source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "librpc/gen_ndr/cli_epmapper.h"
  22
  23 #undef DBGC_CLASS
  24 #define DBGC_CLASS DBGC_RPC_CLI
  25
  26 /*******************************************************************
  27 interface/version dce/rpc pipe identification
  28 ********************************************************************/
  29
  30 #define PIPE_SRVSVC   "\\PIPE\\srvsvc"
  31 #define PIPE_SAMR     "\\PIPE\\samr"
  32 #define PIPE_WINREG   "\\PIPE\\winreg"
  33 #define PIPE_WKSSVC   "\\PIPE\\wkssvc"
  34 #define PIPE_NETLOGON "\\PIPE\\NETLOGON"
  35 #define PIPE_NTLSA    "\\PIPE\\ntlsa"
  36 #define PIPE_NTSVCS   "\\PIPE\\ntsvcs"
  37 #define PIPE_LSASS    "\\PIPE\\lsass"
  38 #define PIPE_LSARPC   "\\PIPE\\lsarpc"
  39 #define PIPE_SPOOLSS  "\\PIPE\\spoolss"
  40 #define PIPE_NETDFS   "\\PIPE\\netdfs"
  41 #define PIPE_ECHO     "\\PIPE\\rpcecho"
  42 #define PIPE_SHUTDOWN "\\PIPE\\initshutdown"
  43 #define PIPE_EPM      "\\PIPE\\epmapper"
  44 #define PIPE_SVCCTL   "\\PIPE\\svcctl"
  45 #define PIPE_EVENTLOG "\\PIPE\\eventlog"
  46 #define PIPE_EPMAPPER "\\PIPE\\epmapper"
  47 #define PIPE_DRSUAPI  "\\PIPE\\drsuapi"
  48
  49 /*
  50  * IMPORTANT!!  If you update this structure, make sure to
  51  * update the index #defines in smb.h.
  52  */
  53
  54 static const struct pipe_id_info {
  55         /* the names appear not to matter: the syntaxes _do_ matter */
  56
  57         const char *client_pipe;
  58         const RPC_IFACE *abstr_syntax; /* this one is the abstract syntax id */
  59 } pipe_names [] =
  60 {
  61         { PIPE_LSARPC,          &ndr_table_lsarpc.syntax_id },
  62         { PIPE_LSARPC,          &ndr_table_dssetup.syntax_id },
  63         { PIPE_SAMR,            &ndr_table_samr.syntax_id },
  64         { PIPE_NETLOGON,        &ndr_table_netlogon.syntax_id },
  65         { PIPE_SRVSVC,          &ndr_table_srvsvc.syntax_id },
  66         { PIPE_WKSSVC,          &ndr_table_wkssvc.syntax_id },
  67         { PIPE_WINREG,          &ndr_table_winreg.syntax_id },
  68         { PIPE_SPOOLSS,         &ndr_table_spoolss.syntax_id },
  69         { PIPE_NETDFS,          &ndr_table_netdfs.syntax_id },
  70         { PIPE_ECHO,            &ndr_table_rpcecho.syntax_id },
  71         { PIPE_SHUTDOWN,        &ndr_table_initshutdown.syntax_id },
  72         { PIPE_SVCCTL,          &ndr_table_svcctl.syntax_id },
  73         { PIPE_EVENTLOG,        &ndr_table_eventlog.syntax_id },
  74         { PIPE_NTSVCS,          &ndr_table_ntsvcs.syntax_id },
  75         { PIPE_EPMAPPER,        &ndr_table_epmapper.syntax_id },
  76         { PIPE_DRSUAPI,         &ndr_table_drsuapi.syntax_id },
  77         { NULL, NULL }
  78 };
  79
  80 /****************************************************************************
  81  Return the pipe name from the interface.
  82  ****************************************************************************/
  83
  84 const char *get_pipe_name_from_iface(const struct ndr_syntax_id *interface)
  85 {
  86         char *guid_str;
  87         const char *result;
  88         int i;
  89         for (i = 0; pipe_names[i].client_pipe; i++) {
  90                 if (ndr_syntax_id_equal(pipe_names[i].abstr_syntax,
  91                                         interface)) {
  92                         return &pipe_names[i].client_pipe[5];
  93                 }
  94         }
  95
  96         /*
  97          * Here we should ask \\epmapper, but for now our code is only
  98          * interested in the known pipes mentioned in pipe_names[]
  99          */
 100
 101         guid_str = GUID_string(talloc_tos(), &interface->uuid);
 102         if (guid_str == NULL) {
 103                 return NULL;
 104         }
 105         result = talloc_asprintf(talloc_tos(), "Interface %s.%d", guid_str,
 106                                  (int)interface->if_version);
 107         TALLOC_FREE(guid_str);
 108
 109         if (result == NULL) {
 110                 return "PIPE";
 111         }
 112         return result;
 113 }
 114
 115 /********************************************************************
 116  Map internal value to wire value.
 117  ********************************************************************/
 118
 119 static int map_pipe_auth_type_to_rpc_auth_type(enum pipe_auth_type auth_type)
 120 {
 121         switch (auth_type) {
 122
 123         case PIPE_AUTH_TYPE_NONE:
 124                 return RPC_ANONYMOUS_AUTH_TYPE;
 125
 126         case PIPE_AUTH_TYPE_NTLMSSP:
 127                 return RPC_NTLMSSP_AUTH_TYPE;
 128
 129         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 130         case PIPE_AUTH_TYPE_SPNEGO_KRB5:
 131                 return RPC_SPNEGO_AUTH_TYPE;
 132
 133         case PIPE_AUTH_TYPE_SCHANNEL:
 134                 return RPC_SCHANNEL_AUTH_TYPE;
 135
 136         case PIPE_AUTH_TYPE_KRB5:
 137                 return RPC_KRB5_AUTH_TYPE;
 138
 139         default:
 140                 DEBUG(0,("map_pipe_auth_type_to_rpc_type: unknown pipe "
 141                         "auth type %u\n",
 142                         (unsigned int)auth_type ));
 143                 break;
 144         }
 145         return -1;
 146 }
 147
 148 /********************************************************************
 149  Pipe description for a DEBUG
 150  ********************************************************************/
 151 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
 152                                    struct rpc_pipe_client *cli)
 153 {
 154         char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
 155         if (result == NULL) {
 156                 return "pipe";
 157         }
 158         return result;
 159 }
 160
 161 /********************************************************************
 162  Rpc pipe call id.
 163  ********************************************************************/
 164
 165 static uint32 get_rpc_call_id(void)
 166 {
 167         static uint32 call_id = 0;
 168         return ++call_id;
 169 }
 170
 171 /*
 172  * Realloc pdu to have a least "size" bytes
 173  */
 174
 175 static bool rpc_grow_buffer(prs_struct *pdu, size_t size)
 176 {
 177         size_t extra_size;
 178
 179         if (prs_data_size(pdu) >= size) {
 180                 return true;
 181         }
 182
 183         extra_size = size - prs_data_size(pdu);
 184
 185         if (!prs_force_grow(pdu, extra_size)) {
 186                 DEBUG(0, ("rpc_grow_buffer: Failed to grow parse struct by "
 187                           "%d bytes.\n", (int)extra_size));
 188                 return false;
 189         }
 190
 191         DEBUG(5, ("rpc_grow_buffer: grew buffer by %d bytes to %u\n",
 192                   (int)extra_size, prs_data_size(pdu)));
 193         return true;
 194 }
 195
 196
 197 /*******************************************************************
 198  Use SMBreadX to get rest of one fragment's worth of rpc data.
 199  Reads the whole size or give an error message
 200  ********************************************************************/
 201
 202 struct rpc_read_state {
 203         struct event_context *ev;
 204         struct rpc_cli_transport *transport;
 205         uint8_t *data;
 206         size_t size;
 207         size_t num_read;
 208 };
 209
 210 static void rpc_read_done(struct async_req *subreq);
 211
 212 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
 213                                         struct event_context *ev,
 214                                         struct rpc_cli_transport *transport,
 215                                         uint8_t *data, size_t size)
 216 {
 217         struct tevent_req *req;
 218         struct async_req *subreq;
 219         struct rpc_read_state *state;
 220
 221         req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
 222         if (req == NULL) {
 223                 return NULL;
 224         }
 225         state->ev = ev;
 226         state->transport = transport;
 227         state->data = data;
 228         state->size = size;
 229         state->num_read = 0;
 230
 231         DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
 232
 233         subreq = transport->read_send(state, ev, (uint8_t *)data, size,
 234                                       transport->priv);
 235         if (subreq == NULL) {
 236                 goto fail;
 237         }
 238         subreq->async.fn = rpc_read_done;
 239         subreq->async.priv = req;
 240         return req;
 241
 242  fail:
 243         TALLOC_FREE(req);
 244         return NULL;
 245 }
 246
 247 static void rpc_read_done(struct async_req *subreq)
 248 {
 249         struct tevent_req *req = talloc_get_type_abort(
 250                 subreq->async.priv, struct tevent_req);
 251         struct rpc_read_state *state = tevent_req_data(
 252                 req, struct rpc_read_state);
 253         NTSTATUS status;
 254         ssize_t received;
 255
 256         status = state->transport->read_recv(subreq, &received);
 257         TALLOC_FREE(subreq);
 258         if (!NT_STATUS_IS_OK(status)) {
 259                 tevent_req_nterror(req, status);
 260                 return;
 261         }
 262
 263         state->num_read += received;
 264         if (state->num_read == state->size) {
 265                 tevent_req_done(req);
 266                 return;
 267         }
 268
 269         subreq = state->transport->read_send(state, state->ev,
 270                                              state->data + state->num_read,
 271                                              state->size - state->num_read,
 272                                              state->transport->priv);
 273         if (tevent_req_nomem(subreq, req)) {
 274                 return;
 275         }
 276         subreq->async.fn = rpc_read_done;
 277         subreq->async.priv = req;
 278 }
 279
 280 static NTSTATUS rpc_read_recv(struct tevent_req *req)
 281 {
 282         return tevent_req_simple_recv_ntstatus(req);
 283 }
 284
 285 struct rpc_write_state {
 286         struct event_context *ev;
 287         struct rpc_cli_transport *transport;
 288         const uint8_t *data;
 289         size_t size;
 290         size_t num_written;
 291 };
 292
 293 static void rpc_write_done(struct async_req *subreq);
 294
 295 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
 296                                          struct event_context *ev,
 297                                          struct rpc_cli_transport *transport,
 298                                          const uint8_t *data, size_t size)
 299 {
 300         struct tevent_req *req;
 301         struct async_req *subreq;
 302         struct rpc_write_state *state;
 303
 304         req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
 305         if (req == NULL) {
 306                 return NULL;
 307         }
 308         state->ev = ev;
 309         state->transport = transport;
 310         state->data = data;
 311         state->size = size;
 312         state->num_written = 0;
 313
 314         DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
 315
 316         subreq = transport->write_send(state, ev, data, size, transport->priv);
 317         if (subreq == NULL) {
 318                 goto fail;
 319         }
 320         subreq->async.fn = rpc_write_done;
 321         subreq->async.priv = req;
 322         return req;
 323  fail:
 324         TALLOC_FREE(req);
 325         return NULL;
 326 }
 327
 328 static void rpc_write_done(struct async_req *subreq)
 329 {
 330         struct tevent_req *req = talloc_get_type_abort(
 331                 subreq->async.priv, struct tevent_req);
 332         struct rpc_write_state *state = tevent_req_data(
 333                 req, struct rpc_write_state);
 334         NTSTATUS status;
 335         ssize_t written;
 336
 337         status = state->transport->write_recv(subreq, &written);
 338         TALLOC_FREE(subreq);
 339         if (!NT_STATUS_IS_OK(status)) {
 340                 tevent_req_nterror(req, status);
 341                 return;
 342         }
 343
 344         state->num_written += written;
 345
 346         if (state->num_written == state->size) {
 347                 tevent_req_done(req);
 348                 return;
 349         }
 350
 351         subreq = state->transport->write_send(state, state->ev,
 352                                               state->data + state->num_written,
 353                                               state->size - state->num_written,
 354                                               state->transport->priv);
 355         if (tevent_req_nomem(subreq, req)) {
 356                 return;
 357         }
 358         subreq->async.fn = rpc_write_done;
 359         subreq->async.priv = req;
 360 }
 361
 362 static NTSTATUS rpc_write_recv(struct tevent_req *req)
 363 {
 364         return tevent_req_simple_recv_ntstatus(req);
 365 }
 366
 367
 368 static NTSTATUS parse_rpc_header(struct rpc_pipe_client *cli,
 369                                  struct rpc_hdr_info *prhdr,
 370                                  prs_struct *pdu)
 371 {
 372         /*
 373          * This next call sets the endian bit correctly in current_pdu. We
 374          * will propagate this to rbuf later.
 375          */
 376
 377         if(!smb_io_rpc_hdr("rpc_hdr   ", prhdr, pdu, 0)) {
 378                 DEBUG(0, ("get_current_pdu: Failed to unmarshall RPC_HDR.\n"));
 379                 return NT_STATUS_BUFFER_TOO_SMALL;
 380         }
 381
 382         if (prhdr->frag_len > cli->max_recv_frag) {
 383                 DEBUG(0, ("cli_pipe_get_current_pdu: Server sent fraglen %d,"
 384                           " we only allow %d\n", (int)prhdr->frag_len,
 385                           (int)cli->max_recv_frag));
 386                 return NT_STATUS_BUFFER_TOO_SMALL;
 387         }
 388
 389         return NT_STATUS_OK;
 390 }
 391
 392 /****************************************************************************
 393  Try and get a PDU's worth of data from current_pdu. If not, then read more
 394  from the wire.
 395  ****************************************************************************/
 396
 397 struct get_complete_frag_state {
 398         struct event_context *ev;
 399         struct rpc_pipe_client *cli;
 400         struct rpc_hdr_info *prhdr;
 401         prs_struct *pdu;
 402 };
 403
 404 static void get_complete_frag_got_header(struct tevent_req *subreq);
 405 static void get_complete_frag_got_rest(struct tevent_req *subreq);
 406
 407 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
 408                                                  struct event_context *ev,
 409                                                  struct rpc_pipe_client *cli,
 410                                                  struct rpc_hdr_info *prhdr,
 411                                                  prs_struct *pdu)
 412 {
 413         struct tevent_req *req, *subreq;
 414         struct get_complete_frag_state *state;
 415         uint32_t pdu_len;
 416         NTSTATUS status;
 417
 418         req = tevent_req_create(mem_ctx, &state,
 419                                 struct get_complete_frag_state);
 420         if (req == NULL) {
 421                 return NULL;
 422         }
 423         state->ev = ev;
 424         state->cli = cli;
 425         state->prhdr = prhdr;
 426         state->pdu = pdu;
 427
 428         pdu_len = prs_data_size(pdu);
 429         if (pdu_len < RPC_HEADER_LEN) {
 430                 if (!rpc_grow_buffer(pdu, RPC_HEADER_LEN)) {
 431                         status = NT_STATUS_NO_MEMORY;
 432                         goto post_status;
 433                 }
 434                 subreq = rpc_read_send(
 435                         state, state->ev,
 436                         state->cli->transport,
 437                         (uint8_t *)(prs_data_p(state->pdu) + pdu_len),
 438                         RPC_HEADER_LEN - pdu_len);
 439                 if (subreq == NULL) {
 440                         status = NT_STATUS_NO_MEMORY;
 441                         goto post_status;
 442                 }
 443                 tevent_req_set_callback(subreq, get_complete_frag_got_header,
 444                                         req);
 445                 return req;
 446         }
 447
 448         status = parse_rpc_header(cli, prhdr, pdu);
 449         if (!NT_STATUS_IS_OK(status)) {
 450                 goto post_status;
 451         }
 452
 453         /*
 454          * Ensure we have frag_len bytes of data.
 455          */
 456         if (pdu_len < prhdr->frag_len) {
 457                 if (!rpc_grow_buffer(pdu, prhdr->frag_len)) {
 458                         status = NT_STATUS_NO_MEMORY;
 459                         goto post_status;
 460                 }
 461                 subreq = rpc_read_send(state, state->ev,
 462                                        state->cli->transport,
 463                                        (uint8_t *)(prs_data_p(pdu) + pdu_len),
 464                                        prhdr->frag_len - pdu_len);
 465                 if (subreq == NULL) {
 466                         status = NT_STATUS_NO_MEMORY;
 467                         goto post_status;
 468                 }
 469                 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
 470                                         req);
 471                 return req;
 472         }
 473
 474         status = NT_STATUS_OK;
 475  post_status:
 476         if (NT_STATUS_IS_OK(status)) {
 477                 tevent_req_done(req);
 478         } else {
 479                 tevent_req_nterror(req, status);
 480         }
 481         return tevent_req_post(req, ev);
 482 }
 483
 484 static void get_complete_frag_got_header(struct tevent_req *subreq)
 485 {
 486         struct tevent_req *req = tevent_req_callback_data(
 487                 subreq, struct tevent_req);
 488         struct get_complete_frag_state *state = tevent_req_data(
 489                 req, struct get_complete_frag_state);
 490         NTSTATUS status;
 491
 492         status = rpc_read_recv(subreq);
 493         TALLOC_FREE(subreq);
 494         if (!NT_STATUS_IS_OK(status)) {
 495                 tevent_req_nterror(req, status);
 496                 return;
 497         }
 498
 499         status = parse_rpc_header(state->cli, state->prhdr, state->pdu);
 500         if (!NT_STATUS_IS_OK(status)) {
 501                 tevent_req_nterror(req, status);
 502                 return;
 503         }
 504
 505         if (!rpc_grow_buffer(state->pdu, state->prhdr->frag_len)) {
 506                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 507                 return;
 508         }
 509
 510         /*
 511          * We're here in this piece of code because we've read exactly
 512          * RPC_HEADER_LEN bytes into state->pdu.
