librpc/rpc: correct the chunk_size depending on the signature size
[tprouty/samba.git] / source4 / librpc / rpc / dcerpc.c
1 /* 
2    Unix SMB/CIFS implementation.
3    raw dcerpc operations
4
5    Copyright (C) Tim Potter 2003
6    Copyright (C) Andrew Tridgell 2003-2005
7    Copyright (C) Jelmer Vernooij 2004-2005
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "lib/util/dlinklist.h"
25 #include "lib/events/events.h"
26 #include "librpc/rpc/dcerpc.h"
27 #include "librpc/rpc/dcerpc_proto.h"
28 #include "librpc/gen_ndr/ndr_misc.h"
29 #include "librpc/gen_ndr/ndr_dcerpc.h"
30 #include "libcli/composite/composite.h"
31 #include "auth/gensec/gensec.h"
32 #include "param/param.h"
33
34 _PUBLIC_ NTSTATUS dcerpc_init(void)
35 {
36         gensec_init(global_loadparm);
37
38         return NT_STATUS_OK;
39 }
40
41 static void dcerpc_connection_dead(struct dcerpc_connection *conn, NTSTATUS status);
42 static void dcerpc_ship_next_request(struct dcerpc_connection *c);
43
44 /* destroy a dcerpc connection */
45 static int dcerpc_connection_destructor(struct dcerpc_connection *conn)
46 {
47         if (conn->dead) {
48                 conn->free_skipped = true;
49                 return -1;
50         }
51         dcerpc_connection_dead(conn, NT_STATUS_LOCAL_DISCONNECT);
52         return 0;
53 }
54
55
56 /* initialise a dcerpc connection. 
57    the event context is optional
58 */
59 static struct dcerpc_connection *dcerpc_connection_init(TALLOC_CTX *mem_ctx, 
60                                                  struct event_context *ev,
61                                                  struct smb_iconv_convenience *ic)
62 {
63         struct dcerpc_connection *c;
64
65         c = talloc_zero(mem_ctx, struct dcerpc_connection);
66         if (!c) {
67                 return NULL;
68         }
69
70         c->iconv_convenience = talloc_reference(c, ic);
71
72         c->event_ctx = talloc_reference(c, ev);
73
74         if (c->event_ctx == NULL) {
75                 talloc_free(c);
76                 return NULL;
77         }
78
79         c->call_id = 1;
80         c->security_state.auth_info = NULL;
81         c->security_state.session_key = dcerpc_generic_session_key;
82         c->security_state.generic_state = NULL;
83         c->binding_string = NULL;
84         c->flags = 0;
85         c->srv_max_xmit_frag = 0;
86         c->srv_max_recv_frag = 0;
87         c->pending = NULL;
88
89         talloc_set_destructor(c, dcerpc_connection_destructor);
90
91         return c;
92 }
93
94 /* initialise a dcerpc pipe. */
95 _PUBLIC_ struct dcerpc_pipe *dcerpc_pipe_init(TALLOC_CTX *mem_ctx, struct event_context *ev,
96                                      struct smb_iconv_convenience *ic)
97 {
98         struct dcerpc_pipe *p;
99
100         p = talloc(mem_ctx, struct dcerpc_pipe);
101         if (!p) {
102                 return NULL;
103         }
104
105         p->conn = dcerpc_connection_init(p, ev, ic);
106         if (p->conn == NULL) {
107                 talloc_free(p);
108                 return NULL;
109         }
110
111         p->last_fault_code = 0;
112         p->context_id = 0;
113         p->request_timeout = DCERPC_REQUEST_TIMEOUT;
114         p->binding = NULL;
115
116         ZERO_STRUCT(p->syntax);
117         ZERO_STRUCT(p->transfer_syntax);
118
119         return p;
120 }
121
122
123 /* 
124    choose the next call id to use
125 */
126 static uint32_t next_call_id(struct dcerpc_connection *c)
127 {
128         c->call_id++;
129         if (c->call_id == 0) {
130                 c->call_id++;
131         }
132         return c->call_id;
133 }
134
135 /* we need to be able to get/set the fragment length without doing a full
136    decode */
137 void dcerpc_set_frag_length(DATA_BLOB *blob, uint16_t v)
138 {
139         if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
140                 SSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET, v);
141         } else {
142                 RSSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET, v);
143         }
144 }
145
146 uint16_t dcerpc_get_frag_length(const DATA_BLOB *blob)
147 {
148         if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
149                 return SVAL(blob->data, DCERPC_FRAG_LEN_OFFSET);
150         } else {
151                 return RSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET);
152         }
153 }
154
155 void dcerpc_set_auth_length(DATA_BLOB *blob, uint16_t v)
156 {
157         if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
158                 SSVAL(blob->data, DCERPC_AUTH_LEN_OFFSET, v);
159         } else {
160                 RSSVAL(blob->data, DCERPC_AUTH_LEN_OFFSET, v);
161         }
162 }
163
164
165 /**
166   setup for a ndr pull, also setting up any flags from the binding string
167 */
168 static struct ndr_pull *ndr_pull_init_flags(struct dcerpc_connection *c, 
169                                             DATA_BLOB *blob, TALLOC_CTX *mem_ctx)
170 {
171         struct ndr_pull *ndr = ndr_pull_init_blob(blob, mem_ctx, c->iconv_convenience);
172
173         if (ndr == NULL) return ndr;
174
175         if (c->flags & DCERPC_DEBUG_PAD_CHECK) {
176                 ndr->flags |= LIBNDR_FLAG_PAD_CHECK;
177         }
178
179         if (c->flags & DCERPC_NDR_REF_ALLOC) {
180                 ndr->flags |= LIBNDR_FLAG_REF_ALLOC;
181         }
182
183         return ndr;
184 }
185
186 /* 
187    parse a data blob into a ncacn_packet structure. This handles both
188    input and output packets
189 */
190 static NTSTATUS ncacn_pull(struct dcerpc_connection *c, DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
191                             struct ncacn_packet *pkt)
192 {
193         struct ndr_pull *ndr;
194         enum ndr_err_code ndr_err;
195
196         ndr = ndr_pull_init_flags(c, blob, mem_ctx);
197         if (!ndr) {
198                 return NT_STATUS_NO_MEMORY;
199         }
200
201         if (! (CVAL(blob->data, DCERPC_DREP_OFFSET) & DCERPC_DREP_LE)) {
202                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
203         }
204
205         ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
206         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
207                 return ndr_map_error2ntstatus(ndr_err);
208         }
209
210         return NT_STATUS_OK;
211 }
212
213 /*
214   generate a CONNECT level verifier
215 */
216 static NTSTATUS dcerpc_connect_verifier(TALLOC_CTX *mem_ctx, DATA_BLOB *blob)
217 {
218         *blob = data_blob_talloc(mem_ctx, NULL, 16);
219         if (blob->data == NULL) {
220                 return NT_STATUS_NO_MEMORY;
221         }
222         SIVAL(blob->data, 0, 1);
223         memset(blob->data+4, 0, 12);
224         return NT_STATUS_OK;
225 }
226
227 /*
228   check a CONNECT level verifier
229 */
230 static NTSTATUS dcerpc_check_connect_verifier(DATA_BLOB *blob)
231 {
232         if (blob->length != 16 ||
233             IVAL(blob->data, 0) != 1) {
234                 return NT_STATUS_ACCESS_DENIED;
235         }
236         return NT_STATUS_OK;
237 }
238
239 /* 
240    parse the authentication information on a dcerpc response packet
241 */
242 static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX *mem_ctx, 
243                                         DATA_BLOB *raw_packet,
244                                         struct ncacn_packet *pkt)
245 {
246         struct ndr_pull *ndr;
247         NTSTATUS status;
248         struct dcerpc_auth auth;
249         DATA_BLOB auth_blob;
250         enum ndr_err_code ndr_err;
251
252         if (pkt->auth_length == 0 &&
253             c->security_state.auth_info->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
254                 return NT_STATUS_OK;
255         }
256
257         auth_blob.length = 8 + pkt->auth_length;
258
259         /* check for a valid length */
260         if (pkt->u.response.stub_and_verifier.length < auth_blob.length) {
261                 return NT_STATUS_INFO_LENGTH_MISMATCH;
