r5976: SIDs can't have more then 5 subauths (caught by [validate] and
[samba.git] / source4 / librpc / rpc / dcerpc_util.c
index 8b974df0fdc163afe459077acfc810428a6116d2..88b1c54cefd803f72de72330ca0299cd027ce7bb 100644 (file)
@@ -164,8 +164,11 @@ static const struct {
        { "ncadg_ipx", NCADG_IPX, 2,
                { EPM_PROTOCOL_NCADG, EPM_PROTOCOL_IPX },
        },
-       { "ncacn_spx", NCACN_SPX, 2,
-               { EPM_PROTOCOL_NCACN, EPM_PROTOCOL_SPX },
+       { "ncacn_spx", NCACN_SPX, 3,
+               /* I guess some MS programmer confused the identifier for 
+                * EPM_PROTOCOL_UUID (0x0D or 13) with the one for 
+                * EPM_PROTOCOL_SPX (0x13) here. -- jelmer*/
+               { EPM_PROTOCOL_NCACN, EPM_PROTOCOL_NCALRPC, EPM_PROTOCOL_UUID },
        },
 };
 
@@ -177,12 +180,87 @@ static const struct {
        {"seal", DCERPC_SEAL},
        {"connect", DCERPC_CONNECT},
        {"spnego", DCERPC_AUTH_SPNEGO},
+       {"krb5", DCERPC_AUTH_KRB5},
        {"validate", DCERPC_DEBUG_VALIDATE_BOTH},
        {"print", DCERPC_DEBUG_PRINT_BOTH},
        {"padcheck", DCERPC_DEBUG_PAD_CHECK},
        {"bigendian", DCERPC_PUSH_BIGENDIAN}
 };
 
+const char *epm_floor_string(TALLOC_CTX *mem_ctx, struct epm_floor *fl)
+{
+       struct GUID uuid;
+       uint16_t if_version;
+       NTSTATUS status;
+
+       switch(fl->lhs.protocol) {
+               case EPM_PROTOCOL_UUID:
+                       status = dcerpc_floor_get_lhs_data(fl, &uuid, &if_version);
+                       if (NT_STATUS_IS_OK(status)) {
+                               /* lhs is used: UUID */
+                               char *uuidstr;
+
+                               uuidstr = GUID_string(mem_ctx, &uuid);
+
+                               if (strcasecmp(uuidstr, NDR_GUID) == 0) {
+                                       return "NDR";
+                               } 
+
+                               return talloc_asprintf(mem_ctx, " uuid %s/0x%02x", uuidstr, if_version);
+                       } else { /* IPX */
+                               return talloc_asprintf(mem_ctx, "IPX:%s", 
+                                               data_blob_hex_string(mem_ctx, &fl->rhs.uuid.unknown));
+                       }
+
+               case EPM_PROTOCOL_NCACN:
+                       return "RPC-C";
+
+               case EPM_PROTOCOL_NCADG:
+                       return "RPC";
+
+               case EPM_PROTOCOL_NCALRPC:
+                       return "NCALRPC";
+
+               case EPM_PROTOCOL_DNET_NSP:
+                       return "DNET/NSP";
+
+               case EPM_PROTOCOL_IP:
+                       return talloc_asprintf(mem_ctx, "IP:%s", fl->rhs.ip.ipaddr);
+
+               case EPM_PROTOCOL_PIPE:
+                       return talloc_asprintf(mem_ctx, "PIPE:%s", fl->rhs.pipe.path);
+
+               case EPM_PROTOCOL_SMB:
+                       return talloc_asprintf(mem_ctx, "SMB:%s", fl->rhs.smb.unc);
+
+               case EPM_PROTOCOL_UNIX_DS:
+                       return talloc_asprintf(mem_ctx, "Unix:%s", fl->rhs.unix_ds.path);
+
+               case EPM_PROTOCOL_NETBIOS:
+                       return talloc_asprintf(mem_ctx, "NetBIOS:%s", fl->rhs.netbios.name);
+
+               case EPM_PROTOCOL_NETBEUI:
+                       return "NETBeui";
+
+               case EPM_PROTOCOL_SPX:
+                       return "SPX";
+
+               case EPM_PROTOCOL_NB_IPX:
+                       return "NB_IPX";
+
+               case EPM_PROTOCOL_HTTP:
+                       return talloc_asprintf(mem_ctx, "HTTP:%d", fl->rhs.http.port);
+
+               case EPM_PROTOCOL_TCP:
+                       return talloc_asprintf(mem_ctx, "TCP:%d", fl->rhs.tcp.port);
+
+               case EPM_PROTOCOL_UDP:
+                       return talloc_asprintf(mem_ctx, "UDP:%d", fl->rhs.udp.port);
+
+               default:
+                       return talloc_asprintf(mem_ctx, "UNK(%02x):", fl->lhs.protocol);
+       }
+}
 
 
 /*
@@ -248,12 +326,20 @@ const char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_bindi
 /*
   parse a binding string into a dcerpc_binding structure
 */
-NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding *b)
+NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding **b_out)
 {
+       struct dcerpc_binding *b;
        char *options, *type;
        char *p;
        int i, j, comma_count;
 
