libcli/auth: rewrite schannel sign/seal code to be more generic
[ira/wip.git] / source3 / rpc_client / cli_pipe.c
index 5a53c0d94097180797d1272599b65c3aa90aa280..186696fbbcf259220e01107f27611d91d5499e7f 100644 (file)
  */
 
 #include "includes.h"
+#include "../libcli/auth/libcli_auth.h"
 #include "librpc/gen_ndr/cli_epmapper.h"
+#include "../librpc/gen_ndr/ndr_schannel.h"
+#include "../libcli/auth/schannel.h"
+#include "../libcli/auth/schannel_proto.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_RPC_CLI
@@ -55,7 +59,7 @@ static const struct pipe_id_info {
        /* the names appear not to matter: the syntaxes _do_ matter */
 
        const char *client_pipe;
-       const RPC_IFACE *abstr_syntax; /* this one is the abstract syntax id */
+       const struct ndr_syntax_id *abstr_syntax; /* this one is the abstract syntax id */
 } pipe_names [] =
 {
        { PIPE_LSARPC,          &ndr_table_lsarpc.syntax_id },
@@ -65,7 +69,7 @@ static const struct pipe_id_info {
        { PIPE_SRVSVC,          &ndr_table_srvsvc.syntax_id },
        { PIPE_WKSSVC,          &ndr_table_wkssvc.syntax_id },
        { PIPE_WINREG,          &ndr_table_winreg.syntax_id },
-       { PIPE_SPOOLSS,         &syntax_spoolss },
+       { PIPE_SPOOLSS,         &ndr_table_spoolss.syntax_id },
        { PIPE_NETDFS,          &ndr_table_netdfs.syntax_id },
        { PIPE_ECHO,            &ndr_table_rpcecho.syntax_id },
        { PIPE_SHUTDOWN,        &ndr_table_initshutdown.syntax_id },
@@ -81,9 +85,10 @@ static const struct pipe_id_info {
  Return the pipe name from the interface.
  ****************************************************************************/
 
-const char *cli_get_pipe_name_from_iface(TALLOC_CTX *mem_ctx,
-                                        const struct ndr_syntax_id *interface)
+const char *get_pipe_name_from_iface(const struct ndr_syntax_id *interface)
 {
+       char *guid_str;
+       const char *result;
        int i;
        for (i = 0; pipe_names[i].client_pipe; i++) {
                if (ndr_syntax_id_equal(pipe_names[i].abstr_syntax,
@@ -97,7 +102,18 @@ const char *cli_get_pipe_name_from_iface(TALLOC_CTX *mem_ctx,
         * interested in the known pipes mentioned in pipe_names[]
         */
 
-       return NULL;
+       guid_str = GUID_string(talloc_tos(), &interface->uuid);
+       if (guid_str == NULL) {
+               return NULL;
+       }
+       result = talloc_asprintf(talloc_tos(), "Interface %s.%d", guid_str,
+                                (int)interface->if_version);
+       TALLOC_FREE(guid_str);
+
+       if (result == NULL) {
+               return "PIPE";
+       }
+       return result;
 }
 
 /********************************************************************
@@ -109,20 +125,20 @@ static int map_pipe_auth_type_to_rpc_auth_type(enum pipe_auth_type auth_type)
        switch (auth_type) {
 
        case PIPE_AUTH_TYPE_NONE:
-               return RPC_ANONYMOUS_AUTH_TYPE;
+               return DCERPC_AUTH_TYPE_NONE;
 
        case PIPE_AUTH_TYPE_NTLMSSP:
-               return RPC_NTLMSSP_AUTH_TYPE;
+               return DCERPC_AUTH_TYPE_NTLMSSP;
 
        case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
        case PIPE_AUTH_TYPE_SPNEGO_KRB5:
-               return RPC_SPNEGO_AUTH_TYPE;
+               return DCERPC_AUTH_TYPE_SPNEGO;
 
        case PIPE_AUTH_TYPE_SCHANNEL:
-               return RPC_SCHANNEL_AUTH_TYPE;
+               return DCERPC_AUTH_TYPE_SCHANNEL;
 
        case PIPE_AUTH_TYPE_KRB5:
-               return RPC_KRB5_AUTH_TYPE;
+               return DCERPC_AUTH_TYPE_KRB5;
 
        default:
                DEBUG(0,("map_pipe_auth_type_to_rpc_type: unknown pipe "
@@ -195,18 +211,18 @@ struct rpc_read_state {
        size_t num_read;
 };
 
-static void rpc_read_done(struct async_req *subreq);
+static void rpc_read_done(struct tevent_req *subreq);
 
-static struct async_req *rpc_read_send(TALLOC_CTX *mem_ctx,
-                                      struct event_context *ev,
-                                      struct rpc_cli_transport *transport,
-                                      uint8_t *data, size_t size)
+static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
+                                       struct event_context *ev,
+                                       struct rpc_cli_transport *transport,
+                                       uint8_t *data, size_t size)
 {
-       struct async_req *result, *subreq;
+       struct tevent_req *req, *subreq;
        struct rpc_read_state *state;
 
-       if (!async_req_setup(mem_ctx, &result, &state,
-                            struct rpc_read_state)) {
+       req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
+       if (req == NULL) {
                return NULL;
        }
        state->ev = ev;
@@ -222,34 +238,33 @@ static struct async_req *rpc_read_send(TALLOC_CTX *mem_ctx,
        if (subreq == NULL) {
                goto fail;
        }
-       subreq->async.fn = rpc_read_done;
-       subreq->async.priv = result;
-       return result;
+       tevent_req_set_callback(subreq, rpc_read_done, req);
+       return req;
 
  fail:
-       TALLOC_FREE(result);
+       TALLOC_FREE(req);
        return NULL;
 }
 
-static void rpc_read_done(struct async_req *subreq)
+static void rpc_read_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct rpc_read_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_read_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct rpc_read_state *state = tevent_req_data(
+               req, struct rpc_read_state);
        NTSTATUS status;
        ssize_t received;
 
        status = state->transport->read_recv(subreq, &received);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
        state->num_read += received;
        if (state->num_read == state->size) {
-               async_req_done(req);
+               tevent_req_done(req);
                return;
        }
 
@@ -257,16 +272,15 @@ static void rpc_read_done(struct async_req *subreq)
                                             state->data + state->num_read,
                                             state->size - state->num_read,
                                             state->transport->priv);
-       if (async_req_nomem(subreq, req)) {
+       if (tevent_req_nomem(subreq, req)) {
                return;
        }
-       subreq->async.fn = rpc_read_done;
-       subreq->async.priv = req;
+       tevent_req_set_callback(subreq, rpc_read_done, req);
 }
 
-static NTSTATUS rpc_read_recv(struct async_req *req)
+static NTSTATUS rpc_read_recv(struct tevent_req *req)
 {
-       return async_req_simple_recv(req);
+       return tevent_req_simple_recv_ntstatus(req);
 }
 
 struct rpc_write_state {
@@ -277,18 +291,18 @@ struct rpc_write_state {
        size_t num_written;
 };
 
-static void rpc_write_done(struct async_req *subreq);
+static void rpc_write_done(struct tevent_req *subreq);
 
-static struct async_req *rpc_write_send(TALLOC_CTX *mem_ctx,
-                                       struct event_context *ev,
-                                       struct rpc_cli_transport *transport,
-                                       const uint8_t *data, size_t size)
+static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
+                                        struct event_context *ev,
+                                        struct rpc_cli_transport *transport,
+                                        const uint8_t *data, size_t size)
 {
-       struct async_req *result, *subreq;
+       struct tevent_req *req, *subreq;
        struct rpc_write_state *state;
 
-       if (!async_req_setup(mem_ctx, &result, &state,
-                            struct rpc_write_state)) {
+       req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
+       if (req == NULL) {
                return NULL;
        }
        state->ev = ev;
@@ -303,34 +317,33 @@ static struct async_req *rpc_write_send(TALLOC_CTX *mem_ctx,
        if (subreq == NULL) {
                goto fail;
        }
-       subreq->async.fn = rpc_write_done;
-       subreq->async.priv = result;
-       return result;
+       tevent_req_set_callback(subreq, rpc_write_done, req);
+       return req;
  fail:
-       TALLOC_FREE(result);
+       TALLOC_FREE(req);
        return NULL;
 }
 
-static void rpc_write_done(struct async_req *subreq)
+static void rpc_write_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct rpc_write_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_write_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct rpc_write_state *state = tevent_req_data(
+               req, struct rpc_write_state);
        NTSTATUS status;
        ssize_t written;
 
        status = state->transport->write_recv(subreq, &written);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
        state->num_written += written;
 
        if (state->num_written == state->size) {
-               async_req_done(req);
+               tevent_req_done(req);
                return;
        }
 
@@ -338,16 +351,15 @@ static void rpc_write_done(struct async_req *subreq)
                                              state->data + state->num_written,
                                              state->size - state->num_written,
                                              state->transport->priv);
-       if (async_req_nomem(subreq, req)) {
+       if (tevent_req_nomem(subreq, req)) {
                return;
        }
-       subreq->async.fn = rpc_write_done;
-       subreq->async.priv = req;
+       tevent_req_set_callback(subreq, rpc_write_done, req);
 }
 
-static NTSTATUS rpc_write_recv(struct async_req *req)
+static NTSTATUS rpc_write_recv(struct tevent_req *req)
 {
-       return async_req_simple_recv(req);
+       return tevent_req_simple_recv_ntstatus(req);
 }
 
 
@@ -387,22 +399,23 @@ struct get_complete_frag_state {
        prs_struct *pdu;
 };
 
-static void get_complete_frag_got_header(struct async_req *subreq);
-static void get_complete_frag_got_rest(struct async_req *subreq);
+static void get_complete_frag_got_header(struct tevent_req *subreq);
+static void get_complete_frag_got_rest(struct tevent_req *subreq);
 
-static struct async_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
-                                              struct event_context *ev,
-                                              struct rpc_pipe_client *cli,
-                                              struct rpc_hdr_info *prhdr,
-                                              prs_struct *pdu)
+static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
+                                                struct event_context *ev,
+                                                struct rpc_pipe_client *cli,
+                                                struct rpc_hdr_info *prhdr,
+                                                prs_struct *pdu)
 {
-       struct async_req *result, *subreq;
+       struct tevent_req *req, *subreq;
        struct get_complete_frag_state *state;
        uint32_t pdu_len;
        NTSTATUS status;
 
