r3323: more warning reductions
[bbaumbach/samba-autobuild/.git] / source4 / rpc_server / dcerpc_server.c
index e5c4c120a5359a41189e1f3931827ac1ffeb53d0..59ea8321ff49697c630c93a0e3a1cc9eadfd1caa 100644 (file)
 /*
   see if two endpoints match
 */
-static BOOL endpoints_match(const struct dcesrv_ep_description *ep1,
-                                                       const struct dcesrv_ep_description *ep2)
+static BOOL endpoints_match(const struct dcerpc_binding *ep1,
+                           const struct dcerpc_binding *ep2)
 {
-       if (ep1->type != ep2->type) {
+       if (ep1->transport != ep2->transport) {
                return False;
        }
 
-       switch (ep1->type) {
-               case ENDPOINT_SMB:
-                       if (strcasecmp(ep1->info.smb_pipe,ep2->info.smb_pipe)==0) {
-                               return True;
-                       }                       
-                       break;
-               case ENDPOINT_TCP:
-                       if (ep1->info.tcp_port == ep2->info.tcp_port) {
-                               return True;
-                       }
-                       break;
+       if (!ep1->endpoint || !ep2->endpoint) {
+               return ep1->endpoint == ep2->endpoint;
        }
 
-       return False;
+       if (strcasecmp(ep1->endpoint, ep2->endpoint) != 0) 
+               return False;
+
+       return True;
 }
 
 /*
   find an endpoint in the dcesrv_context
 */
 static struct dcesrv_endpoint *find_endpoint(struct dcesrv_context *dce_ctx,
-                                                      const struct dcesrv_ep_description *ep_description)
+                                            const struct dcerpc_binding *ep_description)
 {
        struct dcesrv_endpoint *ep;
        for (ep=dce_ctx->endpoint_list; ep; ep=ep->next) {
@@ -100,7 +94,7 @@ static const struct dcesrv_interface *find_interface(const struct dcesrv_endpoin
   see if a uuid and if_version match to an interface
 */
 static BOOL interface_match_by_uuid(const struct dcesrv_interface *iface,
-                                                       const char *uuid, uint32_t if_version)
+                                   const char *uuid, uint32_t if_version)
 {
        if (iface->ndr->if_version != if_version) {
                return False;
@@ -117,7 +111,7 @@ static BOOL interface_match_by_uuid(const struct dcesrv_interface *iface,
   find the interface operations on an endpoint by uuid
 */
 static const struct dcesrv_interface *find_interface_by_uuid(const struct dcesrv_endpoint *endpoint,
-                                                      const char *uuid, uint32_t if_version)
+                                                            const char *uuid, uint32_t if_version)
 {
        struct dcesrv_if_list *ifl;
        for (ifl=endpoint->interface_list; ifl; ifl=ifl->next) {
@@ -150,37 +144,28 @@ NTSTATUS dcesrv_interface_register(struct dcesrv_context *dce_ctx,
                                   const struct dcesrv_interface *iface,
                                   const struct security_descriptor *sd)
 {
-       struct dcesrv_ep_description ep_description;
        struct dcesrv_endpoint *ep;
        struct dcesrv_if_list *ifl;
-       BOOL tcp;
+       struct dcerpc_binding binding;
        BOOL add_ep = False;
+       NTSTATUS status;
+       
+       status = dcerpc_parse_binding(dce_ctx, ep_name, &binding);
 
-       tcp = (strncasecmp(ep_name, "TCP-", 4) == 0);
-
-       if (tcp) {
-               ep_description.type = ENDPOINT_TCP;
-               ep_description.info.tcp_port = atoi(ep_name+4);
-       } else {
-               ep_description.type = ENDPOINT_SMB;
-               ep_description.info.smb_pipe = ep_name;
+       if (NT_STATUS_IS_ERR(status)) {
+               DEBUG(0, ("Trouble parsing binding string '%s'\n", ep_name));
+               return status;
        }
 
