source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "librpc/gen_ndr/cli_epmapper.h"
  22
  23 #undef DBGC_CLASS
  24 #define DBGC_CLASS DBGC_RPC_CLI
  25
  26 /*******************************************************************
  27 interface/version dce/rpc pipe identification
  28 ********************************************************************/
  29
  30 #define PIPE_SRVSVC   "\\PIPE\\srvsvc"
  31 #define PIPE_SAMR     "\\PIPE\\samr"
  32 #define PIPE_WINREG   "\\PIPE\\winreg"
  33 #define PIPE_WKSSVC   "\\PIPE\\wkssvc"
  34 #define PIPE_NETLOGON "\\PIPE\\NETLOGON"
  35 #define PIPE_NTLSA    "\\PIPE\\ntlsa"
  36 #define PIPE_NTSVCS   "\\PIPE\\ntsvcs"
  37 #define PIPE_LSASS    "\\PIPE\\lsass"
  38 #define PIPE_LSARPC   "\\PIPE\\lsarpc"
  39 #define PIPE_SPOOLSS  "\\PIPE\\spoolss"
  40 #define PIPE_NETDFS   "\\PIPE\\netdfs"
  41 #define PIPE_ECHO     "\\PIPE\\rpcecho"
  42 #define PIPE_SHUTDOWN "\\PIPE\\initshutdown"
  43 #define PIPE_EPM      "\\PIPE\\epmapper"
  44 #define PIPE_SVCCTL   "\\PIPE\\svcctl"
  45 #define PIPE_EVENTLOG "\\PIPE\\eventlog"
  46 #define PIPE_EPMAPPER "\\PIPE\\epmapper"
  47 #define PIPE_DRSUAPI  "\\PIPE\\drsuapi"
  48
  49 /*
  50  * IMPORTANT!!  If you update this structure, make sure to
  51  * update the index #defines in smb.h.
  52  */
  53
  54 static const struct pipe_id_info {
  55         /* the names appear not to matter: the syntaxes _do_ matter */
  56
  57         const char *client_pipe;
  58         const RPC_IFACE *abstr_syntax; /* this one is the abstract syntax id */
  59 } pipe_names [] =
  60 {
  61         { PIPE_LSARPC,          &ndr_table_lsarpc.syntax_id },
  62         { PIPE_LSARPC,          &ndr_table_dssetup.syntax_id },
  63         { PIPE_SAMR,            &ndr_table_samr.syntax_id },
  64         { PIPE_NETLOGON,        &ndr_table_netlogon.syntax_id },
  65         { PIPE_SRVSVC,          &ndr_table_srvsvc.syntax_id },
  66         { PIPE_WKSSVC,          &ndr_table_wkssvc.syntax_id },
  67         { PIPE_WINREG,          &ndr_table_winreg.syntax_id },
  68         { PIPE_SPOOLSS,         &syntax_spoolss },
  69         { PIPE_NETDFS,          &ndr_table_netdfs.syntax_id },
  70         { PIPE_ECHO,            &ndr_table_rpcecho.syntax_id },
  71         { PIPE_SHUTDOWN,        &ndr_table_initshutdown.syntax_id },
  72         { PIPE_SVCCTL,          &ndr_table_svcctl.syntax_id },
  73         { PIPE_EVENTLOG,        &ndr_table_eventlog.syntax_id },
  74         { PIPE_NTSVCS,          &ndr_table_ntsvcs.syntax_id },
  75         { PIPE_EPMAPPER,        &ndr_table_epmapper.syntax_id },
  76         { PIPE_DRSUAPI,         &ndr_table_drsuapi.syntax_id },
  77         { NULL, NULL }
  78 };
  79
  80 /****************************************************************************
  81  Return the pipe name from the interface.
  82  ****************************************************************************/
  83
  84 const char *cli_get_pipe_name_from_iface(TALLOC_CTX *mem_ctx,
  85                                          const struct ndr_syntax_id *interface)
  86 {
  87         int i;
  88         for (i = 0; pipe_names[i].client_pipe; i++) {
  89                 if (ndr_syntax_id_equal(pipe_names[i].abstr_syntax,
  90                                         interface)) {
  91                         return &pipe_names[i].client_pipe[5];
  92                 }
  93         }
  94
  95         /*
  96          * Here we should ask \\epmapper, but for now our code is only
  97          * interested in the known pipes mentioned in pipe_names[]
  98          */
  99
 100         return NULL;
 101 }
 102
 103 /********************************************************************
 104  Map internal value to wire value.
 105  ********************************************************************/
 106
 107 static int map_pipe_auth_type_to_rpc_auth_type(enum pipe_auth_type auth_type)
 108 {
 109         switch (auth_type) {
 110
 111         case PIPE_AUTH_TYPE_NONE:
 112                 return RPC_ANONYMOUS_AUTH_TYPE;
 113
 114         case PIPE_AUTH_TYPE_NTLMSSP:
 115                 return RPC_NTLMSSP_AUTH_TYPE;
 116
 117         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 118         case PIPE_AUTH_TYPE_SPNEGO_KRB5:
 119                 return RPC_SPNEGO_AUTH_TYPE;
 120
 121         case PIPE_AUTH_TYPE_SCHANNEL:
 122                 return RPC_SCHANNEL_AUTH_TYPE;
 123
 124         case PIPE_AUTH_TYPE_KRB5:
 125                 return RPC_KRB5_AUTH_TYPE;
 126
 127         default:
 128                 DEBUG(0,("map_pipe_auth_type_to_rpc_type: unknown pipe "
 129                         "auth type %u\n",
 130                         (unsigned int)auth_type ));
 131                 break;
 132         }
 133         return -1;
 134 }
 135
 136 /********************************************************************
 137  Pipe description for a DEBUG
 138  ********************************************************************/
 139 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
 140                                    struct rpc_pipe_client *cli)
 141 {
 142         char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
 143         if (result == NULL) {
 144                 return "pipe";
 145         }
 146         return result;
 147 }
 148
 149 /********************************************************************
 150  Rpc pipe call id.
 151  ********************************************************************/
 152
 153 static uint32 get_rpc_call_id(void)
 154 {
 155         static uint32 call_id = 0;
 156         return ++call_id;
 157 }
 158
 159 /*
 160  * Realloc pdu to have a least "size" bytes
 161  */
 162
 163 static bool rpc_grow_buffer(prs_struct *pdu, size_t size)
 164 {
 165         size_t extra_size;
 166
 167         if (prs_data_size(pdu) >= size) {
 168                 return true;
 169         }
 170
 171         extra_size = size - prs_data_size(pdu);
 172
 173         if (!prs_force_grow(pdu, extra_size)) {
 174                 DEBUG(0, ("rpc_grow_buffer: Failed to grow parse struct by "
 175                           "%d bytes.\n", (int)extra_size));
 176                 return false;
 177         }
 178
 179         DEBUG(5, ("rpc_grow_buffer: grew buffer by %d bytes to %u\n",
 180                   (int)extra_size, prs_data_size(pdu)));
 181         return true;
 182 }
 183
 184
 185 /*******************************************************************
 186  Use SMBreadX to get rest of one fragment's worth of rpc data.
 187  Reads the whole size or give an error message
 188  ********************************************************************/
 189
 190 struct rpc_read_state {
 191         struct event_context *ev;
 192         struct rpc_cli_transport *transport;
 193         uint8_t *data;
 194         size_t size;
 195         size_t num_read;
 196 };
 197
 198 static void rpc_read_done(struct async_req *subreq);
 199
 200 static struct async_req *rpc_read_send(TALLOC_CTX *mem_ctx,
 201                                        struct event_context *ev,
 202                                        struct rpc_cli_transport *transport,
 203                                        uint8_t *data, size_t size)
 204 {
 205         struct async_req *result, *subreq;
 206         struct rpc_read_state *state;
 207
 208         if (!async_req_setup(mem_ctx, &result, &state,
 209                              struct rpc_read_state)) {
 210                 return NULL;
 211         }
 212         state->ev = ev;
 213         state->transport = transport;
 214         state->data = data;
 215         state->size = size;
 216         state->num_read = 0;
 217
 218         DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
 219
 220         subreq = transport->read_send(state, ev, (uint8_t *)data, size,
 221                                       transport->priv);
 222         if (subreq == NULL) {
 223                 goto fail;
 224         }
 225         subreq->async.fn = rpc_read_done;
 226         subreq->async.priv = result;
 227         return result;
 228
 229  fail:
 230         TALLOC_FREE(result);
 231         return NULL;
 232 }
 233
 234 static void rpc_read_done(struct async_req *subreq)
 235 {
 236         struct async_req *req = talloc_get_type_abort(
 237                 subreq->async.priv, struct async_req);
 238         struct rpc_read_state *state = talloc_get_type_abort(
 239                 req->private_data, struct rpc_read_state);
 240         NTSTATUS status;
 241         ssize_t received;
 242
 243         status = state->transport->read_recv(subreq, &received);
 244         TALLOC_FREE(subreq);
 245         if (!NT_STATUS_IS_OK(status)) {
 246                 async_req_error(req, status);
 247                 return;
 248         }
 249
 250         state->num_read += received;
 251         if (state->num_read == state->size) {
 252                 async_req_done(req);
 253                 return;
 254         }
 255
 256         subreq = state->transport->read_send(state, state->ev,
 257                                              state->data + state->num_read,
 258                                              state->size - state->num_read,
 259                                              state->transport->priv);
 260         if (async_req_nomem(subreq, req)) {
 261                 return;
 262         }
 263         subreq->async.fn = rpc_read_done;
 264         subreq->async.priv = req;
 265 }
 266
 267 static NTSTATUS rpc_read_recv(struct async_req *req)
 268 {
 269         return async_req_simple_recv(req);
 270 }
 271
 272 struct rpc_write_state {
 273         struct event_context *ev;
 274         struct rpc_cli_transport *transport;
 275         const uint8_t *data;
 276         size_t size;
 277         size_t num_written;
 278 };
 279
 280 static void rpc_write_done(struct async_req *subreq);
 281
 282 static struct async_req *rpc_write_send(TALLOC_CTX *mem_ctx,
 283                                         struct event_context *ev,
 284                                         struct rpc_cli_transport *transport,
 285                                         const uint8_t *data, size_t size)
 286 {
 287         struct async_req *result, *subreq;
 288         struct rpc_write_state *state;
 289
 290         if (!async_req_setup(mem_ctx, &result, &state,
 291                              struct rpc_write_state)) {
 292                 return NULL;
 293         }
 294         state->ev = ev;
 295         state->transport = transport;
 296         state->data = data;
 297         state->size = size;
 298         state->num_written = 0;
 299
 300         DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
 301
 302         subreq = transport->write_send(state, ev, data, size, transport->priv);
 303         if (subreq == NULL) {
 304                 goto fail;
 305         }
 306         subreq->async.fn = rpc_write_done;
 307         subreq->async.priv = result;
 308         return result;
 309  fail:
 310         TALLOC_FREE(result);
 311         return NULL;
 312 }
 313
 314 static void rpc_write_done(struct async_req *subreq)
 315 {
 316         struct async_req *req = talloc_get_type_abort(
 317                 subreq->async.priv, struct async_req);
 318         struct rpc_write_state *state = talloc_get_type_abort(
 319                 req->private_data, struct rpc_write_state);
 320         NTSTATUS status;
 321         ssize_t written;
 322
 323         status = state->transport->write_recv(subreq, &written);
 324         TALLOC_FREE(subreq);
 325         if (!NT_STATUS_IS_OK(status)) {
 326                 async_req_error(req, status);
 327                 return;
 328         }
 329
 330         state->num_written += written;
 331
 332         if (state->num_written == state->size) {
 333                 async_req_done(req);
 334                 return;
 335         }
 336
 337         subreq = state->transport->write_send(state, state->ev,
 338                                               state->data + state->num_written,
 339                                               state->size - state->num_written,
 340                                               state->transport->priv);
 341         if (async_req_nomem(subreq, req)) {
 342                 return;
 343         }
 344         subreq->async.fn = rpc_write_done;
 345         subreq->async.priv = req;
 346 }
 347
 348 static NTSTATUS rpc_write_recv(struct async_req *req)
 349 {
 350         return async_req_simple_recv(req);
 351 }
 352
 353
 354 static NTSTATUS parse_rpc_header(struct rpc_pipe_client *cli,
 355                                  struct rpc_hdr_info *prhdr,
 356                                  prs_struct *pdu)
 357 {
 358         /*
 359          * This next call sets the endian bit correctly in current_pdu. We
 360          * will propagate this to rbuf later.
 361          */
 362
 363         if(!smb_io_rpc_hdr("rpc_hdr   ", prhdr, pdu, 0)) {
 364                 DEBUG(0, ("get_current_pdu: Failed to unmarshall RPC_HDR.\n"));
 365                 return NT_STATUS_BUFFER_TOO_SMALL;
 366         }
 367
 368         if (prhdr->frag_len > cli->max_recv_frag) {
 369                 DEBUG(0, ("cli_pipe_get_current_pdu: Server sent fraglen %d,"
 370                           " we only allow %d\n", (int)prhdr->frag_len,
 371                           (int)cli->max_recv_frag));
 372                 return NT_STATUS_BUFFER_TOO_SMALL;
 373         }
 374
 375         return NT_STATUS_OK;
 376 }
 377
 378 /****************************************************************************
 379  Try and get a PDU's worth of data from current_pdu. If not, then read more
 380  from the wire.
 381  ****************************************************************************/
 382
 383 struct get_complete_frag_state {
 384         struct event_context *ev;
 385         struct rpc_pipe_client *cli;
 386         struct rpc_hdr_info *prhdr;
 387         prs_struct *pdu;
 388 };
 389
 390 static void get_complete_frag_got_header(struct async_req *subreq);
 391 static void get_complete_frag_got_rest(struct async_req *subreq);
 392
 393 static struct async_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
 394                                                struct event_context *ev,
 395                                                struct rpc_pipe_client *cli,
 396                                                struct rpc_hdr_info *prhdr,
 397                                                prs_struct *pdu)
 398 {
 399         struct async_req *result, *subreq;
 400         struct get_complete_frag_state *state;
 401         uint32_t pdu_len;
 402         NTSTATUS status;
 403
 404         if (!async_req_setup(mem_ctx, &result, &state,
 405                              struct get_complete_frag_state)) {
 406                 return NULL;
 407         }
 408         state->ev = ev;
 409         state->cli = cli;
 410         state->prhdr = prhdr;
 411         state->pdu = pdu;
 412
 413         pdu_len = prs_data_size(pdu);
 414         if (pdu_len < RPC_HEADER_LEN) {
 415                 if (!rpc_grow_buffer(pdu, RPC_HEADER_LEN)) {
 416                         status = NT_STATUS_NO_MEMORY;
 417                         goto post_status;
 418                 }
 419                 subreq = rpc_read_send(
 420                         state, state->ev,
 421                         state->cli->transport,
 422                         (uint8_t *)(prs_data_p(state->pdu) + pdu_len),
 423                         RPC_HEADER_LEN - pdu_len);
 424                 if (subreq == NULL) {
 425                         status = NT_STATUS_NO_MEMORY;
 426                         goto post_status;
 427                 }
 428                 subreq->async.fn = get_complete_frag_got_header;
 429                 subreq->async.priv = result;
 430                 return result;
 431         }
 432
 433         status = parse_rpc_header(cli, prhdr, pdu);
 434         if (!NT_STATUS_IS_OK(status)) {
 435                 goto post_status;
 436         }
 437
 438         /*
 439          * Ensure we have frag_len bytes of data.
 440          */
 441         if (pdu_len < prhdr->frag_len) {
 442                 if (!rpc_grow_buffer(pdu, prhdr->frag_len)) {
 443                         status = NT_STATUS_NO_MEMORY;
 444                         goto post_status;
 445                 }
 446                 subreq = rpc_read_send(state, state->ev,
 447                                        state->cli->transport,
 448                                        (uint8_t *)(prs_data_p(pdu) + pdu_len),
 449                                        prhdr->frag_len - pdu_len);
 450                 if (subreq == NULL) {
 451                         status = NT_STATUS_NO_MEMORY;
 452                         goto post_status;
 453                 }
 454                 subreq->async.fn = get_complete_frag_got_rest;
 455                 subreq->async.priv = result;
 456                 return result;
 457         }
 458
 459         status = NT_STATUS_OK;
 460  post_status:
 461         if (async_post_status(result, ev, status)) {
 462                 return result;
 463         }
 464         TALLOC_FREE(result);
 465         return NULL;
 466 }
 467
 468 static void get_complete_frag_got_header(struct async_req *subreq)
 469 {
 470         struct async_req *req = talloc_get_type_abort(
 471                 subreq->async.priv, struct async_req);
 472         struct get_complete_frag_state *state = talloc_get_type_abort(
 473                 req->private_data, struct get_complete_frag_state);
 474         NTSTATUS status;
 475
 476         status = rpc_read_recv(subreq);
 477         TALLOC_FREE(subreq);
 478         if (!NT_STATUS_IS_OK(status)) {
 479                 async_req_error(req, status);
 480                 return;
 481         }
 482
 483         status = parse_rpc_header(state->cli, state->prhdr, state->pdu);
 484         if (!NT_STATUS_IS_OK(status)) {
 485                 async_req_error(req, status);
 486                 return;
 487         }
 488
 489         if (!rpc_grow_buffer(state->pdu, state->prhdr->frag_len)) {
 490                 async_req_error(req, NT_STATUS_NO_MEMORY);
 491                 return;
 492         }
 493
 494         /*
 495          * We're here in this piece of code because we've read exactly
 496          * RPC_HEADER_LEN bytes into state->pdu.
