r15854: more talloc_set_destructor() typesafe fixes
[bbaumbach/samba-autobuild/.git] / source4 / librpc / rpc / dcerpc.c
1 /* 
2    Unix SMB/CIFS implementation.
3    raw dcerpc operations
4
5    Copyright (C) Tim Potter 2003
6    Copyright (C) Andrew Tridgell 2003-2005
7    Copyright (C) Jelmer Vernooij 2004-2005
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 2 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program; if not, write to the Free Software
21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #include "includes.h"
25 #include "dlinklist.h"
26 #include "lib/events/events.h"
27 #include "librpc/rpc/dcerpc.h"
28 #include "librpc/gen_ndr/ndr_misc.h"
29 #include "librpc/gen_ndr/ndr_dcerpc.h"
30 #include "libcli/composite/composite.h"
31 #include "auth/gensec/gensec.h"
32
33 NTSTATUS dcerpc_init(void)
34 {
35         gensec_init();
36
37         return NT_STATUS_OK;
38 }
39
40 static void dcerpc_ship_next_request(struct dcerpc_connection *c);
41
42 /* destroy a dcerpc connection */
43 static int dcerpc_connection_destructor(struct dcerpc_connection *c)
44 {
45         if (c->transport.shutdown_pipe) {
46                 c->transport.shutdown_pipe(c);
47         }
48         return 0;
49 }
50
51
52 /* initialise a dcerpc connection. 
53    the event context is optional
54 */
55 struct dcerpc_connection *dcerpc_connection_init(TALLOC_CTX *mem_ctx, 
56                                                  struct event_context *ev)
57 {
58         struct dcerpc_connection *c;
59
60         c = talloc_zero(mem_ctx, struct dcerpc_connection);
61         if (!c) {
62                 return NULL;
63         }
64
65         if (ev == NULL) {
66                 ev = event_context_init(c);
67                 if (ev == NULL) {
68                         talloc_free(c);
69                         return NULL;
70                 }
71         }
72
73         c->event_ctx = ev;
74         
75         if (!talloc_reference(c, ev)) {
76                 talloc_free(c);
77                 return NULL;
78         }
79         c->call_id = 1;
80         c->security_state.auth_info = NULL;
81         c->security_state.session_key = dcerpc_generic_session_key;
82         c->security_state.generic_state = NULL;
83         c->binding_string = NULL;
84         c->flags = 0;
85         c->srv_max_xmit_frag = 0;
86         c->srv_max_recv_frag = 0;
87         c->pending = NULL;
88
89         talloc_set_destructor(c, dcerpc_connection_destructor);
90
91         return c;
92 }
93
94 /* initialise a dcerpc pipe. */
95 struct dcerpc_pipe *dcerpc_pipe_init(TALLOC_CTX *mem_ctx, struct event_context *ev)
96 {
97         struct dcerpc_pipe *p;
98
99         p = talloc(mem_ctx, struct dcerpc_pipe);
100         if (!p) {
101                 return NULL;
102         }
103
104         p->conn = dcerpc_connection_init(p, ev);
105         if (p->conn == NULL) {
106                 talloc_free(p);
107                 return NULL;
108         }
109
110         p->last_fault_code = 0;
111         p->context_id = 0;
112         p->request_timeout = DCERPC_REQUEST_TIMEOUT;
113
114         ZERO_STRUCT(p->syntax);
115         ZERO_STRUCT(p->transfer_syntax);
116
117         return p;
118 }
119
120
121 /* 
122    choose the next call id to use
123 */
124 static uint32_t next_call_id(struct dcerpc_connection *c)
125 {
126         c->call_id++;
127         if (c->call_id == 0) {
128                 c->call_id++;
129         }
130         return c->call_id;
131 }
132
133 /* we need to be able to get/set the fragment length without doing a full
134    decode */
135 void dcerpc_set_frag_length(DATA_BLOB *blob, uint16_t v)
136 {
137         if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
138                 SSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET, v);
139         } else {
140                 RSSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET, v);
141         }
142 }
143
144 uint16_t dcerpc_get_frag_length(const DATA_BLOB *blob)
145 {
146         if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
147                 return SVAL(blob->data, DCERPC_FRAG_LEN_OFFSET);
148         } else {
149                 return RSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET);
150         }
151 }
152
153 void dcerpc_set_auth_length(DATA_BLOB *blob, uint16_t v)
154 {
155         if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
156                 SSVAL(blob->data, DCERPC_AUTH_LEN_OFFSET, v);
157         } else {
158                 RSSVAL(blob->data, DCERPC_AUTH_LEN_OFFSET, v);
159         }
160 }
161
162
163 /*
164   setup for a ndr pull, also setting up any flags from the binding string
165 */
166 static struct ndr_pull *ndr_pull_init_flags(struct dcerpc_connection *c, 
167                                             DATA_BLOB *blob, TALLOC_CTX *mem_ctx)
168 {
169         struct ndr_pull *ndr = ndr_pull_init_blob(blob, mem_ctx);
170
171         if (ndr == NULL) return ndr;
172
173         if (c->flags & DCERPC_DEBUG_PAD_CHECK) {
174                 ndr->flags |= LIBNDR_FLAG_PAD_CHECK;
175         }
176
177         if (c->flags & DCERPC_NDR_REF_ALLOC) {
178                 ndr->flags |= LIBNDR_FLAG_REF_ALLOC;
179         }
180
181         return ndr;
182 }
183
184 /* 
185    parse a data blob into a ncacn_packet structure. This handles both
186    input and output packets
187 */
188 static NTSTATUS ncacn_pull(struct dcerpc_connection *c, DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
189                             struct ncacn_packet *pkt)
190 {
191         struct ndr_pull *ndr;
192
193         ndr = ndr_pull_init_flags(c, blob, mem_ctx);
194         if (!ndr) {
195                 return NT_STATUS_NO_MEMORY;
196         }
197
198         if (! (CVAL(blob->data, DCERPC_DREP_OFFSET) & DCERPC_DREP_LE)) {
199                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
200         }
201
202         return ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
203 }
204
205 /*
206   generate a CONNECT level verifier
207 */
208 static NTSTATUS dcerpc_connect_verifier(TALLOC_CTX *mem_ctx, DATA_BLOB *blob)
209 {
210         *blob = data_blob_talloc(mem_ctx, NULL, 16);
211         if (blob->data == NULL) {
212                 return NT_STATUS_NO_MEMORY;
213         }
214         SIVAL(blob->data, 0, 1);
215         memset(blob->data+4, 0, 12);
216         return NT_STATUS_OK;
217 }
218
219 /*
220   check a CONNECT level verifier
221 */
222 static NTSTATUS dcerpc_check_connect_verifier(DATA_BLOB *blob)
223 {
224         if (blob->length != 16 ||
225             IVAL(blob->data, 0) != 1) {
226                 return NT_STATUS_ACCESS_DENIED;
227         }
228         return NT_STATUS_OK;
229 }
230
231 /* 
232    parse the authentication information on a dcerpc response packet
233 */
234 static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX *mem_ctx, 
235                                         DATA_BLOB *raw_packet,
236                                         struct ncacn_packet *pkt)
237 {
238         struct ndr_pull *ndr;
239         NTSTATUS status;
240         struct dcerpc_auth auth;
241         DATA_BLOB auth_blob;
242
243         if (pkt->auth_length == 0 &&
244             c->security_state.auth_info->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
245                 return NT_STATUS_OK;
246         }
247
248         auth_blob.length = 8 + pkt->auth_length;
249
250         /* check for a valid length */
251         if (pkt->u.response.stub_and_verifier.length < auth_blob.length) {
252                 return NT_STATUS_INFO_LENGTH_MISMATCH;
253         }
254
255         auth_blob.data = 
256                 pkt->u.response.stub_and_verifier.data + 
257                 pkt->u.response.stub_and_verifier.length - auth_blob.length;