-       if (!async_req_setup(mem_ctx, &result, &state,
-                            struct get_complete_frag_state)) {
+       req = tevent_req_create(mem_ctx, &state,
+                               struct get_complete_frag_state);
+       if (req == NULL) {
                return NULL;
        }
        state->ev = ev;
@@ -425,9 +438,9 @@ static struct async_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
                        status = NT_STATUS_NO_MEMORY;
                        goto post_status;
                }
-               subreq->async.fn = get_complete_frag_got_header;
-               subreq->async.priv = result;
-               return result;
+               tevent_req_set_callback(subreq, get_complete_frag_got_header,
+                                       req);
+               return req;
        }
 
        status = parse_rpc_header(cli, prhdr, pdu);
@@ -451,43 +464,44 @@ static struct async_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
                        status = NT_STATUS_NO_MEMORY;
                        goto post_status;
                }
-               subreq->async.fn = get_complete_frag_got_rest;
-               subreq->async.priv = result;
-               return result;
+               tevent_req_set_callback(subreq, get_complete_frag_got_rest,
+                                       req);
+               return req;
        }
 
        status = NT_STATUS_OK;
  post_status:
-       if (async_post_status(result, ev, status)) {
-               return result;
+       if (NT_STATUS_IS_OK(status)) {
+               tevent_req_done(req);
+       } else {
+               tevent_req_nterror(req, status);
        }
-       TALLOC_FREE(result);
-       return NULL;
+       return tevent_req_post(req, ev);
 }
 
-static void get_complete_frag_got_header(struct async_req *subreq)
+static void get_complete_frag_got_header(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct get_complete_frag_state *state = talloc_get_type_abort(
-               req->private_data, struct get_complete_frag_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct get_complete_frag_state *state = tevent_req_data(
+               req, struct get_complete_frag_state);
        NTSTATUS status;
 
        status = rpc_read_recv(subreq);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
        status = parse_rpc_header(state->cli, state->prhdr, state->pdu);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
        if (!rpc_grow_buffer(state->pdu, state->prhdr->frag_len)) {
-               async_req_error(req, NT_STATUS_NO_MEMORY);
+               tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
                return;
        }
 
@@ -500,31 +514,30 @@ static void get_complete_frag_got_header(struct async_req *subreq)
                state, state->ev, state->cli->transport,
                (uint8_t *)(prs_data_p(state->pdu) + RPC_HEADER_LEN),
                state->prhdr->frag_len - RPC_HEADER_LEN);
-       if (async_req_nomem(subreq, req)) {
+       if (tevent_req_nomem(subreq, req)) {
                return;
        }
-       subreq->async.fn = get_complete_frag_got_rest;
-       subreq->async.priv = req;
+       tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
 }
 
-static void get_complete_frag_got_rest(struct async_req *subreq)
+static void get_complete_frag_got_rest(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
        NTSTATUS status;
 
        status = rpc_read_recv(subreq);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
-       async_req_done(req);
+       tevent_req_done(req);
 }
 
-static NTSTATUS get_complete_frag_recv(struct async_req *req)
+static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
 {
-       return async_req_simple_recv(req);
+       return tevent_req_simple_recv_ntstatus(req);
 }
 
 /****************************************************************************
@@ -548,8 +561,8 @@ static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *pr
        DATA_BLOB auth_blob;
        NTSTATUS status;
 
-       if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
-           || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
+       if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
+           || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
                return NT_STATUS_OK;
        }
 
@@ -594,7 +607,7 @@ static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *pr
        auth_blob.length = auth_len;
 
        switch (cli->auth->auth_level) {
-               case PIPE_AUTH_LEVEL_PRIVACY:
+               case DCERPC_AUTH_LEVEL_PRIVACY:
                        /* Data is encrypted. */
                        status = ntlmssp_unseal_packet(ntlmssp_state,
                                                        data, data_len,
@@ -609,7 +622,7 @@ static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *pr
                                return status;
                        }
                        break;
-               case PIPE_AUTH_LEVEL_INTEGRITY:
+               case DCERPC_AUTH_LEVEL_INTEGRITY:
                        /* Data is signed. */
                        status = ntlmssp_check_packet(ntlmssp_state,
                                                        data, data_len,
@@ -659,19 +672,21 @@ static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *p
                                uint8 *p_ss_padding_len)
 {
        RPC_HDR_AUTH auth_info;
-       RPC_AUTH_SCHANNEL_CHK schannel_chk;
        uint32 auth_len = prhdr->auth_len;
        uint32 save_offset = prs_offset(current_pdu);
-       struct schannel_auth_struct *schannel_auth =
+       struct schannel_state *schannel_auth =
                cli->auth->a_u.schannel_auth;
+       uint8_t *data;
        uint32 data_len;
+       DATA_BLOB blob;
+       NTSTATUS status;
 
-       if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
-           || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
+       if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
+           || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
                return NT_STATUS_OK;
        }
 
-       if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
+       if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
                DEBUG(0,("cli_pipe_verify_schannel: auth_len %u.\n", (unsigned int)auth_len ));
                return NT_STATUS_INVALID_PARAMETER;
        }
@@ -701,33 +716,50 @@ static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *p
                return NT_STATUS_BUFFER_TOO_SMALL;
        }
 
-       if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
+       if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
                DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n",
                        auth_info.auth_type));
                return NT_STATUS_BUFFER_TOO_SMALL;
        }
 
-       if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
-                               &schannel_chk, current_pdu, 0)) {
-               DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
-               return NT_STATUS_BUFFER_TOO_SMALL;
+       blob = data_blob_const(prs_data_p(current_pdu) + prs_offset(current_pdu), auth_len);
+
+       if (DEBUGLEVEL >= 10) {
+               dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
        }
 
-       if (!schannel_decode(schannel_auth,
-                       cli->auth->auth_level,
-                       SENDER_IS_ACCEPTOR,
-                       &schannel_chk,
-                       prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN,
-                       data_len)) {
+       data = (uint8_t *)prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN;
+
+       switch (cli->auth->auth_level) {
+       case DCERPC_AUTH_LEVEL_PRIVACY:
+               status = netsec_incoming_packet(schannel_auth,
+                                               talloc_tos(),
+                                               true,
+                                               data,
+                                               data_len,
+                                               &blob);
+               break;
+       case DCERPC_AUTH_LEVEL_INTEGRITY:
+               status = netsec_incoming_packet(schannel_auth,
+                                               talloc_tos(),
+                                               false,
+                                               data,
+                                               data_len,
+                                               &blob);
+               break;
+       default:
+               status = NT_STATUS_INTERNAL_ERROR;
+               break;
+       }
+
+       if (!NT_STATUS_IS_OK(status)) {
                DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
-                               "Connection to %s.\n",
-                               rpccli_pipe_txt(debug_ctx(), cli)));
+                               "Connection to %s (%s).\n",
+                               rpccli_pipe_txt(debug_ctx(), cli),
+                               nt_errstr(status)));
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       /* The sequence number gets incremented on both send and receive. */
-       schannel_auth->seq_num++;
-
        /*
         * Return the current pointer to the data offset.
         */
@@ -845,14 +877,14 @@ static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_H
 
        /* Ensure we have the correct type. */
        switch (prhdr->pkt_type) {
-               case RPC_ALTCONTRESP:
-               case RPC_BINDACK:
+               case DCERPC_PKT_ALTER_RESP:
+               case DCERPC_PKT_BIND_ACK:
 
                        /* Alter context and bind ack share the same packet definitions. */
                        break;
 
 
-               case RPC_RESPONSE:
+               case DCERPC_PKT_RESPONSE:
                {
                        RPC_HDR_RESP rhdr_resp;
                        uint8 ss_padding_len = 0;
@@ -908,14 +940,14 @@ static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_H
                        break;
                }
 
-               case RPC_BINDNACK:
+               case DCERPC_PKT_BIND_NAK:
                        DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
                                  "received from %s!\n",
                                  rpccli_pipe_txt(debug_ctx(), cli)));
                        /* Use this for now... */
                        return NT_STATUS_NETWORK_ACCESS_DENIED;
 
-               case RPC_FAULT:
+               case DCERPC_PKT_FAULT:
                {
                        RPC_HDR_RESP rhdr_resp;
                        RPC_HDR_FAULT fault_resp;
@@ -962,10 +994,10 @@ static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_H
           data before now as we may have needed to do cryptographic actions on
           it before. */
 
-       if ((prhdr->pkt_type == RPC_BINDACK) && !(prhdr->flags & RPC_FLG_LAST)) {
+       if ((prhdr->pkt_type == DCERPC_PKT_BIND_ACK) && !(prhdr->flags & DCERPC_PFC_FLAG_LAST)) {
                DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
                        "setting fragment first/last ON.\n"));
-               prhdr->flags |= RPC_FLG_FIRST|RPC_FLG_LAST;
+               prhdr->flags |= DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST;
        }
 
        return NT_STATUS_OK;
@@ -1025,22 +1057,22 @@ struct cli_api_pipe_state {
        uint32_t rdata_len;
 };
 
-static void cli_api_pipe_trans_done(struct async_req *subreq);
-static void cli_api_pipe_write_done(struct async_req *subreq);
-static void cli_api_pipe_read_done(struct async_req *subreq);
+static void cli_api_pipe_trans_done(struct tevent_req *subreq);
+static void cli_api_pipe_write_done(struct tevent_req *subreq);
+static void cli_api_pipe_read_done(struct tevent_req *subreq);
 
-static struct async_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
-                                          struct event_context *ev,
-                                          struct rpc_cli_transport *transport,
-                                          uint8_t *data, size_t data_len,
-                                          uint32_t max_rdata_len)
+static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
+                                           struct event_context *ev,
+                                           struct rpc_cli_transport *transport,
+                                           uint8_t *data, size_t data_len,
+                                           uint32_t max_rdata_len)
 {
-       struct async_req *result, *subreq;
+       struct tevent_req *req, *subreq;
        struct cli_api_pipe_state *state;
        NTSTATUS status;
 