 497          */
 498
 499         subreq = rpc_read_send(
 500                 state, state->ev, state->cli->transport,
 501                 (uint8_t *)(prs_data_p(state->pdu) + RPC_HEADER_LEN),
 502                 state->prhdr->frag_len - RPC_HEADER_LEN);
 503         if (async_req_nomem(subreq, req)) {
 504                 return;
 505         }
 506         subreq->async.fn = get_complete_frag_got_rest;
 507         subreq->async.priv = req;
 508 }
 509
 510 static void get_complete_frag_got_rest(struct async_req *subreq)
 511 {
 512         struct async_req *req = talloc_get_type_abort(
 513                 subreq->async.priv, struct async_req);
 514         NTSTATUS status;
 515
 516         status = rpc_read_recv(subreq);
 517         TALLOC_FREE(subreq);
 518         if (!NT_STATUS_IS_OK(status)) {
 519                 async_req_error(req, status);
 520                 return;
 521         }
 522         async_req_done(req);
 523 }
 524
 525 static NTSTATUS get_complete_frag_recv(struct async_req *req)
 526 {
 527         return async_req_simple_recv(req);
 528 }
 529
 530 /****************************************************************************
 531  NTLMSSP specific sign/seal.
 532  Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
 533  In fact I should probably abstract these into identical pieces of code... JRA.
 534  ****************************************************************************/
 535
 536 static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 537                                 prs_struct *current_pdu,
 538                                 uint8 *p_ss_padding_len)
 539 {
 540         RPC_HDR_AUTH auth_info;
 541         uint32 save_offset = prs_offset(current_pdu);
 542         uint32 auth_len = prhdr->auth_len;
 543         NTLMSSP_STATE *ntlmssp_state = cli->auth->a_u.ntlmssp_state;
 544         unsigned char *data = NULL;
 545         size_t data_len;
 546         unsigned char *full_packet_data = NULL;
 547         size_t full_packet_data_len;
 548         DATA_BLOB auth_blob;
 549         NTSTATUS status;
 550
 551         if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
 552             || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
 553                 return NT_STATUS_OK;
 554         }
 555
 556         if (!ntlmssp_state) {
 557                 return NT_STATUS_INVALID_PARAMETER;
 558         }
 559
 560         /* Ensure there's enough data for an authenticated response. */
 561         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
 562                         (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
 563                 DEBUG(0,("cli_pipe_verify_ntlmssp: auth_len %u is too large.\n",
 564                         (unsigned int)auth_len ));
 565                 return NT_STATUS_BUFFER_TOO_SMALL;
 566         }
 567
 568         /*
 569          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
 570          * after the RPC header.
 571          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
 572          * functions as NTLMv2 checks the rpc headers also.
 573          */
 574
 575         data = (unsigned char *)(prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN);
 576         data_len = (size_t)(prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len);
 577
 578         full_packet_data = (unsigned char *)prs_data_p(current_pdu);
 579         full_packet_data_len = prhdr->frag_len - auth_len;
 580
 581         /* Pull the auth header and the following data into a blob. */
 582         if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
 583                 DEBUG(0,("cli_pipe_verify_ntlmssp: cannot move offset to %u.\n",
 584                         (unsigned int)RPC_HEADER_LEN + (unsigned int)RPC_HDR_RESP_LEN + (unsigned int)data_len ));
 585                 return NT_STATUS_BUFFER_TOO_SMALL;
 586         }
 587
 588         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
 589                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall RPC_HDR_AUTH.\n"));
 590                 return NT_STATUS_BUFFER_TOO_SMALL;
 591         }
 592
 593         auth_blob.data = (unsigned char *)prs_data_p(current_pdu) + prs_offset(current_pdu);
 594         auth_blob.length = auth_len;
 595
 596         switch (cli->auth->auth_level) {
 597                 case PIPE_AUTH_LEVEL_PRIVACY:
 598                         /* Data is encrypted. */
 599                         status = ntlmssp_unseal_packet(ntlmssp_state,
 600                                                         data, data_len,
 601                                                         full_packet_data,
 602                                                         full_packet_data_len,
 603                                                         &auth_blob);
 604                         if (!NT_STATUS_IS_OK(status)) {
 605                                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unseal "
 606                                         "packet from %s. Error was %s.\n",
 607                                         rpccli_pipe_txt(debug_ctx(), cli),
 608                                         nt_errstr(status) ));
 609                                 return status;
 610                         }
 611                         break;
 612                 case PIPE_AUTH_LEVEL_INTEGRITY:
 613                         /* Data is signed. */
 614                         status = ntlmssp_check_packet(ntlmssp_state,
 615                                                         data, data_len,
 616                                                         full_packet_data,
 617                                                         full_packet_data_len,
 618                                                         &auth_blob);
 619                         if (!NT_STATUS_IS_OK(status)) {
 620                                 DEBUG(0,("cli_pipe_verify_ntlmssp: check signing failed on "
 621                                         "packet from %s. Error was %s.\n",
 622                                         rpccli_pipe_txt(debug_ctx(), cli),
 623                                         nt_errstr(status) ));
 624                                 return status;
 625                         }
 626                         break;
 627                 default:
 628                         DEBUG(0, ("cli_pipe_verify_ntlmssp: unknown internal "
 629                                   "auth level %d\n", cli->auth->auth_level));
 630                         return NT_STATUS_INVALID_INFO_CLASS;
 631         }
 632
 633         /*
 634          * Return the current pointer to the data offset.
 635          */
 636
 637         if(!prs_set_offset(current_pdu, save_offset)) {
 638                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
 639                         (unsigned int)save_offset ));
 640                 return NT_STATUS_BUFFER_TOO_SMALL;
 641         }
 642
 643         /*
 644          * Remember the padding length. We must remove it from the real data
 645          * stream once the sign/seal is done.
 646          */
 647
 648         *p_ss_padding_len = auth_info.auth_pad_len;
 649
 650         return NT_STATUS_OK;
 651 }
 652
 653 /****************************************************************************
 654  schannel specific sign/seal.
 655  ****************************************************************************/
 656
 657 static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 658                                 prs_struct *current_pdu,
 659                                 uint8 *p_ss_padding_len)
 660 {
 661         RPC_HDR_AUTH auth_info;
 662         RPC_AUTH_SCHANNEL_CHK schannel_chk;
 663         uint32 auth_len = prhdr->auth_len;
 664         uint32 save_offset = prs_offset(current_pdu);
 665         struct schannel_auth_struct *schannel_auth =
 666                 cli->auth->a_u.schannel_auth;
 667         uint32 data_len;
 668
 669         if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
 670             || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
 671                 return NT_STATUS_OK;
 672         }
 673
 674         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
 675                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u.\n", (unsigned int)auth_len ));
 676                 return NT_STATUS_INVALID_PARAMETER;
 677         }
 678
 679         if (!schannel_auth) {
 680                 return NT_STATUS_INVALID_PARAMETER;
 681         }
 682
 683         /* Ensure there's enough data for an authenticated response. */
 684         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
 685                         (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
 686                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u is too large.\n",
 687                         (unsigned int)auth_len ));
 688                 return NT_STATUS_INVALID_PARAMETER;
 689         }
 690
 691         data_len = prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 692
 693         if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
 694                 DEBUG(0,("cli_pipe_verify_schannel: cannot move offset to %u.\n",
 695                         (unsigned int)RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len ));
 696                 return NT_STATUS_BUFFER_TOO_SMALL;
 697         }
 698
 699         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
 700                 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshall RPC_HDR_AUTH.\n"));
 701                 return NT_STATUS_BUFFER_TOO_SMALL;
 702         }
 703
 704         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
 705                 DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n",
 706                         auth_info.auth_type));
 707                 return NT_STATUS_BUFFER_TOO_SMALL;
 708         }
 709
 710         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 711                                 &schannel_chk, current_pdu, 0)) {
 712                 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
 713                 return NT_STATUS_BUFFER_TOO_SMALL;
 714         }
 715
 716         if (!schannel_decode(schannel_auth,
 717                         cli->auth->auth_level,
 718                         SENDER_IS_ACCEPTOR,
 719                         &schannel_chk,
 720                         prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN,
 721                         data_len)) {
 722                 DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
 723                                 "Connection to %s.\n",
 724                                 rpccli_pipe_txt(debug_ctx(), cli)));
 725                 return NT_STATUS_INVALID_PARAMETER;
 726         }
 727
 728         /* The sequence number gets incremented on both send and receive. */
 729         schannel_auth->seq_num++;
 730
 731         /*
 732          * Return the current pointer to the data offset.
 733          */
 734
 735         if(!prs_set_offset(current_pdu, save_offset)) {
 736                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
 737                         (unsigned int)save_offset ));
 738                 return NT_STATUS_BUFFER_TOO_SMALL;
 739         }
 740
 741         /*
 742          * Remember the padding length. We must remove it from the real data
 743          * stream once the sign/seal is done.
 744          */
 745
 746         *p_ss_padding_len = auth_info.auth_pad_len;
 747
 748         return NT_STATUS_OK;
 749 }
 750
 751 /****************************************************************************
 752  Do the authentication checks on an incoming pdu. Check sign and unseal etc.
 753  ****************************************************************************/
 754
 755 static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 756                                 prs_struct *current_pdu,
 757                                 uint8 *p_ss_padding_len)
 758 {
 759         NTSTATUS ret = NT_STATUS_OK;
 760
 761         /* Paranioa checks for auth_len. */
 762         if (prhdr->auth_len) {
 763                 if (prhdr->auth_len > prhdr->frag_len) {
 764                         return NT_STATUS_INVALID_PARAMETER;
 765                 }
 766
 767                 if (prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < prhdr->auth_len ||
 768                                 prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < (unsigned int)RPC_HDR_AUTH_LEN) {
 769                         /* Integer wrap attempt. */
 770                         return NT_STATUS_INVALID_PARAMETER;
 771                 }
 772         }
 773
 774         /*
 775          * Now we have a complete RPC request PDU fragment, try and verify any auth data.
 776          */
 777
 778         switch(cli->auth->auth_type) {
 779                 case PIPE_AUTH_TYPE_NONE:
 780                         if (prhdr->auth_len) {
 781                                 DEBUG(3, ("cli_pipe_validate_rpc_response: "
 782                                           "Connection to %s - got non-zero "
 783                                           "auth len %u.\n",
 784                                         rpccli_pipe_txt(debug_ctx(), cli),
 785                                         (unsigned int)prhdr->auth_len ));
 786                                 return NT_STATUS_INVALID_PARAMETER;
 787                         }
 788                         break;
 789
 790                 case PIPE_AUTH_TYPE_NTLMSSP:
 791                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 792                         ret = cli_pipe_verify_ntlmssp(cli, prhdr, current_pdu, p_ss_padding_len);
 793                         if (!NT_STATUS_IS_OK(ret)) {
 794                                 return ret;
 795                         }
 796                         break;
 797
 798                 case PIPE_AUTH_TYPE_SCHANNEL:
 799                         ret = cli_pipe_verify_schannel(cli, prhdr, current_pdu, p_ss_padding_len);
 800                         if (!NT_STATUS_IS_OK(ret)) {
 801                                 return ret;
 802                         }
 803                         break;
 804
 805                 case PIPE_AUTH_TYPE_KRB5:
 806                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
 807                 default:
 808                         DEBUG(3, ("cli_pipe_validate_rpc_response: Connection "
 809                                   "to %s - unknown internal auth type %u.\n",
 810                                   rpccli_pipe_txt(debug_ctx(), cli),
 811                                   cli->auth->auth_type ));
 812                         return NT_STATUS_INVALID_INFO_CLASS;
 813         }
 814
 815         return NT_STATUS_OK;
 816 }
 817
 818 /****************************************************************************
 819  Do basic authentication checks on an incoming pdu.
 820  ****************************************************************************/
 821
 822 static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 823                         prs_struct *current_pdu,
 824                         uint8 expected_pkt_type,
 825                         char **ppdata,
 826                         uint32 *pdata_len,
 827                         prs_struct *return_data)
 828 {
 829
 830         NTSTATUS ret = NT_STATUS_OK;
 831         uint32 current_pdu_len = prs_data_size(current_pdu);
 832
 833         if (current_pdu_len != prhdr->frag_len) {
 834                 DEBUG(5,("cli_pipe_validate_current_pdu: incorrect pdu length %u, expected %u\n",
 835                         (unsigned int)current_pdu_len, (unsigned int)prhdr->frag_len ));
 836                 return NT_STATUS_INVALID_PARAMETER;
 837         }
 838
 839         /*
 840          * Point the return values at the real data including the RPC
 841          * header. Just in case the caller wants it.
 842          */
 843         *ppdata = prs_data_p(current_pdu);
 844         *pdata_len = current_pdu_len;
 845
 846         /* Ensure we have the correct type. */
 847         switch (prhdr->pkt_type) {
 848                 case RPC_ALTCONTRESP:
 849                 case RPC_BINDACK:
 850
 851                         /* Alter context and bind ack share the same packet definitions. */
 852                         break;
 853
 854
 855                 case RPC_RESPONSE:
 856                 {
 857                         RPC_HDR_RESP rhdr_resp;
 858                         uint8 ss_padding_len = 0;
 859
 860                         if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
 861                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
 862                                 return NT_STATUS_BUFFER_TOO_SMALL;
 863                         }
 864
 865                         /* Here's where we deal with incoming sign/seal. */
 866                         ret = cli_pipe_validate_rpc_response(cli, prhdr,
 867                                         current_pdu, &ss_padding_len);
 868                         if (!NT_STATUS_IS_OK(ret)) {
 869                                 return ret;
 870                         }
 871
 872                         /* Point the return values at the NDR data. Remember to remove any ss padding. */
 873                         *ppdata = prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
 874
 875                         if (current_pdu_len < RPC_HEADER_LEN + RPC_HDR_RESP_LEN + ss_padding_len) {
 876                                 return NT_STATUS_BUFFER_TOO_SMALL;
 877                         }
 878
 879                         *pdata_len = current_pdu_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - ss_padding_len;
 880
 881                         /* Remember to remove the auth footer. */
 882                         if (prhdr->auth_len) {
 883                                 /* We've already done integer wrap tests on auth_len in
 884                                         cli_pipe_validate_rpc_response(). */
 885                                 if (*pdata_len < RPC_HDR_AUTH_LEN + prhdr->auth_len) {
 886                                         return NT_STATUS_BUFFER_TOO_SMALL;
 887                                 }
 888                                 *pdata_len -= (RPC_HDR_AUTH_LEN + prhdr->auth_len);
 889                         }
 890
 891                         DEBUG(10,("cli_pipe_validate_current_pdu: got pdu len %u, data_len %u, ss_len %u\n",
 892                                 current_pdu_len, *pdata_len, ss_padding_len ));
 893
 894                         /*
 895                          * If this is the first reply, and the allocation hint is reasonably, try and
 896                          * set up the return_data parse_struct to the correct size.
 897                          */
 898
 899                         if ((prs_data_size(return_data) == 0) && rhdr_resp.alloc_hint && (rhdr_resp.alloc_hint < 15*1024*1024)) {
 900                                 if (!prs_set_buffer_size(return_data, rhdr_resp.alloc_hint)) {
 901                                         DEBUG(0,("cli_pipe_validate_current_pdu: reply alloc hint %u "
 902                                                 "too large to allocate\n",
 903                                                 (unsigned int)rhdr_resp.alloc_hint ));
 904                                         return NT_STATUS_NO_MEMORY;
 905                                 }
 906                         }
 907
 908                         break;
 909                 }
 910
 911                 case RPC_BINDNACK:
 912                         DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
 913                                   "received from %s!\n",
 914                                   rpccli_pipe_txt(debug_ctx(), cli)));
 915                         /* Use this for now... */
 916                         return NT_STATUS_NETWORK_ACCESS_DENIED;
 917
 918                 case RPC_FAULT:
 919                 {
 920                         RPC_HDR_RESP rhdr_resp;
 921                         RPC_HDR_FAULT fault_resp;
 922
 923                         if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
 924                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
 925                                 return NT_STATUS_BUFFER_TOO_SMALL;
 926                         }
 927
 928                         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, current_pdu, 0)) {
 929                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_FAULT.\n"));
 930                                 return NT_STATUS_BUFFER_TOO_SMALL;
 931                         }
 932
 933                         DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
 934                                   "code %s received from %s!\n",
 935                                 dcerpc_errstr(debug_ctx(), NT_STATUS_V(fault_resp.status)),
 936                                 rpccli_pipe_txt(debug_ctx(), cli)));
 937                         if (NT_STATUS_IS_OK(fault_resp.status)) {
 938                                 return NT_STATUS_UNSUCCESSFUL;
 939                         } else {
 940                                 return fault_resp.status;
 941                         }
 942                 }
 943
 944                 default:
 945                         DEBUG(0, ("cli_pipe_validate_current_pdu: unknown packet type %u received "
 946                                 "from %s!\n",
 947                                 (unsigned int)prhdr->pkt_type,
 948                                 rpccli_pipe_txt(debug_ctx(), cli)));
 949                         return NT_STATUS_INVALID_INFO_CLASS;
 950         }
 951
 952         if (prhdr->pkt_type != expected_pkt_type) {
 953                 DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
 954                           "got an unexpected RPC packet type - %u, not %u\n",
 955                         rpccli_pipe_txt(debug_ctx(), cli),
 956                         prhdr->pkt_type,
 957                         expected_pkt_type));
 958                 return NT_STATUS_INVALID_INFO_CLASS;
 959         }
 960
 961         /* Do this just before return - we don't want to modify any rpc header
 962            data before now as we may have needed to do cryptographic actions on
 963            it before. */
 964
 965         if ((prhdr->pkt_type == RPC_BINDACK) && !(prhdr->flags & RPC_FLG_LAST)) {
 966                 DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
 967                         "setting fragment first/last ON.\n"));
 968                 prhdr->flags |= RPC_FLG_FIRST|RPC_FLG_LAST;
 969         }
 970
 971         return NT_STATUS_OK;
 972 }
 973
 974 /****************************************************************************
 975  Ensure we eat the just processed pdu from the current_pdu prs_struct.
 976  Normally the frag_len and buffer size will match, but on the first trans
 977  reply there is a theoretical chance that buffer size > frag_len, so we must
 978  deal with that.
