source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "../libcli/auth/libcli_auth.h"
  22 #include "librpc/gen_ndr/cli_epmapper.h"
  23 #include "../librpc/gen_ndr/ndr_schannel.h"
  24 #include "../libcli/auth/schannel.h"
  25 #include "../libcli/auth/schannel_proto.h"
  26 #include "../libcli/auth/spnego.h"
  27
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_RPC_CLI
  30
  31 static const char *get_pipe_name_from_iface(
  32         TALLOC_CTX *mem_ctx, const struct ndr_interface_table *interface)
  33 {
  34         int i;
  35         const struct ndr_interface_string_array *ep = interface->endpoints;
  36         char *p;
  37
  38         for (i=0; i<ep->count; i++) {
  39                 if (strncmp(ep->names[i], "ncacn_np:[\\pipe\\", 16) == 0) {
  40                         break;
  41                 }
  42         }
  43         if (i == ep->count) {
  44                 return NULL;
  45         }
  46
  47         /*
  48          * extract the pipe name without \\pipe from for example
  49          * ncacn_np:[\\pipe\\epmapper]
  50          */
  51         p = strchr(ep->names[i]+15, ']');
  52         if (p == NULL) {
  53                 return "PIPE";
  54         }
  55         return talloc_strndup(mem_ctx, ep->names[i]+15, p - ep->names[i] - 15);
  56 }
  57
  58 static const struct ndr_interface_table **interfaces;
  59
  60 bool smb_register_ndr_interface(const struct ndr_interface_table *interface)
  61 {
  62         int num_interfaces = talloc_array_length(interfaces);
  63         const struct ndr_interface_table **tmp;
  64         int i;
  65
  66         for (i=0; i<num_interfaces; i++) {
  67                 if (ndr_syntax_id_equal(&interfaces[i]->syntax_id,
  68                                         &interface->syntax_id)) {
  69                         return true;
  70                 }
  71         }
  72
  73         tmp = talloc_realloc(NULL, interfaces,
  74                              const struct ndr_interface_table *,
  75                              num_interfaces + 1);
  76         if (tmp == NULL) {
  77                 DEBUG(1, ("smb_register_ndr_interface: talloc failed\n"));
  78                 return false;
  79         }
  80         interfaces = tmp;
  81         interfaces[num_interfaces] = interface;
  82         return true;
  83 }
  84
  85 static bool initialize_interfaces(void)
  86 {
  87         if (!smb_register_ndr_interface(&ndr_table_lsarpc)) {
  88                 return false;
  89         }
  90         if (!smb_register_ndr_interface(&ndr_table_dssetup)) {
  91                 return false;
  92         }
  93         if (!smb_register_ndr_interface(&ndr_table_samr)) {
  94                 return false;
  95         }
  96         if (!smb_register_ndr_interface(&ndr_table_netlogon)) {
  97                 return false;
  98         }
  99         if (!smb_register_ndr_interface(&ndr_table_srvsvc)) {
 100                 return false;
 101         }
 102         if (!smb_register_ndr_interface(&ndr_table_wkssvc)) {
 103                 return false;
 104         }
 105         if (!smb_register_ndr_interface(&ndr_table_winreg)) {
 106                 return false;
 107         }
 108         if (!smb_register_ndr_interface(&ndr_table_spoolss)) {
 109                 return false;
 110         }
 111         if (!smb_register_ndr_interface(&ndr_table_netdfs)) {
 112                 return false;
 113         }
 114         if (!smb_register_ndr_interface(&ndr_table_rpcecho)) {
 115                 return false;
 116         }
 117         if (!smb_register_ndr_interface(&ndr_table_initshutdown)) {
 118                 return false;
 119         }
 120         if (!smb_register_ndr_interface(&ndr_table_svcctl)) {
 121                 return false;
 122         }
 123         if (!smb_register_ndr_interface(&ndr_table_eventlog)) {
 124                 return false;
 125         }
 126         if (!smb_register_ndr_interface(&ndr_table_ntsvcs)) {
 127                 return false;
 128         }
 129         if (!smb_register_ndr_interface(&ndr_table_epmapper)) {
 130                 return false;
 131         }
 132         if (!smb_register_ndr_interface(&ndr_table_drsuapi)) {
 133                 return false;
 134         }
 135         return true;
 136 }
 137
 138 const struct ndr_interface_table *get_iface_from_syntax(
 139         const struct ndr_syntax_id *syntax)
 140 {
 141         int num_interfaces;
 142         int i;
 143
 144         if (interfaces == NULL) {
 145                 if (!initialize_interfaces()) {
 146                         return NULL;
 147                 }
 148         }
 149         num_interfaces = talloc_array_length(interfaces);
 150
 151         for (i=0; i<num_interfaces; i++) {
 152                 if (ndr_syntax_id_equal(&interfaces[i]->syntax_id, syntax)) {
 153                         return interfaces[i];
 154                 }
 155         }
 156
 157         return NULL;
 158 }
 159
 160 /****************************************************************************
 161  Return the pipe name from the interface.
 162  ****************************************************************************/
 163
 164 const char *get_pipe_name_from_syntax(TALLOC_CTX *mem_ctx,
 165                                       const struct ndr_syntax_id *syntax)
 166 {
 167         const struct ndr_interface_table *interface;
 168         char *guid_str;
 169         const char *result;
 170
 171         interface = get_iface_from_syntax(syntax);
 172         if (interface != NULL) {
 173                 result = get_pipe_name_from_iface(mem_ctx, interface);
 174                 if (result != NULL) {
 175                         return result;
 176                 }
 177         }
 178
 179         /*
 180          * Here we should ask \\epmapper, but for now our code is only
 181          * interested in the known pipes mentioned in pipe_names[]
 182          */
 183
 184         guid_str = GUID_string(talloc_tos(), &syntax->uuid);
 185         if (guid_str == NULL) {
 186                 return NULL;
 187         }
 188         result = talloc_asprintf(mem_ctx, "Interface %s.%d", guid_str,
 189                                  (int)syntax->if_version);
 190         TALLOC_FREE(guid_str);
 191
 192         if (result == NULL) {
 193                 return "PIPE";
 194         }
 195         return result;
 196 }
 197
 198 /********************************************************************
 199  Map internal value to wire value.
 200  ********************************************************************/
 201
 202 static int map_pipe_auth_type_to_rpc_auth_type(enum pipe_auth_type auth_type)
 203 {
 204         switch (auth_type) {
 205
 206         case PIPE_AUTH_TYPE_NONE:
 207                 return DCERPC_AUTH_TYPE_NONE;
 208
 209         case PIPE_AUTH_TYPE_NTLMSSP:
 210                 return DCERPC_AUTH_TYPE_NTLMSSP;
 211
 212         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 213         case PIPE_AUTH_TYPE_SPNEGO_KRB5:
 214                 return DCERPC_AUTH_TYPE_SPNEGO;
 215
 216         case PIPE_AUTH_TYPE_SCHANNEL:
 217                 return DCERPC_AUTH_TYPE_SCHANNEL;
 218
 219         case PIPE_AUTH_TYPE_KRB5:
 220                 return DCERPC_AUTH_TYPE_KRB5;
 221
 222         default:
 223                 DEBUG(0,("map_pipe_auth_type_to_rpc_type: unknown pipe "
 224                         "auth type %u\n",
 225                         (unsigned int)auth_type ));
 226                 break;
 227         }
 228         return -1;
 229 }
 230
 231 /********************************************************************
 232  Pipe description for a DEBUG
 233  ********************************************************************/
 234 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
 235                                    struct rpc_pipe_client *cli)
 236 {
 237         char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
 238         if (result == NULL) {
 239                 return "pipe";
 240         }
 241         return result;
 242 }
 243
 244 /********************************************************************
 245  Rpc pipe call id.
 246  ********************************************************************/
 247
 248 static uint32 get_rpc_call_id(void)
 249 {
 250         static uint32 call_id = 0;
 251         return ++call_id;
 252 }
 253
 254 /*
 255  * Realloc pdu to have a least "size" bytes
 256  */
 257
 258 static bool rpc_grow_buffer(prs_struct *pdu, size_t size)
 259 {
 260         size_t extra_size;
 261
 262         if (prs_data_size(pdu) >= size) {
 263                 return true;
 264         }
 265
 266         extra_size = size - prs_data_size(pdu);
 267
 268         if (!prs_force_grow(pdu, extra_size)) {
 269                 DEBUG(0, ("rpc_grow_buffer: Failed to grow parse struct by "
 270                           "%d bytes.\n", (int)extra_size));
 271                 return false;
 272         }
 273
 274         DEBUG(5, ("rpc_grow_buffer: grew buffer by %d bytes to %u\n",
 275                   (int)extra_size, prs_data_size(pdu)));
 276         return true;
 277 }
 278
 279
 280 /*******************************************************************
 281  Use SMBreadX to get rest of one fragment's worth of rpc data.
 282  Reads the whole size or give an error message
 283  ********************************************************************/
 284
 285 struct rpc_read_state {
 286         struct event_context *ev;
 287         struct rpc_cli_transport *transport;
 288         uint8_t *data;
 289         size_t size;
 290         size_t num_read;
 291 };
 292
 293 static void rpc_read_done(struct tevent_req *subreq);
 294
 295 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
 296                                         struct event_context *ev,
 297                                         struct rpc_cli_transport *transport,
 298                                         uint8_t *data, size_t size)
 299 {
 300         struct tevent_req *req, *subreq;
 301         struct rpc_read_state *state;
 302
 303         req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
 304         if (req == NULL) {
 305                 return NULL;
 306         }
 307         state->ev = ev;
 308         state->transport = transport;
 309         state->data = data;
 310         state->size = size;
 311         state->num_read = 0;
 312
 313         DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
 314
 315         subreq = transport->read_send(state, ev, (uint8_t *)data, size,
 316                                       transport->priv);
 317         if (subreq == NULL) {
 318                 goto fail;
 319         }
 320         tevent_req_set_callback(subreq, rpc_read_done, req);
 321         return req;
 322
 323  fail:
 324         TALLOC_FREE(req);
 325         return NULL;
 326 }
 327
 328 static void rpc_read_done(struct tevent_req *subreq)
 329 {
 330         struct tevent_req *req = tevent_req_callback_data(
 331                 subreq, struct tevent_req);
 332         struct rpc_read_state *state = tevent_req_data(
 333                 req, struct rpc_read_state);
 334         NTSTATUS status;
 335         ssize_t received;
 336
 337         status = state->transport->read_recv(subreq, &received);
 338         TALLOC_FREE(subreq);
 339         if (!NT_STATUS_IS_OK(status)) {
 340                 tevent_req_nterror(req, status);
 341                 return;
 342         }
 343
 344         state->num_read += received;
 345         if (state->num_read == state->size) {
 346                 tevent_req_done(req);
 347                 return;
 348         }
 349
 350         subreq = state->transport->read_send(state, state->ev,
 351                                              state->data + state->num_read,
 352                                              state->size - state->num_read,
 353                                              state->transport->priv);
 354         if (tevent_req_nomem(subreq, req)) {
 355                 return;
 356         }
 357         tevent_req_set_callback(subreq, rpc_read_done, req);
 358 }
 359
 360 static NTSTATUS rpc_read_recv(struct tevent_req *req)
 361 {
 362         return tevent_req_simple_recv_ntstatus(req);
 363 }
 364
 365 struct rpc_write_state {
 366         struct event_context *ev;
 367         struct rpc_cli_transport *transport;
 368         const uint8_t *data;
 369         size_t size;
 370         size_t num_written;
 371 };
 372
 373 static void rpc_write_done(struct tevent_req *subreq);
 374
 375 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
 376                                          struct event_context *ev,
 377                                          struct rpc_cli_transport *transport,
 378                                          const uint8_t *data, size_t size)
 379 {
 380         struct tevent_req *req, *subreq;
 381         struct rpc_write_state *state;
 382
 383         req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
 384         if (req == NULL) {
 385                 return NULL;
 386         }
 387         state->ev = ev;
 388         state->transport = transport;
 389         state->data = data;
 390         state->size = size;
 391         state->num_written = 0;
 392
 393         DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
 394
 395         subreq = transport->write_send(state, ev, data, size, transport->priv);
 396         if (subreq == NULL) {
 397                 goto fail;
 398         }
 399         tevent_req_set_callback(subreq, rpc_write_done, req);
 400         return req;
 401  fail:
 402         TALLOC_FREE(req);
 403         return NULL;
 404 }
 405
 406 static void rpc_write_done(struct tevent_req *subreq)
 407 {
 408         struct tevent_req *req = tevent_req_callback_data(
 409                 subreq, struct tevent_req);
 410         struct rpc_write_state *state = tevent_req_data(
 411                 req, struct rpc_write_state);
 412         NTSTATUS status;
 413         ssize_t written;
 414
 415         status = state->transport->write_recv(subreq, &written);
 416         TALLOC_FREE(subreq);
 417         if (!NT_STATUS_IS_OK(status)) {
 418                 tevent_req_nterror(req, status);
 419                 return;
 420         }
 421
 422         state->num_written += written;
 423
 424         if (state->num_written == state->size) {
 425                 tevent_req_done(req);
 426                 return;
 427         }
 428
 429         subreq = state->transport->write_send(state, state->ev,
 430                                               state->data + state->num_written,
 431                                               state->size - state->num_written,
 432                                               state->transport->priv);
 433         if (tevent_req_nomem(subreq, req)) {
 434                 return;
 435         }
 436         tevent_req_set_callback(subreq, rpc_write_done, req);
 437 }
 438
 439 static NTSTATUS rpc_write_recv(struct tevent_req *req)
 440 {
 441         return tevent_req_simple_recv_ntstatus(req);
 442 }
 443
 444
 445 static NTSTATUS parse_rpc_header(struct rpc_pipe_client *cli,
 446                                  struct rpc_hdr_info *prhdr,
 447                                  prs_struct *pdu)
 448 {
 449         /*
 450          * This next call sets the endian bit correctly in current_pdu. We
 451          * will propagate this to rbuf later.
 452          */
 453
 454         if(!smb_io_rpc_hdr("rpc_hdr   ", prhdr, pdu, 0)) {
 455                 DEBUG(0, ("get_current_pdu: Failed to unmarshall RPC_HDR.\n"));
 456                 return NT_STATUS_BUFFER_TOO_SMALL;
 457         }
 458
 459         if (prhdr->frag_len > cli->max_recv_frag) {
 460                 DEBUG(0, ("cli_pipe_get_current_pdu: Server sent fraglen %d,"
 461                           " we only allow %d\n", (int)prhdr->frag_len,
 462                           (int)cli->max_recv_frag));
 463                 return NT_STATUS_BUFFER_TOO_SMALL;
 464         }
 465
 466         return NT_STATUS_OK;
 467 }
 468
 469 /****************************************************************************
 470  Try and get a PDU's worth of data from current_pdu. If not, then read more
 471  from the wire.
 472  ****************************************************************************/
 473
 474 struct get_complete_frag_state {
 475         struct event_context *ev;
 476         struct rpc_pipe_client *cli;
 477         struct rpc_hdr_info *prhdr;
 478         prs_struct *pdu;
 479 };
 480
 481 static void get_complete_frag_got_header(struct tevent_req *subreq);
 482 static void get_complete_frag_got_rest(struct tevent_req *subreq);
 483
 484 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
 485                                                  struct event_context *ev,
 486                                                  struct rpc_pipe_client *cli,
 487                                                  struct rpc_hdr_info *prhdr,
 488                                                  prs_struct *pdu)
 489 {
 490         struct tevent_req *req, *subreq;
 491         struct get_complete_frag_state *state;
 492         uint32_t pdu_len;
 493         NTSTATUS status;
 494
 495         req = tevent_req_create(mem_ctx, &state,
 496                                 struct get_complete_frag_state);
 497         if (req == NULL) {
 498                 return NULL;
 499         }
 500         state->ev = ev;
 501         state->cli = cli;
 502         state->prhdr = prhdr;
 503         state->pdu = pdu;
 504
 505         pdu_len = prs_data_size(pdu);
 506         if (pdu_len < RPC_HEADER_LEN) {
 507                 if (!rpc_grow_buffer(pdu, RPC_HEADER_LEN)) {
 508                         status = NT_STATUS_NO_MEMORY;
 509                         goto post_status;
 510                 }
 511                 subreq = rpc_read_send(
 512                         state, state->ev,
 513                         state->cli->transport,
 514                         (uint8_t *)(prs_data_p(state->pdu) + pdu_len),
 515                         RPC_HEADER_LEN - pdu_len);
 516                 if (subreq == NULL) {
 517                         status = NT_STATUS_NO_MEMORY;
 518                         goto post_status;
 519                 }
 520                 tevent_req_set_callback(subreq, get_complete_frag_got_header,
 521                                         req);
 522                 return req;
 523         }
 524
 525         status = parse_rpc_header(cli, prhdr, pdu);
 526         if (!NT_STATUS_IS_OK(status)) {
 527                 goto post_status;
 528         }
 529
 530         /*
 531          * Ensure we have frag_len bytes of data.
 532          */
 533         if (pdu_len < prhdr->frag_len) {
 534                 if (!rpc_grow_buffer(pdu, prhdr->frag_len)) {
 535                         status = NT_STATUS_NO_MEMORY;
 536                         goto post_status;
 537                 }
 538                 subreq = rpc_read_send(state, state->ev,
 539                                        state->cli->transport,
 540                                        (uint8_t *)(prs_data_p(pdu) + pdu_len),
 541                                        prhdr->frag_len - pdu_len);
 542                 if (subreq == NULL) {
 543                         status = NT_STATUS_NO_MEMORY;
 544                         goto post_status;
 545                 }
 546                 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
 547                                         req);
 548                 return req;
 549         }
 550
 551         status = NT_STATUS_OK;
 552  post_status:
 553         if (NT_STATUS_IS_OK(status)) {
 554                 tevent_req_done(req);
 555         } else {
 556                 tevent_req_nterror(req, status);
 557         }
 558         return tevent_req_post(req, ev);
 559 }
 560
 561 static void get_complete_frag_got_header(struct tevent_req *subreq)
 562 {
 563         struct tevent_req *req = tevent_req_callback_data(
 564                 subreq, struct tevent_req);
 565         struct get_complete_frag_state *state = tevent_req_data(
 566                 req, struct get_complete_frag_state);
 567         NTSTATUS status;
 568
 569         status = rpc_read_recv(subreq);
 570         TALLOC_FREE(subreq);
 571         if (!NT_STATUS_IS_OK(status)) {
 572                 tevent_req_nterror(req, status);
 573                 return;
 574         }
 575
 576         status = parse_rpc_header(state->cli, state->prhdr, state->pdu);
 577         if (!NT_STATUS_IS_OK(status)) {
 578                 tevent_req_nterror(req, status);
 579                 return;
 580         }
 581
 582         if (!rpc_grow_buffer(state->pdu, state->prhdr->frag_len)) {
 583                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 584                 return;
 585         }
 586
 587         /*
 588          * We're here in this piece of code because we've read exactly
 589          * RPC_HEADER_LEN bytes into state->pdu.