 513          */
 514
 515         subreq = rpc_read_send(
 516                 state, state->ev, state->cli->transport,
 517                 (uint8_t *)(prs_data_p(state->pdu) + RPC_HEADER_LEN),
 518                 state->prhdr->frag_len - RPC_HEADER_LEN);
 519         if (tevent_req_nomem(subreq, req)) {
 520                 return;
 521         }
 522         tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
 523 }
 524
 525 static void get_complete_frag_got_rest(struct tevent_req *subreq)
 526 {
 527         struct tevent_req *req = tevent_req_callback_data(
 528                 subreq, struct tevent_req);
 529         NTSTATUS status;
 530
 531         status = rpc_read_recv(subreq);
 532         TALLOC_FREE(subreq);
 533         if (!NT_STATUS_IS_OK(status)) {
 534                 tevent_req_nterror(req, status);
 535                 return;
 536         }
 537         tevent_req_done(req);
 538 }
 539
 540 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
 541 {
 542         return tevent_req_simple_recv_ntstatus(req);
 543 }
 544
 545 /****************************************************************************
 546  NTLMSSP specific sign/seal.
 547  Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
 548  In fact I should probably abstract these into identical pieces of code... JRA.
 549  ****************************************************************************/
 550
 551 static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 552                                 prs_struct *current_pdu,
 553                                 uint8 *p_ss_padding_len)
 554 {
 555         RPC_HDR_AUTH auth_info;
 556         uint32 save_offset = prs_offset(current_pdu);
 557         uint32 auth_len = prhdr->auth_len;
 558         NTLMSSP_STATE *ntlmssp_state = cli->auth->a_u.ntlmssp_state;
 559         unsigned char *data = NULL;
 560         size_t data_len;
 561         unsigned char *full_packet_data = NULL;
 562         size_t full_packet_data_len;
 563         DATA_BLOB auth_blob;
 564         NTSTATUS status;
 565
 566         if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
 567             || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
 568                 return NT_STATUS_OK;
 569         }
 570
 571         if (!ntlmssp_state) {
 572                 return NT_STATUS_INVALID_PARAMETER;
 573         }
 574
 575         /* Ensure there's enough data for an authenticated response. */
 576         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
 577                         (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
 578                 DEBUG(0,("cli_pipe_verify_ntlmssp: auth_len %u is too large.\n",
 579                         (unsigned int)auth_len ));
 580                 return NT_STATUS_BUFFER_TOO_SMALL;
 581         }
 582
 583         /*
 584          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
 585          * after the RPC header.
 586          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
 587          * functions as NTLMv2 checks the rpc headers also.
 588          */
 589
 590         data = (unsigned char *)(prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN);
 591         data_len = (size_t)(prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len);
 592
 593         full_packet_data = (unsigned char *)prs_data_p(current_pdu);
 594         full_packet_data_len = prhdr->frag_len - auth_len;
 595
 596         /* Pull the auth header and the following data into a blob. */
 597         if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
 598                 DEBUG(0,("cli_pipe_verify_ntlmssp: cannot move offset to %u.\n",
 599                         (unsigned int)RPC_HEADER_LEN + (unsigned int)RPC_HDR_RESP_LEN + (unsigned int)data_len ));
 600                 return NT_STATUS_BUFFER_TOO_SMALL;
 601         }
 602
 603         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
 604                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall RPC_HDR_AUTH.\n"));
 605                 return NT_STATUS_BUFFER_TOO_SMALL;
 606         }
 607
 608         auth_blob.data = (unsigned char *)prs_data_p(current_pdu) + prs_offset(current_pdu);
 609         auth_blob.length = auth_len;
 610
 611         switch (cli->auth->auth_level) {
 612                 case PIPE_AUTH_LEVEL_PRIVACY:
 613                         /* Data is encrypted. */
 614                         status = ntlmssp_unseal_packet(ntlmssp_state,
 615                                                         data, data_len,
 616                                                         full_packet_data,
 617                                                         full_packet_data_len,
 618                                                         &auth_blob);
 619                         if (!NT_STATUS_IS_OK(status)) {
 620                                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unseal "
 621                                         "packet from %s. Error was %s.\n",
 622                                         rpccli_pipe_txt(debug_ctx(), cli),
 623                                         nt_errstr(status) ));
 624                                 return status;
 625                         }
 626                         break;
 627                 case PIPE_AUTH_LEVEL_INTEGRITY:
 628                         /* Data is signed. */
 629                         status = ntlmssp_check_packet(ntlmssp_state,
 630                                                         data, data_len,
 631                                                         full_packet_data,
 632                                                         full_packet_data_len,
 633                                                         &auth_blob);
 634                         if (!NT_STATUS_IS_OK(status)) {
 635                                 DEBUG(0,("cli_pipe_verify_ntlmssp: check signing failed on "
 636                                         "packet from %s. Error was %s.\n",
 637                                         rpccli_pipe_txt(debug_ctx(), cli),
 638                                         nt_errstr(status) ));
 639                                 return status;
 640                         }
 641                         break;
 642                 default:
 643                         DEBUG(0, ("cli_pipe_verify_ntlmssp: unknown internal "
 644                                   "auth level %d\n", cli->auth->auth_level));
 645                         return NT_STATUS_INVALID_INFO_CLASS;
 646         }
 647
 648         /*
 649          * Return the current pointer to the data offset.
 650          */
 651
 652         if(!prs_set_offset(current_pdu, save_offset)) {
 653                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
 654                         (unsigned int)save_offset ));
 655                 return NT_STATUS_BUFFER_TOO_SMALL;
 656         }
 657
 658         /*
 659          * Remember the padding length. We must remove it from the real data
 660          * stream once the sign/seal is done.
 661          */
 662
 663         *p_ss_padding_len = auth_info.auth_pad_len;
 664
 665         return NT_STATUS_OK;
 666 }
 667
 668 /****************************************************************************
 669  schannel specific sign/seal.
 670  ****************************************************************************/
 671
 672 static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 673                                 prs_struct *current_pdu,
 674                                 uint8 *p_ss_padding_len)
 675 {
 676         RPC_HDR_AUTH auth_info;
 677         RPC_AUTH_SCHANNEL_CHK schannel_chk;
 678         uint32 auth_len = prhdr->auth_len;
 679         uint32 save_offset = prs_offset(current_pdu);
 680         struct schannel_auth_struct *schannel_auth =
 681                 cli->auth->a_u.schannel_auth;
 682         uint32 data_len;
 683
 684         if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
 685             || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
 686                 return NT_STATUS_OK;
 687         }
 688
 689         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
 690                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u.\n", (unsigned int)auth_len ));
 691                 return NT_STATUS_INVALID_PARAMETER;
 692         }
 693
 694         if (!schannel_auth) {
 695                 return NT_STATUS_INVALID_PARAMETER;
 696         }
 697
 698         /* Ensure there's enough data for an authenticated response. */
 699         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
 700                         (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
 701                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u is too large.\n",
 702                         (unsigned int)auth_len ));
 703                 return NT_STATUS_INVALID_PARAMETER;
 704         }
 705
 706         data_len = prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 707
 708         if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
 709                 DEBUG(0,("cli_pipe_verify_schannel: cannot move offset to %u.\n",
 710                         (unsigned int)RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len ));
 711                 return NT_STATUS_BUFFER_TOO_SMALL;
 712         }
 713
 714         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
 715                 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshall RPC_HDR_AUTH.\n"));
 716                 return NT_STATUS_BUFFER_TOO_SMALL;
 717         }
 718
 719         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
 720                 DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n",
 721                         auth_info.auth_type));
 722                 return NT_STATUS_BUFFER_TOO_SMALL;
 723         }
 724
 725         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 726                                 &schannel_chk, current_pdu, 0)) {
 727                 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
 728                 return NT_STATUS_BUFFER_TOO_SMALL;
 729         }
 730
 731         if (!schannel_decode(schannel_auth,
 732                         cli->auth->auth_level,
 733                         SENDER_IS_ACCEPTOR,
 734                         &schannel_chk,
 735                         prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN,
 736                         data_len)) {
 737                 DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
 738                                 "Connection to %s.\n",
 739                                 rpccli_pipe_txt(debug_ctx(), cli)));
 740                 return NT_STATUS_INVALID_PARAMETER;
 741         }
 742
 743         /* The sequence number gets incremented on both send and receive. */
 744         schannel_auth->seq_num++;
 745
 746         /*
 747          * Return the current pointer to the data offset.
 748          */
 749
 750         if(!prs_set_offset(current_pdu, save_offset)) {
 751                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
 752                         (unsigned int)save_offset ));
 753                 return NT_STATUS_BUFFER_TOO_SMALL;
 754         }
 755
 756         /*
 757          * Remember the padding length. We must remove it from the real data
 758          * stream once the sign/seal is done.
 759          */
 760
 761         *p_ss_padding_len = auth_info.auth_pad_len;
 762
 763         return NT_STATUS_OK;
 764 }
 765
 766 /****************************************************************************
 767  Do the authentication checks on an incoming pdu. Check sign and unseal etc.
 768  ****************************************************************************/
 769
 770 static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 771                                 prs_struct *current_pdu,
 772                                 uint8 *p_ss_padding_len)
 773 {
 774         NTSTATUS ret = NT_STATUS_OK;
 775
 776         /* Paranioa checks for auth_len. */
 777         if (prhdr->auth_len) {
 778                 if (prhdr->auth_len > prhdr->frag_len) {
 779                         return NT_STATUS_INVALID_PARAMETER;
 780                 }
 781
 782                 if (prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < prhdr->auth_len ||
 783                                 prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < (unsigned int)RPC_HDR_AUTH_LEN) {
 784                         /* Integer wrap attempt. */
 785                         return NT_STATUS_INVALID_PARAMETER;
 786                 }
 787         }
 788
 789         /*
 790          * Now we have a complete RPC request PDU fragment, try and verify any auth data.
 791          */
 792
 793         switch(cli->auth->auth_type) {
 794                 case PIPE_AUTH_TYPE_NONE:
 795                         if (prhdr->auth_len) {
 796                                 DEBUG(3, ("cli_pipe_validate_rpc_response: "
 797                                           "Connection to %s - got non-zero "
 798                                           "auth len %u.\n",
 799                                         rpccli_pipe_txt(debug_ctx(), cli),
 800                                         (unsigned int)prhdr->auth_len ));
 801                                 return NT_STATUS_INVALID_PARAMETER;
 802                         }
 803                         break;
 804
 805                 case PIPE_AUTH_TYPE_NTLMSSP:
 806                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 807                         ret = cli_pipe_verify_ntlmssp(cli, prhdr, current_pdu, p_ss_padding_len);
 808                         if (!NT_STATUS_IS_OK(ret)) {
 809                                 return ret;
 810                         }
 811                         break;
 812
 813                 case PIPE_AUTH_TYPE_SCHANNEL:
 814                         ret = cli_pipe_verify_schannel(cli, prhdr, current_pdu, p_ss_padding_len);
 815                         if (!NT_STATUS_IS_OK(ret)) {
 816                                 return ret;
 817                         }
 818                         break;
 819
 820                 case PIPE_AUTH_TYPE_KRB5:
 821                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
 822                 default:
 823                         DEBUG(3, ("cli_pipe_validate_rpc_response: Connection "
 824                                   "to %s - unknown internal auth type %u.\n",
 825                                   rpccli_pipe_txt(debug_ctx(), cli),
 826                                   cli->auth->auth_type ));
 827                         return NT_STATUS_INVALID_INFO_CLASS;
 828         }
 829
 830         return NT_STATUS_OK;
 831 }
 832
 833 /****************************************************************************
 834  Do basic authentication checks on an incoming pdu.
 835  ****************************************************************************/
 836
 837 static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 838                         prs_struct *current_pdu,
 839                         uint8 expected_pkt_type,
 840                         char **ppdata,
 841                         uint32 *pdata_len,
 842                         prs_struct *return_data)
 843 {
 844
 845         NTSTATUS ret = NT_STATUS_OK;
 846         uint32 current_pdu_len = prs_data_size(current_pdu);
 847
 848         if (current_pdu_len != prhdr->frag_len) {
 849                 DEBUG(5,("cli_pipe_validate_current_pdu: incorrect pdu length %u, expected %u\n",
 850                         (unsigned int)current_pdu_len, (unsigned int)prhdr->frag_len ));
 851                 return NT_STATUS_INVALID_PARAMETER;
 852         }
 853
 854         /*
 855          * Point the return values at the real data including the RPC
 856          * header. Just in case the caller wants it.
 857          */
 858         *ppdata = prs_data_p(current_pdu);
 859         *pdata_len = current_pdu_len;
 860
 861         /* Ensure we have the correct type. */
 862         switch (prhdr->pkt_type) {
 863                 case RPC_ALTCONTRESP:
 864                 case RPC_BINDACK:
 865
 866                         /* Alter context and bind ack share the same packet definitions. */
 867                         break;
 868
 869
 870                 case RPC_RESPONSE:
 871                 {
 872                         RPC_HDR_RESP rhdr_resp;
 873                         uint8 ss_padding_len = 0;
 874
 875                         if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
 876                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
 877                                 return NT_STATUS_BUFFER_TOO_SMALL;
 878                         }
 879
 880                         /* Here's where we deal with incoming sign/seal. */
 881                         ret = cli_pipe_validate_rpc_response(cli, prhdr,
 882                                         current_pdu, &ss_padding_len);
 883                         if (!NT_STATUS_IS_OK(ret)) {
 884                                 return ret;
 885                         }
 886
 887                         /* Point the return values at the NDR data. Remember to remove any ss padding. */
 888                         *ppdata = prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
 889
 890                         if (current_pdu_len < RPC_HEADER_LEN + RPC_HDR_RESP_LEN + ss_padding_len) {
 891                                 return NT_STATUS_BUFFER_TOO_SMALL;
 892                         }
 893
 894                         *pdata_len = current_pdu_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - ss_padding_len;
 895
 896                         /* Remember to remove the auth footer. */
 897                         if (prhdr->auth_len) {
 898                                 /* We've already done integer wrap tests on auth_len in
 899                                         cli_pipe_validate_rpc_response(). */
 900                                 if (*pdata_len < RPC_HDR_AUTH_LEN + prhdr->auth_len) {
 901                                         return NT_STATUS_BUFFER_TOO_SMALL;
 902                                 }
 903                                 *pdata_len -= (RPC_HDR_AUTH_LEN + prhdr->auth_len);
 904                         }
 905
 906                         DEBUG(10,("cli_pipe_validate_current_pdu: got pdu len %u, data_len %u, ss_len %u\n",
 907                                 current_pdu_len, *pdata_len, ss_padding_len ));
 908
 909                         /*
 910                          * If this is the first reply, and the allocation hint is reasonably, try and
 911                          * set up the return_data parse_struct to the correct size.
 912                          */
 913
 914                         if ((prs_data_size(return_data) == 0) && rhdr_resp.alloc_hint && (rhdr_resp.alloc_hint < 15*1024*1024)) {
 915                                 if (!prs_set_buffer_size(return_data, rhdr_resp.alloc_hint)) {
 916                                         DEBUG(0,("cli_pipe_validate_current_pdu: reply alloc hint %u "
 917                                                 "too large to allocate\n",
 918                                                 (unsigned int)rhdr_resp.alloc_hint ));
 919                                         return NT_STATUS_NO_MEMORY;
 920                                 }
 921                         }
 922
 923                         break;
 924                 }
 925
 926                 case RPC_BINDNACK:
 927                         DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
 928                                   "received from %s!\n",
 929                                   rpccli_pipe_txt(debug_ctx(), cli)));
 930                         /* Use this for now... */
 931                         return NT_STATUS_NETWORK_ACCESS_DENIED;
 932
 933                 case RPC_FAULT:
 934                 {
 935                         RPC_HDR_RESP rhdr_resp;
 936                         RPC_HDR_FAULT fault_resp;
 937
 938                         if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
 939                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
 940                                 return NT_STATUS_BUFFER_TOO_SMALL;
 941                         }
 942
 943                         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, current_pdu, 0)) {
 944                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_FAULT.\n"));
 945                                 return NT_STATUS_BUFFER_TOO_SMALL;
 946                         }
 947
 948                         DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
 949                                   "code %s received from %s!\n",
 950                                 dcerpc_errstr(debug_ctx(), NT_STATUS_V(fault_resp.status)),
 951                                 rpccli_pipe_txt(debug_ctx(), cli)));
 952                         if (NT_STATUS_IS_OK(fault_resp.status)) {
 953                                 return NT_STATUS_UNSUCCESSFUL;
 954                         } else {
 955                                 return fault_resp.status;
 956                         }
 957                 }
 958
 959                 default:
 960                         DEBUG(0, ("cli_pipe_validate_current_pdu: unknown packet type %u received "
 961                                 "from %s!\n",
 962                                 (unsigned int)prhdr->pkt_type,
 963                                 rpccli_pipe_txt(debug_ctx(), cli)));
 964                         return NT_STATUS_INVALID_INFO_CLASS;
 965         }
 966
 967         if (prhdr->pkt_type != expected_pkt_type) {
 968                 DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
 969                           "got an unexpected RPC packet type - %u, not %u\n",
 970                         rpccli_pipe_txt(debug_ctx(), cli),
 971                         prhdr->pkt_type,
 972                         expected_pkt_type));
 973                 return NT_STATUS_INVALID_INFO_CLASS;
 974         }
 975
 976         /* Do this just before return - we don't want to modify any rpc header
 977            data before now as we may have needed to do cryptographic actions on
 978            it before. */
 979
 980         if ((prhdr->pkt_type == RPC_BINDACK) && !(prhdr->flags & RPC_FLG_LAST)) {
 981                 DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
 982                         "setting fragment first/last ON.\n"));
 983                 prhdr->flags |= RPC_FLG_FIRST|RPC_FLG_LAST;
 984         }
 985
 986         return NT_STATUS_OK;
 987 }
 988
 989 /****************************************************************************
 990  Ensure we eat the just processed pdu from the current_pdu prs_struct.
 991  Normally the frag_len and buffer size will match, but on the first trans
 992  reply there is a theoretical chance that buffer size > frag_len, so we must
 993  deal with that.