 979  ****************************************************************************/
 980
 981 static NTSTATUS cli_pipe_reset_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr, prs_struct *current_pdu)
 982 {
 983         uint32 current_pdu_len = prs_data_size(current_pdu);
 984
 985         if (current_pdu_len < prhdr->frag_len) {
 986                 return NT_STATUS_BUFFER_TOO_SMALL;
 987         }
 988
 989         /* Common case. */
 990         if (current_pdu_len == (uint32)prhdr->frag_len) {
 991                 prs_mem_free(current_pdu);
 992                 prs_init_empty(current_pdu, prs_get_mem_context(current_pdu), UNMARSHALL);
 993                 /* Make current_pdu dynamic with no memory. */
 994                 prs_give_memory(current_pdu, 0, 0, True);
 995                 return NT_STATUS_OK;
 996         }
 997
 998         /*
 999          * Oh no ! More data in buffer than we processed in current pdu.
1000          * Cheat. Move the data down and shrink the buffer.
1001          */
1002
1003         memcpy(prs_data_p(current_pdu), prs_data_p(current_pdu) + prhdr->frag_len,
1004                         current_pdu_len - prhdr->frag_len);
1005
1006         /* Remember to set the read offset back to zero. */
1007         prs_set_offset(current_pdu, 0);
1008
1009         /* Shrink the buffer. */
1010         if (!prs_set_buffer_size(current_pdu, current_pdu_len - prhdr->frag_len)) {
1011                 return NT_STATUS_BUFFER_TOO_SMALL;
1012         }
1013
1014         return NT_STATUS_OK;
1015 }
1016
1017 /****************************************************************************
1018  Call a remote api on an arbitrary pipe.  takes param, data and setup buffers.
1019 ****************************************************************************/
1020
1021 struct cli_api_pipe_state {
1022         struct event_context *ev;
1023         struct rpc_cli_transport *transport;
1024         uint8_t *rdata;
1025         uint32_t rdata_len;
1026 };
1027
1028 static void cli_api_pipe_trans_done(struct async_req *subreq);
1029 static void cli_api_pipe_write_done(struct async_req *subreq);
1030 static void cli_api_pipe_read_done(struct async_req *subreq);
1031
1032 static struct async_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
1033                                            struct event_context *ev,
1034                                            struct rpc_cli_transport *transport,
1035                                            uint8_t *data, size_t data_len,
1036                                            uint32_t max_rdata_len)
1037 {
1038         struct async_req *result, *subreq;
1039         struct cli_api_pipe_state *state;
1040         NTSTATUS status;
1041
1042         if (!async_req_setup(mem_ctx, &result, &state,
1043                              struct cli_api_pipe_state)) {
1044                 return NULL;
1045         }
1046         state->ev = ev;
1047         state->transport = transport;
1048
1049         if (max_rdata_len < RPC_HEADER_LEN) {
1050                 /*
1051                  * For a RPC reply we always need at least RPC_HEADER_LEN
1052                  * bytes. We check this here because we will receive
1053                  * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
1054                  */
1055                 status = NT_STATUS_INVALID_PARAMETER;
1056                 goto post_status;
1057         }
1058
1059         if (transport->trans_send != NULL) {
1060                 subreq = transport->trans_send(state, ev, data, data_len,
1061                                                max_rdata_len, transport->priv);
1062                 if (subreq == NULL) {
1063                         status = NT_STATUS_NO_MEMORY;
1064                         goto post_status;
1065                 }
1066                 subreq->async.fn = cli_api_pipe_trans_done;
1067                 subreq->async.priv = result;
1068                 return result;
1069         }
1070
1071         /*
1072          * If the transport does not provide a "trans" routine, i.e. for
1073          * example the ncacn_ip_tcp transport, do the write/read step here.
1074          */
1075
1076         subreq = rpc_write_send(state, ev, transport, data, data_len);
1077         if (subreq == NULL) {
1078                 goto fail;
1079         }
1080         subreq->async.fn = cli_api_pipe_write_done;
1081         subreq->async.priv = result;
1082         return result;
1083
1084         status = NT_STATUS_INVALID_PARAMETER;
1085
1086  post_status:
1087         if (async_post_status(result, ev, status)) {
1088                 return result;
1089         }
1090  fail:
1091         TALLOC_FREE(result);
1092         return NULL;
1093 }
1094
1095 static void cli_api_pipe_trans_done(struct async_req *subreq)
1096 {
1097         struct async_req *req = talloc_get_type_abort(
1098                 subreq->async.priv, struct async_req);
1099         struct cli_api_pipe_state *state = talloc_get_type_abort(
1100                 req->private_data, struct cli_api_pipe_state);
1101         NTSTATUS status;
1102
1103         status = state->transport->trans_recv(subreq, state, &state->rdata,
1104                                               &state->rdata_len);
1105         TALLOC_FREE(subreq);
1106         if (!NT_STATUS_IS_OK(status)) {
1107                 async_req_error(req, status);
1108                 return;
1109         }
1110         async_req_done(req);
1111 }
1112
1113 static void cli_api_pipe_write_done(struct async_req *subreq)
1114 {
1115         struct async_req *req = talloc_get_type_abort(
1116                 subreq->async.priv, struct async_req);
1117         struct cli_api_pipe_state *state = talloc_get_type_abort(
1118                 req->private_data, struct cli_api_pipe_state);
1119         NTSTATUS status;
1120
1121         status = rpc_write_recv(subreq);
1122         TALLOC_FREE(subreq);
1123         if (!NT_STATUS_IS_OK(status)) {
1124                 async_req_error(req, status);
1125                 return;
1126         }
1127
1128         state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
1129         if (async_req_nomem(state->rdata, req)) {
1130                 return;
1131         }
1132
1133         /*
1134          * We don't need to use rpc_read_send here, the upper layer will cope
1135          * with a short read, transport->trans_send could also return less
1136          * than state->max_rdata_len.
1137          */
1138         subreq = state->transport->read_send(state, state->ev, state->rdata,
1139                                              RPC_HEADER_LEN,
1140                                              state->transport->priv);
1141         if (async_req_nomem(subreq, req)) {
1142                 return;
1143         }
1144         subreq->async.fn = cli_api_pipe_read_done;
1145         subreq->async.priv = req;
1146 }
1147
1148 static void cli_api_pipe_read_done(struct async_req *subreq)
1149 {
1150         struct async_req *req = talloc_get_type_abort(
1151                 subreq->async.priv, struct async_req);
1152         struct cli_api_pipe_state *state = talloc_get_type_abort(
1153                 req->private_data, struct cli_api_pipe_state);
1154         NTSTATUS status;
1155         ssize_t received;
1156
1157         status = state->transport->read_recv(subreq, &received);
1158         TALLOC_FREE(subreq);
1159         if (!NT_STATUS_IS_OK(status)) {
1160                 async_req_error(req, status);
1161                 return;
1162         }
1163         state->rdata_len = received;
1164         async_req_done(req);
1165 }
1166
1167 static NTSTATUS cli_api_pipe_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
1168                                   uint8_t **prdata, uint32_t *prdata_len)
1169 {
1170         struct cli_api_pipe_state *state = talloc_get_type_abort(
1171                 req->private_data, struct cli_api_pipe_state);
1172         NTSTATUS status;
1173
1174         if (async_req_is_error(req, &status)) {
1175                 return status;
1176         }
1177
1178         *prdata = talloc_move(mem_ctx, &state->rdata);
1179         *prdata_len = state->rdata_len;
1180         return NT_STATUS_OK;
1181 }
1182
1183 /****************************************************************************
1184  Send data on an rpc pipe via trans. The prs_struct data must be the last
1185  pdu fragment of an NDR data stream.
1186
1187  Receive response data from an rpc pipe, which may be large...
1188
1189  Read the first fragment: unfortunately have to use SMBtrans for the first
1190  bit, then SMBreadX for subsequent bits.
1191
1192  If first fragment received also wasn't the last fragment, continue
1193  getting fragments until we _do_ receive the last fragment.
1194
1195  Request/Response PDU's look like the following...
1196
1197  |<------------------PDU len----------------------------------------------->|
1198  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
1199
1200  +------------+-----------------+-------------+---------------+-------------+
1201  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
1202  +------------+-----------------+-------------+---------------+-------------+
1203
1204  Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
1205  signing & sealing being negotiated.
1206
1207  ****************************************************************************/
1208
1209 struct rpc_api_pipe_state {
1210         struct event_context *ev;
1211         struct rpc_pipe_client *cli;
1212         uint8_t expected_pkt_type;
1213
1214         prs_struct incoming_frag;
1215         struct rpc_hdr_info rhdr;
1216
1217         prs_struct incoming_pdu;        /* Incoming reply */
1218         uint32_t incoming_pdu_offset;
1219 };
1220
1221 static int rpc_api_pipe_state_destructor(struct rpc_api_pipe_state *state)
1222 {
1223         prs_mem_free(&state->incoming_frag);
1224         prs_mem_free(&state->incoming_pdu);
1225         return 0;
1226 }
1227
1228 static void rpc_api_pipe_trans_done(struct async_req *subreq);
1229 static void rpc_api_pipe_got_pdu(struct async_req *subreq);
1230
1231 static struct async_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
1232                                            struct event_context *ev,
1233                                            struct rpc_pipe_client *cli,
1234                                            prs_struct *data, /* Outgoing PDU */
1235                                            uint8_t expected_pkt_type)
1236 {
1237         struct async_req *result, *subreq;
1238         struct rpc_api_pipe_state *state;
1239         uint16_t max_recv_frag;
1240         NTSTATUS status;
1241
1242         if (!async_req_setup(mem_ctx, &result, &state,
1243                              struct rpc_api_pipe_state)) {
1244                 return NULL;
1245         }
1246         state->ev = ev;
1247         state->cli = cli;
1248         state->expected_pkt_type = expected_pkt_type;
1249         state->incoming_pdu_offset = 0;
1250
1251         prs_init_empty(&state->incoming_frag, state, UNMARSHALL);
1252
1253         prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1254         /* Make incoming_pdu dynamic with no memory. */
1255         prs_give_memory(&state->incoming_pdu, 0, 0, true);
1256
1257         talloc_set_destructor(state, rpc_api_pipe_state_destructor);
1258
1259         /*
1260          * Ensure we're not sending too much.
1261          */
1262         if (prs_offset(data) > cli->max_xmit_frag) {
1263                 status = NT_STATUS_INVALID_PARAMETER;
1264                 goto post_status;
1265         }
1266
1267         DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(debug_ctx(), cli)));
1268
1269         max_recv_frag = cli->max_recv_frag;
1270
1271 #ifdef DEVELOPER
1272         max_recv_frag = RPC_HEADER_LEN + 10 + (sys_random() % 32);
1273 #endif
1274
1275         subreq = cli_api_pipe_send(state, ev, cli->transport,
1276                                    (uint8_t *)prs_data_p(data),
1277                                    prs_offset(data), max_recv_frag);
1278         if (subreq == NULL) {
1279                 status = NT_STATUS_NO_MEMORY;
1280                 goto post_status;
1281         }
1282         subreq->async.fn = rpc_api_pipe_trans_done;
1283         subreq->async.priv = result;
1284         return result;
1285
1286  post_status:
1287         if (async_post_status(result, ev, status)) {
1288                 return result;
1289         }
1290         TALLOC_FREE(result);
1291         return NULL;
1292 }
1293
1294 static void rpc_api_pipe_trans_done(struct async_req *subreq)
1295 {
1296         struct async_req *req = talloc_get_type_abort(
1297                 subreq->async.priv, struct async_req);
1298         struct rpc_api_pipe_state *state = talloc_get_type_abort(
1299                 req->private_data, struct rpc_api_pipe_state);
1300         NTSTATUS status;
1301         uint8_t *rdata = NULL;
1302         uint32_t rdata_len = 0;
1303         char *rdata_copy;
1304
1305         status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
1306         TALLOC_FREE(subreq);
1307         if (!NT_STATUS_IS_OK(status)) {
1308                 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
1309                 async_req_error(req, status);
1310                 return;
1311         }
1312
1313         if (rdata == NULL) {
1314                 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
1315                          rpccli_pipe_txt(debug_ctx(), state->cli)));
1316                 async_req_done(req);
1317                 return;
1318         }
1319
1320         /*
1321          * Give the memory received from cli_trans as dynamic to the current
1322          * pdu. Duplicating it sucks, but prs_struct doesn't know about talloc
1323          * :-(
1324          */
1325         rdata_copy = (char *)memdup(rdata, rdata_len);
1326         TALLOC_FREE(rdata);
1327         if (async_req_nomem(rdata_copy, req)) {
1328                 return;
1329         }
1330         prs_give_memory(&state->incoming_frag, rdata_copy, rdata_len, true);
1331
1332         /* Ensure we have enough data for a pdu. */
1333         subreq = get_complete_frag_send(state, state->ev, state->cli,
1334                                         &state->rhdr, &state->incoming_frag);
1335         if (async_req_nomem(subreq, req)) {
1336                 return;
1337         }
1338         subreq->async.fn = rpc_api_pipe_got_pdu;
1339         subreq->async.priv = req;
1340 }
1341
1342 static void rpc_api_pipe_got_pdu(struct async_req *subreq)
1343 {
1344         struct async_req *req = talloc_get_type_abort(
1345                 subreq->async.priv, struct async_req);
1346         struct rpc_api_pipe_state *state = talloc_get_type_abort(
1347                 req->private_data, struct rpc_api_pipe_state);
1348         NTSTATUS status;
1349         char *rdata = NULL;
1350         uint32_t rdata_len = 0;
1351
1352         status = get_complete_frag_recv(subreq);
1353         TALLOC_FREE(subreq);
1354         if (!NT_STATUS_IS_OK(status)) {
1355                 DEBUG(5, ("get_complete_frag failed: %s\n",
1356                           nt_errstr(status)));
1357                 async_req_error(req, status);
1358                 return;
1359         }
1360
1361         status = cli_pipe_validate_current_pdu(
1362                 state->cli, &state->rhdr, &state->incoming_frag,
1363                 state->expected_pkt_type, &rdata, &rdata_len,
1364                 &state->incoming_pdu);
1365
1366         DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
1367                   (unsigned)prs_data_size(&state->incoming_frag),
1368                   (unsigned)state->incoming_pdu_offset,
1369                   nt_errstr(status)));
1370
1371         if (!NT_STATUS_IS_OK(status)) {
1372                 async_req_error(req, status);
1373                 return;
1374         }
1375
1376         if ((state->rhdr.flags & RPC_FLG_FIRST)
1377             && (state->rhdr.pack_type[0] == 0)) {
1378                 /*
1379                  * Set the data type correctly for big-endian data on the
1380                  * first packet.
1381                  */
1382                 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
1383                           "big-endian.\n",
1384                           rpccli_pipe_txt(debug_ctx(), state->cli)));
1385                 prs_set_endian_data(&state->incoming_pdu, RPC_BIG_ENDIAN);
1386         }
1387         /*
1388          * Check endianness on subsequent packets.
1389          */
1390         if (state->incoming_frag.bigendian_data
1391             != state->incoming_pdu.bigendian_data) {
1392                 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
1393                          "%s\n",
1394                          state->incoming_pdu.bigendian_data?"big":"little",
1395                          state->incoming_frag.bigendian_data?"big":"little"));
1396                 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
1397                 return;
1398         }
1399
1400         /* Now copy the data portion out of the pdu into rbuf. */
1401         if (!prs_force_grow(&state->incoming_pdu, rdata_len)) {
1402                 async_req_error(req, NT_STATUS_NO_MEMORY);
1403                 return;
1404         }
1405
1406         memcpy(prs_data_p(&state->incoming_pdu) + state->incoming_pdu_offset,
1407                rdata, (size_t)rdata_len);
1408         state->incoming_pdu_offset += rdata_len;
1409
1410         status = cli_pipe_reset_current_pdu(state->cli, &state->rhdr,
1411                                             &state->incoming_frag);
1412         if (!NT_STATUS_IS_OK(status)) {
1413                 async_req_error(req, status);
1414                 return;
1415         }
1416
1417         if (state->rhdr.flags & RPC_FLG_LAST) {
1418                 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1419                           rpccli_pipe_txt(debug_ctx(), state->cli),
1420                           (unsigned)prs_data_size(&state->incoming_pdu)));
1421                 async_req_done(req);
1422                 return;
1423         }
1424
1425         subreq = get_complete_frag_send(state, state->ev, state->cli,
1426                                         &state->rhdr, &state->incoming_frag);
1427         if (async_req_nomem(subreq, req)) {
1428                 return;
1429         }
1430         subreq->async.fn = rpc_api_pipe_got_pdu;
1431         subreq->async.priv = req;
1432 }
1433
1434 static NTSTATUS rpc_api_pipe_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
1435                                   prs_struct *reply_pdu)
1436 {
1437         struct rpc_api_pipe_state *state = talloc_get_type_abort(
1438                 req->private_data, struct rpc_api_pipe_state);
1439         NTSTATUS status;
1440
1441         if (async_req_is_error(req, &status)) {
1442                 return status;
1443         }
1444
1445         *reply_pdu = state->incoming_pdu;
1446         reply_pdu->mem_ctx = mem_ctx;
1447
1448         /*
1449          * Prevent state->incoming_pdu from being freed in
1450          * rpc_api_pipe_state_destructor()
1451          */
1452         prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1453
1454         return NT_STATUS_OK;
