u.auth_ntlmssp_state,
2782                                                 NTLMSSP_NEGOTIATE_SEAL |
2783                                                 NTLMSSP_NEGOTIATE_SIGN);
2784         }
2785
2786         *presult = result;
2787         return NT_STATUS_OK;
2788
2789  fail:
2790         TALLOC_FREE(result);
2791         return status;
2792 }
2793
2794 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
2795                                    enum dcerpc_AuthLevel auth_level,
2796                                    struct netlogon_creds_CredentialState *creds,
2797                                    struct pipe_auth_data **presult)
2798 {
2799         struct pipe_auth_data *result;
2800
2801         result = talloc(mem_ctx, struct pipe_auth_data);
2802         if (result == NULL) {
2803                 return NT_STATUS_NO_MEMORY;
2804         }
2805
2806         result->auth_type = PIPE_AUTH_TYPE_SCHANNEL;
2807         result->auth_level = auth_level;
2808
2809         result->user_name = talloc_strdup(result, "");
2810         result->domain = talloc_strdup(result, domain);
2811         if ((result->user_name == NULL) || (result->domain == NULL)) {
2812                 goto fail;
2813         }
2814
2815         result->a_u.schannel_auth = talloc(result, struct schannel_state);
2816         if (result->a_u.schannel_auth == NULL) {
2817                 goto fail;
2818         }
2819
2820         result->a_u.schannel_auth->state = SCHANNEL_STATE_START;
2821         result->a_u.schannel_auth->seq_num = 0;
2822         result->a_u.schannel_auth->initiator = true;
2823         result->a_u.schannel_auth->creds = creds;
2824
2825         *presult = result;
2826         return NT_STATUS_OK;
2827
2828  fail:
2829         TALLOC_FREE(result);
2830         return NT_STATUS_NO_MEMORY;
2831 }
2832
2833 #ifdef HAVE_KRB5
2834 static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
2835 {
2836         data_blob_free(&auth->session_key);
2837         return 0;
2838 }
2839 #endif
2840
2841 static NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
2842                                    enum dcerpc_AuthLevel auth_level,
2843                                    const char *service_princ,
2844                                    const char *username,
2845                                    const char *password,
2846                                    struct pipe_auth_data **presult)
2847 {
2848 #ifdef HAVE_KRB5
2849         struct pipe_auth_data *result;
2850
2851         if ((username != NULL) && (password != NULL)) {
2852                 int ret = kerberos_kinit_password(username, password, 0, NULL);
2853                 if (ret != 0) {
2854                         return NT_STATUS_ACCESS_DENIED;
2855                 }
2856         }
2857
2858         result = talloc(mem_ctx, struct pipe_auth_data);
2859         if (result == NULL) {
2860                 return NT_STATUS_NO_MEMORY;
2861         }
2862
2863         result->auth_type = PIPE_AUTH_TYPE_KRB5;
2864         result->auth_level = auth_level;
2865
2866         /*
2867          * Username / domain need fixing!
2868          */
2869         result->user_name = talloc_strdup(result, "");
2870         result->domain = talloc_strdup(result, "");
2871         if ((result->user_name == NULL) || (result->domain == NULL)) {
2872                 goto fail;
2873         }
2874
2875         result->a_u.kerberos_auth = TALLOC_ZERO_P(
2876                 result, struct kerberos_auth_struct);
2877         if (result->a_u.kerberos_auth == NULL) {
2878                 goto fail;
2879         }
2880         talloc_set_destructor(result->a_u.kerberos_auth,
2881                               cli_auth_kerberos_data_destructor);
2882
2883         result->a_u.kerberos_auth->service_principal = talloc_strdup(
2884                 result, service_princ);
2885         if (result->a_u.kerberos_auth->service_principal == NULL) {
2886                 goto fail;
2887         }
2888
2889         *presult = result;
2890         return NT_STATUS_OK;
2891
2892  fail:
2893         TALLOC_FREE(result);
2894         return NT_STATUS_NO_MEMORY;
2895 #else
2896         return NT_STATUS_NOT_SUPPORTED;
2897 #endif
2898 }
2899
2900 /**
2901  * Create an rpc pipe client struct, connecting to a tcp port.