-       if (!async_req_setup(mem_ctx, &result, &state,
-                            struct cli_api_pipe_state)) {
+       req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
+       if (req == NULL) {
                return NULL;
        }
        state->ev = ev;
@@ -1060,12 +1092,10 @@ static struct async_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
                subreq = transport->trans_send(state, ev, data, data_len,
                                               max_rdata_len, transport->priv);
                if (subreq == NULL) {
-                       status = NT_STATUS_NO_MEMORY;
-                       goto post_status;
+                       goto fail;
                }
-               subreq->async.fn = cli_api_pipe_trans_done;
-               subreq->async.priv = result;
-               return result;
+               tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
+               return req;
        }
 
        /*
@@ -1077,56 +1107,54 @@ static struct async_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
        if (subreq == NULL) {
                goto fail;
        }
-       subreq->async.fn = cli_api_pipe_write_done;
-       subreq->async.priv = result;
-       return result;
+       tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
+       return req;
 
        status = NT_STATUS_INVALID_PARAMETER;
 
  post_status:
-       if (async_post_status(result, ev, status)) {
-               return result;
-       }
+       tevent_req_nterror(req, status);
+       return tevent_req_post(req, ev);
  fail:
-       TALLOC_FREE(result);
+       TALLOC_FREE(req);
        return NULL;
 }
 
-static void cli_api_pipe_trans_done(struct async_req *subreq)
+static void cli_api_pipe_trans_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct cli_api_pipe_state *state = talloc_get_type_abort(
-               req->private_data, struct cli_api_pipe_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct cli_api_pipe_state *state = tevent_req_data(
+               req, struct cli_api_pipe_state);
        NTSTATUS status;
 
        status = state->transport->trans_recv(subreq, state, &state->rdata,
                                              &state->rdata_len);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
-       async_req_done(req);
+       tevent_req_done(req);
 }
 
-static void cli_api_pipe_write_done(struct async_req *subreq)
+static void cli_api_pipe_write_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct cli_api_pipe_state *state = talloc_get_type_abort(
-               req->private_data, struct cli_api_pipe_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct cli_api_pipe_state *state = tevent_req_data(
+               req, struct cli_api_pipe_state);
        NTSTATUS status;
 
        status = rpc_write_recv(subreq);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
        state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
-       if (async_req_nomem(state->rdata, req)) {
+       if (tevent_req_nomem(state->rdata, req)) {
                return;
        }
 
@@ -1138,40 +1166,39 @@ static void cli_api_pipe_write_done(struct async_req *subreq)
        subreq = state->transport->read_send(state, state->ev, state->rdata,
                                             RPC_HEADER_LEN,
                                             state->transport->priv);
-       if (async_req_nomem(subreq, req)) {
+       if (tevent_req_nomem(subreq, req)) {
                return;
        }
-       subreq->async.fn = cli_api_pipe_read_done;
-       subreq->async.priv = req;
+       tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
 }
 
-static void cli_api_pipe_read_done(struct async_req *subreq)
+static void cli_api_pipe_read_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct cli_api_pipe_state *state = talloc_get_type_abort(
-               req->private_data, struct cli_api_pipe_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct cli_api_pipe_state *state = tevent_req_data(
+               req, struct cli_api_pipe_state);
        NTSTATUS status;
        ssize_t received;
 
        status = state->transport->read_recv(subreq, &received);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
        state->rdata_len = received;
-       async_req_done(req);
+       tevent_req_done(req);
 }
 
-static NTSTATUS cli_api_pipe_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
+static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
                                  uint8_t **prdata, uint32_t *prdata_len)
 {
-       struct cli_api_pipe_state *state = talloc_get_type_abort(
-               req->private_data, struct cli_api_pipe_state);
+       struct cli_api_pipe_state *state = tevent_req_data(
+               req, struct cli_api_pipe_state);
        NTSTATUS status;
 
-       if (async_req_is_error(req, &status)) {
+       if (tevent_req_is_nterror(req, &status)) {
                return status;
        }
 
@@ -1225,22 +1252,22 @@ static int rpc_api_pipe_state_destructor(struct rpc_api_pipe_state *state)
        return 0;
 }
 
-static void rpc_api_pipe_trans_done(struct async_req *subreq);
-static void rpc_api_pipe_got_pdu(struct async_req *subreq);
+static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
+static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
 
-static struct async_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
-                                          struct event_context *ev,
-                                          struct rpc_pipe_client *cli,
-                                          prs_struct *data, /* Outgoing PDU */
-                                          uint8_t expected_pkt_type)
+static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
+                                           struct event_context *ev,
+                                           struct rpc_pipe_client *cli,
+                                           prs_struct *data, /* Outgoing PDU */
+                                           uint8_t expected_pkt_type)
 {
-       struct async_req *result, *subreq;
+       struct tevent_req *req, *subreq;
        struct rpc_api_pipe_state *state;
        uint16_t max_recv_frag;
        NTSTATUS status;
 
-       if (!async_req_setup(mem_ctx, &result, &state,
-                            struct rpc_api_pipe_state)) {
+       req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
+       if (req == NULL) {
                return NULL;
        }
        state->ev = ev;
@@ -1252,7 +1279,7 @@ static struct async_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
 
        prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
        /* Make incoming_pdu dynamic with no memory. */
-       prs_give_memory(&state->incoming_pdu, 0, 0, true);
+       prs_give_memory(&state->incoming_pdu, NULL, 0, true);
 
        talloc_set_destructor(state, rpc_api_pipe_state_destructor);
 
@@ -1276,27 +1303,25 @@ static struct async_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
                                   (uint8_t *)prs_data_p(data),
                                   prs_offset(data), max_recv_frag);
        if (subreq == NULL) {
-               status = NT_STATUS_NO_MEMORY;
-               goto post_status;
+               goto fail;
        }
-       subreq->async.fn = rpc_api_pipe_trans_done;
-       subreq->async.priv = result;
-       return result;
+       tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
+       return req;
 
  post_status:
-       if (async_post_status(result, ev, status)) {
-               return result;
-       }
-       TALLOC_FREE(result);
+       tevent_req_nterror(req, status);
+       return tevent_req_post(req, ev);
+ fail:
+       TALLOC_FREE(req);
        return NULL;
 }
 
-static void rpc_api_pipe_trans_done(struct async_req *subreq)
+static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct rpc_api_pipe_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_api_pipe_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct rpc_api_pipe_state *state = tevent_req_data(
+               req, struct rpc_api_pipe_state);
        NTSTATUS status;
        uint8_t *rdata = NULL;
        uint32_t rdata_len = 0;
@@ -1306,14 +1331,14 @@ static void rpc_api_pipe_trans_done(struct async_req *subreq)
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
        if (rdata == NULL) {
                DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
                         rpccli_pipe_txt(debug_ctx(), state->cli)));
-               async_req_done(req);
+               tevent_req_done(req);
                return;
        }
 
@@ -1324,7 +1349,7 @@ static void rpc_api_pipe_trans_done(struct async_req *subreq)
         */
        rdata_copy = (char *)memdup(rdata, rdata_len);
        TALLOC_FREE(rdata);
-       if (async_req_nomem(rdata_copy, req)) {
+       if (tevent_req_nomem(rdata_copy, req)) {
                return;
        }
        prs_give_memory(&state->incoming_frag, rdata_copy, rdata_len, true);
@@ -1332,19 +1357,18 @@ static void rpc_api_pipe_trans_done(struct async_req *subreq)
        /* Ensure we have enough data for a pdu. */
        subreq = get_complete_frag_send(state, state->ev, state->cli,
                                        &state->rhdr, &state->incoming_frag);
-       if (async_req_nomem(subreq, req)) {
+       if (tevent_req_nomem(subreq, req)) {
                return;
        }
-       subreq->async.fn = rpc_api_pipe_got_pdu;
-       subreq->async.priv = req;
+       tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
 }
 
-static void rpc_api_pipe_got_pdu(struct async_req *subreq)
+static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct rpc_api_pipe_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_api_pipe_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct rpc_api_pipe_state *state = tevent_req_data(
+               req, struct rpc_api_pipe_state);
        NTSTATUS status;
        char *rdata = NULL;
        uint32_t rdata_len = 0;
@@ -1354,7 +1378,7 @@ static void rpc_api_pipe_got_pdu(struct async_req *subreq)
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(5, ("get_complete_frag failed: %s\n",
                          nt_errstr(status)));
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
@@ -1369,11 +1393,11 @@ static void rpc_api_pipe_got_pdu(struct async_req *subreq)
                  nt_errstr(status)));
 
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
-       if ((state->rhdr.flags & RPC_FLG_FIRST)
+       if ((state->rhdr.flags & DCERPC_PFC_FLAG_FIRST)
            && (state->rhdr.pack_type[0] == 0)) {
                /*
                 * Set the data type correctly for big-endian data on the
@@ -1393,13 +1417,13 @@ static void rpc_api_pipe_got_pdu(struct async_req *subreq)
                         "%s\n",
                         state->incoming_pdu.bigendian_data?"big":"little",
                         state->incoming_frag.bigendian_data?"big":"little"));
-               async_req_error(req, NT_STATUS_INVALID_PARAMETER);
+               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                return;
        }
 
        /* Now copy the data portion out of the pdu into rbuf. */
        if (!prs_force_grow(&state->incoming_pdu, rdata_len)) {
-               async_req_error(req, NT_STATUS_NO_MEMORY);
+               tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
                return;
        }
 
@@ -1410,35 +1434,34 @@ static void rpc_api_pipe_got_pdu(struct async_req *subreq)
        status = cli_pipe_reset_current_pdu(state->cli, &state->rhdr,
                                            &state->incoming_frag);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
-       if (state->rhdr.flags & RPC_FLG_LAST) {
+       if (state->rhdr.flags & DCERPC_PFC_FLAG_LAST) {
                DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
                          rpccli_pipe_txt(debug_ctx(), state->cli),
                          (unsigned)prs_data_size(&state->incoming_pdu)));
-               async_req_done(req);
+               tevent_req_done(req);
                return;
        }
 
        subreq = get_complete_frag_send(state, state->ev, state->cli,
                                        &state->rhdr, &state->incoming_frag);
-       if (async_req_nomem(subreq, req)) {
+       if (tevent_req_nomem(subreq, req)) {
                return;
        }
-       subreq->async.fn = rpc_api_pipe_got_pdu;
-       subreq->async.priv = req;
+       tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
 }
 