1455 }
1456
1457 /*******************************************************************
1458  Creates krb5 auth bind.
1459  ********************************************************************/
1460
1461 static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
1462                                                 enum pipe_auth_level auth_level,
1463                                                 RPC_HDR_AUTH *pauth_out,
1464                                                 prs_struct *auth_data)
1465 {
1466 #ifdef HAVE_KRB5
1467         int ret;
1468         struct kerberos_auth_struct *a = cli->auth->a_u.kerberos_auth;
1469         DATA_BLOB tkt = data_blob_null;
1470         DATA_BLOB tkt_wrapped = data_blob_null;
1471
1472         /* We may change the pad length before marshalling. */
1473         init_rpc_hdr_auth(pauth_out, RPC_KRB5_AUTH_TYPE, (int)auth_level, 0, 1);
1474
1475         DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
1476                 a->service_principal ));
1477
1478         /* Create the ticket for the service principal and return it in a gss-api wrapped blob. */
1479
1480         ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
1481                         &a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL);
1482
1483         if (ret) {
1484                 DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
1485                         "failed with %s\n",
1486                         a->service_principal,
1487                         error_message(ret) ));
1488
1489                 data_blob_free(&tkt);
1490                 prs_mem_free(auth_data);
1491                 return NT_STATUS_INVALID_PARAMETER;
1492         }
1493
1494         /* wrap that up in a nice GSS-API wrapping */
1495         tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
1496
1497         data_blob_free(&tkt);
1498
1499         /* Auth len in the rpc header doesn't include auth_header. */
1500         if (!prs_copy_data_in(auth_data, (char *)tkt_wrapped.data, tkt_wrapped.length)) {
1501                 data_blob_free(&tkt_wrapped);
1502                 prs_mem_free(auth_data);
1503                 return NT_STATUS_NO_MEMORY;
1504         }
1505
1506         DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
1507         dump_data(5, tkt_wrapped.data, tkt_wrapped.length);
1508
1509         data_blob_free(&tkt_wrapped);
1510         return NT_STATUS_OK;
1511 #else
1512         return NT_STATUS_INVALID_PARAMETER;
1513 #endif
1514 }
1515
1516 /*******************************************************************
1517  Creates SPNEGO NTLMSSP auth bind.
1518  ********************************************************************/
1519
1520 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1521                                                 enum pipe_auth_level auth_level,
1522                                                 RPC_HDR_AUTH *pauth_out,
1523                                                 prs_struct *auth_data)
1524 {
1525         NTSTATUS nt_status;
1526         DATA_BLOB null_blob = data_blob_null;
1527         DATA_BLOB request = data_blob_null;
1528         DATA_BLOB spnego_msg = data_blob_null;
1529
1530         /* We may change the pad length before marshalling. */
1531         init_rpc_hdr_auth(pauth_out, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
1532
1533         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1534         nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1535                                         null_blob,
1536                                         &request);
1537
1538         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1539                 data_blob_free(&request);
1540                 prs_mem_free(auth_data);
1541                 return nt_status;
1542         }
1543
1544         /* Wrap this in SPNEGO. */
1545         spnego_msg = gen_negTokenInit(OID_NTLMSSP, request);
1546
1547         data_blob_free(&request);
1548
1549         /* Auth len in the rpc header doesn't include auth_header. */
1550         if (!prs_copy_data_in(auth_data, (char *)spnego_msg.data, spnego_msg.length)) {
1551                 data_blob_free(&spnego_msg);
1552                 prs_mem_free(auth_data);
1553                 return NT_STATUS_NO_MEMORY;
1554         }
1555
1556         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1557         dump_data(5, spnego_msg.data, spnego_msg.length);
1558
1559         data_blob_free(&spnego_msg);
1560         return NT_STATUS_OK;
1561 }
1562
1563 /*******************************************************************
1564  Creates NTLMSSP auth bind.
1565  ********************************************************************/
1566
1567 static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1568                                                 enum pipe_auth_level auth_level,
1569                                                 RPC_HDR_AUTH *pauth_out,
1570                                                 prs_struct *auth_data)
1571 {
1572         NTSTATUS nt_status;
1573         DATA_BLOB null_blob = data_blob_null;
1574         DATA_BLOB request = data_blob_null;
1575
1576         /* We may change the pad length before marshalling. */
1577         init_rpc_hdr_auth(pauth_out, RPC_NTLMSSP_AUTH_TYPE, (int)auth_level, 0, 1);
1578
1579         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1580         nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1581                                         null_blob,
1582                                         &request);
1583
1584         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1585                 data_blob_free(&request);
1586                 prs_mem_free(auth_data);
1587                 return nt_status;
1588         }
1589
1590         /* Auth len in the rpc header doesn't include auth_header. */
1591         if (!prs_copy_data_in(auth_data, (char *)request.data, request.length)) {
1592                 data_blob_free(&request);
1593                 prs_mem_free(auth_data);
1594                 return NT_STATUS_NO_MEMORY;
1595         }
1596
1597         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1598         dump_data(5, request.data, request.length);
1599
1600         data_blob_free(&request);
1601         return NT_STATUS_OK;
1602 }
1603
1604 /*******************************************************************
1605  Creates schannel auth bind.
1606  ********************************************************************/
1607
1608 static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1609                                                 enum pipe_auth_level auth_level,
1610                                                 RPC_HDR_AUTH *pauth_out,
1611                                                 prs_struct *auth_data)
1612 {
1613         RPC_AUTH_SCHANNEL_NEG schannel_neg;
1614
1615         /* We may change the pad length before marshalling. */
1616         init_rpc_hdr_auth(pauth_out, RPC_SCHANNEL_AUTH_TYPE, (int)auth_level, 0, 1);
1617
1618         /* Use lp_workgroup() if domain not specified */
1619
1620         if (!cli->auth->domain || !cli->auth->domain[0]) {
1621                 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1622                 if (cli->auth->domain == NULL) {
1623                         return NT_STATUS_NO_MEMORY;
1624                 }
1625         }
1626
1627         init_rpc_auth_schannel_neg(&schannel_neg, cli->auth->domain,
1628                                    global_myname());
1629
1630         /*
1631          * Now marshall the data into the auth parse_struct.
1632          */
1633
1634         if(!smb_io_rpc_auth_schannel_neg("schannel_neg",
1635                                        &schannel_neg, auth_data, 0)) {
1636                 DEBUG(0,("Failed to marshall RPC_AUTH_SCHANNEL_NEG.\n"));
1637                 prs_mem_free(auth_data);
1638                 return NT_STATUS_NO_MEMORY;
1639         }
1640
1641         return NT_STATUS_OK;
1642 }
1643
1644 /*******************************************************************
1645  Creates the internals of a DCE/RPC bind request or alter context PDU.
1646  ********************************************************************/
1647
1648 static NTSTATUS create_bind_or_alt_ctx_internal(enum RPC_PKT_TYPE pkt_type,
1649                                                 prs_struct *rpc_out,
1650                                                 uint32 rpc_call_id,
1651                                                 const RPC_IFACE *abstract,
1652                                                 const RPC_IFACE *transfer,
1653                                                 RPC_HDR_AUTH *phdr_auth,
1654                                                 prs_struct *pauth_info)
1655 {
1656         RPC_HDR hdr;
1657         RPC_HDR_RB hdr_rb;
1658         RPC_CONTEXT rpc_ctx;
1659         uint16 auth_len = prs_offset(pauth_info);
1660         uint8 ss_padding_len = 0;
1661         uint16 frag_len = 0;
1662
1663         /* create the RPC context. */
1664         init_rpc_context(&rpc_ctx, 0 /* context id */, abstract, transfer);
1665
1666         /* create the bind request RPC_HDR_RB */
1667         init_rpc_hdr_rb(&hdr_rb, RPC_MAX_PDU_FRAG_LEN, RPC_MAX_PDU_FRAG_LEN, 0x0, &rpc_ctx);
1668
1669         /* Start building the frag length. */
1670         frag_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1671
1672         /* Do we need to pad ? */
1673         if (auth_len) {
1674                 uint16 data_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1675                 if (data_len % 8) {
1676                         ss_padding_len = 8 - (data_len % 8);
1677                         phdr_auth->auth_pad_len = ss_padding_len;
1678                 }
1679                 frag_len += RPC_HDR_AUTH_LEN + auth_len + ss_padding_len;
1680         }
1681
1682         /* Create the request RPC_HDR */
1683         init_rpc_hdr(&hdr, pkt_type, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id, frag_len, auth_len);
1684
1685         /* Marshall the RPC header */
1686         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
1687                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR.\n"));
1688                 return NT_STATUS_NO_MEMORY;
1689         }
1690
1691         /* Marshall the bind request data */
1692         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
1693                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1694                 return NT_STATUS_NO_MEMORY;
1695         }
1696
1697         /*
1698          * Grow the outgoing buffer to store any auth info.
1699          */
1700
1701         if(auth_len != 0) {
1702                 if (ss_padding_len) {
1703                         char pad[8];
1704                         memset(pad, '\0', 8);
1705                         if (!prs_copy_data_in(rpc_out, pad, ss_padding_len)) {
1706                                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall padding.\n"));
1707                                 return NT_STATUS_NO_MEMORY;
1708                         }
1709                 }
1710
1711                 if(!smb_io_rpc_hdr_auth("hdr_auth", phdr_auth, rpc_out, 0)) {
1712                         DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_AUTH.\n"));
1713                         return NT_STATUS_NO_MEMORY;
1714                 }
1715
1716
1717                 if(!prs_append_prs_data( rpc_out, pauth_info)) {
1718                         DEBUG(0,("create_bind_or_alt_ctx_internal: failed to grow parse struct to add auth.\n"));
1719                         return NT_STATUS_NO_MEMORY;
1720                 }
1721         }
1722
1723         return NT_STATUS_OK;
1724 }
1725
1726 /*******************************************************************
1727  Creates a DCE/RPC bind request.
1728  ********************************************************************/
1729
1730 static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
1731                                 prs_struct *rpc_out,
1732                                 uint32 rpc_call_id,
1733                                 const RPC_IFACE *abstract,
1734                                 const RPC_IFACE *transfer,
1735                                 enum pipe_auth_type auth_type,
1736                                 enum pipe_auth_level auth_level)
1737 {
1738         RPC_HDR_AUTH hdr_auth;
1739         prs_struct auth_info;
1740         NTSTATUS ret = NT_STATUS_OK;
1741
1742         ZERO_STRUCT(hdr_auth);
1743         if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
1744                 return NT_STATUS_NO_MEMORY;
1745
1746         switch (auth_type) {
1747                 case PIPE_AUTH_TYPE_SCHANNEL:
1748                         ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1749                         if (!NT_STATUS_IS_OK(ret)) {
1750                                 prs_mem_free(&auth_info);
1751                                 return ret;
1752                         }
1753                         break;
1754
1755                 case PIPE_AUTH_TYPE_NTLMSSP:
1756                         ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1757                         if (!NT_STATUS_IS_OK(ret)) {
1758                                 prs_mem_free(&auth_info);
1759                                 return ret;
1760                         }
1761                         break;
1762
1763                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1764                         ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1765                         if (!NT_STATUS_IS_OK(ret)) {
1766                                 prs_mem_free(&auth_info);
1767                                 return ret;
1768                         }
1769                         break;
1770
1771                 case PIPE_AUTH_TYPE_KRB5:
1772                         ret = create_krb5_auth_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1773                         if (!NT_STATUS_IS_OK(ret)) {
1774                                 prs_mem_free(&auth_info);
1775                                 return ret;
1776                         }
1777                         break;
1778
1779                 case PIPE_AUTH_TYPE_NONE:
1780                         break;
1781
1782                 default:
1783                         /* "Can't" happen. */
1784                         return NT_STATUS_INVALID_INFO_CLASS;
1785         }
1786
1787         ret = create_bind_or_alt_ctx_internal(RPC_BIND,
1788                                                 rpc_out,
1789                                                 rpc_call_id,
1790                                                 abstract,
1791                                                 transfer,
1792                                                 &hdr_auth,
1793                                                 &auth_info);
1794
1795         prs_mem_free(&auth_info);
1796         return ret;
1797 }
1798
1799 /*******************************************************************
1800  Create and add the NTLMSSP sign/seal auth header and data.
1801  ********************************************************************/
1802
1803 static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
1804                                         RPC_HDR *phdr,
1805                                         uint32 ss_padding_len,
1806                                         prs_struct *outgoing_pdu)
1807 {
1808         RPC_HDR_AUTH auth_info;
1809         NTSTATUS status;
1810         DATA_BLOB auth_blob = data_blob_null;
1811         uint16 data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1812
1813         if (!cli->auth->a_u.ntlmssp_state) {
1814                 return NT_STATUS_INVALID_PARAMETER;
1815         }
1816
1817         /* Init and marshall the auth header. */
1818         init_rpc_hdr_auth(&auth_info,
1819                         map_pipe_auth_type_to_rpc_auth_type(
1820                                 cli->auth->auth_type),
1821                         cli->auth->auth_level,
1822                         ss_padding_len,
1823                         1 /* context id. */);
1824
1825         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
1826                 DEBUG(0,("add_ntlmssp_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
1827                 data_blob_free(&auth_blob);
1828                 return NT_STATUS_NO_MEMORY;
1829         }
1830
1831         switch (cli->auth->auth_level) {
1832                 case PIPE_AUTH_LEVEL_PRIVACY:
1833                         /* Data portion is encrypted. */
1834                         status = ntlmssp_seal_packet(cli->auth->a_u.ntlmssp_state,
1835                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1836                                         data_and_pad_len,
1837                                         (unsigned char *)prs_data_p(outgoing_pdu),
1838                                         (size_t)prs_offset(outgoing_pdu),
1839                                         &auth_blob);
1840                         if (!NT_STATUS_IS_OK(status)) {
1841                                 data_blob_free(&auth_blob);
1842                                 return status;
1843                         }
1844                         break;
1845
1846                 case PIPE_AUTH_LEVEL_INTEGRITY:
1847                         /* Data is signed. */
1848                         status = ntlmssp_sign_packet(cli->auth->a_u.ntlmssp_state,
1849                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1850                                         data_and_pad_len,
1851                                         (unsigned char *)prs_data_p(outgoing_pdu),
1852                                         (size_t)prs_offset(outgoing_pdu),
1853                                         &auth_blob);
1854                         if (!NT_STATUS_IS_OK(status)) {
1855                                 data_blob_free(&auth_blob);
1856                                 return status;
1857                         }
1858                         break;
1859
1860                 default:
1861                         /* Can't happen. */
1862                         smb_panic("bad auth level");
1863                         /* Notreached. */
1864                         return NT_STATUS_INVALID_PARAMETER;
1865         }
1866
1867         /* Finally marshall the blob. */
1868
1869         if (!prs_copy_data_in(outgoing_pdu, (const char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
1870                 DEBUG(0,("add_ntlmssp_auth_footer: failed to add %u bytes auth blob.\n",
1871                         (unsigned int)NTLMSSP_SIG_SIZE));
1872                 data_blob_free(&auth_blob);
1873                 return NT_STATUS_NO_MEMORY;
1874         }
1875
1876         data_blob_free(&auth_blob);
1877         return NT_STATUS_OK;
1878 }
1879
1880 /*******************************************************************
1881  Create and add the schannel sign/seal auth header and data.
1882  ********************************************************************/
1883
1884 static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
1885                                         RPC_HDR *phdr,
1886                                         uint32 ss_padding_len,
1887                                         prs_struct *outgoing_pdu)
1888 {
1889         RPC_HDR_AUTH auth_info;
1890         RPC_AUTH_SCHANNEL_CHK verf;
1891         struct schannel_auth_struct *sas = cli->auth->a_u.schannel_auth;
1892         char *data_p = prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
1893         size_t data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1894
1895         if (!sas) {
1896                 return NT_STATUS_INVALID_PARAMETER;
1897         }
1898
1899         /* Init and marshall the auth header. */
1900         init_rpc_hdr_auth(&auth_info,
1901                         map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
1902                         cli->auth->auth_level,
1903                         ss_padding_len,
1904                         1 /* context id. */);
1905
1906         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
1907                 DEBUG(0,("add_schannel_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
1908                 return NT_STATUS_NO_MEMORY;
1909         }
1910
1911         switch (cli->auth->auth_level) {
1912                 case PIPE_AUTH_LEVEL_PRIVACY:
1913                 case PIPE_AUTH_LEVEL_INTEGRITY:
1914                         DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
1915                                 sas->seq_num));
1916
1917                         schannel_encode(sas,
1918                                         cli->auth->auth_level,
1919                                         SENDER_IS_INITIATOR,
1920                                         &verf,
1921                                         data_p,
1922                                         data_and_pad_len);
1923
1924                         sas->seq_num++;
1925                         break;
1926
1927                 default:
1928                         /* Can't happen. */
1929                         smb_panic("bad auth level");
1930                         /* Notreached. */
1931                         return NT_STATUS_INVALID_PARAMETER;
1932         }
1933
1934         /* Finally marshall the blob. */
1935         smb_io_rpc_auth_schannel_chk("",
1936                         RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
1937                         &verf,
1938                         outgoing_pdu,
1939                         0);
1940
1941         return NT_STATUS_OK;
1942 }
1943
1944 /*******************************************************************
1945  Calculate how much data we're going to send in this packet, also
1946  work out any sign/seal padding length.
1947  ********************************************************************/
1948
1949 static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
1950                                         uint32 data_left,
1951                                         uint16 *p_frag_len,
1952                                         uint16 *p_auth_len,
1953                                         uint32 *p_ss_padding)
1954 {
1955         uint32 data_space, data_len;
1956
1957 #ifdef DEVELOPER
1958         if ((data_left > 0) && (sys_random() % 2)) {
1959                 data_left = MAX(data_left/2, 1);
1960         }
1961 #endif
1962
1963         switch (cli->auth->auth_level) {
1964                 case PIPE_AUTH_LEVEL_NONE:
1965                 case PIPE_AUTH_LEVEL_CONNECT:
1966                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN;
1967                         data_len = MIN(data_space, data_left);
1968                         *p_ss_padding = 0;
1969                         *p_auth_len = 0;
1970                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + data_len;
1971                         return data_len;
1972
1973                 case PIPE_AUTH_LEVEL_INTEGRITY:
1974                 case PIPE_AUTH_LEVEL_PRIVACY:
1975                         /* Treat the same for all authenticated rpc requests. */
1976                         switch(cli->auth->auth_type) {
1977                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1978                                 case PIPE_AUTH_TYPE_NTLMSSP:
1979                                         *p_auth_len = NTLMSSP_SIG_SIZE;
1980                                         break;
1981                                 case PIPE_AUTH_TYPE_SCHANNEL:
1982                                         *p_auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
1983                                         break;
1984                                 default:
1985                                         smb_panic("bad auth type");
1986                                         break;
1987                         }
1988
1989                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1990                                                 RPC_HDR_AUTH_LEN - *p_auth_len;
1991
1992                         data_len = MIN(data_space, data_left);
1993                         *p_ss_padding = 0;
1994                         if (data_len % 8) {
1995                                 *p_ss_padding = 8 - (data_len % 8);
1996                         }
1997                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN +                /* Normal headers. */
1998                                         data_len + *p_ss_padding +              /* data plus padding. */
1999                                         RPC_HDR_AUTH_LEN + *p_auth_len;         /* Auth header and auth data. */
2000                         return data_len;
2001
2002                 default:
2003                         smb_panic("bad auth level");
2004                         /* Notreached. */
2005                         return 0;
2006         }
2007 }
2008
2009 /*******************************************************************
2010  External interface.
2011  Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
2012  Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
2013  and deals with signing/sealing details.