+       b = talloc(mem_ctx, struct dcerpc_binding);
+       if (!b) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       b->authservice = NULL;
+
        p = strchr(s, '@');
 
        if (p && PTR_DIFF(p, s) == 36) { /* 36 is the length of a UUID */
@@ -298,14 +384,14 @@ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_
 
        p = strchr(s, '[');
        if (p) {
-               b->host = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
+               b->host = talloc_strndup(b, s, PTR_DIFF(p, s));
                options = talloc_strdup(mem_ctx, p+1);
                if (options[strlen(options)-1] != ']') {
                        return NT_STATUS_INVALID_PARAMETER;
                }
                options[strlen(options)-1] = 0;
        } else {
-               b->host = talloc_strdup(mem_ctx, s);
+               b->host = talloc_strdup(b, s);
                options = NULL;
        }
 
@@ -318,18 +404,19 @@ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_
        b->endpoint = NULL;
 
        if (!options) {
+               *b_out = b;
                return NT_STATUS_OK;
        }
 
        comma_count = count_chars(options, ',');
 
-       b->options = talloc_array_p(mem_ctx, const char *, comma_count+2);
+       b->options = talloc_array(b, const char *, comma_count+2);
        if (!b->options) {
                return NT_STATUS_NO_MEMORY;
        }
 
        for (i=0; (p = strchr(options, ',')); i++) {
-               b->options[i] = talloc_strndup(mem_ctx, options, PTR_DIFF(p, options));
+               b->options[i] = talloc_strndup(b, options, PTR_DIFF(p, options));
                if (!b->options[i]) {
                        return NT_STATUS_NO_MEMORY;
                }
@@ -366,9 +453,43 @@ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_
        if (b->options[0] == NULL)
                b->options = NULL;
        
+       *b_out = b;
        return NT_STATUS_OK;
 }
 
+NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *floor, struct GUID *uuid, uint16_t *if_version)
+{
+       TALLOC_CTX *mem_ctx = talloc_init("floor_get_lhs_data");
+       struct ndr_pull *ndr = ndr_pull_init_blob(&floor->lhs.lhs_data, mem_ctx);
+       NTSTATUS status;
+       
+       ndr->flags |= LIBNDR_FLAG_NOALIGN;
+
+       status = ndr_pull_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, uuid);
+       if (NT_STATUS_IS_ERR(status)) {
+               talloc_free(mem_ctx);
+               return status;
+       }
+
+       status = ndr_pull_uint16(ndr, NDR_SCALARS, if_version);
+
+       talloc_free(mem_ctx);
+
+       return status;
+}
+
+DATA_BLOB dcerpc_floor_pack_lhs_data(TALLOC_CTX *mem_ctx, struct GUID *uuid, uint32_t if_version)
+{
+       struct ndr_push *ndr = ndr_push_init_ctx(mem_ctx);
+
+       ndr->flags |= LIBNDR_FLAG_NOALIGN;
+
+       ndr_push_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, uuid);
+       ndr_push_uint16(ndr, NDR_SCALARS, if_version);
+
+       return ndr_push_blob(ndr);
+}
+
 const char *dcerpc_floor_get_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *floor)
 {
        switch (floor->lhs.protocol) {
@@ -385,15 +506,7 @@ const char *dcerpc_floor_get_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *flo
                return talloc_asprintf(mem_ctx, "%d", floor->rhs.http.port);
 
        case EPM_PROTOCOL_IP:
-               if (floor->rhs.ip.address == 0) {
-                       return NULL; 
-               }
-
-               {
-                       struct ipv4_addr in;
-                       in.addr = htonl(floor->rhs.ip.address);
-                       return talloc_strdup(mem_ctx, sys_inet_ntoa(in));
-               }
+               return talloc_strdup(mem_ctx, floor->rhs.ip.ipaddr);
 
        case EPM_PROTOCOL_NCACN:
                return NULL;
@@ -456,11 +569,8 @@ static NTSTATUS dcerpc_floor_set_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor
                return NT_STATUS_OK;
 
        case EPM_PROTOCOL_IP:
-               if (strlen(data) > 0) {
-                       floor->rhs.ip.address = ntohl(interpret_addr(data));
-               } else {
-                       floor->rhs.ip.address = 0;
-               }
+               floor->rhs.ip.ipaddr = talloc_strdup(mem_ctx, data);
+               NT_STATUS_HAVE_NO_MEMORY(floor->rhs.ip.ipaddr);
                return NT_STATUS_OK;
 
        case EPM_PROTOCOL_NCACN:
@@ -473,23 +583,17 @@ static NTSTATUS dcerpc_floor_set_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor
 
        case EPM_PROTOCOL_SMB:
                floor->rhs.smb.unc = talloc_strdup(mem_ctx, data);
-               if (!floor->rhs.smb.unc) {
-                       return NT_STATUS_NO_MEMORY;
-               }
+               NT_STATUS_HAVE_NO_MEMORY(floor->rhs.smb.unc);
                return NT_STATUS_OK;
 