262         }
263
264         auth_blob.data = 
265                 pkt->u.response.stub_and_verifier.data + 
266                 pkt->u.response.stub_and_verifier.length - auth_blob.length;
267         pkt->u.response.stub_and_verifier.length -= auth_blob.length;
268
269         /* pull the auth structure */
270         ndr = ndr_pull_init_flags(c, &auth_blob, mem_ctx);
271         if (!ndr) {
272                 return NT_STATUS_NO_MEMORY;
273         }
274
275         if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
276                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
277         }
278
279         ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
280         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
281                 return ndr_map_error2ntstatus(ndr_err);
282         }
283         status = NT_STATUS_OK;
284
285         /* check signature or unseal the packet */
286         switch (c->security_state.auth_info->auth_level) {
287         case DCERPC_AUTH_LEVEL_PRIVACY:
288                 status = gensec_unseal_packet(c->security_state.generic_state, 
289                                               mem_ctx, 
290                                               raw_packet->data + DCERPC_REQUEST_LENGTH,
291                                               pkt->u.response.stub_and_verifier.length, 
292                                               raw_packet->data,
293                                               raw_packet->length - auth.credentials.length,
294                                               &auth.credentials);
295                 memcpy(pkt->u.response.stub_and_verifier.data,
296                        raw_packet->data + DCERPC_REQUEST_LENGTH,
297                        pkt->u.response.stub_and_verifier.length);
298                 break;
299                 
300         case DCERPC_AUTH_LEVEL_INTEGRITY:
301                 status = gensec_check_packet(c->security_state.generic_state, 
302                                              mem_ctx, 
303                                              pkt->u.response.stub_and_verifier.data, 
304                                              pkt->u.response.stub_and_verifier.length, 
305                                              raw_packet->data,
306                                              raw_packet->length - auth.credentials.length,
307                                              &auth.credentials);
308                 break;
309
310         case DCERPC_AUTH_LEVEL_CONNECT:
311                 status = dcerpc_check_connect_verifier(&auth.credentials);
312                 break;
313
314         case DCERPC_AUTH_LEVEL_NONE:
315                 break;
316
317         default:
318                 status = NT_STATUS_INVALID_LEVEL;
319                 break;
320         }
321         
322         /* remove the indicated amount of paddiing */
323         if (pkt->u.response.stub_and_verifier.length < auth.auth_pad_length) {
324                 return NT_STATUS_INFO_LENGTH_MISMATCH;
325         }
326         pkt->u.response.stub_and_verifier.length -= auth.auth_pad_length;
327
328         return status;
329 }
330
331
332 /* 
333    push a dcerpc request packet into a blob, possibly signing it.
334 */
335 static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c, 
336                                          DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
337                                          size_t sig_size,
338                                          struct ncacn_packet *pkt)
339 {
340         NTSTATUS status;
341         struct ndr_push *ndr;
342         DATA_BLOB creds2;
343         size_t payload_length;
344         enum ndr_err_code ndr_err;
345
346         /* non-signed packets are simpler */
347         if (!c->security_state.auth_info || 
348             !c->security_state.generic_state) {
349                 return ncacn_push_auth(blob, mem_ctx, c->iconv_convenience, pkt, c->security_state.auth_info);
350         }
351
352         ndr = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
353         if (!ndr) {
354                 return NT_STATUS_NO_MEMORY;
355         }
356
357         if (c->flags & DCERPC_PUSH_BIGENDIAN) {
358                 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
359         }
360
361         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
362                 ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
363         }
364
365         ndr_err = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
366         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
367                 return ndr_map_error2ntstatus(ndr_err);
368         }
369         status = NT_STATUS_OK;
370
371         /* pad to 16 byte multiple in the payload portion of the
372            packet. This matches what w2k3 does */
373         c->security_state.auth_info->auth_pad_length = 
374                 (16 - (pkt->u.request.stub_and_verifier.length & 15)) & 15;
375         ndr_push_zero(ndr, c->security_state.auth_info->auth_pad_length);
376
377         payload_length = pkt->u.request.stub_and_verifier.length + 
378                 c->security_state.auth_info->auth_pad_length;
379
380         /* sign or seal the packet */
381         switch (c->security_state.auth_info->auth_level) {
382         case DCERPC_AUTH_LEVEL_PRIVACY:
383         case DCERPC_AUTH_LEVEL_INTEGRITY:
384                 /* We hope this length is accruate.  If must be if the
385                  * GENSEC mech does AEAD signing of the packet
386                  * headers */
387                 c->security_state.auth_info->credentials
388                         = data_blob_talloc(mem_ctx, NULL, sig_size);
389                 data_blob_clear(&c->security_state.auth_info->credentials);
390                 break;
391
392         case DCERPC_AUTH_LEVEL_CONNECT:
393                 status = dcerpc_connect_verifier(mem_ctx, &c->security_state.auth_info->credentials);
394                 break;
395                 
396         case DCERPC_AUTH_LEVEL_NONE:
397                 c->security_state.auth_info->credentials = data_blob(NULL, 0);
398                 break;
399                 
400         default:
401                 status = NT_STATUS_INVALID_LEVEL;
402                 break;
403         }
404         
405         if (!NT_STATUS_IS_OK(status)) {
406                 return status;
407         }       
408
409         /* add the auth verifier */
410         ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, c->security_state.auth_info);
411         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
412                 return ndr_map_error2ntstatus(ndr_err);
413         }
414         status = NT_STATUS_OK;
415
416         /* extract the whole packet as a blob */
417         *blob = ndr_push_blob(ndr);
418
419         /* fill in the fragment length and auth_length, we can't fill
420            in these earlier as we don't know the signature length (it
421            could be variable length) */
422         dcerpc_set_frag_length(blob, blob->length);
423         /* We hope this value is accruate.  If must be if the GENSEC
424          * mech does AEAD signing of the packet headers */
425         dcerpc_set_auth_length(blob, c->security_state.auth_info->credentials.length);
426
427         /* sign or seal the packet */
428         switch (c->security_state.auth_info->auth_level) {
429         case DCERPC_AUTH_LEVEL_PRIVACY:
430                 status = gensec_seal_packet(c->security_state.generic_state, 
431                                             mem_ctx, 
432                                             blob->data + DCERPC_REQUEST_LENGTH, 
433                                             payload_length,
434                                             blob->data,
435                                             blob->length - 
436                                             c->security_state.auth_info->credentials.length,