 994  ****************************************************************************/
 995
 996 static NTSTATUS cli_pipe_reset_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr, prs_struct *current_pdu)
 997 {
 998         uint32 current_pdu_len = prs_data_size(current_pdu);
 999
1000         if (current_pdu_len < prhdr->frag_len) {
1001                 return NT_STATUS_BUFFER_TOO_SMALL;
1002         }
1003
1004         /* Common case. */
1005         if (current_pdu_len == (uint32)prhdr->frag_len) {
1006                 prs_mem_free(current_pdu);
1007                 prs_init_empty(current_pdu, prs_get_mem_context(current_pdu), UNMARSHALL);
1008                 /* Make current_pdu dynamic with no memory. */
1009                 prs_give_memory(current_pdu, 0, 0, True);
1010                 return NT_STATUS_OK;
1011         }
1012
1013         /*
1014          * Oh no ! More data in buffer than we processed in current pdu.
1015          * Cheat. Move the data down and shrink the buffer.
1016          */
1017
1018         memcpy(prs_data_p(current_pdu), prs_data_p(current_pdu) + prhdr->frag_len,
1019                         current_pdu_len - prhdr->frag_len);
1020
1021         /* Remember to set the read offset back to zero. */
1022         prs_set_offset(current_pdu, 0);
1023
1024         /* Shrink the buffer. */
1025         if (!prs_set_buffer_size(current_pdu, current_pdu_len - prhdr->frag_len)) {
1026                 return NT_STATUS_BUFFER_TOO_SMALL;
1027         }
1028
1029         return NT_STATUS_OK;
1030 }
1031
1032 /****************************************************************************
1033  Call a remote api on an arbitrary pipe.  takes param, data and setup buffers.
1034 ****************************************************************************/
1035
1036 struct cli_api_pipe_state {
1037         struct event_context *ev;
1038         struct rpc_cli_transport *transport;
1039         uint8_t *rdata;
1040         uint32_t rdata_len;
1041 };
1042
1043 static void cli_api_pipe_trans_done(struct async_req *subreq);
1044 static void cli_api_pipe_write_done(struct tevent_req *subreq);
1045 static void cli_api_pipe_read_done(struct async_req *subreq);
1046
1047 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
1048                                             struct event_context *ev,
1049                                             struct rpc_cli_transport *transport,
1050                                             uint8_t *data, size_t data_len,
1051                                             uint32_t max_rdata_len)
1052 {
1053         struct tevent_req *req;
1054         struct async_req *subreq;
1055         struct tevent_req *subreq2;
1056         struct cli_api_pipe_state *state;
1057         NTSTATUS status;
1058
1059         req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
1060         if (req == NULL) {
1061                 return NULL;
1062         }
1063         state->ev = ev;
1064         state->transport = transport;
1065
1066         if (max_rdata_len < RPC_HEADER_LEN) {
1067                 /*
1068                  * For a RPC reply we always need at least RPC_HEADER_LEN
1069                  * bytes. We check this here because we will receive
1070                  * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
1071                  */
1072                 status = NT_STATUS_INVALID_PARAMETER;
1073                 goto post_status;
1074         }
1075
1076         if (transport->trans_send != NULL) {
1077                 subreq = transport->trans_send(state, ev, data, data_len,
1078                                                max_rdata_len, transport->priv);
1079                 if (subreq == NULL) {
1080                         status = NT_STATUS_NO_MEMORY;
1081                         goto post_status;
1082                 }
1083                 subreq->async.fn = cli_api_pipe_trans_done;
1084                 subreq->async.priv = req;
1085                 return req;
1086         }
1087
1088         /*
1089          * If the transport does not provide a "trans" routine, i.e. for
1090          * example the ncacn_ip_tcp transport, do the write/read step here.
1091          */
1092
1093         subreq2 = rpc_write_send(state, ev, transport, data, data_len);
1094         if (subreq2 == NULL) {
1095                 goto fail;
1096         }
1097         tevent_req_set_callback(subreq2, cli_api_pipe_write_done, req);
1098         return req;
1099
1100         status = NT_STATUS_INVALID_PARAMETER;
1101
1102  post_status:
1103         if (NT_STATUS_IS_OK(status)) {
1104                 tevent_req_done(req);
1105         } else {
1106                 tevent_req_nterror(req, status);
1107         }
1108         return tevent_req_post(req, ev);
1109  fail:
1110         TALLOC_FREE(req);
1111         return NULL;
1112 }
1113
1114 static void cli_api_pipe_trans_done(struct async_req *subreq)
1115 {
1116         struct tevent_req *req = talloc_get_type_abort(
1117                 subreq->async.priv, struct tevent_req);
1118         struct cli_api_pipe_state *state = tevent_req_data(
1119                 req, struct cli_api_pipe_state);
1120         NTSTATUS status;
1121
1122         status = state->transport->trans_recv(subreq, state, &state->rdata,
1123                                               &state->rdata_len);
1124         TALLOC_FREE(subreq);
1125         if (!NT_STATUS_IS_OK(status)) {
1126                 tevent_req_nterror(req, status);
1127                 return;
1128         }
1129         tevent_req_done(req);
1130 }
1131
1132 static void cli_api_pipe_write_done(struct tevent_req *subreq)
1133 {
1134         struct tevent_req *req = tevent_req_callback_data(
1135                 subreq, struct tevent_req);
1136         struct cli_api_pipe_state *state = tevent_req_data(
1137                 req, struct cli_api_pipe_state);
1138         struct async_req *subreq2;
1139         NTSTATUS status;
1140
1141         status = rpc_write_recv(subreq);
1142         TALLOC_FREE(subreq);
1143         if (!NT_STATUS_IS_OK(status)) {
1144                 tevent_req_nterror(req, status);
1145                 return;
1146         }
1147
1148         state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
1149         if (tevent_req_nomem(state->rdata, req)) {
1150                 return;
1151         }
1152
1153         /*
1154          * We don't need to use rpc_read_send here, the upper layer will cope
1155          * with a short read, transport->trans_send could also return less
1156          * than state->max_rdata_len.
1157          */
1158         subreq2 = state->transport->read_send(state, state->ev, state->rdata,
1159                                               RPC_HEADER_LEN,
1160                                               state->transport->priv);
1161         if (tevent_req_nomem(subreq2, req)) {
1162                 return;
1163         }
1164         subreq2->async.fn = cli_api_pipe_read_done;
1165         subreq2->async.priv = req;
1166 }
1167
1168 static void cli_api_pipe_read_done(struct async_req *subreq)
1169 {
1170         struct tevent_req *req = talloc_get_type_abort(
1171                 subreq->async.priv, struct tevent_req);
1172         struct cli_api_pipe_state *state = tevent_req_data(
1173                 req, struct cli_api_pipe_state);
1174         NTSTATUS status;
1175         ssize_t received;
1176
1177         status = state->transport->read_recv(subreq, &received);
1178         TALLOC_FREE(subreq);
1179         if (!NT_STATUS_IS_OK(status)) {
1180                 tevent_req_nterror(req, status);
1181                 return;
1182         }
1183         state->rdata_len = received;
1184         tevent_req_done(req);
1185 }
1186
1187 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1188                                   uint8_t **prdata, uint32_t *prdata_len)
1189 {
1190         struct cli_api_pipe_state *state = tevent_req_data(
1191                 req, struct cli_api_pipe_state);
1192         NTSTATUS status;
1193
1194         if (tevent_req_is_nterror(req, &status)) {
1195                 return status;
1196         }
1197
1198         *prdata = talloc_move(mem_ctx, &state->rdata);
1199         *prdata_len = state->rdata_len;
1200         return NT_STATUS_OK;
1201 }
1202
1203 /****************************************************************************
1204  Send data on an rpc pipe via trans. The prs_struct data must be the last
1205  pdu fragment of an NDR data stream.
1206
1207  Receive response data from an rpc pipe, which may be large...
1208
1209  Read the first fragment: unfortunately have to use SMBtrans for the first
1210  bit, then SMBreadX for subsequent bits.
1211
1212  If first fragment received also wasn't the last fragment, continue
1213  getting fragments until we _do_ receive the last fragment.
1214
1215  Request/Response PDU's look like the following...
1216
1217  |<------------------PDU len----------------------------------------------->|
1218  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
1219
1220  +------------+-----------------+-------------+---------------+-------------+
1221  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
1222  +------------+-----------------+-------------+---------------+-------------+
1223
1224  Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
1225  signing & sealing being negotiated.
1226
1227  ****************************************************************************/
1228
1229 struct rpc_api_pipe_state {
1230         struct event_context *ev;
1231         struct rpc_pipe_client *cli;
1232         uint8_t expected_pkt_type;
1233
1234         prs_struct incoming_frag;
1235         struct rpc_hdr_info rhdr;
1236
1237         prs_struct incoming_pdu;        /* Incoming reply */
1238         uint32_t incoming_pdu_offset;
1239 };
1240
1241 static int rpc_api_pipe_state_destructor(struct rpc_api_pipe_state *state)
1242 {
1243         prs_mem_free(&state->incoming_frag);
1244         prs_mem_free(&state->incoming_pdu);
1245         return 0;
1246 }
1247
1248 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
1249 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
1250
1251 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
1252                                             struct event_context *ev,
1253                                             struct rpc_pipe_client *cli,
1254                                             prs_struct *data, /* Outgoing PDU */
1255                                             uint8_t expected_pkt_type)
1256 {
1257         struct tevent_req *req, *subreq;
1258         struct rpc_api_pipe_state *state;
1259         uint16_t max_recv_frag;
1260         NTSTATUS status;
1261
1262         req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
1263         if (req == NULL) {
1264                 return NULL;
1265         }
1266         state->ev = ev;
1267         state->cli = cli;
1268         state->expected_pkt_type = expected_pkt_type;
1269         state->incoming_pdu_offset = 0;
1270
1271         prs_init_empty(&state->incoming_frag, state, UNMARSHALL);
1272
1273         prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1274         /* Make incoming_pdu dynamic with no memory. */
1275         prs_give_memory(&state->incoming_pdu, NULL, 0, true);
1276
1277         talloc_set_destructor(state, rpc_api_pipe_state_destructor);
1278
1279         /*
1280          * Ensure we're not sending too much.
1281          */
1282         if (prs_offset(data) > cli->max_xmit_frag) {
1283                 status = NT_STATUS_INVALID_PARAMETER;
1284                 goto post_status;
1285         }
1286
1287         DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(debug_ctx(), cli)));
1288
1289         max_recv_frag = cli->max_recv_frag;
1290
1291 #ifdef DEVELOPER
1292         max_recv_frag = RPC_HEADER_LEN + 10 + (sys_random() % 32);
1293 #endif
1294
1295         subreq = cli_api_pipe_send(state, ev, cli->transport,
1296                                    (uint8_t *)prs_data_p(data),
1297                                    prs_offset(data), max_recv_frag);
1298         if (subreq == NULL) {
1299                 goto fail;
1300         }
1301         tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
1302         return req;
1303
1304  post_status:
1305         tevent_req_nterror(req, status);
1306         return tevent_req_post(req, ev);
1307  fail:
1308         TALLOC_FREE(req);
1309         return NULL;
1310 }
1311
1312 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
1313 {
1314         struct tevent_req *req = tevent_req_callback_data(
1315                 subreq, struct tevent_req);
1316         struct rpc_api_pipe_state *state = tevent_req_data(
1317                 req, struct rpc_api_pipe_state);
1318         NTSTATUS status;
1319         uint8_t *rdata = NULL;
1320         uint32_t rdata_len = 0;
1321         char *rdata_copy;
1322
1323         status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
1324         TALLOC_FREE(subreq);
1325         if (!NT_STATUS_IS_OK(status)) {
1326                 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
1327                 tevent_req_nterror(req, status);
1328                 return;
1329         }
1330
1331         if (rdata == NULL) {
1332                 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
1333                          rpccli_pipe_txt(debug_ctx(), state->cli)));
1334                 tevent_req_done(req);
1335                 return;
1336         }
1337
1338         /*
1339          * Give the memory received from cli_trans as dynamic to the current
1340          * pdu. Duplicating it sucks, but prs_struct doesn't know about talloc
1341          * :-(
1342          */
1343         rdata_copy = (char *)memdup(rdata, rdata_len);
1344         TALLOC_FREE(rdata);
1345         if (tevent_req_nomem(rdata_copy, req)) {
1346                 return;
1347         }
1348         prs_give_memory(&state->incoming_frag, rdata_copy, rdata_len, true);
1349
1350         /* Ensure we have enough data for a pdu. */
1351         subreq = get_complete_frag_send(state, state->ev, state->cli,
1352                                         &state->rhdr, &state->incoming_frag);
1353         if (tevent_req_nomem(subreq, req)) {
1354                 return;
1355         }
1356         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1357 }
1358
1359 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
1360 {
1361         struct tevent_req *req = tevent_req_callback_data(
1362                 subreq, struct tevent_req);
1363         struct rpc_api_pipe_state *state = tevent_req_data(
1364                 req, struct rpc_api_pipe_state);
1365         NTSTATUS status;
1366         char *rdata = NULL;
1367         uint32_t rdata_len = 0;
1368
1369         status = get_complete_frag_recv(subreq);
1370         TALLOC_FREE(subreq);
1371         if (!NT_STATUS_IS_OK(status)) {
1372                 DEBUG(5, ("get_complete_frag failed: %s\n",
1373                           nt_errstr(status)));
1374                 tevent_req_nterror(req, status);
1375                 return;
1376         }
1377
1378         status = cli_pipe_validate_current_pdu(
1379                 state->cli, &state->rhdr, &state->incoming_frag,
1380                 state->expected_pkt_type, &rdata, &rdata_len,
1381                 &state->incoming_pdu);
1382
1383         DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
1384                   (unsigned)prs_data_size(&state->incoming_frag),
1385                   (unsigned)state->incoming_pdu_offset,
1386                   nt_errstr(status)));
1387
1388         if (!NT_STATUS_IS_OK(status)) {
1389                 tevent_req_nterror(req, status);
1390                 return;
1391         }
1392
1393         if ((state->rhdr.flags & RPC_FLG_FIRST)
1394             && (state->rhdr.pack_type[0] == 0)) {
1395                 /*
1396                  * Set the data type correctly for big-endian data on the
1397                  * first packet.
1398                  */
1399                 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
1400                           "big-endian.\n",
1401                           rpccli_pipe_txt(debug_ctx(), state->cli)));
1402                 prs_set_endian_data(&state->incoming_pdu, RPC_BIG_ENDIAN);
1403         }
1404         /*
1405          * Check endianness on subsequent packets.
1406          */
1407         if (state->incoming_frag.bigendian_data
1408             != state->incoming_pdu.bigendian_data) {
1409                 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
1410                          "%s\n",
1411                          state->incoming_pdu.bigendian_data?"big":"little",
1412                          state->incoming_frag.bigendian_data?"big":"little"));
1413                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1414                 return;
1415         }
1416
1417         /* Now copy the data portion out of the pdu into rbuf. */
1418         if (!prs_force_grow(&state->incoming_pdu, rdata_len)) {
1419                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1420                 return;
1421         }
1422
1423         memcpy(prs_data_p(&state->incoming_pdu) + state->incoming_pdu_offset,
1424                rdata, (size_t)rdata_len);
1425         state->incoming_pdu_offset += rdata_len;
1426
1427         status = cli_pipe_reset_current_pdu(state->cli, &state->rhdr,
1428                                             &state->incoming_frag);
1429         if (!NT_STATUS_IS_OK(status)) {
1430                 tevent_req_nterror(req, status);
1431                 return;
1432         }
1433
1434         if (state->rhdr.flags & RPC_FLG_LAST) {
1435                 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1436                           rpccli_pipe_txt(debug_ctx(), state->cli),
1437                           (unsigned)prs_data_size(&state->incoming_pdu)));
1438                 tevent_req_done(req);
1439                 return;
1440         }
1441
1442         subreq = get_complete_frag_send(state, state->ev, state->cli,
1443                                         &state->rhdr, &state->incoming_frag);
1444         if (tevent_req_nomem(subreq, req)) {
1445                 return;
1446         }
1447         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1448 }
1449
1450 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1451                                   prs_struct *reply_pdu)
1452 {
1453         struct rpc_api_pipe_state *state = tevent_req_data(
1454                 req, struct rpc_api_pipe_state);
1455         NTSTATUS status;
1456
1457         if (tevent_req_is_nterror(req, &status)) {
1458                 return status;
1459         }
1460
1461         *reply_pdu = state->incoming_pdu;
1462         reply_pdu->mem_ctx = mem_ctx;
1463
1464         /*
1465          * Prevent state->incoming_pdu from being freed in
1466          * rpc_api_pipe_state_destructor()
1467          */
1468         prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1469
1470         return NT_STATUS_OK;