        /* check if this endpoint exists
         */
-       if ((ep=find_endpoint(dce_ctx, &ep_description))==NULL) {
-               ep = talloc(dce_ctx->mem_ctx, sizeof(*ep));
+       if ((ep=find_endpoint(dce_ctx, &binding))==NULL) {
+               ep = talloc_p(dce_ctx, struct dcesrv_endpoint);
                if (!ep) {
                        return NT_STATUS_NO_MEMORY;
                }
                ZERO_STRUCTP(ep);
-               if (tcp) {
-                       ep->ep_description.type = ENDPOINT_TCP;
-                       ep->ep_description.info.tcp_port = atoi(ep_name+4);
-               } else {
-                       ep->ep_description.type = ENDPOINT_SMB;
-                       ep->ep_description.info.smb_pipe = smb_xstrdup(ep_name);
-               }
+               ep->ep_description = binding;
                add_ep = True;
        }
 
@@ -192,7 +177,7 @@ NTSTATUS dcesrv_interface_register(struct dcesrv_context *dce_ctx,
        }
 
        /* talloc a new interface list element */
-       ifl = talloc(dce_ctx->mem_ctx, sizeof(*ifl));
+       ifl = talloc_p(dce_ctx, struct dcesrv_if_list);
        if (!ifl) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -208,7 +193,7 @@ NTSTATUS dcesrv_interface_register(struct dcesrv_context *dce_ctx,
                 * we try to set it
                 */
                if (ep->sd == NULL) {
-                       ep->sd = copy_security_descriptor(dce_ctx->mem_ctx, sd);
+                       ep->sd = copy_security_descriptor(dce_ctx, sd);
                }
 
                /* if now there's no security descriptor given on the endpoint
@@ -239,6 +224,58 @@ NTSTATUS dcesrv_interface_register(struct dcesrv_context *dce_ctx,
        return NT_STATUS_OK;
 }
 
+static NTSTATUS dcesrv_inherited_session_key(struct dcesrv_connection *p,
+                                             DATA_BLOB *session_key)
+{
+       if (p->auth_state.session_info->session_key.length) {
+               *session_key = p->auth_state.session_info->session_key;
+               return NT_STATUS_OK;
+       }
+       return NT_STATUS_NO_USER_SESSION_KEY;
+}
+
+NTSTATUS dcesrv_generic_session_key(struct dcesrv_connection *p,
+                                   DATA_BLOB *session_key)
+{
+       /* this took quite a few CPU cycles to find ... */
+       session_key->data = discard_const_p(char, "SystemLibraryDTC");
+       session_key->length = 16;
+       return NT_STATUS_OK;
+}
+
+/*
+  fetch the user session key - may be default (above) or the SMB session key
+*/
+NTSTATUS dcesrv_fetch_session_key(struct dcesrv_connection *p,
+                                 DATA_BLOB *session_key)
+{
+       return p->auth_state.session_key(p, session_key);
+}
+
+
+/*
+  destroy a link to an endpoint
+*/
+static int dcesrv_endpoint_destructor(void *ptr)
+{
+       struct dcesrv_connection *p = ptr;
+       if (p->iface) {
+               p->iface->unbind(p, p->iface);
+       }
+
+       /* destroy any handles */
+       while (p->handles) {
+               dcesrv_handle_destroy(p, p->handles);
+       }
+
+       if (p->auth_state.gensec_security) {
+               gensec_end(&p->auth_state.gensec_security);
+       }
+
+       return 0;
+}
+
+
 /*
   connect to a dcerpc endpoint
 */
@@ -246,21 +283,12 @@ NTSTATUS dcesrv_endpoint_connect(struct dcesrv_context *dce_ctx,
                                 const struct dcesrv_endpoint *ep,
                                 struct dcesrv_connection **p)
 {
-       TALLOC_CTX *mem_ctx;
-
-       mem_ctx = talloc_init("dcesrv_endpoint_connect");
-       if (!mem_ctx) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       *p = talloc_p(mem_ctx, struct dcesrv_connection);
+       *p = talloc_p(dce_ctx, struct dcesrv_connection);
        if (! *p) {
-               talloc_destroy(mem_ctx);
                return NT_STATUS_NO_MEMORY;
        }
 