-static NTSTATUS rpc_api_pipe_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
+static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
                                  prs_struct *reply_pdu)
 {
-       struct rpc_api_pipe_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_api_pipe_state);
+       struct rpc_api_pipe_state *state = tevent_req_data(
+               req, struct rpc_api_pipe_state);
        NTSTATUS status;
 
-       if (async_req_is_error(req, &status)) {
+       if (tevent_req_is_nterror(req, &status)) {
                return status;
        }
 
@@ -1459,7 +1482,7 @@ static NTSTATUS rpc_api_pipe_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
  ********************************************************************/
 
 static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
-                                               enum pipe_auth_level auth_level,
+                                               enum dcerpc_AuthLevel auth_level,
                                                RPC_HDR_AUTH *pauth_out,
                                                prs_struct *auth_data)
 {
@@ -1470,7 +1493,7 @@ static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
        DATA_BLOB tkt_wrapped = data_blob_null;
 
        /* We may change the pad length before marshalling. */
-       init_rpc_hdr_auth(pauth_out, RPC_KRB5_AUTH_TYPE, (int)auth_level, 0, 1);
+       init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_KRB5, (int)auth_level, 0, 1);
 
        DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
                a->service_principal ));
@@ -1518,7 +1541,7 @@ static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
  ********************************************************************/
 
 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
-                                               enum pipe_auth_level auth_level,
+                                               enum dcerpc_AuthLevel auth_level,
                                                RPC_HDR_AUTH *pauth_out,
                                                prs_struct *auth_data)
 {
@@ -1528,7 +1551,7 @@ static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client
        DATA_BLOB spnego_msg = data_blob_null;
 
        /* We may change the pad length before marshalling. */
-       init_rpc_hdr_auth(pauth_out, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
+       init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_SPNEGO, (int)auth_level, 0, 1);
 
        DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
        nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
@@ -1565,7 +1588,7 @@ static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client
  ********************************************************************/
 
 static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
-                                               enum pipe_auth_level auth_level,
+                                               enum dcerpc_AuthLevel auth_level,
                                                RPC_HDR_AUTH *pauth_out,
                                                prs_struct *auth_data)
 {
@@ -1574,7 +1597,7 @@ static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
        DATA_BLOB request = data_blob_null;
 
        /* We may change the pad length before marshalling. */
-       init_rpc_hdr_auth(pauth_out, RPC_NTLMSSP_AUTH_TYPE, (int)auth_level, 0, 1);
+       init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_NTLMSSP, (int)auth_level, 0, 1);
 
        DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
        nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
@@ -1606,14 +1629,16 @@ static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
  ********************************************************************/
 
 static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
-                                               enum pipe_auth_level auth_level,
+                                               enum dcerpc_AuthLevel auth_level,
                                                RPC_HDR_AUTH *pauth_out,
                                                prs_struct *auth_data)
 {
-       RPC_AUTH_SCHANNEL_NEG schannel_neg;
+       struct NL_AUTH_MESSAGE r;
+       enum ndr_err_code ndr_err;
+       DATA_BLOB blob;
 
        /* We may change the pad length before marshalling. */
-       init_rpc_hdr_auth(pauth_out, RPC_SCHANNEL_AUTH_TYPE, (int)auth_level, 0, 1);
+       init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_SCHANNEL, (int)auth_level, 0, 1);
 
        /* Use lp_workgroup() if domain not specified */
 
@@ -1624,16 +1649,30 @@ static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
                }
        }
 
-       init_rpc_auth_schannel_neg(&schannel_neg, cli->auth->domain,
-                                  global_myname());
-
        /*
         * Now marshall the data into the auth parse_struct.
         */
 
-       if(!smb_io_rpc_auth_schannel_neg("schannel_neg",
-                                      &schannel_neg, auth_data, 0)) {
-               DEBUG(0,("Failed to marshall RPC_AUTH_SCHANNEL_NEG.\n"));
+       r.MessageType                   = NL_NEGOTIATE_REQUEST;
+       r.Flags                         = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
+                                         NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
+       r.oem_netbios_domain.a          = cli->auth->domain;
+       r.oem_netbios_computer.a        = global_myname();
+
+       ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &r,
+                      (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
+               prs_mem_free(auth_data);
+               return ndr_map_error2ntstatus(ndr_err);
+       }
+
+       if (DEBUGLEVEL >= 10) {
+               NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &r);
+       }
+
+       if (!prs_copy_data_in(auth_data, (const char *)blob.data, blob.length))
+       {
                prs_mem_free(auth_data);
                return NT_STATUS_NO_MEMORY;
        }
@@ -1645,11 +1684,11 @@ static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
  Creates the internals of a DCE/RPC bind request or alter context PDU.
  ********************************************************************/
 
-static NTSTATUS create_bind_or_alt_ctx_internal(enum RPC_PKT_TYPE pkt_type,
+static NTSTATUS create_bind_or_alt_ctx_internal(enum dcerpc_pkt_type pkt_type,
                                                prs_struct *rpc_out, 
                                                uint32 rpc_call_id,
-                                               const RPC_IFACE *abstract,
-                                               const RPC_IFACE *transfer,
+                                               const struct ndr_syntax_id *abstract,
+                                               const struct ndr_syntax_id *transfer,
                                                RPC_HDR_AUTH *phdr_auth,
                                                prs_struct *pauth_info)
 {
@@ -1680,7 +1719,7 @@ static NTSTATUS create_bind_or_alt_ctx_internal(enum RPC_PKT_TYPE pkt_type,
        }
 
        /* Create the request RPC_HDR */
-       init_rpc_hdr(&hdr, pkt_type, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id, frag_len, auth_len);
+       init_rpc_hdr(&hdr, pkt_type, DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST, rpc_call_id, frag_len, auth_len);
 
        /* Marshall the RPC header */
        if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
@@ -1730,10 +1769,10 @@ static NTSTATUS create_bind_or_alt_ctx_internal(enum RPC_PKT_TYPE pkt_type,
 static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
                                prs_struct *rpc_out, 
                                uint32 rpc_call_id,
-                               const RPC_IFACE *abstract,
-                               const RPC_IFACE *transfer,
+                               const struct ndr_syntax_id *abstract,
+                               const struct ndr_syntax_id *transfer,
                                enum pipe_auth_type auth_type,
-                               enum pipe_auth_level auth_level)
+                               enum dcerpc_AuthLevel auth_level)
 {
        RPC_HDR_AUTH hdr_auth;
        prs_struct auth_info;
@@ -1784,7 +1823,7 @@ static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
                        return NT_STATUS_INVALID_INFO_CLASS;
        }
 
-       ret = create_bind_or_alt_ctx_internal(RPC_BIND,
+       ret = create_bind_or_alt_ctx_internal(DCERPC_PKT_BIND,
                                                rpc_out, 
                                                rpc_call_id,
                                                abstract,
@@ -1829,7 +1868,7 @@ static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
        }
 
        switch (cli->auth->auth_level) {
-               case PIPE_AUTH_LEVEL_PRIVACY:
+               case DCERPC_AUTH_LEVEL_PRIVACY:
                        /* Data portion is encrypted. */
                        status = ntlmssp_seal_packet(cli->auth->a_u.ntlmssp_state,
                                        (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
@@ -1843,7 +1882,7 @@ static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
                        }
                        break;
 
-               case PIPE_AUTH_LEVEL_INTEGRITY:
+               case DCERPC_AUTH_LEVEL_INTEGRITY:
                        /* Data is signed. */
                        status = ntlmssp_sign_packet(cli->auth->a_u.ntlmssp_state,
                                        (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
@@ -1887,10 +1926,11 @@ static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
                                        prs_struct *outgoing_pdu)
 {
        RPC_HDR_AUTH auth_info;
-       RPC_AUTH_SCHANNEL_CHK verf;
-       struct schannel_auth_struct *sas = cli->auth->a_u.schannel_auth;
+       struct schannel_state *sas = cli->auth->a_u.schannel_auth;
        char *data_p = prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
        size_t data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
+       DATA_BLOB blob;
+       NTSTATUS status;
 
        if (!sas) {
                return NT_STATUS_INVALID_PARAMETER;
@@ -1908,35 +1948,45 @@ static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
                return NT_STATUS_NO_MEMORY;
        }
 
+       DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
+                       sas->seq_num));
+
        switch (cli->auth->auth_level) {
-               case PIPE_AUTH_LEVEL_PRIVACY:
-               case PIPE_AUTH_LEVEL_INTEGRITY:
-                       DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
-                               sas->seq_num));
-
-                       schannel_encode(sas,
-                                       cli->auth->auth_level,
-                                       SENDER_IS_INITIATOR,
-                                       &verf,
-                                       data_p,
-                                       data_and_pad_len);
-
-                       sas->seq_num++;
-                       break;
+       case DCERPC_AUTH_LEVEL_PRIVACY:
+               status = netsec_outgoing_packet(sas,
+                                               talloc_tos(),
+                                               true,
+                                               (uint8_t *)data_p,
+                                               data_and_pad_len,
+                                               &blob);
+               break;
+       case DCERPC_AUTH_LEVEL_INTEGRITY:
+               status = netsec_outgoing_packet(sas,
+                                               talloc_tos(),
+                                               false,
+                                               (uint8_t *)data_p,
+                                               data_and_pad_len,
+                                               &blob);
+               break;
+       default:
+               status = NT_STATUS_INTERNAL_ERROR;
+               break;
+       }
 
-               default:
-                       /* Can't happen. */
-                       smb_panic("bad auth level");
-                       /* Notreached. */
-                       return NT_STATUS_INVALID_PARAMETER;
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(1,("add_schannel_auth_footer: failed to process packet: %s\n",
+                       nt_errstr(status)));
+               return status;
+       }
+
+       if (DEBUGLEVEL >= 10) {
+               dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
        }
 