 590          */
 591
 592         subreq = rpc_read_send(
 593                 state, state->ev, state->cli->transport,
 594                 (uint8_t *)(prs_data_p(state->pdu) + RPC_HEADER_LEN),
 595                 state->prhdr->frag_len - RPC_HEADER_LEN);
 596         if (tevent_req_nomem(subreq, req)) {
 597                 return;
 598         }
 599         tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
 600 }
 601
 602 static void get_complete_frag_got_rest(struct tevent_req *subreq)
 603 {
 604         struct tevent_req *req = tevent_req_callback_data(
 605                 subreq, struct tevent_req);
 606         NTSTATUS status;
 607
 608         status = rpc_read_recv(subreq);
 609         TALLOC_FREE(subreq);
 610         if (!NT_STATUS_IS_OK(status)) {
 611                 tevent_req_nterror(req, status);
 612                 return;
 613         }
 614         tevent_req_done(req);
 615 }
 616
 617 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
 618 {
 619         return tevent_req_simple_recv_ntstatus(req);
 620 }
 621
 622 /****************************************************************************
 623  NTLMSSP specific sign/seal.
 624  Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
 625  In fact I should probably abstract these into identical pieces of code... JRA.
 626  ****************************************************************************/
 627
 628 static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 629                                 prs_struct *current_pdu,
 630                                 uint8 *p_ss_padding_len)
 631 {
 632         RPC_HDR_AUTH auth_info;
 633         uint32 save_offset = prs_offset(current_pdu);
 634         uint32 auth_len = prhdr->auth_len;
 635         NTLMSSP_STATE *ntlmssp_state = cli->auth->a_u.ntlmssp_state;
 636         unsigned char *data = NULL;
 637         size_t data_len;
 638         unsigned char *full_packet_data = NULL;
 639         size_t full_packet_data_len;
 640         DATA_BLOB auth_blob;
 641         NTSTATUS status;
 642
 643         if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
 644             || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
 645                 return NT_STATUS_OK;
 646         }
 647
 648         if (!ntlmssp_state) {
 649                 return NT_STATUS_INVALID_PARAMETER;
 650         }
 651
 652         /* Ensure there's enough data for an authenticated response. */
 653         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
 654                         (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
 655                 DEBUG(0,("cli_pipe_verify_ntlmssp: auth_len %u is too large.\n",
 656                         (unsigned int)auth_len ));
 657                 return NT_STATUS_BUFFER_TOO_SMALL;
 658         }
 659
 660         /*
 661          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
 662          * after the RPC header.
 663          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
 664          * functions as NTLMv2 checks the rpc headers also.
 665          */
 666
 667         data = (unsigned char *)(prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN);
 668         data_len = (size_t)(prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len);
 669
 670         full_packet_data = (unsigned char *)prs_data_p(current_pdu);
 671         full_packet_data_len = prhdr->frag_len - auth_len;
 672
 673         /* Pull the auth header and the following data into a blob. */
 674         if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
 675                 DEBUG(0,("cli_pipe_verify_ntlmssp: cannot move offset to %u.\n",
 676                         (unsigned int)RPC_HEADER_LEN + (unsigned int)RPC_HDR_RESP_LEN + (unsigned int)data_len ));
 677                 return NT_STATUS_BUFFER_TOO_SMALL;
 678         }
 679
 680         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
 681                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall RPC_HDR_AUTH.\n"));
 682                 return NT_STATUS_BUFFER_TOO_SMALL;
 683         }
 684
 685         auth_blob.data = (unsigned char *)prs_data_p(current_pdu) + prs_offset(current_pdu);
 686         auth_blob.length = auth_len;
 687
 688         switch (cli->auth->auth_level) {
 689                 case DCERPC_AUTH_LEVEL_PRIVACY:
 690                         /* Data is encrypted. */
 691                         status = ntlmssp_unseal_packet(ntlmssp_state,
 692                                                         data, data_len,
 693                                                         full_packet_data,
 694                                                         full_packet_data_len,
 695                                                         &auth_blob);
 696                         if (!NT_STATUS_IS_OK(status)) {
 697                                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unseal "
 698                                         "packet from %s. Error was %s.\n",
 699                                         rpccli_pipe_txt(talloc_tos(), cli),
 700                                         nt_errstr(status) ));
 701                                 return status;
 702                         }
 703                         break;
 704                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 705                         /* Data is signed. */
 706                         status = ntlmssp_check_packet(ntlmssp_state,
 707                                                         data, data_len,
 708                                                         full_packet_data,
 709                                                         full_packet_data_len,
 710                                                         &auth_blob);
 711                         if (!NT_STATUS_IS_OK(status)) {
 712                                 DEBUG(0,("cli_pipe_verify_ntlmssp: check signing failed on "
 713                                         "packet from %s. Error was %s.\n",
 714                                         rpccli_pipe_txt(talloc_tos(), cli),
 715                                         nt_errstr(status) ));
 716                                 return status;
 717                         }
 718                         break;
 719                 default:
 720                         DEBUG(0, ("cli_pipe_verify_ntlmssp: unknown internal "
 721                                   "auth level %d\n", cli->auth->auth_level));
 722                         return NT_STATUS_INVALID_INFO_CLASS;
 723         }
 724
 725         /*
 726          * Return the current pointer to the data offset.
 727          */
 728
 729         if(!prs_set_offset(current_pdu, save_offset)) {
 730                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
 731                         (unsigned int)save_offset ));
 732                 return NT_STATUS_BUFFER_TOO_SMALL;
 733         }
 734
 735         /*
 736          * Remember the padding length. We must remove it from the real data
 737          * stream once the sign/seal is done.
 738          */
 739
 740         *p_ss_padding_len = auth_info.auth_pad_len;
 741
 742         return NT_STATUS_OK;
 743 }
 744
 745 /****************************************************************************
 746  schannel specific sign/seal.
 747  ****************************************************************************/
 748
 749 static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 750                                 prs_struct *current_pdu,
 751                                 uint8 *p_ss_padding_len)
 752 {
 753         RPC_HDR_AUTH auth_info;
 754         uint32 auth_len = prhdr->auth_len;
 755         uint32 save_offset = prs_offset(current_pdu);
 756         struct schannel_state *schannel_auth =
 757                 cli->auth->a_u.schannel_auth;
 758         uint8_t *data;
 759         uint32 data_len;
 760         DATA_BLOB blob;
 761         NTSTATUS status;
 762
 763         if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
 764             || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
 765                 return NT_STATUS_OK;
 766         }
 767
 768         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
 769                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u.\n", (unsigned int)auth_len ));
 770                 return NT_STATUS_INVALID_PARAMETER;
 771         }
 772
 773         if (!schannel_auth) {
 774                 return NT_STATUS_INVALID_PARAMETER;
 775         }
 776
 777         /* Ensure there's enough data for an authenticated response. */
 778         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
 779                         (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
 780                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u is too large.\n",
 781                         (unsigned int)auth_len ));
 782                 return NT_STATUS_INVALID_PARAMETER;
 783         }
 784
 785         data_len = prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 786
 787         if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
 788                 DEBUG(0,("cli_pipe_verify_schannel: cannot move offset to %u.\n",
 789                         (unsigned int)RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len ));
 790                 return NT_STATUS_BUFFER_TOO_SMALL;
 791         }
 792
 793         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
 794                 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshall RPC_HDR_AUTH.\n"));
 795                 return NT_STATUS_BUFFER_TOO_SMALL;
 796         }
 797
 798         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
 799                 DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n",
 800                         auth_info.auth_type));
 801                 return NT_STATUS_BUFFER_TOO_SMALL;
 802         }
 803
 804         blob = data_blob_const(prs_data_p(current_pdu) + prs_offset(current_pdu), auth_len);
 805
 806         if (DEBUGLEVEL >= 10) {
 807                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 808         }
 809
 810         data = (uint8_t *)prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN;
 811
 812         switch (cli->auth->auth_level) {
 813         case DCERPC_AUTH_LEVEL_PRIVACY:
 814                 status = netsec_incoming_packet(schannel_auth,
 815                                                 talloc_tos(),
 816                                                 true,
 817                                                 data,
 818                                                 data_len,
 819                                                 &blob);
 820                 break;
 821         case DCERPC_AUTH_LEVEL_INTEGRITY:
 822                 status = netsec_incoming_packet(schannel_auth,
 823                                                 talloc_tos(),
 824                                                 false,
 825                                                 data,
 826                                                 data_len,
 827                                                 &blob);
 828                 break;
 829         default:
 830                 status = NT_STATUS_INTERNAL_ERROR;
 831                 break;
 832         }
 833
 834         if (!NT_STATUS_IS_OK(status)) {
 835                 DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
 836                                 "Connection to %s (%s).\n",
 837                                 rpccli_pipe_txt(talloc_tos(), cli),
 838                                 nt_errstr(status)));
 839                 return NT_STATUS_INVALID_PARAMETER;
 840         }
 841
 842         /*
 843          * Return the current pointer to the data offset.
 844          */
 845
 846         if(!prs_set_offset(current_pdu, save_offset)) {
 847                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
 848                         (unsigned int)save_offset ));
 849                 return NT_STATUS_BUFFER_TOO_SMALL;
 850         }
 851
 852         /*
 853          * Remember the padding length. We must remove it from the real data
 854          * stream once the sign/seal is done.
 855          */
 856
 857         *p_ss_padding_len = auth_info.auth_pad_len;
 858
 859         return NT_STATUS_OK;
 860 }
 861
 862 /****************************************************************************
 863  Do the authentication checks on an incoming pdu. Check sign and unseal etc.
 864  ****************************************************************************/
 865
 866 static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 867                                 prs_struct *current_pdu,
 868                                 uint8 *p_ss_padding_len)
 869 {
 870         NTSTATUS ret = NT_STATUS_OK;
 871
 872         /* Paranioa checks for auth_len. */
 873         if (prhdr->auth_len) {
 874                 if (prhdr->auth_len > prhdr->frag_len) {
 875                         return NT_STATUS_INVALID_PARAMETER;
 876                 }
 877
 878                 if (prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < prhdr->auth_len ||
 879                                 prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < (unsigned int)RPC_HDR_AUTH_LEN) {
 880                         /* Integer wrap attempt. */
 881                         return NT_STATUS_INVALID_PARAMETER;
 882                 }
 883         }
 884
 885         /*
 886          * Now we have a complete RPC request PDU fragment, try and verify any auth data.
 887          */
 888
 889         switch(cli->auth->auth_type) {
 890                 case PIPE_AUTH_TYPE_NONE:
 891                         if (prhdr->auth_len) {
 892                                 DEBUG(3, ("cli_pipe_validate_rpc_response: "
 893                                           "Connection to %s - got non-zero "
 894                                           "auth len %u.\n",
 895                                         rpccli_pipe_txt(talloc_tos(), cli),
 896                                         (unsigned int)prhdr->auth_len ));
 897                                 return NT_STATUS_INVALID_PARAMETER;
 898                         }
 899                         break;
 900
 901                 case PIPE_AUTH_TYPE_NTLMSSP:
 902                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 903                         ret = cli_pipe_verify_ntlmssp(cli, prhdr, current_pdu, p_ss_padding_len);
 904                         if (!NT_STATUS_IS_OK(ret)) {
 905                                 return ret;
 906                         }
 907                         break;
 908
 909                 case PIPE_AUTH_TYPE_SCHANNEL:
 910                         ret = cli_pipe_verify_schannel(cli, prhdr, current_pdu, p_ss_padding_len);
 911                         if (!NT_STATUS_IS_OK(ret)) {
 912                                 return ret;
 913                         }
 914                         break;
 915
 916                 case PIPE_AUTH_TYPE_KRB5:
 917                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
 918                 default:
 919                         DEBUG(3, ("cli_pipe_validate_rpc_response: Connection "
 920                                   "to %s - unknown internal auth type %u.\n",
 921                                   rpccli_pipe_txt(talloc_tos(), cli),
 922                                   cli->auth->auth_type ));
 923                         return NT_STATUS_INVALID_INFO_CLASS;
 924         }
 925
 926         return NT_STATUS_OK;
 927 }
 928
 929 /****************************************************************************
 930  Do basic authentication checks on an incoming pdu.
 931  ****************************************************************************/
 932
 933 static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 934                         prs_struct *current_pdu,
 935                         uint8 expected_pkt_type,
 936                         char **ppdata,
 937                         uint32 *pdata_len,
 938                         prs_struct *return_data)
 939 {
 940
 941         NTSTATUS ret = NT_STATUS_OK;
 942         uint32 current_pdu_len = prs_data_size(current_pdu);
 943
 944         if (current_pdu_len != prhdr->frag_len) {
 945                 DEBUG(5,("cli_pipe_validate_current_pdu: incorrect pdu length %u, expected %u\n",
 946                         (unsigned int)current_pdu_len, (unsigned int)prhdr->frag_len ));
 947                 return NT_STATUS_INVALID_PARAMETER;
 948         }
 949
 950         /*
 951          * Point the return values at the real data including the RPC
 952          * header. Just in case the caller wants it.
 953          */
 954         *ppdata = prs_data_p(current_pdu);
 955         *pdata_len = current_pdu_len;
 956
 957         /* Ensure we have the correct type. */
 958         switch (prhdr->pkt_type) {
 959                 case DCERPC_PKT_ALTER_RESP:
 960                 case DCERPC_PKT_BIND_ACK:
 961
 962                         /* Alter context and bind ack share the same packet definitions. */
 963                         break;
 964
 965
 966                 case DCERPC_PKT_RESPONSE:
 967                 {
 968                         RPC_HDR_RESP rhdr_resp;
 969                         uint8 ss_padding_len = 0;
 970
 971                         if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
 972                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
 973                                 return NT_STATUS_BUFFER_TOO_SMALL;
 974                         }
 975
 976                         /* Here's where we deal with incoming sign/seal. */
 977                         ret = cli_pipe_validate_rpc_response(cli, prhdr,
 978                                         current_pdu, &ss_padding_len);
 979                         if (!NT_STATUS_IS_OK(ret)) {
 980                                 return ret;
 981                         }
 982
 983                         /* Point the return values at the NDR data. Remember to remove any ss padding. */
 984                         *ppdata = prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
 985
 986                         if (current_pdu_len < RPC_HEADER_LEN + RPC_HDR_RESP_LEN + ss_padding_len) {
 987                                 return NT_STATUS_BUFFER_TOO_SMALL;
 988                         }
 989
 990                         *pdata_len = current_pdu_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - ss_padding_len;
 991
 992                         /* Remember to remove the auth footer. */
 993                         if (prhdr->auth_len) {
 994                                 /* We've already done integer wrap tests on auth_len in
 995                                         cli_pipe_validate_rpc_response(). */
 996                                 if (*pdata_len < RPC_HDR_AUTH_LEN + prhdr->auth_len) {
 997                                         return NT_STATUS_BUFFER_TOO_SMALL;
 998                                 }
 999                                 *pdata_len -= (RPC_HDR_AUTH_LEN + prhdr->auth_len);
1000                         }
1001
1002                         DEBUG(10,("cli_pipe_validate_current_pdu: got pdu len %u, data_len %u, ss_len %u\n",
1003                                 current_pdu_len, *pdata_len, ss_padding_len ));
1004
1005                         /*
1006                          * If this is the first reply, and the allocation hint is reasonably, try and
1007                          * set up the return_data parse_struct to the correct size.
1008                          */
1009
1010                         if ((prs_data_size(return_data) == 0) && rhdr_resp.alloc_hint && (rhdr_resp.alloc_hint < 15*1024*1024)) {
1011                                 if (!prs_set_buffer_size(return_data, rhdr_resp.alloc_hint)) {
1012                                         DEBUG(0,("cli_pipe_validate_current_pdu: reply alloc hint %u "
1013                                                 "too large to allocate\n",
1014                                                 (unsigned int)rhdr_resp.alloc_hint ));
1015                                         return NT_STATUS_NO_MEMORY;
1016                                 }
1017                         }
1018
1019                         break;
1020                 }
1021
1022                 case DCERPC_PKT_BIND_NAK:
1023                         DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
1024                                   "received from %s!\n",
1025                                   rpccli_pipe_txt(talloc_tos(), cli)));
1026                         /* Use this for now... */
1027                         return NT_STATUS_NETWORK_ACCESS_DENIED;
1028
1029                 case DCERPC_PKT_FAULT:
1030                 {
1031                         RPC_HDR_RESP rhdr_resp;
1032                         RPC_HDR_FAULT fault_resp;
1033
1034                         if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
1035                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
1036                                 return NT_STATUS_BUFFER_TOO_SMALL;
1037                         }
1038
1039                         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, current_pdu, 0)) {
1040                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_FAULT.\n"));
1041                                 return NT_STATUS_BUFFER_TOO_SMALL;
1042                         }
1043
1044                         DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
1045                                   "code %s received from %s!\n",
1046                                 dcerpc_errstr(talloc_tos(), NT_STATUS_V(fault_resp.status)),
1047                                 rpccli_pipe_txt(talloc_tos(), cli)));
1048                         if (NT_STATUS_IS_OK(fault_resp.status)) {
1049                                 return NT_STATUS_UNSUCCESSFUL;
1050                         } else {
1051                                 return fault_resp.status;
1052                         }
1053                 }
1054
1055                 default:
1056                         DEBUG(0, ("cli_pipe_validate_current_pdu: unknown packet type %u received "
1057                                 "from %s!\n",
1058                                 (unsigned int)prhdr->pkt_type,
1059                                 rpccli_pipe_txt(talloc_tos(), cli)));
1060                         return NT_STATUS_INVALID_INFO_CLASS;
1061         }
1062
1063         if (prhdr->pkt_type != expected_pkt_type) {
1064                 DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
1065                           "got an unexpected RPC packet type - %u, not %u\n",
1066                         rpccli_pipe_txt(talloc_tos(), cli),
1067                         prhdr->pkt_type,
1068                         expected_pkt_type));
1069                 return NT_STATUS_INVALID_INFO_CLASS;
1070         }
1071
1072         /* Do this just before return - we don't want to modify any rpc header
1073            data before now as we may have needed to do cryptographic actions on
1074            it before. */
1075
1076         if ((prhdr->pkt_type == DCERPC_PKT_BIND_ACK) && !(prhdr->flags & DCERPC_PFC_FLAG_LAST)) {
1077                 DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
1078                         "setting fragment first/last ON.\n"));
1079                 prhdr->flags |= DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST;
1080         }
1081
1082         return NT_STATUS_OK;
1083 }
1084
1085 /****************************************************************************
1086  Ensure we eat the just processed pdu from the current_pdu prs_struct.
1087  Normally the frag_len and buffer size will match, but on the first trans
1088  reply there is a theoretical chance that buffer size > frag_len, so we must
1089  deal with that.