258         pkt->u.response.stub_and_verifier.length -= auth_blob.length;
259
260         /* pull the auth structure */
261         ndr = ndr_pull_init_flags(c, &auth_blob, mem_ctx);
262         if (!ndr) {
263                 return NT_STATUS_NO_MEMORY;
264         }
265
266         if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
267                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
268         }
269
270         status = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
271         if (!NT_STATUS_IS_OK(status)) {
272                 return status;
273         }
274         
275         
276         /* check signature or unseal the packet */
277         switch (c->security_state.auth_info->auth_level) {
278         case DCERPC_AUTH_LEVEL_PRIVACY:
279                 status = gensec_unseal_packet(c->security_state.generic_state, 
280                                               mem_ctx, 
281                                               raw_packet->data + DCERPC_REQUEST_LENGTH,
282                                               pkt->u.response.stub_and_verifier.length, 
283                                               raw_packet->data,
284                                               raw_packet->length - auth.credentials.length,
285                                               &auth.credentials);
286                 memcpy(pkt->u.response.stub_and_verifier.data,
287                        raw_packet->data + DCERPC_REQUEST_LENGTH,
288                        pkt->u.response.stub_and_verifier.length);
289                 break;
290                 
291         case DCERPC_AUTH_LEVEL_INTEGRITY:
292                 status = gensec_check_packet(c->security_state.generic_state, 
293                                              mem_ctx, 
294                                              pkt->u.response.stub_and_verifier.data, 
295                                              pkt->u.response.stub_and_verifier.length, 
296                                              raw_packet->data,
297                                              raw_packet->length - auth.credentials.length,
298                                              &auth.credentials);
299                 break;
300
301         case DCERPC_AUTH_LEVEL_CONNECT:
302                 status = dcerpc_check_connect_verifier(&auth.credentials);
303                 break;
304
305         case DCERPC_AUTH_LEVEL_NONE:
306                 break;
307
308         default:
309                 status = NT_STATUS_INVALID_LEVEL;
310                 break;
311         }
312         
313         /* remove the indicated amount of paddiing */
314         if (pkt->u.response.stub_and_verifier.length < auth.auth_pad_length) {
315                 return NT_STATUS_INFO_LENGTH_MISMATCH;
316         }
317         pkt->u.response.stub_and_verifier.length -= auth.auth_pad_length;
318
319         return status;
320 }
321
322
323 /* 
324    push a dcerpc request packet into a blob, possibly signing it.
325 */
326 static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c, 
327                                          DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
328                                          struct ncacn_packet *pkt)
329 {
330         NTSTATUS status;
331         struct ndr_push *ndr;
332         DATA_BLOB creds2;
333         size_t payload_length;
334
335         /* non-signed packets are simpler */
336         if (!c->security_state.auth_info || 
337             !c->security_state.generic_state) {
338                 return ncacn_push_auth(blob, mem_ctx, pkt, c->security_state.auth_info);
339         }
340
341         ndr = ndr_push_init_ctx(mem_ctx);
342         if (!ndr) {
343                 return NT_STATUS_NO_MEMORY;
344         }
345
346         if (c->flags & DCERPC_PUSH_BIGENDIAN) {
347                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
348         }
349
350         if (pkt->pfc_flags & DCERPC_PFC_FLAG_ORPC) {
351                 ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
352         }
353
354         status = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
355         if (!NT_STATUS_IS_OK(status)) {
356                 return status;
357         }
358
359         /* pad to 16 byte multiple in the payload portion of the
360            packet. This matches what w2k3 does */
361         c->security_state.auth_info->auth_pad_length = 
362                 (16 - (pkt->u.request.stub_and_verifier.length & 15)) & 15;
363         ndr_push_zero(ndr, c->security_state.auth_info->auth_pad_length);
364
365         payload_length = pkt->u.request.stub_and_verifier.length + 
366                 c->security_state.auth_info->auth_pad_length;
367
368         /* sign or seal the packet */
369         switch (c->security_state.auth_info->auth_level) {
370         case DCERPC_AUTH_LEVEL_PRIVACY:
371         case DCERPC_AUTH_LEVEL_INTEGRITY:
372                 c->security_state.auth_info->credentials
373                         = data_blob_talloc(mem_ctx, NULL, gensec_sig_size(c->security_state.generic_state, 
374                                                                           payload_length));
375                 data_blob_clear(&c->security_state.auth_info->credentials);
376                 break;
377
378         case DCERPC_AUTH_LEVEL_CONNECT:
379                 status = dcerpc_connect_verifier(mem_ctx, &c->security_state.auth_info->credentials);
380                 break;
381                 
382         case DCERPC_AUTH_LEVEL_NONE:
383                 c->security_state.auth_info->credentials = data_blob(NULL, 0);
384                 break;
385                 
386         default:
387                 status = NT_STATUS_INVALID_LEVEL;
388                 break;
389         }
390         
391         if (!NT_STATUS_IS_OK(status)) {
392                 return status;
393         }       
394
395         /* add the auth verifier */
396         status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, c->security_state.auth_info);
397         if (!NT_STATUS_IS_OK(status)) {
398                 return status;
399         }
400
401         /* extract the whole packet as a blob */
402         *blob = ndr_push_blob(ndr);
403
404         /* fill in the fragment length and auth_length, we can't fill
405            in these earlier as we don't know the signature length (it
406            could be variable length) */
407         dcerpc_set_frag_length(blob, blob->length);
408         dcerpc_set_auth_length(blob, c->security_state.auth_info->credentials.length);
409
410         /* sign or seal the packet */
411         switch (c->security_state.auth_info->auth_level) {
412         case DCERPC_AUTH_LEVEL_PRIVACY:
413                 status = gensec_seal_packet(c->security_state.generic_state, 
414                                             mem_ctx, 
415                                             blob->data + DCERPC_REQUEST_LENGTH, 
416                                             payload_length,
417                                             blob->data,
418                                             blob->length - 
419                                             c->security_state.auth_info->credentials.length,
420                                             &creds2);
421                 if (!NT_STATUS_IS_OK(status)) {
422                         return status;
423                 }
424                 memcpy(blob->data + blob->length - creds2.length, creds2.data, creds2.length);
425                 break;
426
427         case DCERPC_AUTH_LEVEL_INTEGRITY:
428                 status = gensec_sign_packet(c->security_state.generic_state, 
429                                             mem_ctx, 