2902  */
2903 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2904                                        uint16_t port,
2905                                        const struct ndr_syntax_id *abstract_syntax,
2906                                        struct rpc_pipe_client **presult)
2907 {
2908         struct rpc_pipe_client *result;
2909         struct sockaddr_storage addr;
2910         NTSTATUS status;
2911         int fd;
2912
2913         result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
2914         if (result == NULL) {
2915                 return NT_STATUS_NO_MEMORY;
2916         }
2917
2918         result->abstract_syntax = *abstract_syntax;
2919         result->transfer_syntax = ndr_transfer_syntax;
2920         result->dispatch = cli_do_rpc_ndr;
2921         result->dispatch_send = cli_do_rpc_ndr_send;
2922         result->dispatch_recv = cli_do_rpc_ndr_recv;
2923
2924         result->desthost = talloc_strdup(result, host);
2925         result->srv_name_slash = talloc_asprintf_strupper_m(
2926                 result, "\\\\%s", result->desthost);
2927         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2928                 status = NT_STATUS_NO_MEMORY;
2929                 goto fail;
2930         }
2931
2932         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2933         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2934
2935         if (!resolve_name(host, &addr, 0, false)) {
2936                 status = NT_STATUS_NOT_FOUND;
2937                 goto fail;
2938         }
2939
2940         status = open_socket_out(&addr, port, 60, &fd);
2941         if (!NT_STATUS_IS_OK(status)) {
2942                 goto fail;
2943         }
2944         set_socket_options(fd, lp_socket_options());
2945
2946         status = rpc_transport_sock_init(result, fd, &result->transport);
2947         if (!NT_STATUS_IS_OK(status)) {
2948                 close(fd);
2949                 goto fail;
2950         }
2951
2952         result->transport->transport = NCACN_IP_TCP;
2953
2954         *presult = result;
2955         return NT_STATUS_OK;
2956
2957  fail:
2958         TALLOC_FREE(result);
2959         return status;
2960 }
2961
2962 /**
2963  * Determine the tcp port on which a dcerpc interface is listening
2964  * for the ncacn_ip_tcp transport via the endpoint mapper of the
2965  * target host.
2966  */
2967 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2968                                       const struct ndr_syntax_id *abstract_syntax,
2969                                       uint16_t *pport)
2970 {
2971         NTSTATUS status;
2972         struct rpc_pipe_client *epm_pipe = NULL;
2973         struct pipe_auth_data *auth = NULL;
2974         struct dcerpc_binding *map_binding = NULL;
2975         struct dcerpc_binding *res_binding = NULL;
2976         struct epm_twr_t *map_tower = NULL;
2977         struct epm_twr_t *res_towers = NULL;
2978         struct policy_handle *entry_handle = NULL;
2979         uint32_t num_towers = 0;
2980         uint32_t max_towers = 1;
2981         struct epm_twr_p_t towers;
2982         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2983
2984         if (pport == NULL) {
2985                 status = NT_STATUS_INVALID_PARAMETER;
2986                 goto done;
2987         }
2988
2989         /* open the connection to the endpoint mapper */
2990         status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
2991                                         &ndr_table_epmapper.syntax_id,
2992                                         &epm_pipe);
2993
2994         if (!NT_STATUS_IS_OK(status)) {
2995                 goto done;
2996         }
2997
2998         status = rpccli_anon_bind_data(tmp_ctx, &auth);
2999         if (!NT_STATUS_IS_OK(status)) {
3000                 goto done;
3001         }
3002
3003         status = rpc_pipe_bind(epm_pipe, auth);
3004         if (!NT_STATUS_IS_OK(status)) {
3005                 goto done;
3006         }
3007
3008         /* create tower for asking the epmapper */
3009
3010         map_binding = TALLOC_ZERO_P(tmp_ctx, struct dcerpc_binding);
3011         if (map_binding == NULL) {
3012                 status = NT_STATUS_NO_MEMORY;
3013                 goto done;
3014         }
3015
3016         map_binding->transport = NCACN_IP_TCP;
3017         map_binding->object = *abstract_syntax;
3018         map_binding->host = host; /* needed? */
3019         map_binding->endpoint = "0"; /* correct? needed? */
3020
3021         map_tower = TALLOC_ZERO_P(tmp_ctx, struct epm_twr_t);
3022         if (map_tower == NULL) {
3023                 status = NT_STATUS_NO_MEMORY;
3024                 goto done;
3025         }
3026
3027         status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
3028                                             &(map_tower->tower));
3029         if (!NT_STATUS_IS_OK(status)) {
3030                 goto done;
3031         }
3032
3033         /* allocate further parameters for the epm_Map call */
3034
3035         res_towers = TALLOC_ARRAY(tmp_ctx, struct epm_twr_t, max_towers);
3036         if (res_towers == NULL) {
3037                 status = NT_STATUS_NO_MEMORY;
3038                 goto done;
3039         }
3040         towers.twr = res_towers;
3041
3042         entry_handle = TALLOC_ZERO_P(tmp_ctx, struct policy_handle);
3043         if (entry_handle == NULL) {
3044                 status = NT_STATUS_NO_MEMORY;
3045                 goto done;
3046         }
3047
3048         /* ask the endpoint mapper for the port */
3049
3050         status = rpccli_epm_Map(epm_pipe,
3051                                 tmp_ctx,
3052                                 CONST_DISCARD(struct GUID *,
3053                                               &(abstract_syntax->uuid)),
3054                                 map_tower,
3055                                 entry_handle,
3056                                 max_towers,
3057                                 &num_towers,
3058                                 &towers);
3059
3060         if (!NT_STATUS_IS_OK(status)) {
3061                 goto done;
3062         }
3063
3064         if (num_towers != 1) {
3065                 status = NT_STATUS_UNSUCCESSFUL;
3066                 goto done;
3067         }
3068
3069         /* extract the port from the answer */
3070
3071         status = dcerpc_binding_from_tower(tmp_ctx,
3072                                            &(towers.twr->tower),
3073                                            &res_binding);
3074         if (!NT_STATUS_IS_OK(status)) {
3075                 goto done;
3076         }
3077
3078         /* are further checks here necessary? */
3079         if (res_binding->transport != NCACN_IP_TCP) {
3080                 status = NT_STATUS_UNSUCCESSFUL;
3081                 goto done;
3082         }
3083
3084         *pport = (uint16_t)atoi(res_binding->endpoint);
3085
3086 done:
3087         TALLOC_FREE(tmp_ctx);
3088         return status;
3089 }
3090
3091 /**
3092  * Create a rpc pipe client struct, connecting to a host via tcp.