1090  ****************************************************************************/
1091
1092 static NTSTATUS cli_pipe_reset_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr, prs_struct *current_pdu)
1093 {
1094         uint32 current_pdu_len = prs_data_size(current_pdu);
1095
1096         if (current_pdu_len < prhdr->frag_len) {
1097                 return NT_STATUS_BUFFER_TOO_SMALL;
1098         }
1099
1100         /* Common case. */
1101         if (current_pdu_len == (uint32)prhdr->frag_len) {
1102                 prs_mem_free(current_pdu);
1103                 prs_init_empty(current_pdu, prs_get_mem_context(current_pdu), UNMARSHALL);
1104                 /* Make current_pdu dynamic with no memory. */
1105                 prs_give_memory(current_pdu, 0, 0, True);
1106                 return NT_STATUS_OK;
1107         }
1108
1109         /*
1110          * Oh no ! More data in buffer than we processed in current pdu.
1111          * Cheat. Move the data down and shrink the buffer.
1112          */
1113
1114         memcpy(prs_data_p(current_pdu), prs_data_p(current_pdu) + prhdr->frag_len,
1115                         current_pdu_len - prhdr->frag_len);
1116
1117         /* Remember to set the read offset back to zero. */
1118         prs_set_offset(current_pdu, 0);
1119
1120         /* Shrink the buffer. */
1121         if (!prs_set_buffer_size(current_pdu, current_pdu_len - prhdr->frag_len)) {
1122                 return NT_STATUS_BUFFER_TOO_SMALL;
1123         }
1124
1125         return NT_STATUS_OK;
1126 }
1127
1128 /****************************************************************************
1129  Call a remote api on an arbitrary pipe.  takes param, data and setup buffers.
1130 ****************************************************************************/
1131
1132 struct cli_api_pipe_state {
1133         struct event_context *ev;
1134         struct rpc_cli_transport *transport;
1135         uint8_t *rdata;
1136         uint32_t rdata_len;
1137 };
1138
1139 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
1140 static void cli_api_pipe_write_done(struct tevent_req *subreq);
1141 static void cli_api_pipe_read_done(struct tevent_req *subreq);
1142
1143 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
1144                                             struct event_context *ev,
1145                                             struct rpc_cli_transport *transport,
1146                                             uint8_t *data, size_t data_len,
1147                                             uint32_t max_rdata_len)
1148 {
1149         struct tevent_req *req, *subreq;
1150         struct cli_api_pipe_state *state;
1151         NTSTATUS status;
1152
1153         req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
1154         if (req == NULL) {
1155                 return NULL;
1156         }
1157         state->ev = ev;
1158         state->transport = transport;
1159
1160         if (max_rdata_len < RPC_HEADER_LEN) {
1161                 /*
1162                  * For a RPC reply we always need at least RPC_HEADER_LEN
1163                  * bytes. We check this here because we will receive
1164                  * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
1165                  */
1166                 status = NT_STATUS_INVALID_PARAMETER;
1167                 goto post_status;
1168         }
1169
1170         if (transport->trans_send != NULL) {
1171                 subreq = transport->trans_send(state, ev, data, data_len,
1172                                                max_rdata_len, transport->priv);
1173                 if (subreq == NULL) {
1174                         goto fail;
1175                 }
1176                 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
1177                 return req;
1178         }
1179
1180         /*
1181          * If the transport does not provide a "trans" routine, i.e. for
1182          * example the ncacn_ip_tcp transport, do the write/read step here.
1183          */
1184
1185         subreq = rpc_write_send(state, ev, transport, data, data_len);
1186         if (subreq == NULL) {
1187                 goto fail;
1188         }
1189         tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
1190         return req;
1191
1192         status = NT_STATUS_INVALID_PARAMETER;
1193
1194  post_status:
1195         tevent_req_nterror(req, status);
1196         return tevent_req_post(req, ev);
1197  fail:
1198         TALLOC_FREE(req);
1199         return NULL;
1200 }
1201
1202 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
1203 {
1204         struct tevent_req *req = tevent_req_callback_data(
1205                 subreq, struct tevent_req);
1206         struct cli_api_pipe_state *state = tevent_req_data(
1207                 req, struct cli_api_pipe_state);
1208         NTSTATUS status;
1209
1210         status = state->transport->trans_recv(subreq, state, &state->rdata,
1211                                               &state->rdata_len);
1212         TALLOC_FREE(subreq);
1213         if (!NT_STATUS_IS_OK(status)) {
1214                 tevent_req_nterror(req, status);
1215                 return;
1216         }
1217         tevent_req_done(req);
1218 }
1219
1220 static void cli_api_pipe_write_done(struct tevent_req *subreq)
1221 {
1222         struct tevent_req *req = tevent_req_callback_data(
1223                 subreq, struct tevent_req);
1224         struct cli_api_pipe_state *state = tevent_req_data(
1225                 req, struct cli_api_pipe_state);
1226         NTSTATUS status;
1227
1228         status = rpc_write_recv(subreq);
1229         TALLOC_FREE(subreq);
1230         if (!NT_STATUS_IS_OK(status)) {
1231                 tevent_req_nterror(req, status);
1232                 return;
1233         }
1234
1235         state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
1236         if (tevent_req_nomem(state->rdata, req)) {
1237                 return;
1238         }
1239
1240         /*
1241          * We don't need to use rpc_read_send here, the upper layer will cope
1242          * with a short read, transport->trans_send could also return less
1243          * than state->max_rdata_len.
1244          */
1245         subreq = state->transport->read_send(state, state->ev, state->rdata,
1246                                              RPC_HEADER_LEN,
1247                                              state->transport->priv);
1248         if (tevent_req_nomem(subreq, req)) {
1249                 return;
1250         }
1251         tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
1252 }
1253
1254 static void cli_api_pipe_read_done(struct tevent_req *subreq)
1255 {
1256         struct tevent_req *req = tevent_req_callback_data(
1257                 subreq, struct tevent_req);
1258         struct cli_api_pipe_state *state = tevent_req_data(
1259                 req, struct cli_api_pipe_state);
1260         NTSTATUS status;
1261         ssize_t received;
1262
1263         status = state->transport->read_recv(subreq, &received);
1264         TALLOC_FREE(subreq);
1265         if (!NT_STATUS_IS_OK(status)) {
1266                 tevent_req_nterror(req, status);
1267                 return;
1268         }
1269         state->rdata_len = received;
1270         tevent_req_done(req);
1271 }
1272
1273 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1274                                   uint8_t **prdata, uint32_t *prdata_len)
1275 {
1276         struct cli_api_pipe_state *state = tevent_req_data(
1277                 req, struct cli_api_pipe_state);
1278         NTSTATUS status;
1279
1280         if (tevent_req_is_nterror(req, &status)) {
1281                 return status;
1282         }
1283
1284         *prdata = talloc_move(mem_ctx, &state->rdata);
1285         *prdata_len = state->rdata_len;
1286         return NT_STATUS_OK;
1287 }
1288
1289 /****************************************************************************
1290  Send data on an rpc pipe via trans. The prs_struct data must be the last
1291  pdu fragment of an NDR data stream.
1292
1293  Receive response data from an rpc pipe, which may be large...
1294
1295  Read the first fragment: unfortunately have to use SMBtrans for the first
1296  bit, then SMBreadX for subsequent bits.
1297
1298  If first fragment received also wasn't the last fragment, continue
1299  getting fragments until we _do_ receive the last fragment.
1300
1301  Request/Response PDU's look like the following...
1302
1303  |<------------------PDU len----------------------------------------------->|
1304  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
1305
1306  +------------+-----------------+-------------+---------------+-------------+
1307  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
1308  +------------+-----------------+-------------+---------------+-------------+
1309
1310  Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
1311  signing & sealing being negotiated.
1312
1313  ****************************************************************************/
1314
1315 struct rpc_api_pipe_state {
1316         struct event_context *ev;
1317         struct rpc_pipe_client *cli;
1318         uint8_t expected_pkt_type;
1319
1320         prs_struct incoming_frag;
1321         struct rpc_hdr_info rhdr;
1322
1323         prs_struct incoming_pdu;        /* Incoming reply */
1324         uint32_t incoming_pdu_offset;
1325 };
1326
1327 static int rpc_api_pipe_state_destructor(struct rpc_api_pipe_state *state)
1328 {
1329         prs_mem_free(&state->incoming_frag);
1330         prs_mem_free(&state->incoming_pdu);
1331         return 0;
1332 }
1333
1334 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
1335 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
1336
1337 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
1338                                             struct event_context *ev,
1339                                             struct rpc_pipe_client *cli,
1340                                             prs_struct *data, /* Outgoing PDU */
1341                                             uint8_t expected_pkt_type)
1342 {
1343         struct tevent_req *req, *subreq;
1344         struct rpc_api_pipe_state *state;
1345         uint16_t max_recv_frag;
1346         NTSTATUS status;
1347
1348         req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
1349         if (req == NULL) {
1350                 return NULL;
1351         }
1352         state->ev = ev;
1353         state->cli = cli;
1354         state->expected_pkt_type = expected_pkt_type;
1355         state->incoming_pdu_offset = 0;
1356
1357         prs_init_empty(&state->incoming_frag, state, UNMARSHALL);
1358
1359         prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1360         /* Make incoming_pdu dynamic with no memory. */
1361         prs_give_memory(&state->incoming_pdu, NULL, 0, true);
1362
1363         talloc_set_destructor(state, rpc_api_pipe_state_destructor);
1364
1365         /*
1366          * Ensure we're not sending too much.
1367          */
1368         if (prs_offset(data) > cli->max_xmit_frag) {
1369                 status = NT_STATUS_INVALID_PARAMETER;
1370                 goto post_status;
1371         }
1372
1373         DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
1374
1375         max_recv_frag = cli->max_recv_frag;
1376
1377 #if 0
1378         max_recv_frag = RPC_HEADER_LEN + 10 + (sys_random() % 32);
1379 #endif
1380
1381         subreq = cli_api_pipe_send(state, ev, cli->transport,
1382                                    (uint8_t *)prs_data_p(data),
1383                                    prs_offset(data), max_recv_frag);
1384         if (subreq == NULL) {
1385                 goto fail;
1386         }
1387         tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
1388         return req;
1389
1390  post_status:
1391         tevent_req_nterror(req, status);
1392         return tevent_req_post(req, ev);
1393  fail:
1394         TALLOC_FREE(req);
1395         return NULL;
1396 }
1397
1398 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
1399 {
1400         struct tevent_req *req = tevent_req_callback_data(
1401                 subreq, struct tevent_req);
1402         struct rpc_api_pipe_state *state = tevent_req_data(
1403                 req, struct rpc_api_pipe_state);
1404         NTSTATUS status;
1405         uint8_t *rdata = NULL;
1406         uint32_t rdata_len = 0;
1407         char *rdata_copy;
1408
1409         status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
1410         TALLOC_FREE(subreq);
1411         if (!NT_STATUS_IS_OK(status)) {
1412                 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
1413                 tevent_req_nterror(req, status);
1414                 return;
1415         }
1416
1417         if (rdata == NULL) {
1418                 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
1419                          rpccli_pipe_txt(talloc_tos(), state->cli)));
1420                 tevent_req_done(req);
1421                 return;
1422         }
1423
1424         /*
1425          * Give the memory received from cli_trans as dynamic to the current
1426          * pdu. Duplicating it sucks, but prs_struct doesn't know about talloc
1427          * :-(
1428          */
1429         rdata_copy = (char *)memdup(rdata, rdata_len);
1430         TALLOC_FREE(rdata);
1431         if (tevent_req_nomem(rdata_copy, req)) {
1432                 return;
1433         }
1434         prs_give_memory(&state->incoming_frag, rdata_copy, rdata_len, true);
1435
1436         /* Ensure we have enough data for a pdu. */
1437         subreq = get_complete_frag_send(state, state->ev, state->cli,
1438                                         &state->rhdr, &state->incoming_frag);
1439         if (tevent_req_nomem(subreq, req)) {
1440                 return;
1441         }
1442         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1443 }
1444
1445 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
1446 {
1447         struct tevent_req *req = tevent_req_callback_data(
1448                 subreq, struct tevent_req);
1449         struct rpc_api_pipe_state *state = tevent_req_data(
1450                 req, struct rpc_api_pipe_state);
1451         NTSTATUS status;
1452         char *rdata = NULL;
1453         uint32_t rdata_len = 0;
1454
1455         status = get_complete_frag_recv(subreq);
1456         TALLOC_FREE(subreq);
1457         if (!NT_STATUS_IS_OK(status)) {
1458                 DEBUG(5, ("get_complete_frag failed: %s\n",
1459                           nt_errstr(status)));
1460                 tevent_req_nterror(req, status);
1461                 return;
1462         }
1463
1464         status = cli_pipe_validate_current_pdu(
1465                 state->cli, &state->rhdr, &state->incoming_frag,
1466                 state->expected_pkt_type, &rdata, &rdata_len,
1467                 &state->incoming_pdu);
1468
1469         DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
1470                   (unsigned)prs_data_size(&state->incoming_frag),
1471                   (unsigned)state->incoming_pdu_offset,
1472                   nt_errstr(status)));
1473
1474         if (!NT_STATUS_IS_OK(status)) {
1475                 tevent_req_nterror(req, status);
1476                 return;
1477         }
1478
1479         if ((state->rhdr.flags & DCERPC_PFC_FLAG_FIRST)
1480             && (state->rhdr.pack_type[0] == 0)) {
1481                 /*
1482                  * Set the data type correctly for big-endian data on the
1483                  * first packet.
1484                  */
1485                 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
1486                           "big-endian.\n",
1487                           rpccli_pipe_txt(talloc_tos(), state->cli)));
1488                 prs_set_endian_data(&state->incoming_pdu, RPC_BIG_ENDIAN);
1489         }
1490         /*
1491          * Check endianness on subsequent packets.
1492          */
1493         if (state->incoming_frag.bigendian_data
1494             != state->incoming_pdu.bigendian_data) {
1495                 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
1496                          "%s\n",
1497                          state->incoming_pdu.bigendian_data?"big":"little",
1498                          state->incoming_frag.bigendian_data?"big":"little"));
1499                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1500                 return;
1501         }
1502
1503         /* Now copy the data portion out of the pdu into rbuf. */
1504         if (!prs_force_grow(&state->incoming_pdu, rdata_len)) {
1505                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1506                 return;
1507         }
1508
1509         memcpy(prs_data_p(&state->incoming_pdu) + state->incoming_pdu_offset,
1510                rdata, (size_t)rdata_len);
1511         state->incoming_pdu_offset += rdata_len;
1512
1513         status = cli_pipe_reset_current_pdu(state->cli, &state->rhdr,
1514                                             &state->incoming_frag);
1515         if (!NT_STATUS_IS_OK(status)) {
1516                 tevent_req_nterror(req, status);
1517                 return;
1518         }
1519
1520         if (state->rhdr.flags & DCERPC_PFC_FLAG_LAST) {
1521                 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1522                           rpccli_pipe_txt(talloc_tos(), state->cli),
1523                           (unsigned)prs_data_size(&state->incoming_pdu)));
1524                 tevent_req_done(req);
1525                 return;
1526         }
1527
1528         subreq = get_complete_frag_send(state, state->ev, state->cli,
1529                                         &state->rhdr, &state->incoming_frag);
1530         if (tevent_req_nomem(subreq, req)) {
1531                 return;
1532         }
1533         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1534 }
1535
1536 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1537                                   prs_struct *reply_pdu)
1538 {
1539         struct rpc_api_pipe_state *state = tevent_req_data(
1540                 req, struct rpc_api_pipe_state);
1541         NTSTATUS status;
1542
1543         if (tevent_req_is_nterror(req, &status)) {
1544                 return status;
1545         }
1546
1547         *reply_pdu = state->incoming_pdu;
1548         reply_pdu->mem_ctx = mem_ctx;
1549
1550         /*
1551          * Prevent state->incoming_pdu from being freed in
1552          * rpc_api_pipe_state_destructor()
1553          */
1554         prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1555
1556         return NT_STATUS_OK;