430                                             blob->data + DCERPC_REQUEST_LENGTH, 
431                                             payload_length, 
432                                             blob->data,
433                                             blob->length - 
434                                             c->security_state.auth_info->credentials.length,
435                                             &creds2);
436                 if (!NT_STATUS_IS_OK(status)) {
437                         return status;
438                 }
439                 memcpy(blob->data + blob->length - creds2.length, creds2.data, creds2.length);
440                 break;
441
442         case DCERPC_AUTH_LEVEL_CONNECT:
443                 break;
444
445         case DCERPC_AUTH_LEVEL_NONE:
446                 c->security_state.auth_info->credentials = data_blob(NULL, 0);
447                 break;
448
449         default:
450                 status = NT_STATUS_INVALID_LEVEL;
451                 break;
452         }
453
454         data_blob_free(&c->security_state.auth_info->credentials);
455
456         return NT_STATUS_OK;
457 }
458
459
460 /* 
461    fill in the fixed values in a dcerpc header 
462 */
463 static void init_ncacn_hdr(struct dcerpc_connection *c, struct ncacn_packet *pkt)
464 {
465         pkt->rpc_vers = 5;
466         pkt->rpc_vers_minor = 0;
467         if (c->flags & DCERPC_PUSH_BIGENDIAN) {
468                 pkt->drep[0] = 0;
469         } else {
470                 pkt->drep[0] = DCERPC_DREP_LE;
471         }
472         pkt->drep[1] = 0;
473         pkt->drep[2] = 0;
474         pkt->drep[3] = 0;
475 }
476
477 /*
478   map a bind nak reason to a NTSTATUS
479 */
480 static NTSTATUS dcerpc_map_reason(uint16_t reason)
481 {
482         switch (reason) {
483         case DCERPC_BIND_REASON_ASYNTAX:
484                 return NT_STATUS_RPC_UNSUPPORTED_NAME_SYNTAX;
485         case DCERPC_BIND_REASON_INVALID_AUTH_TYPE:
486                 return NT_STATUS_INVALID_PARAMETER;
487         }
488         return NT_STATUS_UNSUCCESSFUL;
489 }
490
491 /*
492   a bind or alter context has failed
493 */
494 static void dcerpc_composite_fail(struct rpc_request *req)
495 {
496         struct composite_context *c = talloc_get_type(req->async.private, 
497                                                       struct composite_context);
498         composite_error(c, req->status);
499 }
500
501 /*
502   mark the dcerpc connection dead. All outstanding requests get an error
503 */
504 static void dcerpc_connection_dead(struct dcerpc_connection *conn, NTSTATUS status)
505 {
506         /* all pending requests get the error */
507         while (conn->pending) {
508                 struct rpc_request *req = conn->pending;
509                 req->state = RPC_REQUEST_DONE;
510                 req->status = status;
511                 DLIST_REMOVE(conn->pending, req);
512                 if (req->async.callback) {
513                         req->async.callback(req);
514                 }
515         }       
516 }
517
518 /*
519   forward declarations of the recv_data handlers for the types of
520   packets we need to handle
521 */
522 static void dcerpc_request_recv_data(struct dcerpc_connection *c, 
523                                      DATA_BLOB *raw_packet, struct ncacn_packet *pkt);
524
525 /*
526   receive a dcerpc reply from the transport. Here we work out what
527   type of reply it is (normal request, bind or alter context) and
528   dispatch to the appropriate handler
529 */
530 static void dcerpc_recv_data(struct dcerpc_connection *conn, DATA_BLOB *blob, NTSTATUS status)
531 {
532         struct ncacn_packet pkt;
533
534         if (NT_STATUS_IS_OK(status) && blob->length == 0) {
535                 status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
536         }
537
538         /* the transport may be telling us of a severe error, such as
539            a dropped socket */
540         if (!NT_STATUS_IS_OK(status)) {
541                 data_blob_free(blob);
542                 dcerpc_connection_dead(conn, status);
543                 return;
544         }
545
546         /* parse the basic packet to work out what type of response this is */
547         status = ncacn_pull(conn, blob, blob->data, &pkt);
548         if (!NT_STATUS_IS_OK(status)) {
549                 data_blob_free(blob);
550                 dcerpc_connection_dead(conn, status);
551         }
552
553         dcerpc_request_recv_data(conn, blob, &pkt);
554 }
555
556
557 /*
558   Receive a bind reply from the transport
559 */
560 static void dcerpc_bind_recv_handler(struct rpc_request *req, 
561                                      DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
562 {
563         struct composite_context *c;
564         struct dcerpc_connection *conn;
565
566         c = talloc_get_type(req->async.private, struct composite_context);
567
568         if (pkt->ptype == DCERPC_PKT_BIND_NAK) {
569                 DEBUG(2,("dcerpc: bind_nak reason %d\n",
570                          pkt->u.bind_nak.reject_reason));
571                 composite_error(c, dcerpc_map_reason(pkt->u.bind_nak.
572                                                      reject_reason));
573                 return;
574         }
575
576         if ((pkt->ptype != DCERPC_PKT_BIND_ACK) ||
577             (pkt->u.bind_ack.num_results == 0) ||
578             (pkt->u.bind_ack.ctx_list[0].result != 0)) {
579                 composite_error(c, NT_STATUS_UNSUCCESSFUL);
580                 return;
581         }
582
583         conn = req->p->conn;
584
585         conn->srv_max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
586         conn->srv_max_recv_frag = pkt->u.bind_ack.max_recv_frag;
587
588         /* the bind_ack might contain a reply set of credentials */
589         if (conn->security_state.auth_info &&
590             pkt->u.bind_ack.auth_info.length) {
591                 c->status = ndr_pull_struct_blob(
592                         &pkt->u.bind_ack.auth_info, conn,
593                         conn->security_state.auth_info,
594                         (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
595                 if (!composite_is_ok(c)) return;
596         }
597
598         composite_done(c);
599 }
600
601 /*
602   handle timeouts of individual dcerpc requests
603 */
604 static void dcerpc_timeout_handler(struct event_context *ev, struct timed_event *te, 
605                                    struct timeval t, void *private)
606 {
607         struct rpc_request *req = talloc_get_type(private, struct rpc_request);
608
609         if (req->state != RPC_REQUEST_PENDING) {
610                 return;
611         }
612
613         req->status = NT_STATUS_IO_TIMEOUT;
614         req->state = RPC_REQUEST_DONE;
615         DLIST_REMOVE(req->p->conn->pending, req);
616         if (req->async.callback) {
617                 req->async.callback(req);
618         }
619 }
620
621
622 /*
623   send a async dcerpc bind request
624 */
625 struct composite_context *dcerpc_bind_send(struct dcerpc_pipe *p,
626                                            TALLOC_CTX *mem_ctx,
627                                            const struct dcerpc_syntax_id *syntax,
628                                            const struct dcerpc_syntax_id *transfer_syntax)
629 {
630         struct composite_context *c;
631         struct ncacn_packet pkt;
632         DATA_BLOB blob;
633         struct rpc_request *req;
634
635         /* we allocate a dcerpc_request so we can be in the same
636            request queue as normal requests, but most of the request
637            fields are not used as there is no call id */
638         req = talloc_zero(mem_ctx, struct rpc_request);
