source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "librpc/gen_ndr/cli_epmapper.h"
  22 #include "../librpc/gen_ndr/ndr_schannel.h"
  23 #include "../librpc/gen_ndr/ndr_lsa.h"
  24 #include "../librpc/gen_ndr/ndr_dssetup.h"
  25 #include "../librpc/gen_ndr/ndr_samr.h"
  26 #include "../librpc/gen_ndr/ndr_netlogon.h"
  27 #include "../librpc/gen_ndr/ndr_srvsvc.h"
  28 #include "../librpc/gen_ndr/ndr_wkssvc.h"
  29 #include "../librpc/gen_ndr/ndr_winreg.h"
  30 #include "../librpc/gen_ndr/ndr_spoolss.h"
  31 #include "../librpc/gen_ndr/ndr_dfs.h"
  32 #include "../librpc/gen_ndr/ndr_echo.h"
  33 #include "../librpc/gen_ndr/ndr_initshutdown.h"
  34 #include "../librpc/gen_ndr/ndr_svcctl.h"
  35 #include "../librpc/gen_ndr/ndr_eventlog.h"
  36 #include "../librpc/gen_ndr/ndr_ntsvcs.h"
  37 #include "../librpc/gen_ndr/ndr_epmapper.h"
  38 #include "../librpc/gen_ndr/ndr_drsuapi.h"
  39 #include "../libcli/auth/schannel.h"
  40 #include "../libcli/auth/spnego.h"
  41 #include "smb_krb5.h"
  42 #include "../libcli/auth/ntlmssp.h"
  43 #include "rpc_client/cli_netlogon.h"
  44 #include "librpc/gen_ndr/ndr_dcerpc.h"
  45
  46 #undef DBGC_CLASS
  47 #define DBGC_CLASS DBGC_RPC_CLI
  48
  49 static const char *get_pipe_name_from_iface(
  50         TALLOC_CTX *mem_ctx, const struct ndr_interface_table *interface)
  51 {
  52         int i;
  53         const struct ndr_interface_string_array *ep = interface->endpoints;
  54         char *p;
  55
  56         for (i=0; i<ep->count; i++) {
  57                 if (strncmp(ep->names[i], "ncacn_np:[\\pipe\\", 16) == 0) {
  58                         break;
  59                 }
  60         }
  61         if (i == ep->count) {
  62                 return NULL;
  63         }
  64
  65         /*
  66          * extract the pipe name without \\pipe from for example
  67          * ncacn_np:[\\pipe\\epmapper]
  68          */
  69         p = strchr(ep->names[i]+15, ']');
  70         if (p == NULL) {
  71                 return "PIPE";
  72         }
  73         return talloc_strndup(mem_ctx, ep->names[i]+15, p - ep->names[i] - 15);
  74 }
  75
  76 static const struct ndr_interface_table **interfaces;
  77
  78 bool smb_register_ndr_interface(const struct ndr_interface_table *interface)
  79 {
  80         int num_interfaces = talloc_array_length(interfaces);
  81         const struct ndr_interface_table **tmp;
  82         int i;
  83
  84         for (i=0; i<num_interfaces; i++) {
  85                 if (ndr_syntax_id_equal(&interfaces[i]->syntax_id,
  86                                         &interface->syntax_id)) {
  87                         return true;
  88                 }
  89         }
  90
  91         tmp = talloc_realloc(NULL, interfaces,
  92                              const struct ndr_interface_table *,
  93                              num_interfaces + 1);
  94         if (tmp == NULL) {
  95                 DEBUG(1, ("smb_register_ndr_interface: talloc failed\n"));
  96                 return false;
  97         }
  98         interfaces = tmp;
  99         interfaces[num_interfaces] = interface;
 100         return true;
 101 }
 102
 103 static bool initialize_interfaces(void)
 104 {
 105         if (!smb_register_ndr_interface(&ndr_table_lsarpc)) {
 106                 return false;
 107         }
 108         if (!smb_register_ndr_interface(&ndr_table_dssetup)) {
 109                 return false;
 110         }
 111         if (!smb_register_ndr_interface(&ndr_table_samr)) {
 112                 return false;
 113         }
 114         if (!smb_register_ndr_interface(&ndr_table_netlogon)) {
 115                 return false;
 116         }
 117         if (!smb_register_ndr_interface(&ndr_table_srvsvc)) {
 118                 return false;
 119         }
 120         if (!smb_register_ndr_interface(&ndr_table_wkssvc)) {
 121                 return false;
 122         }
 123         if (!smb_register_ndr_interface(&ndr_table_winreg)) {
 124                 return false;
 125         }
 126         if (!smb_register_ndr_interface(&ndr_table_spoolss)) {
 127                 return false;
 128         }
 129         if (!smb_register_ndr_interface(&ndr_table_netdfs)) {
 130                 return false;
 131         }
 132         if (!smb_register_ndr_interface(&ndr_table_rpcecho)) {
 133                 return false;
 134         }
 135         if (!smb_register_ndr_interface(&ndr_table_initshutdown)) {
 136                 return false;
 137         }
 138         if (!smb_register_ndr_interface(&ndr_table_svcctl)) {
 139                 return false;
 140         }
 141         if (!smb_register_ndr_interface(&ndr_table_eventlog)) {
 142                 return false;
 143         }