3093  * The port is determined by asking the endpoint mapper on the given
3094  * host.
3095  */
3096 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
3097                            const struct ndr_syntax_id *abstract_syntax,
3098                            struct rpc_pipe_client **presult)
3099 {
3100         NTSTATUS status;
3101         uint16_t port = 0;
3102
3103         status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
3104         if (!NT_STATUS_IS_OK(status)) {
3105                 return status;
3106         }
3107
3108         return rpc_pipe_open_tcp_port(mem_ctx, host, port,
3109                                         abstract_syntax, presult);
3110 }
3111
3112 /********************************************************************
3113  Create a rpc pipe client struct, connecting to a unix domain socket
3114  ********************************************************************/
3115 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
3116                                const struct ndr_syntax_id *abstract_syntax,
3117                                struct rpc_pipe_client **presult)
3118 {
3119         struct rpc_pipe_client *result;
3120         struct sockaddr_un addr;
3121         NTSTATUS status;
3122         int fd;
3123
3124         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
3125         if (result == NULL) {
3126                 return NT_STATUS_NO_MEMORY;
3127         }
3128
3129         result->abstract_syntax = *abstract_syntax;
3130         result->transfer_syntax = ndr_transfer_syntax;
3131         result->dispatch = cli_do_rpc_ndr;
3132         result->dispatch_send = cli_do_rpc_ndr_send;
3133         result->dispatch_recv = cli_do_rpc_ndr_recv;
3134
3135         result->desthost = get_myname(result);
3136         result->srv_name_slash = talloc_asprintf_strupper_m(
3137                 result, "\\\\%s", result->desthost);
3138         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3139                 status = NT_STATUS_NO_MEMORY;
3140                 goto fail;
3141         }
3142
3143         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3144         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3145
3146         fd = socket(AF_UNIX, SOCK_STREAM, 0);
3147         if (fd == -1) {
3148                 status = map_nt_error_from_unix(errno);
3149                 goto fail;
3150         }
3151
3152         ZERO_STRUCT(addr);
3153         addr.sun_family = AF_UNIX;
3154         strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
3155
3156         if (sys_connect(fd, (struct sockaddr *)(void *)&addr) == -1) {
3157                 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
3158                           strerror(errno)));
3159                 close(fd);
3160                 return map_nt_error_from_unix(errno);
3161         }
3162
3163         status = rpc_transport_sock_init(result, fd, &result->transport);
3164         if (!NT_STATUS_IS_OK(status)) {
3165                 close(fd);
3166                 goto fail;
3167         }
3168
3169         result->transport->transport = NCALRPC;
3170
3171         *presult = result;
3172         return NT_STATUS_OK;
3173
3174  fail:
3175         TALLOC_FREE(result);
3176         return status;
3177 }
3178
3179 struct rpc_pipe_client_np_ref {
3180         struct cli_state *cli;
3181         struct rpc_pipe_client *pipe;
3182 };
3183
3184 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
3185 {
3186         DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
3187         return 0;
3188 }
3189
3190 /****************************************************************************
3191  Open a named pipe over SMB to a remote server.
3192  *
3193  * CAVEAT CALLER OF THIS FUNCTION:
3194  *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
3195  *    so be sure that this function is called AFTER any structure (vs pointer)
3196  *    assignment of the cli.  In particular, libsmbclient does structure
3197  *    assignments of cli, which invalidates the data in the returned
3198  *    rpc_pipe_client if this function is called before the structure assignment
3199  *    of cli.