639         if (req == NULL) return NULL;
640
641         c = talloc_zero(mem_ctx, struct composite_context);
642         if (c == NULL) return NULL;
643
644         c->state = COMPOSITE_STATE_IN_PROGRESS;
645         c->private_data = p;
646         c->event_ctx = p->conn->event_ctx;
647
648         p->syntax = *syntax;
649         p->transfer_syntax = *transfer_syntax;
650
651         init_ncacn_hdr(p->conn, &pkt);
652
653         pkt.ptype = DCERPC_PKT_BIND;
654         pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
655         pkt.call_id = p->conn->call_id;
656         pkt.auth_length = 0;
657
658         pkt.u.bind.max_xmit_frag = 5840;
659         pkt.u.bind.max_recv_frag = 5840;
660         pkt.u.bind.assoc_group_id = 0;
661         pkt.u.bind.num_contexts = 1;
662         pkt.u.bind.ctx_list =
663                 talloc_array(mem_ctx, struct dcerpc_ctx_list, 1);
664         if (pkt.u.bind.ctx_list == NULL) {
665                 c->status = NT_STATUS_NO_MEMORY;
666                 goto failed;
667         }
668         pkt.u.bind.ctx_list[0].context_id = p->context_id;
669         pkt.u.bind.ctx_list[0].num_transfer_syntaxes = 1;
670         pkt.u.bind.ctx_list[0].abstract_syntax = p->syntax;
671         pkt.u.bind.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
672         pkt.u.bind.auth_info = data_blob(NULL, 0);
673
674         /* construct the NDR form of the packet */
675         c->status = ncacn_push_auth(&blob, c, &pkt,
676                                     p->conn->security_state.auth_info);
677         if (!NT_STATUS_IS_OK(c->status)) {
678                 goto failed;
679         }
680
681         p->conn->transport.recv_data = dcerpc_recv_data;
682
683         req->state = RPC_REQUEST_PENDING;
684         req->call_id = pkt.call_id;
685         req->async.private = c;
686         req->async.callback = dcerpc_composite_fail;
687         req->p = p;
688         req->recv_handler = dcerpc_bind_recv_handler;
689
690         DLIST_ADD_END(p->conn->pending, req, struct rpc_request *);
691
692         c->status = p->conn->transport.send_request(p->conn, &blob,
693                                                     True);
694         if (!NT_STATUS_IS_OK(c->status)) {
695                 goto failed;
696         }
697
698         event_add_timed(c->event_ctx, req,
699                         timeval_current_ofs(DCERPC_REQUEST_TIMEOUT, 0),
700                         dcerpc_timeout_handler, req);
701
702         return c;
703
704  failed:
705         composite_error(c, c->status);
706         return c;
707 }
708
709 /*
710   recv side of async dcerpc bind request
711 */
712 NTSTATUS dcerpc_bind_recv(struct composite_context *ctx)
713 {
714         NTSTATUS result = composite_wait(ctx);
715         talloc_free(ctx);
716         return result;
717 }
718
719 /* 
720    perform a bind using the given syntax 
721
722    the auth_info structure is updated with the reply authentication info
723    on success
724 */
725 NTSTATUS dcerpc_bind(struct dcerpc_pipe *p, 
726                      TALLOC_CTX *mem_ctx,
727                      const struct dcerpc_syntax_id *syntax,
728                      const struct dcerpc_syntax_id *transfer_syntax)
729 {
730         struct composite_context *creq;
731         creq = dcerpc_bind_send(p, mem_ctx, syntax, transfer_syntax);
732         return dcerpc_bind_recv(creq);
733 }
734
735 /* 
736    perform a continued bind (and auth3)
737 */
738 NTSTATUS dcerpc_auth3(struct dcerpc_connection *c, 
739                       TALLOC_CTX *mem_ctx)
740 {
741         struct ncacn_packet pkt;
742         NTSTATUS status;
743         DATA_BLOB blob;
744
745         init_ncacn_hdr(c, &pkt);
746
747         pkt.ptype = DCERPC_PKT_AUTH3;
748         pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
749         pkt.call_id = next_call_id(c);
750         pkt.auth_length = 0;
751         pkt.u.auth3._pad = 0;
752         pkt.u.auth3.auth_info = data_blob(NULL, 0);
753
754         /* construct the NDR form of the packet */
755         status = ncacn_push_auth(&blob, mem_ctx, &pkt, c->security_state.auth_info);
756         if (!NT_STATUS_IS_OK(status)) {
757                 return status;
758         }
759
760         /* send it on its way */
761         status = c->transport.send_request(c, &blob, False);
762         if (!NT_STATUS_IS_OK(status)) {
763                 return status;
764         }
765
766         return status;  
767 }
768
769
770 /*
771   return the rpc syntax and transfer syntax given the pipe uuid and version
772 */
773 NTSTATUS dcerpc_init_syntaxes(const struct dcerpc_interface_table *table,
774                               struct dcerpc_syntax_id *syntax,
775                               struct dcerpc_syntax_id *transfer_syntax)
776 {
777         syntax->uuid = table->syntax_id.uuid;
778         syntax->if_version = table->syntax_id.if_version;
779
780         *transfer_syntax = ndr_transfer_syntax;
781
782         return NT_STATUS_OK;
783 }
784
785 /* perform a dcerpc bind, using the uuid as the key */
786 NTSTATUS dcerpc_bind_byuuid(struct dcerpc_pipe *p, 
787                             TALLOC_CTX *mem_ctx,
788                             const struct dcerpc_interface_table *table)
789 {
790         struct dcerpc_syntax_id syntax;
791         struct dcerpc_syntax_id transfer_syntax;
792         NTSTATUS status;
793
794         status = dcerpc_init_syntaxes(table,
795                                       &syntax, &transfer_syntax);
796         if (!NT_STATUS_IS_OK(status)) {
797                 DEBUG(2,("Invalid uuid string in dcerpc_bind_byuuid\n"));
798                 return status;
799         }
800
801         return dcerpc_bind(p, mem_ctx, &syntax, &transfer_syntax);
802 }
803
804
805 /*
806   process a fragment received from the transport layer during a
807   request
808
809   This function frees the data 
810 */
811 static void dcerpc_request_recv_data(struct dcerpc_connection *c, 
812                                      DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
813 {
814         struct rpc_request *req;
815         uint_t length;
816         NTSTATUS status = NT_STATUS_OK;
817
818         /*
819           if this is an authenticated connection then parse and check
820           the auth info. We have to do this before finding the
821           matching packet, as the request structure might have been
822           removed due to a timeout, but if it has been we still need
823           to run the auth routines so that we don't get the sign/seal
824           info out of step with the server
825         */
826         if (c->security_state.auth_info && c->security_state.generic_state &&
827             pkt->ptype == DCERPC_PKT_RESPONSE) {
828                 status = ncacn_pull_request_auth(c, raw_packet->data, raw_packet, pkt);
829         }
830
831         /* find the matching request */
832         for (req=c->pending;req;req=req->next) {
833                 if (pkt->call_id == req->call_id) break;
834         }
835
836         if (req == NULL) {
837                 DEBUG(2,("dcerpc_request: unmatched call_id %u in response packet\n", pkt->call_id));
838                 data_blob_free(raw_packet);
839                 return;
840         }
841
842         talloc_steal(req, raw_packet->data);
843
844         if (req->recv_handler != NULL) {
845                 req->state = RPC_REQUEST_DONE;
846                 DLIST_REMOVE(c->pending, req);
847                 req->recv_handler(req, raw_packet, pkt);
848                 return;
849         }
850
851         if (pkt->ptype == DCERPC_PKT_FAULT) {
852                 DEBUG(5,("rpc fault: %s\n", dcerpc_errstr(c, pkt->u.fault.status)));
853                 req->fault_code = pkt->u.fault.status;