        case EPM_PROTOCOL_PIPE:
                floor->rhs.pipe.path = talloc_strdup(mem_ctx, data);
-               if (!floor->rhs.pipe.path) {
-                       return NT_STATUS_NO_MEMORY;
-               }
+               NT_STATUS_HAVE_NO_MEMORY(floor->rhs.pipe.path);
                return NT_STATUS_OK;
 
        case EPM_PROTOCOL_NETBIOS:
                floor->rhs.netbios.name = talloc_strdup(mem_ctx, data);
-               if (!floor->rhs.netbios.name) {
-                       return NT_STATUS_NO_MEMORY;
-               }
+               NT_STATUS_HAVE_NO_MEMORY(floor->rhs.netbios.name);
                return NT_STATUS_OK;
 
        case EPM_PROTOCOL_NCALRPC:
@@ -505,16 +609,12 @@ static NTSTATUS dcerpc_floor_set_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor
                
        case EPM_PROTOCOL_STREETTALK:
                floor->rhs.streettalk.streettalk = talloc_strdup(mem_ctx, data);
-               if (!floor->rhs.streettalk.streettalk) {
-                       return NT_STATUS_NO_MEMORY;
-               }
+               NT_STATUS_HAVE_NO_MEMORY(floor->rhs.streettalk.streettalk);
                return NT_STATUS_OK;
                
        case EPM_PROTOCOL_UNIX_DS:
                floor->rhs.unix_ds.path = talloc_strdup(mem_ctx, data);
-               if (!floor->rhs.unix_ds.path) {
-                       return NT_STATUS_NO_MEMORY;
-               }
+               NT_STATUS_HAVE_NO_MEMORY(floor->rhs.unix_ds.path);
                return NT_STATUS_OK;
                
        case EPM_PROTOCOL_NULL:
@@ -570,8 +670,14 @@ enum dcerpc_transport_t dcerpc_transport_by_tower(struct epm_tower *tower)
        return -1;
 }
 
-NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, struct epm_tower *tower, struct dcerpc_binding *binding)
+NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, struct epm_tower *tower, struct dcerpc_binding **b_out)
 {
+       NTSTATUS status;
+       struct dcerpc_binding *binding;
+
+       binding = talloc(mem_ctx, struct dcerpc_binding);
+       NT_STATUS_HAVE_NO_MEMORY(binding);
+
        ZERO_STRUCT(binding->object);
        binding->options = NULL;
        binding->host = NULL;
@@ -588,8 +694,12 @@ NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, struct epm_tower *tower,
        }
 
        /* Set object uuid */
-       binding->object = tower->floors[0].lhs.info.uuid.uuid;
-       binding->object_version = tower->floors[0].lhs.info.uuid.version;
+       status = dcerpc_floor_get_lhs_data(&tower->floors[0], &binding->object, &binding->object_version);
+       
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(1, ("Error pulling object uuid and version: %s", nt_errstr(status)));     
+               return status;
+       }
 
        /* Ignore floor 1, it contains the NDR version info */
        
@@ -606,6 +716,7 @@ NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, struct epm_tower *tower,
        if (tower->num_floors >= 5) {
                binding->host = dcerpc_floor_get_rhs_data(mem_ctx, &tower->floors[4]);
        }
+       *b_out = binding;
        return NT_STATUS_OK;
 }
 
@@ -613,6 +724,7 @@ NTSTATUS dcerpc_binding_build_tower(TALLOC_CTX *mem_ctx, struct dcerpc_binding *
 {
        const enum epm_protocol *protseq = NULL;
        int num_protocols = -1, i;
+       struct GUID ndr_guid;
        NTSTATUS status;
        
        /* Find transport */
@@ -630,27 +742,31 @@ NTSTATUS dcerpc_binding_build_tower(TALLOC_CTX *mem_ctx, struct dcerpc_binding *
        }
 
        tower->num_floors = 2 + num_protocols;
-       tower->floors = talloc_array_p(mem_ctx, struct epm_floor, tower->num_floors);
+       tower->floors = talloc_array(mem_ctx, struct epm_floor, tower->num_floors);
 
        /* Floor 0 */
        tower->floors[0].lhs.protocol = EPM_PROTOCOL_UUID;
-       tower->floors[0].lhs.info.uuid.uuid = binding->object;
-       tower->floors[0].lhs.info.uuid.version = binding->object_version;
-       tower->floors[0].rhs.uuid.unknown = 0;
+
+       tower->floors[0].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx, &binding->object, binding->object_version);
+
+       tower->floors[0].rhs.uuid.unknown = data_blob_talloc_zero(mem_ctx, 2);
        
        /* Floor 1 */
        tower->floors[1].lhs.protocol = EPM_PROTOCOL_UUID;
-       tower->floors[1].lhs.info.uuid.version = NDR_GUID_VERSION;
-       tower->floors[1].rhs.uuid.unknown = 0;
-       status = GUID_from_string(NDR_GUID, &tower->floors[1].lhs.info.uuid.uuid);
+
+       status = GUID_from_string(NDR_GUID, &ndr_guid);
        if (NT_STATUS_IS_ERR(status)) {
                return status;
        }
 