        (*p)->dce_ctx = dce_ctx;
-       (*p)->mem_ctx = mem_ctx;
        (*p)->endpoint = ep;
        (*p)->iface = NULL;
        (*p)->private = NULL;
@@ -271,6 +299,10 @@ NTSTATUS dcesrv_endpoint_connect(struct dcesrv_context *dce_ctx,
        (*p)->auth_state.auth_info = NULL;
        (*p)->auth_state.gensec_security = NULL;
        (*p)->auth_state.session_info = NULL;
+       (*p)->auth_state.session_key = dcesrv_generic_session_key;
+       (*p)->srv_conn = NULL;
+
+       talloc_set_destructor(*p, dcesrv_endpoint_destructor);
 
        return NT_STATUS_OK;
 }
@@ -279,7 +311,7 @@ NTSTATUS dcesrv_endpoint_connect(struct dcesrv_context *dce_ctx,
   search and connect to a dcerpc endpoint
 */
 NTSTATUS dcesrv_endpoint_search_connect(struct dcesrv_context *dce_ctx,
-                                       const struct dcesrv_ep_description *ep_description,
+                                       const struct dcerpc_binding *ep_description,
                                        struct auth_session_info *session_info,
                                        struct dcesrv_connection **dce_conn_p)
 {
@@ -299,6 +331,7 @@ NTSTATUS dcesrv_endpoint_search_connect(struct dcesrv_context *dce_ctx,
 
        session_info->refcount++;
        (*dce_conn_p)->auth_state.session_info = session_info;
+       (*dce_conn_p)->auth_state.session_key = dcesrv_inherited_session_key;
 
        /* TODO: check security descriptor of the endpoint here 
         *       if it's a smb named pipe
@@ -309,31 +342,6 @@ NTSTATUS dcesrv_endpoint_search_connect(struct dcesrv_context *dce_ctx,
 }
 
 
-/*
-  disconnect a link to an endpoint
-*/
-void dcesrv_endpoint_disconnect(struct dcesrv_connection *p)
-{
-       if (p->iface) {
-               p->iface->unbind(p, p->iface);
-       }
-
-       /* destroy any handles */
-       while (p->handles) {
-               dcesrv_handle_destroy(p, p->handles);
-       }
-
-       if (p->auth_state.gensec_security) {
-               gensec_end(&p->auth_state.gensec_security);
-       }
-
-       if (p->auth_state.session_info) {
-               free_session_info(&p->auth_state.session_info);
-       }
-
-       talloc_destroy(p->mem_ctx);
-}
-
 static void dcesrv_init_hdr(struct dcerpc_packet *pkt)
 {
        pkt->rpc_vers = 5;
@@ -368,12 +376,12 @@ static NTSTATUS dcesrv_fault(struct dcesrv_call_state *call, uint32_t fault_code
        pkt.u.fault.cancel_count = 0;
        pkt.u.fault.status = fault_code;
 
-       rep = talloc_p(call->mem_ctx, struct dcesrv_call_reply);
+       rep = talloc_p(call, struct dcesrv_call_reply);
        if (!rep) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       status = dcerpc_push_auth(&rep->data, call->mem_ctx, &pkt, NULL);
+       status = dcerpc_push_auth(&rep->data, call, &pkt, NULL);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -405,12 +413,12 @@ static NTSTATUS dcesrv_bind_nak(struct dcesrv_call_state *call, uint32_t reason)
        pkt.u.bind_nak.reject_reason = reason;
        pkt.u.bind_nak.num_versions = 0;
 