437                                             &creds2);
438                 if (!NT_STATUS_IS_OK(status)) {
439                         return status;
440                 }
441                 blob->length -= c->security_state.auth_info->credentials.length;
442                 if (!data_blob_append(mem_ctx, blob,
443                                           creds2.data, creds2.length)) {
444                         return NT_STATUS_NO_MEMORY;
445                 }
446                 dcerpc_set_auth_length(blob, creds2.length);
447                 if (c->security_state.auth_info->credentials.length == 0) {
448                         /* this is needed for krb5 only, to correct the total packet
449                            length */
450                         dcerpc_set_frag_length(blob, 
451                                                dcerpc_get_frag_length(blob)
452                                                +creds2.length);
453                 }
454                 break;
455
456         case DCERPC_AUTH_LEVEL_INTEGRITY:
457                 status = gensec_sign_packet(c->security_state.generic_state, 
458                                             mem_ctx, 
459                                             blob->data + DCERPC_REQUEST_LENGTH, 
460                                             payload_length, 
461                                             blob->data,
462                                             blob->length - 
463                                             c->security_state.auth_info->credentials.length,
464                                             &creds2);
465                 if (!NT_STATUS_IS_OK(status)) {
466                         return status;
467                 }
468                 blob->length -= c->security_state.auth_info->credentials.length;
469                 if (!data_blob_append(mem_ctx, blob,
470                                           creds2.data, creds2.length)) {
471                         return NT_STATUS_NO_MEMORY;
472                 }
473                 dcerpc_set_auth_length(blob, creds2.length);
474                 if (c->security_state.auth_info->credentials.length == 0) {
475                         /* this is needed for krb5 only, to correct the total packet
476                            length */
477                         dcerpc_set_frag_length(blob, 
478                                                dcerpc_get_frag_length(blob)
479                                                +creds2.length);
480                 }
481                 break;
482
483         case DCERPC_AUTH_LEVEL_CONNECT:
484                 break;
485
486         case DCERPC_AUTH_LEVEL_NONE:
487                 c->security_state.auth_info->credentials = data_blob(NULL, 0);
488                 break;
489
490         default:
491                 status = NT_STATUS_INVALID_LEVEL;
492                 break;
493         }
494
495         data_blob_free(&c->security_state.auth_info->credentials);
496
497         return NT_STATUS_OK;
498 }
499
500
501 /* 
502    fill in the fixed values in a dcerpc header 
503 */
504 static void init_ncacn_hdr(struct dcerpc_connection *c, struct ncacn_packet *pkt)
505 {
506         pkt->rpc_vers = 5;
507         pkt->rpc_vers_minor = 0;
508         if (c->flags & DCERPC_PUSH_BIGENDIAN) {
509                 pkt->drep[0] = 0;
510         } else {
511                 pkt->drep[0] = DCERPC_DREP_LE;
512         }
513         pkt->drep[1] = 0;
514         pkt->drep[2] = 0;
515         pkt->drep[3] = 0;
516 }
517
518 /*
519   map a bind nak reason to a NTSTATUS
520 */
521 static NTSTATUS dcerpc_map_reason(uint16_t reason)
522 {
523         switch (reason) {
524         case DCERPC_BIND_REASON_ASYNTAX:
525                 return NT_STATUS_RPC_UNSUPPORTED_NAME_SYNTAX;
526         case DCERPC_BIND_REASON_INVALID_AUTH_TYPE:
527                 return NT_STATUS_INVALID_PARAMETER;
528         }
529         return NT_STATUS_UNSUCCESSFUL;
530 }
531
532 /*
533   a bind or alter context has failed
534 */
535 static void dcerpc_composite_fail(struct rpc_request *req)
536 {
537         struct composite_context *c = talloc_get_type(req->async.private_data, 
538                                                       struct composite_context);
539         composite_error(c, req->status);
540 }
541
542 /*
543   remove requests from the pending or queued queues
544  */
545 static int dcerpc_req_dequeue(struct rpc_request *req)
546 {
547         switch (req->state) {
548         case RPC_REQUEST_QUEUED:
549                 DLIST_REMOVE(req->p->conn->request_queue, req);
550                 break;
551         case RPC_REQUEST_PENDING:
552                 DLIST_REMOVE(req->p->conn->pending, req);
553                 break;
554         case RPC_REQUEST_DONE:
555                 break;
556         }
557         return 0;
558 }
559
560
561 /*
562   mark the dcerpc connection dead. All outstanding requests get an error
563 */
564 static void dcerpc_connection_dead(struct dcerpc_connection *conn, NTSTATUS status)
565 {
566         if (conn->dead) return;
567
568         conn->dead = true;
569
570         if (conn->transport.shutdown_pipe) {
571                 conn->transport.shutdown_pipe(conn, status);
572         }
573
574         /* all pending requests get the error */
575         while (conn->pending) {
576                 struct rpc_request *req = conn->pending;
577                 dcerpc_req_dequeue(req);
578                 req->state = RPC_REQUEST_DONE;
579                 req->status = status;
580                 if (req->async.callback) {
581                         req->async.callback(req);
582                 }
583         }       
584
585         talloc_set_destructor(conn, NULL);
586         if (conn->free_skipped) {
587                 talloc_free(conn);
588         }
589 }
590
591 /*
592   forward declarations of the recv_data handlers for the types of
593   packets we need to handle
594 */
595 static void dcerpc_request_recv_data(struct dcerpc_connection *c, 
596                                      DATA_BLOB *raw_packet, struct ncacn_packet *pkt);
597
598 /*
599   receive a dcerpc reply from the transport. Here we work out what
600   type of reply it is (normal request, bind or alter context) and
601   dispatch to the appropriate handler
602 */
603 static void dcerpc_recv_data(struct dcerpc_connection *conn, DATA_BLOB *blob, NTSTATUS status)
604 {
605         struct ncacn_packet pkt;
606
607         if (NT_STATUS_IS_OK(status) && blob->length == 0) {
608                 status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
609         }
610
611         /* the transport may be telling us of a severe error, such as
612            a dropped socket */
613         if (!NT_STATUS_IS_OK(status)) {
614                 data_blob_free(blob);
615                 dcerpc_connection_dead(conn, status);
616                 return;
617         }
618
619         /* parse the basic packet to work out what type of response this is */
620         status = ncacn_pull(conn, blob, blob->data, &pkt);
621         if (!NT_STATUS_IS_OK(status)) {
622                 data_blob_free(blob);
623                 dcerpc_connection_dead(conn, status);
624         }
625
626         dcerpc_request_recv_data(conn, blob, &pkt);
627 }
628
629
630 /*
631   Receive a bind reply from the transport
632 */
633 static void dcerpc_bind_recv_handler(struct rpc_request *req, 
634                                      DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
635 {
636         struct composite_context *c;
637         struct dcerpc_connection *conn;
638
639         c = talloc_get_type(req->async.private_data, struct composite_context);
640
641         if (pkt->ptype == DCERPC_PKT_BIND_NAK) {
642                 DEBUG(2,("dcerpc: bind_nak reason %d\n",
643                          pkt->u.bind_nak.reject_reason));
644                 composite_error(c, dcerpc_map_reason(pkt->u.bind_nak.