1557 }
1558
1559 /*******************************************************************
1560  Creates krb5 auth bind.
1561  ********************************************************************/
1562
1563 static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
1564                                                 enum dcerpc_AuthLevel auth_level,
1565                                                 RPC_HDR_AUTH *pauth_out,
1566                                                 prs_struct *auth_data)
1567 {
1568 #ifdef HAVE_KRB5
1569         int ret;
1570         struct kerberos_auth_struct *a = cli->auth->a_u.kerberos_auth;
1571         DATA_BLOB tkt = data_blob_null;
1572         DATA_BLOB tkt_wrapped = data_blob_null;
1573
1574         /* We may change the pad length before marshalling. */
1575         init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_KRB5, (int)auth_level, 0, 1);
1576
1577         DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
1578                 a->service_principal ));
1579
1580         /* Create the ticket for the service principal and return it in a gss-api wrapped blob. */
1581
1582         ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
1583                         &a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL, NULL);
1584
1585         if (ret) {
1586                 DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
1587                         "failed with %s\n",
1588                         a->service_principal,
1589                         error_message(ret) ));
1590
1591                 data_blob_free(&tkt);
1592                 prs_mem_free(auth_data);
1593                 return NT_STATUS_INVALID_PARAMETER;
1594         }
1595
1596         /* wrap that up in a nice GSS-API wrapping */
1597         tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
1598
1599         data_blob_free(&tkt);
1600
1601         /* Auth len in the rpc header doesn't include auth_header. */
1602         if (!prs_copy_data_in(auth_data, (char *)tkt_wrapped.data, tkt_wrapped.length)) {
1603                 data_blob_free(&tkt_wrapped);
1604                 prs_mem_free(auth_data);
1605                 return NT_STATUS_NO_MEMORY;
1606         }
1607
1608         DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
1609         dump_data(5, tkt_wrapped.data, tkt_wrapped.length);
1610
1611         data_blob_free(&tkt_wrapped);
1612         return NT_STATUS_OK;
1613 #else
1614         return NT_STATUS_INVALID_PARAMETER;
1615 #endif
1616 }
1617
1618 /*******************************************************************
1619  Creates SPNEGO NTLMSSP auth bind.
1620  ********************************************************************/
1621
1622 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1623                                                 enum dcerpc_AuthLevel auth_level,
1624                                                 RPC_HDR_AUTH *pauth_out,
1625                                                 prs_struct *auth_data)
1626 {
1627         NTSTATUS nt_status;
1628         DATA_BLOB null_blob = data_blob_null;
1629         DATA_BLOB request = data_blob_null;
1630         DATA_BLOB spnego_msg = data_blob_null;
1631
1632         /* We may change the pad length before marshalling. */
1633         init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_SPNEGO, (int)auth_level, 0, 1);
1634
1635         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1636         nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1637                                         null_blob,
1638                                         &request);
1639
1640         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1641                 data_blob_free(&request);
1642                 prs_mem_free(auth_data);
1643                 return nt_status;
1644         }
1645
1646         /* Wrap this in SPNEGO. */
1647         spnego_msg = gen_negTokenInit(OID_NTLMSSP, request);
1648
1649         data_blob_free(&request);
1650
1651         /* Auth len in the rpc header doesn't include auth_header. */
1652         if (!prs_copy_data_in(auth_data, (char *)spnego_msg.data, spnego_msg.length)) {
1653                 data_blob_free(&spnego_msg);
1654                 prs_mem_free(auth_data);
1655                 return NT_STATUS_NO_MEMORY;
1656         }
1657
1658         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1659         dump_data(5, spnego_msg.data, spnego_msg.length);
1660
1661         data_blob_free(&spnego_msg);
1662         return NT_STATUS_OK;
1663 }
1664
1665 /*******************************************************************
1666  Creates NTLMSSP auth bind.
1667  ********************************************************************/
1668
1669 static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1670                                                 enum dcerpc_AuthLevel auth_level,
1671                                                 RPC_HDR_AUTH *pauth_out,
1672                                                 prs_struct *auth_data)
1673 {
1674         NTSTATUS nt_status;
1675         DATA_BLOB null_blob = data_blob_null;
1676         DATA_BLOB request = data_blob_null;
1677
1678         /* We may change the pad length before marshalling. */
1679         init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_NTLMSSP, (int)auth_level, 0, 1);
1680
1681         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1682         nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1683                                         null_blob,
1684                                         &request);
1685
1686         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1687                 data_blob_free(&request);
1688                 prs_mem_free(auth_data);
1689                 return nt_status;
1690         }
1691
1692         /* Auth len in the rpc header doesn't include auth_header. */
1693         if (!prs_copy_data_in(auth_data, (char *)request.data, request.length)) {
1694                 data_blob_free(&request);
1695                 prs_mem_free(auth_data);
1696                 return NT_STATUS_NO_MEMORY;
1697         }
1698
1699         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1700         dump_data(5, request.data, request.length);
1701
1702         data_blob_free(&request);
1703         return NT_STATUS_OK;
1704 }
1705
1706 /*******************************************************************
1707  Creates schannel auth bind.
1708  ********************************************************************/
1709
1710 static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1711                                                 enum dcerpc_AuthLevel auth_level,
1712                                                 RPC_HDR_AUTH *pauth_out,
1713                                                 prs_struct *auth_data)
1714 {
1715         struct NL_AUTH_MESSAGE r;
1716         enum ndr_err_code ndr_err;
1717         DATA_BLOB blob;
1718
1719         /* We may change the pad length before marshalling. */
1720         init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_SCHANNEL, (int)auth_level, 0, 1);
1721
1722         /* Use lp_workgroup() if domain not specified */
1723
1724         if (!cli->auth->domain || !cli->auth->domain[0]) {
1725                 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1726                 if (cli->auth->domain == NULL) {
1727                         return NT_STATUS_NO_MEMORY;
1728                 }
1729         }
1730
1731         /*
1732          * Now marshall the data into the auth parse_struct.
1733          */
1734
1735         r.MessageType                   = NL_NEGOTIATE_REQUEST;
1736         r.Flags                         = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1737                                           NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1738         r.oem_netbios_domain.a          = cli->auth->domain;
1739         r.oem_netbios_computer.a        = global_myname();
1740
1741         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &r,
1742                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1743         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1744                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1745                 prs_mem_free(auth_data);
1746                 return ndr_map_error2ntstatus(ndr_err);
1747         }
1748
1749         if (DEBUGLEVEL >= 10) {
1750                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &r);
1751         }
1752
1753         if (!prs_copy_data_in(auth_data, (const char *)blob.data, blob.length))
1754         {
1755                 prs_mem_free(auth_data);
1756                 return NT_STATUS_NO_MEMORY;
1757         }
1758
1759         return NT_STATUS_OK;
1760 }
1761
1762 /*******************************************************************
1763  Creates the internals of a DCE/RPC bind request or alter context PDU.
1764  ********************************************************************/
1765
1766 static NTSTATUS create_bind_or_alt_ctx_internal(enum dcerpc_pkt_type pkt_type,
1767                                                 prs_struct *rpc_out,
1768                                                 uint32 rpc_call_id,
1769                                                 const struct ndr_syntax_id *abstract,
1770                                                 const struct ndr_syntax_id *transfer,
1771                                                 RPC_HDR_AUTH *phdr_auth,
1772                                                 prs_struct *pauth_info)
1773 {
1774         RPC_HDR hdr;
1775         RPC_HDR_RB hdr_rb;
1776         RPC_CONTEXT rpc_ctx;
1777         uint16 auth_len = prs_offset(pauth_info);
1778         uint8 ss_padding_len = 0;
1779         uint16 frag_len = 0;
1780
1781         /* create the RPC context. */
1782         init_rpc_context(&rpc_ctx, 0 /* context id */, abstract, transfer);
1783
1784         /* create the bind request RPC_HDR_RB */
1785         init_rpc_hdr_rb(&hdr_rb, RPC_MAX_PDU_FRAG_LEN, RPC_MAX_PDU_FRAG_LEN, 0x0, &rpc_ctx);
1786
1787         /* Start building the frag length. */
1788         frag_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1789
1790         /* Do we need to pad ? */
1791         if (auth_len) {
1792                 uint16 data_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1793                 if (data_len % 8) {
1794                         ss_padding_len = 8 - (data_len % 8);
1795                         phdr_auth->auth_pad_len = ss_padding_len;
1796                 }
1797                 frag_len += RPC_HDR_AUTH_LEN + auth_len + ss_padding_len;
1798         }
1799
1800         /* Create the request RPC_HDR */
1801         init_rpc_hdr(&hdr, pkt_type, DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST, rpc_call_id, frag_len, auth_len);
1802
1803         /* Marshall the RPC header */
1804         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
1805                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR.\n"));
1806                 return NT_STATUS_NO_MEMORY;
1807         }
1808
1809         /* Marshall the bind request data */
1810         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
1811                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1812                 return NT_STATUS_NO_MEMORY;
1813         }
1814
1815         /*
1816          * Grow the outgoing buffer to store any auth info.
1817          */
1818
1819         if(auth_len != 0) {
1820                 if (ss_padding_len) {
1821                         char pad[8];
1822                         memset(pad, '\0', 8);
1823                         if (!prs_copy_data_in(rpc_out, pad, ss_padding_len)) {
1824                                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall padding.\n"));
1825                                 return NT_STATUS_NO_MEMORY;
1826                         }
1827                 }
1828
1829                 if(!smb_io_rpc_hdr_auth("hdr_auth", phdr_auth, rpc_out, 0)) {
1830                         DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_AUTH.\n"));
1831                         return NT_STATUS_NO_MEMORY;
1832                 }
1833
1834
1835                 if(!prs_append_prs_data( rpc_out, pauth_info)) {
1836                         DEBUG(0,("create_bind_or_alt_ctx_internal: failed to grow parse struct to add auth.\n"));
1837                         return NT_STATUS_NO_MEMORY;
1838                 }
1839         }
1840
1841         return NT_STATUS_OK;
1842 }
1843
1844 /*******************************************************************
1845  Creates a DCE/RPC bind request.
1846  ********************************************************************/
1847
1848 static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
1849                                 prs_struct *rpc_out,
1850                                 uint32 rpc_call_id,
1851                                 const struct ndr_syntax_id *abstract,
1852                                 const struct ndr_syntax_id *transfer,
1853                                 enum pipe_auth_type auth_type,
1854                                 enum dcerpc_AuthLevel auth_level)
1855 {
1856         RPC_HDR_AUTH hdr_auth;
1857         prs_struct auth_info;
1858         NTSTATUS ret = NT_STATUS_OK;
1859
1860         ZERO_STRUCT(hdr_auth);
1861         if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
1862                 return NT_STATUS_NO_MEMORY;
1863
1864         switch (auth_type) {
1865                 case PIPE_AUTH_TYPE_SCHANNEL:
1866                         ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1867                         if (!NT_STATUS_IS_OK(ret)) {
1868                                 prs_mem_free(&auth_info);
1869                                 return ret;
1870                         }
1871                         break;
1872
1873                 case PIPE_AUTH_TYPE_NTLMSSP:
1874                         ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1875                         if (!NT_STATUS_IS_OK(ret)) {
1876                                 prs_mem_free(&auth_info);
1877                                 return ret;
1878                         }
1879                         break;
1880
1881                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1882                         ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1883                         if (!NT_STATUS_IS_OK(ret)) {
1884                                 prs_mem_free(&auth_info);
1885                                 return ret;
1886                         }
1887                         break;
1888
1889                 case PIPE_AUTH_TYPE_KRB5:
1890                         ret = create_krb5_auth_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1891                         if (!NT_STATUS_IS_OK(ret)) {
1892                                 prs_mem_free(&auth_info);
1893                                 return ret;
1894                         }
1895                         break;
1896
1897                 case PIPE_AUTH_TYPE_NONE:
1898                         break;
1899
1900                 default:
1901                         /* "Can't" happen. */
1902                         return NT_STATUS_INVALID_INFO_CLASS;
1903         }
1904
1905         ret = create_bind_or_alt_ctx_internal(DCERPC_PKT_BIND,
1906                                                 rpc_out,
1907                                                 rpc_call_id,
1908                                                 abstract,
1909                                                 transfer,
1910                                                 &hdr_auth,
1911                                                 &auth_info);
1912
1913         prs_mem_free(&auth_info);
1914         return ret;
1915 }
1916
1917 /*******************************************************************
1918  Create and add the NTLMSSP sign/seal auth header and data.
1919  ********************************************************************/
1920
1921 static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
1922                                         RPC_HDR *phdr,
1923                                         uint32 ss_padding_len,
1924                                         prs_struct *outgoing_pdu)
1925 {
1926         RPC_HDR_AUTH auth_info;
1927         NTSTATUS status;
1928         DATA_BLOB auth_blob = data_blob_null;
1929         uint16 data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1930
1931         if (!cli->auth->a_u.ntlmssp_state) {
1932                 return NT_STATUS_INVALID_PARAMETER;
1933         }
1934
1935         /* Init and marshall the auth header. */
1936         init_rpc_hdr_auth(&auth_info,
1937                         map_pipe_auth_type_to_rpc_auth_type(
1938                                 cli->auth->auth_type),
1939                         cli->auth->auth_level,
1940                         ss_padding_len,
1941                         1 /* context id. */);
1942
1943         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
1944                 DEBUG(0,("add_ntlmssp_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
1945                 data_blob_free(&auth_blob);
1946                 return NT_STATUS_NO_MEMORY;
1947         }
1948
1949         switch (cli->auth->auth_level) {
1950                 case DCERPC_AUTH_LEVEL_PRIVACY:
1951                         /* Data portion is encrypted. */
1952                         status = ntlmssp_seal_packet(cli->auth->a_u.ntlmssp_state,
1953                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1954                                         data_and_pad_len,
1955                                         (unsigned char *)prs_data_p(outgoing_pdu),
1956                                         (size_t)prs_offset(outgoing_pdu),
1957                                         &auth_blob);
1958                         if (!NT_STATUS_IS_OK(status)) {
1959                                 data_blob_free(&auth_blob);
1960                                 return status;
1961                         }
1962                         break;
1963
1964                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1965                         /* Data is signed. */
1966                         status = ntlmssp_sign_packet(cli->auth->a_u.ntlmssp_state,
1967                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1968                                         data_and_pad_len,
1969                                         (unsigned char *)prs_data_p(outgoing_pdu),
1970                                         (size_t)prs_offset(outgoing_pdu),
1971                                         &auth_blob);
1972                         if (!NT_STATUS_IS_OK(status)) {
1973                                 data_blob_free(&auth_blob);
1974                                 return status;
1975                         }
1976                         break;
1977
1978                 default:
1979                         /* Can't happen. */
1980                         smb_panic("bad auth level");
1981                         /* Notreached. */
1982                         return NT_STATUS_INVALID_PARAMETER;
1983         }
1984
1985         /* Finally marshall the blob. */
1986
1987         if (!prs_copy_data_in(outgoing_pdu, (const char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
1988                 DEBUG(0,("add_ntlmssp_auth_footer: failed to add %u bytes auth blob.\n",
1989                         (unsigned int)NTLMSSP_SIG_SIZE));
1990                 data_blob_free(&auth_blob);
1991                 return NT_STATUS_NO_MEMORY;
1992         }
1993
1994         data_blob_free(&auth_blob);
1995         return NT_STATUS_OK;
1996 }
1997
1998 /*******************************************************************
1999  Create and add the schannel sign/seal auth header and data.
2000  ********************************************************************/
2001
2002 static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
2003                                         RPC_HDR *phdr,
2004                                         uint32 ss_padding_len,
2005                                         prs_struct *outgoing_pdu)
2006 {
2007         RPC_HDR_AUTH auth_info;
2008         struct schannel_state *sas = cli->auth->a_u.schannel_auth;
2009         char *data_p = prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
2010         size_t data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
2011         DATA_BLOB blob;
2012         NTSTATUS status;
2013
2014         if (!sas) {
2015                 return NT_STATUS_INVALID_PARAMETER;
2016         }
2017
2018         /* Init and marshall the auth header. */
2019         init_rpc_hdr_auth(&auth_info,
2020                         map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
2021                         cli->auth->auth_level,
2022                         ss_padding_len,
2023                         1 /* context id. */);
2024
2025         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
2026                 DEBUG(0,("add_schannel_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
2027                 return NT_STATUS_NO_MEMORY;
2028         }
2029
2030         DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
2031                         sas->seq_num));
2032
2033         switch (cli->auth->auth_level) {
2034         case DCERPC_AUTH_LEVEL_PRIVACY:
2035                 status = netsec_outgoing_packet(sas,
2036                                                 talloc_tos(),
2037                                                 true,
2038                                                 (uint8_t *)data_p,
2039                                                 data_and_pad_len,
2040                                                 &blob);
2041                 break;
2042         case DCERPC_AUTH_LEVEL_INTEGRITY:
2043                 status = netsec_outgoing_packet(sas,
2044                                                 talloc_tos(),
2045                                                 false,
2046                                                 (uint8_t *)data_p,
2047                                                 data_and_pad_len,
2048                                                 &blob);
2049                 break;
2050         default:
2051                 status = NT_STATUS_INTERNAL_ERROR;
2052                 break;
2053         }
2054
2055         if (!NT_STATUS_IS_OK(status)) {
2056                 DEBUG(1,("add_schannel_auth_footer: failed to process packet: %s\n",
2057                         nt_errstr(status)));
2058                 return status;
2059         }
2060
2061         if (DEBUGLEVEL >= 10) {
2062                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2063         }
2064
2065         /* Finally marshall the blob. */
2066         if (!prs_copy_data_in(outgoing_pdu, (const char *)blob.data, blob.length)) {
2067                 return NT_STATUS_NO_MEMORY;
2068         }
2069
2070         return NT_STATUS_OK;
2071 }
2072
2073 /*******************************************************************
2074  Calculate how much data we're going to send in this packet, also
2075  work out any sign/seal padding length.