        /* Finally marshall the blob. */
-       smb_io_rpc_auth_schannel_chk("",
-                       RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
-                       &verf,
-                       outgoing_pdu,
-                       0);
+       if (!prs_copy_data_in(outgoing_pdu, (const char *)blob.data, blob.length)) {
+               return NT_STATUS_NO_MEMORY;
+       }
 
        return NT_STATUS_OK;
 }
@@ -1961,8 +2011,8 @@ static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
 #endif
 
        switch (cli->auth->auth_level) {
-               case PIPE_AUTH_LEVEL_NONE:
-               case PIPE_AUTH_LEVEL_CONNECT:
+               case DCERPC_AUTH_LEVEL_NONE:
+               case DCERPC_AUTH_LEVEL_CONNECT:
                        data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN;
                        data_len = MIN(data_space, data_left);
                        *p_ss_padding = 0;
@@ -1970,8 +2020,8 @@ static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
                        *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + data_len;
                        return data_len;
 
-               case PIPE_AUTH_LEVEL_INTEGRITY:
-               case PIPE_AUTH_LEVEL_PRIVACY:
+               case DCERPC_AUTH_LEVEL_INTEGRITY:
+               case DCERPC_AUTH_LEVEL_PRIVACY:
                        /* Treat the same for all authenticated rpc requests. */
                        switch(cli->auth->auth_type) {
                                case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
@@ -2031,24 +2081,25 @@ static int rpc_api_pipe_req_state_destructor(struct rpc_api_pipe_req_state *s)
        return 0;
 }
 
-static void rpc_api_pipe_req_write_done(struct async_req *subreq);
-static void rpc_api_pipe_req_done(struct async_req *subreq);
+static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
+static void rpc_api_pipe_req_done(struct tevent_req *subreq);
 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
                                  bool *is_last_frag);
 
-struct async_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
-                                       struct event_context *ev,
-                                       struct rpc_pipe_client *cli,
-                                       uint8_t op_num,
-                                       prs_struct *req_data)
+struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
+                                        struct event_context *ev,
+                                        struct rpc_pipe_client *cli,
+                                        uint8_t op_num,
+                                        prs_struct *req_data)
 {
-       struct async_req *result, *subreq;
+       struct tevent_req *req, *subreq;
        struct rpc_api_pipe_req_state *state;
        NTSTATUS status;
        bool is_last_frag;
 
-       if (!async_req_setup(mem_ctx, &result, &state,
-                            struct rpc_api_pipe_req_state)) {
+       req = tevent_req_create(mem_ctx, &state,
+                               struct rpc_api_pipe_req_state);
+       if (req == NULL) {
                return NULL;
        }
        state->ev = ev;
@@ -2069,8 +2120,7 @@ struct async_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
 
        if (!prs_init(&state->outgoing_frag, cli->max_xmit_frag,
                      state, MARSHALL)) {
-               status = NT_STATUS_NO_MEMORY;
-               goto post_status;
+               goto fail;
        }
 
        talloc_set_destructor(state, rpc_api_pipe_req_state_destructor);
@@ -2083,32 +2133,29 @@ struct async_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
        if (is_last_frag) {
                subreq = rpc_api_pipe_send(state, ev, state->cli,
                                           &state->outgoing_frag,
-                                          RPC_RESPONSE);
+                                          DCERPC_PKT_RESPONSE);
                if (subreq == NULL) {
-                       status = NT_STATUS_NO_MEMORY;
-                       goto post_status;
+                       goto fail;
                }
-               subreq->async.fn = rpc_api_pipe_req_done;
-               subreq->async.priv = result;
+               tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
        } else {
                subreq = rpc_write_send(
                        state, ev, cli->transport,
                        (uint8_t *)prs_data_p(&state->outgoing_frag),
                        prs_offset(&state->outgoing_frag));
                if (subreq == NULL) {
-                       status = NT_STATUS_NO_MEMORY;
-                       goto post_status;
+                       goto fail;
                }
-               subreq->async.fn = rpc_api_pipe_req_write_done;
-               subreq->async.priv = result;
+               tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
+                                       req);
        }
-       return result;
+       return req;
 
  post_status:
-       if (async_post_status(result, ev, status)) {
-               return result;
-       }
-       TALLOC_FREE(result);
+       tevent_req_nterror(req, status);
+       return tevent_req_post(req, ev);
+ fail:
+       TALLOC_FREE(req);
        return NULL;
 }
 
@@ -2132,11 +2179,11 @@ static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
                state->cli, data_left, &frag_len, &auth_len, &ss_padding);
 
        if (state->req_data_sent == 0) {
-               flags = RPC_FLG_FIRST;
+               flags = DCERPC_PFC_FLAG_FIRST;
        }
 
        if (data_sent_thistime == data_left) {
-               flags |= RPC_FLG_LAST;
+               flags |= DCERPC_PFC_FLAG_LAST;
        }
 
        if (!prs_set_offset(&state->outgoing_frag, 0)) {
@@ -2144,7 +2191,7 @@ static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
        }
 
        /* Create and marshall the header and request header. */
-       init_rpc_hdr(&hdr, RPC_REQUEST, flags, state->call_id, frag_len,
+       init_rpc_hdr(&hdr, DCERPC_PKT_REQUEST, flags, state->call_id, frag_len,
                     auth_len);
 
        if (!smb_io_rpc_hdr("hdr    ", &hdr, &state->outgoing_frag, 0)) {
@@ -2192,81 +2239,80 @@ static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
        }
 
        state->req_data_sent += data_sent_thistime;
-       *is_last_frag = ((flags & RPC_FLG_LAST) != 0);
+       *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
 
        return status;
 }
 
-static void rpc_api_pipe_req_write_done(struct async_req *subreq)
+static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_api_pipe_req_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct rpc_api_pipe_req_state *state = tevent_req_data(
+               req, struct rpc_api_pipe_req_state);
        NTSTATUS status;
        bool is_last_frag;
 
        status = rpc_write_recv(subreq);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
        status = prepare_next_frag(state, &is_last_frag);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
        if (is_last_frag) {
                subreq = rpc_api_pipe_send(state, state->ev, state->cli,
                                           &state->outgoing_frag,
-                                          RPC_RESPONSE);
-               if (async_req_nomem(subreq, req)) {
+                                          DCERPC_PKT_RESPONSE);
+               if (tevent_req_nomem(subreq, req)) {
                        return;
                }
-               subreq->async.fn = rpc_api_pipe_req_done;
-               subreq->async.priv = req;
+               tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
        } else {
                subreq = rpc_write_send(
                        state, state->ev,
                        state->cli->transport,
                        (uint8_t *)prs_data_p(&state->outgoing_frag),
                        prs_offset(&state->outgoing_frag));
-               if (async_req_nomem(subreq, req)) {
+               if (tevent_req_nomem(subreq, req)) {
                        return;
                }
-               subreq->async.fn = rpc_api_pipe_req_write_done;
-               subreq->async.priv = req;
+               tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
+                                       req);
        }
 }
 
-static void rpc_api_pipe_req_done(struct async_req *subreq)
+static void rpc_api_pipe_req_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_api_pipe_req_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct rpc_api_pipe_req_state *state = tevent_req_data(
+               req, struct rpc_api_pipe_req_state);
        NTSTATUS status;
 
        status = rpc_api_pipe_recv(subreq, state, &state->reply_pdu);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
-       async_req_done(req);
+       tevent_req_done(req);
 }
 
-NTSTATUS rpc_api_pipe_req_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
+NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
                               prs_struct *reply_pdu)
 {
-       struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_api_pipe_req_state);
+       struct rpc_api_pipe_req_state *state = tevent_req_data(
+               req, struct rpc_api_pipe_req_state);
        NTSTATUS status;
 
-       if (async_req_is_error(req, &status)) {
+       if (tevent_req_is_nterror(req, &status)) {
                /*
                 * We always have to initialize to reply pdu, even if there is
                 * none. The rpccli_* caller routines expect this.
@@ -2287,36 +2333,6 @@ NTSTATUS rpc_api_pipe_req_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
        return NT_STATUS_OK;
 }
 
-NTSTATUS rpc_api_pipe_req(TALLOC_CTX *mem_ctx, struct rpc_pipe_client *cli,
-                       uint8 op_num,
-                       prs_struct *in_data,
-                       prs_struct *out_data)
-{
-       TALLOC_CTX *frame = talloc_stackframe();
-       struct event_context *ev;
-       struct async_req *req;
-       NTSTATUS status = NT_STATUS_NO_MEMORY;
-
-       ev = event_context_init(frame);
-       if (ev == NULL) {
-               goto fail;
-       }
-
-       req = rpc_api_pipe_req_send(frame, ev, cli, op_num, in_data);
-       if (req == NULL) {
-               goto fail;
-       }
-
-       while (req->state < ASYNC_REQ_DONE) {
-               event_loop_once(ev);
-       }
-
-       status = rpc_api_pipe_req_recv(req, mem_ctx, out_data);
- fail:
-       TALLOC_FREE(frame);
-       return status;
-}
-
 #if 0
 /****************************************************************************
  Set the handle state.
@@ -2368,7 +2384,8 @@ static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
  Check the rpc bind acknowledge response.
 ****************************************************************************/
 
-static bool check_bind_response(RPC_HDR_BA *hdr_ba, const RPC_IFACE *transfer)
+static bool check_bind_response(RPC_HDR_BA *hdr_ba,
+                               const struct ndr_syntax_id *transfer)
 {
        if ( hdr_ba->addr.len == 0) {
                DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
@@ -2400,7 +2417,7 @@ static bool check_bind_response(RPC_HDR_BA *hdr_ba, const RPC_IFACE *transfer)
 static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
                                uint32 rpc_call_id,
                                enum pipe_auth_type auth_type,
-                               enum pipe_auth_level auth_level,
+                               enum dcerpc_AuthLevel auth_level,
                                DATA_BLOB *pauth_blob,
                                prs_struct *rpc_out)
 {
@@ -2409,7 +2426,7 @@ static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
        uint32 pad = 0;
 
        /* Create the request RPC_HDR */
-       init_rpc_hdr(&hdr, RPC_AUTH3, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id,
+       init_rpc_hdr(&hdr, DCERPC_PKT_AUTH3, DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST, rpc_call_id,
                     RPC_HEADER_LEN + 4 /* pad */ + RPC_HDR_AUTH_LEN + pauth_blob->length,
                     pauth_blob->length );
 