2014  ********************************************************************/
2015
2016 struct rpc_api_pipe_req_state {
2017         struct event_context *ev;
2018         struct rpc_pipe_client *cli;
2019         uint8_t op_num;
2020         uint32_t call_id;
2021         prs_struct *req_data;
2022         uint32_t req_data_sent;
2023         prs_struct outgoing_frag;
2024         prs_struct reply_pdu;
2025 };
2026
2027 static int rpc_api_pipe_req_state_destructor(struct rpc_api_pipe_req_state *s)
2028 {
2029         prs_mem_free(&s->outgoing_frag);
2030         prs_mem_free(&s->reply_pdu);
2031         return 0;
2032 }
2033
2034 static void rpc_api_pipe_req_write_done(struct async_req *subreq);
2035 static void rpc_api_pipe_req_done(struct async_req *subreq);
2036 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2037                                   bool *is_last_frag);
2038
2039 struct async_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
2040                                         struct event_context *ev,
2041                                         struct rpc_pipe_client *cli,
2042                                         uint8_t op_num,
2043                                         prs_struct *req_data)
2044 {
2045         struct async_req *result, *subreq;
2046         struct rpc_api_pipe_req_state *state;
2047         NTSTATUS status;
2048         bool is_last_frag;
2049
2050         if (!async_req_setup(mem_ctx, &result, &state,
2051                              struct rpc_api_pipe_req_state)) {
2052                 return NULL;
2053         }
2054         state->ev = ev;
2055         state->cli = cli;
2056         state->op_num = op_num;
2057         state->req_data = req_data;
2058         state->req_data_sent = 0;
2059         state->call_id = get_rpc_call_id();
2060
2061         if (cli->max_xmit_frag
2062             < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_MAX_SIGN_SIZE) {
2063                 /* Server is screwed up ! */
2064                 status = NT_STATUS_INVALID_PARAMETER;
2065                 goto post_status;
2066         }
2067
2068         prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2069
2070         if (!prs_init(&state->outgoing_frag, cli->max_xmit_frag,
2071                       state, MARSHALL)) {
2072                 status = NT_STATUS_NO_MEMORY;
2073                 goto post_status;
2074         }
2075
2076         talloc_set_destructor(state, rpc_api_pipe_req_state_destructor);
2077
2078         status = prepare_next_frag(state, &is_last_frag);
2079         if (!NT_STATUS_IS_OK(status)) {
2080                 goto post_status;
2081         }
2082
2083         if (is_last_frag) {
2084                 subreq = rpc_api_pipe_send(state, ev, state->cli,
2085                                            &state->outgoing_frag,
2086                                            RPC_RESPONSE);
2087                 if (subreq == NULL) {
2088                         status = NT_STATUS_NO_MEMORY;
2089                         goto post_status;
2090                 }
2091                 subreq->async.fn = rpc_api_pipe_req_done;
2092                 subreq->async.priv = result;
2093         } else {
2094                 subreq = rpc_write_send(
2095                         state, ev, cli->transport,
2096                         (uint8_t *)prs_data_p(&state->outgoing_frag),
2097                         prs_offset(&state->outgoing_frag));
2098                 if (subreq == NULL) {
2099                         status = NT_STATUS_NO_MEMORY;
2100                         goto post_status;
2101                 }
2102                 subreq->async.fn = rpc_api_pipe_req_write_done;
2103                 subreq->async.priv = result;
2104         }
2105         return result;
2106
2107  post_status:
2108         if (async_post_status(result, ev, status)) {
2109                 return result;
2110         }
2111         TALLOC_FREE(result);
2112         return NULL;
2113 }
2114
2115 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2116                                   bool *is_last_frag)
2117 {
2118         RPC_HDR hdr;
2119         RPC_HDR_REQ hdr_req;
2120         uint32_t data_sent_thistime;
2121         uint16_t auth_len;
2122         uint16_t frag_len;
2123         uint8_t flags = 0;
2124         uint32_t ss_padding;
2125         uint32_t data_left;
2126         char pad[8] = { 0, };
2127         NTSTATUS status;
2128
2129         data_left = prs_offset(state->req_data) - state->req_data_sent;
2130
2131         data_sent_thistime = calculate_data_len_tosend(
2132                 state->cli, data_left, &frag_len, &auth_len, &ss_padding);
2133
2134         if (state->req_data_sent == 0) {
2135                 flags = RPC_FLG_FIRST;
2136         }
2137
2138         if (data_sent_thistime == data_left) {
2139                 flags |= RPC_FLG_LAST;
2140         }
2141
2142         if (!prs_set_offset(&state->outgoing_frag, 0)) {
2143                 return NT_STATUS_NO_MEMORY;
2144         }
2145
2146         /* Create and marshall the header and request header. */
2147         init_rpc_hdr(&hdr, RPC_REQUEST, flags, state->call_id, frag_len,
2148                      auth_len);
2149
2150         if (!smb_io_rpc_hdr("hdr    ", &hdr, &state->outgoing_frag, 0)) {
2151                 return NT_STATUS_NO_MEMORY;
2152         }
2153
2154         /* Create the rpc request RPC_HDR_REQ */
2155         init_rpc_hdr_req(&hdr_req, prs_offset(state->req_data),
2156                          state->op_num);
2157
2158         if (!smb_io_rpc_hdr_req("hdr_req", &hdr_req,
2159                                 &state->outgoing_frag, 0)) {
2160                 return NT_STATUS_NO_MEMORY;
2161         }
2162
2163         /* Copy in the data, plus any ss padding. */
2164         if (!prs_append_some_prs_data(&state->outgoing_frag,
2165                                       state->req_data, state->req_data_sent,
2166                                       data_sent_thistime)) {
2167                 return NT_STATUS_NO_MEMORY;
2168         }
2169
2170         /* Copy the sign/seal padding data. */
2171         if (!prs_copy_data_in(&state->outgoing_frag, pad, ss_padding)) {
2172                 return NT_STATUS_NO_MEMORY;
2173         }
2174
2175         /* Generate any auth sign/seal and add the auth footer. */
2176         switch (state->cli->auth->auth_type) {
2177         case PIPE_AUTH_TYPE_NONE:
2178                 status = NT_STATUS_OK;
2179                 break;
2180         case PIPE_AUTH_TYPE_NTLMSSP:
2181         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2182                 status = add_ntlmssp_auth_footer(state->cli, &hdr, ss_padding,
2183                                                  &state->outgoing_frag);
2184                 break;
2185         case PIPE_AUTH_TYPE_SCHANNEL:
2186                 status = add_schannel_auth_footer(state->cli, &hdr, ss_padding,
2187                                                   &state->outgoing_frag);
2188                 break;
2189         default:
2190                 status = NT_STATUS_INVALID_PARAMETER;
2191                 break;
2192         }
2193
2194         state->req_data_sent += data_sent_thistime;
2195         *is_last_frag = ((flags & RPC_FLG_LAST) != 0);
2196
2197         return status;
2198 }
2199
2200 static void rpc_api_pipe_req_write_done(struct async_req *subreq)
2201 {
2202         struct async_req *req = talloc_get_type_abort(
2203                 subreq->async.priv, struct async_req);
2204         struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2205                 req->private_data, struct rpc_api_pipe_req_state);
2206         NTSTATUS status;
2207         bool is_last_frag;
2208
2209         status = rpc_write_recv(subreq);
2210         TALLOC_FREE(subreq);
2211         if (!NT_STATUS_IS_OK(status)) {
2212                 async_req_error(req, status);
2213                 return;
2214         }
2215
2216         status = prepare_next_frag(state, &is_last_frag);
2217         if (!NT_STATUS_IS_OK(status)) {
2218                 async_req_error(req, status);
2219                 return;
2220         }
2221
2222         if (is_last_frag) {
2223                 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2224                                            &state->outgoing_frag,
2225                                            RPC_RESPONSE);
2226                 if (async_req_nomem(subreq, req)) {
2227                         return;
2228                 }
2229                 subreq->async.fn = rpc_api_pipe_req_done;
2230                 subreq->async.priv = req;
2231         } else {
2232                 subreq = rpc_write_send(
2233                         state, state->ev,
2234                         state->cli->transport,
2235                         (uint8_t *)prs_data_p(&state->outgoing_frag),
2236                         prs_offset(&state->outgoing_frag));
2237                 if (async_req_nomem(subreq, req)) {
2238                         return;
2239                 }
2240                 subreq->async.fn = rpc_api_pipe_req_write_done;
2241                 subreq->async.priv = req;
2242         }
2243 }
2244
2245 static void rpc_api_pipe_req_done(struct async_req *subreq)
2246 {
2247         struct async_req *req = talloc_get_type_abort(
2248                 subreq->async.priv, struct async_req);
2249         struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2250                 req->private_data, struct rpc_api_pipe_req_state);
2251         NTSTATUS status;
2252
2253         status = rpc_api_pipe_recv(subreq, state, &state->reply_pdu);
2254         TALLOC_FREE(subreq);
2255         if (!NT_STATUS_IS_OK(status)) {
2256                 async_req_error(req, status);
2257                 return;
2258         }
2259         async_req_done(req);
2260 }
2261
2262 NTSTATUS rpc_api_pipe_req_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
2263                                prs_struct *reply_pdu)
2264 {
2265         struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2266                 req->private_data, struct rpc_api_pipe_req_state);
2267         NTSTATUS status;
2268
2269         if (async_req_is_error(req, &status)) {
2270                 /*
2271                  * We always have to initialize to reply pdu, even if there is
2272                  * none. The rpccli_* caller routines expect this.
2273                  */
2274                 prs_init_empty(reply_pdu, mem_ctx, UNMARSHALL);
2275                 return status;
2276         }
2277
2278         *reply_pdu = state->reply_pdu;
2279         reply_pdu->mem_ctx = mem_ctx;
2280
2281         /*
2282          * Prevent state->req_pdu from being freed in
2283          * rpc_api_pipe_req_state_destructor()
2284          */
2285         prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2286
2287         return NT_STATUS_OK;
2288 }
2289
2290 NTSTATUS rpc_api_pipe_req(TALLOC_CTX *mem_ctx, struct rpc_pipe_client *cli,
2291                         uint8 op_num,
2292                         prs_struct *in_data,
2293                         prs_struct *out_data)
2294 {
2295         TALLOC_CTX *frame = talloc_stackframe();
2296         struct event_context *ev;
2297         struct async_req *req;
2298         NTSTATUS status = NT_STATUS_NO_MEMORY;
2299
2300         ev = event_context_init(frame);
2301         if (ev == NULL) {
2302                 goto fail;
2303         }
2304
2305         req = rpc_api_pipe_req_send(frame, ev, cli, op_num, in_data);
2306         if (req == NULL) {
2307                 goto fail;
2308         }
2309
2310         while (req->state < ASYNC_REQ_DONE) {
2311                 event_loop_once(ev);
2312         }
2313
2314         status = rpc_api_pipe_req_recv(req, mem_ctx, out_data);
2315  fail:
2316         TALLOC_FREE(frame);
2317         return status;
2318 }
2319
2320 #if 0
2321 /****************************************************************************
2322  Set the handle state.
2323 ****************************************************************************/
2324
2325 static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
2326                                    const char *pipe_name, uint16 device_state)
2327 {
2328         bool state_set = False;
2329         char param[2];
2330         uint16 setup[2]; /* only need 2 uint16 setup parameters */
2331         char *rparam = NULL;
2332         char *rdata = NULL;
2333         uint32 rparam_len, rdata_len;
2334
2335         if (pipe_name == NULL)
2336                 return False;
2337
2338         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
2339                  cli->fnum, pipe_name, device_state));
2340
2341         /* create parameters: device state */
2342         SSVAL(param, 0, device_state);
2343
2344         /* create setup parameters. */
2345         setup[0] = 0x0001;
2346         setup[1] = cli->fnum; /* pipe file handle.  got this from an SMBOpenX. */
2347
2348         /* send the data on \PIPE\ */
2349         if (cli_api_pipe(cli->cli, "\\PIPE\\",
2350                     setup, 2, 0,                /* setup, length, max */
2351                     param, 2, 0,                /* param, length, max */
2352                     NULL, 0, 1024,              /* data, length, max */
2353                     &rparam, &rparam_len,        /* return param, length */
2354                     &rdata, &rdata_len))         /* return data, length */
2355         {
2356                 DEBUG(5, ("Set Handle state: return OK\n"));
2357                 state_set = True;
2358         }
2359
2360         SAFE_FREE(rparam);
2361         SAFE_FREE(rdata);
2362
2363         return state_set;
2364 }
2365 #endif
2366
2367 /****************************************************************************
2368  Check the rpc bind acknowledge response.
2369 ****************************************************************************/
2370
2371 static bool check_bind_response(RPC_HDR_BA *hdr_ba, const RPC_IFACE *transfer)
2372 {
2373         if ( hdr_ba->addr.len == 0) {
2374                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
2375         }
2376
2377         /* check the transfer syntax */
2378         if ((hdr_ba->transfer.if_version != transfer->if_version) ||
2379              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
2380                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
2381                 return False;
2382         }
2383
2384         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
2385                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
2386                           hdr_ba->res.num_results, hdr_ba->res.reason));
2387         }
2388
2389         DEBUG(5,("check_bind_response: accepted!\n"));
2390         return True;
2391 }
2392
2393 /*******************************************************************
2394  Creates a DCE/RPC bind authentication response.
2395  This is the packet that is sent back to the server once we
2396  have received a BIND-ACK, to finish the third leg of
2397  the authentication handshake.
2398  ********************************************************************/
2399
2400 static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
2401                                 uint32 rpc_call_id,
2402                                 enum pipe_auth_type auth_type,
2403                                 enum pipe_auth_level auth_level,
2404                                 DATA_BLOB *pauth_blob,
2405                                 prs_struct *rpc_out)
2406 {
2407         RPC_HDR hdr;
2408         RPC_HDR_AUTH hdr_auth;
2409         uint32 pad = 0;
2410
2411         /* Create the request RPC_HDR */
2412         init_rpc_hdr(&hdr, RPC_AUTH3, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id,
2413                      RPC_HEADER_LEN + 4 /* pad */ + RPC_HDR_AUTH_LEN + pauth_blob->length,
2414                      pauth_blob->length );
2415
2416         /* Marshall it. */
2417         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
2418                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR.\n"));
2419                 return NT_STATUS_NO_MEMORY;
2420         }
2421
2422         /*
2423                 I'm puzzled about this - seems to violate the DCE RPC auth rules,
2424                 about padding - shouldn't this pad to length 8 ? JRA.
2425         */
2426
2427         /* 4 bytes padding. */
2428         if (!prs_uint32("pad", rpc_out, 0, &pad)) {
2429                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall 4 byte pad.\n"));
2430                 return NT_STATUS_NO_MEMORY;
2431         }
2432
2433         /* Create the request RPC_HDR_AUTHA */
2434         init_rpc_hdr_auth(&hdr_auth,
2435                         map_pipe_auth_type_to_rpc_auth_type(auth_type),
2436                         auth_level, 0, 1);
2437
2438         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rpc_out, 0)) {
2439                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR_AUTHA.\n"));
2440                 return NT_STATUS_NO_MEMORY;
2441         }
2442
2443         /*
2444          * Append the auth data to the outgoing buffer.