2076  ********************************************************************/
2077
2078 static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
2079                                         uint32 data_left,
2080                                         uint16 *p_frag_len,
2081                                         uint16 *p_auth_len,
2082                                         uint32 *p_ss_padding)
2083 {
2084         uint32 data_space, data_len;
2085
2086 #if 0
2087         if ((data_left > 0) && (sys_random() % 2)) {
2088                 data_left = MAX(data_left/2, 1);
2089         }
2090 #endif
2091
2092         switch (cli->auth->auth_level) {
2093                 case DCERPC_AUTH_LEVEL_NONE:
2094                 case DCERPC_AUTH_LEVEL_CONNECT:
2095                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN;
2096                         data_len = MIN(data_space, data_left);
2097                         *p_ss_padding = 0;
2098                         *p_auth_len = 0;
2099                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + data_len;
2100                         return data_len;
2101
2102                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2103                 case DCERPC_AUTH_LEVEL_PRIVACY:
2104                         /* Treat the same for all authenticated rpc requests. */
2105                         switch(cli->auth->auth_type) {
2106                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2107                                 case PIPE_AUTH_TYPE_NTLMSSP:
2108                                         *p_auth_len = NTLMSSP_SIG_SIZE;
2109                                         break;
2110                                 case PIPE_AUTH_TYPE_SCHANNEL:
2111                                         *p_auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
2112                                         break;
2113                                 default:
2114                                         smb_panic("bad auth type");
2115                                         break;
2116                         }
2117
2118                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2119                                                 RPC_HDR_AUTH_LEN - *p_auth_len;
2120
2121                         data_len = MIN(data_space, data_left);
2122                         *p_ss_padding = 0;
2123                         if (data_len % 8) {
2124                                 *p_ss_padding = 8 - (data_len % 8);
2125                         }
2126                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN +                /* Normal headers. */
2127                                         data_len + *p_ss_padding +              /* data plus padding. */
2128                                         RPC_HDR_AUTH_LEN + *p_auth_len;         /* Auth header and auth data. */
2129                         return data_len;
2130
2131                 default:
2132                         smb_panic("bad auth level");
2133                         /* Notreached. */
2134                         return 0;
2135         }
2136 }
2137
2138 /*******************************************************************
2139  External interface.
2140  Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
2141  Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
2142  and deals with signing/sealing details.
2143  ********************************************************************/
2144
2145 struct rpc_api_pipe_req_state {
2146         struct event_context *ev;
2147         struct rpc_pipe_client *cli;
2148         uint8_t op_num;
2149         uint32_t call_id;
2150         prs_struct *req_data;
2151         uint32_t req_data_sent;
2152         prs_struct outgoing_frag;
2153         prs_struct reply_pdu;
2154 };
2155
2156 static int rpc_api_pipe_req_state_destructor(struct rpc_api_pipe_req_state *s)
2157 {
2158         prs_mem_free(&s->outgoing_frag);
2159         prs_mem_free(&s->reply_pdu);
2160         return 0;
2161 }
2162
2163 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
2164 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
2165 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2166                                   bool *is_last_frag);
2167
2168 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
2169                                          struct event_context *ev,
2170                                          struct rpc_pipe_client *cli,
2171                                          uint8_t op_num,
2172                                          prs_struct *req_data)
2173 {
2174         struct tevent_req *req, *subreq;
2175         struct rpc_api_pipe_req_state *state;
2176         NTSTATUS status;
2177         bool is_last_frag;
2178
2179         req = tevent_req_create(mem_ctx, &state,
2180                                 struct rpc_api_pipe_req_state);
2181         if (req == NULL) {
2182                 return NULL;
2183         }
2184         state->ev = ev;
2185         state->cli = cli;
2186         state->op_num = op_num;
2187         state->req_data = req_data;
2188         state->req_data_sent = 0;
2189         state->call_id = get_rpc_call_id();
2190
2191         if (cli->max_xmit_frag
2192             < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_MAX_SIGN_SIZE) {
2193                 /* Server is screwed up ! */
2194                 status = NT_STATUS_INVALID_PARAMETER;
2195                 goto post_status;
2196         }
2197
2198         prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2199
2200         if (!prs_init(&state->outgoing_frag, cli->max_xmit_frag,
2201                       state, MARSHALL)) {
2202                 goto fail;
2203         }
2204
2205         talloc_set_destructor(state, rpc_api_pipe_req_state_destructor);
2206
2207         status = prepare_next_frag(state, &is_last_frag);
2208         if (!NT_STATUS_IS_OK(status)) {
2209                 goto post_status;
2210         }
2211
2212         if (is_last_frag) {
2213                 subreq = rpc_api_pipe_send(state, ev, state->cli,
2214                                            &state->outgoing_frag,
2215                                            DCERPC_PKT_RESPONSE);
2216                 if (subreq == NULL) {
2217                         goto fail;
2218                 }
2219                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
2220         } else {
2221                 subreq = rpc_write_send(
2222                         state, ev, cli->transport,
2223                         (uint8_t *)prs_data_p(&state->outgoing_frag),
2224                         prs_offset(&state->outgoing_frag));
2225                 if (subreq == NULL) {
2226                         goto fail;
2227                 }
2228                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
2229                                         req);
2230         }
2231         return req;
2232
2233  post_status:
2234         tevent_req_nterror(req, status);
2235         return tevent_req_post(req, ev);
2236  fail:
2237         TALLOC_FREE(req);
2238         return NULL;
2239 }
2240
2241 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2242                                   bool *is_last_frag)
2243 {
2244         RPC_HDR hdr;
2245         RPC_HDR_REQ hdr_req;
2246         uint32_t data_sent_thistime;
2247         uint16_t auth_len;
2248         uint16_t frag_len;
2249         uint8_t flags = 0;
2250         uint32_t ss_padding;
2251         uint32_t data_left;
2252         char pad[8] = { 0, };
2253         NTSTATUS status;
2254
2255         data_left = prs_offset(state->req_data) - state->req_data_sent;
2256
2257         data_sent_thistime = calculate_data_len_tosend(
2258                 state->cli, data_left, &frag_len, &auth_len, &ss_padding);
2259
2260         if (state->req_data_sent == 0) {
2261                 flags = DCERPC_PFC_FLAG_FIRST;
2262         }
2263
2264         if (data_sent_thistime == data_left) {
2265                 flags |= DCERPC_PFC_FLAG_LAST;
2266         }
2267
2268         if (!prs_set_offset(&state->outgoing_frag, 0)) {
2269                 return NT_STATUS_NO_MEMORY;
2270         }
2271
2272         /* Create and marshall the header and request header. */
2273         init_rpc_hdr(&hdr, DCERPC_PKT_REQUEST, flags, state->call_id, frag_len,
2274                      auth_len);
2275
2276         if (!smb_io_rpc_hdr("hdr    ", &hdr, &state->outgoing_frag, 0)) {
2277                 return NT_STATUS_NO_MEMORY;
2278         }
2279
2280         /* Create the rpc request RPC_HDR_REQ */
2281         init_rpc_hdr_req(&hdr_req, prs_offset(state->req_data),
2282                          state->op_num);
2283
2284         if (!smb_io_rpc_hdr_req("hdr_req", &hdr_req,
2285                                 &state->outgoing_frag, 0)) {
2286                 return NT_STATUS_NO_MEMORY;
2287         }
2288
2289         /* Copy in the data, plus any ss padding. */
2290         if (!prs_append_some_prs_data(&state->outgoing_frag,
2291                                       state->req_data, state->req_data_sent,
2292                                       data_sent_thistime)) {
2293                 return NT_STATUS_NO_MEMORY;
2294         }
2295
2296         /* Copy the sign/seal padding data. */
2297         if (!prs_copy_data_in(&state->outgoing_frag, pad, ss_padding)) {
2298                 return NT_STATUS_NO_MEMORY;
2299         }
2300
2301         /* Generate any auth sign/seal and add the auth footer. */
2302         switch (state->cli->auth->auth_type) {
2303         case PIPE_AUTH_TYPE_NONE:
2304                 status = NT_STATUS_OK;
2305                 break;
2306         case PIPE_AUTH_TYPE_NTLMSSP:
2307         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2308                 status = add_ntlmssp_auth_footer(state->cli, &hdr, ss_padding,
2309                                                  &state->outgoing_frag);
2310                 break;
2311         case PIPE_AUTH_TYPE_SCHANNEL:
2312                 status = add_schannel_auth_footer(state->cli, &hdr, ss_padding,
2313                                                   &state->outgoing_frag);
2314                 break;
2315         default:
2316                 status = NT_STATUS_INVALID_PARAMETER;
2317                 break;
2318         }
2319
2320         state->req_data_sent += data_sent_thistime;
2321         *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
2322
2323         return status;
2324 }
2325
2326 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
2327 {
2328         struct tevent_req *req = tevent_req_callback_data(
2329                 subreq, struct tevent_req);
2330         struct rpc_api_pipe_req_state *state = tevent_req_data(
2331                 req, struct rpc_api_pipe_req_state);
2332         NTSTATUS status;
2333         bool is_last_frag;
2334
2335         status = rpc_write_recv(subreq);
2336         TALLOC_FREE(subreq);
2337         if (!NT_STATUS_IS_OK(status)) {
2338                 tevent_req_nterror(req, status);
2339                 return;
2340         }
2341
2342         status = prepare_next_frag(state, &is_last_frag);
2343         if (!NT_STATUS_IS_OK(status)) {
2344                 tevent_req_nterror(req, status);
2345                 return;
2346         }
2347
2348         if (is_last_frag) {
2349                 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2350                                            &state->outgoing_frag,
2351                                            DCERPC_PKT_RESPONSE);
2352                 if (tevent_req_nomem(subreq, req)) {
2353                         return;
2354                 }
2355                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
2356         } else {
2357                 subreq = rpc_write_send(
2358                         state, state->ev,
2359                         state->cli->transport,
2360                         (uint8_t *)prs_data_p(&state->outgoing_frag),
2361                         prs_offset(&state->outgoing_frag));
2362                 if (tevent_req_nomem(subreq, req)) {
2363                         return;
2364                 }
2365                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
2366                                         req);
2367         }
2368 }
2369
2370 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
2371 {
2372         struct tevent_req *req = tevent_req_callback_data(
2373                 subreq, struct tevent_req);
2374         struct rpc_api_pipe_req_state *state = tevent_req_data(
2375                 req, struct rpc_api_pipe_req_state);
2376         NTSTATUS status;
2377
2378         status = rpc_api_pipe_recv(subreq, state, &state->reply_pdu);
2379         TALLOC_FREE(subreq);
2380         if (!NT_STATUS_IS_OK(status)) {
2381                 tevent_req_nterror(req, status);
2382                 return;
2383         }
2384         tevent_req_done(req);
2385 }
2386
2387 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2388                                prs_struct *reply_pdu)
2389 {
2390         struct rpc_api_pipe_req_state *state = tevent_req_data(
2391                 req, struct rpc_api_pipe_req_state);
2392         NTSTATUS status;
2393
2394         if (tevent_req_is_nterror(req, &status)) {
2395                 /*
2396                  * We always have to initialize to reply pdu, even if there is
2397                  * none. The rpccli_* caller routines expect this.
2398                  */
2399                 prs_init_empty(reply_pdu, mem_ctx, UNMARSHALL);
2400                 return status;
2401         }
2402
2403         *reply_pdu = state->reply_pdu;
2404         reply_pdu->mem_ctx = mem_ctx;
2405
2406         /*
2407          * Prevent state->req_pdu from being freed in
2408          * rpc_api_pipe_req_state_destructor()
2409          */
2410         prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2411
2412         return NT_STATUS_OK;
2413 }
2414
2415 #if 0
2416 /****************************************************************************
2417  Set the handle state.
2418 ****************************************************************************/
2419
2420 static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
2421                                    const char *pipe_name, uint16 device_state)
2422 {
2423         bool state_set = False;
2424         char param[2];
2425         uint16 setup[2]; /* only need 2 uint16 setup parameters */
2426         char *rparam = NULL;
2427         char *rdata = NULL;
2428         uint32 rparam_len, rdata_len;
2429
2430         if (pipe_name == NULL)
2431                 return False;
2432
2433         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
2434                  cli->fnum, pipe_name, device_state));
2435
2436         /* create parameters: device state */
2437         SSVAL(param, 0, device_state);
2438
2439         /* create setup parameters. */
2440         setup[0] = 0x0001;
2441         setup[1] = cli->fnum; /* pipe file handle.  got this from an SMBOpenX. */
2442
2443         /* send the data on \PIPE\ */
2444         if (cli_api_pipe(cli->cli, "\\PIPE\\",
2445                     setup, 2, 0,                /* setup, length, max */
2446                     param, 2, 0,                /* param, length, max */
2447                     NULL, 0, 1024,              /* data, length, max */
2448                     &rparam, &rparam_len,        /* return param, length */
2449                     &rdata, &rdata_len))         /* return data, length */
2450         {
2451                 DEBUG(5, ("Set Handle state: return OK\n"));
2452                 state_set = True;
2453         }
2454
2455         SAFE_FREE(rparam);
2456         SAFE_FREE(rdata);
2457
2458         return state_set;
2459 }
2460 #endif
2461
2462 /****************************************************************************
2463  Check the rpc bind acknowledge response.
2464 ****************************************************************************/
2465
2466 static bool check_bind_response(RPC_HDR_BA *hdr_ba,
2467                                 const struct ndr_syntax_id *transfer)
2468 {
2469         if ( hdr_ba->addr.len == 0) {
2470                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
2471         }
2472
2473         /* check the transfer syntax */
2474         if ((hdr_ba->transfer.if_version != transfer->if_version) ||
2475              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
2476                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
2477                 return False;
2478         }
2479
2480         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
2481                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
2482                           hdr_ba->res.num_results, hdr_ba->res.reason));
2483         }
2484
2485         DEBUG(5,("check_bind_response: accepted!\n"));
2486         return True;
2487 }
2488
2489 /*******************************************************************
2490  Creates a DCE/RPC bind authentication response.
2491  This is the packet that is sent back to the server once we
2492  have received a BIND-ACK, to finish the third leg of
2493  the authentication handshake.
2494  ********************************************************************/
2495
2496 static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
2497                                 uint32 rpc_call_id,
2498                                 enum pipe_auth_type auth_type,
2499                                 enum dcerpc_AuthLevel auth_level,
2500                                 DATA_BLOB *pauth_blob,
2501                                 prs_struct *rpc_out)
2502 {
2503         RPC_HDR hdr;
2504         RPC_HDR_AUTH hdr_auth;
2505         uint32 pad = 0;
2506
2507         /* Create the request RPC_HDR */
2508         init_rpc_hdr(&hdr, DCERPC_PKT_AUTH3, DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST, rpc_call_id,
2509                      RPC_HEADER_LEN + 4 /* pad */ + RPC_HDR_AUTH_LEN + pauth_blob->length,
2510                      pauth_blob->length );
2511
2512         /* Marshall it. */
2513         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
2514                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR.\n"));
2515                 return NT_STATUS_NO_MEMORY;
2516         }
2517
2518         /*
2519                 I'm puzzled about this - seems to violate the DCE RPC auth rules,
2520                 about padding - shouldn't this pad to length 8 ? JRA.
2521         */
2522
2523         /* 4 bytes padding. */
2524         if (!prs_uint32("pad", rpc_out, 0, &pad)) {
2525                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall 4 byte pad.\n"));
2526                 return NT_STATUS_NO_MEMORY;
2527         }
2528
2529         /* Create the request RPC_HDR_AUTHA */
2530         init_rpc_hdr_auth(&hdr_auth,
2531                         map_pipe_auth_type_to_rpc_auth_type(auth_type),
2532                         auth_level, 0, 1);
2533
2534         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rpc_out, 0)) {
2535                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR_AUTHA.\n"));
2536                 return NT_STATUS_NO_MEMORY;
2537         }
2538
2539         /*
2540          * Append the auth data to the outgoing buffer.
2541          */
2542
2543         if(!prs_copy_data_in(rpc_out, (char *)pauth_blob->data, pauth_blob->length)) {
2544                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall auth blob.\n"));
2545                 return NT_STATUS_NO_MEMORY;
2546         }
2547
2548         return NT_STATUS_OK;
2549 }
2550
2551 /*******************************************************************
2552  Creates a DCE/RPC bind alter context authentication request which
2553  may contain a spnego auth blobl
2554  ********************************************************************/
2555
2556 static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
2557                                         const struct ndr_syntax_id *abstract,
2558                                         const struct ndr_syntax_id *transfer,
2559                                         enum dcerpc_AuthLevel auth_level,
2560                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
2561                                         prs_struct *rpc_out)
2562 {
2563         RPC_HDR_AUTH hdr_auth;
2564         prs_struct auth_info;
2565         NTSTATUS ret = NT_STATUS_OK;
2566
2567         ZERO_STRUCT(hdr_auth);
2568         if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
2569                 return NT_STATUS_NO_MEMORY;
2570
2571         /* We may change the pad length before marshalling. */
2572         init_rpc_hdr_auth(&hdr_auth, DCERPC_AUTH_TYPE_SPNEGO, (int)auth_level, 0, 1);
2573
2574         if (pauth_blob->length) {
2575                 if (!prs_copy_data_in(&auth_info, (const char *)pauth_blob->data, pauth_blob->length)) {
2576                         prs_mem_free(&auth_info);
2577                         return NT_STATUS_NO_MEMORY;
2578                 }
2579         }
2580
2581         ret = create_bind_or_alt_ctx_internal(DCERPC_PKT_ALTER,
2582                                                 rpc_out,
2583                                                 rpc_call_id,
2584                                                 abstract,
2585                                                 transfer,
2586                                                 &hdr_auth,
2587                                                 &auth_info);
2588         prs_mem_free(&auth_info);
2589         return ret;
2590 }
2591
2592 /****************************************************************************