-       rep = talloc_p(call->mem_ctx, struct dcesrv_call_reply);
+       rep = talloc_p(call, struct dcesrv_call_reply);
        if (!rep) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       status = dcerpc_push_auth(&rep->data, call->mem_ctx, &pkt, NULL);
+       status = dcerpc_push_auth(&rep->data, call, &pkt, NULL);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -442,13 +450,13 @@ static NTSTATUS dcesrv_bind(struct dcesrv_call_state *call)
        }
 
        if_version = call->pkt.u.bind.ctx_list[0].abstract_syntax.if_version;
-       uuid = GUID_string(call->mem_ctx, &call->pkt.u.bind.ctx_list[0].abstract_syntax.uuid);
+       uuid = GUID_string(call, &call->pkt.u.bind.ctx_list[0].abstract_syntax.uuid);
        if (!uuid) {
                return dcesrv_bind_nak(call, 0);
        }
 
        transfer_syntax_version = call->pkt.u.bind.ctx_list[0].transfer_syntaxes[0].if_version;
-       transfer_syntax = GUID_string(call->mem_ctx
+       transfer_syntax = GUID_string(call, 
                                      &call->pkt.u.bind.ctx_list[0].transfer_syntaxes[0].uuid);
        if (!transfer_syntax ||
            strcasecmp(NDR_GUID, transfer_syntax) != 0 ||
@@ -485,13 +493,14 @@ static NTSTATUS dcesrv_bind(struct dcesrv_call_state *call)
        pkt.u.bind_ack.max_recv_frag = 0x2000;
        pkt.u.bind_ack.assoc_group_id = call->pkt.u.bind.assoc_group_id;
        if (call->conn->iface && call->conn->iface->ndr) {
-               pkt.u.bind_ack.secondary_address = talloc_asprintf(call->mem_ctx, "\\PIPE\\%s", 
+               /* FIXME: Use pipe name as specified by endpoint instead of interface name */
+               pkt.u.bind_ack.secondary_address = talloc_asprintf(call, "\\PIPE\\%s", 
                                                                   call->conn->iface->ndr->name);
        } else {
                pkt.u.bind_ack.secondary_address = "";
        }
        pkt.u.bind_ack.num_results = 1;
-       pkt.u.bind_ack.ctx_list = talloc_p(call->mem_ctx, struct dcerpc_ack_ctx);
+       pkt.u.bind_ack.ctx_list = talloc_p(call, struct dcerpc_ack_ctx);
        if (!pkt.u.bind_ack.ctx_list) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -508,17 +517,17 @@ static NTSTATUS dcesrv_bind(struct dcesrv_call_state *call)
        if (call->conn->iface) {
                status = call->conn->iface->bind(call, call->conn->iface);
                if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(2,("Request for dcerpc interface %s/%d rejected\n", uuid, if_version));
-                       return status;
+                       DEBUG(2,("Request for dcerpc interface %s/%d rejected: %s\n", uuid, if_version, nt_errstr(status)));
+                       return dcesrv_bind_nak(call, 0);
                }
        }
 
-       rep = talloc_p(call->mem_ctx, struct dcesrv_call_reply);
+       rep = talloc_p(call, struct dcesrv_call_reply);
        if (!rep) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       status = dcerpc_push_auth(&rep->data, call->mem_ctx, &pkt, 
+       status = dcerpc_push_auth(&rep->data, call, &pkt, 
                                  call->conn->auth_state.auth_info);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -543,7 +552,7 @@ static NTSTATUS dcesrv_auth3(struct dcesrv_call_state *call)
                return dcesrv_fault(call, DCERPC_FAULT_OTHER);
        }
 
-       talloc_destroy(call->mem_ctx);
+       talloc_free(call);
 
        /* we don't send a reply to a auth3 request, except by a
           fault */
@@ -575,12 +584,12 @@ static NTSTATUS dcesrv_request(struct dcesrv_call_state *call)
                return dcesrv_fault(call, DCERPC_FAULT_OP_RNG_ERROR);
        }
 
-       pull = ndr_pull_init_blob(&call->pkt.u.request.stub_and_verifier, call->mem_ctx);
+       pull = ndr_pull_init_blob(&call->pkt.u.request.stub_and_verifier, call);
        if (!pull) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       r = talloc(call->mem_ctx, call->conn->iface->ndr->calls[opnum].struct_size);
+       r = talloc(call, call->conn->iface->ndr->calls[opnum].struct_size);
        if (!r) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -597,10 +606,16 @@ static NTSTATUS dcesrv_request(struct dcesrv_call_state *call)
                return dcesrv_fault(call, DCERPC_FAULT_NDR);
        }
 