645                                                      reject_reason));
646                 return;
647         }
648
649         if ((pkt->ptype != DCERPC_PKT_BIND_ACK) ||
650             (pkt->u.bind_ack.num_results == 0) ||
651             (pkt->u.bind_ack.ctx_list[0].result != 0)) {
652                 composite_error(c, NT_STATUS_NET_WRITE_FAULT);
653                 return;
654         }
655
656         conn = req->p->conn;
657
658         conn->srv_max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
659         conn->srv_max_recv_frag = pkt->u.bind_ack.max_recv_frag;
660
661         if ((req->p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) &&
662             (pkt->pfc_flags & DCERPC_PFC_FLAG_CONC_MPX)) {
663                 conn->flags |= DCERPC_CONCURRENT_MULTIPLEX;
664         }
665
666         if ((req->p->binding->flags & DCERPC_HEADER_SIGNING) &&
667             (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN)) {
668                 conn->flags |= DCERPC_HEADER_SIGNING;
669         }
670
671         /* the bind_ack might contain a reply set of credentials */
672         if (conn->security_state.auth_info &&
673             pkt->u.bind_ack.auth_info.length) {
674                 enum ndr_err_code ndr_err;
675                 ndr_err = ndr_pull_struct_blob(
676                         &pkt->u.bind_ack.auth_info, conn,
677                         NULL,
678                         conn->security_state.auth_info,
679                         (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
680                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
681                         c->status = ndr_map_error2ntstatus(ndr_err);
682                         if (!composite_is_ok(c)) return;
683                 }
684         }
685
686         req->p->assoc_group_id = pkt->u.bind_ack.assoc_group_id;
687
688         composite_done(c);
689 }
690
691 /*
692   handle timeouts of individual dcerpc requests
693 */
694 static void dcerpc_timeout_handler(struct event_context *ev, struct timed_event *te, 
695                                    struct timeval t, void *private)
696 {
697         struct rpc_request *req = talloc_get_type(private, struct rpc_request);
698
699         if (req->ignore_timeout) {
700                 dcerpc_req_dequeue(req);
701                 req->state = RPC_REQUEST_DONE;
702                 req->status = NT_STATUS_IO_TIMEOUT;
703                 if (req->async.callback) {
704                         req->async.callback(req);
705                 }
706                 return;
707         }
708
709         dcerpc_connection_dead(req->p->conn, NT_STATUS_IO_TIMEOUT);
710 }
711
712 /*
713   send a async dcerpc bind request
714 */
715 struct composite_context *dcerpc_bind_send(struct dcerpc_pipe *p,
716                                            TALLOC_CTX *mem_ctx,
717                                            const struct ndr_syntax_id *syntax,
718                                            const struct ndr_syntax_id *transfer_syntax)
719 {
720         struct composite_context *c;
721         struct ncacn_packet pkt;
722         DATA_BLOB blob;
723         struct rpc_request *req;
724
725         c = composite_create(mem_ctx,p->conn->event_ctx);
726         if (c == NULL) return NULL;
727
728         c->private_data = p;
729
730         p->syntax = *syntax;
731         p->transfer_syntax = *transfer_syntax;
732
733         init_ncacn_hdr(p->conn, &pkt);
734
735         pkt.ptype = DCERPC_PKT_BIND;
736         pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
737         pkt.call_id = p->conn->call_id;
738         pkt.auth_length = 0;
739
740         if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
741                 pkt.pfc_flags |= DCERPC_PFC_FLAG_CONC_MPX;
742         }
743
744         if (p->binding->flags & DCERPC_HEADER_SIGNING) {
745                 pkt.pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
746         }
747
748         pkt.u.bind.max_xmit_frag = 5840;
749         pkt.u.bind.max_recv_frag = 5840;
750         pkt.u.bind.assoc_group_id = p->binding->assoc_group_id;
751         pkt.u.bind.num_contexts = 1;
752         pkt.u.bind.ctx_list = talloc_array(mem_ctx, struct dcerpc_ctx_list, 1);
753         if (composite_nomem(pkt.u.bind.ctx_list, c)) return c;
754         pkt.u.bind.ctx_list[0].context_id = p->context_id;
755         pkt.u.bind.ctx_list[0].num_transfer_syntaxes = 1;
756         pkt.u.bind.ctx_list[0].abstract_syntax = p->syntax;
757         pkt.u.bind.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
758         pkt.u.bind.auth_info = data_blob(NULL, 0);
759
760         /* construct the NDR form of the packet */
761         c->status = ncacn_push_auth(&blob, c, p->conn->iconv_convenience, &pkt,
762                                     p->conn->security_state.auth_info);
763         if (!composite_is_ok(c)) return c;
764
765         p->conn->transport.recv_data = dcerpc_recv_data;
766
767         /*
768          * we allocate a dcerpc_request so we can be in the same
769          * request queue as normal requests
770          */
771         req = talloc_zero(c, struct rpc_request);
772         if (composite_nomem(req, c)) return c;
773
774         req->state = RPC_REQUEST_PENDING;
775         req->call_id = pkt.call_id;
776         req->async.private_data = c;
777         req->async.callback = dcerpc_composite_fail;
778         req->p = p;
779         req->recv_handler = dcerpc_bind_recv_handler;
780         DLIST_ADD_END(p->conn->pending, req, struct rpc_request *);
781         talloc_set_destructor(req, dcerpc_req_dequeue);
782
783         c->status = p->conn->transport.send_request(p->conn, &blob,
784                                                     true);
785         if (!composite_is_ok(c)) return c;
786
787         event_add_timed(c->event_ctx, req,
788                         timeval_current_ofs(DCERPC_REQUEST_TIMEOUT, 0),
789                         dcerpc_timeout_handler, req);
790
791         return c;
792 }
793
794 /*
795   recv side of async dcerpc bind request
796 */
797 NTSTATUS dcerpc_bind_recv(struct composite_context *ctx)
798 {
799         NTSTATUS result = composite_wait(ctx);
800         talloc_free(ctx);
801         return result;
802 }
803
804 /* 
805    perform a continued bind (and auth3)
806 */
807 NTSTATUS dcerpc_auth3(struct dcerpc_pipe *p,
808                       TALLOC_CTX *mem_ctx)
809 {
810         struct ncacn_packet pkt;
811         NTSTATUS status;
812         DATA_BLOB blob;
813
814         init_ncacn_hdr(p->conn, &pkt);
815
816         pkt.ptype = DCERPC_PKT_AUTH3;
817         pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
818         pkt.call_id = next_call_id(p->conn);
819         pkt.auth_length = 0;
820         pkt.u.auth3._pad = 0;
821         pkt.u.auth3.auth_info = data_blob(NULL, 0);
822
823         if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
824                 pkt.pfc_flags |= DCERPC_PFC_FLAG_CONC_MPX;
825         }
826
827         if (p->binding->flags & DCERPC_HEADER_SIGNING) {
828                 pkt.pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
829         }
830
831         /* construct the NDR form of the packet */
832         status = ncacn_push_auth(&blob, mem_ctx,
833                                  p->conn->iconv_convenience,
834                                  &pkt,
835                                  p->conn->security_state.auth_info);
836         if (!NT_STATUS_IS_OK(status)) {
837                 return status;
838         }
839
840         /* send it on its way */
841         status = p->conn->transport.send_request(p->conn, &blob, false);
842         if (!NT_STATUS_IS_OK(status)) {
843                 return status;
844         }
845
846         return NT_STATUS_OK;    
847 }
848
849
850 /*
851   process a fragment received from the transport layer during a
852   request
853
854   This function frees the data 
855 */
856 static void dcerpc_request_recv_data(struct dcerpc_connection *c, 
857                                      DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
858 {
859         struct rpc_request *req;
860         uint_t length;
861         NTSTATUS status = NT_STATUS_OK;
862
863         /*
864           if this is an authenticated connection then parse and check
865           the auth info. We have to do this before finding the
866           matching packet, as the request structure might have been
867           removed due to a timeout, but if it has been we still need
868           to run the auth routines so that we don't get the sign/seal
869           info out of step with the server
870         */
871         if (c->security_state.auth_info && c->security_state.generic_state &&