2593  Do an rpc bind.
2594 ****************************************************************************/
2595
2596 struct rpc_pipe_bind_state {
2597         struct event_context *ev;
2598         struct rpc_pipe_client *cli;
2599         prs_struct rpc_out;
2600         uint32_t rpc_call_id;
2601 };
2602
2603 static int rpc_pipe_bind_state_destructor(struct rpc_pipe_bind_state *state)
2604 {
2605         prs_mem_free(&state->rpc_out);
2606         return 0;
2607 }
2608
2609 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
2610 static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
2611                                            struct rpc_pipe_bind_state *state,
2612                                            struct rpc_hdr_info *phdr,
2613                                            prs_struct *reply_pdu);
2614 static void rpc_bind_auth3_write_done(struct tevent_req *subreq);
2615 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
2616                                                     struct rpc_pipe_bind_state *state,
2617                                                     struct rpc_hdr_info *phdr,
2618                                                     prs_struct *reply_pdu);
2619 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq);
2620
2621 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
2622                                       struct event_context *ev,
2623                                       struct rpc_pipe_client *cli,
2624                                       struct cli_pipe_auth_data *auth)
2625 {
2626         struct tevent_req *req, *subreq;
2627         struct rpc_pipe_bind_state *state;
2628         NTSTATUS status;
2629
2630         req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
2631         if (req == NULL) {
2632                 return NULL;
2633         }
2634
2635         DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
2636                 rpccli_pipe_txt(talloc_tos(), cli),
2637                 (unsigned int)auth->auth_type,
2638                 (unsigned int)auth->auth_level ));
2639
2640         state->ev = ev;
2641         state->cli = cli;
2642         state->rpc_call_id = get_rpc_call_id();
2643
2644         prs_init_empty(&state->rpc_out, state, MARSHALL);
2645         talloc_set_destructor(state, rpc_pipe_bind_state_destructor);
2646
2647         cli->auth = talloc_move(cli, &auth);
2648
2649         /* Marshall the outgoing data. */
2650         status = create_rpc_bind_req(cli, &state->rpc_out,
2651                                      state->rpc_call_id,
2652                                      &cli->abstract_syntax,
2653                                      &cli->transfer_syntax,
2654                                      cli->auth->auth_type,
2655                                      cli->auth->auth_level);
2656
2657         if (!NT_STATUS_IS_OK(status)) {
2658                 goto post_status;
2659         }
2660
2661         subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
2662                                    DCERPC_PKT_BIND_ACK);
2663         if (subreq == NULL) {
2664                 goto fail;
2665         }
2666         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2667         return req;
2668
2669  post_status:
2670         tevent_req_nterror(req, status);
2671         return tevent_req_post(req, ev);
2672  fail:
2673         TALLOC_FREE(req);
2674         return NULL;
2675 }
2676
2677 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
2678 {
2679         struct tevent_req *req = tevent_req_callback_data(
2680                 subreq, struct tevent_req);
2681         struct rpc_pipe_bind_state *state = tevent_req_data(
2682                 req, struct rpc_pipe_bind_state);
2683         prs_struct reply_pdu;
2684         struct rpc_hdr_info hdr;
2685         struct rpc_hdr_ba_info hdr_ba;
2686         NTSTATUS status;
2687
2688         status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2689         TALLOC_FREE(subreq);
2690         if (!NT_STATUS_IS_OK(status)) {
2691                 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
2692                           rpccli_pipe_txt(talloc_tos(), state->cli),
2693                           nt_errstr(status)));
2694                 tevent_req_nterror(req, status);
2695                 return;
2696         }
2697
2698         /* Unmarshall the RPC header */
2699         if (!smb_io_rpc_hdr("hdr", &hdr, &reply_pdu, 0)) {
2700                 DEBUG(0, ("rpc_pipe_bind: failed to unmarshall RPC_HDR.\n"));
2701                 prs_mem_free(&reply_pdu);
2702                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2703                 return;
2704         }
2705
2706         if (!smb_io_rpc_hdr_ba("", &hdr_ba, &reply_pdu, 0)) {
2707                 DEBUG(0, ("rpc_pipe_bind: Failed to unmarshall "
2708                           "RPC_HDR_BA.\n"));
2709                 prs_mem_free(&reply_pdu);
2710                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2711                 return;
2712         }
2713
2714         if (!check_bind_response(&hdr_ba, &state->cli->transfer_syntax)) {
2715                 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
2716                 prs_mem_free(&reply_pdu);
2717                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2718                 return;
2719         }
2720
2721         state->cli->max_xmit_frag = hdr_ba.bba.max_tsize;
2722         state->cli->max_recv_frag = hdr_ba.bba.max_rsize;
2723
2724         /*
2725          * For authenticated binds we may need to do 3 or 4 leg binds.
2726          */
2727
2728         switch(state->cli->auth->auth_type) {
2729
2730         case PIPE_AUTH_TYPE_NONE:
2731         case PIPE_AUTH_TYPE_SCHANNEL:
2732                 /* Bind complete. */
2733                 prs_mem_free(&reply_pdu);
2734                 tevent_req_done(req);
2735                 break;
2736
2737         case PIPE_AUTH_TYPE_NTLMSSP:
2738                 /* Need to send AUTH3 packet - no reply. */
2739                 status = rpc_finish_auth3_bind_send(req, state, &hdr,
2740                                                     &reply_pdu);
2741                 prs_mem_free(&reply_pdu);
2742                 if (!NT_STATUS_IS_OK(status)) {
2743                         tevent_req_nterror(req, status);
2744                 }
2745                 break;
2746
2747         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2748                 /* Need to send alter context request and reply. */
2749                 status = rpc_finish_spnego_ntlmssp_bind_send(req, state, &hdr,
2750                                                              &reply_pdu);
2751                 prs_mem_free(&reply_pdu);
2752                 if (!NT_STATUS_IS_OK(status)) {
2753                         tevent_req_nterror(req, status);
2754                 }
2755                 break;
2756
2757         case PIPE_AUTH_TYPE_KRB5:
2758                 /* */
2759
2760         default:
2761                 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
2762                          (unsigned int)state->cli->auth->auth_type));
2763                 prs_mem_free(&reply_pdu);
2764                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2765         }
2766 }
2767
2768 static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
2769                                            struct rpc_pipe_bind_state *state,
2770                                            struct rpc_hdr_info *phdr,
2771                                            prs_struct *reply_pdu)
2772 {
2773         DATA_BLOB server_response = data_blob_null;
2774         DATA_BLOB client_reply = data_blob_null;
2775         struct rpc_hdr_auth_info hdr_auth;
2776         struct tevent_req *subreq;
2777         NTSTATUS status;
2778
2779         if ((phdr->auth_len == 0)
2780             || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2781                 return NT_STATUS_INVALID_PARAMETER;
2782         }
2783
2784         if (!prs_set_offset(
2785                     reply_pdu,
2786                     phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2787                 return NT_STATUS_INVALID_PARAMETER;
2788         }
2789
2790         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2791                 return NT_STATUS_INVALID_PARAMETER;
2792         }
2793
2794         /* TODO - check auth_type/auth_level match. */
2795
2796         server_response = data_blob_talloc(talloc_tos(), NULL, phdr->auth_len);
2797         prs_copy_data_out((char *)server_response.data, reply_pdu,
2798                           phdr->auth_len);
2799
2800         status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2801                                 server_response, &client_reply);
2802
2803         if (!NT_STATUS_IS_OK(status)) {
2804                 DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
2805                           "blob failed: %s.\n", nt_errstr(status)));
2806                 return status;
2807         }
2808
2809         prs_init_empty(&state->rpc_out, talloc_tos(), MARSHALL);
2810
2811         status = create_rpc_bind_auth3(state->cli, state->rpc_call_id,
2812                                        state->cli->auth->auth_type,
2813                                        state->cli->auth->auth_level,
2814                                        &client_reply, &state->rpc_out);
2815         data_blob_free(&client_reply);
2816
2817         if (!NT_STATUS_IS_OK(status)) {
2818                 return status;
2819         }
2820
2821         subreq = rpc_write_send(state, state->ev, state->cli->transport,
2822                                 (uint8_t *)prs_data_p(&state->rpc_out),
2823                                 prs_offset(&state->rpc_out));
2824         if (subreq == NULL) {
2825                 return NT_STATUS_NO_MEMORY;
2826         }
2827         tevent_req_set_callback(subreq, rpc_bind_auth3_write_done, req);
2828         return NT_STATUS_OK;
2829 }
2830
2831 static void rpc_bind_auth3_write_done(struct tevent_req *subreq)
2832 {
2833         struct tevent_req *req = tevent_req_callback_data(
2834                 subreq, struct tevent_req);
2835         NTSTATUS status;
2836
2837         status = rpc_write_recv(subreq);
2838         TALLOC_FREE(subreq);
2839         if (!NT_STATUS_IS_OK(status)) {
2840                 tevent_req_nterror(req, status);
2841                 return;
2842         }
2843         tevent_req_done(req);
2844 }
2845
2846 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
2847                                                     struct rpc_pipe_bind_state *state,
2848                                                     struct rpc_hdr_info *phdr,
2849                                                     prs_struct *reply_pdu)
2850 {
2851         DATA_BLOB server_spnego_response = data_blob_null;
2852         DATA_BLOB server_ntlm_response = data_blob_null;
2853         DATA_BLOB client_reply = data_blob_null;
2854         DATA_BLOB tmp_blob = data_blob_null;
2855         RPC_HDR_AUTH hdr_auth;
2856         struct tevent_req *subreq;
2857         NTSTATUS status;
2858
2859         if ((phdr->auth_len == 0)
2860             || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2861                 return NT_STATUS_INVALID_PARAMETER;
2862         }
2863
2864         /* Process the returned NTLMSSP blob first. */
2865         if (!prs_set_offset(
2866                     reply_pdu,
2867                     phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2868                 return NT_STATUS_INVALID_PARAMETER;
2869         }
2870
2871         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2872                 return NT_STATUS_INVALID_PARAMETER;
2873         }
2874
2875         server_spnego_response = data_blob(NULL, phdr->auth_len);
2876         prs_copy_data_out((char *)server_spnego_response.data,
2877                           reply_pdu, phdr->auth_len);
2878
2879         /*
2880          * The server might give us back two challenges - tmp_blob is for the
2881          * second.
2882          */
2883         if (!spnego_parse_challenge(server_spnego_response,
2884                                     &server_ntlm_response, &tmp_blob)) {
2885                 data_blob_free(&server_spnego_response);
2886                 data_blob_free(&server_ntlm_response);
2887                 data_blob_free(&tmp_blob);
2888                 return NT_STATUS_INVALID_PARAMETER;
2889         }
2890
2891         /* We're finished with the server spnego response and the tmp_blob. */
2892         data_blob_free(&server_spnego_response);
2893         data_blob_free(&tmp_blob);
2894
2895         status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2896                                 server_ntlm_response, &client_reply);
2897
2898         /* Finished with the server_ntlm response */
2899         data_blob_free(&server_ntlm_response);
2900
2901         if (!NT_STATUS_IS_OK(status)) {
2902                 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
2903                           "using server blob failed.\n"));
2904                 data_blob_free(&client_reply);
2905                 return status;
2906         }
2907
2908         /* SPNEGO wrap the client reply. */
2909         tmp_blob = spnego_gen_auth(client_reply);
2910         data_blob_free(&client_reply);
2911         client_reply = tmp_blob;
2912         tmp_blob = data_blob_null;
2913
2914         /* Now prepare the alter context pdu. */
2915         prs_init_empty(&state->rpc_out, state, MARSHALL);
2916
2917         status = create_rpc_alter_context(state->rpc_call_id,
2918                                           &state->cli->abstract_syntax,
2919                                           &state->cli->transfer_syntax,
2920                                           state->cli->auth->auth_level,
2921                                           &client_reply,
2922                                           &state->rpc_out);
2923         data_blob_free(&client_reply);
2924
2925         if (!NT_STATUS_IS_OK(status)) {
2926                 return status;
2927         }
2928
2929         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2930                                    &state->rpc_out, DCERPC_PKT_ALTER_RESP);
2931         if (subreq == NULL) {
2932                 return NT_STATUS_NO_MEMORY;
2933         }
2934         tevent_req_set_callback(subreq, rpc_bind_ntlmssp_api_done, req);
2935         return NT_STATUS_OK;
2936 }
2937
2938 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq)
2939 {
2940         struct tevent_req *req = tevent_req_callback_data(
2941                 subreq, struct tevent_req);
2942         struct rpc_pipe_bind_state *state = tevent_req_data(
2943                 req, struct rpc_pipe_bind_state);
2944         DATA_BLOB server_spnego_response = data_blob_null;
2945         DATA_BLOB tmp_blob = data_blob_null;
2946         prs_struct reply_pdu;
2947         struct rpc_hdr_info hdr;
2948         struct rpc_hdr_auth_info hdr_auth;
2949         NTSTATUS status;
2950
2951         status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2952         TALLOC_FREE(subreq);
2953         if (!NT_STATUS_IS_OK(status)) {
2954                 tevent_req_nterror(req, status);
2955                 return;
2956         }
2957
2958         /* Get the auth blob from the reply. */
2959         if (!smb_io_rpc_hdr("rpc_hdr   ", &hdr, &reply_pdu, 0)) {
2960                 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: Failed to "
2961                           "unmarshall RPC_HDR.\n"));
2962                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2963                 return;
2964         }
2965
2966         if (!prs_set_offset(
2967                     &reply_pdu,
2968                     hdr.frag_len - hdr.auth_len - RPC_HDR_AUTH_LEN)) {
2969                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
2970                 return;
2971         }
2972
2973         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &reply_pdu, 0)) {
2974                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
2975                 return;
2976         }
2977
2978         server_spnego_response = data_blob(NULL, hdr.auth_len);
2979         prs_copy_data_out((char *)server_spnego_response.data, &reply_pdu,
2980                           hdr.auth_len);
2981
2982         /* Check we got a valid auth response. */
2983         if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK,
2984                                         OID_NTLMSSP, &tmp_blob)) {
2985                 data_blob_free(&server_spnego_response);
2986                 data_blob_free(&tmp_blob);
2987                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
2988                 return;
2989         }
2990
2991         data_blob_free(&server_spnego_response);
2992         data_blob_free(&tmp_blob);
2993
2994         DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
2995                  "%s.\n", rpccli_pipe_txt(talloc_tos(), state->cli)));
2996         tevent_req_done(req);
2997 }
2998
2999 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
3000 {
3001         return tevent_req_simple_recv_ntstatus(req);
3002 }
3003
3004 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
3005                        struct cli_pipe_auth_data *auth)
3006 {
3007         TALLOC_CTX *frame = talloc_stackframe();
3008         struct event_context *ev;
3009         struct tevent_req *req;
3010         NTSTATUS status = NT_STATUS_OK;
3011
3012         ev = event_context_init(frame);
3013         if (ev == NULL) {
3014                 status = NT_STATUS_NO_MEMORY;
3015                 goto fail;
3016         }
3017
3018         req = rpc_pipe_bind_send(frame, ev, cli, auth);
3019         if (req == NULL) {
3020                 status = NT_STATUS_NO_MEMORY;
3021                 goto fail;
3022         }
3023
3024         if (!tevent_req_poll(req, ev)) {
3025                 status = map_nt_error_from_unix(errno);
3026                 goto fail;
3027         }
3028
3029         status = rpc_pipe_bind_recv(req);
3030  fail:
3031         TALLOC_FREE(frame);
3032         return status;
3033 }
3034
3035 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
3036                                 unsigned int timeout)
3037 {
3038         struct cli_state *cli = rpc_pipe_np_smb_conn(rpc_cli);
3039
3040         if (cli == NULL) {
3041                 return 0;
3042         }
3043         return cli_set_timeout(cli, timeout);
3044 }
3045
3046 bool rpccli_get_pwd_hash(struct rpc_pipe_client *rpc_cli, uint8_t nt_hash[16])
3047 {
3048         struct cli_state *cli;
3049
3050         if ((rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_NTLMSSP)
3051             || (rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP)) {
3052                 memcpy(nt_hash, rpc_cli->auth->a_u.ntlmssp_state->nt_hash, 16);
3053                 return true;
3054         }
3055
3056         cli = rpc_pipe_np_smb_conn(rpc_cli);
3057         if (cli == NULL) {
3058                 return false;
3059         }
3060         E_md4hash(cli->password ? cli->password : "", nt_hash);
3061         return true;
3062 }
3063
3064 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
3065                                struct cli_pipe_auth_data **presult)
3066 {
3067         struct cli_pipe_auth_data *result;
3068
3069         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3070         if (result == NULL) {
3071                 return NT_STATUS_NO_MEMORY;
3072         }
3073
3074         result->auth_type = PIPE_AUTH_TYPE_NONE;
3075         result->auth_level = DCERPC_AUTH_LEVEL_NONE;
3076
3077         result->user_name = talloc_strdup(result, "");
3078         result->domain = talloc_strdup(result, "");
3079         if ((result->user_name == NULL) || (result->domain == NULL)) {
3080                 TALLOC_FREE(result);
3081                 return NT_STATUS_NO_MEMORY;
3082         }
3083
3084         *presult = result;
3085         return NT_STATUS_OK;
3086 }
3087
3088 static int cli_auth_ntlmssp_data_destructor(struct cli_pipe_auth_data *auth)
3089 {
3090         ntlmssp_end(&auth->a_u.ntlmssp_state);
3091         return 0;
3092 }
3093
3094 static NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
3095                                   enum pipe_auth_type auth_type,
3096                                   enum dcerpc_AuthLevel auth_level,
3097                                   const char *domain,
3098                                   const char *username,
3099                                   const char *password,
3100                                   struct cli_pipe_auth_data **presult)
3101 {
3102         struct cli_pipe_auth_data *result;
3103         NTSTATUS status;
3104
3105         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3106         if (result == NULL) {
3107                 return NT_STATUS_NO_MEMORY;
3108         }
3109
3110         result->auth_type = auth_type;
3111         result->auth_level = auth_level;
3112
3113         result->user_name = talloc_strdup(result, username);
3114         result->domain = talloc_strdup(result, domain);
3115         if ((result->user_name == NULL) || (result->domain == NULL)) {
3116                 status = NT_STATUS_NO_MEMORY;
3117                 goto fail;
3118         }
3119
3120         status = ntlmssp_client_start(&result->a_u.ntlmssp_state);
3121         if (!NT_STATUS_IS_OK(status)) {
3122                 goto fail;
3123         }
3124
3125         talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
3126
3127         status = ntlmssp_set_username(result->a_u.ntlmssp_state, username);
3128         if (!NT_STATUS_IS_OK(status)) {
3129                 goto fail;
3130         }
3131
3132         status = ntlmssp_set_domain(result->a_u.ntlmssp_state, domain);
3133         if (!NT_STATUS_IS_OK(status)) {
3134                 goto fail;
3135         }
3136
3137         status = ntlmssp_set_password(result->a_u.ntlmssp_state, password);
3138         if (!NT_STATUS_IS_OK(status)) {
3139                 goto fail;
3140         }
3141
3142         /*
3143          * Turn off sign+seal to allow selected auth level to turn it back on.