+       if (pull->offset != pull->data_size) {
+               DEBUG(3,("Warning: %d extra bytes in incoming RPC request\n", 
+                        pull->data_size - pull->offset));
+               dump_data(10, pull->data+pull->offset, pull->data_size - pull->offset);
+       }
+
        call->fault_code = 0;
 
        /* call the dispatch function */
-       status = call->conn->iface->dispatch(call, call->mem_ctx, r);
+       status = call->conn->iface->dispatch(call, call, r);
        if (!NT_STATUS_IS_OK(status)) {
                dcerpc_log_packet(call->conn->iface->ndr, opnum, NDR_IN, 
                                  &call->pkt.u.request.stub_and_verifier);
@@ -608,11 +623,16 @@ static NTSTATUS dcesrv_request(struct dcesrv_call_state *call)
        }
 
        /* form the reply NDR */
-       push = ndr_push_init_ctx(call->mem_ctx);
+       push = ndr_push_init_ctx(call);
        if (!push) {
                return NT_STATUS_NO_MEMORY;
        }
 
+       /* carry over the pointer count to the reply in case we are
+          using full pointer. See NDR specification for full
+          pointers */
+       push->ptr_count = pull->ptr_count;
+
        if (lp_rpc_big_endian()) {
                push->flags |= LIBNDR_FLAG_BIGENDIAN;
        }
@@ -631,7 +651,7 @@ static NTSTATUS dcesrv_request(struct dcesrv_call_state *call)
                struct dcesrv_call_reply *rep;
                struct dcerpc_packet pkt;
 
-               rep = talloc_p(call->mem_ctx, struct dcesrv_call_reply);
+               rep = talloc_p(call, struct dcesrv_call_reply);
                if (!rep) {
                        return NT_STATUS_NO_MEMORY;
                }
@@ -717,32 +737,25 @@ static void dce_partial_advance(struct dcesrv_connection *dce_conn, uint32_t off
 NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
 {
        struct ndr_pull *ndr;
-       TALLOC_CTX *mem_ctx;
        NTSTATUS status;
        struct dcesrv_call_state *call;
        DATA_BLOB blob;
 
-       mem_ctx = talloc_init("dcesrv_input");
-       if (!mem_ctx) {
-               return NT_STATUS_NO_MEMORY;
-       }
-       call = talloc_p(mem_ctx, struct dcesrv_call_state);
+       call = talloc_p(dce_conn, struct dcesrv_call_state);
        if (!call) {
-               talloc_free(dce_conn->mem_ctx, dce_conn->partial_input.data);
-               talloc_destroy(mem_ctx);
+               talloc_free(dce_conn->partial_input.data);
                return NT_STATUS_NO_MEMORY;
        }
-       call->mem_ctx = mem_ctx;
        call->conn = dce_conn;
        call->replies = NULL;
 
        blob = dce_conn->partial_input;
        blob.length = dcerpc_get_frag_length(&blob);
 
-       ndr = ndr_pull_init_blob(&blob, mem_ctx);
+       ndr = ndr_pull_init_blob(&blob, call);
        if (!ndr) {
-               talloc_free(dce_conn->mem_ctx, dce_conn->partial_input.data);
-               talloc_destroy(mem_ctx);
+               talloc_free(dce_conn->partial_input.data);
+               talloc_free(call);
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -752,20 +765,21 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
 
        status = ndr_pull_dcerpc_packet(ndr, NDR_SCALARS|NDR_BUFFERS, &call->pkt);
        if (!NT_STATUS_IS_OK(status)) {
-               talloc_free(dce_conn->mem_ctx, dce_conn->partial_input.data);
-               talloc_destroy(mem_ctx);
+               talloc_free(dce_conn->partial_input.data);
+               talloc_free(call);
                return status;
        }
 