1471 }
1472
1473 /*******************************************************************
1474  Creates krb5 auth bind.
1475  ********************************************************************/
1476
1477 static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
1478                                                 enum pipe_auth_level auth_level,
1479                                                 RPC_HDR_AUTH *pauth_out,
1480                                                 prs_struct *auth_data)
1481 {
1482 #ifdef HAVE_KRB5
1483         int ret;
1484         struct kerberos_auth_struct *a = cli->auth->a_u.kerberos_auth;
1485         DATA_BLOB tkt = data_blob_null;
1486         DATA_BLOB tkt_wrapped = data_blob_null;
1487
1488         /* We may change the pad length before marshalling. */
1489         init_rpc_hdr_auth(pauth_out, RPC_KRB5_AUTH_TYPE, (int)auth_level, 0, 1);
1490
1491         DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
1492                 a->service_principal ));
1493
1494         /* Create the ticket for the service principal and return it in a gss-api wrapped blob. */
1495
1496         ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
1497                         &a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL);
1498
1499         if (ret) {
1500                 DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
1501                         "failed with %s\n",
1502                         a->service_principal,
1503                         error_message(ret) ));
1504
1505                 data_blob_free(&tkt);
1506                 prs_mem_free(auth_data);
1507                 return NT_STATUS_INVALID_PARAMETER;
1508         }
1509
1510         /* wrap that up in a nice GSS-API wrapping */
1511         tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
1512
1513         data_blob_free(&tkt);
1514
1515         /* Auth len in the rpc header doesn't include auth_header. */
1516         if (!prs_copy_data_in(auth_data, (char *)tkt_wrapped.data, tkt_wrapped.length)) {
1517                 data_blob_free(&tkt_wrapped);
1518                 prs_mem_free(auth_data);
1519                 return NT_STATUS_NO_MEMORY;
1520         }
1521
1522         DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
1523         dump_data(5, tkt_wrapped.data, tkt_wrapped.length);
1524
1525         data_blob_free(&tkt_wrapped);
1526         return NT_STATUS_OK;
1527 #else
1528         return NT_STATUS_INVALID_PARAMETER;
1529 #endif
1530 }
1531
1532 /*******************************************************************
1533  Creates SPNEGO NTLMSSP auth bind.
1534  ********************************************************************/
1535
1536 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1537                                                 enum pipe_auth_level auth_level,
1538                                                 RPC_HDR_AUTH *pauth_out,
1539                                                 prs_struct *auth_data)
1540 {
1541         NTSTATUS nt_status;
1542         DATA_BLOB null_blob = data_blob_null;
1543         DATA_BLOB request = data_blob_null;
1544         DATA_BLOB spnego_msg = data_blob_null;
1545
1546         /* We may change the pad length before marshalling. */
1547         init_rpc_hdr_auth(pauth_out, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
1548
1549         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1550         nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1551                                         null_blob,
1552                                         &request);
1553
1554         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1555                 data_blob_free(&request);
1556                 prs_mem_free(auth_data);
1557                 return nt_status;
1558         }
1559
1560         /* Wrap this in SPNEGO. */
1561         spnego_msg = gen_negTokenInit(OID_NTLMSSP, request);
1562
1563         data_blob_free(&request);
1564
1565         /* Auth len in the rpc header doesn't include auth_header. */
1566         if (!prs_copy_data_in(auth_data, (char *)spnego_msg.data, spnego_msg.length)) {
1567                 data_blob_free(&spnego_msg);
1568                 prs_mem_free(auth_data);
1569                 return NT_STATUS_NO_MEMORY;
1570         }
1571
1572         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1573         dump_data(5, spnego_msg.data, spnego_msg.length);
1574
1575         data_blob_free(&spnego_msg);
1576         return NT_STATUS_OK;
1577 }
1578
1579 /*******************************************************************
1580  Creates NTLMSSP auth bind.
1581  ********************************************************************/
1582
1583 static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1584                                                 enum pipe_auth_level auth_level,
1585                                                 RPC_HDR_AUTH *pauth_out,
1586                                                 prs_struct *auth_data)
1587 {
1588         NTSTATUS nt_status;
1589         DATA_BLOB null_blob = data_blob_null;
1590         DATA_BLOB request = data_blob_null;
1591
1592         /* We may change the pad length before marshalling. */
1593         init_rpc_hdr_auth(pauth_out, RPC_NTLMSSP_AUTH_TYPE, (int)auth_level, 0, 1);
1594
1595         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1596         nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1597                                         null_blob,
1598                                         &request);
1599
1600         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1601                 data_blob_free(&request);
1602                 prs_mem_free(auth_data);
1603                 return nt_status;
1604         }
1605
1606         /* Auth len in the rpc header doesn't include auth_header. */
1607         if (!prs_copy_data_in(auth_data, (char *)request.data, request.length)) {
1608                 data_blob_free(&request);
1609                 prs_mem_free(auth_data);
1610                 return NT_STATUS_NO_MEMORY;
1611         }
1612
1613         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1614         dump_data(5, request.data, request.length);
1615
1616         data_blob_free(&request);
1617         return NT_STATUS_OK;
1618 }
1619
1620 /*******************************************************************
1621  Creates schannel auth bind.
1622  ********************************************************************/
1623
1624 static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1625                                                 enum pipe_auth_level auth_level,
1626                                                 RPC_HDR_AUTH *pauth_out,
1627                                                 prs_struct *auth_data)
1628 {
1629         RPC_AUTH_SCHANNEL_NEG schannel_neg;
1630
1631         /* We may change the pad length before marshalling. */
1632         init_rpc_hdr_auth(pauth_out, RPC_SCHANNEL_AUTH_TYPE, (int)auth_level, 0, 1);
1633
1634         /* Use lp_workgroup() if domain not specified */
1635
1636         if (!cli->auth->domain || !cli->auth->domain[0]) {
1637                 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1638                 if (cli->auth->domain == NULL) {
1639                         return NT_STATUS_NO_MEMORY;
1640                 }
1641         }
1642
1643         init_rpc_auth_schannel_neg(&schannel_neg, cli->auth->domain,
1644                                    global_myname());
1645
1646         /*
1647          * Now marshall the data into the auth parse_struct.
1648          */
1649
1650         if(!smb_io_rpc_auth_schannel_neg("schannel_neg",
1651                                        &schannel_neg, auth_data, 0)) {
1652                 DEBUG(0,("Failed to marshall RPC_AUTH_SCHANNEL_NEG.\n"));
1653                 prs_mem_free(auth_data);
1654                 return NT_STATUS_NO_MEMORY;
1655         }
1656
1657         return NT_STATUS_OK;
1658 }
1659
1660 /*******************************************************************
1661  Creates the internals of a DCE/RPC bind request or alter context PDU.
1662  ********************************************************************/
1663
1664 static NTSTATUS create_bind_or_alt_ctx_internal(enum RPC_PKT_TYPE pkt_type,
1665                                                 prs_struct *rpc_out,
1666                                                 uint32 rpc_call_id,
1667                                                 const RPC_IFACE *abstract,
1668                                                 const RPC_IFACE *transfer,
1669                                                 RPC_HDR_AUTH *phdr_auth,
1670                                                 prs_struct *pauth_info)
1671 {
1672         RPC_HDR hdr;
1673         RPC_HDR_RB hdr_rb;
1674         RPC_CONTEXT rpc_ctx;
1675         uint16 auth_len = prs_offset(pauth_info);
1676         uint8 ss_padding_len = 0;
1677         uint16 frag_len = 0;
1678
1679         /* create the RPC context. */
1680         init_rpc_context(&rpc_ctx, 0 /* context id */, abstract, transfer);
1681
1682         /* create the bind request RPC_HDR_RB */
1683         init_rpc_hdr_rb(&hdr_rb, RPC_MAX_PDU_FRAG_LEN, RPC_MAX_PDU_FRAG_LEN, 0x0, &rpc_ctx);
1684
1685         /* Start building the frag length. */
1686         frag_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1687
1688         /* Do we need to pad ? */
1689         if (auth_len) {
1690                 uint16 data_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1691                 if (data_len % 8) {
1692                         ss_padding_len = 8 - (data_len % 8);
1693                         phdr_auth->auth_pad_len = ss_padding_len;
1694                 }
1695                 frag_len += RPC_HDR_AUTH_LEN + auth_len + ss_padding_len;
1696         }
1697
1698         /* Create the request RPC_HDR */
1699         init_rpc_hdr(&hdr, pkt_type, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id, frag_len, auth_len);
1700
1701         /* Marshall the RPC header */
1702         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
1703                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR.\n"));
1704                 return NT_STATUS_NO_MEMORY;
1705         }
1706
1707         /* Marshall the bind request data */
1708         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
1709                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1710                 return NT_STATUS_NO_MEMORY;
1711         }
1712
1713         /*
1714          * Grow the outgoing buffer to store any auth info.
1715          */
1716
1717         if(auth_len != 0) {
1718                 if (ss_padding_len) {
1719                         char pad[8];
1720                         memset(pad, '\0', 8);
1721                         if (!prs_copy_data_in(rpc_out, pad, ss_padding_len)) {
1722                                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall padding.\n"));
1723                                 return NT_STATUS_NO_MEMORY;
1724                         }
1725                 }
1726
1727                 if(!smb_io_rpc_hdr_auth("hdr_auth", phdr_auth, rpc_out, 0)) {
1728                         DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_AUTH.\n"));
1729                         return NT_STATUS_NO_MEMORY;
1730                 }
1731
1732
1733                 if(!prs_append_prs_data( rpc_out, pauth_info)) {
1734                         DEBUG(0,("create_bind_or_alt_ctx_internal: failed to grow parse struct to add auth.\n"));
1735                         return NT_STATUS_NO_MEMORY;
1736                 }
1737         }
1738
1739         return NT_STATUS_OK;
1740 }
1741
1742 /*******************************************************************
1743  Creates a DCE/RPC bind request.
1744  ********************************************************************/
1745
1746 static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
1747                                 prs_struct *rpc_out,
1748                                 uint32 rpc_call_id,
1749                                 const RPC_IFACE *abstract,
1750                                 const RPC_IFACE *transfer,
1751                                 enum pipe_auth_type auth_type,
1752                                 enum pipe_auth_level auth_level)
1753 {
1754         RPC_HDR_AUTH hdr_auth;
1755         prs_struct auth_info;
1756         NTSTATUS ret = NT_STATUS_OK;
1757
1758         ZERO_STRUCT(hdr_auth);
1759         if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
1760                 return NT_STATUS_NO_MEMORY;
1761
1762         switch (auth_type) {
1763                 case PIPE_AUTH_TYPE_SCHANNEL:
1764                         ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1765                         if (!NT_STATUS_IS_OK(ret)) {
1766                                 prs_mem_free(&auth_info);
1767                                 return ret;
1768                         }
1769                         break;
1770
1771                 case PIPE_AUTH_TYPE_NTLMSSP:
1772                         ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1773                         if (!NT_STATUS_IS_OK(ret)) {
1774                                 prs_mem_free(&auth_info);
1775                                 return ret;
1776                         }
1777                         break;
1778
1779                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1780                         ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1781                         if (!NT_STATUS_IS_OK(ret)) {
1782                                 prs_mem_free(&auth_info);
1783                                 return ret;
1784                         }
1785                         break;
1786
1787                 case PIPE_AUTH_TYPE_KRB5:
1788                         ret = create_krb5_auth_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1789                         if (!NT_STATUS_IS_OK(ret)) {
1790                                 prs_mem_free(&auth_info);
1791                                 return ret;
1792                         }
1793                         break;
1794
1795                 case PIPE_AUTH_TYPE_NONE:
1796                         break;
1797
1798                 default:
1799                         /* "Can't" happen. */
1800                         return NT_STATUS_INVALID_INFO_CLASS;
1801         }
1802
1803         ret = create_bind_or_alt_ctx_internal(RPC_BIND,
1804                                                 rpc_out,
1805                                                 rpc_call_id,
1806                                                 abstract,
1807                                                 transfer,
1808                                                 &hdr_auth,
1809                                                 &auth_info);
1810
1811         prs_mem_free(&auth_info);
1812         return ret;
1813 }
1814
1815 /*******************************************************************
1816  Create and add the NTLMSSP sign/seal auth header and data.
1817  ********************************************************************/
1818
1819 static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
1820                                         RPC_HDR *phdr,
1821                                         uint32 ss_padding_len,
1822                                         prs_struct *outgoing_pdu)
1823 {
1824         RPC_HDR_AUTH auth_info;
1825         NTSTATUS status;
1826         DATA_BLOB auth_blob = data_blob_null;
1827         uint16 data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1828
1829         if (!cli->auth->a_u.ntlmssp_state) {
1830                 return NT_STATUS_INVALID_PARAMETER;
1831         }
1832
1833         /* Init and marshall the auth header. */
1834         init_rpc_hdr_auth(&auth_info,
1835                         map_pipe_auth_type_to_rpc_auth_type(
1836                                 cli->auth->auth_type),
1837                         cli->auth->auth_level,
1838                         ss_padding_len,
1839                         1 /* context id. */);
1840
1841         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
1842                 DEBUG(0,("add_ntlmssp_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
1843                 data_blob_free(&auth_blob);
1844                 return NT_STATUS_NO_MEMORY;
1845         }
1846
1847         switch (cli->auth->auth_level) {
1848                 case PIPE_AUTH_LEVEL_PRIVACY:
1849                         /* Data portion is encrypted. */
1850                         status = ntlmssp_seal_packet(cli->auth->a_u.ntlmssp_state,
1851                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1852                                         data_and_pad_len,
1853                                         (unsigned char *)prs_data_p(outgoing_pdu),
1854                                         (size_t)prs_offset(outgoing_pdu),
1855                                         &auth_blob);
1856                         if (!NT_STATUS_IS_OK(status)) {
1857                                 data_blob_free(&auth_blob);
1858                                 return status;
1859                         }
1860                         break;
1861
1862                 case PIPE_AUTH_LEVEL_INTEGRITY:
1863                         /* Data is signed. */
1864                         status = ntlmssp_sign_packet(cli->auth->a_u.ntlmssp_state,
1865                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1866                                         data_and_pad_len,
1867                                         (unsigned char *)prs_data_p(outgoing_pdu),
1868                                         (size_t)prs_offset(outgoing_pdu),
1869                                         &auth_blob);
1870                         if (!NT_STATUS_IS_OK(status)) {
1871                                 data_blob_free(&auth_blob);
1872                                 return status;
1873                         }
1874                         break;
1875
1876                 default:
1877                         /* Can't happen. */
1878                         smb_panic("bad auth level");
1879                         /* Notreached. */
1880                         return NT_STATUS_INVALID_PARAMETER;
1881         }
1882
1883         /* Finally marshall the blob. */
1884
1885         if (!prs_copy_data_in(outgoing_pdu, (const char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
1886                 DEBUG(0,("add_ntlmssp_auth_footer: failed to add %u bytes auth blob.\n",
1887                         (unsigned int)NTLMSSP_SIG_SIZE));
1888                 data_blob_free(&auth_blob);
1889                 return NT_STATUS_NO_MEMORY;
1890         }
1891
1892         data_blob_free(&auth_blob);
1893         return NT_STATUS_OK;
1894 }
1895
1896 /*******************************************************************
1897  Create and add the schannel sign/seal auth header and data.
1898  ********************************************************************/
1899
1900 static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
1901                                         RPC_HDR *phdr,
1902                                         uint32 ss_padding_len,
1903                                         prs_struct *outgoing_pdu)
1904 {
1905         RPC_HDR_AUTH auth_info;
1906         RPC_AUTH_SCHANNEL_CHK verf;
1907         struct schannel_auth_struct *sas = cli->auth->a_u.schannel_auth;
1908         char *data_p = prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
1909         size_t data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1910
1911         if (!sas) {
1912                 return NT_STATUS_INVALID_PARAMETER;
1913         }
1914
1915         /* Init and marshall the auth header. */
1916         init_rpc_hdr_auth(&auth_info,
1917                         map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
1918                         cli->auth->auth_level,
1919                         ss_padding_len,
1920                         1 /* context id. */);
1921
1922         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
1923                 DEBUG(0,("add_schannel_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
1924                 return NT_STATUS_NO_MEMORY;
1925         }
1926
1927         switch (cli->auth->auth_level) {
1928                 case PIPE_AUTH_LEVEL_PRIVACY:
1929                 case PIPE_AUTH_LEVEL_INTEGRITY:
1930                         DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
1931                                 sas->seq_num));
1932
1933                         schannel_encode(sas,
1934                                         cli->auth->auth_level,
1935                                         SENDER_IS_INITIATOR,
1936                                         &verf,
1937                                         data_p,
1938                                         data_and_pad_len);
1939
1940                         sas->seq_num++;
1941                         break;
1942
1943                 default:
1944                         /* Can't happen. */
1945                         smb_panic("bad auth level");
1946                         /* Notreached. */
1947                         return NT_STATUS_INVALID_PARAMETER;
1948         }
1949
1950         /* Finally marshall the blob. */
1951         smb_io_rpc_auth_schannel_chk("",
1952                         RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
1953                         &verf,
1954                         outgoing_pdu,
1955                         0);
1956
1957         return NT_STATUS_OK;
1958 }
1959
1960 /*******************************************************************
1961  Calculate how much data we're going to send in this packet, also
1962  work out any sign/seal padding length.
1963  ********************************************************************/
1964
1965 static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
1966                                         uint32 data_left,
1967                                         uint16 *p_frag_len,
1968                                         uint16 *p_auth_len,
1969                                         uint32 *p_ss_padding)
1970 {
1971         uint32 data_space, data_len;
1972
1973 #ifdef DEVELOPER
1974         if ((data_left > 0) && (sys_random() % 2)) {
1975                 data_left = MAX(data_left/2, 1);
1976         }
1977 #endif
1978
1979         switch (cli->auth->auth_level) {
1980                 case PIPE_AUTH_LEVEL_NONE:
1981                 case PIPE_AUTH_LEVEL_CONNECT:
1982                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN;
1983                         data_len = MIN(data_space, data_left);
1984                         *p_ss_padding = 0;
1985                         *p_auth_len = 0;
1986                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + data_len;
1987                         return data_len;
1988
1989                 case PIPE_AUTH_LEVEL_INTEGRITY:
1990                 case PIPE_AUTH_LEVEL_PRIVACY:
1991                         /* Treat the same for all authenticated rpc requests. */
1992                         switch(cli->auth->auth_type) {
1993                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1994                                 case PIPE_AUTH_TYPE_NTLMSSP:
1995                                         *p_auth_len = NTLMSSP_SIG_SIZE;
1996                                         break;
1997                                 case PIPE_AUTH_TYPE_SCHANNEL:
1998                                         *p_auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
1999                                         break;
2000                                 default:
2001                                         smb_panic("bad auth type");
2002                                         break;
2003                         }
2004
2005                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2006                                                 RPC_HDR_AUTH_LEN - *p_auth_len;
2007
2008                         data_len = MIN(data_space, data_left);
2009                         *p_ss_padding = 0;
2010                         if (data_len % 8) {
2011                                 *p_ss_padding = 8 - (data_len % 8);
2012                         }
2013                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN +                /* Normal headers. */
2014                                         data_len + *p_ss_padding +              /* data plus padding. */
2015                                         RPC_HDR_AUTH_LEN + *p_auth_len;         /* Auth header and auth data. */
2016                         return data_len;
2017
2018                 default:
2019                         smb_panic("bad auth level");
2020                         /* Notreached. */
2021                         return 0;
2022         }
2023 }
2024
2025 /*******************************************************************
2026  External interface.
2027  Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
2028  Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
2029  and deals with signing/sealing details.