+       tower->floors[1].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx, &ndr_guid, NDR_GUID_VERSION);
+       
+       tower->floors[1].rhs.uuid.unknown = data_blob_talloc_zero(mem_ctx, 2);
+       
        /* Floor 2 to num_protocols */
        for (i = 0; i < num_protocols; i++) {
                tower->floors[2 + i].lhs.protocol = protseq[i];
-               tower->floors[2 + i].lhs.info.lhs_data = data_blob_talloc(mem_ctx, NULL, 0);
+               tower->floors[2 + i].lhs.lhs_data = data_blob_talloc(mem_ctx, NULL, 0);
                ZERO_STRUCT(tower->floors[2 + i].rhs);
                dcerpc_floor_set_rhs_data(mem_ctx, &tower->floors[2 + i], "");
        }
@@ -675,7 +791,7 @@ NTSTATUS dcerpc_binding_build_tower(TALLOC_CTX *mem_ctx, struct dcerpc_binding *
 }
 
 NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
-                                const char *uuid, uint_t version)
+                               const char *uuid, uint_t version)
 {
        struct dcerpc_pipe *p;
        NTSTATUS status;
@@ -683,39 +799,57 @@ NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *bind
        struct policy_handle handle;
        struct GUID guid;
        struct epm_twr_t twr, *twr_r;
-       struct dcerpc_binding epmapper_binding;
+       struct dcerpc_binding *epmapper_binding;
        const struct dcerpc_interface_table *table = idl_iface_by_uuid(uuid);
        int i;
 
+       struct cli_credentials *anon_creds
+               = cli_credentials_init(mem_ctx);
+       cli_credentials_set_anonymous(anon_creds);
+       cli_credentials_guess(anon_creds);
+
        /* First, check if there is a default endpoint specified in the IDL */
 
        if (table) {
-               struct dcerpc_binding default_binding;
-               
+               struct dcerpc_binding *default_binding;
+
+               binding->authservice = talloc_strdup(binding, table->authservices->names[0]);
+
                /* Find one of the default pipes for this interface */
                for (i = 0; i < table->endpoints->count; i++) {
                        status = dcerpc_parse_binding(mem_ctx, table->endpoints->names[i], &default_binding);
 
-                       if (NT_STATUS_IS_OK(status) && default_binding.transport == binding->transport && default_binding.endpoint) {
-                               binding->endpoint = talloc_strdup(mem_ctx, default_binding.endpoint);   
-                               return NT_STATUS_OK;
+                       if (NT_STATUS_IS_OK(status)) {
+                               if (default_binding->transport == binding->transport && default_binding->endpoint) {
+                                       binding->endpoint = talloc_reference(binding, default_binding->endpoint);
+                                       talloc_free(default_binding);
+                                       return NT_STATUS_OK;
+                               } else {
+                                       talloc_free(default_binding);
+                               }
                        }
                }
        }
 
+       epmapper_binding = talloc_zero(mem_ctx, struct dcerpc_binding);
+       if (!epmapper_binding) {
+               return NT_STATUS_NO_MEMORY;
+       }
 
-       ZERO_STRUCT(epmapper_binding);
-       epmapper_binding.transport = binding->transport;
-       epmapper_binding.host = binding->host;
-       epmapper_binding.options = NULL;
-       epmapper_binding.flags = 0;
-       epmapper_binding.endpoint = NULL;
+       epmapper_binding->transport = binding->transport;
+       epmapper_binding->host = talloc_reference(epmapper_binding, 
+                                                 binding->host);
+       epmapper_binding->options = NULL;
+       epmapper_binding->flags = 0;
+       epmapper_binding->endpoint = NULL;
+       epmapper_binding->authservice = NULL;
        
-       status = dcerpc_pipe_connect_b(&p,
-                                       &epmapper_binding,
-                                  DCERPC_EPMAPPER_UUID,
-                                  DCERPC_EPMAPPER_VERSION,
-                                  NULL, NULL, NULL);
+       status = dcerpc_pipe_connect_b(mem_ctx, 
+                                      &p,
+                                      epmapper_binding,
+                                      DCERPC_EPMAPPER_UUID,
+                                      DCERPC_EPMAPPER_VERSION,
+                                      anon_creds);
 
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -745,29 +879,29 @@ NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *bind
 
        status = dcerpc_epm_Map(p, p, &r);
        if (!NT_STATUS_IS_OK(status)) {
-               dcerpc_pipe_close(p);
+               talloc_free(p);
                return status;
        }
        if (r.out.result != 0 || r.out.num_towers != 1) {
-               dcerpc_pipe_close(p);
+               talloc_free(p);
                return NT_STATUS_PORT_UNREACHABLE;
        }
 
        twr_r = r.out.towers[0].twr;
        if (!twr_r) {
-               dcerpc_pipe_close(p);
+               talloc_free(p);
                return NT_STATUS_PORT_UNREACHABLE;
        }
 
        if (twr_r->tower.num_floors != twr.tower.num_floors ||
            twr_r->tower.floors[3].lhs.protocol != twr.tower.floors[3].lhs.protocol) {
-               dcerpc_pipe_close(p);
+               talloc_free(p);
                return NT_STATUS_PORT_UNREACHABLE;
        }
 