-       dce_partial_advance(dce_conn, blob.length);
-
        /* we have to check the signing here, before combining the
           pdus */
        if (call->pkt.ptype == DCERPC_PKT_REQUEST &&
-           !dcesrv_auth_request(call)) {
-               return dcesrv_fault(call, DCERPC_FAULT_OTHER);          
+           !dcesrv_auth_request(call, &blob)) {
+               dce_partial_advance(dce_conn, blob.length);
+               return dcesrv_fault(call, DCERPC_FAULT_LOGON_FAILURE);          
        }
 
+       dce_partial_advance(dce_conn, blob.length);
+
        /* see if this is a continued packet */
        if (!(call->pkt.pfc_flags & DCERPC_PFC_FLAG_FIRST)) {
                struct dcesrv_call_state *call2 = call;
@@ -795,8 +809,7 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
                }
 
                call->pkt.u.request.stub_and_verifier.data = 
-                       talloc_realloc(call->mem_ctx,
-                                      call->pkt.u.request.stub_and_verifier.data, alloc_size);
+                       talloc_realloc(call, call->pkt.u.request.stub_and_verifier.data, alloc_size);
                if (!call->pkt.u.request.stub_and_verifier.data) {
                        return dcesrv_fault(call2, DCERPC_FAULT_OTHER);
                }
@@ -808,6 +821,8 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
                        call2->pkt.u.request.stub_and_verifier.length;
 
                call->pkt.pfc_flags |= (call2->pkt.pfc_flags & DCERPC_PFC_FLAG_LAST);
+
+               talloc_free(call2);
        }
 
        /* this may not be the last pdu in the chain - if its isn't then
@@ -836,7 +851,7 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
           it to the list of pending calls. We add it to the end to keep the call
           list in the order we will answer */
        if (!NT_STATUS_IS_OK(status)) {
-               talloc_destroy(mem_ctx);
+               talloc_free(call);
        }
 
        return status;
@@ -851,34 +866,9 @@ NTSTATUS dcesrv_input(struct dcesrv_connection *dce_conn, const DATA_BLOB *data)
 {
        NTSTATUS status;
 
-       /* handle the very common case that the input contains a full packet and there
-          is no partial packet pending. In this case we can avoid a copy of the
-          data */
-       if (dce_conn->partial_input.length == 0) {
-               dce_conn->partial_input = *data;
-               /* make sure that dce_partial_advance doesn't free this data */
-               dce_conn->partial_input.free = NULL;
-               while (dce_full_packet(&dce_conn->partial_input)) {
-                       status = dcesrv_input_process(dce_conn);
-                       if (!NT_STATUS_IS_OK(status)) {
-                               return status;
-                       }
-               }
-               if (dce_conn->partial_input.length) {
-                       /* there was some data left over. We have to copy this
-                          as the caller may free the data */
-                       dce_conn->partial_input = 
-                               data_blob(dce_conn->partial_input.data,
-                                         dce_conn->partial_input.length);
-                       if (!dce_conn->partial_input.data) {
-                               return NT_STATUS_NO_MEMORY;
-                       }
-               }
-               return NT_STATUS_OK;
-       }
-
-       dce_conn->partial_input.data = Realloc(dce_conn->partial_input.data,
-                                         dce_conn->partial_input.length + data->length);
+       dce_conn->partial_input.data = talloc_realloc(dce_conn,
+                                                     dce_conn->partial_input.data,
+                                                     dce_conn->partial_input.length + data->length);
        if (!dce_conn->partial_input.data) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -912,12 +902,11 @@ NTSTATUS dcesrv_input(struct dcesrv_connection *dce_conn, const DATA_BLOB *data)
 */
 NTSTATUS dcesrv_output(struct dcesrv_connection *dce_conn, 
                       void *private,
-                      ssize_t (*write_fn)(void *, const void *, size_t))
+                      ssize_t (*write_fn)(void *, DATA_BLOB *))
 {
        struct dcesrv_call_state *call;
        struct dcesrv_call_reply *rep;
        ssize_t nwritten;
-       NTSTATUS status = NT_STATUS_OK;
 
        call = dce_conn->call_list;
        if (!call || !call->replies) {
@@ -925,7 +914,7 @@ NTSTATUS dcesrv_output(struct dcesrv_connection *dce_conn,
        }
        rep = call->replies;
 