3200  *
3201  ****************************************************************************/
3202
3203 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
3204                                  const struct ndr_syntax_id *abstract_syntax,
3205                                  struct rpc_pipe_client **presult)
3206 {
3207         struct rpc_pipe_client *result;
3208         NTSTATUS status;
3209         struct rpc_pipe_client_np_ref *np_ref;
3210
3211         /* sanity check to protect against crashes */
3212
3213         if ( !cli ) {
3214                 return NT_STATUS_INVALID_HANDLE;
3215         }
3216
3217         result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
3218         if (result == NULL) {
3219                 return NT_STATUS_NO_MEMORY;
3220         }
3221
3222         result->abstract_syntax = *abstract_syntax;
3223         result->transfer_syntax = ndr_transfer_syntax;
3224         result->dispatch = cli_do_rpc_ndr;
3225         result->dispatch_send = cli_do_rpc_ndr_send;
3226         result->dispatch_recv = cli_do_rpc_ndr_recv;
3227         result->desthost = talloc_strdup(result, cli->desthost);
3228         result->srv_name_slash = talloc_asprintf_strupper_m(
3229                 result, "\\\\%s", result->desthost);
3230
3231         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3232         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3233
3234         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3235                 TALLOC_FREE(result);
3236                 return NT_STATUS_NO_MEMORY;
3237         }
3238
3239         status = rpc_transport_np_init(result, cli, abstract_syntax,
3240                                        &result->transport);
3241         if (!NT_STATUS_IS_OK(status)) {
3242                 TALLOC_FREE(result);
3243                 return status;
3244         }
3245
3246         result->transport->transport = NCACN_NP;
3247
3248         np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
3249         if (np_ref == NULL) {
3250                 TALLOC_FREE(result);
3251                 return NT_STATUS_NO_MEMORY;
3252         }
3253         np_ref->cli = cli;
3254         np_ref->pipe = result;
3255
3256         DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
3257         talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
3258
3259         *presult = result;
3260         return NT_STATUS_OK;
3261 }
3262
3263 NTSTATUS rpc_pipe_open_local(TALLOC_CTX *mem_ctx,
3264                              struct rpc_cli_smbd_conn *conn,
3265                              const struct ndr_syntax_id *syntax,
3266                              struct rpc_pipe_client **presult)
3267 {
3268         struct rpc_pipe_client *result;
3269         struct pipe_auth_data *auth;
3270         NTSTATUS status;
3271
3272         result = talloc(mem_ctx, struct rpc_pipe_client);
3273         if (result == NULL) {
3274                 return NT_STATUS_NO_MEMORY;
3275         }
3276         result->abstract_syntax = *syntax;
3277         result->transfer_syntax = ndr_transfer_syntax;
3278         result->dispatch = cli_do_rpc_ndr;
3279         result->dispatch_send = cli_do_rpc_ndr_send;
3280         result->dispatch_recv = cli_do_rpc_ndr_recv;
3281         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3282         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3283
3284         result->desthost = talloc_strdup(result, global_myname());
3285         result->srv_name_slash = talloc_asprintf_strupper_m(
3286                 result, "\\\\%s", global_myname());
3287         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3288                 TALLOC_FREE(result);
3289                 return NT_STATUS_NO_MEMORY;
3290         }
3291
3292         status = rpc_transport_smbd_init(result, conn, syntax,
3293                                          &result->transport);
3294         if (!NT_STATUS_IS_OK(status)) {
3295                 DEBUG(1, ("rpc_transport_smbd_init failed: %s\n",
3296                           nt_errstr(status)));
3297                 TALLOC_FREE(result);
3298                 return status;
3299         }
3300
3301         status = rpccli_anon_bind_data(result, &auth);
3302         if (!NT_STATUS_IS_OK(status)) {
3303                 DEBUG(1, ("rpccli_anon_bind_data failed: %s\n",
3304                           nt_errstr(status)));
3305                 TALLOC_FREE(result);
3306                 return status;
3307         }
3308
3309         status = rpc_pipe_bind(result, auth);
3310         if (!NT_STATUS_IS_OK(status)) {
3311                 DEBUG(1, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
3312                 TALLOC_FREE(result);
3313                 return status;
3314         }
3315
3316         result->transport->transport = NCACN_INTERNAL;
3317
3318         *presult = result;
3319         return NT_STATUS_OK;
3320 }
3321
3322 /****************************************************************************