854                 req->status = NT_STATUS_NET_WRITE_FAULT;
855                 goto req_done;
856         }
857
858         if (pkt->ptype != DCERPC_PKT_RESPONSE) {
859                 DEBUG(2,("Unexpected packet type %d in dcerpc response\n",
860                          (int)pkt->ptype)); 
861                 req->fault_code = DCERPC_FAULT_OTHER;
862                 req->status = NT_STATUS_NET_WRITE_FAULT;
863                 goto req_done;
864         }
865
866         /* now check the status from the auth routines, and if it failed then fail
867            this request accordingly */
868         if (!NT_STATUS_IS_OK(status)) {
869                 req->status = status;
870                 goto req_done;
871         }
872
873         length = pkt->u.response.stub_and_verifier.length;
874
875         if (length > 0) {
876                 req->payload.data = talloc_realloc(req, 
877                                                    req->payload.data, 
878                                                    uint8_t,
879                                                    req->payload.length + length);
880                 if (!req->payload.data) {
881                         req->status = NT_STATUS_NO_MEMORY;
882                         goto req_done;
883                 }
884                 memcpy(req->payload.data+req->payload.length, 
885                        pkt->u.response.stub_and_verifier.data, length);
886                 req->payload.length += length;
887         }
888
889         if (!(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
890                 c->transport.send_read(c);
891                 return;
892         }
893
894         if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
895                 req->flags |= DCERPC_PULL_BIGENDIAN;
896         } else {
897                 req->flags &= ~DCERPC_PULL_BIGENDIAN;
898         }
899
900
901 req_done:
902         /* we've got the full payload */
903         req->state = RPC_REQUEST_DONE;
904         DLIST_REMOVE(c->pending, req);
905
906         if (c->request_queue != NULL) {
907                 /* We have to look at shipping further requests before calling
908                  * the async function, that one might close the pipe */
909                 dcerpc_ship_next_request(c);
910         }
911
912         if (req->async.callback) {
913                 req->async.callback(req);
914         }
915 }
916
917 /*
918   make sure requests are cleaned up 
919  */
920 static int dcerpc_req_destructor(struct rpc_request *req)
921 {
922         DLIST_REMOVE(req->p->conn->pending, req);
923         return 0;
924 }
925
926 /*
927   perform the send side of a async dcerpc request
928 */
929 static struct rpc_request *dcerpc_request_send(struct dcerpc_pipe *p, 
930                                                const struct GUID *object,
931                                                uint16_t opnum,
932                                                BOOL async,
933                                                DATA_BLOB *stub_data)
934 {
935         struct rpc_request *req;
936
937         p->conn->transport.recv_data = dcerpc_recv_data;
938
939         req = talloc(p, struct rpc_request);
940         if (req == NULL) {
941                 return NULL;
942         }
943
944         req->p = p;
945         req->call_id = next_call_id(p->conn);
946         req->status = NT_STATUS_OK;
947         req->state = RPC_REQUEST_PENDING;
948         req->payload = data_blob(NULL, 0);
949         req->flags = 0;
950         req->fault_code = 0;
951         req->async_call = async;
952         req->async.callback = NULL;
953         req->async.private = NULL;
954         req->recv_handler = NULL;
955
956         if (object != NULL) {
957                 req->object = talloc_memdup(req, object, sizeof(*object));
958                 if (req->object == NULL) {
959                         talloc_free(req);
960                         return NULL;
961                 }
962         } else {
963                 req->object = NULL;
964         }
965
966         req->opnum = opnum;
967         req->request_data.length = stub_data->length;
968         req->request_data.data = talloc_reference(req, stub_data->data);
969         if (req->request_data.data == NULL) {
970                 return NULL;
971         }
972
973         DLIST_ADD_END(p->conn->request_queue, req, struct rpc_request *);
974
975         dcerpc_ship_next_request(p->conn);
976
977         if (p->request_timeout) {
978                 event_add_timed(dcerpc_event_context(p), req, 
979                                 timeval_current_ofs(p->request_timeout, 0), 
980                                 dcerpc_timeout_handler, req);
981         }
982
983         talloc_set_destructor(req, dcerpc_req_destructor);
984         return req;
985 }
986
987 /*
988   Send a request using the transport
989 */
990
991 static void dcerpc_ship_next_request(struct dcerpc_connection *c)
992 {
993         struct rpc_request *req;
994         struct dcerpc_pipe *p;
995         DATA_BLOB *stub_data;
996         struct ncacn_packet pkt;
997         DATA_BLOB blob;
998         uint32_t remaining, chunk_size;
999         BOOL first_packet = True;
1000
1001         req = c->request_queue;
1002         if (req == NULL) {
1003                 return;
1004         }
1005
1006         p = req->p;
1007         stub_data = &req->request_data;
1008
1009         if (!req->async_call && (c->pending != NULL)) {
1010                 return;
1011         }
1012
1013         DLIST_REMOVE(c->request_queue, req);
1014         DLIST_ADD(c->pending, req);
1015
1016         init_ncacn_hdr(p->conn, &pkt);
1017
1018         remaining = stub_data->length;
1019
1020         /* we can write a full max_recv_frag size, minus the dcerpc
1021            request header size */
1022         chunk_size = p->conn->srv_max_recv_frag - (DCERPC_MAX_SIGN_SIZE+DCERPC_REQUEST_LENGTH);
1023
1024         pkt.ptype = DCERPC_PKT_REQUEST;
1025         pkt.call_id = req->call_id;
1026         pkt.auth_length = 0;
1027         pkt.pfc_flags = 0;
1028         pkt.u.request.alloc_hint = remaining;
1029         pkt.u.request.context_id = p->context_id;
1030         pkt.u.request.opnum = req->opnum;
1031
1032         if (req->object) {
1033                 pkt.u.request.object.object = *req->object;
1034                 pkt.pfc_flags |= DCERPC_PFC_FLAG_ORPC;
1035                 chunk_size -= ndr_size_GUID(req->object,0);
1036         }
1037
1038         /* we send a series of pdus without waiting for a reply */
1039         while (remaining > 0 || first_packet) {
1040                 uint32_t chunk = MIN(chunk_size, remaining);
1041                 BOOL last_frag = False;
1042
1043                 first_packet = False;
1044                 pkt.pfc_flags &= ~(DCERPC_PFC_FLAG_FIRST |DCERPC_PFC_FLAG_LAST);
1045
1046                 if (remaining == stub_data->length) {
1047                         pkt.pfc_flags |= DCERPC_PFC_FLAG_FIRST;
1048                 }
1049                 if (chunk == remaining) {
1050                         pkt.pfc_flags |= DCERPC_PFC_FLAG_LAST;
1051                         last_frag = True;
1052                 }
1053
1054                 pkt.u.request.stub_and_verifier.data = stub_data->data + 
1055                         (stub_data->length - remaining);
1056                 pkt.u.request.stub_and_verifier.length = chunk;
1057
1058                 req->status = ncacn_push_request_sign(p->conn, &blob, req, &pkt);
1059                 if (!NT_STATUS_IS_OK(req->status)) {
1060                         req->state = RPC_REQUEST_DONE;
1061                         DLIST_REMOVE(p->conn->pending, req);
1062                         return;
1063                 }
1064                 