2445          */
2446
2447         if(!prs_copy_data_in(rpc_out, (char *)pauth_blob->data, pauth_blob->length)) {
2448                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall auth blob.\n"));
2449                 return NT_STATUS_NO_MEMORY;
2450         }
2451
2452         return NT_STATUS_OK;
2453 }
2454
2455 /*******************************************************************
2456  Creates a DCE/RPC bind alter context authentication request which
2457  may contain a spnego auth blobl
2458  ********************************************************************/
2459
2460 static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
2461                                         const RPC_IFACE *abstract,
2462                                         const RPC_IFACE *transfer,
2463                                         enum pipe_auth_level auth_level,
2464                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
2465                                         prs_struct *rpc_out)
2466 {
2467         RPC_HDR_AUTH hdr_auth;
2468         prs_struct auth_info;
2469         NTSTATUS ret = NT_STATUS_OK;
2470
2471         ZERO_STRUCT(hdr_auth);
2472         if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
2473                 return NT_STATUS_NO_MEMORY;
2474
2475         /* We may change the pad length before marshalling. */
2476         init_rpc_hdr_auth(&hdr_auth, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
2477
2478         if (pauth_blob->length) {
2479                 if (!prs_copy_data_in(&auth_info, (const char *)pauth_blob->data, pauth_blob->length)) {
2480                         prs_mem_free(&auth_info);
2481                         return NT_STATUS_NO_MEMORY;
2482                 }
2483         }
2484
2485         ret = create_bind_or_alt_ctx_internal(RPC_ALTCONT,
2486                                                 rpc_out,
2487                                                 rpc_call_id,
2488                                                 abstract,
2489                                                 transfer,
2490                                                 &hdr_auth,
2491                                                 &auth_info);
2492         prs_mem_free(&auth_info);
2493         return ret;
2494 }
2495
2496 /****************************************************************************
2497  Do an rpc bind.
2498 ****************************************************************************/
2499
2500 struct rpc_pipe_bind_state {
2501         struct event_context *ev;
2502         struct rpc_pipe_client *cli;
2503         prs_struct rpc_out;
2504         uint32_t rpc_call_id;
2505 };
2506
2507 static int rpc_pipe_bind_state_destructor(struct rpc_pipe_bind_state *state)
2508 {
2509         prs_mem_free(&state->rpc_out);
2510         return 0;
2511 }
2512
2513 static void rpc_pipe_bind_step_one_done(struct async_req *subreq);
2514 static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
2515                                            struct rpc_pipe_bind_state *state,
2516                                            struct rpc_hdr_info *phdr,
2517                                            prs_struct *reply_pdu);
2518 static void rpc_bind_auth3_write_done(struct async_req *subreq);
2519 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
2520                                                     struct rpc_pipe_bind_state *state,
2521                                                     struct rpc_hdr_info *phdr,
2522                                                     prs_struct *reply_pdu);
2523 static void rpc_bind_ntlmssp_api_done(struct async_req *subreq);
2524
2525 struct async_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
2526                                      struct event_context *ev,
2527                                      struct rpc_pipe_client *cli,
2528                                      struct cli_pipe_auth_data *auth)
2529 {
2530         struct async_req *result, *subreq;
2531         struct rpc_pipe_bind_state *state;
2532         NTSTATUS status;
2533
2534         if (!async_req_setup(mem_ctx, &result, &state,
2535                              struct rpc_pipe_bind_state)) {
2536                 return NULL;
2537         }
2538
2539         DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
2540                 rpccli_pipe_txt(debug_ctx(), cli),
2541                 (unsigned int)auth->auth_type,
2542                 (unsigned int)auth->auth_level ));
2543
2544         state->ev = ev;
2545         state->cli = cli;
2546         state->rpc_call_id = get_rpc_call_id();
2547
2548         prs_init_empty(&state->rpc_out, state, MARSHALL);
2549         talloc_set_destructor(state, rpc_pipe_bind_state_destructor);
2550
2551         cli->auth = talloc_move(cli, &auth);
2552
2553         /* Marshall the outgoing data. */
2554         status = create_rpc_bind_req(cli, &state->rpc_out,
2555                                      state->rpc_call_id,
2556                                      &cli->abstract_syntax,
2557                                      &cli->transfer_syntax,
2558                                      cli->auth->auth_type,
2559                                      cli->auth->auth_level);
2560
2561         if (!NT_STATUS_IS_OK(status)) {
2562                 goto post_status;
2563         }
2564
2565         subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
2566                                    RPC_BINDACK);
2567         if (subreq == NULL) {
2568                 status = NT_STATUS_NO_MEMORY;
2569                 goto post_status;
2570         }
2571         subreq->async.fn = rpc_pipe_bind_step_one_done;
2572         subreq->async.priv = result;
2573         return result;
2574
2575  post_status:
2576         if (async_post_status(result, ev, status)) {
2577                 return result;
2578         }
2579         TALLOC_FREE(result);
2580         return NULL;
2581 }
2582
2583 static void rpc_pipe_bind_step_one_done(struct async_req *subreq)
2584 {
2585         struct async_req *req = talloc_get_type_abort(
2586                 subreq->async.priv, struct async_req);
2587         struct rpc_pipe_bind_state *state = talloc_get_type_abort(
2588                 req->private_data, struct rpc_pipe_bind_state);
2589         prs_struct reply_pdu;
2590         struct rpc_hdr_info hdr;
2591         struct rpc_hdr_ba_info hdr_ba;
2592         NTSTATUS status;
2593
2594         status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2595         TALLOC_FREE(subreq);
2596         if (!NT_STATUS_IS_OK(status)) {
2597                 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
2598                           rpccli_pipe_txt(debug_ctx(), state->cli),
2599                           nt_errstr(status)));
2600                 async_req_error(req, status);
2601                 return;
2602         }
2603
2604         /* Unmarshall the RPC header */
2605         if (!smb_io_rpc_hdr("hdr", &hdr, &reply_pdu, 0)) {
2606                 DEBUG(0, ("rpc_pipe_bind: failed to unmarshall RPC_HDR.\n"));
2607                 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2608                 return;
2609         }
2610
2611         if (!smb_io_rpc_hdr_ba("", &hdr_ba, &reply_pdu, 0)) {
2612                 DEBUG(0, ("rpc_pipe_bind: Failed to unmarshall "
2613                           "RPC_HDR_BA.\n"));
2614                 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2615                 return;
2616         }
2617
2618         if (!check_bind_response(&hdr_ba, &state->cli->transfer_syntax)) {
2619                 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
2620                 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2621                 return;
2622         }
2623
2624         state->cli->max_xmit_frag = hdr_ba.bba.max_tsize;
2625         state->cli->max_recv_frag = hdr_ba.bba.max_rsize;
2626
2627         /*
2628          * For authenticated binds we may need to do 3 or 4 leg binds.
2629          */
2630
2631         switch(state->cli->auth->auth_type) {
2632
2633         case PIPE_AUTH_TYPE_NONE:
2634         case PIPE_AUTH_TYPE_SCHANNEL:
2635                 /* Bind complete. */
2636                 async_req_done(req);
2637                 break;
2638
2639         case PIPE_AUTH_TYPE_NTLMSSP:
2640                 /* Need to send AUTH3 packet - no reply. */
2641                 status = rpc_finish_auth3_bind_send(req, state, &hdr,
2642                                                     &reply_pdu);
2643                 if (!NT_STATUS_IS_OK(status)) {
2644                         async_req_error(req, status);
2645                 }
2646                 break;
2647
2648         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2649                 /* Need to send alter context request and reply. */
2650                 status = rpc_finish_spnego_ntlmssp_bind_send(req, state, &hdr,
2651                                                              &reply_pdu);
2652                 if (!NT_STATUS_IS_OK(status)) {
2653                         async_req_error(req, status);
2654                 }
2655                 break;
2656
2657         case PIPE_AUTH_TYPE_KRB5:
2658                 /* */
2659
2660         default:
2661                 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
2662                          (unsigned int)state->cli->auth->auth_type));
2663                 async_req_error(req, NT_STATUS_INTERNAL_ERROR);
2664         }
2665 }
2666
2667 static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
2668                                            struct rpc_pipe_bind_state *state,
2669                                            struct rpc_hdr_info *phdr,
2670                                            prs_struct *reply_pdu)
2671 {
2672         DATA_BLOB server_response = data_blob_null;
2673         DATA_BLOB client_reply = data_blob_null;
2674         struct rpc_hdr_auth_info hdr_auth;
2675         struct async_req *subreq;
2676         NTSTATUS status;
2677
2678         if ((phdr->auth_len == 0)
2679             || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2680                 return NT_STATUS_INVALID_PARAMETER;
2681         }
2682
2683         if (!prs_set_offset(
2684                     reply_pdu,
2685                     phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2686                 return NT_STATUS_INVALID_PARAMETER;
2687         }
2688
2689         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2690                 return NT_STATUS_INVALID_PARAMETER;
2691         }
2692
2693         /* TODO - check auth_type/auth_level match. */
2694
2695         server_response = data_blob_talloc(talloc_tos(), NULL, phdr->auth_len);
2696         prs_copy_data_out((char *)server_response.data, reply_pdu,
2697                           phdr->auth_len);
2698
2699         status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2700                                 server_response, &client_reply);
2701
2702         if (!NT_STATUS_IS_OK(status)) {
2703                 DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
2704                           "blob failed: %s.\n", nt_errstr(status)));
2705                 return status;
2706         }
2707
2708         prs_init_empty(&state->rpc_out, talloc_tos(), MARSHALL);
2709
2710         status = create_rpc_bind_auth3(state->cli, state->rpc_call_id,
2711                                        state->cli->auth->auth_type,
2712                                        state->cli->auth->auth_level,
2713                                        &client_reply, &state->rpc_out);
2714         data_blob_free(&client_reply);
2715
2716         if (!NT_STATUS_IS_OK(status)) {
2717                 return status;
2718         }
2719
2720         subreq = rpc_write_send(state, state->ev, state->cli->transport,
2721                                 (uint8_t *)prs_data_p(&state->rpc_out),
2722                                 prs_offset(&state->rpc_out));
2723         if (subreq == NULL) {
2724                 return NT_STATUS_NO_MEMORY;
2725         }
2726         subreq->async.fn = rpc_bind_auth3_write_done;
2727         subreq->async.priv = req;
2728         return NT_STATUS_OK;
2729 }
2730
2731 static void rpc_bind_auth3_write_done(struct async_req *subreq)
2732 {
2733         struct async_req *req = talloc_get_type_abort(
2734                 subreq->async.priv, struct async_req);
2735         NTSTATUS status;
2736
2737         status = rpc_write_recv(subreq);
2738         TALLOC_FREE(subreq);
2739         if (!NT_STATUS_IS_OK(status)) {
2740                 async_req_error(req, status);
2741                 return;
2742         }
2743         async_req_done(req);
2744 }
2745
2746 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
2747                                                     struct rpc_pipe_bind_state *state,
2748                                                     struct rpc_hdr_info *phdr,
2749                                                     prs_struct *reply_pdu)
2750 {
2751         DATA_BLOB server_spnego_response = data_blob_null;
2752         DATA_BLOB server_ntlm_response = data_blob_null;
2753         DATA_BLOB client_reply = data_blob_null;
2754         DATA_BLOB tmp_blob = data_blob_null;
2755         RPC_HDR_AUTH hdr_auth;
2756         struct async_req *subreq;
2757         NTSTATUS status;
2758
2759         if ((phdr->auth_len == 0)
2760             || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2761                 return NT_STATUS_INVALID_PARAMETER;
2762         }
2763
2764         /* Process the returned NTLMSSP blob first. */
2765         if (!prs_set_offset(
2766                     reply_pdu,
2767                     phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2768                 return NT_STATUS_INVALID_PARAMETER;
2769         }
2770
2771         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2772                 return NT_STATUS_INVALID_PARAMETER;
2773         }
2774
2775         server_spnego_response = data_blob(NULL, phdr->auth_len);
2776         prs_copy_data_out((char *)server_spnego_response.data,
2777                           reply_pdu, phdr->auth_len);
2778
2779         /*
2780          * The server might give us back two challenges - tmp_blob is for the
2781          * second.
2782          */
2783         if (!spnego_parse_challenge(server_spnego_response,
2784                                     &server_ntlm_response, &tmp_blob)) {
2785                 data_blob_free(&server_spnego_response);
2786                 data_blob_free(&server_ntlm_response);
2787                 data_blob_free(&tmp_blob);
2788                 return NT_STATUS_INVALID_PARAMETER;
2789         }
2790
2791         /* We're finished with the server spnego response and the tmp_blob. */
2792         data_blob_free(&server_spnego_response);
2793         data_blob_free(&tmp_blob);
2794
2795         status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2796                                 server_ntlm_response, &client_reply);
2797
2798         /* Finished with the server_ntlm response */
2799         data_blob_free(&server_ntlm_response);
2800
2801         if (!NT_STATUS_IS_OK(status)) {
2802                 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
2803                           "using server blob failed.\n"));
2804                 data_blob_free(&client_reply);
2805                 return status;
2806         }
2807
2808         /* SPNEGO wrap the client reply. */
2809         tmp_blob = spnego_gen_auth(client_reply);
2810         data_blob_free(&client_reply);
2811         client_reply = tmp_blob;
2812         tmp_blob = data_blob_null;
2813
2814         /* Now prepare the alter context pdu. */
2815         prs_init_empty(&state->rpc_out, state, MARSHALL);
2816
2817         status = create_rpc_alter_context(state->rpc_call_id,
2818                                           &state->cli->abstract_syntax,
2819                                           &state->cli->transfer_syntax,
2820                                           state->cli->auth->auth_level,
2821                                           &client_reply,
2822                                           &state->rpc_out);
2823         data_blob_free(&client_reply);
2824
2825         if (!NT_STATUS_IS_OK(status)) {
2826                 return status;
2827         }
2828
2829         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2830                                    &state->rpc_out, RPC_ALTCONTRESP);
2831         if (subreq == NULL) {
2832                 return NT_STATUS_NO_MEMORY;
2833         }
2834         subreq->async.fn = rpc_bind_ntlmssp_api_done;
2835         subreq->async.priv = req;
2836         return NT_STATUS_OK;
2837 }
2838
2839 static void rpc_bind_ntlmssp_api_done(struct async_req *subreq)
2840 {
2841         struct async_req *req = talloc_get_type_abort(
2842                 subreq->async.priv, struct async_req);
2843         struct rpc_pipe_bind_state *state = talloc_get_type_abort(
2844                 req->private_data, struct rpc_pipe_bind_state);
2845         DATA_BLOB server_spnego_response = data_blob_null;
2846         DATA_BLOB tmp_blob = data_blob_null;
2847         prs_struct reply_pdu;
2848         struct rpc_hdr_info hdr;
2849         struct rpc_hdr_auth_info hdr_auth;
2850         NTSTATUS status;
2851
2852         status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2853         TALLOC_FREE(subreq);
2854         if (!NT_STATUS_IS_OK(status)) {
2855                 async_req_error(req, status);
2856                 return;
2857         }
2858
2859         /* Get the auth blob from the reply. */
2860         if (!smb_io_rpc_hdr("rpc_hdr   ", &hdr, &reply_pdu, 0)) {
2861                 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: Failed to "
2862                           "unmarshall RPC_HDR.\n"));
2863                 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2864                 return;
2865         }
2866
2867         if (!prs_set_offset(
2868                     &reply_pdu,
2869                     hdr.frag_len - hdr.auth_len - RPC_HDR_AUTH_LEN)) {
2870                 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
2871                 return;
2872         }
2873
2874         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &reply_pdu, 0)) {
2875                 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
2876                 return;
2877         }
2878
2879         server_spnego_response = data_blob(NULL, hdr.auth_len);
2880         prs_copy_data_out((char *)server_spnego_response.data, &reply_pdu,
2881                           hdr.auth_len);
2882
2883         /* Check we got a valid auth response. */
2884         if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK,
2885                                         OID_NTLMSSP, &tmp_blob)) {
2886                 data_blob_free(&server_spnego_response);
2887                 data_blob_free(&tmp_blob);
2888                 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
2889                 return;
2890         }
2891
2892         data_blob_free(&server_spnego_response);
2893         data_blob_free(&tmp_blob);
2894
2895         DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
2896                  "%s.\n", rpccli_pipe_txt(debug_ctx(), state->cli)));
2897         async_req_done(req);
2898 }
2899
2900 NTSTATUS rpc_pipe_bind_recv(struct async_req *req)
2901 {
2902         return async_req_simple_recv(req);
2903 }
2904
2905 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
2906                        struct cli_pipe_auth_data *auth)
2907 {
2908         TALLOC_CTX *frame = talloc_stackframe();
2909         struct event_context *ev;
2910         struct async_req *req;
2911         NTSTATUS status = NT_STATUS_NO_MEMORY;
2912
2913         ev = event_context_init(frame);
2914         if (ev == NULL) {
2915                 goto fail;
2916         }
2917
2918         req = rpc_pipe_bind_send(frame, ev, cli, auth);
2919         if (req == NULL) {
2920                 goto fail;
2921         }
2922
2923         while (req->state < ASYNC_REQ_DONE) {
2924                 event_loop_once(ev);
2925         }
2926
2927         status = rpc_pipe_bind_recv(req);
2928  fail:
2929         TALLOC_FREE(frame);
2930         return status;
2931 }
2932
2933 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
2934                                 unsigned int timeout)
2935 {
2936         struct cli_state *cli = rpc_pipe_np_smb_conn(rpc_cli);
2937
2938         if (cli == NULL) {
2939                 return 0;
2940         }
2941         return cli_set_timeout(cli, timeout);
2942 }
2943
2944 bool rpccli_get_pwd_hash(struct rpc_pipe_client *rpc_cli, uint8_t nt_hash[16])
2945 {
2946         struct cli_state *cli;
2947
2948         if ((rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_NTLMSSP)
2949             || (rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP)) {
2950                 memcpy(nt_hash, rpc_cli->auth->a_u.ntlmssp_state->nt_hash, 16);
2951                 return true;
2952         }
2953
2954         cli = rpc_pipe_np_smb_conn(rpc_cli);
2955         if (cli == NULL) {
2956                 return false;
2957         }
2958         E_md4hash(cli->pwd.password, nt_hash);
2959         return true;
2960 }
2961
2962 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2963                                struct cli_pipe_auth_data **presult)
2964 {
2965         struct cli_pipe_auth_data *result;
2966
2967         result = talloc(mem_ctx, struct cli_pipe_auth_data);
2968         if (result == NULL) {
2969                 return NT_STATUS_NO_MEMORY;
2970         }
2971
2972         result->auth_type = PIPE_AUTH_TYPE_NONE;
2973         result->auth_level = PIPE_AUTH_LEVEL_NONE;
2974
2975         result->user_name = talloc_strdup(result, "");
2976         result->domain = talloc_strdup(result, "");
2977         if ((result->user_name == NULL) || (result->domain == NULL)) {
2978                 TALLOC_FREE(result);
2979                 return NT_STATUS_NO_MEMORY;
2980         }
2981
2982         *presult = result;
2983         return NT_STATUS_OK;
2984 }
2985
2986 static int cli_auth_ntlmssp_data_destructor(struct cli_pipe_auth_data *auth)
2987 {
2988         ntlmssp_end(&auth->a_u.ntlmssp_state);
2989         return 0;
2990 }
2991
2992 NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
2993                                   enum pipe_auth_type auth_type,
2994                                   enum pipe_auth_level auth_level,
2995                                   const char *domain,
2996                                   const char *username,
2997                                   const char *password,
2998                                   struct cli_pipe_auth_data **presult)
2999 {
3000         struct cli_pipe_auth_data *result;
3001         NTSTATUS status;
3002
3003         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3004         if (result == NULL) {
3005                 return NT_STATUS_NO_MEMORY;
3006         }
3007
3008         result->auth_type = auth_type;
3009         result->auth_level = auth_level;
3010
3011         result->user_name = talloc_strdup(result, username);
3012         result->domain = talloc_strdup(result, domain);
3013         if ((result->user_name == NULL) || (result->domain == NULL)) {
3014                 status = NT_STATUS_NO_MEMORY;
3015                 goto fail;
3016         }
3017
3018         status = ntlmssp_client_start(&result->a_u.ntlmssp_state);
3019         if (!NT_STATUS_IS_OK(status)) {
3020                 goto fail;
3021         }
3022
3023         talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
3024
3025         status = ntlmssp_set_username(result->a_u.ntlmssp_state, username);
3026         if (!NT_STATUS_IS_OK(status)) {
3027                 goto fail;
3028         }
3029
3030         status = ntlmssp_set_domain(result->a_u.ntlmssp_state, domain);
3031         if (!NT_STATUS_IS_OK(status)) {
3032                 goto fail;
3033         }
3034
3035         status = ntlmssp_set_password(result->a_u.ntlmssp_state, password);
3036         if (!NT_STATUS_IS_OK(status)) {
3037                 goto fail;
3038         }
3039
3040         /*
3041          * Turn off sign+seal to allow selected auth level to turn it back on.