3323  Open a pipe to a remote server.
3324  ****************************************************************************/
3325
3326 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3327                                   enum dcerpc_transport_t transport,
3328                                   const struct ndr_syntax_id *interface,
3329                                   struct rpc_pipe_client **presult)
3330 {
3331         switch (transport) {
3332         case NCACN_IP_TCP:
3333                 return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
3334                                          presult);
3335         case NCACN_NP:
3336                 return rpc_pipe_open_np(cli, interface, presult);
3337         default:
3338                 return NT_STATUS_NOT_IMPLEMENTED;
3339         }
3340 }
3341
3342 /****************************************************************************
3343  Open a named pipe to an SMB server and bind anonymously.
3344  ****************************************************************************/
3345
3346 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
3347                                             enum dcerpc_transport_t transport,
3348                                             const struct ndr_syntax_id *interface,
3349                                             struct rpc_pipe_client **presult)
3350 {
3351         struct rpc_pipe_client *result;
3352         struct pipe_auth_data *auth;
3353         NTSTATUS status;
3354
3355         status = cli_rpc_pipe_open(cli, transport, interface, &result);
3356         if (!NT_STATUS_IS_OK(status)) {
3357                 return status;
3358         }
3359
3360         status = rpccli_anon_bind_data(result, &auth);
3361         if (!NT_STATUS_IS_OK(status)) {
3362                 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3363                           nt_errstr(status)));
3364                 TALLOC_FREE(result);
3365                 return status;
3366         }
3367
3368         /*
3369          * This is a bit of an abstraction violation due to the fact that an
3370          * anonymous bind on an authenticated SMB inherits the user/domain
3371          * from the enclosing SMB creds
3372          */
3373
3374         TALLOC_FREE(auth->user_name);
3375         TALLOC_FREE(auth->domain);
3376
3377         auth->user_name = talloc_strdup(auth, cli->user_name);
3378         auth->domain = talloc_strdup(auth, cli->domain);
3379         auth->user_session_key = data_blob_talloc(auth,
3380                 cli->user_session_key.data,
3381                 cli->user_session_key.length);
3382
3383         if ((auth->user_name == NULL) || (auth->domain == NULL)) {
3384                 TALLOC_FREE(result);
3385                 return NT_STATUS_NO_MEMORY;
3386         }
3387
3388         status = rpc_pipe_bind(result, auth);
3389         if (!NT_STATUS_IS_OK(status)) {
3390                 int lvl = 0;
3391                 if (ndr_syntax_id_equal(interface,
3392                                         &ndr_table_dssetup.syntax_id)) {
3393                         /* non AD domains just don't have this pipe, avoid
3394                          * level 0 statement in that case - gd */
3395                         lvl = 3;
3396                 }
3397                 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3398                             "%s failed with error %s\n",
3399                             get_pipe_name_from_syntax(talloc_tos(), interface),
3400                             nt_errstr(status) ));
3401                 TALLOC_FREE(result);
3402                 return status;
3403         }
3404
3405         DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3406                   "%s and bound anonymously.\n",
3407                   get_pipe_name_from_syntax(talloc_tos(), interface),
3408                   cli->desthost));
3409
3410         *presult = result;
3411         return NT_STATUS_OK;
3412 }
3413
3414 /****************************************************************************
3415  ****************************************************************************/
3416
3417 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3418                                   const struct ndr_syntax_id *interface,
3419                                   struct rpc_pipe_client **presult)
3420 {
3421         return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
3422                                                   interface, presult);
3423 }
3424
3425 /****************************************************************************
3426  Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
3427  ****************************************************************************/
3428
3429 static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
3430                                                    const struct ndr_syntax_id *interface,
3431                                                    enum dcerpc_transport_t transport,
3432                                                    enum pipe_auth_type auth_type,
3433                                                    enum dcerpc_AuthLevel auth_level,
3434                                                    const char *domain,
3435                                                    const char *username,
3436                                                    const char *password,
3437                                                    struct rpc_pipe_client **presult)
3438 {
3439         struct rpc_pipe_client *result;
3440         struct pipe_auth_data *auth;
3441         NTSTATUS status;
3442
3443         status = cli_rpc_pipe_open(cli, transport, interface, &result);
3444         if (!NT_STATUS_IS_OK(status)) {
3445                 return status;
3446         }
3447
3448         status = rpccli_ntlmssp_bind_data(
3449                 result, auth_type, auth_level, domain, username,
3450                 password, &auth);
3451         if (!NT_STATUS_IS_OK(status)) {
3452                 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
3453                           nt_errstr(status)));
3454                 goto err;
3455         }
3456
3457         status = rpc_pipe_bind(result, auth);
3458         if (!NT_STATUS_IS_OK(status)) {
3459                 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
3460                         nt_errstr(status) ));
3461                 goto err;
3462         }
3463
3464         DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
3465                 "machine %s and bound NTLMSSP as user %s\\%s.\n",
3466                   get_pipe_name_from_syntax(talloc_tos(), interface),
3467                   cli->desthost, domain, username ));
3468
3469         *presult = result;
3470         return NT_STATUS_OK;
3471
3472   err:
3473
3474         TALLOC_FREE(result);
3475         return status;
3476 }
3477
3478 /****************************************************************************