1065                 req->status = p->conn->transport.send_request(p->conn, &blob, last_frag);
1066                 if (!NT_STATUS_IS_OK(req->status)) {
1067                         req->state = RPC_REQUEST_DONE;
1068                         DLIST_REMOVE(p->conn->pending, req);
1069                         return;
1070                 }               
1071
1072                 remaining -= chunk;
1073         }
1074 }
1075
1076 /*
1077   return the event context for a dcerpc pipe
1078   used by callers who wish to operate asynchronously
1079 */
1080 struct event_context *dcerpc_event_context(struct dcerpc_pipe *p)
1081 {
1082         return p->conn->event_ctx;
1083 }
1084
1085
1086
1087 /*
1088   perform the receive side of a async dcerpc request
1089 */
1090 NTSTATUS dcerpc_request_recv(struct rpc_request *req,
1091                              TALLOC_CTX *mem_ctx,
1092                              DATA_BLOB *stub_data)
1093 {
1094         NTSTATUS status;
1095
1096         while (req->state == RPC_REQUEST_PENDING) {
1097                 struct event_context *ctx = dcerpc_event_context(req->p);
1098                 if (event_loop_once(ctx) != 0) {
1099                         return NT_STATUS_CONNECTION_DISCONNECTED;
1100                 }
1101         }
1102         *stub_data = req->payload;
1103         status = req->status;
1104         if (stub_data->data) {
1105                 stub_data->data = talloc_steal(mem_ctx, stub_data->data);
1106         }
1107         if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
1108                 req->p->last_fault_code = req->fault_code;
1109         }
1110         talloc_free(req);
1111         return status;
1112 }
1113
1114 /*
1115   perform a full request/response pair on a dcerpc pipe
1116 */
1117 NTSTATUS dcerpc_request(struct dcerpc_pipe *p, 
1118                         struct GUID *object,
1119                         uint16_t opnum,
1120                         BOOL async,
1121                         TALLOC_CTX *mem_ctx,
1122                         DATA_BLOB *stub_data_in,
1123                         DATA_BLOB *stub_data_out)
1124 {
1125         struct rpc_request *req;
1126
1127         req = dcerpc_request_send(p, object, opnum, async, stub_data_in);
1128         if (req == NULL) {
1129                 return NT_STATUS_NO_MEMORY;
1130         }
1131
1132         return dcerpc_request_recv(req, mem_ctx, stub_data_out);
1133 }
1134
1135
1136 /*
1137   this is a paranoid NDR validator. For every packet we push onto the wire
1138   we pull it back again, then push it again. Then we compare the raw NDR data
1139   for that to the NDR we initially generated. If they don't match then we know
1140   we must have a bug in either the pull or push side of our code
1141 */
1142 static NTSTATUS dcerpc_ndr_validate_in(struct dcerpc_connection *c, 
1143                                        TALLOC_CTX *mem_ctx,
1144                                        DATA_BLOB blob,
1145                                        size_t struct_size,
1146                                        ndr_push_flags_fn_t ndr_push,
1147                                        ndr_pull_flags_fn_t ndr_pull)
1148 {
1149         void *st;
1150         struct ndr_pull *pull;
1151         struct ndr_push *push;
1152         NTSTATUS status;
1153         DATA_BLOB blob2;
1154
1155         st = talloc_size(mem_ctx, struct_size);
1156         if (!st) {
1157                 return NT_STATUS_NO_MEMORY;
1158         }
1159
1160         pull = ndr_pull_init_flags(c, &blob, mem_ctx);
1161         if (!pull) {
1162                 return NT_STATUS_NO_MEMORY;
1163         }
1164         pull->flags |= LIBNDR_FLAG_REF_ALLOC;
1165
1166         status = ndr_pull(pull, NDR_IN, st);
1167         if (!NT_STATUS_IS_OK(status)) {
1168                 return ndr_pull_error(pull, NDR_ERR_VALIDATE, 
1169                                       "failed input validation pull - %s",
1170                                       nt_errstr(status));
1171         }
1172
1173         push = ndr_push_init_ctx(mem_ctx);
1174         if (!push) {
1175                 return NT_STATUS_NO_MEMORY;
1176         }       
1177
1178         status = ndr_push(push, NDR_IN, st);
1179         if (!NT_STATUS_IS_OK(status)) {
1180                 return ndr_push_error(push, NDR_ERR_VALIDATE, 
1181                                       "failed input validation push - %s",
1182                                       nt_errstr(status));
1183         }
1184
1185         blob2 = ndr_push_blob(push);
1186
1187         if (!data_blob_equal(&blob, &blob2)) {
1188                 DEBUG(3,("original:\n"));
1189                 dump_data(3, blob.data, blob.length);
1190                 DEBUG(3,("secondary:\n"));
1191                 dump_data(3, blob2.data, blob2.length);
1192                 return ndr_push_error(push, NDR_ERR_VALIDATE, 
1193                                       "failed input validation data - %s",
1194                                       nt_errstr(status));
1195         }
1196
1197         return NT_STATUS_OK;
1198 }
1199
1200 /*
1201   this is a paranoid NDR input validator. For every packet we pull
1202   from the wire we push it back again then pull and push it
1203   again. Then we compare the raw NDR data for that to the NDR we
1204   initially generated. If they don't match then we know we must have a
1205   bug in either the pull or push side of our code
1206 */
1207 static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
1208                                         struct ndr_pull *pull_in,
1209                                         void *struct_ptr,
1210                                         size_t struct_size,
1211                                         ndr_push_flags_fn_t ndr_push,
1212                                         ndr_pull_flags_fn_t ndr_pull,
1213                                         ndr_print_function_t ndr_print)
1214 {
1215         void *st;
1216         struct ndr_pull *pull;
1217         struct ndr_push *push;
1218         NTSTATUS status;
1219         DATA_BLOB blob, blob2;
1220         TALLOC_CTX *mem_ctx = pull_in;
1221         char *s1, *s2;
1222
1223         st = talloc_size(mem_ctx, struct_size);
1224         if (!st) {
1225                 return NT_STATUS_NO_MEMORY;
1226         }
1227         memcpy(st, struct_ptr, struct_size);
1228
1229         push = ndr_push_init_ctx(mem_ctx);
1230         if (!push) {
1231                 return NT_STATUS_NO_MEMORY;
1232         }       
1233
1234         status = ndr_push(push, NDR_OUT, struct_ptr);
1235         if (!NT_STATUS_IS_OK(status)) {
1236                 return ndr_push_error(push, NDR_ERR_VALIDATE, 
1237                                       "failed output validation push - %s",
1238                                       nt_errstr(status));
1239         }
1240
1241         blob = ndr_push_blob(push);
1242
1243         pull = ndr_pull_init_flags(c, &blob, mem_ctx);
1244         if (!pull) {
1245                 return NT_STATUS_NO_MEMORY;
1246         }
1247
1248         pull->flags |= LIBNDR_FLAG_REF_ALLOC;
1249         status = ndr_pull(pull, NDR_OUT, st);
1250         if (!NT_STATUS_IS_OK(status)) {
1251                 return ndr_pull_error(pull, NDR_ERR_VALIDATE, 
1252                                       "failed output validation pull - %s",
1253                                       nt_errstr(status));
1254         }
1255
1256         push = ndr_push_init_ctx(mem_ctx);
1257         if (!push) {
1258                 return NT_STATUS_NO_MEMORY;
1259         }       
1260
1261         status = ndr_push(push, NDR_OUT, st);
1262         if (!NT_STATUS_IS_OK(status)) {
1263                 return ndr_push_error(push, NDR_ERR_VALIDATE, 