-       binding->endpoint = dcerpc_floor_get_rhs_data(mem_ctx, &twr_r->tower.floors[3]);
+       binding->endpoint = talloc_reference(binding, dcerpc_floor_get_rhs_data(mem_ctx, &twr_r->tower.floors[3]));
 
-       dcerpc_pipe_close(p);
+       talloc_free(p);
 
        return NT_STATUS_OK;
 }
@@ -776,76 +910,92 @@ NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *bind
 /* 
    perform an authenticated bind if needed
 */
-static NTSTATUS dcerpc_pipe_auth(struct dcerpc_pipe *p, 
-                                struct dcerpc_binding *binding,
-                                const char *pipe_uuid, 
-                                uint32_t pipe_version,
-                                const char *domain,
-                                const char *username,
-                                const char *password)
+NTSTATUS dcerpc_pipe_auth(struct dcerpc_pipe *p, 
+                         struct dcerpc_binding *binding,
+                         const char *pipe_uuid, 
+                         uint32_t pipe_version,
+                         struct cli_credentials *credentials)
 {
        NTSTATUS status;
+       TALLOC_CTX *tmp_ctx;
+       tmp_ctx = talloc_new(p);
+
        p->conn->flags = binding->flags;
 
        /* remember the binding string for possible secondary connections */
        p->conn->binding_string = dcerpc_binding_string(p, binding);
 
-       if (username && username[0] && (binding->flags & DCERPC_SCHANNEL_ANY)) {
-               status = dcerpc_bind_auth_schannel(p, pipe_uuid, pipe_version, 
-                                                  domain, username, password);
-       } else if (username && username[0]) {
+       if (!cli_credentials_is_anonymous(credentials) &&
+               (binding->flags & DCERPC_SCHANNEL_ANY)) {
+               status = dcerpc_bind_auth_schannel(tmp_ctx, 
+                                                  p, pipe_uuid, pipe_version, 
+                                                  credentials);
+       } else if (!cli_credentials_is_anonymous(credentials)) {
                uint8_t auth_type;
                if (binding->flags & DCERPC_AUTH_SPNEGO) {
                        auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+               } else if (binding->flags & DCERPC_AUTH_KRB5) {
+                       auth_type = DCERPC_AUTH_TYPE_KRB5;
                } else {
                        auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
                }
 
                status = dcerpc_bind_auth_password(p, pipe_uuid, pipe_version, 
-                                                  domain, username, password, 
-                                                  auth_type);
-       } else {    
+                                                  credentials, auth_type,
+                                                  binding->authservice);
+       } else {
                status = dcerpc_bind_auth_none(p, pipe_uuid, pipe_version);
        }
 
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0,("Failed to bind to uuid %s - %s\n", pipe_uuid, nt_errstr(status)));
        }
+       talloc_free(tmp_ctx);
        return status;
 }
 
 
 /* open a rpc connection to a rpc pipe on SMB using the binding
    structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_np(struct dcerpc_pipe **pp, 
+static NTSTATUS dcerpc_pipe_connect_ncacn_np(TALLOC_CTX *tmp_ctx, 
+                                            struct dcerpc_pipe *p, 
                                             struct dcerpc_binding *binding,
                                             const char *pipe_uuid, 
                                             uint32_t pipe_version,
-                                            const char *domain,
-                                            const char *username,
-                                            const char *password)
+                                            struct cli_credentials *credentials)
 {
-       struct dcerpc_pipe *p;
        NTSTATUS status;
        struct smbcli_state *cli;
        const char *pipe_name = NULL;
-       TALLOC_CTX *tmp_ctx;
 
-       *pp = NULL;
-
-       p = dcerpc_pipe_init(NULL);
-       if (p == NULL) {
-               return NT_STATUS_NO_MEMORY;
+       if (binding->flags & DCERPC_SCHANNEL_ANY) {
+               struct cli_credentials *anon_creds
+                       = cli_credentials_init(tmp_ctx);
+               cli_credentials_set_anonymous(anon_creds);
+               cli_credentials_guess(anon_creds);
+               status = smbcli_full_connection(p->conn, &cli, 
+                                               cli_credentials_get_workstation(credentials),
+                                               binding->host, 
+                                               "IPC$", NULL, 
+                                               anon_creds);
+       } else {
+               status = smbcli_full_connection(p->conn, &cli, 
+                                               cli_credentials_get_workstation(credentials),
+                                               binding->host, 
+                                               "IPC$", NULL,
+                                               credentials);
        }
-       tmp_ctx = talloc_new(p);
-       
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0,("Failed to connect to %s - %s\n", binding->host, nt_errstr(status)));
+               return status;
+       }
+
        /* Look up identifier using the epmapper */
        if (!binding->endpoint) {
                status = dcerpc_epm_map_binding(tmp_ctx, binding, pipe_uuid, pipe_version);
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(0,("Failed to map DCERPC/TCP NCACN_NP pipe for '%s' - %s\n", 
                                 pipe_uuid, nt_errstr(status)));
-                       talloc_free(p);
                        return status;
                }
                DEBUG(1,("Mapped to DCERPC/NP pipe %s\n", binding->endpoint));
@@ -853,78 +1003,24 @@ static NTSTATUS dcerpc_pipe_connect_ncacn_np(struct dcerpc_pipe **pp,
 
        pipe_name = binding->endpoint;
 