3042          */
3043         result->a_u.ntlmssp_state->neg_flags &=
3044                 ~(NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL);
3045
3046         if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
3047                 result->a_u.ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
3048         } else if (auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
3049                 result->a_u.ntlmssp_state->neg_flags
3050                         |= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
3051         }
3052
3053         *presult = result;
3054         return NT_STATUS_OK;
3055
3056  fail:
3057         TALLOC_FREE(result);
3058         return status;
3059 }
3060
3061 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
3062                                    enum pipe_auth_level auth_level,
3063                                    const uint8_t sess_key[16],
3064                                    struct cli_pipe_auth_data **presult)
3065 {
3066         struct cli_pipe_auth_data *result;
3067
3068         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3069         if (result == NULL) {
3070                 return NT_STATUS_NO_MEMORY;
3071         }
3072
3073         result->auth_type = PIPE_AUTH_TYPE_SCHANNEL;
3074         result->auth_level = auth_level;
3075
3076         result->user_name = talloc_strdup(result, "");
3077         result->domain = talloc_strdup(result, domain);
3078         if ((result->user_name == NULL) || (result->domain == NULL)) {
3079                 goto fail;
3080         }
3081
3082         result->a_u.schannel_auth = talloc(result,
3083                                            struct schannel_auth_struct);
3084         if (result->a_u.schannel_auth == NULL) {
3085                 goto fail;
3086         }
3087
3088         memcpy(result->a_u.schannel_auth->sess_key, sess_key,
3089                sizeof(result->a_u.schannel_auth->sess_key));
3090         result->a_u.schannel_auth->seq_num = 0;
3091
3092         *presult = result;
3093         return NT_STATUS_OK;
3094
3095  fail:
3096         TALLOC_FREE(result);
3097         return NT_STATUS_NO_MEMORY;
3098 }
3099
3100 #ifdef HAVE_KRB5
3101 static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
3102 {
3103         data_blob_free(&auth->session_key);
3104         return 0;
3105 }
3106 #endif
3107
3108 NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
3109                                    enum pipe_auth_level auth_level,
3110                                    const char *service_princ,
3111                                    const char *username,
3112                                    const char *password,
3113                                    struct cli_pipe_auth_data **presult)
3114 {
3115 #ifdef HAVE_KRB5
3116         struct cli_pipe_auth_data *result;
3117
3118         if ((username != NULL) && (password != NULL)) {
3119                 int ret = kerberos_kinit_password(username, password, 0, NULL);
3120                 if (ret != 0) {
3121                         return NT_STATUS_ACCESS_DENIED;
3122                 }
3123         }
3124
3125         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3126         if (result == NULL) {
3127                 return NT_STATUS_NO_MEMORY;
3128         }
3129
3130         result->auth_type = PIPE_AUTH_TYPE_KRB5;
3131         result->auth_level = auth_level;
3132
3133         /*
3134          * Username / domain need fixing!
3135          */
3136         result->user_name = talloc_strdup(result, "");
3137         result->domain = talloc_strdup(result, "");
3138         if ((result->user_name == NULL) || (result->domain == NULL)) {
3139                 goto fail;
3140         }
3141
3142         result->a_u.kerberos_auth = TALLOC_ZERO_P(
3143                 result, struct kerberos_auth_struct);
3144         if (result->a_u.kerberos_auth == NULL) {
3145                 goto fail;
3146         }
3147         talloc_set_destructor(result->a_u.kerberos_auth,
3148                               cli_auth_kerberos_data_destructor);
3149
3150         result->a_u.kerberos_auth->service_principal = talloc_strdup(
3151                 result, service_princ);
3152         if (result->a_u.kerberos_auth->service_principal == NULL) {
3153                 goto fail;
3154         }
3155
3156         *presult = result;
3157         return NT_STATUS_OK;
3158
3159  fail:
3160         TALLOC_FREE(result);
3161         return NT_STATUS_NO_MEMORY;
3162 #else
3163         return NT_STATUS_NOT_SUPPORTED;
3164 #endif
3165 }
3166
3167 /**
3168  * Create an rpc pipe client struct, connecting to a tcp port.
3169  */
3170 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
3171                                        uint16_t port,
3172                                        const struct ndr_syntax_id *abstract_syntax,
3173                                        struct rpc_pipe_client **presult)
3174 {
3175         struct rpc_pipe_client *result;
3176         struct sockaddr_storage addr;
3177         NTSTATUS status;
3178         int fd;
3179
3180         result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
3181         if (result == NULL) {
3182                 return NT_STATUS_NO_MEMORY;
3183         }
3184
3185         result->abstract_syntax = *abstract_syntax;
3186         result->transfer_syntax = ndr_transfer_syntax;
3187         result->dispatch = cli_do_rpc_ndr;
3188
3189         result->desthost = talloc_strdup(result, host);
3190         result->srv_name_slash = talloc_asprintf_strupper_m(
3191                 result, "\\\\%s", result->desthost);
3192         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3193                 status = NT_STATUS_NO_MEMORY;
3194                 goto fail;
3195         }
3196
3197         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3198         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3199
3200         if (!resolve_name(host, &addr, 0)) {
3201                 status = NT_STATUS_NOT_FOUND;
3202                 goto fail;
3203         }
3204
3205         status = open_socket_out(&addr, port, 60, &fd);
3206         if (!NT_STATUS_IS_OK(status)) {
3207                 goto fail;
3208         }
3209         set_socket_options(fd, lp_socket_options());
3210
3211         status = rpc_transport_sock_init(result, fd, &result->transport);
3212         if (!NT_STATUS_IS_OK(status)) {
3213                 close(fd);
3214                 goto fail;
3215         }
3216
3217         *presult = result;
3218         return NT_STATUS_OK;
3219
3220  fail:
3221         TALLOC_FREE(result);
3222         return status;
3223 }
3224
3225 /**
3226  * Determine the tcp port on which a dcerpc interface is listening
3227  * for the ncacn_ip_tcp transport via the endpoint mapper of the
3228  * target host.
3229  */
3230 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
3231                                       const struct ndr_syntax_id *abstract_syntax,
3232                                       uint16_t *pport)
3233 {
3234         NTSTATUS status;
3235         struct rpc_pipe_client *epm_pipe = NULL;
3236         struct cli_pipe_auth_data *auth = NULL;
3237         struct dcerpc_binding *map_binding = NULL;
3238         struct dcerpc_binding *res_binding = NULL;
3239         struct epm_twr_t *map_tower = NULL;
3240         struct epm_twr_t *res_towers = NULL;
3241         struct policy_handle *entry_handle = NULL;
3242         uint32_t num_towers = 0;
3243         uint32_t max_towers = 1;
3244         struct epm_twr_p_t towers;
3245         TALLOC_CTX *tmp_ctx = talloc_stackframe();
3246
3247         if (pport == NULL) {
3248                 status = NT_STATUS_INVALID_PARAMETER;
3249                 goto done;
3250         }
3251
3252         /* open the connection to the endpoint mapper */
3253         status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
3254                                         &ndr_table_epmapper.syntax_id,
3255                                         &epm_pipe);
3256
3257         if (!NT_STATUS_IS_OK(status)) {
3258                 goto done;
3259         }
3260
3261         status = rpccli_anon_bind_data(tmp_ctx, &auth);
3262         if (!NT_STATUS_IS_OK(status)) {
3263                 goto done;
3264         }
3265
3266         status = rpc_pipe_bind(epm_pipe, auth);
3267         if (!NT_STATUS_IS_OK(status)) {
3268                 goto done;
3269         }
3270
3271         /* create tower for asking the epmapper */
3272
3273         map_binding = TALLOC_ZERO_P(tmp_ctx, struct dcerpc_binding);
3274         if (map_binding == NULL) {
3275                 status = NT_STATUS_NO_MEMORY;
3276                 goto done;
3277         }
3278
3279         map_binding->transport = NCACN_IP_TCP;
3280         map_binding->object = *abstract_syntax;
3281         map_binding->host = host; /* needed? */
3282         map_binding->endpoint = "0"; /* correct? needed? */
3283
3284         map_tower = TALLOC_ZERO_P(tmp_ctx, struct epm_twr_t);
3285         if (map_tower == NULL) {
3286                 status = NT_STATUS_NO_MEMORY;
3287                 goto done;
3288         }
3289
3290         status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
3291                                             &(map_tower->tower));
3292         if (!NT_STATUS_IS_OK(status)) {
3293                 goto done;
3294         }
3295
3296         /* allocate further parameters for the epm_Map call */
3297
3298         res_towers = TALLOC_ARRAY(tmp_ctx, struct epm_twr_t, max_towers);
3299         if (res_towers == NULL) {
3300                 status = NT_STATUS_NO_MEMORY;
3301                 goto done;
3302         }
3303         towers.twr = res_towers;
3304
3305         entry_handle = TALLOC_ZERO_P(tmp_ctx, struct policy_handle);
3306         if (entry_handle == NULL) {
3307                 status = NT_STATUS_NO_MEMORY;
3308                 goto done;
3309         }
3310
3311         /* ask the endpoint mapper for the port */
3312
3313         status = rpccli_epm_Map(epm_pipe,
3314                                 tmp_ctx,
3315                                 CONST_DISCARD(struct GUID *,
3316                                               &(abstract_syntax->uuid)),
3317                                 map_tower,
3318                                 entry_handle,
3319                                 max_towers,
3320                                 &num_towers,
3321                                 &towers);
3322
3323         if (!NT_STATUS_IS_OK(status)) {
3324                 goto done;
3325         }
3326
3327         if (num_towers != 1) {
3328                 status = NT_STATUS_UNSUCCESSFUL;
3329                 goto done;
3330         }
3331
3332         /* extract the port from the answer */
3333
3334         status = dcerpc_binding_from_tower(tmp_ctx,
3335                                            &(towers.twr->tower),
3336                                            &res_binding);
3337         if (!NT_STATUS_IS_OK(status)) {
3338                 goto done;
3339         }
3340
3341         /* are further checks here necessary? */
3342         if (res_binding->transport != NCACN_IP_TCP) {
3343                 status = NT_STATUS_UNSUCCESSFUL;
3344                 goto done;
3345         }
3346
3347         *pport = (uint16_t)atoi(res_binding->endpoint);
3348
3349 done:
3350         TALLOC_FREE(tmp_ctx);
3351         return status;
3352 }
3353
3354 /**
3355  * Create a rpc pipe client struct, connecting to a host via tcp.
3356  * The port is determined by asking the endpoint mapper on the given
3357  * host.
3358  */
3359 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
3360                            const struct ndr_syntax_id *abstract_syntax,
3361                            struct rpc_pipe_client **presult)
3362 {
3363         NTSTATUS status;
3364         uint16_t port = 0;
3365
3366         *presult = NULL;
3367
3368         status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
3369         if (!NT_STATUS_IS_OK(status)) {
3370                 goto done;
3371         }
3372
3373         status = rpc_pipe_open_tcp_port(mem_ctx, host, port,
3374                                         abstract_syntax, presult);
3375
3376 done:
3377         return status;
3378 }
3379
3380 /********************************************************************
3381  Create a rpc pipe client struct, connecting to a unix domain socket
3382  ********************************************************************/
3383 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
3384                                const struct ndr_syntax_id *abstract_syntax,
3385                                struct rpc_pipe_client **presult)
3386 {
3387         struct rpc_pipe_client *result;
3388         struct sockaddr_un addr;
3389         NTSTATUS status;
3390         int fd;
3391
3392         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
3393         if (result == NULL) {
3394                 return NT_STATUS_NO_MEMORY;
3395         }
3396
3397         result->abstract_syntax = *abstract_syntax;
3398         result->transfer_syntax = ndr_transfer_syntax;
3399         result->dispatch = cli_do_rpc_ndr;
3400
3401         result->desthost = talloc_get_myname(result);
3402         result->srv_name_slash = talloc_asprintf_strupper_m(
3403                 result, "\\\\%s", result->desthost);
3404         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3405                 status = NT_STATUS_NO_MEMORY;
3406                 goto fail;
3407         }
3408
3409         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3410         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3411
3412         fd = socket(AF_UNIX, SOCK_STREAM, 0);
3413         if (fd == -1) {
3414                 status = map_nt_error_from_unix(errno);
3415                 goto fail;
3416         }
3417
3418         ZERO_STRUCT(addr);
3419         addr.sun_family = AF_UNIX;
3420         strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
3421
3422         if (sys_connect(fd, (struct sockaddr *)&addr) == -1) {
3423                 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
3424                           strerror(errno)));
3425                 close(fd);
3426                 return map_nt_error_from_unix(errno);
3427         }
3428
3429         status = rpc_transport_sock_init(result, fd, &result->transport);
3430         if (!NT_STATUS_IS_OK(status)) {
3431                 close(fd);
3432                 goto fail;
3433         }
3434
3435         *presult = result;
3436         return NT_STATUS_OK;
3437
3438  fail:
3439         TALLOC_FREE(result);
3440         return status;
3441 }
3442
3443 static int rpc_pipe_client_np_destructor(struct rpc_pipe_client *p)
3444 {
3445         struct cli_state *cli;
3446
3447         cli = rpc_pipe_np_smb_conn(p);
3448         if (cli != NULL) {
3449                 DLIST_REMOVE(cli->pipe_list, p);
3450         }
3451         return 0;
3452 }
3453
3454 /****************************************************************************
3455  Open a named pipe over SMB to a remote server.
3456  *
3457  * CAVEAT CALLER OF THIS FUNCTION:
3458  *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
3459  *    so be sure that this function is called AFTER any structure (vs pointer)
3460  *    assignment of the cli.  In particular, libsmbclient does structure
3461  *    assignments of cli, which invalidates the data in the returned
3462  *    rpc_pipe_client if this function is called before the structure assignment
3463  *    of cli.
3464  *
3465  ****************************************************************************/
3466
3467 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
3468                                  const struct ndr_syntax_id *abstract_syntax,
3469                                  struct rpc_pipe_client **presult)
3470 {
3471         struct rpc_pipe_client *result;
3472         NTSTATUS status;
3473
3474         /* sanity check to protect against crashes */
3475
3476         if ( !cli ) {
3477                 return NT_STATUS_INVALID_HANDLE;
3478         }
3479
3480         result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
3481         if (result == NULL) {
3482                 return NT_STATUS_NO_MEMORY;
3483         }
3484
3485         result->abstract_syntax = *abstract_syntax;
3486         result->transfer_syntax = ndr_transfer_syntax;
3487         result->dispatch = cli_do_rpc_ndr;
3488         result->desthost = talloc_strdup(result, cli->desthost);
3489         result->srv_name_slash = talloc_asprintf_strupper_m(
3490                 result, "\\\\%s", result->desthost);
3491
3492         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3493         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3494
3495         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3496                 TALLOC_FREE(result);
3497                 return NT_STATUS_NO_MEMORY;
3498         }
3499
3500         status = rpc_transport_np_init(result, cli, abstract_syntax,
3501                                        &result->transport);
3502         if (!NT_STATUS_IS_OK(status)) {
3503                 TALLOC_FREE(result);
3504                 return status;
3505         }
3506
3507         DLIST_ADD(cli->pipe_list, result);
3508         talloc_set_destructor(result, rpc_pipe_client_np_destructor);
3509
3510         *presult = result;
3511         return NT_STATUS_OK;
3512 }
3513
3514 /****************************************************************************
3515  Open a pipe to a remote server.
3516  ****************************************************************************/
3517
3518 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3519                                   const struct ndr_syntax_id *interface,
3520                                   struct rpc_pipe_client **presult)
3521 {
3522         if (ndr_syntax_id_equal(interface, &ndr_table_drsuapi.syntax_id)) {
3523                 /*
3524                  * We should have a better way to figure out this drsuapi
3525                  * speciality...