@@ -2458,9 +2475,9 @@ static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
  ********************************************************************/
 
 static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
-                                       const RPC_IFACE *abstract,
-                                       const RPC_IFACE *transfer,
-                                       enum pipe_auth_level auth_level,
+                                       const struct ndr_syntax_id *abstract,
+                                       const struct ndr_syntax_id *transfer,
+                                       enum dcerpc_AuthLevel auth_level,
                                        const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
                                        prs_struct *rpc_out)
 {
@@ -2473,7 +2490,7 @@ static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
                return NT_STATUS_NO_MEMORY;
 
        /* We may change the pad length before marshalling. */
-       init_rpc_hdr_auth(&hdr_auth, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
+       init_rpc_hdr_auth(&hdr_auth, DCERPC_AUTH_TYPE_SPNEGO, (int)auth_level, 0, 1);
 
        if (pauth_blob->length) {
                if (!prs_copy_data_in(&auth_info, (const char *)pauth_blob->data, pauth_blob->length)) {
@@ -2482,7 +2499,7 @@ static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
                }
        }
 
-       ret = create_bind_or_alt_ctx_internal(RPC_ALTCONT,
+       ret = create_bind_or_alt_ctx_internal(DCERPC_PKT_ALTER,
                                                rpc_out, 
                                                rpc_call_id,
                                                abstract,
@@ -2510,29 +2527,29 @@ static int rpc_pipe_bind_state_destructor(struct rpc_pipe_bind_state *state)
        return 0;
 }
 
-static void rpc_pipe_bind_step_one_done(struct async_req *subreq);
-static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
+static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
+static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
                                           struct rpc_pipe_bind_state *state,
                                           struct rpc_hdr_info *phdr,
                                           prs_struct *reply_pdu);
-static void rpc_bind_auth3_write_done(struct async_req *subreq);
-static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
+static void rpc_bind_auth3_write_done(struct tevent_req *subreq);
+static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
                                                    struct rpc_pipe_bind_state *state,
                                                    struct rpc_hdr_info *phdr,
                                                    prs_struct *reply_pdu);
-static void rpc_bind_ntlmssp_api_done(struct async_req *subreq);
+static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq);
 
-struct async_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
-                                    struct event_context *ev,
-                                    struct rpc_pipe_client *cli,
-                                    struct cli_pipe_auth_data *auth)
+struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
+                                     struct event_context *ev,
+                                     struct rpc_pipe_client *cli,
+                                     struct cli_pipe_auth_data *auth)
 {
-       struct async_req *result, *subreq;
+       struct tevent_req *req, *subreq;
        struct rpc_pipe_bind_state *state;
        NTSTATUS status;
 
-       if (!async_req_setup(mem_ctx, &result, &state,
-                            struct rpc_pipe_bind_state)) {
+       req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
+       if (req == NULL) {
                return NULL;
        }
 
@@ -2563,29 +2580,27 @@ struct async_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
        }
 
        subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
-                                  RPC_BINDACK);
+                                  DCERPC_PKT_BIND_ACK);
        if (subreq == NULL) {
-               status = NT_STATUS_NO_MEMORY;
-               goto post_status;
+               goto fail;
        }
-       subreq->async.fn = rpc_pipe_bind_step_one_done;
-       subreq->async.priv = result;
-       return result;
+       tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
+       return req;
 
  post_status:
-       if (async_post_status(result, ev, status)) {
-               return result;
-       }
-       TALLOC_FREE(result);
+       tevent_req_nterror(req, status);
+       return tevent_req_post(req, ev);
+ fail:
+       TALLOC_FREE(req);
        return NULL;
 }
 
-static void rpc_pipe_bind_step_one_done(struct async_req *subreq)
+static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct rpc_pipe_bind_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_pipe_bind_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct rpc_pipe_bind_state *state = tevent_req_data(
+               req, struct rpc_pipe_bind_state);
        prs_struct reply_pdu;
        struct rpc_hdr_info hdr;
        struct rpc_hdr_ba_info hdr_ba;
@@ -2597,27 +2612,30 @@ static void rpc_pipe_bind_step_one_done(struct async_req *subreq)
                DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
                          rpccli_pipe_txt(debug_ctx(), state->cli),
                          nt_errstr(status)));
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
        /* Unmarshall the RPC header */
        if (!smb_io_rpc_hdr("hdr", &hdr, &reply_pdu, 0)) {
                DEBUG(0, ("rpc_pipe_bind: failed to unmarshall RPC_HDR.\n"));
-               async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
+               prs_mem_free(&reply_pdu);
+               tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
                return;
        }
 
        if (!smb_io_rpc_hdr_ba("", &hdr_ba, &reply_pdu, 0)) {
                DEBUG(0, ("rpc_pipe_bind: Failed to unmarshall "
                          "RPC_HDR_BA.\n"));
-               async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
+               prs_mem_free(&reply_pdu);
+               tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
                return;
        }
 
        if (!check_bind_response(&hdr_ba, &state->cli->transfer_syntax)) {
                DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
-               async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
+               prs_mem_free(&reply_pdu);
+               tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
                return;
        }
 
@@ -2633,15 +2651,17 @@ static void rpc_pipe_bind_step_one_done(struct async_req *subreq)
        case PIPE_AUTH_TYPE_NONE:
        case PIPE_AUTH_TYPE_SCHANNEL:
                /* Bind complete. */
-               async_req_done(req);
+               prs_mem_free(&reply_pdu);
+               tevent_req_done(req);
                break;
 
        case PIPE_AUTH_TYPE_NTLMSSP:
                /* Need to send AUTH3 packet - no reply. */
                status = rpc_finish_auth3_bind_send(req, state, &hdr,
                                                    &reply_pdu);
+               prs_mem_free(&reply_pdu);
                if (!NT_STATUS_IS_OK(status)) {
-                       async_req_error(req, status);
+                       tevent_req_nterror(req, status);
                }
                break;
 
@@ -2649,8 +2669,9 @@ static void rpc_pipe_bind_step_one_done(struct async_req *subreq)
                /* Need to send alter context request and reply. */
                status = rpc_finish_spnego_ntlmssp_bind_send(req, state, &hdr,
                                                             &reply_pdu);
+               prs_mem_free(&reply_pdu);
                if (!NT_STATUS_IS_OK(status)) {
-                       async_req_error(req, status);
+                       tevent_req_nterror(req, status);
                }
                break;
 
@@ -2660,11 +2681,12 @@ static void rpc_pipe_bind_step_one_done(struct async_req *subreq)
        default:
                DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
                         (unsigned int)state->cli->auth->auth_type));
-               async_req_error(req, NT_STATUS_INTERNAL_ERROR);
+               prs_mem_free(&reply_pdu);
+               tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
        }
 }
 
-static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
+static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
                                           struct rpc_pipe_bind_state *state,
                                           struct rpc_hdr_info *phdr,
                                           prs_struct *reply_pdu)
@@ -2672,7 +2694,7 @@ static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
        DATA_BLOB server_response = data_blob_null;
        DATA_BLOB client_reply = data_blob_null;
        struct rpc_hdr_auth_info hdr_auth;
-       struct async_req *subreq;
+       struct tevent_req *subreq;
        NTSTATUS status;
 
        if ((phdr->auth_len == 0)
@@ -2723,27 +2745,26 @@ static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
        if (subreq == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
-       subreq->async.fn = rpc_bind_auth3_write_done;
-       subreq->async.priv = req;
+       tevent_req_set_callback(subreq, rpc_bind_auth3_write_done, req);
        return NT_STATUS_OK;
 }
 
-static void rpc_bind_auth3_write_done(struct async_req *subreq)
+static void rpc_bind_auth3_write_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
        NTSTATUS status;
 
        status = rpc_write_recv(subreq);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
-       async_req_done(req);
+       tevent_req_done(req);
 }
 
-static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
+static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
                                                    struct rpc_pipe_bind_state *state,
                                                    struct rpc_hdr_info *phdr,
                                                    prs_struct *reply_pdu)
@@ -2753,7 +2774,7 @@ static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
        DATA_BLOB client_reply = data_blob_null;
        DATA_BLOB tmp_blob = data_blob_null;
        RPC_HDR_AUTH hdr_auth;
-       struct async_req *subreq;
+       struct tevent_req *subreq;
        NTSTATUS status;
 
        if ((phdr->auth_len == 0)
@@ -2827,21 +2848,20 @@ static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
        }
 
        subreq = rpc_api_pipe_send(state, state->ev, state->cli,
-                                  &state->rpc_out, RPC_ALTCONTRESP);
+                                  &state->rpc_out, DCERPC_PKT_ALTER_RESP);
        if (subreq == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
-       subreq->async.fn = rpc_bind_ntlmssp_api_done;
-       subreq->async.priv = req;
+       tevent_req_set_callback(subreq, rpc_bind_ntlmssp_api_done, req);
        return NT_STATUS_OK;
 }
 
-static void rpc_bind_ntlmssp_api_done(struct async_req *subreq)
+static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq)
 {
-       struct async_req *req = talloc_get_type_abort(
-               subreq->async.priv, struct async_req);
-       struct rpc_pipe_bind_state *state = talloc_get_type_abort(
-               req->private_data, struct rpc_pipe_bind_state);
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct rpc_pipe_bind_state *state = tevent_req_data(
+               req, struct rpc_pipe_bind_state);
        DATA_BLOB server_spnego_response = data_blob_null;
        DATA_BLOB tmp_blob = data_blob_null;
        prs_struct reply_pdu;
@@ -2852,7 +2872,7 @@ static void rpc_bind_ntlmssp_api_done(struct async_req *subreq)
        status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
        TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               async_req_error(req, status);
+               tevent_req_nterror(req, status);
                return;
        }
 
@@ -2860,19 +2880,19 @@ static void rpc_bind_ntlmssp_api_done(struct async_req *subreq)
        if (!smb_io_rpc_hdr("rpc_hdr   ", &hdr, &reply_pdu, 0)) {
                DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: Failed to "
                          "unmarshall RPC_HDR.\n"));
-               async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
+               tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
                return;
        }
 
        if (!prs_set_offset(
                    &reply_pdu,
                    hdr.frag_len - hdr.auth_len - RPC_HDR_AUTH_LEN)) {
-               async_req_error(req, NT_STATUS_INVALID_PARAMETER);
+               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                return;
        }
 
        if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &reply_pdu, 0)) {
-               async_req_error(req, NT_STATUS_INVALID_PARAMETER);
+               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                return;
        }
 