-       if (!strncasecmp(pipe_name, "/pipe/", 6) || 
-           !strncasecmp(pipe_name, "\\pipe\\", 6)) {
-               pipe_name += 6;
-       }
-
-       if (pipe_name[0] != '\\') {
-               pipe_name = talloc_asprintf(tmp_ctx, "\\%s", pipe_name);
-       }
-       
-       if (!username || !username[0] || 
-           (binding->flags & DCERPC_SCHANNEL_ANY)) {
-               status = smbcli_full_connection(p->conn, &cli, lp_netbios_name(),
-                                               binding->host, 
-                                               "ipc$", NULL, 
-                                               "", "", NULL);
-       } else {
-               status = smbcli_full_connection(p->conn, &cli, lp_netbios_name(),
-                                               binding->host, 
-                                               "ipc$", NULL,
-                                               username, domain,
-                                               password);
-       }
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0,("Failed to connect to %s - %s\n", binding->host, nt_errstr(status)));
-               talloc_free(p);
-               return status;
-       }
-
        status = dcerpc_pipe_open_smb(p->conn, cli->tree, pipe_name);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0,("Failed to open pipe %s - %s\n", pipe_name, nt_errstr(status)));
-               talloc_free(p);
                return status;
        }
 
-       if (!(binding->flags & DCERPC_AUTH_OPTIONS)) {
-               username = NULL;
-       }
-       
-       status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, domain, username, password);
-       if (!NT_STATUS_IS_OK(status)) {
-               talloc_free(p);
-               return status;
-       }
-
-       (*pp) = p;
-       talloc_free(tmp_ctx);
-
        return NT_STATUS_OK;
 }
 
 /* open a rpc connection to a rpc pipe on SMP using the binding
    structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncalrpc(struct dcerpc_pipe **pp, 
+static NTSTATUS dcerpc_pipe_connect_ncalrpc(TALLOC_CTX *tmp_ctx, 
+                                           struct dcerpc_pipe *p, 
                                            struct dcerpc_binding *binding,
                                            const char *pipe_uuid, 
-                                           uint32_t pipe_version,
-                                           const char *domain,
-                                           const char *username,
-                                           const char *password)
+                                           uint32_t pipe_version)
 {
        NTSTATUS status;
-       struct dcerpc_pipe *p;
-       TALLOC_CTX *tmp_ctx;
-
-       (*pp) = NULL;
-
-       p = dcerpc_pipe_init(NULL);
-       if (p == NULL) {
-               return NT_STATUS_NO_MEMORY;
-       }
-       tmp_ctx = talloc_new(p);
 
        /* Look up identifier using the epmapper */
        if (!binding->endpoint) {
@@ -932,7 +1028,6 @@ static NTSTATUS dcerpc_pipe_connect_ncalrpc(struct dcerpc_pipe **pp,
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(0,("Failed to map DCERPC/TCP NCALRPC identifier for '%s' - %s\n", 
                                 pipe_uuid, nt_errstr(status)));
-                       talloc_free(p);
                        return status;
                }
                DEBUG(1,("Mapped to DCERPC/LRPC identifier %s\n", binding->endpoint));
@@ -942,19 +1037,9 @@ static NTSTATUS dcerpc_pipe_connect_ncalrpc(struct dcerpc_pipe **pp,
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0,("Failed to open ncalrpc pipe '%s' - %s\n", 
                         binding->endpoint, nt_errstr(status)));
-               talloc_free(p);
                return status;
        }
 
-       status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, domain, username, password);
-       if (!NT_STATUS_IS_OK(status)) {
-               talloc_free(p);
-               return status;
-       }
-
-       (*pp) = p;
-       talloc_free(tmp_ctx);
-
        return status;
 }
 
@@ -962,29 +1047,19 @@ static NTSTATUS dcerpc_pipe_connect_ncalrpc(struct dcerpc_pipe **pp,
 
 /* open a rpc connection to a rpc pipe on SMP using the binding
    structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_unix_stream(struct dcerpc_pipe **pp, 
+static NTSTATUS dcerpc_pipe_connect_ncacn_unix_stream(TALLOC_CTX *tmp_ctx, 
+                                                     struct dcerpc_pipe *p, 
                                                      struct dcerpc_binding *binding,
                                                      const char *pipe_uuid, 
-                                                     uint32_t pipe_version,
-                                                     const char *domain,
-                                                     const char *username,
-                                                     const char *password)
+                                                     uint32_t pipe_version)
 {
        NTSTATUS status;
-       struct dcerpc_pipe *p;
-
-       (*pp) = NULL;
 
        if (!binding->endpoint) {
                DEBUG(0, ("Path to unix socket not specified\n"));
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       p = dcerpc_pipe_init(NULL);
-       if (p == NULL) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
        status = dcerpc_pipe_open_unix_stream(p->conn, binding->endpoint);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0,("Failed to open unix socket %s - %s\n", 
@@ -993,39 +1068,19 @@ static NTSTATUS dcerpc_pipe_connect_ncacn_unix_stream(struct dcerpc_pipe **pp,
                 return status;
        }
 