2030  ********************************************************************/
2031
2032 struct rpc_api_pipe_req_state {
2033         struct event_context *ev;
2034         struct rpc_pipe_client *cli;
2035         uint8_t op_num;
2036         uint32_t call_id;
2037         prs_struct *req_data;
2038         uint32_t req_data_sent;
2039         prs_struct outgoing_frag;
2040         prs_struct reply_pdu;
2041 };
2042
2043 static int rpc_api_pipe_req_state_destructor(struct rpc_api_pipe_req_state *s)
2044 {
2045         prs_mem_free(&s->outgoing_frag);
2046         prs_mem_free(&s->reply_pdu);
2047         return 0;
2048 }
2049
2050 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
2051 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
2052 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2053                                   bool *is_last_frag);
2054
2055 struct async_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
2056                                         struct event_context *ev,
2057                                         struct rpc_pipe_client *cli,
2058                                         uint8_t op_num,
2059                                         prs_struct *req_data)
2060 {
2061         struct async_req *result;
2062         struct tevent_req *subreq;
2063         struct rpc_api_pipe_req_state *state;
2064         NTSTATUS status;
2065         bool is_last_frag;
2066
2067         if (!async_req_setup(mem_ctx, &result, &state,
2068                              struct rpc_api_pipe_req_state)) {
2069                 return NULL;
2070         }
2071         state->ev = ev;
2072         state->cli = cli;
2073         state->op_num = op_num;
2074         state->req_data = req_data;
2075         state->req_data_sent = 0;
2076         state->call_id = get_rpc_call_id();
2077
2078         if (cli->max_xmit_frag
2079             < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_MAX_SIGN_SIZE) {
2080                 /* Server is screwed up ! */
2081                 status = NT_STATUS_INVALID_PARAMETER;
2082                 goto post_status;
2083         }
2084
2085         prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2086
2087         if (!prs_init(&state->outgoing_frag, cli->max_xmit_frag,
2088                       state, MARSHALL)) {
2089                 goto fail;
2090         }
2091
2092         talloc_set_destructor(state, rpc_api_pipe_req_state_destructor);
2093
2094         status = prepare_next_frag(state, &is_last_frag);
2095         if (!NT_STATUS_IS_OK(status)) {
2096                 goto post_status;
2097         }
2098
2099         if (is_last_frag) {
2100                 subreq = rpc_api_pipe_send(state, ev, state->cli,
2101                                            &state->outgoing_frag,
2102                                            RPC_RESPONSE);
2103                 if (subreq == NULL) {
2104                         goto fail;
2105                 }
2106                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done,
2107                                         result);
2108         } else {
2109                 subreq = rpc_write_send(
2110                         state, ev, cli->transport,
2111                         (uint8_t *)prs_data_p(&state->outgoing_frag),
2112                         prs_offset(&state->outgoing_frag));
2113                 if (subreq == NULL) {
2114                         goto fail;
2115                 }
2116                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
2117                                         result);
2118         }
2119         return result;
2120
2121  post_status:
2122         if (async_post_ntstatus(result, ev, status)) {
2123                 return result;
2124         }
2125  fail:
2126         TALLOC_FREE(result);
2127         return NULL;
2128 }
2129
2130 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2131                                   bool *is_last_frag)
2132 {
2133         RPC_HDR hdr;
2134         RPC_HDR_REQ hdr_req;
2135         uint32_t data_sent_thistime;
2136         uint16_t auth_len;
2137         uint16_t frag_len;
2138         uint8_t flags = 0;
2139         uint32_t ss_padding;
2140         uint32_t data_left;
2141         char pad[8] = { 0, };
2142         NTSTATUS status;
2143
2144         data_left = prs_offset(state->req_data) - state->req_data_sent;
2145
2146         data_sent_thistime = calculate_data_len_tosend(
2147                 state->cli, data_left, &frag_len, &auth_len, &ss_padding);
2148
2149         if (state->req_data_sent == 0) {
2150                 flags = RPC_FLG_FIRST;
2151         }
2152
2153         if (data_sent_thistime == data_left) {
2154                 flags |= RPC_FLG_LAST;
2155         }
2156
2157         if (!prs_set_offset(&state->outgoing_frag, 0)) {
2158                 return NT_STATUS_NO_MEMORY;
2159         }
2160
2161         /* Create and marshall the header and request header. */
2162         init_rpc_hdr(&hdr, RPC_REQUEST, flags, state->call_id, frag_len,
2163                      auth_len);
2164
2165         if (!smb_io_rpc_hdr("hdr    ", &hdr, &state->outgoing_frag, 0)) {
2166                 return NT_STATUS_NO_MEMORY;
2167         }
2168
2169         /* Create the rpc request RPC_HDR_REQ */
2170         init_rpc_hdr_req(&hdr_req, prs_offset(state->req_data),
2171                          state->op_num);
2172
2173         if (!smb_io_rpc_hdr_req("hdr_req", &hdr_req,
2174                                 &state->outgoing_frag, 0)) {
2175                 return NT_STATUS_NO_MEMORY;
2176         }
2177
2178         /* Copy in the data, plus any ss padding. */
2179         if (!prs_append_some_prs_data(&state->outgoing_frag,
2180                                       state->req_data, state->req_data_sent,
2181                                       data_sent_thistime)) {
2182                 return NT_STATUS_NO_MEMORY;
2183         }
2184
2185         /* Copy the sign/seal padding data. */
2186         if (!prs_copy_data_in(&state->outgoing_frag, pad, ss_padding)) {
2187                 return NT_STATUS_NO_MEMORY;
2188         }
2189
2190         /* Generate any auth sign/seal and add the auth footer. */
2191         switch (state->cli->auth->auth_type) {
2192         case PIPE_AUTH_TYPE_NONE:
2193                 status = NT_STATUS_OK;
2194                 break;
2195         case PIPE_AUTH_TYPE_NTLMSSP:
2196         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2197                 status = add_ntlmssp_auth_footer(state->cli, &hdr, ss_padding,
2198                                                  &state->outgoing_frag);
2199                 break;
2200         case PIPE_AUTH_TYPE_SCHANNEL:
2201                 status = add_schannel_auth_footer(state->cli, &hdr, ss_padding,
2202                                                   &state->outgoing_frag);
2203                 break;
2204         default:
2205                 status = NT_STATUS_INVALID_PARAMETER;
2206                 break;
2207         }
2208
2209         state->req_data_sent += data_sent_thistime;
2210         *is_last_frag = ((flags & RPC_FLG_LAST) != 0);
2211
2212         return status;
2213 }
2214
2215 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
2216 {
2217         struct async_req *req = tevent_req_callback_data(
2218                 subreq, struct async_req);
2219         struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2220                 req->private_data, struct rpc_api_pipe_req_state);
2221         NTSTATUS status;
2222         bool is_last_frag;
2223
2224         status = rpc_write_recv(subreq);
2225         TALLOC_FREE(subreq);
2226         if (!NT_STATUS_IS_OK(status)) {
2227                 async_req_nterror(req, status);
2228                 return;
2229         }
2230
2231         status = prepare_next_frag(state, &is_last_frag);
2232         if (!NT_STATUS_IS_OK(status)) {
2233                 async_req_nterror(req, status);
2234                 return;
2235         }
2236
2237         if (is_last_frag) {
2238                 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2239                                            &state->outgoing_frag,
2240                                            RPC_RESPONSE);
2241                 if (async_req_nomem(subreq, req)) {
2242                         return;
2243                 }
2244                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
2245         } else {
2246                 subreq = rpc_write_send(
2247                         state, state->ev,
2248                         state->cli->transport,
2249                         (uint8_t *)prs_data_p(&state->outgoing_frag),
2250                         prs_offset(&state->outgoing_frag));
2251                 if (async_req_nomem(subreq, req)) {
2252                         return;
2253                 }
2254                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
2255                                         req);
2256         }
2257 }
2258
2259 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
2260 {
2261         struct async_req *req = tevent_req_callback_data(
2262                 subreq, struct async_req);
2263         struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2264                 req->private_data, struct rpc_api_pipe_req_state);
2265         NTSTATUS status;
2266
2267         status = rpc_api_pipe_recv(subreq, state, &state->reply_pdu);
2268         TALLOC_FREE(subreq);
2269         if (!NT_STATUS_IS_OK(status)) {
2270                 async_req_nterror(req, status);
2271                 return;
2272         }
2273         async_req_done(req);
2274 }
2275
2276 NTSTATUS rpc_api_pipe_req_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
2277                                prs_struct *reply_pdu)
2278 {
2279         struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2280                 req->private_data, struct rpc_api_pipe_req_state);
2281         NTSTATUS status;
2282
2283         if (async_req_is_nterror(req, &status)) {
2284                 /*
2285                  * We always have to initialize to reply pdu, even if there is
2286                  * none. The rpccli_* caller routines expect this.
2287                  */
2288                 prs_init_empty(reply_pdu, mem_ctx, UNMARSHALL);
2289                 return status;
2290         }
2291
2292         *reply_pdu = state->reply_pdu;
2293         reply_pdu->mem_ctx = mem_ctx;
2294
2295         /*
2296          * Prevent state->req_pdu from being freed in
2297          * rpc_api_pipe_req_state_destructor()
2298          */
2299         prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2300
2301         return NT_STATUS_OK;
2302 }
2303
2304 NTSTATUS rpc_api_pipe_req(TALLOC_CTX *mem_ctx, struct rpc_pipe_client *cli,
2305                         uint8 op_num,
2306                         prs_struct *in_data,
2307                         prs_struct *out_data)
2308 {
2309         TALLOC_CTX *frame = talloc_stackframe();
2310         struct event_context *ev;
2311         struct async_req *req;
2312         NTSTATUS status = NT_STATUS_NO_MEMORY;
2313
2314         ev = event_context_init(frame);
2315         if (ev == NULL) {
2316                 goto fail;
2317         }
2318
2319         req = rpc_api_pipe_req_send(frame, ev, cli, op_num, in_data);
2320         if (req == NULL) {
2321                 goto fail;
2322         }
2323
2324         while (req->state < ASYNC_REQ_DONE) {
2325                 event_loop_once(ev);
2326         }
2327
2328         status = rpc_api_pipe_req_recv(req, mem_ctx, out_data);
2329  fail:
2330         TALLOC_FREE(frame);
2331         return status;
2332 }
2333
2334 #if 0
2335 /****************************************************************************
2336  Set the handle state.
2337 ****************************************************************************/
2338
2339 static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
2340                                    const char *pipe_name, uint16 device_state)
2341 {
2342         bool state_set = False;
2343         char param[2];
2344         uint16 setup[2]; /* only need 2 uint16 setup parameters */
2345         char *rparam = NULL;
2346         char *rdata = NULL;
2347         uint32 rparam_len, rdata_len;
2348
2349         if (pipe_name == NULL)
2350                 return False;
2351
2352         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
2353                  cli->fnum, pipe_name, device_state));
2354
2355         /* create parameters: device state */
2356         SSVAL(param, 0, device_state);
2357
2358         /* create setup parameters. */
2359         setup[0] = 0x0001;
2360         setup[1] = cli->fnum; /* pipe file handle.  got this from an SMBOpenX. */
2361
2362         /* send the data on \PIPE\ */
2363         if (cli_api_pipe(cli->cli, "\\PIPE\\",
2364                     setup, 2, 0,                /* setup, length, max */
2365                     param, 2, 0,                /* param, length, max */
2366                     NULL, 0, 1024,              /* data, length, max */
2367                     &rparam, &rparam_len,        /* return param, length */
2368                     &rdata, &rdata_len))         /* return data, length */
2369         {
2370                 DEBUG(5, ("Set Handle state: return OK\n"));
2371                 state_set = True;
2372         }
2373
2374         SAFE_FREE(rparam);
2375         SAFE_FREE(rdata);
2376
2377         return state_set;
2378 }
2379 #endif
2380
2381 /****************************************************************************
2382  Check the rpc bind acknowledge response.
2383 ****************************************************************************/
2384
2385 static bool check_bind_response(RPC_HDR_BA *hdr_ba, const RPC_IFACE *transfer)
2386 {
2387         if ( hdr_ba->addr.len == 0) {
2388                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
2389         }
2390
2391         /* check the transfer syntax */
2392         if ((hdr_ba->transfer.if_version != transfer->if_version) ||
2393              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
2394                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
2395                 return False;
2396         }
2397
2398         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
2399                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
2400                           hdr_ba->res.num_results, hdr_ba->res.reason));
2401         }
2402
2403         DEBUG(5,("check_bind_response: accepted!\n"));
2404         return True;
2405 }
2406
2407 /*******************************************************************
2408  Creates a DCE/RPC bind authentication response.
2409  This is the packet that is sent back to the server once we
2410  have received a BIND-ACK, to finish the third leg of
2411  the authentication handshake.
2412  ********************************************************************/
2413
2414 static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
2415                                 uint32 rpc_call_id,
2416                                 enum pipe_auth_type auth_type,
2417                                 enum pipe_auth_level auth_level,
2418                                 DATA_BLOB *pauth_blob,
2419                                 prs_struct *rpc_out)
2420 {
2421         RPC_HDR hdr;
2422         RPC_HDR_AUTH hdr_auth;
2423         uint32 pad = 0;
2424
2425         /* Create the request RPC_HDR */
2426         init_rpc_hdr(&hdr, RPC_AUTH3, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id,
2427                      RPC_HEADER_LEN + 4 /* pad */ + RPC_HDR_AUTH_LEN + pauth_blob->length,
2428                      pauth_blob->length );
2429
2430         /* Marshall it. */
2431         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
2432                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR.\n"));
2433                 return NT_STATUS_NO_MEMORY;
2434         }
2435
2436         /*
2437                 I'm puzzled about this - seems to violate the DCE RPC auth rules,
2438                 about padding - shouldn't this pad to length 8 ? JRA.
2439         */
2440
2441         /* 4 bytes padding. */
2442         if (!prs_uint32("pad", rpc_out, 0, &pad)) {
2443                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall 4 byte pad.\n"));
2444                 return NT_STATUS_NO_MEMORY;
2445         }
2446
2447         /* Create the request RPC_HDR_AUTHA */
2448         init_rpc_hdr_auth(&hdr_auth,
2449                         map_pipe_auth_type_to_rpc_auth_type(auth_type),
2450                         auth_level, 0, 1);
2451
2452         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rpc_out, 0)) {
2453                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR_AUTHA.\n"));
2454                 return NT_STATUS_NO_MEMORY;
2455         }
2456
2457         /*
2458          * Append the auth data to the outgoing buffer.
2459          */
2460
2461         if(!prs_copy_data_in(rpc_out, (char *)pauth_blob->data, pauth_blob->length)) {
2462                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall auth blob.\n"));
2463                 return NT_STATUS_NO_MEMORY;
2464         }
2465
2466         return NT_STATUS_OK;
2467 }
2468
2469 /*******************************************************************
2470  Creates a DCE/RPC bind alter context authentication request which
2471  may contain a spnego auth blobl
2472  ********************************************************************/
2473
2474 static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
2475                                         const RPC_IFACE *abstract,
2476                                         const RPC_IFACE *transfer,
2477                                         enum pipe_auth_level auth_level,
2478                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
2479                                         prs_struct *rpc_out)
2480 {
2481         RPC_HDR_AUTH hdr_auth;
2482         prs_struct auth_info;
2483         NTSTATUS ret = NT_STATUS_OK;
2484
2485         ZERO_STRUCT(hdr_auth);
2486         if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
2487                 return NT_STATUS_NO_MEMORY;
2488
2489         /* We may change the pad length before marshalling. */
2490         init_rpc_hdr_auth(&hdr_auth, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
2491
2492         if (pauth_blob->length) {
2493                 if (!prs_copy_data_in(&auth_info, (const char *)pauth_blob->data, pauth_blob->length)) {
2494                         prs_mem_free(&auth_info);
2495                         return NT_STATUS_NO_MEMORY;
2496                 }
2497         }
2498
2499         ret = create_bind_or_alt_ctx_internal(RPC_ALTCONT,
2500                                                 rpc_out,
2501                                                 rpc_call_id,
2502                                                 abstract,
2503                                                 transfer,
2504                                                 &hdr_auth,
2505                                                 &auth_info);
2506         prs_mem_free(&auth_info);
2507         return ret;
2508 }
2509
2510 /****************************************************************************