3144          */
3145         result->a_u.ntlmssp_state->neg_flags &=
3146                 ~(NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL);
3147
3148         if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
3149                 result->a_u.ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
3150         } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
3151                 result->a_u.ntlmssp_state->neg_flags
3152                         |= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
3153         }
3154
3155         *presult = result;
3156         return NT_STATUS_OK;
3157
3158  fail:
3159         TALLOC_FREE(result);
3160         return status;
3161 }
3162
3163 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
3164                                    enum dcerpc_AuthLevel auth_level,
3165                                    struct netlogon_creds_CredentialState *creds,
3166                                    struct cli_pipe_auth_data **presult)
3167 {
3168         struct cli_pipe_auth_data *result;
3169
3170         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3171         if (result == NULL) {
3172                 return NT_STATUS_NO_MEMORY;
3173         }
3174
3175         result->auth_type = PIPE_AUTH_TYPE_SCHANNEL;
3176         result->auth_level = auth_level;
3177
3178         result->user_name = talloc_strdup(result, "");
3179         result->domain = talloc_strdup(result, domain);
3180         if ((result->user_name == NULL) || (result->domain == NULL)) {
3181                 goto fail;
3182         }
3183
3184         result->a_u.schannel_auth = talloc(result, struct schannel_state);
3185         if (result->a_u.schannel_auth == NULL) {
3186                 goto fail;
3187         }
3188
3189         result->a_u.schannel_auth->state = SCHANNEL_STATE_START;
3190         result->a_u.schannel_auth->seq_num = 0;
3191         result->a_u.schannel_auth->initiator = true;
3192         result->a_u.schannel_auth->creds = creds;
3193
3194         *presult = result;
3195         return NT_STATUS_OK;
3196
3197  fail:
3198         TALLOC_FREE(result);
3199         return NT_STATUS_NO_MEMORY;
3200 }
3201
3202 #ifdef HAVE_KRB5
3203 static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
3204 {
3205         data_blob_free(&auth->session_key);
3206         return 0;
3207 }
3208 #endif
3209
3210 static NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
3211                                    enum dcerpc_AuthLevel auth_level,
3212                                    const char *service_princ,
3213                                    const char *username,
3214                                    const char *password,
3215                                    struct cli_pipe_auth_data **presult)
3216 {
3217 #ifdef HAVE_KRB5
3218         struct cli_pipe_auth_data *result;
3219
3220         if ((username != NULL) && (password != NULL)) {
3221                 int ret = kerberos_kinit_password(username, password, 0, NULL);
3222                 if (ret != 0) {
3223                         return NT_STATUS_ACCESS_DENIED;
3224                 }
3225         }
3226
3227         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3228         if (result == NULL) {
3229                 return NT_STATUS_NO_MEMORY;
3230         }
3231
3232         result->auth_type = PIPE_AUTH_TYPE_KRB5;
3233         result->auth_level = auth_level;
3234
3235         /*
3236          * Username / domain need fixing!
3237          */
3238         result->user_name = talloc_strdup(result, "");
3239         result->domain = talloc_strdup(result, "");
3240         if ((result->user_name == NULL) || (result->domain == NULL)) {
3241                 goto fail;
3242         }
3243
3244         result->a_u.kerberos_auth = TALLOC_ZERO_P(
3245                 result, struct kerberos_auth_struct);
3246         if (result->a_u.kerberos_auth == NULL) {
3247                 goto fail;
3248         }
3249         talloc_set_destructor(result->a_u.kerberos_auth,
3250                               cli_auth_kerberos_data_destructor);
3251
3252         result->a_u.kerberos_auth->service_principal = talloc_strdup(
3253                 result, service_princ);
3254         if (result->a_u.kerberos_auth->service_principal == NULL) {
3255                 goto fail;
3256         }
3257
3258         *presult = result;
3259         return NT_STATUS_OK;
3260
3261  fail:
3262         TALLOC_FREE(result);
3263         return NT_STATUS_NO_MEMORY;
3264 #else
3265         return NT_STATUS_NOT_SUPPORTED;
3266 #endif
3267 }
3268
3269 /**
3270  * Create an rpc pipe client struct, connecting to a tcp port.
3271  */
3272 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
3273                                        uint16_t port,
3274                                        const struct ndr_syntax_id *abstract_syntax,
3275                                        struct rpc_pipe_client **presult)
3276 {
3277         struct rpc_pipe_client *result;
3278         struct sockaddr_storage addr;
3279         NTSTATUS status;
3280         int fd;
3281
3282         result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
3283         if (result == NULL) {
3284                 return NT_STATUS_NO_MEMORY;
3285         }
3286
3287         result->abstract_syntax = *abstract_syntax;
3288         result->transfer_syntax = ndr_transfer_syntax;
3289         result->dispatch = cli_do_rpc_ndr;
3290         result->dispatch_send = cli_do_rpc_ndr_send;
3291         result->dispatch_recv = cli_do_rpc_ndr_recv;
3292
3293         result->desthost = talloc_strdup(result, host);
3294         result->srv_name_slash = talloc_asprintf_strupper_m(
3295                 result, "\\\\%s", result->desthost);
3296         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3297                 status = NT_STATUS_NO_MEMORY;
3298                 goto fail;
3299         }
3300
3301         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3302         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3303
3304         if (!resolve_name(host, &addr, 0, false)) {
3305                 status = NT_STATUS_NOT_FOUND;
3306                 goto fail;
3307         }
3308
3309         status = open_socket_out(&addr, port, 60, &fd);
3310         if (!NT_STATUS_IS_OK(status)) {
3311                 goto fail;
3312         }
3313         set_socket_options(fd, lp_socket_options());
3314
3315         status = rpc_transport_sock_init(result, fd, &result->transport);
3316         if (!NT_STATUS_IS_OK(status)) {
3317                 close(fd);
3318                 goto fail;
3319         }
3320
3321         result->transport->transport = NCACN_IP_TCP;
3322
3323         *presult = result;
3324         return NT_STATUS_OK;
3325
3326  fail:
3327         TALLOC_FREE(result);
3328         return status;
3329 }
3330
3331 /**
3332  * Determine the tcp port on which a dcerpc interface is listening
3333  * for the ncacn_ip_tcp transport via the endpoint mapper of the
3334  * target host.
3335  */
3336 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
3337                                       const struct ndr_syntax_id *abstract_syntax,
3338                                       uint16_t *pport)
3339 {
3340         NTSTATUS status;
3341         struct rpc_pipe_client *epm_pipe = NULL;
3342         struct cli_pipe_auth_data *auth = NULL;
3343         struct dcerpc_binding *map_binding = NULL;
3344         struct dcerpc_binding *res_binding = NULL;
3345         struct epm_twr_t *map_tower = NULL;
3346         struct epm_twr_t *res_towers = NULL;
3347         struct policy_handle *entry_handle = NULL;
3348         uint32_t num_towers = 0;
3349         uint32_t max_towers = 1;
3350         struct epm_twr_p_t towers;
3351         TALLOC_CTX *tmp_ctx = talloc_stackframe();
3352
3353         if (pport == NULL) {
3354                 status = NT_STATUS_INVALID_PARAMETER;
3355                 goto done;
3356         }
3357
3358         /* open the connection to the endpoint mapper */
3359         status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
3360                                         &ndr_table_epmapper.syntax_id,
3361                                         &epm_pipe);
3362
3363         if (!NT_STATUS_IS_OK(status)) {
3364                 goto done;
3365         }
3366
3367         status = rpccli_anon_bind_data(tmp_ctx, &auth);
3368         if (!NT_STATUS_IS_OK(status)) {
3369                 goto done;
3370         }
3371
3372         status = rpc_pipe_bind(epm_pipe, auth);
3373         if (!NT_STATUS_IS_OK(status)) {
3374                 goto done;
3375         }
3376
3377         /* create tower for asking the epmapper */
3378
3379         map_binding = TALLOC_ZERO_P(tmp_ctx, struct dcerpc_binding);
3380         if (map_binding == NULL) {
3381                 status = NT_STATUS_NO_MEMORY;
3382                 goto done;
3383         }
3384
3385         map_binding->transport = NCACN_IP_TCP;
3386         map_binding->object = *abstract_syntax;
3387         map_binding->host = host; /* needed? */
3388         map_binding->endpoint = "0"; /* correct? needed? */
3389
3390         map_tower = TALLOC_ZERO_P(tmp_ctx, struct epm_twr_t);
3391         if (map_tower == NULL) {
3392                 status = NT_STATUS_NO_MEMORY;
3393                 goto done;
3394         }
3395
3396         status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
3397                                             &(map_tower->tower));
3398         if (!NT_STATUS_IS_OK(status)) {
3399                 goto done;
3400         }
3401
3402         /* allocate further parameters for the epm_Map call */
3403
3404         res_towers = TALLOC_ARRAY(tmp_ctx, struct epm_twr_t, max_towers);
3405         if (res_towers == NULL) {
3406                 status = NT_STATUS_NO_MEMORY;
3407                 goto done;
3408         }
3409         towers.twr = res_towers;
3410
3411         entry_handle = TALLOC_ZERO_P(tmp_ctx, struct policy_handle);
3412         if (entry_handle == NULL) {
3413                 status = NT_STATUS_NO_MEMORY;
3414                 goto done;
3415         }
3416
3417         /* ask the endpoint mapper for the port */
3418
3419         status = rpccli_epm_Map(epm_pipe,
3420                                 tmp_ctx,
3421                                 CONST_DISCARD(struct GUID *,
3422                                               &(abstract_syntax->uuid)),
3423                                 map_tower,
3424                                 entry_handle,
3425                                 max_towers,
3426                                 &num_towers,
3427                                 &towers);
3428
3429         if (!NT_STATUS_IS_OK(status)) {
3430                 goto done;
3431         }
3432
3433         if (num_towers != 1) {
3434                 status = NT_STATUS_UNSUCCESSFUL;
3435                 goto done;
3436         }
3437
3438         /* extract the port from the answer */
3439
3440         status = dcerpc_binding_from_tower(tmp_ctx,
3441                                            &(towers.twr->tower),
3442                                            &res_binding);
3443         if (!NT_STATUS_IS_OK(status)) {
3444                 goto done;
3445         }
3446
3447         /* are further checks here necessary? */
3448         if (res_binding->transport != NCACN_IP_TCP) {
3449                 status = NT_STATUS_UNSUCCESSFUL;
3450                 goto done;
3451         }
3452
3453         *pport = (uint16_t)atoi(res_binding->endpoint);
3454
3455 done:
3456         TALLOC_FREE(tmp_ctx);
3457         return status;
3458 }
3459
3460 /**
3461  * Create a rpc pipe client struct, connecting to a host via tcp.
3462  * The port is determined by asking the endpoint mapper on the given
3463  * host.
3464  */
3465 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
3466                            const struct ndr_syntax_id *abstract_syntax,
3467                            struct rpc_pipe_client **presult)
3468 {
3469         NTSTATUS status;
3470         uint16_t port = 0;
3471
3472         status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
3473         if (!NT_STATUS_IS_OK(status)) {
3474                 return status;
3475         }
3476
3477         return rpc_pipe_open_tcp_port(mem_ctx, host, port,
3478                                         abstract_syntax, presult);
3479 }
3480
3481 /********************************************************************
3482  Create a rpc pipe client struct, connecting to a unix domain socket
3483  ********************************************************************/
3484 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
3485                                const struct ndr_syntax_id *abstract_syntax,
3486                                struct rpc_pipe_client **presult)
3487 {
3488         struct rpc_pipe_client *result;
3489         struct sockaddr_un addr;
3490         NTSTATUS status;
3491         int fd;
3492
3493         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
3494         if (result == NULL) {
3495                 return NT_STATUS_NO_MEMORY;
3496         }
3497
3498         result->abstract_syntax = *abstract_syntax;
3499         result->transfer_syntax = ndr_transfer_syntax;
3500         result->dispatch = cli_do_rpc_ndr;
3501         result->dispatch_send = cli_do_rpc_ndr_send;
3502         result->dispatch_recv = cli_do_rpc_ndr_recv;
3503
3504         result->desthost = get_myname(result);
3505         result->srv_name_slash = talloc_asprintf_strupper_m(
3506                 result, "\\\\%s", result->desthost);
3507         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3508                 status = NT_STATUS_NO_MEMORY;
3509                 goto fail;
3510         }
3511
3512         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3513         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3514
3515         fd = socket(AF_UNIX, SOCK_STREAM, 0);
3516         if (fd == -1) {
3517                 status = map_nt_error_from_unix(errno);
3518                 goto fail;
3519         }
3520
3521         ZERO_STRUCT(addr);
3522         addr.sun_family = AF_UNIX;
3523         strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
3524
3525         if (sys_connect(fd, (struct sockaddr *)(void *)&addr) == -1) {
3526                 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
3527                           strerror(errno)));
3528                 close(fd);
3529                 return map_nt_error_from_unix(errno);
3530         }
3531
3532         status = rpc_transport_sock_init(result, fd, &result->transport);
3533         if (!NT_STATUS_IS_OK(status)) {
3534                 close(fd);
3535                 goto fail;
3536         }
3537
3538         result->transport->transport = NCALRPC;
3539
3540         *presult = result;
3541         return NT_STATUS_OK;
3542
3543  fail:
3544         TALLOC_FREE(result);
3545         return status;
3546 }
3547
3548 static int rpc_pipe_client_np_destructor(struct rpc_pipe_client *p)
3549 {
3550         struct cli_state *cli;
3551
3552         cli = rpc_pipe_np_smb_conn(p);
3553         if (cli != NULL) {
3554                 DLIST_REMOVE(cli->pipe_list, p);
3555         }
3556         return 0;
3557 }
3558
3559 /****************************************************************************
3560  Open a named pipe over SMB to a remote server.
3561  *
3562  * CAVEAT CALLER OF THIS FUNCTION:
3563  *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
3564  *    so be sure that this function is called AFTER any structure (vs pointer)
3565  *    assignment of the cli.  In particular, libsmbclient does structure
3566  *    assignments of cli, which invalidates the data in the returned
3567  *    rpc_pipe_client if this function is called before the structure assignment
3568  *    of cli.
3569  *
3570  ****************************************************************************/
3571
3572 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
3573                                  const struct ndr_syntax_id *abstract_syntax,
3574                                  struct rpc_pipe_client **presult)
3575 {
3576         struct rpc_pipe_client *result;
3577         NTSTATUS status;
3578
3579         /* sanity check to protect against crashes */
3580
3581         if ( !cli ) {
3582                 return NT_STATUS_INVALID_HANDLE;
3583         }
3584
3585         result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
3586         if (result == NULL) {
3587                 return NT_STATUS_NO_MEMORY;
3588         }
3589
3590         result->abstract_syntax = *abstract_syntax;
3591         result->transfer_syntax = ndr_transfer_syntax;
3592         result->dispatch = cli_do_rpc_ndr;
3593         result->dispatch_send = cli_do_rpc_ndr_send;
3594         result->dispatch_recv = cli_do_rpc_ndr_recv;
3595         result->desthost = talloc_strdup(result, cli->desthost);
3596         result->srv_name_slash = talloc_asprintf_strupper_m(
3597                 result, "\\\\%s", result->desthost);
3598
3599         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3600         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3601
3602         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3603                 TALLOC_FREE(result);
3604                 return NT_STATUS_NO_MEMORY;
3605         }
3606
3607         status = rpc_transport_np_init(result, cli, abstract_syntax,
3608                                        &result->transport);
3609         if (!NT_STATUS_IS_OK(status)) {
3610                 TALLOC_FREE(result);
3611                 return status;
3612         }
3613
3614         result->transport->transport = NCACN_NP;
3615
3616         DLIST_ADD(cli->pipe_list, result);
3617         talloc_set_destructor(result, rpc_pipe_client_np_destructor);
3618
3619         *presult = result;
3620         return NT_STATUS_OK;
3621 }
3622
3623 NTSTATUS rpc_pipe_open_local(TALLOC_CTX *mem_ctx,
3624                              struct rpc_cli_smbd_conn *conn,
3625                              const struct ndr_syntax_id *syntax,
3626                              struct rpc_pipe_client **presult)
3627 {
3628         struct rpc_pipe_client *result;
3629         struct cli_pipe_auth_data *auth;
3630         NTSTATUS status;
3631
3632         result = talloc(mem_ctx, struct rpc_pipe_client);
3633         if (result == NULL) {
3634                 return NT_STATUS_NO_MEMORY;
3635         }
3636         result->abstract_syntax = *syntax;
3637         result->transfer_syntax = ndr_transfer_syntax;
3638         result->dispatch = cli_do_rpc_ndr;
3639         result->dispatch_send = cli_do_rpc_ndr_send;
3640         result->dispatch_recv = cli_do_rpc_ndr_recv;
3641         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3642         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3643
3644         result->desthost = talloc_strdup(result, global_myname());
3645         result->srv_name_slash = talloc_asprintf_strupper_m(
3646                 result, "\\\\%s", global_myname());
3647         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3648                 TALLOC_FREE(result);
3649                 return NT_STATUS_NO_MEMORY;
3650         }
3651
3652         status = rpc_transport_smbd_init(result, conn, syntax,
3653                                          &result->transport);
3654         if (!NT_STATUS_IS_OK(status)) {
3655                 DEBUG(1, ("rpc_transport_smbd_init failed: %s\n",
3656                           nt_errstr(status)));
3657                 TALLOC_FREE(result);
3658                 return status;
3659         }
3660
3661         status = rpccli_anon_bind_data(result, &auth);
3662         if (!NT_STATUS_IS_OK(status)) {
3663                 DEBUG(1, ("rpccli_anon_bind_data failed: %s\n",
3664                           nt_errstr(status)));
3665                 TALLOC_FREE(result);
3666                 return status;
3667         }
3668
3669         status = rpc_pipe_bind(result, auth);
3670         if (!NT_STATUS_IS_OK(status)) {
3671                 DEBUG(1, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
3672                 TALLOC_FREE(result);
3673                 return status;
3674         }
3675
3676         result->transport->transport = NCACN_INTERNAL;
3677
3678         *presult = result;
3679         return NT_STATUS_OK;
3680 }
3681
3682 /****************************************************************************
3683  Open a pipe to a remote server.
3684  ****************************************************************************/
3685
3686 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3687                                   enum dcerpc_transport_t transport,
3688                                   const struct ndr_syntax_id *interface,
3689                                   struct rpc_pipe_client **presult)
3690 {
3691         switch (transport) {
3692         case NCACN_IP_TCP:
3693                 return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
3694                                          presult);
3695         case NCACN_NP:
3696                 return rpc_pipe_open_np(cli, interface, presult);
3697         default:
3698                 return NT_STATUS_NOT_IMPLEMENTED;
3699         }
3700 }
3701
3702 /****************************************************************************