3526                  */
3527                 return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
3528                                          presult);
3529         }
3530
3531         return rpc_pipe_open_np(cli, interface, presult);
3532 }
3533
3534 /****************************************************************************
3535  Open a named pipe to an SMB server and bind anonymously.
3536  ****************************************************************************/
3537
3538 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3539                                   const struct ndr_syntax_id *interface,
3540                                   struct rpc_pipe_client **presult)
3541 {
3542         struct rpc_pipe_client *result;
3543         struct cli_pipe_auth_data *auth;
3544         NTSTATUS status;
3545
3546         status = cli_rpc_pipe_open(cli, interface, &result);
3547         if (!NT_STATUS_IS_OK(status)) {
3548                 return status;
3549         }
3550
3551         status = rpccli_anon_bind_data(result, &auth);
3552         if (!NT_STATUS_IS_OK(status)) {
3553                 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3554                           nt_errstr(status)));
3555                 TALLOC_FREE(result);
3556                 return status;
3557         }
3558
3559         /*
3560          * This is a bit of an abstraction violation due to the fact that an
3561          * anonymous bind on an authenticated SMB inherits the user/domain
3562          * from the enclosing SMB creds
3563          */
3564
3565         TALLOC_FREE(auth->user_name);
3566         TALLOC_FREE(auth->domain);
3567
3568         auth->user_name = talloc_strdup(auth, cli->user_name);
3569         auth->domain = talloc_strdup(auth, cli->domain);
3570         auth->user_session_key = data_blob_talloc(auth,
3571                 cli->user_session_key.data,
3572                 cli->user_session_key.length);
3573
3574         if ((auth->user_name == NULL) || (auth->domain == NULL)) {
3575                 TALLOC_FREE(result);
3576                 return NT_STATUS_NO_MEMORY;
3577         }
3578
3579         status = rpc_pipe_bind(result, auth);
3580         if (!NT_STATUS_IS_OK(status)) {
3581                 int lvl = 0;
3582                 if (ndr_syntax_id_equal(interface,
3583                                         &ndr_table_dssetup.syntax_id)) {
3584                         /* non AD domains just don't have this pipe, avoid
3585                          * level 0 statement in that case - gd */
3586                         lvl = 3;
3587                 }
3588                 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3589                             "%s failed with error %s\n",
3590                             cli_get_pipe_name_from_iface(debug_ctx(),
3591                                                          interface),
3592                             nt_errstr(status) ));
3593                 TALLOC_FREE(result);
3594                 return status;
3595         }
3596
3597         DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3598                   "%s and bound anonymously.\n",
3599                   cli_get_pipe_name_from_iface(debug_ctx(), interface),
3600                   cli->desthost ));
3601
3602         *presult = result;
3603         return NT_STATUS_OK;
3604 }
3605
3606 /****************************************************************************
3607  Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
3608  ****************************************************************************/
3609
3610 static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
3611                                                    const struct ndr_syntax_id *interface,
3612                                                    enum pipe_auth_type auth_type,
3613                                                    enum pipe_auth_level auth_level,
3614                                                    const char *domain,
3615                                                    const char *username,
3616                                                    const char *password,
3617                                                    struct rpc_pipe_client **presult)
3618 {
3619         struct rpc_pipe_client *result;
3620         struct cli_pipe_auth_data *auth;
3621         NTSTATUS status;
3622
3623         status = cli_rpc_pipe_open(cli, interface, &result);
3624         if (!NT_STATUS_IS_OK(status)) {
3625                 return status;
3626         }
3627
3628         status = rpccli_ntlmssp_bind_data(
3629                 result, auth_type, auth_level, domain, username,
3630                 cli->pwd.null_pwd ? NULL : password, &auth);
3631         if (!NT_STATUS_IS_OK(status)) {
3632                 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
3633                           nt_errstr(status)));
3634                 goto err;
3635         }
3636
3637         status = rpc_pipe_bind(result, auth);
3638         if (!NT_STATUS_IS_OK(status)) {
3639                 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
3640                         nt_errstr(status) ));
3641                 goto err;
3642         }
3643
3644         DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
3645                 "machine %s and bound NTLMSSP as user %s\\%s.\n",
3646                   cli_get_pipe_name_from_iface(debug_ctx(), interface),
3647                   cli->desthost, domain, username ));
3648
3649         *presult = result;
3650         return NT_STATUS_OK;
3651
3652   err:
3653
3654         TALLOC_FREE(result);
3655         return status;
3656 }
3657
3658 /****************************************************************************
3659  External interface.
3660  Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
3661  ****************************************************************************/
3662
3663 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
3664                                    const struct ndr_syntax_id *interface,
3665                                    enum pipe_auth_level auth_level,
3666                                    const char *domain,
3667                                    const char *username,
3668                                    const char *password,
3669                                    struct rpc_pipe_client **presult)
3670 {
3671         return cli_rpc_pipe_open_ntlmssp_internal(cli,
3672                                                 interface,
3673                                                 PIPE_AUTH_TYPE_NTLMSSP,
3674                                                 auth_level,
3675                                                 domain,
3676                                                 username,
3677                                                 password,
3678                                                 presult);
3679 }
3680
3681 /****************************************************************************
3682  External interface.
3683  Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
3684  ****************************************************************************/
3685
3686 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
3687                                           const struct ndr_syntax_id *interface,
3688                                           enum pipe_auth_level auth_level,
3689                                           const char *domain,
3690                                           const char *username,
3691                                           const char *password,
3692                                           struct rpc_pipe_client **presult)
3693 {
3694         return cli_rpc_pipe_open_ntlmssp_internal(cli,
3695                                                 interface,
3696                                                 PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
3697                                                 auth_level,
3698                                                 domain,
3699                                                 username,
3700                                                 password,
3701                                                 presult);
3702 }
3703
3704 /****************************************************************************
3705   Get a the schannel session key out of an already opened netlogon pipe.
3706  ****************************************************************************/
3707 static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
3708                                                 struct cli_state *cli,
3709                                                 const char *domain,
3710                                                 uint32 *pneg_flags)
3711 {
3712         uint32 sec_chan_type = 0;
3713         unsigned char machine_pwd[16];
3714         const char *machine_account;
3715         NTSTATUS status;
3716
3717         /* Get the machine account credentials from secrets.tdb. */
3718         if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
3719                                &sec_chan_type))
3720         {
3721                 DEBUG(0, ("get_schannel_session_key: could not fetch "
3722                         "trust account password for domain '%s'\n",
3723                         domain));
3724                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3725         }
3726
3727         status = rpccli_netlogon_setup_creds(netlogon_pipe,
3728                                         cli->desthost, /* server name */
3729                                         domain,        /* domain */
3730                                         global_myname(), /* client name */
3731                                         machine_account, /* machine account name */
3732                                         machine_pwd,
3733                                         sec_chan_type,
3734                                         pneg_flags);
3735
3736         if (!NT_STATUS_IS_OK(status)) {
3737                 DEBUG(3, ("get_schannel_session_key_common: "
3738                           "rpccli_netlogon_setup_creds failed with result %s "
3739                           "to server %s, domain %s, machine account %s.\n",
3740                           nt_errstr(status), cli->desthost, domain,
3741                           machine_account ));
3742                 return status;
3743         }
3744
3745         if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
3746                 DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
3747                         cli->desthost));
3748                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3749         }
3750
3751         return NT_STATUS_OK;;
3752 }
3753
3754 /****************************************************************************
3755  Open a netlogon pipe and get the schannel session key.
3756  Now exposed to external callers.
3757  ****************************************************************************/
3758
3759
3760 NTSTATUS get_schannel_session_key(struct cli_state *cli,
3761                                   const char *domain,
3762                                   uint32 *pneg_flags,
3763                                   struct rpc_pipe_client **presult)
3764 {
3765         struct rpc_pipe_client *netlogon_pipe = NULL;
3766         NTSTATUS status;
3767
3768         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
3769                                           &netlogon_pipe);
3770         if (!NT_STATUS_IS_OK(status)) {
3771                 return status;
3772         }
3773
3774         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3775                                                  pneg_flags);
3776         if (!NT_STATUS_IS_OK(status)) {
3777                 TALLOC_FREE(netlogon_pipe);
3778                 return status;
3779         }
3780
3781         *presult = netlogon_pipe;
3782         return NT_STATUS_OK;
3783 }
3784
3785 /****************************************************************************
3786  External interface.
3787  Open a named pipe to an SMB server and bind using schannel (bind type 68)
3788  using session_key. sign and seal.
3789  ****************************************************************************/
3790
3791 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
3792                                              const struct ndr_syntax_id *interface,
3793                                              enum pipe_auth_level auth_level,
3794                                              const char *domain,
3795                                              const struct dcinfo *pdc,
3796                                              struct rpc_pipe_client **presult)
3797 {
3798         struct rpc_pipe_client *result;
3799         struct cli_pipe_auth_data *auth;
3800         NTSTATUS status;
3801
3802         status = cli_rpc_pipe_open(cli, interface, &result);
3803         if (!NT_STATUS_IS_OK(status)) {
3804                 return status;
3805         }
3806
3807         status = rpccli_schannel_bind_data(result, domain, auth_level,
3808                                            pdc->sess_key, &auth);
3809         if (!NT_STATUS_IS_OK(status)) {
3810                 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3811                           nt_errstr(status)));
3812                 TALLOC_FREE(result);
3813                 return status;
3814         }
3815
3816         status = rpc_pipe_bind(result, auth);
3817         if (!NT_STATUS_IS_OK(status)) {
3818                 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
3819                           "cli_rpc_pipe_bind failed with error %s\n",
3820                           nt_errstr(status) ));
3821                 TALLOC_FREE(result);
3822                 return status;
3823         }
3824
3825         /*
3826          * The credentials on a new netlogon pipe are the ones we are passed
3827          * in - copy them over.
3828          */
3829         result->dc = (struct dcinfo *)talloc_memdup(result, pdc, sizeof(*pdc));
3830         if (result->dc == NULL) {
3831                 DEBUG(0, ("talloc failed\n"));
3832                 TALLOC_FREE(result);
3833                 return NT_STATUS_NO_MEMORY;
3834         }
3835
3836         DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
3837                   "for domain %s and bound using schannel.\n",
3838                   cli_get_pipe_name_from_iface(debug_ctx(), interface),
3839                   cli->desthost, domain ));
3840
3841         *presult = result;
3842         return NT_STATUS_OK;
3843 }
3844
3845 /****************************************************************************
3846  Open a named pipe to an SMB server and bind using schannel (bind type 68).
3847  Fetch the session key ourselves using a temporary netlogon pipe. This
3848  version uses an ntlmssp auth bound netlogon pipe to get the key.
3849  ****************************************************************************/
3850
3851 static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
3852                                                       const char *domain,
3853                                                       const char *username,
3854                                                       const char *password,
3855                                                       uint32 *pneg_flags,
3856                                                       struct rpc_pipe_client **presult)
3857 {
3858         struct rpc_pipe_client *netlogon_pipe = NULL;
3859         NTSTATUS status;
3860
3861         status = cli_rpc_pipe_open_spnego_ntlmssp(
3862                 cli, &ndr_table_netlogon.syntax_id, PIPE_AUTH_LEVEL_PRIVACY,
3863                 domain, username, password, &netlogon_pipe);
3864         if (!NT_STATUS_IS_OK(status)) {
3865                 return status;
3866         }
3867
3868         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3869                                                  pneg_flags);
3870         if (!NT_STATUS_IS_OK(status)) {
3871                 TALLOC_FREE(netlogon_pipe);
3872                 return status;
3873         }
3874
3875         *presult = netlogon_pipe;
3876         return NT_STATUS_OK;
3877 }
3878
3879 /****************************************************************************
3880  Open a named pipe to an SMB server and bind using schannel (bind type 68).
3881  Fetch the session key ourselves using a temporary netlogon pipe. This version
3882  uses an ntlmssp bind to get the session key.
3883  ****************************************************************************/
3884
3885 NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
3886                                                  const struct ndr_syntax_id *interface,
3887                                                  enum pipe_auth_level auth_level,
3888                                                  const char *domain,
3889                                                  const char *username,
3890                                                  const char *password,
3891                                                  struct rpc_pipe_client **presult)
3892 {
3893         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
3894         struct rpc_pipe_client *netlogon_pipe = NULL;
3895         struct rpc_pipe_client *result = NULL;
3896         NTSTATUS status;
3897
3898         status = get_schannel_session_key_auth_ntlmssp(
3899                 cli, domain, username, password, &neg_flags, &netlogon_pipe);
3900         if (!NT_STATUS_IS_OK(status)) {
3901                 DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
3902                         "key from server %s for domain %s.\n",
3903                         cli->desthost, domain ));
3904                 return status;
3905         }
3906
3907         status = cli_rpc_pipe_open_schannel_with_key(
3908                 cli, interface, auth_level, domain, netlogon_pipe->dc,
3909                 &result);
3910
3911         /* Now we've bound using the session key we can close the netlog pipe. */
3912         TALLOC_FREE(netlogon_pipe);
3913
3914         if (NT_STATUS_IS_OK(status)) {
3915                 *presult = result;
3916         }
3917         return status;
3918 }
3919
3920 /****************************************************************************
3921  Open a named pipe to an SMB server and bind using schannel (bind type 68).
3922  Fetch the session key ourselves using a temporary netlogon pipe.
3923  ****************************************************************************/
3924
3925 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
3926                                     const struct ndr_syntax_id *interface,
3927                                     enum pipe_auth_level auth_level,
3928                                     const char *domain,
3929                                     struct rpc_pipe_client **presult)
3930 {
3931         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
3932         struct rpc_pipe_client *netlogon_pipe = NULL;
3933         struct rpc_pipe_client *result = NULL;
3934         NTSTATUS status;
3935
3936         status = get_schannel_session_key(cli, domain, &neg_flags,
3937                                           &netlogon_pipe);
3938         if (!NT_STATUS_IS_OK(status)) {
3939                 DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
3940                         "key from server %s for domain %s.\n",
3941                         cli->desthost, domain ));
3942                 return status;
3943         }
3944
3945         status = cli_rpc_pipe_open_schannel_with_key(
3946                 cli, interface, auth_level, domain, netlogon_pipe->dc,
3947                 &result);
3948
3949         /* Now we've bound using the session key we can close the netlog pipe. */
3950         TALLOC_FREE(netlogon_pipe);
3951
3952         if (NT_STATUS_IS_OK(status)) {
3953                 *presult = result;
3954         }
3955
3956         return NT_STATUS_OK;
3957 }
3958
3959 /****************************************************************************
3960  Open a named pipe to an SMB server and bind using krb5 (bind type 16).
3961  The idea is this can be called with service_princ, username and password all
3962  NULL so long as the caller has a TGT.
3963  ****************************************************************************/
3964
3965 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
3966                                 const struct ndr_syntax_id *interface,
3967                                 enum pipe_auth_level auth_level,
3968                                 const char *service_princ,
3969                                 const char *username,
3970                                 const char *password,
3971                                 struct rpc_pipe_client **presult)
3972 {
3973 #ifdef HAVE_KRB5
3974         struct rpc_pipe_client *result;
3975         struct cli_pipe_auth_data *auth;
3976         NTSTATUS status;
3977
3978         status = cli_rpc_pipe_open(cli, interface, &result);
3979         if (!NT_STATUS_IS_OK(status)) {
3980                 return status;
3981         }
3982
3983         status = rpccli_kerberos_bind_data(result, auth_level, service_princ,
3984                                            username, password, &auth);
3985         if (!NT_STATUS_IS_OK(status)) {
3986                 DEBUG(0, ("rpccli_kerberos_bind_data returned %s\n",
3987                           nt_errstr(status)));
3988                 TALLOC_FREE(result);
3989                 return status;
3990         }
3991
3992         status = rpc_pipe_bind(result, auth);
3993         if (!NT_STATUS_IS_OK(status)) {
3994                 DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
3995                           "with error %s\n", nt_errstr(status)));
3996                 TALLOC_FREE(result);
3997                 return status;
3998         }
3999
4000         *presult = result;
4001         return NT_STATUS_OK;
4002 #else
4003         DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
4004         return NT_STATUS_NOT_IMPLEMENTED;
4005 #endif
4006 }
4007
4008 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
4009                              struct rpc_pipe_client *cli,
4010                              DATA_BLOB *session_key)
4011 {
4012         if (!session_key || !cli) {
4013                 return NT_STATUS_INVALID_PARAMETER;
4014         }
4015
4016         if (!cli->auth) {
4017                 return NT_STATUS_INVALID_PARAMETER;
4018         }
4019
4020         switch (cli->auth->auth_type) {
4021                 case PIPE_AUTH_TYPE_SCHANNEL:
4022                         *session_key = data_blob_talloc(mem_ctx,
4023                                 cli->auth->a_u.schannel_auth->sess_key, 16);
4024                         break;
4025                 case PIPE_AUTH_TYPE_NTLMSSP:
4026                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
4027                         *session_key = data_blob_talloc(mem_ctx,
4028                                 cli->auth->a_u.ntlmssp_state->session_key.data,
4029                                 cli->auth->a_u.ntlmssp_state->session_key.length);
4030                         break;
4031                 case PIPE_AUTH_TYPE_KRB5:
4032                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
4033                         *session_key = data_blob_talloc(mem_ctx,
4034                                 cli->auth->a_u.kerberos_auth->session_key.data,
4035                                 cli->auth->a_u.kerberos_auth->session_key.length);
4036                         break;
4037                 case PIPE_AUTH_TYPE_NONE:
4038                         *session_key = data_blob_talloc(mem_ctx,
4039                                 cli->auth->user_session_key.data,
4040                                 cli->auth->user_session_key.length);
4041                         break;
4042                 default:
4043                         return NT_STATUS_NO_USER_SESSION_KEY;
4044         }
4045
4046         return NT_STATUS_OK;
4047 }
4048
4049 /**
4050  * Create a new RPC client context which uses a local dispatch function.
4051  */
4052 NTSTATUS rpc_pipe_open_internal(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *abstract_syntax,
4053                                 NTSTATUS (*dispatch) (struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx, const struct ndr_interface_table *table, uint32_t opnum, void *r),
4054                                 struct auth_serversupplied_info *serversupplied_info,
4055                                 struct rpc_pipe_client **presult)
4056 {
4057         struct rpc_pipe_client *result;
4058
4059         result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
4060         if (result == NULL) {
4061                 return NT_STATUS_NO_MEMORY;
4062         }
4063
4064         result->abstract_syntax = *abstract_syntax;
4065         result->transfer_syntax = ndr_transfer_syntax;
4066         result->dispatch = dispatch;
4067
4068         result->pipes_struct = TALLOC_ZERO_P(mem_ctx, pipes_struct);
4069         if (result->pipes_struct == NULL) {
4070                 TALLOC_FREE(result);
4071                 return NT_STATUS_NO_MEMORY;
4072         }
4073         result->pipes_struct->mem_ctx = mem_ctx;
4074         result->pipes_struct->server_info = serversupplied_info;
4075         result->pipes_struct->pipe_bound = true;
4076
4077         result->max_xmit_frag = -1;
4078         result->max_recv_frag = -1;
4079
4080         *presult = result;
4081         return NT_STATUS_OK;
4082 }
4083
4084