2511  Do an rpc bind.
2512 ****************************************************************************/
2513
2514 struct rpc_pipe_bind_state {
2515         struct event_context *ev;
2516         struct rpc_pipe_client *cli;
2517         prs_struct rpc_out;
2518         uint32_t rpc_call_id;
2519 };
2520
2521 static int rpc_pipe_bind_state_destructor(struct rpc_pipe_bind_state *state)
2522 {
2523         prs_mem_free(&state->rpc_out);
2524         return 0;
2525 }
2526
2527 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
2528 static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
2529                                            struct rpc_pipe_bind_state *state,
2530                                            struct rpc_hdr_info *phdr,
2531                                            prs_struct *reply_pdu);
2532 static void rpc_bind_auth3_write_done(struct tevent_req *subreq);
2533 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
2534                                                     struct rpc_pipe_bind_state *state,
2535                                                     struct rpc_hdr_info *phdr,
2536                                                     prs_struct *reply_pdu);
2537 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq);
2538
2539 struct async_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
2540                                      struct event_context *ev,
2541                                      struct rpc_pipe_client *cli,
2542                                      struct cli_pipe_auth_data *auth)
2543 {
2544         struct async_req *result;
2545         struct tevent_req *subreq;
2546         struct rpc_pipe_bind_state *state;
2547         NTSTATUS status;
2548
2549         if (!async_req_setup(mem_ctx, &result, &state,
2550                              struct rpc_pipe_bind_state)) {
2551                 return NULL;
2552         }
2553
2554         DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
2555                 rpccli_pipe_txt(debug_ctx(), cli),
2556                 (unsigned int)auth->auth_type,
2557                 (unsigned int)auth->auth_level ));
2558
2559         state->ev = ev;
2560         state->cli = cli;
2561         state->rpc_call_id = get_rpc_call_id();
2562
2563         prs_init_empty(&state->rpc_out, state, MARSHALL);
2564         talloc_set_destructor(state, rpc_pipe_bind_state_destructor);
2565
2566         cli->auth = talloc_move(cli, &auth);
2567
2568         /* Marshall the outgoing data. */
2569         status = create_rpc_bind_req(cli, &state->rpc_out,
2570                                      state->rpc_call_id,
2571                                      &cli->abstract_syntax,
2572                                      &cli->transfer_syntax,
2573                                      cli->auth->auth_type,
2574                                      cli->auth->auth_level);
2575
2576         if (!NT_STATUS_IS_OK(status)) {
2577                 goto post_status;
2578         }
2579
2580         subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
2581                                    RPC_BINDACK);
2582         if (subreq == NULL) {
2583                 goto fail;
2584         }
2585         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, result);
2586         return result;
2587
2588  post_status:
2589         if (async_post_ntstatus(result, ev, status)) {
2590                 return result;
2591         }
2592  fail:
2593         TALLOC_FREE(result);
2594         return NULL;
2595 }
2596
2597 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
2598 {
2599         struct async_req *req = tevent_req_callback_data(
2600                 subreq, struct async_req);
2601         struct rpc_pipe_bind_state *state = talloc_get_type_abort(
2602                 req->private_data, struct rpc_pipe_bind_state);
2603         prs_struct reply_pdu;
2604         struct rpc_hdr_info hdr;
2605         struct rpc_hdr_ba_info hdr_ba;
2606         NTSTATUS status;
2607
2608         status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2609         TALLOC_FREE(subreq);
2610         if (!NT_STATUS_IS_OK(status)) {
2611                 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
2612                           rpccli_pipe_txt(debug_ctx(), state->cli),
2613                           nt_errstr(status)));
2614                 async_req_nterror(req, status);
2615                 return;
2616         }
2617
2618         /* Unmarshall the RPC header */
2619         if (!smb_io_rpc_hdr("hdr", &hdr, &reply_pdu, 0)) {
2620                 DEBUG(0, ("rpc_pipe_bind: failed to unmarshall RPC_HDR.\n"));
2621                 prs_mem_free(&reply_pdu);
2622                 async_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2623                 return;
2624         }
2625
2626         if (!smb_io_rpc_hdr_ba("", &hdr_ba, &reply_pdu, 0)) {
2627                 DEBUG(0, ("rpc_pipe_bind: Failed to unmarshall "
2628                           "RPC_HDR_BA.\n"));
2629                 prs_mem_free(&reply_pdu);
2630                 async_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2631                 return;
2632         }
2633
2634         if (!check_bind_response(&hdr_ba, &state->cli->transfer_syntax)) {
2635                 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
2636                 prs_mem_free(&reply_pdu);
2637                 async_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2638                 return;
2639         }
2640
2641         state->cli->max_xmit_frag = hdr_ba.bba.max_tsize;
2642         state->cli->max_recv_frag = hdr_ba.bba.max_rsize;
2643
2644         /*
2645          * For authenticated binds we may need to do 3 or 4 leg binds.
2646          */
2647
2648         switch(state->cli->auth->auth_type) {
2649
2650         case PIPE_AUTH_TYPE_NONE:
2651         case PIPE_AUTH_TYPE_SCHANNEL:
2652                 /* Bind complete. */
2653                 prs_mem_free(&reply_pdu);
2654                 async_req_done(req);
2655                 break;
2656
2657         case PIPE_AUTH_TYPE_NTLMSSP:
2658                 /* Need to send AUTH3 packet - no reply. */
2659                 status = rpc_finish_auth3_bind_send(req, state, &hdr,
2660                                                     &reply_pdu);
2661                 prs_mem_free(&reply_pdu);
2662                 if (!NT_STATUS_IS_OK(status)) {
2663                         async_req_nterror(req, status);
2664                 }
2665                 break;
2666
2667         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2668                 /* Need to send alter context request and reply. */
2669                 status = rpc_finish_spnego_ntlmssp_bind_send(req, state, &hdr,
2670                                                              &reply_pdu);
2671                 prs_mem_free(&reply_pdu);
2672                 if (!NT_STATUS_IS_OK(status)) {
2673                         async_req_nterror(req, status);
2674                 }
2675                 break;
2676
2677         case PIPE_AUTH_TYPE_KRB5:
2678                 /* */
2679
2680         default:
2681                 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
2682                          (unsigned int)state->cli->auth->auth_type));
2683                 prs_mem_free(&reply_pdu);
2684                 async_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2685         }
2686 }
2687
2688 static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
2689                                            struct rpc_pipe_bind_state *state,
2690                                            struct rpc_hdr_info *phdr,
2691                                            prs_struct *reply_pdu)
2692 {
2693         DATA_BLOB server_response = data_blob_null;
2694         DATA_BLOB client_reply = data_blob_null;
2695         struct rpc_hdr_auth_info hdr_auth;
2696         struct tevent_req *subreq;
2697         NTSTATUS status;
2698
2699         if ((phdr->auth_len == 0)
2700             || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2701                 return NT_STATUS_INVALID_PARAMETER;
2702         }
2703
2704         if (!prs_set_offset(
2705                     reply_pdu,
2706                     phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2707                 return NT_STATUS_INVALID_PARAMETER;
2708         }
2709
2710         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2711                 return NT_STATUS_INVALID_PARAMETER;
2712         }
2713
2714         /* TODO - check auth_type/auth_level match. */
2715
2716         server_response = data_blob_talloc(talloc_tos(), NULL, phdr->auth_len);
2717         prs_copy_data_out((char *)server_response.data, reply_pdu,
2718                           phdr->auth_len);
2719
2720         status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2721                                 server_response, &client_reply);
2722
2723         if (!NT_STATUS_IS_OK(status)) {
2724                 DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
2725                           "blob failed: %s.\n", nt_errstr(status)));
2726                 return status;
2727         }
2728
2729         prs_init_empty(&state->rpc_out, talloc_tos(), MARSHALL);
2730
2731         status = create_rpc_bind_auth3(state->cli, state->rpc_call_id,
2732                                        state->cli->auth->auth_type,
2733                                        state->cli->auth->auth_level,
2734                                        &client_reply, &state->rpc_out);
2735         data_blob_free(&client_reply);
2736
2737         if (!NT_STATUS_IS_OK(status)) {
2738                 return status;
2739         }
2740
2741         subreq = rpc_write_send(state, state->ev, state->cli->transport,
2742                                 (uint8_t *)prs_data_p(&state->rpc_out),
2743                                 prs_offset(&state->rpc_out));
2744         if (subreq == NULL) {
2745                 return NT_STATUS_NO_MEMORY;
2746         }
2747         tevent_req_set_callback(subreq, rpc_bind_auth3_write_done, req);
2748         return NT_STATUS_OK;
2749 }
2750
2751 static void rpc_bind_auth3_write_done(struct tevent_req *subreq)
2752 {
2753         struct async_req *req = tevent_req_callback_data(
2754                 subreq, struct async_req);
2755         NTSTATUS status;
2756
2757         status = rpc_write_recv(subreq);
2758         TALLOC_FREE(subreq);
2759         if (!NT_STATUS_IS_OK(status)) {
2760                 async_req_nterror(req, status);
2761                 return;
2762         }
2763         async_req_done(req);
2764 }
2765
2766 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
2767                                                     struct rpc_pipe_bind_state *state,
2768                                                     struct rpc_hdr_info *phdr,
2769                                                     prs_struct *reply_pdu)
2770 {
2771         DATA_BLOB server_spnego_response = data_blob_null;
2772         DATA_BLOB server_ntlm_response = data_blob_null;
2773         DATA_BLOB client_reply = data_blob_null;
2774         DATA_BLOB tmp_blob = data_blob_null;
2775         RPC_HDR_AUTH hdr_auth;
2776         struct tevent_req *subreq;
2777         NTSTATUS status;
2778
2779         if ((phdr->auth_len == 0)
2780             || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2781                 return NT_STATUS_INVALID_PARAMETER;
2782         }
2783
2784         /* Process the returned NTLMSSP blob first. */
2785         if (!prs_set_offset(
2786                     reply_pdu,
2787                     phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2788                 return NT_STATUS_INVALID_PARAMETER;
2789         }
2790
2791         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2792                 return NT_STATUS_INVALID_PARAMETER;
2793         }
2794
2795         server_spnego_response = data_blob(NULL, phdr->auth_len);
2796         prs_copy_data_out((char *)server_spnego_response.data,
2797                           reply_pdu, phdr->auth_len);
2798
2799         /*
2800          * The server might give us back two challenges - tmp_blob is for the
2801          * second.
2802          */
2803         if (!spnego_parse_challenge(server_spnego_response,
2804                                     &server_ntlm_response, &tmp_blob)) {
2805                 data_blob_free(&server_spnego_response);
2806                 data_blob_free(&server_ntlm_response);
2807                 data_blob_free(&tmp_blob);
2808                 return NT_STATUS_INVALID_PARAMETER;
2809         }
2810
2811         /* We're finished with the server spnego response and the tmp_blob. */
2812         data_blob_free(&server_spnego_response);
2813         data_blob_free(&tmp_blob);
2814
2815         status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2816                                 server_ntlm_response, &client_reply);
2817
2818         /* Finished with the server_ntlm response */
2819         data_blob_free(&server_ntlm_response);
2820
2821         if (!NT_STATUS_IS_OK(status)) {
2822                 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
2823                           "using server blob failed.\n"));
2824                 data_blob_free(&client_reply);
2825                 return status;
2826         }
2827
2828         /* SPNEGO wrap the client reply. */
2829         tmp_blob = spnego_gen_auth(client_reply);
2830         data_blob_free(&client_reply);
2831         client_reply = tmp_blob;
2832         tmp_blob = data_blob_null;
2833
2834         /* Now prepare the alter context pdu. */
2835         prs_init_empty(&state->rpc_out, state, MARSHALL);
2836
2837         status = create_rpc_alter_context(state->rpc_call_id,
2838                                           &state->cli->abstract_syntax,
2839                                           &state->cli->transfer_syntax,
2840                                           state->cli->auth->auth_level,
2841                                           &client_reply,
2842                                           &state->rpc_out);
2843         data_blob_free(&client_reply);
2844
2845         if (!NT_STATUS_IS_OK(status)) {
2846                 return status;
2847         }
2848
2849         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2850                                    &state->rpc_out, RPC_ALTCONTRESP);
2851         if (subreq == NULL) {
2852                 return NT_STATUS_NO_MEMORY;
2853         }
2854         tevent_req_set_callback(subreq, rpc_bind_ntlmssp_api_done, req);
2855         return NT_STATUS_OK;
2856 }
2857
2858 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq)
2859 {
2860         struct async_req *req = tevent_req_callback_data(
2861                 subreq, struct async_req);
2862         struct rpc_pipe_bind_state *state = talloc_get_type_abort(
2863                 req->private_data, struct rpc_pipe_bind_state);
2864         DATA_BLOB server_spnego_response = data_blob_null;
2865         DATA_BLOB tmp_blob = data_blob_null;
2866         prs_struct reply_pdu;
2867         struct rpc_hdr_info hdr;
2868         struct rpc_hdr_auth_info hdr_auth;
2869         NTSTATUS status;
2870
2871         status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2872         TALLOC_FREE(subreq);
2873         if (!NT_STATUS_IS_OK(status)) {
2874                 async_req_nterror(req, status);
2875                 return;
2876         }
2877
2878         /* Get the auth blob from the reply. */
2879         if (!smb_io_rpc_hdr("rpc_hdr   ", &hdr, &reply_pdu, 0)) {
2880                 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: Failed to "
2881                           "unmarshall RPC_HDR.\n"));
2882                 async_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2883                 return;
2884         }
2885
2886         if (!prs_set_offset(
2887                     &reply_pdu,
2888                     hdr.frag_len - hdr.auth_len - RPC_HDR_AUTH_LEN)) {
2889                 async_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
2890                 return;
2891         }
2892
2893         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &reply_pdu, 0)) {
2894                 async_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
2895                 return;
2896         }
2897
2898         server_spnego_response = data_blob(NULL, hdr.auth_len);
2899         prs_copy_data_out((char *)server_spnego_response.data, &reply_pdu,
2900                           hdr.auth_len);
2901
2902         /* Check we got a valid auth response. */
2903         if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK,
2904                                         OID_NTLMSSP, &tmp_blob)) {
2905                 data_blob_free(&server_spnego_response);
2906                 data_blob_free(&tmp_blob);
2907                 async_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
2908                 return;
2909         }
2910
2911         data_blob_free(&server_spnego_response);
2912         data_blob_free(&tmp_blob);
2913
2914         DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
2915                  "%s.\n", rpccli_pipe_txt(debug_ctx(), state->cli)));
2916         async_req_done(req);
2917 }
2918
2919 NTSTATUS rpc_pipe_bind_recv(struct async_req *req)
2920 {
2921         return async_req_simple_recv_ntstatus(req);
2922 }
2923
2924 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
2925                        struct cli_pipe_auth_data *auth)
2926 {
2927         TALLOC_CTX *frame = talloc_stackframe();
2928         struct event_context *ev;
2929         struct async_req *req;
2930         NTSTATUS status = NT_STATUS_NO_MEMORY;
2931
2932         ev = event_context_init(frame);
2933         if (ev == NULL) {
2934                 goto fail;
2935         }
2936
2937         req = rpc_pipe_bind_send(frame, ev, cli, auth);
2938         if (req == NULL) {
2939                 goto fail;
2940         }
2941
2942         while (req->state < ASYNC_REQ_DONE) {
2943                 event_loop_once(ev);
2944         }
2945
2946         status = rpc_pipe_bind_recv(req);
2947  fail:
2948         TALLOC_FREE(frame);
2949         return status;
2950 }
2951
2952 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
2953                                 unsigned int timeout)
2954 {
2955         struct cli_state *cli = rpc_pipe_np_smb_conn(rpc_cli);
2956
2957         if (cli == NULL) {
2958                 return 0;
2959         }
2960         return cli_set_timeout(cli, timeout);
2961 }
2962
2963 bool rpccli_get_pwd_hash(struct rpc_pipe_client *rpc_cli, uint8_t nt_hash[16])
2964 {
2965         struct cli_state *cli;
2966
2967         if ((rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_NTLMSSP)
2968             || (rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP)) {
2969                 memcpy(nt_hash, rpc_cli->auth->a_u.ntlmssp_state->nt_hash, 16);
2970                 return true;
2971         }
2972
2973         cli = rpc_pipe_np_smb_conn(rpc_cli);
2974         if (cli == NULL) {
2975                 return false;
2976         }
2977         E_md4hash(cli->password ? cli->password : "", nt_hash);
2978         return true;
2979 }
2980
2981 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2982                                struct cli_pipe_auth_data **presult)
2983 {
2984         struct cli_pipe_auth_data *result;
2985
2986         result = talloc(mem_ctx, struct cli_pipe_auth_data);
2987         if (result == NULL) {
2988                 return NT_STATUS_NO_MEMORY;
2989         }
2990
2991         result->auth_type = PIPE_AUTH_TYPE_NONE;
2992         result->auth_level = PIPE_AUTH_LEVEL_NONE;
2993
2994         result->user_name = talloc_strdup(result, "");
2995         result->domain = talloc_strdup(result, "");
2996         if ((result->user_name == NULL) || (result->domain == NULL)) {
2997                 TALLOC_FREE(result);
2998                 return NT_STATUS_NO_MEMORY;
2999         }
3000
3001         *presult = result;
3002         return NT_STATUS_OK;
3003 }
3004
3005 static int cli_auth_ntlmssp_data_destructor(struct cli_pipe_auth_data *auth)
3006 {
3007         ntlmssp_end(&auth->a_u.ntlmssp_state);
3008         return 0;
3009 }
3010
3011 NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
3012                                   enum pipe_auth_type auth_type,
3013                                   enum pipe_auth_level auth_level,
3014                                   const char *domain,
3015                                   const char *username,
3016                                   const char *password,
3017                                   struct cli_pipe_auth_data **presult)
3018 {
3019         struct cli_pipe_auth_data *result;
3020         NTSTATUS status;
3021
3022         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3023         if (result == NULL) {
3024                 return NT_STATUS_NO_MEMORY;
3025         }
3026
3027         result->auth_type = auth_type;
3028         result->auth_level = auth_level;
3029
3030         result->user_name = talloc_strdup(result, username);
3031         result->domain = talloc_strdup(result, domain);
3032         if ((result->user_name == NULL) || (result->domain == NULL)) {
3033                 status = NT_STATUS_NO_MEMORY;
3034                 goto fail;
3035         }
3036
3037         status = ntlmssp_client_start(&result->a_u.ntlmssp_state);
3038         if (!NT_STATUS_IS_OK(status)) {
3039                 goto fail;
3040         }
3041
3042         talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
3043
3044         status = ntlmssp_set_username(result->a_u.ntlmssp_state, username);
3045         if (!NT_STATUS_IS_OK(status)) {
3046                 goto fail;
3047         }
3048
3049         status = ntlmssp_set_domain(result->a_u.ntlmssp_state, domain);
3050         if (!NT_STATUS_IS_OK(status)) {
3051                 goto fail;
3052         }
3053
3054         status = ntlmssp_set_password(result->a_u.ntlmssp_state, password);
3055         if (!NT_STATUS_IS_OK(status)) {
3056                 goto fail;
3057         }
3058
3059         /*
3060          * Turn off sign+seal to allow selected auth level to turn it back on.