-       nwritten = write_fn(private, rep->data.data, rep->data.length);
+       nwritten = write_fn(private, &rep->data);
        if (nwritten == -1) {
                /* TODO: hmm, how do we cope with this? destroy the
                   connection perhaps? */
@@ -938,30 +927,28 @@ NTSTATUS dcesrv_output(struct dcesrv_connection *dce_conn,
        if (rep->data.length == 0) {
                /* we're done with this section of the call */
                DLIST_REMOVE(call->replies, rep);
-       } else {
-               status = STATUS_BUFFER_OVERFLOW;
        }
 
        if (call->replies == NULL) {
                /* we're done with the whole call */
                DLIST_REMOVE(dce_conn->call_list, call);
-               talloc_destroy(call->mem_ctx);
+               talloc_free(call);
        }
 
-       return status;
+       return NT_STATUS_OK;
 }
 
 
 /*
   write_fn() for dcesrv_output_blob()
 */
-static ssize_t dcesrv_output_blob_write_fn(void *private, const void *buf, size_t count)
+static ssize_t dcesrv_output_blob_write_fn(void *private, DATA_BLOB *out)
 {
        DATA_BLOB *blob = private;
-       if (count < blob->length) {
-               blob->length = count;
+       if (out->length < blob->length) {
+               blob->length = out->length;
        }
-       memcpy(blob->data, buf, blob->length);
+       memcpy(blob->data, out->data, blob->length);
        return blob->length;
 }
 
@@ -978,18 +965,17 @@ NTSTATUS dcesrv_output_blob(struct dcesrv_connection *dce_conn,
 /*
   initialise the dcerpc server context
 */
-NTSTATUS dcesrv_init_context(struct dcesrv_context *dce_ctx)
+NTSTATUS dcesrv_init_context(TALLOC_CTX *mem_ctx, struct dcesrv_context **dce_ctx)
 {
        int i;
        const char **endpoint_servers = lp_dcerpc_endpoint_servers();
 
-       dce_ctx->mem_ctx = talloc_init("struct dcesrv_context");
-       if (!dce_ctx->mem_ctx) {
-               DEBUG(3,("dcesrv_init_context: talloc_init failed\n"));
+       (*dce_ctx) = talloc_p(mem_ctx, struct dcesrv_context);
+       if (! *dce_ctx) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       dce_ctx->endpoint_list = NULL;
+       (*dce_ctx)->endpoint_list = NULL;
 
        if (!endpoint_servers) {
                DEBUG(3,("dcesrv_init_context: no endpoint servers configured\n"));
@@ -1006,7 +992,7 @@ NTSTATUS dcesrv_init_context(struct dcesrv_context *dce_ctx)
                        return NT_STATUS_UNSUCCESSFUL;
                }
 
-               ret = ep_server->init_server(dce_ctx, ep_server);
+               ret = ep_server->init_server(*dce_ctx, ep_server);
                if (!NT_STATUS_IS_OK(ret)) {
                        DEBUG(0,("dcesrv_init_context: failed to init endpoint server = '%s'\n", endpoint_servers[i]));
                        return ret;
@@ -1016,6 +1002,82 @@ NTSTATUS dcesrv_init_context(struct dcesrv_context *dce_ctx)
        return NT_STATUS_OK;
 }
 