@@ -2885,7 +2905,7 @@ static void rpc_bind_ntlmssp_api_done(struct async_req *subreq)
                                        OID_NTLMSSP, &tmp_blob)) {
                data_blob_free(&server_spnego_response);
                data_blob_free(&tmp_blob);
-               async_req_error(req, NT_STATUS_INVALID_PARAMETER);
+               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                return;
        }
 
@@ -2894,12 +2914,12 @@ static void rpc_bind_ntlmssp_api_done(struct async_req *subreq)
 
        DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
                 "%s.\n", rpccli_pipe_txt(debug_ctx(), state->cli)));
-       async_req_done(req);
+       tevent_req_done(req);
 }
 
-NTSTATUS rpc_pipe_bind_recv(struct async_req *req)
+NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
 {
-       return async_req_simple_recv(req);
+       return tevent_req_simple_recv_ntstatus(req);
 }
 
 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
@@ -2907,21 +2927,24 @@ NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
 {
        TALLOC_CTX *frame = talloc_stackframe();
        struct event_context *ev;
-       struct async_req *req;
-       NTSTATUS status = NT_STATUS_NO_MEMORY;
+       struct tevent_req *req;
+       NTSTATUS status = NT_STATUS_OK;
 
        ev = event_context_init(frame);
        if (ev == NULL) {
+               status = NT_STATUS_NO_MEMORY;
                goto fail;
        }
 
        req = rpc_pipe_bind_send(frame, ev, cli, auth);
        if (req == NULL) {
+               status = NT_STATUS_NO_MEMORY;
                goto fail;
        }
 
-       while (req->state < ASYNC_REQ_DONE) {
-               event_loop_once(ev);
+       if (!tevent_req_poll(req, ev)) {
+               status = map_nt_error_from_unix(errno);
+               goto fail;
        }
 
        status = rpc_pipe_bind_recv(req);
@@ -2955,7 +2978,7 @@ bool rpccli_get_pwd_hash(struct rpc_pipe_client *rpc_cli, uint8_t nt_hash[16])
        if (cli == NULL) {
                return false;
        }
-       E_md4hash(cli->pwd.password, nt_hash);
+       E_md4hash(cli->password ? cli->password : "", nt_hash);
        return true;
 }
 
@@ -2970,7 +2993,7 @@ NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
        }
 
        result->auth_type = PIPE_AUTH_TYPE_NONE;
-       result->auth_level = PIPE_AUTH_LEVEL_NONE;
+       result->auth_level = DCERPC_AUTH_LEVEL_NONE;
 
        result->user_name = talloc_strdup(result, "");
        result->domain = talloc_strdup(result, "");
@@ -2991,7 +3014,7 @@ static int cli_auth_ntlmssp_data_destructor(struct cli_pipe_auth_data *auth)
 
 NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
                                  enum pipe_auth_type auth_type,
-                                 enum pipe_auth_level auth_level,
+                                 enum dcerpc_AuthLevel auth_level,
                                  const char *domain,
                                  const char *username,
                                  const char *password,
@@ -3043,9 +3066,9 @@ NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
        result->a_u.ntlmssp_state->neg_flags &=
                ~(NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL);
 
-       if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
+       if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
                result->a_u.ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
-       } else if (auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
+       } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
                result->a_u.ntlmssp_state->neg_flags
                        |= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
        }
@@ -3059,8 +3082,8 @@ NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
 }
 
 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
-                                  enum pipe_auth_level auth_level,
-                                  const uint8_t sess_key[16],
+                                  enum dcerpc_AuthLevel auth_level,
+                                  struct netlogon_creds_CredentialState *creds,
                                   struct cli_pipe_auth_data **presult)
 {
        struct cli_pipe_auth_data *result;
@@ -3079,15 +3102,15 @@ NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
                goto fail;
        }
 
-       result->a_u.schannel_auth = talloc(result,
-                                          struct schannel_auth_struct);
+       result->a_u.schannel_auth = talloc(result, struct schannel_state);
        if (result->a_u.schannel_auth == NULL) {
                goto fail;
        }
 
-       memcpy(result->a_u.schannel_auth->sess_key, sess_key,
-              sizeof(result->a_u.schannel_auth->sess_key));
+       result->a_u.schannel_auth->state = SCHANNEL_STATE_START;
        result->a_u.schannel_auth->seq_num = 0;
+       result->a_u.schannel_auth->initiator = true;
+       result->a_u.schannel_auth->creds = creds;
 
        *presult = result;
        return NT_STATUS_OK;
@@ -3106,7 +3129,7 @@ static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
 #endif
 
 NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
-                                  enum pipe_auth_level auth_level,
+                                  enum dcerpc_AuthLevel auth_level,
                                   const char *service_princ,
                                   const char *username,
                                   const char *password,
@@ -3185,6 +3208,8 @@ static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
        result->abstract_syntax = *abstract_syntax;
        result->transfer_syntax = ndr_transfer_syntax;
        result->dispatch = cli_do_rpc_ndr;
+       result->dispatch_send = cli_do_rpc_ndr_send;
+       result->dispatch_recv = cli_do_rpc_ndr_recv;
 
        result->desthost = talloc_strdup(result, host);
        result->srv_name_slash = talloc_asprintf_strupper_m(
@@ -3197,7 +3222,7 @@ static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
        result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
        result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
 
-       if (!resolve_name(host, &addr, 0)) {
+       if (!resolve_name(host, &addr, 0, false)) {
                status = NT_STATUS_NOT_FOUND;
                goto fail;
        }
@@ -3214,6 +3239,8 @@ static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
                goto fail;
        }
 
+       result->transport->transport = NCACN_IP_TCP;
+
        *presult = result;
        return NT_STATUS_OK;
 
@@ -3397,8 +3424,10 @@ NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
        result->abstract_syntax = *abstract_syntax;
        result->transfer_syntax = ndr_transfer_syntax;
        result->dispatch = cli_do_rpc_ndr;
+       result->dispatch_send = cli_do_rpc_ndr_send;
+       result->dispatch_recv = cli_do_rpc_ndr_recv;
 
-       result->desthost = talloc_get_myname(result);
+       result->desthost = get_myname(result);
        result->srv_name_slash = talloc_asprintf_strupper_m(
                result, "\\\\%s", result->desthost);
        if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
@@ -3419,7 +3448,7 @@ NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
        addr.sun_family = AF_UNIX;
        strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
 
-       if (sys_connect(fd, (struct sockaddr *)&addr) == -1) {
+       if (sys_connect(fd, (struct sockaddr *)(void *)&addr) == -1) {
                DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
                          strerror(errno)));
                close(fd);
@@ -3432,6 +3461,8 @@ NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
                goto fail;
        }
 
+       result->transport->transport = NCALRPC;
+
        *presult = result;
        return NT_STATUS_OK;
 
@@ -3485,6 +3516,8 @@ static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
        result->abstract_syntax = *abstract_syntax;
        result->transfer_syntax = ndr_transfer_syntax;
        result->dispatch = cli_do_rpc_ndr;
+       result->dispatch_send = cli_do_rpc_ndr_send;
+       result->dispatch_recv = cli_do_rpc_ndr_recv;
        result->desthost = talloc_strdup(result, cli->desthost);
        result->srv_name_slash = talloc_asprintf_strupper_m(
                result, "\\\\%s", result->desthost);
@@ -3504,6 +3537,8 @@ static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
                return status;
        }
 
+       result->transport->transport = NCACN_NP;
+
        DLIST_ADD(cli->pipe_list, result);
        talloc_set_destructor(result, rpc_pipe_client_np_destructor);
 
@@ -3511,39 +3546,99 @@ static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
        return NT_STATUS_OK;
 }
 
+NTSTATUS rpc_pipe_open_local(TALLOC_CTX *mem_ctx,
+                            struct rpc_cli_smbd_conn *conn,
+                            const struct ndr_syntax_id *syntax,
+                            struct rpc_pipe_client **presult)
+{
+       struct rpc_pipe_client *result;
+       struct cli_pipe_auth_data *auth;
+       NTSTATUS status;
+
+       result = talloc(mem_ctx, struct rpc_pipe_client);
+       if (result == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       result->abstract_syntax = *syntax;
+       result->transfer_syntax = ndr_transfer_syntax;
+       result->dispatch = cli_do_rpc_ndr;
+       result->dispatch_send = cli_do_rpc_ndr_send;
+       result->dispatch_recv = cli_do_rpc_ndr_recv;
+       result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
+       result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
+
+       result->desthost = talloc_strdup(result, global_myname());
+       result->srv_name_slash = talloc_asprintf_strupper_m(
+               result, "\\\\%s", global_myname());
+       if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
+               TALLOC_FREE(result);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       status = rpc_transport_smbd_init(result, conn, syntax,
+                                        &result->transport);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(1, ("rpc_transport_smbd_init failed: %s\n",
+                         nt_errstr(status)));
+               TALLOC_FREE(result);
+               return status;
+       }
+
+       status = rpccli_anon_bind_data(result, &auth);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(1, ("rpccli_anon_bind_data failed: %s\n",
+                         nt_errstr(status)));
+               TALLOC_FREE(result);
+               return status;
+       }
+
+       status = rpc_pipe_bind(result, auth);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(1, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
+               TALLOC_FREE(result);
+               return status;
+       }
+
+       result->transport->transport = NCACN_INTERNAL;
+
+       *presult = result;
+       return NT_STATUS_OK;
+}
+
 /****************************************************************************
  Open a pipe to a remote server.
  ****************************************************************************/
 
 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
+                                 enum dcerpc_transport_t transport,
                                  const struct ndr_syntax_id *interface,
                                  struct rpc_pipe_client **presult)
 {
-       if (ndr_syntax_id_equal(interface, &ndr_table_drsuapi.syntax_id)) {
-               /*
-                * We should have a better way to figure out this drsuapi
-                * speciality...
-                */
+       switch (transport) {
+       case NCACN_IP_TCP:
                return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
                                         presult);
+       case NCACN_NP:
+               return rpc_pipe_open_np(cli, interface, presult);
+       default:
+               return NT_STATUS_NOT_IMPLEMENTED;
        }
-
-       return rpc_pipe_open_np(cli, interface, presult);
 }
 