872             pkt->ptype == DCERPC_PKT_RESPONSE) {
873                 status = ncacn_pull_request_auth(c, raw_packet->data, raw_packet, pkt);
874         }
875
876         /* find the matching request */
877         for (req=c->pending;req;req=req->next) {
878                 if (pkt->call_id == req->call_id) break;
879         }
880
881 #if 0
882         /* useful for testing certain vendors RPC servers */
883         if (req == NULL && c->pending && pkt->call_id == 0) {
884                 DEBUG(0,("HACK FOR INCORRECT CALL ID\n"));
885                 req = c->pending;
886         }
887 #endif
888
889         if (req == NULL) {
890                 DEBUG(2,("dcerpc_request: unmatched call_id %u in response packet\n", pkt->call_id));
891                 data_blob_free(raw_packet);
892                 return;
893         }
894
895         talloc_steal(req, raw_packet->data);
896
897         if (req->recv_handler != NULL) {
898                 dcerpc_req_dequeue(req);
899                 req->state = RPC_REQUEST_DONE;
900                 req->recv_handler(req, raw_packet, pkt);
901                 return;
902         }
903
904         if (pkt->ptype == DCERPC_PKT_FAULT) {
905                 DEBUG(5,("rpc fault: %s\n", dcerpc_errstr(c, pkt->u.fault.status)));
906                 req->fault_code = pkt->u.fault.status;
907                 req->status = NT_STATUS_NET_WRITE_FAULT;
908                 goto req_done;
909         }
910
911         if (pkt->ptype != DCERPC_PKT_RESPONSE) {
912                 DEBUG(2,("Unexpected packet type %d in dcerpc response\n",
913                          (int)pkt->ptype)); 
914                 req->fault_code = DCERPC_FAULT_OTHER;
915                 req->status = NT_STATUS_NET_WRITE_FAULT;
916                 goto req_done;
917         }
918
919         /* now check the status from the auth routines, and if it failed then fail
920            this request accordingly */
921         if (!NT_STATUS_IS_OK(status)) {
922                 req->status = status;
923                 goto req_done;
924         }
925
926         length = pkt->u.response.stub_and_verifier.length;
927
928         if (length > 0) {
929                 req->payload.data = talloc_realloc(req, 
930                                                    req->payload.data, 
931                                                    uint8_t,
932                                                    req->payload.length + length);
933                 if (!req->payload.data) {
934                         req->status = NT_STATUS_NO_MEMORY;
935                         goto req_done;
936                 }
937                 memcpy(req->payload.data+req->payload.length, 
938                        pkt->u.response.stub_and_verifier.data, length);
939                 req->payload.length += length;
940         }
941
942         if (!(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
943                 c->transport.send_read(c);
944                 return;
945         }
946
947         if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
948                 req->flags |= DCERPC_PULL_BIGENDIAN;
949         } else {
950                 req->flags &= ~DCERPC_PULL_BIGENDIAN;
951         }
952
953
954 req_done:
955         /* we've got the full payload */
956         req->state = RPC_REQUEST_DONE;
957         DLIST_REMOVE(c->pending, req);
958
959         if (c->request_queue != NULL) {
960                 /* We have to look at shipping further requests before calling
961                  * the async function, that one might close the pipe */
962                 dcerpc_ship_next_request(c);
963         }
964
965         if (req->async.callback) {
966                 req->async.callback(req);
967         }
968 }
969
970 /*
971   perform the send side of a async dcerpc request
972 */
973 static struct rpc_request *dcerpc_request_send(struct dcerpc_pipe *p, 
974                                                const struct GUID *object,
975                                                uint16_t opnum,
976                                                bool async,
977                                                DATA_BLOB *stub_data)
978 {
979         struct rpc_request *req;
980
981         p->conn->transport.recv_data = dcerpc_recv_data;
982
983         req = talloc(p, struct rpc_request);
984         if (req == NULL) {
985                 return NULL;
986         }
987
988         req->p = p;
989         req->call_id = next_call_id(p->conn);
990         req->status = NT_STATUS_OK;
991         req->state = RPC_REQUEST_QUEUED;
992         req->payload = data_blob(NULL, 0);
993         req->flags = 0;
994         req->fault_code = 0;
995         req->async_call = async;
996         req->ignore_timeout = false;
997         req->async.callback = NULL;
998         req->async.private_data = NULL;
999         req->recv_handler = NULL;
1000
1001         if (object != NULL) {
1002                 req->object = (struct GUID *)talloc_memdup(req, (const void *)object, sizeof(*object));
1003                 if (req->object == NULL) {
1004                         talloc_free(req);
1005                         return NULL;
1006                 }
1007         } else {
1008                 req->object = NULL;
1009         }
1010
1011         req->opnum = opnum;
1012         req->request_data.length = stub_data->length;
1013         req->request_data.data = talloc_reference(req, stub_data->data);
1014         if (req->request_data.length && req->request_data.data == NULL) {
1015                 return NULL;
1016         }
1017
1018         DLIST_ADD_END(p->conn->request_queue, req, struct rpc_request *);
1019         talloc_set_destructor(req, dcerpc_req_dequeue);
1020
1021         dcerpc_ship_next_request(p->conn);
1022
1023         if (p->request_timeout) {
1024                 event_add_timed(dcerpc_event_context(p), req, 
1025                                 timeval_current_ofs(p->request_timeout, 0), 
1026                                 dcerpc_timeout_handler, req);
1027         }
1028
1029         return req;
1030 }
1031
1032 /*
1033   Send a request using the transport
1034 */
1035
1036 static void dcerpc_ship_next_request(struct dcerpc_connection *c)
1037 {
1038         struct rpc_request *req;
1039         struct dcerpc_pipe *p;
1040         DATA_BLOB *stub_data;
1041         struct ncacn_packet pkt;
1042         DATA_BLOB blob;
1043         uint32_t remaining, chunk_size;
1044         bool first_packet = true;
1045         size_t sig_size = 0;
1046
1047         req = c->request_queue;
1048         if (req == NULL) {
1049                 return;
1050         }
1051
1052         p = req->p;
1053         stub_data = &req->request_data;
1054
1055         if (!req->async_call && (c->pending != NULL)) {
1056                 return;
1057         }
1058
1059         DLIST_REMOVE(c->request_queue, req);
1060         DLIST_ADD(c->pending, req);
1061         req->state = RPC_REQUEST_PENDING;
1062
1063         init_ncacn_hdr(p->conn, &pkt);
1064
1065         remaining = stub_data->length;
1066
1067         /* we can write a full max_recv_frag size, minus the dcerpc
1068            request header size */
1069         chunk_size = p->conn->srv_max_recv_frag;
1070         chunk_size -= DCERPC_REQUEST_LENGTH;
1071         if (c->security_state.generic_state) {
1072                 chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
1073                 sig_size = gensec_sig_size(c->security_state.generic_state,
1074                                            p->conn->srv_max_recv_frag);
1075                 chunk_size -= sig_size;
1076                 chunk_size -= (chunk_size % 16);
1077         }
1078
1079         pkt.ptype = DCERPC_PKT_REQUEST;
1080         pkt.call_id = req->call_id;
1081         pkt.auth_length = 0;
1082         pkt.pfc_flags = 0;
1083         pkt.u.request.alloc_hint = remaining;
1084         pkt.u.request.context_id = p->context_id;
1085         pkt.u.request.opnum = req->opnum;
1086
1087         if (req->object) {
1088                 pkt.u.request.object.object = *req->object;
1089                 pkt.pfc_flags |= DCERPC_PFC_FLAG_OBJECT_UUID;
1090                 chunk_size -= ndr_size_GUID(req->object,0);
1091         }
1092
1093         /* we send a series of pdus without waiting for a reply */
1094         while (remaining > 0 || first_packet) {
1095                 uint32_t chunk = MIN(chunk_size, remaining);
1096                 bool last_frag = false;
1097
1098                 first_packet = false;
1099                 pkt.pfc_flags &= ~(DCERPC_PFC_FLAG_FIRST |DCERPC_PFC_FLAG_LAST);
1100
1101                 if (remaining == stub_data->length) {