3703  Open a named pipe to an SMB server and bind anonymously.
3704  ****************************************************************************/
3705
3706 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
3707                                             enum dcerpc_transport_t transport,
3708                                             const struct ndr_syntax_id *interface,
3709                                             struct rpc_pipe_client **presult)
3710 {
3711         struct rpc_pipe_client *result;
3712         struct cli_pipe_auth_data *auth;
3713         NTSTATUS status;
3714
3715         status = cli_rpc_pipe_open(cli, transport, interface, &result);
3716         if (!NT_STATUS_IS_OK(status)) {
3717                 return status;
3718         }
3719
3720         status = rpccli_anon_bind_data(result, &auth);
3721         if (!NT_STATUS_IS_OK(status)) {
3722                 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3723                           nt_errstr(status)));
3724                 TALLOC_FREE(result);
3725                 return status;
3726         }
3727
3728         /*
3729          * This is a bit of an abstraction violation due to the fact that an
3730          * anonymous bind on an authenticated SMB inherits the user/domain
3731          * from the enclosing SMB creds
3732          */
3733
3734         TALLOC_FREE(auth->user_name);
3735         TALLOC_FREE(auth->domain);
3736
3737         auth->user_name = talloc_strdup(auth, cli->user_name);
3738         auth->domain = talloc_strdup(auth, cli->domain);
3739         auth->user_session_key = data_blob_talloc(auth,
3740                 cli->user_session_key.data,
3741                 cli->user_session_key.length);
3742
3743         if ((auth->user_name == NULL) || (auth->domain == NULL)) {
3744                 TALLOC_FREE(result);
3745                 return NT_STATUS_NO_MEMORY;
3746         }
3747
3748         status = rpc_pipe_bind(result, auth);
3749         if (!NT_STATUS_IS_OK(status)) {
3750                 int lvl = 0;
3751                 if (ndr_syntax_id_equal(interface,
3752                                         &ndr_table_dssetup.syntax_id)) {
3753                         /* non AD domains just don't have this pipe, avoid
3754                          * level 0 statement in that case - gd */
3755                         lvl = 3;
3756                 }
3757                 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3758                             "%s failed with error %s\n",
3759                             get_pipe_name_from_syntax(talloc_tos(), interface),
3760                             nt_errstr(status) ));
3761                 TALLOC_FREE(result);
3762                 return status;
3763         }
3764
3765         DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3766                   "%s and bound anonymously.\n",
3767                   get_pipe_name_from_syntax(talloc_tos(), interface),
3768                   cli->desthost));
3769
3770         *presult = result;
3771         return NT_STATUS_OK;
3772 }
3773
3774 /****************************************************************************
3775  ****************************************************************************/
3776
3777 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3778                                   const struct ndr_syntax_id *interface,
3779                                   struct rpc_pipe_client **presult)
3780 {
3781         return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
3782                                                   interface, presult);
3783 }
3784
3785 /****************************************************************************
3786  Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
3787  ****************************************************************************/
3788
3789 static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
3790                                                    const struct ndr_syntax_id *interface,
3791                                                    enum dcerpc_transport_t transport,
3792                                                    enum pipe_auth_type auth_type,
3793                                                    enum dcerpc_AuthLevel auth_level,
3794                                                    const char *domain,
3795                                                    const char *username,
3796                                                    const char *password,
3797                                                    struct rpc_pipe_client **presult)
3798 {
3799         struct rpc_pipe_client *result;
3800         struct cli_pipe_auth_data *auth;
3801         NTSTATUS status;
3802
3803         status = cli_rpc_pipe_open(cli, transport, interface, &result);
3804         if (!NT_STATUS_IS_OK(status)) {
3805                 return status;
3806         }
3807
3808         status = rpccli_ntlmssp_bind_data(
3809                 result, auth_type, auth_level, domain, username,
3810                 password, &auth);
3811         if (!NT_STATUS_IS_OK(status)) {
3812                 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
3813                           nt_errstr(status)));
3814                 goto err;
3815         }
3816
3817         status = rpc_pipe_bind(result, auth);
3818         if (!NT_STATUS_IS_OK(status)) {
3819                 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
3820                         nt_errstr(status) ));
3821                 goto err;
3822         }
3823
3824         DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
3825                 "machine %s and bound NTLMSSP as user %s\\%s.\n",
3826                   get_pipe_name_from_syntax(talloc_tos(), interface),
3827                   cli->desthost, domain, username ));
3828
3829         *presult = result;
3830         return NT_STATUS_OK;
3831
3832   err:
3833
3834         TALLOC_FREE(result);
3835         return status;
3836 }
3837
3838 /****************************************************************************
3839  External interface.
3840  Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
3841  ****************************************************************************/
3842
3843 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
3844                                    const struct ndr_syntax_id *interface,
3845                                    enum dcerpc_transport_t transport,
3846                                    enum dcerpc_AuthLevel auth_level,
3847                                    const char *domain,
3848                                    const char *username,
3849                                    const char *password,
3850                                    struct rpc_pipe_client **presult)
3851 {
3852         return cli_rpc_pipe_open_ntlmssp_internal(cli,
3853                                                 interface,
3854                                                 transport,
3855                                                 PIPE_AUTH_TYPE_NTLMSSP,
3856                                                 auth_level,
3857                                                 domain,
3858                                                 username,
3859                                                 password,
3860                                                 presult);
3861 }
3862
3863 /****************************************************************************
3864  External interface.
3865  Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
3866  ****************************************************************************/
3867
3868 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
3869                                           const struct ndr_syntax_id *interface,
3870                                           enum dcerpc_transport_t transport,
3871                                           enum dcerpc_AuthLevel auth_level,
3872                                           const char *domain,
3873                                           const char *username,
3874                                           const char *password,
3875                                           struct rpc_pipe_client **presult)
3876 {
3877         return cli_rpc_pipe_open_ntlmssp_internal(cli,
3878                                                 interface,
3879                                                 transport,
3880                                                 PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
3881                                                 auth_level,
3882                                                 domain,
3883                                                 username,
3884                                                 password,
3885                                                 presult);
3886 }
3887
3888 /****************************************************************************
3889   Get a the schannel session key out of an already opened netlogon pipe.
3890  ****************************************************************************/
3891 static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
3892                                                 struct cli_state *cli,
3893                                                 const char *domain,
3894                                                 uint32 *pneg_flags)
3895 {
3896         enum netr_SchannelType sec_chan_type = 0;
3897         unsigned char machine_pwd[16];
3898         const char *machine_account;
3899         NTSTATUS status;
3900
3901         /* Get the machine account credentials from secrets.tdb. */
3902         if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
3903                                &sec_chan_type))
3904         {
3905                 DEBUG(0, ("get_schannel_session_key: could not fetch "
3906                         "trust account password for domain '%s'\n",
3907                         domain));
3908                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3909         }
3910
3911         status = rpccli_netlogon_setup_creds(netlogon_pipe,
3912                                         cli->desthost, /* server name */
3913                                         domain,        /* domain */
3914                                         global_myname(), /* client name */
3915                                         machine_account, /* machine account name */
3916                                         machine_pwd,
3917                                         sec_chan_type,
3918                                         pneg_flags);
3919
3920         if (!NT_STATUS_IS_OK(status)) {
3921                 DEBUG(3, ("get_schannel_session_key_common: "
3922                           "rpccli_netlogon_setup_creds failed with result %s "
3923                           "to server %s, domain %s, machine account %s.\n",
3924                           nt_errstr(status), cli->desthost, domain,
3925                           machine_account ));
3926                 return status;
3927         }
3928
3929         if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
3930                 DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
3931                         cli->desthost));
3932                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3933         }
3934
3935         return NT_STATUS_OK;;
3936 }
3937
3938 /****************************************************************************
3939  Open a netlogon pipe and get the schannel session key.
3940  Now exposed to external callers.
3941  ****************************************************************************/
3942
3943
3944 NTSTATUS get_schannel_session_key(struct cli_state *cli,
3945                                   const char *domain,
3946                                   uint32 *pneg_flags,
3947                                   struct rpc_pipe_client **presult)
3948 {
3949         struct rpc_pipe_client *netlogon_pipe = NULL;
3950         NTSTATUS status;
3951
3952         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
3953                                           &netlogon_pipe);
3954         if (!NT_STATUS_IS_OK(status)) {
3955                 return status;
3956         }
3957
3958         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3959                                                  pneg_flags);
3960         if (!NT_STATUS_IS_OK(status)) {
3961                 TALLOC_FREE(netlogon_pipe);
3962                 return status;
3963         }
3964
3965         *presult = netlogon_pipe;
3966         return NT_STATUS_OK;
3967 }
3968
3969 /****************************************************************************
3970  External interface.
3971  Open a named pipe to an SMB server and bind using schannel (bind type 68)
3972  using session_key. sign and seal.
3973
3974  The *pdc will be stolen onto this new pipe
3975  ****************************************************************************/
3976
3977 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
3978                                              const struct ndr_syntax_id *interface,
3979                                              enum dcerpc_transport_t transport,
3980                                              enum dcerpc_AuthLevel auth_level,
3981                                              const char *domain,
3982                                              struct netlogon_creds_CredentialState **pdc,
3983                                              struct rpc_pipe_client **presult)
3984 {
3985         struct rpc_pipe_client *result;
3986         struct cli_pipe_auth_data *auth;
3987         NTSTATUS status;
3988
3989         status = cli_rpc_pipe_open(cli, transport, interface, &result);
3990         if (!NT_STATUS_IS_OK(status)) {
3991                 return status;
3992         }
3993
3994         status = rpccli_schannel_bind_data(result, domain, auth_level,
3995                                            *pdc, &auth);
3996         if (!NT_STATUS_IS_OK(status)) {
3997                 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3998                           nt_errstr(status)));
3999                 TALLOC_FREE(result);
4000                 return status;
4001         }
4002
4003         status = rpc_pipe_bind(result, auth);
4004         if (!NT_STATUS_IS_OK(status)) {
4005                 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
4006                           "cli_rpc_pipe_bind failed with error %s\n",
4007                           nt_errstr(status) ));
4008                 TALLOC_FREE(result);
4009                 return status;
4010         }
4011
4012         /*
4013          * The credentials on a new netlogon pipe are the ones we are passed
4014          * in - reference them in
4015          */
4016         result->dc = talloc_move(result, pdc);
4017
4018         DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
4019                   "for domain %s and bound using schannel.\n",
4020                   get_pipe_name_from_syntax(talloc_tos(), interface),
4021                   cli->desthost, domain ));
4022
4023         *presult = result;
4024         return NT_STATUS_OK;
4025 }
4026
4027 /****************************************************************************
4028  Open a named pipe to an SMB server and bind using schannel (bind type 68).
4029  Fetch the session key ourselves using a temporary netlogon pipe. This
4030  version uses an ntlmssp auth bound netlogon pipe to get the key.
4031  ****************************************************************************/
4032
4033 static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
4034                                                       const char *domain,
4035                                                       const char *username,
4036                                                       const char *password,
4037                                                       uint32 *pneg_flags,
4038                                                       struct rpc_pipe_client **presult)
4039 {
4040         struct rpc_pipe_client *netlogon_pipe = NULL;
4041         NTSTATUS status;
4042
4043         status = cli_rpc_pipe_open_spnego_ntlmssp(
4044                 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
4045                 DCERPC_AUTH_LEVEL_PRIVACY,
4046                 domain, username, password, &netlogon_pipe);
4047         if (!NT_STATUS_IS_OK(status)) {
4048                 return status;
4049         }
4050
4051         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
4052                                                  pneg_flags);
4053         if (!NT_STATUS_IS_OK(status)) {
4054                 TALLOC_FREE(netlogon_pipe);
4055                 return status;
4056         }
4057
4058         *presult = netlogon_pipe;
4059         return NT_STATUS_OK;
4060 }
4061
4062 /****************************************************************************
4063  Open a named pipe to an SMB server and bind using schannel (bind type 68).
4064  Fetch the session key ourselves using a temporary netlogon pipe. This version
4065  uses an ntlmssp bind to get the session key.
4066  ****************************************************************************/
4067
4068 NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
4069                                                  const struct ndr_syntax_id *interface,
4070                                                  enum dcerpc_transport_t transport,
4071                                                  enum dcerpc_AuthLevel auth_level,
4072                                                  const char *domain,
4073                                                  const char *username,
4074                                                  const char *password,
4075                                                  struct rpc_pipe_client **presult)
4076 {
4077         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
4078         struct rpc_pipe_client *netlogon_pipe = NULL;
4079         struct rpc_pipe_client *result = NULL;
4080         NTSTATUS status;
4081
4082         status = get_schannel_session_key_auth_ntlmssp(
4083                 cli, domain, username, password, &neg_flags, &netlogon_pipe);
4084         if (!NT_STATUS_IS_OK(status)) {
4085                 DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
4086                         "key from server %s for domain %s.\n",
4087                         cli->desthost, domain ));
4088                 return status;
4089         }
4090
4091         status = cli_rpc_pipe_open_schannel_with_key(
4092                 cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
4093                 &result);
4094
4095         /* Now we've bound using the session key we can close the netlog pipe. */
4096         TALLOC_FREE(netlogon_pipe);
4097
4098         if (NT_STATUS_IS_OK(status)) {
4099                 *presult = result;
4100         }
4101         return status;
4102 }
4103
4104 /****************************************************************************
4105  Open a named pipe to an SMB server and bind using schannel (bind type 68).
4106  Fetch the session key ourselves using a temporary netlogon pipe.
4107  ****************************************************************************/
4108
4109 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
4110                                     const struct ndr_syntax_id *interface,
4111                                     enum dcerpc_transport_t transport,
4112                                     enum dcerpc_AuthLevel auth_level,
4113                                     const char *domain,
4114                                     struct rpc_pipe_client **presult)
4115 {
4116         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
4117         struct rpc_pipe_client *netlogon_pipe = NULL;
4118         struct rpc_pipe_client *result = NULL;
4119         NTSTATUS status;
4120
4121         status = get_schannel_session_key(cli, domain, &neg_flags,
4122                                           &netlogon_pipe);
4123         if (!NT_STATUS_IS_OK(status)) {
4124                 DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
4125                         "key from server %s for domain %s.\n",
4126                         cli->desthost, domain ));
4127                 return status;
4128         }
4129
4130         status = cli_rpc_pipe_open_schannel_with_key(
4131                 cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
4132                 &result);
4133
4134         /* Now we've bound using the session key we can close the netlog pipe. */
4135         TALLOC_FREE(netlogon_pipe);
4136
4137         if (NT_STATUS_IS_OK(status)) {
4138                 *presult = result;
4139         }
4140
4141         return status;
4142 }
4143
4144 /****************************************************************************
4145  Open a named pipe to an SMB server and bind using krb5 (bind type 16).
4146  The idea is this can be called with service_princ, username and password all
4147  NULL so long as the caller has a TGT.
4148  ****************************************************************************/
4149
4150 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
4151                                 const struct ndr_syntax_id *interface,
4152                                 enum dcerpc_AuthLevel auth_level,
4153                                 const char *service_princ,
4154                                 const char *username,
4155                                 const char *password,
4156                                 struct rpc_pipe_client **presult)
4157 {
4158 #ifdef HAVE_KRB5
4159         struct rpc_pipe_client *result;
4160         struct cli_pipe_auth_data *auth;
4161         NTSTATUS status;
4162
4163         status = cli_rpc_pipe_open(cli, NCACN_NP, interface, &result);
4164         if (!NT_STATUS_IS_OK(status)) {
4165                 return status;
4166         }
4167
4168         status = rpccli_kerberos_bind_data(result, auth_level, service_princ,
4169                                            username, password, &auth);
4170         if (!NT_STATUS_IS_OK(status)) {
4171                 DEBUG(0, ("rpccli_kerberos_bind_data returned %s\n",
4172                           nt_errstr(status)));
4173                 TALLOC_FREE(result);
4174                 return status;
4175         }
4176
4177         status = rpc_pipe_bind(result, auth);
4178         if (!NT_STATUS_IS_OK(status)) {
4179                 DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
4180                           "with error %s\n", nt_errstr(status)));
4181                 TALLOC_FREE(result);
4182                 return status;
4183         }
4184
4185         *presult = result;
4186         return NT_STATUS_OK;
4187 #else
4188         DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
4189         return NT_STATUS_NOT_IMPLEMENTED;
4190 #endif
4191 }
4192
4193 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
4194                              struct rpc_pipe_client *cli,
4195                              DATA_BLOB *session_key)
4196 {
4197         if (!session_key || !cli) {
4198                 return NT_STATUS_INVALID_PARAMETER;
4199         }
4200
4201         if (!cli->auth) {
4202                 return NT_STATUS_INVALID_PARAMETER;
4203         }
4204
4205         switch (cli->auth->auth_type) {
4206                 case PIPE_AUTH_TYPE_SCHANNEL:
4207                         *session_key = data_blob_talloc(mem_ctx,
4208                                 cli->auth->a_u.schannel_auth->creds->session_key, 16);
4209                         break;
4210                 case PIPE_AUTH_TYPE_NTLMSSP:
4211                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
4212                         *session_key = data_blob_talloc(mem_ctx,
4213                                 cli->auth->a_u.ntlmssp_state->session_key.data,
4214                                 cli->auth->a_u.ntlmssp_state->session_key.length);
4215                         break;
4216                 case PIPE_AUTH_TYPE_KRB5:
4217                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
4218                         *session_key = data_blob_talloc(mem_ctx,
4219                                 cli->auth->a_u.kerberos_auth->session_key.data,
4220                                 cli->auth->a_u.kerberos_auth->session_key.length);
4221                         break;
4222                 case PIPE_AUTH_TYPE_NONE:
4223                         *session_key = data_blob_talloc(mem_ctx,
4224                                 cli->auth->user_session_key.data,
4225                                 cli->auth->user_session_key.length);
4226                         break;
4227                 default:
4228                         return NT_STATUS_NO_USER_SESSION_KEY;
4229         }
4230
4231         return NT_STATUS_OK;
4232 }