+static void dcesrv_init(struct server_service *service, const struct model_ops *model_ops)
+{
+       struct dcesrv_context *dce_ctx;
+       int i;
+       const char **endpoint_servers = lp_dcerpc_endpoint_servers();
+
+       DEBUG(1,("dcesrv_init\n"));
+
+       if (!endpoint_servers) {
+               DEBUG(0,("dcesrv_init_context: no endpoint servers configured\n"));
+               return;
+       }
+
+       dce_ctx = talloc_p(service, struct dcesrv_context);
+       if (!dce_ctx) {
+               DEBUG(0,("talloc_p(mem_ctx, struct dcesrv_context) failed\n"));
+               return;
+       }
+
+       ZERO_STRUCTP(dce_ctx);
+       dce_ctx->endpoint_list  = NULL;
+
+       for (i=0;endpoint_servers[i];i++) {
+               NTSTATUS ret;
+               const struct dcesrv_endpoint_server *ep_server;
+               
+               ep_server = dcesrv_ep_server_byname(endpoint_servers[i]);
+               if (!ep_server) {
+                       DEBUG(0,("dcesrv_init_context: failed to find endpoint server = '%s'\n", endpoint_servers[i]));
+                       return;
+               }
+
+               ret = ep_server->init_server(dce_ctx, ep_server);
+               if (!NT_STATUS_IS_OK(ret)) {
+                       DEBUG(0,("dcesrv_init_context: failed to init endpoint server = '%s'\n", endpoint_servers[i]));
+                       return;
+               }
+       }
+
+       dcesrv_sock_init(service, model_ops, dce_ctx);
+
+       return; 
+}
+
+static void dcesrv_accept(struct server_connection *srv_conn)
+{
+       dcesrv_sock_accept(srv_conn);
+}
+
+static void dcesrv_recv(struct server_connection *srv_conn, time_t t, uint16_t flags)
+{
+       dcesrv_sock_recv(srv_conn, t, flags);
+}
+
+static void dcesrv_send(struct server_connection *srv_conn, time_t t, uint16_t flags)
+{
+       dcesrv_sock_send(srv_conn, t, flags);
+}
+
+static void dcesrv_idle(struct server_connection *srv_conn, time_t t)
+{
+       dcesrv_sock_idle(srv_conn, t);
+}
+
+static void dcesrv_close(struct server_connection *srv_conn, const char *reason)
+{
+       dcesrv_sock_close(srv_conn, reason);
+       return; 
+}
+
+static void dcesrv_exit(struct server_service *service, const char *reason)
+{
+       dcesrv_sock_exit(service, reason);
+       return; 
+}
+
 /* the list of currently registered DCERPC endpoint servers.
  */
 static struct {
@@ -1086,7 +1148,6 @@ const struct dcesrv_critical_sizes *dcerpc_module_version(void)
                sizeof(struct dcesrv_context),
                sizeof(struct dcesrv_endpoint),
                sizeof(struct dcesrv_endpoint_server),
-               sizeof(struct dcesrv_ep_description),
                sizeof(struct dcesrv_interface),
                sizeof(struct dcesrv_if_list),
                sizeof(struct dcesrv_connection),
@@ -1101,7 +1162,7 @@ const struct dcesrv_critical_sizes *dcerpc_module_version(void)
 /*
   initialise the DCERPC subsystem
 */
-BOOL dcesrv_init(void)
+BOOL subsystem_dcerpc_init(void)
 {
        NTSTATUS status;
 
@@ -1110,9 +1171,30 @@ BOOL dcesrv_init(void)
                return False;
        }
 
-       /* FIXME: Perhaps panic if a basic endpoint server, such as EPMAPER, fails to initialise? */
+       /* FIXME: Perhaps panic if a basic endpoint server, such as EPMAPPER, fails to initialise? */
        static_init_dcerpc;
 
        DEBUG(3,("DCERPC subsystem version %d initialised\n", DCERPC_MODULE_VERSION));
        return True;
 }
+
+static const struct server_service_ops dcesrv_ops = {
+       .name                   = "rpc",
+       .service_init           = dcesrv_init,
+       .accept_connection      = dcesrv_accept,
+       .recv_handler           = dcesrv_recv,
+       .send_handler           = dcesrv_send,
+       .idle_handler           = dcesrv_idle,
+       .close_connection       = dcesrv_close,
+       .service_exit           = dcesrv_exit,  
+};
+
+const struct server_service_ops *dcesrv_get_ops(void)
+{
+       return &dcesrv_ops;
+}
+
+NTSTATUS server_service_rpc_init(void)
+{
+       return NT_STATUS_OK;    
+}