3479  External interface.
3480  Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
3481  ****************************************************************************/
3482
3483 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
3484                                    const struct ndr_syntax_id *interface,
3485                                    enum dcerpc_transport_t transport,
3486                                    enum dcerpc_AuthLevel auth_level,
3487                                    const char *domain,
3488                                    const char *username,
3489                                    const char *password,
3490                                    struct rpc_pipe_client **presult)
3491 {
3492         return cli_rpc_pipe_open_ntlmssp_internal(cli,
3493                                                 interface,
3494                                                 transport,
3495                                                 PIPE_AUTH_TYPE_NTLMSSP,
3496                                                 auth_level,
3497                                                 domain,
3498                                                 username,
3499                                                 password,
3500                                                 presult);
3501 }
3502
3503 /****************************************************************************
3504  External interface.
3505  Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
3506  ****************************************************************************/
3507
3508 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
3509                                           const struct ndr_syntax_id *interface,
3510                                           enum dcerpc_transport_t transport,
3511                                           enum dcerpc_AuthLevel auth_level,
3512                                           const char *domain,
3513                                           const char *username,
3514                                           const char *password,
3515                                           struct rpc_pipe_client **presult)
3516 {
3517         return cli_rpc_pipe_open_ntlmssp_internal(cli,
3518                                                 interface,
3519                                                 transport,
3520                                                 PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
3521                                                 auth_level,
3522                                                 domain,
3523                                                 username,
3524                                                 password,
3525                                                 presult);
3526 }
3527
3528 /****************************************************************************
3529   Get a the schannel session key out of an already opened netlogon pipe.
3530  ****************************************************************************/
3531 static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
3532                                                 struct cli_state *cli,
3533                                                 const char *domain,
3534                                                 uint32 *pneg_flags)
3535 {
3536         enum netr_SchannelType sec_chan_type = 0;
3537         unsigned char machine_pwd[16];
3538         const char *machine_account;
3539         NTSTATUS status;
3540
3541         /* Get the machine account credentials from secrets.tdb. */
3542         if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
3543                                &sec_chan_type))
3544         {
3545                 DEBUG(0, ("get_schannel_session_key: could not fetch "
3546                         "trust account password for domain '%s'\n",
3547                         domain));
3548                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3549         }
3550
3551         status = rpccli_netlogon_setup_creds(netlogon_pipe,
3552                                         cli->desthost, /* server name */
3553                                         domain,        /* domain */
3554                                         global_myname(), /* client name */
3555                                         machine_account, /* machine account name */
3556                                         machine_pwd,
3557                                         sec_chan_type,
3558                                         pneg_flags);
3559
3560         if (!NT_STATUS_IS_OK(status)) {
3561                 DEBUG(3, ("get_schannel_session_key_common: "
3562                           "rpccli_netlogon_setup_creds failed with result %s "
3563                           "to server %s, domain %s, machine account %s.\n",
3564                           nt_errstr(status), cli->desthost, domain,
3565                           machine_account ));
3566                 return status;
3567         }
3568
3569         if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
3570                 DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
3571                         cli->desthost));
3572                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3573         }
3574
3575         return NT_STATUS_OK;;
3576 }
3577
3578 /****************************************************************************
3579  Open a netlogon pipe and get the schannel session key.
3580  Now exposed to external callers.
3581  ****************************************************************************/
3582
3583
3584 NTSTATUS get_schannel_session_key(struct cli_state *cli,
3585                                   const char *domain,
3586                                   uint32 *pneg_flags,
3587                                   struct rpc_pipe_client **presult)
3588 {
3589         struct rpc_pipe_client *netlogon_pipe = NULL;
3590         NTSTATUS status;
3591
3592         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
3593                                           &netlogon_pipe);
3594         if (!NT_STATUS_IS_OK(status)) {
3595                 return status;
3596         }
3597
3598         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3599                                                  pneg_flags);
3600         if (!NT_STATUS_IS_OK(status)) {
3601                 TALLOC_FREE(netlogon_pipe);
3602                 return status;
3603         }
3604
3605         *presult = netlogon_pipe;
3606         return NT_STATUS_OK;
3607 }
3608
3609 /****************************************************************************
3610  External interface.
3611  Open a named pipe to an SMB server and bind using schannel (bind type 68)
3612  using session_key. sign and seal.