3061          */
3062         result->a_u.ntlmssp_state->neg_flags &=
3063                 ~(NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL);
3064
3065         if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
3066                 result->a_u.ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
3067         } else if (auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
3068                 result->a_u.ntlmssp_state->neg_flags
3069                         |= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
3070         }
3071
3072         *presult = result;
3073         return NT_STATUS_OK;
3074
3075  fail:
3076         TALLOC_FREE(result);
3077         return status;
3078 }
3079
3080 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
3081                                    enum pipe_auth_level auth_level,
3082                                    const uint8_t sess_key[16],
3083                                    struct cli_pipe_auth_data **presult)
3084 {
3085         struct cli_pipe_auth_data *result;
3086
3087         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3088         if (result == NULL) {
3089                 return NT_STATUS_NO_MEMORY;
3090         }
3091
3092         result->auth_type = PIPE_AUTH_TYPE_SCHANNEL;
3093         result->auth_level = auth_level;
3094
3095         result->user_name = talloc_strdup(result, "");
3096         result->domain = talloc_strdup(result, domain);
3097         if ((result->user_name == NULL) || (result->domain == NULL)) {
3098                 goto fail;
3099         }
3100
3101         result->a_u.schannel_auth = talloc(result,
3102                                            struct schannel_auth_struct);
3103         if (result->a_u.schannel_auth == NULL) {
3104                 goto fail;
3105         }
3106
3107         memcpy(result->a_u.schannel_auth->sess_key, sess_key,
3108                sizeof(result->a_u.schannel_auth->sess_key));
3109         result->a_u.schannel_auth->seq_num = 0;
3110
3111         *presult = result;
3112         return NT_STATUS_OK;
3113
3114  fail:
3115         TALLOC_FREE(result);
3116         return NT_STATUS_NO_MEMORY;
3117 }
3118
3119 #ifdef HAVE_KRB5
3120 static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
3121 {
3122         data_blob_free(&auth->session_key);
3123         return 0;
3124 }
3125 #endif
3126
3127 NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
3128                                    enum pipe_auth_level auth_level,
3129                                    const char *service_princ,
3130                                    const char *username,
3131                                    const char *password,
3132                                    struct cli_pipe_auth_data **presult)
3133 {
3134 #ifdef HAVE_KRB5
3135         struct cli_pipe_auth_data *result;
3136
3137         if ((username != NULL) && (password != NULL)) {
3138                 int ret = kerberos_kinit_password(username, password, 0, NULL);
3139                 if (ret != 0) {
3140                         return NT_STATUS_ACCESS_DENIED;
3141                 }
3142         }
3143
3144         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3145         if (result == NULL) {
3146                 return NT_STATUS_NO_MEMORY;
3147         }
3148
3149         result->auth_type = PIPE_AUTH_TYPE_KRB5;
3150         result->auth_level = auth_level;
3151
3152         /*
3153          * Username / domain need fixing!
3154          */
3155         result->user_name = talloc_strdup(result, "");
3156         result->domain = talloc_strdup(result, "");
3157         if ((result->user_name == NULL) || (result->domain == NULL)) {
3158                 goto fail;
3159         }
3160
3161         result->a_u.kerberos_auth = TALLOC_ZERO_P(
3162                 result, struct kerberos_auth_struct);
3163         if (result->a_u.kerberos_auth == NULL) {
3164                 goto fail;
3165         }
3166         talloc_set_destructor(result->a_u.kerberos_auth,
3167                               cli_auth_kerberos_data_destructor);
3168
3169         result->a_u.kerberos_auth->service_principal = talloc_strdup(
3170                 result, service_princ);
3171         if (result->a_u.kerberos_auth->service_principal == NULL) {
3172                 goto fail;
3173         }
3174
3175         *presult = result;
3176         return NT_STATUS_OK;
3177
3178  fail:
3179         TALLOC_FREE(result);
3180         return NT_STATUS_NO_MEMORY;
3181 #else
3182         return NT_STATUS_NOT_SUPPORTED;
3183 #endif
3184 }
3185
3186 /**
3187  * Create an rpc pipe client struct, connecting to a tcp port.
3188  */
3189 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
3190                                        uint16_t port,
3191                                        const struct ndr_syntax_id *abstract_syntax,
3192                                        struct rpc_pipe_client **presult)
3193 {
3194         struct rpc_pipe_client *result;
3195         struct sockaddr_storage addr;
3196         NTSTATUS status;
3197         int fd;
3198
3199         result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
3200         if (result == NULL) {
3201                 return NT_STATUS_NO_MEMORY;
3202         }
3203
3204         result->abstract_syntax = *abstract_syntax;
3205         result->transfer_syntax = ndr_transfer_syntax;
3206         result->dispatch = cli_do_rpc_ndr;
3207
3208         result->desthost = talloc_strdup(result, host);
3209         result->srv_name_slash = talloc_asprintf_strupper_m(
3210                 result, "\\\\%s", result->desthost);
3211         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3212                 status = NT_STATUS_NO_MEMORY;
3213                 goto fail;
3214         }
3215
3216         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3217         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3218
3219         if (!resolve_name(host, &addr, 0)) {
3220                 status = NT_STATUS_NOT_FOUND;
3221                 goto fail;
3222         }
3223
3224         status = open_socket_out(&addr, port, 60, &fd);
3225         if (!NT_STATUS_IS_OK(status)) {
3226                 goto fail;
3227         }
3228         set_socket_options(fd, lp_socket_options());
3229
3230         status = rpc_transport_sock_init(result, fd, &result->transport);
3231         if (!NT_STATUS_IS_OK(status)) {
3232                 close(fd);
3233                 goto fail;
3234         }
3235
3236         *presult = result;
3237         return NT_STATUS_OK;
3238
3239  fail:
3240         TALLOC_FREE(result);
3241         return status;
3242 }
3243
3244 /**
3245  * Determine the tcp port on which a dcerpc interface is listening
3246  * for the ncacn_ip_tcp transport via the endpoint mapper of the
3247  * target host.
3248  */
3249 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
3250                                       const struct ndr_syntax_id *abstract_syntax,
3251                                       uint16_t *pport)
3252 {
3253         NTSTATUS status;
3254         struct rpc_pipe_client *epm_pipe = NULL;
3255         struct cli_pipe_auth_data *auth = NULL;
3256         struct dcerpc_binding *map_binding = NULL;
3257         struct dcerpc_binding *res_binding = NULL;
3258         struct epm_twr_t *map_tower = NULL;
3259         struct epm_twr_t *res_towers = NULL;
3260         struct policy_handle *entry_handle = NULL;
3261         uint32_t num_towers = 0;
3262         uint32_t max_towers = 1;
3263         struct epm_twr_p_t towers;
3264         TALLOC_CTX *tmp_ctx = talloc_stackframe();
3265
3266         if (pport == NULL) {
3267                 status = NT_STATUS_INVALID_PARAMETER;
3268                 goto done;
3269         }
3270
3271         /* open the connection to the endpoint mapper */
3272         status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
3273                                         &ndr_table_epmapper.syntax_id,
3274                                         &epm_pipe);
3275
3276         if (!NT_STATUS_IS_OK(status)) {
3277                 goto done;
3278         }
3279
3280         status = rpccli_anon_bind_data(tmp_ctx, &auth);
3281         if (!NT_STATUS_IS_OK(status)) {
3282                 goto done;
3283         }
3284
3285         status = rpc_pipe_bind(epm_pipe, auth);
3286         if (!NT_STATUS_IS_OK(status)) {
3287                 goto done;
3288         }
3289
3290         /* create tower for asking the epmapper */
3291
3292         map_binding = TALLOC_ZERO_P(tmp_ctx, struct dcerpc_binding);
3293         if (map_binding == NULL) {
3294                 status = NT_STATUS_NO_MEMORY;
3295                 goto done;
3296         }
3297
3298         map_binding->transport = NCACN_IP_TCP;
3299         map_binding->object = *abstract_syntax;
3300         map_binding->host = host; /* needed? */
3301         map_binding->endpoint = "0"; /* correct? needed? */
3302
3303         map_tower = TALLOC_ZERO_P(tmp_ctx, struct epm_twr_t);
3304         if (map_tower == NULL) {
3305                 status = NT_STATUS_NO_MEMORY;
3306                 goto done;
3307         }
3308
3309         status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
3310                                             &(map_tower->tower));
3311         if (!NT_STATUS_IS_OK(status)) {
3312                 goto done;
3313         }
3314
3315         /* allocate further parameters for the epm_Map call */
3316
3317         res_towers = TALLOC_ARRAY(tmp_ctx, struct epm_twr_t, max_towers);
3318         if (res_towers == NULL) {
3319                 status = NT_STATUS_NO_MEMORY;
3320                 goto done;
3321         }
3322         towers.twr = res_towers;
3323
3324         entry_handle = TALLOC_ZERO_P(tmp_ctx, struct policy_handle);
3325         if (entry_handle == NULL) {
3326                 status = NT_STATUS_NO_MEMORY;
3327                 goto done;
3328         }
3329
3330         /* ask the endpoint mapper for the port */
3331
3332         status = rpccli_epm_Map(epm_pipe,
3333                                 tmp_ctx,
3334                                 CONST_DISCARD(struct GUID *,
3335                                               &(abstract_syntax->uuid)),
3336                                 map_tower,
3337                                 entry_handle,
3338                                 max_towers,
3339                                 &num_towers,
3340                                 &towers);
3341
3342         if (!NT_STATUS_IS_OK(status)) {
3343                 goto done;
3344         }
3345
3346         if (num_towers != 1) {
3347                 status = NT_STATUS_UNSUCCESSFUL;
3348                 goto done;
3349         }
3350
3351         /* extract the port from the answer */
3352
3353         status = dcerpc_binding_from_tower(tmp_ctx,
3354                                            &(towers.twr->tower),
3355                                            &res_binding);
3356         if (!NT_STATUS_IS_OK(status)) {
3357                 goto done;
3358         }
3359
3360         /* are further checks here necessary? */
3361         if (res_binding->transport != NCACN_IP_TCP) {
3362                 status = NT_STATUS_UNSUCCESSFUL;
3363                 goto done;
3364         }
3365
3366         *pport = (uint16_t)atoi(res_binding->endpoint);
3367
3368 done:
3369         TALLOC_FREE(tmp_ctx);
3370         return status;
3371 }
3372
3373 /**
3374  * Create a rpc pipe client struct, connecting to a host via tcp.
3375  * The port is determined by asking the endpoint mapper on the given
3376  * host.
3377  */
3378 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
3379                            const struct ndr_syntax_id *abstract_syntax,
3380                            struct rpc_pipe_client **presult)
3381 {
3382         NTSTATUS status;
3383         uint16_t port = 0;
3384
3385         *presult = NULL;
3386
3387         status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
3388         if (!NT_STATUS_IS_OK(status)) {
3389                 goto done;
3390         }
3391
3392         status = rpc_pipe_open_tcp_port(mem_ctx, host, port,
3393                                         abstract_syntax, presult);
3394
3395 done:
3396         return status;
3397 }
3398
3399 /********************************************************************
3400  Create a rpc pipe client struct, connecting to a unix domain socket
3401  ********************************************************************/
3402 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
3403                                const struct ndr_syntax_id *abstract_syntax,
3404                                struct rpc_pipe_client **presult)
3405 {
3406         struct rpc_pipe_client *result;
3407         struct sockaddr_un addr;
3408         NTSTATUS status;
3409         int fd;
3410
3411         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
3412         if (result == NULL) {
3413                 return NT_STATUS_NO_MEMORY;
3414         }
3415
3416         result->abstract_syntax = *abstract_syntax;
3417         result->transfer_syntax = ndr_transfer_syntax;
3418         result->dispatch = cli_do_rpc_ndr;
3419
3420         result->desthost = get_myname(result);
3421         result->srv_name_slash = talloc_asprintf_strupper_m(
3422                 result, "\\\\%s", result->desthost);
3423         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3424                 status = NT_STATUS_NO_MEMORY;
3425                 goto fail;
3426         }
3427
3428         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3429         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3430
3431         fd = socket(AF_UNIX, SOCK_STREAM, 0);
3432         if (fd == -1) {
3433                 status = map_nt_error_from_unix(errno);
3434                 goto fail;
3435         }
3436
3437         ZERO_STRUCT(addr);
3438         addr.sun_family = AF_UNIX;
3439         strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
3440
3441         if (sys_connect(fd, (struct sockaddr *)&addr) == -1) {
3442                 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
3443                           strerror(errno)));
3444                 close(fd);
3445                 return map_nt_error_from_unix(errno);
3446         }
3447
3448         status = rpc_transport_sock_init(result, fd, &result->transport);
3449         if (!NT_STATUS_IS_OK(status)) {
3450                 close(fd);
3451                 goto fail;
3452         }
3453
3454         *presult = result;
3455         return NT_STATUS_OK;
3456
3457  fail:
3458         TALLOC_FREE(result);
3459         return status;
3460 }
3461
3462 static int rpc_pipe_client_np_destructor(struct rpc_pipe_client *p)
3463 {
3464         struct cli_state *cli;
3465
3466         cli = rpc_pipe_np_smb_conn(p);
3467         if (cli != NULL) {
3468                 DLIST_REMOVE(cli->pipe_list, p);
3469         }
3470         return 0;
3471 }
3472
3473 /****************************************************************************
3474  Open a named pipe over SMB to a remote server.
3475  *
3476  * CAVEAT CALLER OF THIS FUNCTION:
3477  *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
3478  *    so be sure that this function is called AFTER any structure (vs pointer)
3479  *    assignment of the cli.  In particular, libsmbclient does structure
3480  *    assignments of cli, which invalidates the data in the returned
3481  *    rpc_pipe_client if this function is called before the structure assignment
3482  *    of cli.
3483  *
3484  ****************************************************************************/
3485
3486 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
3487                                  const struct ndr_syntax_id *abstract_syntax,
3488                                  struct rpc_pipe_client **presult)
3489 {
3490         struct rpc_pipe_client *result;
3491         NTSTATUS status;
3492
3493         /* sanity check to protect against crashes */
3494
3495         if ( !cli ) {
3496                 return NT_STATUS_INVALID_HANDLE;
3497         }
3498
3499         result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
3500         if (result == NULL) {
3501                 return NT_STATUS_NO_MEMORY;
3502         }
3503
3504         result->abstract_syntax = *abstract_syntax;
3505         result->transfer_syntax = ndr_transfer_syntax;
3506         result->dispatch = cli_do_rpc_ndr;
3507         result->desthost = talloc_strdup(result, cli->desthost);
3508         result->srv_name_slash = talloc_asprintf_strupper_m(
3509                 result, "\\\\%s", result->desthost);
3510
3511         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3512         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3513
3514         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3515                 TALLOC_FREE(result);
3516                 return NT_STATUS_NO_MEMORY;
3517         }
3518
3519         status = rpc_transport_np_init(result, cli, abstract_syntax,
3520                                        &result->transport);
3521         if (!NT_STATUS_IS_OK(status)) {
3522                 TALLOC_FREE(result);
3523                 return status;
3524         }
3525
3526         DLIST_ADD(cli->pipe_list, result);
3527         talloc_set_destructor(result, rpc_pipe_client_np_destructor);
3528
3529         *presult = result;
3530         return NT_STATUS_OK;
3531 }
3532
3533 NTSTATUS rpc_pipe_open_local(TALLOC_CTX *mem_ctx,
3534                              struct rpc_cli_smbd_conn *conn,
3535                              const struct ndr_syntax_id *syntax,
3536                              struct rpc_pipe_client **presult)
3537 {
3538         struct rpc_pipe_client *result;
3539         struct cli_pipe_auth_data *auth;
3540         NTSTATUS status;
3541
3542         result = talloc(mem_ctx, struct rpc_pipe_client);
3543         if (result == NULL) {
3544                 return NT_STATUS_NO_MEMORY;
3545         }
3546         result->abstract_syntax = *syntax;
3547         result->transfer_syntax = ndr_transfer_syntax;
3548         result->dispatch = cli_do_rpc_ndr;
3549         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3550         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3551
3552         result->desthost = talloc_strdup(result, global_myname());
3553         result->srv_name_slash = talloc_asprintf_strupper_m(
3554                 result, "\\\\%s", global_myname());
3555         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3556                 TALLOC_FREE(result);
3557                 return NT_STATUS_NO_MEMORY;
3558         }
3559
3560         status = rpc_transport_smbd_init(result, conn, syntax,
3561                                          &result->transport);
3562         if (!NT_STATUS_IS_OK(status)) {
3563                 DEBUG(1, ("rpc_transport_smbd_init failed: %s\n",
3564                           nt_errstr(status)));
3565                 TALLOC_FREE(result);
3566                 return status;
3567         }
3568
3569         status = rpccli_anon_bind_data(result, &auth);
3570         if (!NT_STATUS_IS_OK(status)) {
3571                 DEBUG(1, ("rpccli_anon_bind_data failed: %s\n",
3572                           nt_errstr(status)));
3573                 TALLOC_FREE(result);
3574                 return status;
3575         }
3576
3577         status = rpc_pipe_bind(result, auth);
3578         if (!NT_STATUS_IS_OK(status)) {
3579                 DEBUG(1, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
3580                 TALLOC_FREE(result);
3581                 return status;
3582         }
3583
3584         *presult = result;
3585         return NT_STATUS_OK;
3586 }
3587
3588 /****************************************************************************
3589  Open a pipe to a remote server.
3590  ****************************************************************************/
3591
3592 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3593                                   const struct ndr_syntax_id *interface,
3594                                   struct rpc_pipe_client **presult)
3595 {
3596         if (ndr_syntax_id_equal(interface, &ndr_table_drsuapi.syntax_id)) {
3597                 /*
3598                  * We should have a better way to figure out this drsuapi
3599                  * speciality...