1102                         pkt.pfc_flags |= DCERPC_PFC_FLAG_FIRST;
1103                 }
1104                 if (chunk == remaining) {
1105                         pkt.pfc_flags |= DCERPC_PFC_FLAG_LAST;
1106                         last_frag = true;
1107                 }
1108
1109                 pkt.u.request.stub_and_verifier.data = stub_data->data + 
1110                         (stub_data->length - remaining);
1111                 pkt.u.request.stub_and_verifier.length = chunk;
1112
1113                 req->status = ncacn_push_request_sign(p->conn, &blob, req, sig_size, &pkt);
1114                 if (!NT_STATUS_IS_OK(req->status)) {
1115                         req->state = RPC_REQUEST_DONE;
1116                         DLIST_REMOVE(p->conn->pending, req);
1117                         return;
1118                 }
1119                 
1120                 req->status = p->conn->transport.send_request(p->conn, &blob, last_frag);
1121                 if (!NT_STATUS_IS_OK(req->status)) {
1122                         req->state = RPC_REQUEST_DONE;
1123                         DLIST_REMOVE(p->conn->pending, req);
1124                         return;
1125                 }               
1126
1127                 remaining -= chunk;
1128         }
1129 }
1130
1131 /*
1132   return the event context for a dcerpc pipe
1133   used by callers who wish to operate asynchronously
1134 */
1135 _PUBLIC_ struct event_context *dcerpc_event_context(struct dcerpc_pipe *p)
1136 {
1137         return p->conn->event_ctx;
1138 }
1139
1140
1141
1142 /*
1143   perform the receive side of a async dcerpc request
1144 */
1145 NTSTATUS dcerpc_request_recv(struct rpc_request *req,
1146                              TALLOC_CTX *mem_ctx,
1147                              DATA_BLOB *stub_data)
1148 {
1149         NTSTATUS status;
1150
1151         while (req->state != RPC_REQUEST_DONE) {
1152                 struct event_context *ctx = dcerpc_event_context(req->p);
1153                 if (event_loop_once(ctx) != 0) {
1154                         return NT_STATUS_CONNECTION_DISCONNECTED;
1155                 }
1156         }
1157         *stub_data = req->payload;
1158         status = req->status;
1159         if (stub_data->data) {
1160                 stub_data->data = talloc_steal(mem_ctx, stub_data->data);
1161         }
1162         if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
1163                 req->p->last_fault_code = req->fault_code;
1164         }
1165         talloc_free(req);
1166         return status;
1167 }
1168
1169 /*
1170   perform a full request/response pair on a dcerpc pipe
1171 */
1172 NTSTATUS dcerpc_request(struct dcerpc_pipe *p, 
1173                         struct GUID *object,
1174                         uint16_t opnum,
1175                         bool async,
1176                         TALLOC_CTX *mem_ctx,
1177                         DATA_BLOB *stub_data_in,
1178                         DATA_BLOB *stub_data_out)
1179 {
1180         struct rpc_request *req;
1181
1182         req = dcerpc_request_send(p, object, opnum, async, stub_data_in);
1183         if (req == NULL) {
1184                 return NT_STATUS_NO_MEMORY;
1185         }
1186
1187         return dcerpc_request_recv(req, mem_ctx, stub_data_out);
1188 }
1189
1190
1191 /*
1192   this is a paranoid NDR validator. For every packet we push onto the wire
1193   we pull it back again, then push it again. Then we compare the raw NDR data
1194   for that to the NDR we initially generated. If they don't match then we know
1195   we must have a bug in either the pull or push side of our code
1196 */
1197 static NTSTATUS dcerpc_ndr_validate_in(struct dcerpc_connection *c, 
1198                                        TALLOC_CTX *mem_ctx,
1199                                        DATA_BLOB blob,
1200                                        size_t struct_size,
1201                                        ndr_push_flags_fn_t ndr_push,
1202                                        ndr_pull_flags_fn_t ndr_pull)
1203 {
1204         void *st;
1205         struct ndr_pull *pull;
1206         struct ndr_push *push;
1207         DATA_BLOB blob2;
1208         enum ndr_err_code ndr_err;
1209
1210         st = talloc_size(mem_ctx, struct_size);
1211         if (!st) {
1212                 return NT_STATUS_NO_MEMORY;
1213         }
1214
1215         pull = ndr_pull_init_flags(c, &blob, mem_ctx);
1216         if (!pull) {
1217                 return NT_STATUS_NO_MEMORY;
1218         }
1219         pull->flags |= LIBNDR_FLAG_REF_ALLOC;
1220
1221         ndr_err = ndr_pull(pull, NDR_IN, st);
1222         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1223                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1224                 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1225                                          "failed input validation pull - %s",
1226                                          nt_errstr(status));
1227                 return ndr_map_error2ntstatus(ndr_err);
1228         }
1229
1230         push = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
1231         if (!push) {
1232                 return NT_STATUS_NO_MEMORY;
1233         }       
1234
1235         ndr_err = ndr_push(push, NDR_IN, st);
1236         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1237                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1238                 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1239                                          "failed input validation push - %s",
1240                                          nt_errstr(status));
1241                 return ndr_map_error2ntstatus(ndr_err);
1242         }
1243
1244         blob2 = ndr_push_blob(push);
1245
1246         if (data_blob_cmp(&blob, &blob2) != 0) {
1247                 DEBUG(3,("original:\n"));
1248                 dump_data(3, blob.data, blob.length);
1249                 DEBUG(3,("secondary:\n"));
1250                 dump_data(3, blob2.data, blob2.length);
1251                 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1252                                          "failed input validation blobs doesn't match");
1253                 return ndr_map_error2ntstatus(ndr_err);
1254         }
1255
1256         return NT_STATUS_OK;
1257 }
1258
1259 /*
1260   this is a paranoid NDR input validator. For every packet we pull
1261   from the wire we push it back again then pull and push it
1262   again. Then we compare the raw NDR data for that to the NDR we
1263   initially generated. If they don't match then we know we must have a
1264   bug in either the pull or push side of our code
1265 */
1266 static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
1267                                         struct ndr_pull *pull_in,
1268                                         void *struct_ptr,
1269                                         size_t struct_size,
1270                                         ndr_push_flags_fn_t ndr_push,
1271                                         ndr_pull_flags_fn_t ndr_pull,
1272                                         ndr_print_function_t ndr_print)
1273 {
1274         void *st;
1275         struct ndr_pull *pull;
1276         struct ndr_push *push;
1277         DATA_BLOB blob, blob2;
1278         TALLOC_CTX *mem_ctx = pull_in;
1279         char *s1, *s2;
1280         enum ndr_err_code ndr_err;
1281
1282         st = talloc_size(mem_ctx, struct_size);
1283         if (!st) {
1284                 return NT_STATUS_NO_MEMORY;
1285         }
1286         memcpy(st, struct_ptr, struct_size);
1287
1288         push = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
1289         if (!push) {
1290                 return NT_STATUS_NO_MEMORY;
1291         }       
1292
1293         ndr_err = ndr_push(push, NDR_OUT, struct_ptr);
1294         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1295                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1296                 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1297                                          "failed output validation push - %s",
1298                                          nt_errstr(status));
1299                 return ndr_map_error2ntstatus(ndr_err);
1300         }
1301
1302         blob = ndr_push_blob(push);
1303
1304         pull = ndr_pull_init_flags(c, &blob, mem_ctx);
1305         if (!pull) {
1306                 return NT_STATUS_NO_MEMORY;
1307         }
1308
1309         pull->flags |= LIBNDR_FLAG_REF_ALLOC;
1310         ndr_err = ndr_pull(pull, NDR_OUT, st);