1264                                       "failed output validation push2 - %s",
1265                                       nt_errstr(status));
1266         }
1267
1268         blob2 = ndr_push_blob(push);
1269
1270         if (!data_blob_equal(&blob, &blob2)) {
1271                 DEBUG(3,("original:\n"));
1272                 dump_data(3, blob.data, blob.length);
1273                 DEBUG(3,("secondary:\n"));
1274                 dump_data(3, blob2.data, blob2.length);
1275                 return ndr_push_error(push, NDR_ERR_VALIDATE, 
1276                                       "failed output validation data - %s",
1277                                       nt_errstr(status));
1278         }
1279
1280         /* this checks the printed forms of the two structures, which effectively
1281            tests all of the value() attributes */
1282         s1 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE", 
1283                                        NDR_OUT, struct_ptr);
1284         s2 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE", 
1285                                        NDR_OUT, st);
1286         if (strcmp(s1, s2) != 0) {
1287 #if 1
1288                 printf("VALIDATE ERROR:\nWIRE:\n%s\n GEN:\n%s\n", s1, s2);
1289 #else
1290                 /* this is sometimes useful */
1291                 printf("VALIDATE ERROR\n");
1292                 file_save("wire.dat", s1, strlen(s1));
1293                 file_save("gen.dat", s2, strlen(s2));
1294                 system("diff -u wire.dat gen.dat");
1295 #endif
1296         }
1297
1298         return NT_STATUS_OK;
1299 }
1300
1301
1302 /*
1303  send a rpc request given a dcerpc_call structure 
1304  */
1305 struct rpc_request *dcerpc_ndr_request_send(struct dcerpc_pipe *p,
1306                                                 const struct GUID *object,
1307                                                 const struct dcerpc_interface_table *table,
1308                                                 uint32_t opnum, 
1309                                                 TALLOC_CTX *mem_ctx, 
1310                                                 void *r)
1311 {
1312         const struct dcerpc_interface_call *call;
1313         struct ndr_push *push;
1314         NTSTATUS status;
1315         DATA_BLOB request;
1316         struct rpc_request *req;
1317
1318         call = &table->calls[opnum];
1319
1320         /* setup for a ndr_push_* call */
1321         push = ndr_push_init_ctx(mem_ctx);
1322         if (!push) {
1323                 return NULL;
1324         }
1325
1326         if (p->conn->flags & DCERPC_PUSH_BIGENDIAN) {
1327                 push->flags |= LIBNDR_FLAG_BIGENDIAN;
1328         }
1329
1330         /* push the structure into a blob */
1331         status = call->ndr_push(push, NDR_IN, r);
1332         if (!NT_STATUS_IS_OK(status)) {
1333                 DEBUG(2,("Unable to ndr_push structure in dcerpc_ndr_request_send - %s\n",
1334                          nt_errstr(status)));
1335                 talloc_free(push);
1336                 return NULL;
1337         }
1338
1339         /* retrieve the blob */
1340         request = ndr_push_blob(push);
1341
1342         if (p->conn->flags & DCERPC_DEBUG_VALIDATE_IN) {
1343                 status = dcerpc_ndr_validate_in(p->conn, push, request, call->struct_size, 
1344                                                 call->ndr_push, call->ndr_pull);
1345                 if (!NT_STATUS_IS_OK(status)) {
1346                         DEBUG(2,("Validation failed in dcerpc_ndr_request_send - %s\n",
1347                                  nt_errstr(status)));
1348                         talloc_free(push);
1349                         return NULL;
1350                 }
1351         }
1352
1353         DEBUG(10,("rpc request data:\n"));
1354         dump_data(10, request.data, request.length);
1355
1356         /* make the actual dcerpc request */
1357         req = dcerpc_request_send(p, object, opnum, table->calls[opnum].async,
1358                                   &request);
1359
1360         if (req != NULL) {
1361                 req->ndr.table = table;
1362                 req->ndr.opnum = opnum;
1363                 req->ndr.struct_ptr = r;
1364                 req->ndr.mem_ctx = mem_ctx;
1365         }
1366
1367         talloc_free(push);
1368
1369         return req;
1370 }
1371
1372 /*
1373   receive the answer from a dcerpc_ndr_request_send()
1374 */
1375 NTSTATUS dcerpc_ndr_request_recv(struct rpc_request *req)
1376 {
1377         struct dcerpc_pipe *p = req->p;
1378         NTSTATUS status;
1379         DATA_BLOB response;
1380         struct ndr_pull *pull;
1381         uint_t flags;
1382         TALLOC_CTX *mem_ctx = req->ndr.mem_ctx;
1383         void *r = req->ndr.struct_ptr;
1384         uint32_t opnum = req->ndr.opnum;
1385         const struct dcerpc_interface_table *table = req->ndr.table;
1386         const struct dcerpc_interface_call *call = &table->calls[opnum];
1387
1388         /* make sure the recv code doesn't free the request, as we
1389            need to grab the flags element before it is freed */
1390         talloc_increase_ref_count(req);
1391
1392         status = dcerpc_request_recv(req, mem_ctx, &response);
1393         if (!NT_STATUS_IS_OK(status)) {
1394                 return status;
1395         }
1396
1397         flags = req->flags;
1398
1399         /* prepare for ndr_pull_* */
1400         pull = ndr_pull_init_flags(p->conn, &response, mem_ctx);
1401         if (!pull) {
1402                 talloc_free(req);
1403                 return NT_STATUS_NO_MEMORY;
1404         }
1405
1406         if (pull->data) {
1407                 pull->data = talloc_steal(pull, pull->data);
1408         }
1409         talloc_free(req);
1410
1411         if (flags & DCERPC_PULL_BIGENDIAN) {
1412                 pull->flags |= LIBNDR_FLAG_BIGENDIAN;
1413         }
1414
1415         DEBUG(10,("rpc reply data:\n"));
1416         dump_data(10, pull->data, pull->data_size);
1417
1418         /* pull the structure from the blob */
1419         status = call->ndr_pull(pull, NDR_OUT, r);
1420         if (!NT_STATUS_IS_OK(status)) {
1421                 dcerpc_log_packet(table, opnum, NDR_OUT, 
1422                                   &response);
1423                 return status;
1424         }
1425
1426         if (p->conn->flags & DCERPC_DEBUG_VALIDATE_OUT) {
1427                 status = dcerpc_ndr_validate_out(p->conn, pull, r, call->struct_size, 
1428                                                  call->ndr_push, call->ndr_pull, 
1429                                                  call->ndr_print);
1430                 if (!NT_STATUS_IS_OK(status)) {
1431                         dcerpc_log_packet(table, opnum, NDR_OUT, 
1432                                   &response);
1433                         return status;
1434                 }
1435         }
1436
1437         if (pull->offset != pull->data_size) {
1438                 DEBUG(0,("Warning! ignoring %d unread bytes in rpc packet!\n", 
1439                          pull->data_size - pull->offset));
1440                 /* we used to return NT_STATUS_INFO_LENGTH_MISMATCH here,
1441                    but it turns out that early versions of NT
1442                    (specifically NT3.1) add junk onto the end of rpc
1443                    packets, so if we want to interoperate at all with
1444                    those versions then we need to ignore this error */
1445         }
1446
1447         /* TODO: make pull context independent from the output mem_ctx and free the pull context */
1448
1449         return NT_STATUS_OK;
1450 }
1451
1452
1453 /*
1454   a useful helper function for synchronous rpc requests 
1455