3600                  */
3601                 return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
3602                                          presult);
3603         }
3604
3605         return rpc_pipe_open_np(cli, interface, presult);
3606 }
3607
3608 /****************************************************************************
3609  Open a named pipe to an SMB server and bind anonymously.
3610  ****************************************************************************/
3611
3612 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3613                                   const struct ndr_syntax_id *interface,
3614                                   struct rpc_pipe_client **presult)
3615 {
3616         struct rpc_pipe_client *result;
3617         struct cli_pipe_auth_data *auth;
3618         NTSTATUS status;
3619
3620         status = cli_rpc_pipe_open(cli, interface, &result);
3621         if (!NT_STATUS_IS_OK(status)) {
3622                 return status;
3623         }
3624
3625         status = rpccli_anon_bind_data(result, &auth);
3626         if (!NT_STATUS_IS_OK(status)) {
3627                 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3628                           nt_errstr(status)));
3629                 TALLOC_FREE(result);
3630                 return status;
3631         }
3632
3633         /*
3634          * This is a bit of an abstraction violation due to the fact that an
3635          * anonymous bind on an authenticated SMB inherits the user/domain
3636          * from the enclosing SMB creds
3637          */
3638
3639         TALLOC_FREE(auth->user_name);
3640         TALLOC_FREE(auth->domain);
3641
3642         auth->user_name = talloc_strdup(auth, cli->user_name);
3643         auth->domain = talloc_strdup(auth, cli->domain);
3644         auth->user_session_key = data_blob_talloc(auth,
3645                 cli->user_session_key.data,
3646                 cli->user_session_key.length);
3647
3648         if ((auth->user_name == NULL) || (auth->domain == NULL)) {
3649                 TALLOC_FREE(result);
3650                 return NT_STATUS_NO_MEMORY;
3651         }
3652
3653         status = rpc_pipe_bind(result, auth);
3654         if (!NT_STATUS_IS_OK(status)) {
3655                 int lvl = 0;
3656                 if (ndr_syntax_id_equal(interface,
3657                                         &ndr_table_dssetup.syntax_id)) {
3658                         /* non AD domains just don't have this pipe, avoid
3659                          * level 0 statement in that case - gd */
3660                         lvl = 3;
3661                 }
3662                 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3663                             "%s failed with error %s\n",
3664                             get_pipe_name_from_iface(interface),
3665                             nt_errstr(status) ));
3666                 TALLOC_FREE(result);
3667                 return status;
3668         }
3669
3670         DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3671                   "%s and bound anonymously.\n",
3672                   get_pipe_name_from_iface(interface), cli->desthost));
3673
3674         *presult = result;
3675         return NT_STATUS_OK;
3676 }
3677
3678 /****************************************************************************
3679  Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
3680  ****************************************************************************/
3681
3682 static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
3683                                                    const struct ndr_syntax_id *interface,
3684                                                    enum pipe_auth_type auth_type,
3685                                                    enum pipe_auth_level auth_level,
3686                                                    const char *domain,
3687                                                    const char *username,
3688                                                    const char *password,
3689                                                    struct rpc_pipe_client **presult)
3690 {
3691         struct rpc_pipe_client *result;
3692         struct cli_pipe_auth_data *auth;
3693         NTSTATUS status;
3694
3695         status = cli_rpc_pipe_open(cli, interface, &result);
3696         if (!NT_STATUS_IS_OK(status)) {
3697                 return status;
3698         }
3699
3700         status = rpccli_ntlmssp_bind_data(
3701                 result, auth_type, auth_level, domain, username,
3702                 password, &auth);
3703         if (!NT_STATUS_IS_OK(status)) {
3704                 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
3705                           nt_errstr(status)));
3706                 goto err;
3707         }
3708
3709         status = rpc_pipe_bind(result, auth);
3710         if (!NT_STATUS_IS_OK(status)) {
3711                 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
3712                         nt_errstr(status) ));
3713                 goto err;
3714         }
3715
3716         DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
3717                 "machine %s and bound NTLMSSP as user %s\\%s.\n",
3718                   get_pipe_name_from_iface(interface), cli->desthost, domain,
3719                   username ));
3720
3721         *presult = result;
3722         return NT_STATUS_OK;
3723
3724   err:
3725
3726         TALLOC_FREE(result);
3727         return status;
3728 }
3729
3730 /****************************************************************************
3731  External interface.
3732  Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
3733  ****************************************************************************/
3734
3735 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
3736                                    const struct ndr_syntax_id *interface,
3737                                    enum pipe_auth_level auth_level,
3738                                    const char *domain,
3739                                    const char *username,
3740                                    const char *password,
3741                                    struct rpc_pipe_client **presult)
3742 {
3743         return cli_rpc_pipe_open_ntlmssp_internal(cli,
3744                                                 interface,
3745                                                 PIPE_AUTH_TYPE_NTLMSSP,
3746                                                 auth_level,
3747                                                 domain,
3748                                                 username,
3749                                                 password,
3750                                                 presult);
3751 }
3752
3753 /****************************************************************************
3754  External interface.
3755  Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
3756  ****************************************************************************/
3757
3758 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
3759                                           const struct ndr_syntax_id *interface,
3760                                           enum pipe_auth_level auth_level,
3761                                           const char *domain,
3762                                           const char *username,
3763                                           const char *password,
3764                                           struct rpc_pipe_client **presult)
3765 {
3766         return cli_rpc_pipe_open_ntlmssp_internal(cli,
3767                                                 interface,
3768                                                 PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
3769                                                 auth_level,
3770                                                 domain,
3771                                                 username,
3772                                                 password,
3773                                                 presult);
3774 }
3775
3776 /****************************************************************************
3777   Get a the schannel session key out of an already opened netlogon pipe.
3778  ****************************************************************************/
3779 static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
3780                                                 struct cli_state *cli,
3781                                                 const char *domain,
3782                                                 uint32 *pneg_flags)
3783 {
3784         uint32 sec_chan_type = 0;
3785         unsigned char machine_pwd[16];
3786         const char *machine_account;
3787         NTSTATUS status;
3788
3789         /* Get the machine account credentials from secrets.tdb. */
3790         if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
3791                                &sec_chan_type))
3792         {
3793                 DEBUG(0, ("get_schannel_session_key: could not fetch "
3794                         "trust account password for domain '%s'\n",
3795                         domain));
3796                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3797         }
3798
3799         status = rpccli_netlogon_setup_creds(netlogon_pipe,
3800                                         cli->desthost, /* server name */
3801                                         domain,        /* domain */
3802                                         global_myname(), /* client name */
3803                                         machine_account, /* machine account name */
3804                                         machine_pwd,
3805                                         sec_chan_type,
3806                                         pneg_flags);
3807
3808         if (!NT_STATUS_IS_OK(status)) {
3809                 DEBUG(3, ("get_schannel_session_key_common: "
3810                           "rpccli_netlogon_setup_creds failed with result %s "
3811                           "to server %s, domain %s, machine account %s.\n",
3812                           nt_errstr(status), cli->desthost, domain,
3813                           machine_account ));
3814                 return status;
3815         }
3816
3817         if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
3818                 DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
3819                         cli->desthost));
3820                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3821         }
3822
3823         return NT_STATUS_OK;;
3824 }
3825
3826 /****************************************************************************
3827  Open a netlogon pipe and get the schannel session key.
3828  Now exposed to external callers.
3829  ****************************************************************************/
3830
3831
3832 NTSTATUS get_schannel_session_key(struct cli_state *cli,
3833                                   const char *domain,
3834                                   uint32 *pneg_flags,
3835                                   struct rpc_pipe_client **presult)
3836 {
3837         struct rpc_pipe_client *netlogon_pipe = NULL;
3838         NTSTATUS status;
3839
3840         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
3841                                           &netlogon_pipe);
3842         if (!NT_STATUS_IS_OK(status)) {
3843                 return status;
3844         }
3845
3846         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3847                                                  pneg_flags);
3848         if (!NT_STATUS_IS_OK(status)) {
3849                 TALLOC_FREE(netlogon_pipe);
3850                 return status;
3851         }
3852
3853         *presult = netlogon_pipe;
3854         return NT_STATUS_OK;
3855 }
3856
3857 /****************************************************************************
3858  External interface.
3859  Open a named pipe to an SMB server and bind using schannel (bind type 68)
3860  using session_key. sign and seal.
3861  ****************************************************************************/
3862
3863 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
3864                                              const struct ndr_syntax_id *interface,
3865                                              enum pipe_auth_level auth_level,
3866                                              const char *domain,
3867                                              const struct dcinfo *pdc,
3868                                              struct rpc_pipe_client **presult)
3869 {
3870         struct rpc_pipe_client *result;
3871         struct cli_pipe_auth_data *auth;
3872         NTSTATUS status;
3873
3874         status = cli_rpc_pipe_open(cli, interface, &result);
3875         if (!NT_STATUS_IS_OK(status)) {
3876                 return status;
3877         }
3878
3879         status = rpccli_schannel_bind_data(result, domain, auth_level,
3880                                            pdc->sess_key, &auth);
3881         if (!NT_STATUS_IS_OK(status)) {
3882                 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3883                           nt_errstr(status)));
3884                 TALLOC_FREE(result);
3885                 return status;
3886         }
3887
3888         status = rpc_pipe_bind(result, auth);
3889         if (!NT_STATUS_IS_OK(status)) {
3890                 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
3891                           "cli_rpc_pipe_bind failed with error %s\n",
3892                           nt_errstr(status) ));
3893                 TALLOC_FREE(result);
3894                 return status;
3895         }
3896
3897         /*
3898          * The credentials on a new netlogon pipe are the ones we are passed
3899          * in - copy them over.
3900          */
3901         result->dc = (struct dcinfo *)talloc_memdup(result, pdc, sizeof(*pdc));
3902         if (result->dc == NULL) {
3903                 DEBUG(0, ("talloc failed\n"));
3904                 TALLOC_FREE(result);
3905                 return NT_STATUS_NO_MEMORY;
3906         }
3907
3908         DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
3909                   "for domain %s and bound using schannel.\n",
3910                   get_pipe_name_from_iface(interface),
3911                   cli->desthost, domain ));
3912
3913         *presult = result;
3914         return NT_STATUS_OK;
3915 }
3916
3917 /****************************************************************************
3918  Open a named pipe to an SMB server and bind using schannel (bind type 68).
3919  Fetch the session key ourselves using a temporary netlogon pipe. This
3920  version uses an ntlmssp auth bound netlogon pipe to get the key.
3921  ****************************************************************************/
3922
3923 static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
3924                                                       const char *domain,
3925                                                       const char *username,
3926                                                       const char *password,
3927                                                       uint32 *pneg_flags,
3928                                                       struct rpc_pipe_client **presult)
3929 {
3930         struct rpc_pipe_client *netlogon_pipe = NULL;
3931         NTSTATUS status;
3932
3933         status = cli_rpc_pipe_open_spnego_ntlmssp(
3934                 cli, &ndr_table_netlogon.syntax_id, PIPE_AUTH_LEVEL_PRIVACY,
3935                 domain, username, password, &netlogon_pipe);
3936         if (!NT_STATUS_IS_OK(status)) {
3937                 return status;
3938         }
3939
3940         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3941                                                  pneg_flags);
3942         if (!NT_STATUS_IS_OK(status)) {
3943                 TALLOC_FREE(netlogon_pipe);
3944                 return status;
3945         }
3946
3947         *presult = netlogon_pipe;
3948         return NT_STATUS_OK;
3949 }
3950
3951 /****************************************************************************
3952  Open a named pipe to an SMB server and bind using schannel (bind type 68).
3953  Fetch the session key ourselves using a temporary netlogon pipe. This version
3954  uses an ntlmssp bind to get the session key.
3955  ****************************************************************************/
3956
3957 NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
3958                                                  const struct ndr_syntax_id *interface,
3959                                                  enum pipe_auth_level auth_level,
3960                                                  const char *domain,
3961                                                  const char *username,
3962                                                  const char *password,
3963                                                  struct rpc_pipe_client **presult)
3964 {
3965         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
3966         struct rpc_pipe_client *netlogon_pipe = NULL;
3967         struct rpc_pipe_client *result = NULL;
3968         NTSTATUS status;
3969
3970         status = get_schannel_session_key_auth_ntlmssp(
3971                 cli, domain, username, password, &neg_flags, &netlogon_pipe);
3972         if (!NT_STATUS_IS_OK(status)) {
3973                 DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
3974                         "key from server %s for domain %s.\n",
3975                         cli->desthost, domain ));
3976                 return status;
3977         }
3978
3979         status = cli_rpc_pipe_open_schannel_with_key(
3980                 cli, interface, auth_level, domain, netlogon_pipe->dc,
3981                 &result);
3982
3983         /* Now we've bound using the session key we can close the netlog pipe. */
3984         TALLOC_FREE(netlogon_pipe);
3985
3986         if (NT_STATUS_IS_OK(status)) {
3987                 *presult = result;
3988         }
3989         return status;
3990 }
3991
3992 /****************************************************************************
3993  Open a named pipe to an SMB server and bind using schannel (bind type 68).
3994  Fetch the session key ourselves using a temporary netlogon pipe.
3995  ****************************************************************************/
3996
3997 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
3998                                     const struct ndr_syntax_id *interface,
3999                                     enum pipe_auth_level auth_level,
4000                                     const char *domain,
4001                                     struct rpc_pipe_client **presult)
4002 {
4003         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
4004         struct rpc_pipe_client *netlogon_pipe = NULL;
4005         struct rpc_pipe_client *result = NULL;
4006         NTSTATUS status;
4007
4008         status = get_schannel_session_key(cli, domain, &neg_flags,
4009                                           &netlogon_pipe);
4010         if (!NT_STATUS_IS_OK(status)) {
4011                 DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
4012                         "key from server %s for domain %s.\n",
4013                         cli->desthost, domain ));
4014                 return status;
4015         }
4016
4017         status = cli_rpc_pipe_open_schannel_with_key(
4018                 cli, interface, auth_level, domain, netlogon_pipe->dc,
4019                 &result);
4020
4021         /* Now we've bound using the session key we can close the netlog pipe. */
4022         TALLOC_FREE(netlogon_pipe);
4023
4024         if (NT_STATUS_IS_OK(status)) {
4025                 *presult = result;
4026         }
4027
4028         return NT_STATUS_OK;
4029 }
4030
4031 /****************************************************************************
4032  Open a named pipe to an SMB server and bind using krb5 (bind type 16).
4033  The idea is this can be called with service_princ, username and password all
4034  NULL so long as the caller has a TGT.
4035  ****************************************************************************/
4036
4037 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
4038                                 const struct ndr_syntax_id *interface,
4039                                 enum pipe_auth_level auth_level,
4040                                 const char *service_princ,
4041                                 const char *username,
4042                                 const char *password,
4043                                 struct rpc_pipe_client **presult)
4044 {
4045 #ifdef HAVE_KRB5
4046         struct rpc_pipe_client *result;
4047         struct cli_pipe_auth_data *auth;
4048         NTSTATUS status;
4049
4050         status = cli_rpc_pipe_open(cli, interface, &result);
4051         if (!NT_STATUS_IS_OK(status)) {
4052                 return status;
4053         }
4054
4055         status = rpccli_kerberos_bind_data(result, auth_level, service_princ,
4056                                            username, password, &auth);
4057         if (!NT_STATUS_IS_OK(status)) {
4058                 DEBUG(0, ("rpccli_kerberos_bind_data returned %s\n",
4059                           nt_errstr(status)));
4060                 TALLOC_FREE(result);
4061                 return status;
4062         }
4063
4064         status = rpc_pipe_bind(result, auth);
4065         if (!NT_STATUS_IS_OK(status)) {
4066                 DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
4067                           "with error %s\n", nt_errstr(status)));
4068                 TALLOC_FREE(result);
4069                 return status;
4070         }
4071
4072         *presult = result;
4073         return NT_STATUS_OK;
4074 #else
4075         DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
4076         return NT_STATUS_NOT_IMPLEMENTED;
4077 #endif
4078 }
4079
4080 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
4081                              struct rpc_pipe_client *cli,
4082                              DATA_BLOB *session_key)
4083 {
4084         if (!session_key || !cli) {
4085                 return NT_STATUS_INVALID_PARAMETER;
4086         }
4087
4088         if (!cli->auth) {
4089                 return NT_STATUS_INVALID_PARAMETER;
4090         }
4091
4092         switch (cli->auth->auth_type) {
4093                 case PIPE_AUTH_TYPE_SCHANNEL:
4094                         *session_key = data_blob_talloc(mem_ctx,
4095                                 cli->auth->a_u.schannel_auth->sess_key, 16);
4096                         break;
4097                 case PIPE_AUTH_TYPE_NTLMSSP:
4098                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
4099                         *session_key = data_blob_talloc(mem_ctx,
4100                                 cli->auth->a_u.ntlmssp_state->session_key.data,
4101                                 cli->auth->a_u.ntlmssp_state->session_key.length);
4102                         break;
4103                 case PIPE_AUTH_TYPE_KRB5:
4104                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
4105                         *session_key = data_blob_talloc(mem_ctx,
4106                                 cli->auth->a_u.kerberos_auth->session_key.data,
4107                                 cli->auth->a_u.kerberos_auth->session_key.length);
4108                         break;
4109                 case PIPE_AUTH_TYPE_NONE:
4110                         *session_key = data_blob_talloc(mem_ctx,
4111                                 cli->auth->user_session_key.data,
4112                                 cli->auth->user_session_key.length);
4113                         break;
4114                 default:
4115                         return NT_STATUS_NO_USER_SESSION_KEY;
4116         }
4117
4118         return NT_STATUS_OK;
4119 }