-       status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, domain, username, password);
-       if (!NT_STATUS_IS_OK(status)) {
-               talloc_free(p);
-               return status;
-       }
-
-       (*pp) = p;
        return status;
 }
 
-/* open a rpc connection to a rpc pipe on SMP using the binding
+/* open a rpc connection to a rpc pipe on TCP/IP sockets using the binding
    structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_ip_tcp(struct dcerpc_pipe **pp, 
+static NTSTATUS dcerpc_pipe_connect_ncacn_ip_tcp(TALLOC_CTX *tmp_ctx, 
+                                                struct dcerpc_pipe *p, 
                                                 struct dcerpc_binding *binding,
                                                 const char *pipe_uuid, 
-                                                uint32_t pipe_version,
-                                                const char *domain,
-                                                const char *username,
-                                                const char *password)
+                                                uint32_t pipe_version)
 {
        NTSTATUS status;
        uint32_t port = 0;
-       struct dcerpc_pipe *p;
-       TALLOC_CTX *tmp_ctx;
-
-       (*pp) = NULL;
-
-       p = dcerpc_pipe_init(NULL);
-       if (p == NULL) {
-               return NT_STATUS_NO_MEMORY;
-       }
-       tmp_ctx = talloc_new(p);
 
        if (!binding->endpoint) {
                status = dcerpc_epm_map_binding(tmp_ctx, binding, 
@@ -1033,7 +1088,6 @@ static NTSTATUS dcerpc_pipe_connect_ncacn_ip_tcp(struct dcerpc_pipe **pp,
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(0,("Failed to map DCERPC/TCP port for '%s' - %s\n", 
                                 pipe_uuid, nt_errstr(status)));
-                       talloc_free(p);
                        return status;
                }
                DEBUG(1,("Mapped to DCERPC/TCP port %s\n", binding->endpoint));
@@ -1045,75 +1099,90 @@ static NTSTATUS dcerpc_pipe_connect_ncacn_ip_tcp(struct dcerpc_pipe **pp,
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0,("Failed to connect to %s:%d - %s\n", 
                         binding->host, port, nt_errstr(status)));
-               talloc_free(p);
                 return status;
         }
 
-       status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, domain, username, password);
-       if (!NT_STATUS_IS_OK(status)) {
-               talloc_free(p);
-               return status;
-       }
-
-       (*pp) = p;
-       talloc_free(tmp_ctx);
         return status;
 }
 
 
 /* open a rpc connection to a rpc pipe, using the specified 
    binding structure to determine the endpoint and options */
-NTSTATUS dcerpc_pipe_connect_b(struct dcerpc_pipe **pp, 
+NTSTATUS dcerpc_pipe_connect_b(TALLOC_CTX *parent_ctx, 
+                              struct dcerpc_pipe **pp, 
                               struct dcerpc_binding *binding,
                               const char *pipe_uuid, 
                               uint32_t pipe_version,
-                              const char *domain,
-                              const char *username,
-                              const char *password)
+                              struct cli_credentials *credentials)
 {
        NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
+       struct dcerpc_pipe *p; 
+       
+       TALLOC_CTX *tmp_ctx;
+
+       (*pp) = NULL;
+
+       p = dcerpc_pipe_init(parent_ctx);
+       if (p == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       tmp_ctx = talloc_named(p, 0, "dcerpc_pipe_connect_b tmp_ctx");
 
        switch (binding->transport) {
        case NCACN_NP:
-               status = dcerpc_pipe_connect_ncacn_np(pp, binding, pipe_uuid, pipe_version,
-                                                     domain, username, password);
+               status = dcerpc_pipe_connect_ncacn_np(tmp_ctx, 
+                                                     p, binding, pipe_uuid, pipe_version, credentials);
                break;
        case NCACN_IP_TCP:
-               status = dcerpc_pipe_connect_ncacn_ip_tcp(pp, binding, pipe_uuid, pipe_version,
-                                                         domain, username, password);
+               status = dcerpc_pipe_connect_ncacn_ip_tcp(tmp_ctx, 
+                                                         p, binding, pipe_uuid, pipe_version);
                break;
        case NCACN_UNIX_STREAM:
-               status = dcerpc_pipe_connect_ncacn_unix_stream(pp, binding, pipe_uuid, pipe_version
-                                                              domain, username, password);
+               status = dcerpc_pipe_connect_ncacn_unix_stream(tmp_ctx
+                                                              p, binding, pipe_uuid, pipe_version);
                break;
        case NCALRPC:
-               status = dcerpc_pipe_connect_ncalrpc(pp, binding, pipe_uuid, pipe_version
-                                                    domain, username, password);
+               status = dcerpc_pipe_connect_ncalrpc(tmp_ctx
+                                                    p, binding, pipe_uuid, pipe_version);
                break;
        default:
                return NT_STATUS_NOT_SUPPORTED;
        }
 