1311         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1312                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1313                 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1314                                          "failed output validation pull - %s",
1315                                          nt_errstr(status));
1316                 return ndr_map_error2ntstatus(ndr_err);
1317         }
1318
1319         push = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
1320         if (!push) {
1321                 return NT_STATUS_NO_MEMORY;
1322         }       
1323
1324         ndr_err = ndr_push(push, NDR_OUT, st);
1325         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1326                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1327                 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1328                                          "failed output validation push2 - %s",
1329                                          nt_errstr(status));
1330                 return ndr_map_error2ntstatus(ndr_err);
1331         }
1332
1333         blob2 = ndr_push_blob(push);
1334
1335         if (data_blob_cmp(&blob, &blob2) != 0) {
1336                 DEBUG(3,("original:\n"));
1337                 dump_data(3, blob.data, blob.length);
1338                 DEBUG(3,("secondary:\n"));
1339                 dump_data(3, blob2.data, blob2.length);
1340                 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1341                                          "failed output validation blobs doesn't match");
1342                 return ndr_map_error2ntstatus(ndr_err);
1343         }
1344
1345         /* this checks the printed forms of the two structures, which effectively
1346            tests all of the value() attributes */
1347         s1 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE", 
1348                                        NDR_OUT, struct_ptr);
1349         s2 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE", 
1350                                        NDR_OUT, st);
1351         if (strcmp(s1, s2) != 0) {
1352 #if 1
1353                 DEBUG(3,("VALIDATE ERROR:\nWIRE:\n%s\n GEN:\n%s\n", s1, s2));
1354 #else
1355                 /* this is sometimes useful */
1356                 printf("VALIDATE ERROR\n");
1357                 file_save("wire.dat", s1, strlen(s1));
1358                 file_save("gen.dat", s2, strlen(s2));
1359                 system("diff -u wire.dat gen.dat");
1360 #endif
1361                 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1362                                          "failed output validation strings doesn't match");
1363                 return ndr_map_error2ntstatus(ndr_err);
1364         }
1365
1366         return NT_STATUS_OK;
1367 }
1368
1369
1370 /**
1371  send a rpc request given a dcerpc_call structure 
1372  */
1373 struct rpc_request *dcerpc_ndr_request_send(struct dcerpc_pipe *p,
1374                                                 const struct GUID *object,
1375                                                 const struct ndr_interface_table *table,
1376                                                 uint32_t opnum, 
1377                                                 TALLOC_CTX *mem_ctx, 
1378                                                 void *r)
1379 {
1380         const struct ndr_interface_call *call;
1381         struct ndr_push *push;
1382         NTSTATUS status;
1383         DATA_BLOB request;
1384         struct rpc_request *req;
1385         enum ndr_err_code ndr_err;
1386
1387         call = &table->calls[opnum];
1388
1389         /* setup for a ndr_push_* call */
1390         push = ndr_push_init_ctx(mem_ctx, p->conn->iconv_convenience);
1391         if (!push) {
1392                 return NULL;
1393         }
1394
1395         if (p->conn->flags & DCERPC_PUSH_BIGENDIAN) {
1396                 push->flags |= LIBNDR_FLAG_BIGENDIAN;
1397         }
1398
1399         /* push the structure into a blob */
1400         ndr_err = call->ndr_push(push, NDR_IN, r);
1401         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1402                 status = ndr_map_error2ntstatus(ndr_err);
1403                 DEBUG(2,("Unable to ndr_push structure in dcerpc_ndr_request_send - %s\n",
1404                          nt_errstr(status)));
1405                 talloc_free(push);
1406                 return NULL;
1407         }
1408
1409         /* retrieve the blob */
1410         request = ndr_push_blob(push);
1411
1412         if (p->conn->flags & DCERPC_DEBUG_VALIDATE_IN) {
1413                 status = dcerpc_ndr_validate_in(p->conn, push, request, call->struct_size, 
1414                                                 call->ndr_push, call->ndr_pull);
1415                 if (!NT_STATUS_IS_OK(status)) {
1416                         DEBUG(2,("Validation failed in dcerpc_ndr_request_send - %s\n",
1417                                  nt_errstr(status)));
1418                         talloc_free(push);
1419                         return NULL;
1420                 }
1421         }
1422
1423         DEBUG(10,("rpc request data:\n"));
1424         dump_data(10, request.data, request.length);
1425
1426         /* make the actual dcerpc request */
1427         req = dcerpc_request_send(p, object, opnum, table->calls[opnum].async,
1428                                   &request);
1429
1430         if (req != NULL) {
1431                 req->ndr.table = table;
1432                 req->ndr.opnum = opnum;
1433                 req->ndr.struct_ptr = r;
1434                 req->ndr.mem_ctx = mem_ctx;
1435         }
1436
1437         talloc_free(push);
1438
1439         return req;
1440 }
1441
1442 /*
1443   receive the answer from a dcerpc_ndr_request_send()
1444 */
1445 _PUBLIC_ NTSTATUS dcerpc_ndr_request_recv(struct rpc_request *req)
1446 {
1447         struct dcerpc_pipe *p = req->p;
1448         NTSTATUS status;
1449         DATA_BLOB response;
1450         struct ndr_pull *pull;
1451         uint_t flags;
1452         TALLOC_CTX *mem_ctx = req->ndr.mem_ctx;
1453         void *r = req->ndr.struct_ptr;
1454         uint32_t opnum = req->ndr.opnum;
1455         const struct ndr_interface_table *table = req->ndr.table;
1456         const struct ndr_interface_call *call = &table->calls[opnum];
1457         enum ndr_err_code ndr_err;
1458
1459         /* make sure the recv code doesn't free the request, as we
1460            need to grab the flags element before it is freed */
1461         if (talloc_reference(p, req) == NULL) {
1462                 return NT_STATUS_NO_MEMORY;
1463         }
1464
1465         status = dcerpc_request_recv(req, mem_ctx, &response);
1466         if (!NT_STATUS_IS_OK(status)) {
1467                 talloc_unlink(p, req);
1468                 return status;
1469         }
1470
1471         flags = req->flags;
1472
1473         /* prepare for ndr_pull_* */
1474         pull = ndr_pull_init_flags(p->conn, &response, mem_ctx);
1475         if (!pull) {
1476                 talloc_unlink(p, req);
1477                 return NT_STATUS_NO_MEMORY;
1478         }
1479
1480         if (pull->data) {
1481                 pull->data = talloc_steal(pull, pull->data);
1482         }
1483         talloc_unlink(p, req);
1484
1485         if (flags & DCERPC_PULL_BIGENDIAN) {
1486                 pull->flags |= LIBNDR_FLAG_BIGENDIAN;
1487         }
1488
1489         DEBUG(10,("rpc reply data:\n"));
1490         dump_data(10, pull->data, pull->data_size);
1491
1492         /* pull the structure from the blob */
1493         ndr_err = call->ndr_pull(pull, NDR_OUT, r);
1494         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1495                 status = ndr_map_error2ntstatus(ndr_err);
1496                 dcerpc_log_packet(table, opnum, NDR_OUT, 
1497                                   &response);
1498                 return status;
1499         }
1500
1501         if (p->conn->flags & DCERPC_DEBUG_VALIDATE_OUT) {
1502                 status = dcerpc_ndr_validate_out(p->conn, pull, r, call->struct_size, 
1503                                                  call->ndr_push, call->ndr_pull, 
1504                                                  call->ndr_print);
1505                 if (!NT_STATUS_IS_OK(status)) {
1506                         dcerpc_log_packet(table, opnum, NDR_OUT, 
1507                                   &response);
1508                         return status;
1509                 }
1510         }
1511
1512         if (pull->offset != pull->data_size) {
1513                 DEBUG(0,("Warning! ignoring %d unread bytes in rpc packet!\n", 
1514                          pull->data_size - pull->offset));
1515                 /* we used to return NT_STATUS_INFO_LENGTH_MISMATCH here,