3613
3614  The *pdc will be stolen onto this new pipe
3615  ****************************************************************************/
3616
3617 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
3618                                              const struct ndr_syntax_id *interface,
3619                                              enum dcerpc_transport_t transport,
3620                                              enum dcerpc_AuthLevel auth_level,
3621                                              const char *domain,
3622                                              struct netlogon_creds_CredentialState **pdc,
3623                                              struct rpc_pipe_client **presult)
3624 {
3625         struct rpc_pipe_client *result;
3626         struct pipe_auth_data *auth;
3627         NTSTATUS status;
3628
3629         status = cli_rpc_pipe_open(cli, transport, interface, &result);
3630         if (!NT_STATUS_IS_OK(status)) {
3631                 return status;
3632         }
3633
3634         status = rpccli_schannel_bind_data(result, domain, auth_level,
3635                                            *pdc, &auth);
3636         if (!NT_STATUS_IS_OK(status)) {
3637                 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3638                           nt_errstr(status)));
3639                 TALLOC_FREE(result);
3640                 return status;
3641         }
3642
3643         status = rpc_pipe_bind(result, auth);
3644         if (!NT_STATUS_IS_OK(status)) {
3645                 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
3646                           "cli_rpc_pipe_bind failed with error %s\n",
3647                           nt_errstr(status) ));
3648                 TALLOC_FREE(result);
3649                 return status;
3650         }
3651
3652         /*
3653          * The credentials on a new netlogon pipe are the ones we are passed
3654          * in - reference them in
3655          */
3656         result->dc = talloc_move(result, pdc);
3657
3658         DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
3659                   "for domain %s and bound using schannel.\n",
3660                   get_pipe_name_from_syntax(talloc_tos(), interface),
3661                   cli->desthost, domain ));
3662
3663         *presult = result;
3664         return NT_STATUS_OK;
3665 }
3666
3667 /****************************************************************************
3668  Open a named pipe to an SMB server and bind using schannel (bind type 68).
3669  Fetch the session key ourselves using a temporary netlogon pipe. This
3670  version uses an ntlmssp auth bound netlogon pipe to get the key.
3671  ****************************************************************************/
3672
3673 static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
3674                                                       const char *domain,
3675                                                       const char *username,
3676                                                       const char *password,
3677                                                       uint32 *pneg_flags,
3678                                                       struct rpc_pipe_client **presult)
3679 {
3680         struct rpc_pipe_client *netlogon_pipe = NULL;
3681         NTSTATUS status;
3682
3683         status = cli_rpc_pipe_open_spnego_ntlmssp(
3684                 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
3685                 DCERPC_AUTH_LEVEL_PRIVACY,
3686                 domain, username, password, &netlogon_pipe);
3687         if (!NT_STATUS_IS_OK(status)) {
3688                 return status;
3689         }
3690
3691         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3692                                                  pneg_flags);
3693         if (!NT_STATUS_IS_OK(status)) {
3694                 TALLOC_FREE(netlogon_pipe);
3695                 return status;
3696         }
3697
3698         *presult = netlogon_pipe;
3699         return NT_STATUS_OK;
3700 }
3701
3702 /****************************************************************************
3703  Open a named pipe to an SMB server and bind using schannel (bind type 68).
3704  Fetch the session key ourselves using a temporary netlogon pipe. This version
3705  uses an ntlmssp bind to get the session key.
3706  ****************************************************************************/
3707
3708 NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
3709                                                  const struct ndr_syntax_id *interface,
3710                                                  enum dcerpc_transport_t transport,
3711                                                  enum dcerpc_AuthLevel auth_level,
3712                                                  const char *domain,
3713                                                  const char *username,
3714                                                  const char *password,
3715                                                  struct rpc_pipe_client **presult)
3716 {
3717         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
3718         struct rpc_pipe_client *netlogon_pipe = NULL;
3719         struct rpc_pipe_client *result = NULL;
3720         NTSTATUS status;
3721
3722         status = get_schannel_session_key_auth_ntlmssp(
3723                 cli, domain, username, password, &neg_flags, &netlogon_pipe);
3724         if (!NT_STATUS_IS_OK(status)) {
3725                 DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
3726                         "key from server %s for domain %s.\n",
3727                         cli->desthost, domain ));
3728                 return status;
3729         }
3730
3731         status = cli_rpc_pipe_open_schannel_with_key(
3732                 cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
3733                 &result);
3734
3735         /* Now we've bound using the session key we can close the netlog pipe. */
3736         TALLOC_FREE(netlogon_pipe);
3737
3738         if (NT_STATUS_IS_OK(status)) {
3739                 *presult = result;
3740         }
3741         return status;
3742 }
3743
3744 /****************************************************************************