+       if (!NT_STATUS_IS_OK(status)) {
+               talloc_free(p);
+               return status;
+       }
+
+       status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, credentials);
+       if (!NT_STATUS_IS_OK(status)) {
+               talloc_free(p);
+               return status;
+       }
+       *pp = p;
+       talloc_free(tmp_ctx);
+
        return status;
 }
 
 
 /* open a rpc connection to a rpc pipe, using the specified string
    binding to determine the endpoint and options */
-NTSTATUS dcerpc_pipe_connect(struct dcerpc_pipe **pp, 
+NTSTATUS dcerpc_pipe_connect(TALLOC_CTX *parent_ctx, 
+                            struct dcerpc_pipe **pp, 
                             const char *binding,
                             const char *pipe_uuid, 
                             uint32_t pipe_version,
-                            const char *domain,
-                            const char *username,
-                            const char *password)
+                            struct cli_credentials *credentials)
 {
-       struct dcerpc_binding b;
+       struct dcerpc_binding *b;
        NTSTATUS status;
        TALLOC_CTX *tmp_ctx;
 
-       tmp_ctx = talloc_new(NULL);
+       tmp_ctx = talloc_named(parent_ctx, 0, "dcerpc_pipe_connect tmp_ctx");
+       if (!tmp_ctx) {
+               return NT_STATUS_NO_MEMORY;
+       }
 
        status = dcerpc_parse_binding(tmp_ctx, binding, &b);
        if (!NT_STATUS_IS_OK(status)) {
@@ -1122,10 +1191,14 @@ NTSTATUS dcerpc_pipe_connect(struct dcerpc_pipe **pp,
                return status;
        }
 
-       DEBUG(3,("Using binding %s\n", dcerpc_binding_string(tmp_ctx, &b)));
+       DEBUG(3,("Using binding %s\n", dcerpc_binding_string(tmp_ctx, b)));
 
-       status = dcerpc_pipe_connect_b(pp, &b, pipe_uuid, pipe_version, domain, username, password);
+       status = dcerpc_pipe_connect_b(tmp_ctx,
+                                      pp, b, pipe_uuid, pipe_version, credentials);
 
+       if (NT_STATUS_IS_OK(status)) {
+               *pp = talloc_reference(parent_ctx, *pp);
+       }
        talloc_free(tmp_ctx);
 
        return status;
@@ -1139,13 +1212,12 @@ NTSTATUS dcerpc_pipe_connect(struct dcerpc_pipe **pp,
   will be on the same SMB connection, but use a new fnum
 */
 NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p, struct dcerpc_pipe **p2,
-                                    const char *pipe_name,
-                                    const char *pipe_uuid,
-                                    uint32_t pipe_version)
+                                    struct dcerpc_binding *b)
+
+
 {
        struct smbcli_tree *tree;
        NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
-       struct dcerpc_binding b;
 
        (*p2) = dcerpc_pipe_init(p);
        if (*p2 == NULL) {
@@ -1158,23 +1230,15 @@ NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p, struct dcerpc_pipe *
                if (!tree) {
                        return NT_STATUS_INVALID_PARAMETER;
                }
-               status = dcerpc_pipe_open_smb((*p2)->conn, tree, pipe_name);
+               status = dcerpc_pipe_open_smb((*p2)->conn, tree, b->endpoint);
                break;
 
        case NCACN_IP_TCP:
-               status = dcerpc_parse_binding(p, p->conn->binding_string, &b);
-               if (!NT_STATUS_IS_OK(status)) {
-                       return status;
-               }
-               status = dcerpc_pipe_open_tcp((*p2)->conn, b.host, atoi(b.endpoint));
+               status = dcerpc_pipe_open_tcp((*p2)->conn, b->host, atoi(b->endpoint));
                break;
 
        case NCALRPC:
-               status = dcerpc_parse_binding(p, p->conn->binding_string, &b);
-               if (!NT_STATUS_IS_OK(status)) {
-                       return status;
-               }
-               status = dcerpc_pipe_open_pipe((*p2)->conn, b.endpoint);
+               status = dcerpc_pipe_open_pipe((*p2)->conn, b->endpoint);
                break;
 
        default:
@@ -1188,12 +1252,6 @@ NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p, struct dcerpc_pipe *
 
        (*p2)->conn->flags = p->conn->flags;
 
-       status = dcerpc_bind_auth_none(*p2, pipe_uuid, pipe_version);
-       if (!NT_STATUS_IS_OK(status)) {
-               talloc_free(*p2);
-                return status;
-        }
-
        return NT_STATUS_OK;
 }
 
@@ -1238,7 +1296,7 @@ void dcerpc_log_packet(const struct dcerpc_interface_table *ndr,
                if (name == NULL) {
                        return;
                }
-               if (!file_exist(name, NULL)) {
+               if (!file_exist(name)) {
                        if (file_save(name, pkt->data, pkt->length)) {
                                DEBUG(10,("Logged rpc packet to %s\n", name));
                        }