 /****************************************************************************
  Open a named pipe to an SMB server and bind anonymously.
  ****************************************************************************/
 
-NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
-                                 const struct ndr_syntax_id *interface,
-                                 struct rpc_pipe_client **presult)
+NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
+                                           enum dcerpc_transport_t transport,
+                                           const struct ndr_syntax_id *interface,
+                                           struct rpc_pipe_client **presult)
 {
        struct rpc_pipe_client *result;
        struct cli_pipe_auth_data *auth;
        NTSTATUS status;
 
-       status = cli_rpc_pipe_open(cli, interface, &result);
+       status = cli_rpc_pipe_open(cli, transport, interface, &result);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -3587,8 +3682,7 @@ NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
                }
                DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
                            "%s failed with error %s\n",
-                           cli_get_pipe_name_from_iface(debug_ctx(),
-                                                        interface),
+                           get_pipe_name_from_iface(interface),
                            nt_errstr(status) ));
                TALLOC_FREE(result);
                return status;
@@ -3596,21 +3690,32 @@ NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
 
        DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
                  "%s and bound anonymously.\n",
-                 cli_get_pipe_name_from_iface(debug_ctx(), interface),
-                 cli->desthost ));
+                 get_pipe_name_from_iface(interface), cli->desthost));
 
        *presult = result;
        return NT_STATUS_OK;
 }
 
+/****************************************************************************
+ ****************************************************************************/
+
+NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
+                                 const struct ndr_syntax_id *interface,
+                                 struct rpc_pipe_client **presult)
+{
+       return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
+                                                 interface, presult);
+}
+
 /****************************************************************************
  Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
  ****************************************************************************/
 
 static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
                                                   const struct ndr_syntax_id *interface,
+                                                  enum dcerpc_transport_t transport,
                                                   enum pipe_auth_type auth_type,
-                                                  enum pipe_auth_level auth_level,
+                                                  enum dcerpc_AuthLevel auth_level,
                                                   const char *domain,
                                                   const char *username,
                                                   const char *password,
@@ -3620,14 +3725,14 @@ static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
        struct cli_pipe_auth_data *auth;
        NTSTATUS status;
 
-       status = cli_rpc_pipe_open(cli, interface, &result);
+       status = cli_rpc_pipe_open(cli, transport, interface, &result);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
 
        status = rpccli_ntlmssp_bind_data(
                result, auth_type, auth_level, domain, username,
-               cli->pwd.null_pwd ? NULL : password, &auth);
+               password, &auth);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
                          nt_errstr(status)));
@@ -3643,8 +3748,8 @@ static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
 
        DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
                "machine %s and bound NTLMSSP as user %s\\%s.\n",
-                 cli_get_pipe_name_from_iface(debug_ctx(), interface),
-                 cli->desthost, domain, username ));
+                 get_pipe_name_from_iface(interface), cli->desthost, domain,
+                 username ));
 
        *presult = result;
        return NT_STATUS_OK;
@@ -3662,7 +3767,8 @@ static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
 
 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
                                   const struct ndr_syntax_id *interface,
-                                  enum pipe_auth_level auth_level,
+                                  enum dcerpc_transport_t transport,
+                                  enum dcerpc_AuthLevel auth_level,
                                   const char *domain,
                                   const char *username,
                                   const char *password,
@@ -3670,6 +3776,7 @@ NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
 {
        return cli_rpc_pipe_open_ntlmssp_internal(cli,
                                                interface,
+                                               transport,
                                                PIPE_AUTH_TYPE_NTLMSSP,
                                                auth_level,
                                                domain,
@@ -3685,7 +3792,8 @@ NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
 
 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
                                          const struct ndr_syntax_id *interface,
-                                         enum pipe_auth_level auth_level,
+                                         enum dcerpc_transport_t transport,
+                                         enum dcerpc_AuthLevel auth_level,
                                          const char *domain,
                                          const char *username,
                                          const char *password,
@@ -3693,6 +3801,7 @@ NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
 {
        return cli_rpc_pipe_open_ntlmssp_internal(cli,
                                                interface,
+                                               transport,
                                                PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
                                                auth_level,
                                                domain,
@@ -3786,26 +3895,29 @@ NTSTATUS get_schannel_session_key(struct cli_state *cli,
  External interface.
  Open a named pipe to an SMB server and bind using schannel (bind type 68)
  using session_key. sign and seal.
+
+ The *pdc will be stolen onto this new pipe
  ****************************************************************************/
 
 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
                                             const struct ndr_syntax_id *interface,
-                                            enum pipe_auth_level auth_level,
+                                            enum dcerpc_transport_t transport,
+                                            enum dcerpc_AuthLevel auth_level,
                                             const char *domain,
-                                            const struct dcinfo *pdc,
+                                            struct netlogon_creds_CredentialState **pdc,
                                             struct rpc_pipe_client **presult)
 {
        struct rpc_pipe_client *result;
        struct cli_pipe_auth_data *auth;
        NTSTATUS status;
 
-       status = cli_rpc_pipe_open(cli, interface, &result);
+       status = cli_rpc_pipe_open(cli, transport, interface, &result);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
 
        status = rpccli_schannel_bind_data(result, domain, auth_level,
-                                          pdc->sess_key, &auth);
+                                          *pdc, &auth);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
                          nt_errstr(status)));
@@ -3824,18 +3936,18 @@ NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
 
        /*
         * The credentials on a new netlogon pipe are the ones we are passed
-        * in - copy them over.
+        * in - reference them in
         */
-       result->dc = (struct dcinfo *)talloc_memdup(result, pdc, sizeof(*pdc));
+       result->dc = talloc_move(result, pdc);
        if (result->dc == NULL) {
-               DEBUG(0, ("talloc failed\n"));
+               DEBUG(0, ("talloc reference failed\n"));
                TALLOC_FREE(result);
                return NT_STATUS_NO_MEMORY;
        }
 
        DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
                  "for domain %s and bound using schannel.\n",
-                 cli_get_pipe_name_from_iface(debug_ctx(), interface),
+                 get_pipe_name_from_iface(interface),
                  cli->desthost, domain ));
 
        *presult = result;
@@ -3859,7 +3971,8 @@ static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
        NTSTATUS status;
 
        status = cli_rpc_pipe_open_spnego_ntlmssp(
-               cli, &ndr_table_netlogon.syntax_id, PIPE_AUTH_LEVEL_PRIVACY,
+               cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
+               DCERPC_AUTH_LEVEL_PRIVACY,
                domain, username, password, &netlogon_pipe);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -3884,7 +3997,8 @@ static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
 
 NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
                                                 const struct ndr_syntax_id *interface,
-                                                enum pipe_auth_level auth_level,
+                                                enum dcerpc_transport_t transport,
+                                                enum dcerpc_AuthLevel auth_level,
                                                 const char *domain,
                                                 const char *username,
                                                 const char *password,
@@ -3905,7 +4019,7 @@ NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
        }
 
        status = cli_rpc_pipe_open_schannel_with_key(
-               cli, interface, auth_level, domain, netlogon_pipe->dc,
+               cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
                &result);
 
        /* Now we've bound using the session key we can close the netlog pipe. */
@@ -3924,7 +4038,8 @@ NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
 
 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
                                    const struct ndr_syntax_id *interface,
-                                   enum pipe_auth_level auth_level,
+                                   enum dcerpc_transport_t transport,
+                                   enum dcerpc_AuthLevel auth_level,
                                    const char *domain,
                                    struct rpc_pipe_client **presult)
 {
@@ -3943,7 +4058,7 @@ NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
        }
 
        status = cli_rpc_pipe_open_schannel_with_key(
-               cli, interface, auth_level, domain, netlogon_pipe->dc,
+               cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
                &result);
 
        /* Now we've bound using the session key we can close the netlog pipe. */
@@ -3964,7 +4079,7 @@ NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
 
 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
                                const struct ndr_syntax_id *interface,
-                               enum pipe_auth_level auth_level,
+                               enum dcerpc_AuthLevel auth_level,
                                const char *service_princ,
                                const char *username,
                                const char *password,
@@ -3975,7 +4090,7 @@ NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
        struct cli_pipe_auth_data *auth;
        NTSTATUS status;
 
-       status = cli_rpc_pipe_open(cli, interface, &result);
+       status = cli_rpc_pipe_open(cli, NCACN_NP, interface, &result);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -4020,7 +4135,7 @@ NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
        switch (cli->auth->auth_type) {
                case PIPE_AUTH_TYPE_SCHANNEL:
                        *session_key = data_blob_talloc(mem_ctx,
-                               cli->auth->a_u.schannel_auth->sess_key, 16);
+                               cli->auth->a_u.schannel_auth->creds->session_key, 16);
                        break;
                case PIPE_AUTH_TYPE_NTLMSSP:
                case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
@@ -4045,40 +4160,3 @@ NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
 
        return NT_STATUS_OK;
 }
-
-/**
- * Create a new RPC client context which uses a local dispatch function.
- */
-NTSTATUS rpc_pipe_open_internal(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *abstract_syntax, 
-                               NTSTATUS (*dispatch) (struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx, const struct ndr_interface_table *table, uint32_t opnum, void *r),
-                               struct auth_serversupplied_info *serversupplied_info,
-                               struct rpc_pipe_client **presult)
-{
-       struct rpc_pipe_client *result;
-
-       result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
-       if (result == NULL) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       result->abstract_syntax = *abstract_syntax;
-       result->transfer_syntax = ndr_transfer_syntax;
-       result->dispatch = dispatch;
-
-       result->pipes_struct = TALLOC_ZERO_P(mem_ctx, pipes_struct);
-       if (result->pipes_struct == NULL) {
-               TALLOC_FREE(result);
-               return NT_STATUS_NO_MEMORY;
-       }
-       result->pipes_struct->mem_ctx = mem_ctx;
-       result->pipes_struct->server_info = serversupplied_info;
-       result->pipes_struct->pipe_bound = true;
-
-       result->max_xmit_frag = -1;
-       result->max_recv_frag = -1;
-
-       *presult = result;
-       return NT_STATUS_OK;
-}
-
-