1456   this can be used when you have ndr push/pull functions in the
1457   standard format
1458 */
1459 NTSTATUS dcerpc_ndr_request(struct dcerpc_pipe *p,
1460                             const struct GUID *object,
1461                             const struct dcerpc_interface_table *table,
1462                             uint32_t opnum, 
1463                             TALLOC_CTX *mem_ctx, 
1464                             void *r)
1465 {
1466         struct rpc_request *req;
1467
1468         req = dcerpc_ndr_request_send(p, object, table, opnum, mem_ctx, r);
1469         if (req == NULL) {
1470                 return NT_STATUS_NO_MEMORY;
1471         }
1472
1473         return dcerpc_ndr_request_recv(req);
1474 }
1475
1476
1477 /*
1478   a useful function for retrieving the server name we connected to
1479 */
1480 const char *dcerpc_server_name(struct dcerpc_pipe *p)
1481 {
1482         if (!p->conn->transport.peer_name) {
1483                 return "";
1484         }
1485         return p->conn->transport.peer_name(p->conn);
1486 }
1487
1488
1489 /*
1490   get the dcerpc auth_level for a open connection
1491 */
1492 uint32_t dcerpc_auth_level(struct dcerpc_connection *c) 
1493 {
1494         uint8_t auth_level;
1495
1496         if (c->flags & DCERPC_SEAL) {
1497                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1498         } else if (c->flags & DCERPC_SIGN) {
1499                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1500         } else if (c->flags & DCERPC_CONNECT) {
1501                 auth_level = DCERPC_AUTH_LEVEL_CONNECT;
1502         } else {
1503                 auth_level = DCERPC_AUTH_LEVEL_NONE;
1504         }
1505         return auth_level;
1506 }
1507
1508 /*
1509   Receive an alter reply from the transport
1510 */
1511 static void dcerpc_alter_recv_handler(struct rpc_request *req,
1512                                       DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
1513 {
1514         struct composite_context *c;
1515         struct dcerpc_pipe *recv_pipe;
1516
1517         c = talloc_get_type(req->async.private, struct composite_context);
1518         recv_pipe = talloc_get_type(c->private_data, struct dcerpc_pipe);
1519
1520         if (pkt->ptype == DCERPC_PKT_ALTER_RESP &&
1521             pkt->u.alter_resp.num_results == 1 &&
1522             pkt->u.alter_resp.ctx_list[0].result != 0) {
1523                 DEBUG(2,("dcerpc: alter_resp failed - reason %d\n", 
1524                          pkt->u.alter_resp.ctx_list[0].reason));
1525                 composite_error(c, dcerpc_map_reason(pkt->u.alter_resp.ctx_list[0].reason));
1526                 return;
1527         }
1528
1529         if (pkt->ptype != DCERPC_PKT_ALTER_RESP ||
1530             pkt->u.alter_resp.num_results == 0 ||
1531             pkt->u.alter_resp.ctx_list[0].result != 0) {
1532                 composite_error(c, NT_STATUS_UNSUCCESSFUL);
1533                 return;
1534         }
1535
1536         /* the alter_resp might contain a reply set of credentials */
1537         if (recv_pipe->conn->security_state.auth_info &&
1538             pkt->u.alter_resp.auth_info.length) {
1539                 c->status = ndr_pull_struct_blob(
1540                         &pkt->u.alter_resp.auth_info, recv_pipe,
1541                         recv_pipe->conn->security_state.auth_info,
1542                         (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
1543                 if (!composite_is_ok(c)) return;
1544         }
1545
1546         composite_done(c);
1547 }
1548
1549 /* 
1550    send a dcerpc alter_context request
1551 */
1552 struct composite_context *dcerpc_alter_context_send(struct dcerpc_pipe *p, 
1553                                                     TALLOC_CTX *mem_ctx,
1554                                                     const struct dcerpc_syntax_id *syntax,
1555                                                     const struct dcerpc_syntax_id *transfer_syntax)
1556 {
1557         struct composite_context *c;
1558         struct ncacn_packet pkt;
1559         DATA_BLOB blob;
1560         struct rpc_request *req;
1561
1562         /* we allocate a dcerpc_request so we can be in the same
1563            request queue as normal requests, but most of the request
1564            fields are not used as there is no call id */
1565         req = talloc_zero(mem_ctx, struct rpc_request);
1566         if (req == NULL) return NULL;
1567
1568         c = talloc_zero(req, struct composite_context);
1569         if (c == NULL) return NULL;
1570
1571         c->state = COMPOSITE_STATE_IN_PROGRESS;
1572         c->private_data = p;
1573         c->event_ctx = p->conn->event_ctx;
1574
1575         p->syntax = *syntax;
1576         p->transfer_syntax = *transfer_syntax;
1577
1578         init_ncacn_hdr(p->conn, &pkt);
1579
1580         pkt.ptype = DCERPC_PKT_ALTER;
1581         pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1582         pkt.call_id = p->conn->call_id;
1583         pkt.auth_length = 0;
1584
1585         pkt.u.alter.max_xmit_frag = 5840;
1586         pkt.u.alter.max_recv_frag = 5840;
1587         pkt.u.alter.assoc_group_id = 0;
1588         pkt.u.alter.num_contexts = 1;
1589         pkt.u.alter.ctx_list = talloc_array(mem_ctx,
1590                                                    struct dcerpc_ctx_list, 1);
1591         if (pkt.u.alter.ctx_list == NULL) {
1592                 c->status = NT_STATUS_NO_MEMORY;
1593                 goto failed;
1594         }
1595         pkt.u.alter.ctx_list[0].context_id = p->context_id;
1596         pkt.u.alter.ctx_list[0].num_transfer_syntaxes = 1;
1597         pkt.u.alter.ctx_list[0].abstract_syntax = p->syntax;
1598         pkt.u.alter.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
1599         pkt.u.alter.auth_info = data_blob(NULL, 0);
1600
1601         /* construct the NDR form of the packet */
1602         c->status = ncacn_push_auth(&blob, mem_ctx, &pkt,
1603                                     p->conn->security_state.auth_info);
1604         if (!NT_STATUS_IS_OK(c->status)) {
1605                 goto failed;
1606         }
1607
1608         p->conn->transport.recv_data = dcerpc_recv_data;
1609
1610         req->state = RPC_REQUEST_PENDING;
1611         req->call_id = pkt.call_id;
1612         req->async.private = c;
1613         req->async.callback = dcerpc_composite_fail;
1614         req->p = p;
1615         req->recv_handler = dcerpc_alter_recv_handler;
1616
1617         DLIST_ADD_END(p->conn->pending, req, struct rpc_request *);
1618
1619         c->status = p->conn->transport.send_request(p->conn, &blob, True);
1620         if (!NT_STATUS_IS_OK(c->status)) {
1621                 goto failed;
1622         }
1623
1624         event_add_timed(c->event_ctx, req,
1625                         timeval_current_ofs(DCERPC_REQUEST_TIMEOUT, 0),
1626                         dcerpc_timeout_handler, req);
1627
1628         return c;
1629
1630  failed:
1631         composite_error(c, c->status);
1632         return c;
1633 }
1634
1635 NTSTATUS dcerpc_alter_context_recv(struct composite_context *ctx)
1636 {
1637         NTSTATUS result = composite_wait(ctx);
1638         talloc_free(ctx);
1639         return result;
1640 }
1641
1642 /* 
1643    send a dcerpc alter_context request
1644 */
1645 NTSTATUS dcerpc_alter_context(struct dcerpc_pipe *p, 
1646                               TALLOC_CTX *mem_ctx,
1647                               const struct dcerpc_syntax_id *syntax,
1648                               const struct dcerpc_syntax_id *transfer_syntax)
1649 {
1650         struct composite_context *creq;
1651         creq = dcerpc_alter_context_send(p, mem_ctx, syntax, transfer_syntax);
1652         return dcerpc_alter_context_recv(creq);
1653 }