3745  Open a named pipe to an SMB server and bind using schannel (bind type 68).
3746  Fetch the session key ourselves using a temporary netlogon pipe.
3747  ****************************************************************************/
3748
3749 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
3750                                     const struct ndr_syntax_id *interface,
3751                                     enum dcerpc_transport_t transport,
3752                                     enum dcerpc_AuthLevel auth_level,
3753                                     const char *domain,
3754                                     struct rpc_pipe_client **presult)
3755 {
3756         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
3757         struct rpc_pipe_client *netlogon_pipe = NULL;
3758         struct rpc_pipe_client *result = NULL;
3759         NTSTATUS status;
3760
3761         status = get_schannel_session_key(cli, domain, &neg_flags,
3762                                           &netlogon_pipe);
3763         if (!NT_STATUS_IS_OK(status)) {
3764                 DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
3765                         "key from server %s for domain %s.\n",
3766                         cli->desthost, domain ));
3767                 return status;
3768         }
3769
3770         status = cli_rpc_pipe_open_schannel_with_key(
3771                 cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
3772                 &result);
3773
3774         /* Now we've bound using the session key we can close the netlog pipe. */
3775         TALLOC_FREE(netlogon_pipe);
3776
3777         if (NT_STATUS_IS_OK(status)) {
3778                 *presult = result;
3779         }
3780
3781         return status;
3782 }
3783
3784 /****************************************************************************
3785  Open a named pipe to an SMB server and bind using krb5 (bind type 16).
3786  The idea is this can be called with service_princ, username and password all
3787  NULL so long as the caller has a TGT.
3788  ****************************************************************************/
3789
3790 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
3791                                 const struct ndr_syntax_id *interface,
3792                                 enum dcerpc_AuthLevel auth_level,
3793                                 const char *service_princ,
3794                                 const char *username,
3795                                 const char *password,
3796                                 struct rpc_pipe_client **presult)
3797 {
3798 #ifdef HAVE_KRB5
3799         struct rpc_pipe_client *result;
3800         struct pipe_auth_data *auth;
3801         NTSTATUS status;
3802
3803         status = cli_rpc_pipe_open(cli, NCACN_NP, interface, &result);
3804         if (!NT_STATUS_IS_OK(status)) {
3805                 return status;
3806         }
3807
3808         status = rpccli_kerberos_bind_data(result, auth_level, service_princ,
3809                                            username, password, &auth);
3810         if (!NT_STATUS_IS_OK(status)) {
3811                 DEBUG(0, ("rpccli_kerberos_bind_data returned %s\n",
3812                           nt_errstr(status)));
3813                 TALLOC_FREE(result);
3814                 return status;
3815         }
3816
3817         status = rpc_pipe_bind(result, auth);
3818         if (!NT_STATUS_IS_OK(status)) {
3819                 DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
3820                           "with error %s\n", nt_errstr(status)));
3821                 TALLOC_FREE(result);
3822                 return status;
3823         }
3824
3825         *presult = result;
3826         return NT_STATUS_OK;
3827 #else
3828         DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
3829         return NT_STATUS_NOT_IMPLEMENTED;
3830 #endif
3831 }
3832
3833 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3834                              struct rpc_pipe_client *cli,
3835                              DATA_BLOB *session_key)
3836 {
3837         DATA_BLOB sk;
3838
3839         if (!session_key || !cli) {
3840                 return NT_STATUS_INVALID_PARAMETER;
3841         }
3842
3843         if (!cli->auth) {
3844                 return NT_STATUS_INVALID_PARAMETER;
3845         }
3846
3847         switch (cli->auth->auth_type) {
3848                 case PIPE_AUTH_TYPE_SCHANNEL:
3849                         *session_key = data_blob_talloc(mem_ctx,
3850                                 cli->auth->a_u.schannel_auth->creds->session_key, 16);
3851                         break;
3852                 case PIPE_AUTH_TYPE_NTLMSSP:
3853                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
3854                         sk = auth_ntlmssp_get_session_key(cli->auth->a_u.auth_ntlmssp_state);
3855                         *session_key = data_blob_dup_talloc(mem_ctx, &sk);
3856                         break;
3857                 case PIPE_AUTH_TYPE_KRB5:
3858                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
3859                         *session_key = data_blob_talloc(mem_ctx,
3860                                 cli->auth->a_u.kerberos_auth->session_key.data,
3861                                 cli->auth->a_u.kerberos_auth->session_key.length);
3862                         break;
3863                 case PIPE_AUTH_TYPE_NONE:
3864                         *session_key = data_blob_talloc(mem_ctx,
3865                                 cli->auth->user_session_key.data,
3866                                 cli->auth->user_session_key.length);
3867                         break;
3868                 default:
3869                         return NT_STATUS_NO_USER_SESSION_KEY;
3870         }
3871
3872         return NT_STATUS_OK;
3873 }