1516                    but it turns out that early versions of NT
1517                    (specifically NT3.1) add junk onto the end of rpc
1518                    packets, so if we want to interoperate at all with
1519                    those versions then we need to ignore this error */
1520         }
1521
1522         /* TODO: make pull context independent from the output mem_ctx and free the pull context */
1523
1524         return NT_STATUS_OK;
1525 }
1526
1527
1528 /*
1529   a useful helper function for synchronous rpc requests 
1530
1531   this can be used when you have ndr push/pull functions in the
1532   standard format
1533 */
1534 _PUBLIC_ NTSTATUS dcerpc_ndr_request(struct dcerpc_pipe *p,
1535                             const struct GUID *object,
1536                             const struct ndr_interface_table *table,
1537                             uint32_t opnum, 
1538                             TALLOC_CTX *mem_ctx, 
1539                             void *r)
1540 {
1541         struct rpc_request *req;
1542
1543         req = dcerpc_ndr_request_send(p, object, table, opnum, mem_ctx, r);
1544         if (req == NULL) {
1545                 return NT_STATUS_NO_MEMORY;
1546         }
1547
1548         return dcerpc_ndr_request_recv(req);
1549 }
1550
1551
1552 /*
1553   a useful function for retrieving the server name we connected to
1554 */
1555 _PUBLIC_ const char *dcerpc_server_name(struct dcerpc_pipe *p)
1556 {
1557         if (!p->conn->transport.target_hostname) {
1558                 if (!p->conn->transport.peer_name) {
1559                         return "";
1560                 }
1561                 return p->conn->transport.peer_name(p->conn);
1562         }
1563         return p->conn->transport.target_hostname(p->conn);
1564 }
1565
1566
1567 /*
1568   get the dcerpc auth_level for a open connection
1569 */
1570 uint32_t dcerpc_auth_level(struct dcerpc_connection *c) 
1571 {
1572         uint8_t auth_level;
1573
1574         if (c->flags & DCERPC_SEAL) {
1575                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1576         } else if (c->flags & DCERPC_SIGN) {
1577                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1578         } else if (c->flags & DCERPC_CONNECT) {
1579                 auth_level = DCERPC_AUTH_LEVEL_CONNECT;
1580         } else {
1581                 auth_level = DCERPC_AUTH_LEVEL_NONE;
1582         }
1583         return auth_level;
1584 }
1585
1586 /*
1587   Receive an alter reply from the transport
1588 */
1589 static void dcerpc_alter_recv_handler(struct rpc_request *req,
1590                                       DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
1591 {
1592         struct composite_context *c;
1593         struct dcerpc_pipe *recv_pipe;
1594
1595         c = talloc_get_type(req->async.private_data, struct composite_context);
1596         recv_pipe = talloc_get_type(c->private_data, struct dcerpc_pipe);
1597
1598         if (pkt->ptype == DCERPC_PKT_ALTER_RESP &&
1599             pkt->u.alter_resp.num_results == 1 &&
1600             pkt->u.alter_resp.ctx_list[0].result != 0) {
1601                 DEBUG(2,("dcerpc: alter_resp failed - reason %d\n", 
1602                          pkt->u.alter_resp.ctx_list[0].reason));
1603                 composite_error(c, dcerpc_map_reason(pkt->u.alter_resp.ctx_list[0].reason));
1604                 return;
1605         }
1606
1607         if (pkt->ptype != DCERPC_PKT_ALTER_RESP ||
1608             pkt->u.alter_resp.num_results == 0 ||
1609             pkt->u.alter_resp.ctx_list[0].result != 0) {
1610                 composite_error(c, NT_STATUS_NET_WRITE_FAULT);
1611                 return;
1612         }
1613
1614         /* the alter_resp might contain a reply set of credentials */
1615         if (recv_pipe->conn->security_state.auth_info &&
1616             pkt->u.alter_resp.auth_info.length) {
1617                 enum ndr_err_code ndr_err;
1618                 ndr_err = ndr_pull_struct_blob(
1619                         &pkt->u.alter_resp.auth_info, recv_pipe,
1620                         NULL,
1621                         recv_pipe->conn->security_state.auth_info,
1622                         (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
1623                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1624                         c->status = ndr_map_error2ntstatus(ndr_err);
1625                         if (!composite_is_ok(c)) return;
1626                 }
1627         }
1628
1629         composite_done(c);
1630 }
1631
1632 /* 
1633    send a dcerpc alter_context request
1634 */
1635 struct composite_context *dcerpc_alter_context_send(struct dcerpc_pipe *p, 
1636                                                     TALLOC_CTX *mem_ctx,
1637                                                     const struct ndr_syntax_id *syntax,
1638                                                     const struct ndr_syntax_id *transfer_syntax)
1639 {
1640         struct composite_context *c;
1641         struct ncacn_packet pkt;
1642         DATA_BLOB blob;
1643         struct rpc_request *req;
1644
1645         c = composite_create(mem_ctx, p->conn->event_ctx);
1646         if (c == NULL) return NULL;
1647
1648         c->private_data = p;
1649
1650         p->syntax = *syntax;
1651         p->transfer_syntax = *transfer_syntax;
1652
1653         init_ncacn_hdr(p->conn, &pkt);
1654
1655         pkt.ptype = DCERPC_PKT_ALTER;
1656         pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1657         pkt.call_id = p->conn->call_id;
1658         pkt.auth_length = 0;
1659
1660         if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
1661                 pkt.pfc_flags |= DCERPC_PFC_FLAG_CONC_MPX;
1662         }
1663
1664         if (p->binding->flags & DCERPC_HEADER_SIGNING) {
1665                 pkt.pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
1666         }
1667
1668         pkt.u.alter.max_xmit_frag = 5840;
1669         pkt.u.alter.max_recv_frag = 5840;
1670         pkt.u.alter.assoc_group_id = p->binding->assoc_group_id;
1671         pkt.u.alter.num_contexts = 1;
1672         pkt.u.alter.ctx_list = talloc_array(c, struct dcerpc_ctx_list, 1);
1673         if (composite_nomem(pkt.u.alter.ctx_list, c)) return c;
1674         pkt.u.alter.ctx_list[0].context_id = p->context_id;
1675         pkt.u.alter.ctx_list[0].num_transfer_syntaxes = 1;
1676         pkt.u.alter.ctx_list[0].abstract_syntax = p->syntax;
1677         pkt.u.alter.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
1678         pkt.u.alter.auth_info = data_blob(NULL, 0);
1679
1680         /* construct the NDR form of the packet */
1681         c->status = ncacn_push_auth(&blob, mem_ctx, p->conn->iconv_convenience, &pkt,
1682                                     p->conn->security_state.auth_info);
1683         if (!composite_is_ok(c)) return c;
1684
1685         p->conn->transport.recv_data = dcerpc_recv_data;
1686
1687         /*
1688          * we allocate a dcerpc_request so we can be in the same
1689          * request queue as normal requests
1690          */
1691         req = talloc_zero(c, struct rpc_request);
1692         if (composite_nomem(req, c)) return c;
1693
1694         req->state = RPC_REQUEST_PENDING;
1695         req->call_id = pkt.call_id;
1696         req->async.private_data = c;
1697         req->async.callback = dcerpc_composite_fail;
1698         req->p = p;
1699         req->recv_handler = dcerpc_alter_recv_handler;
1700         DLIST_ADD_END(p->conn->pending, req, struct rpc_request *);
1701         talloc_set_destructor(req, dcerpc_req_dequeue);
1702
1703         c->status = p->conn->transport.send_request(p->conn, &blob, true);
1704         if (!composite_is_ok(c)) return c;
1705
1706         event_add_timed(c->event_ctx, req,
1707                         timeval_current_ofs(DCERPC_REQUEST_TIMEOUT, 0),
1708                         dcerpc_timeout_handler, req);
1709
1710         return c;
1711 }
1712
1713 NTSTATUS dcerpc_alter_context_recv(struct composite_context *ctx)
1714 {
1715         NTSTATUS result = composite_wait(ctx);
1716         talloc_free(ctx);
1717         return result;
1718 }
1719
1720 /* 
1721    send a dcerpc alter_context request
1722 */
1723 _PUBLIC_ NTSTATUS dcerpc_alter_context(struct dcerpc_pipe *p, 
1724                               TALLOC_CTX *mem_ctx,
1725                               const struct ndr_syntax_id *syntax,
1726                               const struct ndr_syntax_id *transfer_syntax)
1727 {
1728         struct composite_context *creq;
1729         creq = dcerpc_alter_context_send(p, mem_ctx, syntax, transfer_syntax);
1730         return dcerpc_alter_context_recv(creq);
1731 }