 144         if (!smb_register_ndr_interface(&ndr_table_ntsvcs)) {
 145                 return false;
 146         }
 147         if (!smb_register_ndr_interface(&ndr_table_epmapper)) {
 148                 return false;
 149         }
 150         if (!smb_register_ndr_interface(&ndr_table_drsuapi)) {
 151                 return false;
 152         }
 153         return true;
 154 }
 155
 156 const struct ndr_interface_table *get_iface_from_syntax(
 157         const struct ndr_syntax_id *syntax)
 158 {
 159         int num_interfaces;
 160         int i;
 161
 162         if (interfaces == NULL) {
 163                 if (!initialize_interfaces()) {
 164                         return NULL;
 165                 }
 166         }
 167         num_interfaces = talloc_array_length(interfaces);
 168
 169         for (i=0; i<num_interfaces; i++) {
 170                 if (ndr_syntax_id_equal(&interfaces[i]->syntax_id, syntax)) {
 171                         return interfaces[i];
 172                 }
 173         }
 174
 175         return NULL;
 176 }
 177
 178 /****************************************************************************
 179  Return the pipe name from the interface.
 180  ****************************************************************************/
 181
 182 const char *get_pipe_name_from_syntax(TALLOC_CTX *mem_ctx,
 183                                       const struct ndr_syntax_id *syntax)
 184 {
 185         const struct ndr_interface_table *interface;
 186         char *guid_str;
 187         const char *result;
 188
 189         interface = get_iface_from_syntax(syntax);
 190         if (interface != NULL) {
 191                 result = get_pipe_name_from_iface(mem_ctx, interface);
 192                 if (result != NULL) {
 193                         return result;
 194                 }
 195         }
 196
 197         /*
 198          * Here we should ask \\epmapper, but for now our code is only
 199          * interested in the known pipes mentioned in pipe_names[]
 200          */
 201
 202         guid_str = GUID_string(talloc_tos(), &syntax->uuid);
 203         if (guid_str == NULL) {
 204                 return NULL;
 205         }
 206         result = talloc_asprintf(mem_ctx, "Interface %s.%d", guid_str,
 207                                  (int)syntax->if_version);
 208         TALLOC_FREE(guid_str);
 209
 210         if (result == NULL) {
 211                 return "PIPE";
 212         }
 213         return result;
 214 }
 215
 216 /********************************************************************
 217  Map internal value to wire value.
 218  ********************************************************************/
 219
 220 static int map_pipe_auth_type_to_rpc_auth_type(enum pipe_auth_type auth_type)
 221 {
 222         switch (auth_type) {
 223
 224         case PIPE_AUTH_TYPE_NONE:
 225                 return DCERPC_AUTH_TYPE_NONE;
 226
 227         case PIPE_AUTH_TYPE_NTLMSSP:
 228                 return DCERPC_AUTH_TYPE_NTLMSSP;
 229
 230         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 231         case PIPE_AUTH_TYPE_SPNEGO_KRB5:
 232                 return DCERPC_AUTH_TYPE_SPNEGO;
 233
 234         case PIPE_AUTH_TYPE_SCHANNEL:
 235                 return DCERPC_AUTH_TYPE_SCHANNEL;
 236
 237         case PIPE_AUTH_TYPE_KRB5:
 238                 return DCERPC_AUTH_TYPE_KRB5;
 239
 240         default:
 241                 DEBUG(0,("map_pipe_auth_type_to_rpc_type: unknown pipe "
 242                         "auth type %u\n",
 243                         (unsigned int)auth_type ));
 244                 break;
 245         }
 246         return -1;
 247 }
 248
 249 /********************************************************************
 250  Pipe description for a DEBUG
 251  ********************************************************************/
 252 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
 253                                    struct rpc_pipe_client *cli)
 254 {
 255         char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
 256         if (result == NULL) {
 257                 return "pipe";
 258         }
 259         return result;
 260 }
 261
 262 /********************************************************************
 263  Rpc pipe call id.
 264  ********************************************************************/
 265
 266 static uint32 get_rpc_call_id(void)
 267 {
 268         static uint32 call_id = 0;
 269         return ++call_id;
 270 }
 271
 272 /*
 273  * Realloc pdu to have a least "size" bytes
 274  */
 275
 276 static bool rpc_grow_buffer(prs_struct *pdu, size_t size)
 277 {
 278         size_t extra_size;
 279
 280         if (prs_data_size(pdu) >= size) {
 281                 return true;
 282         }
 283
 284         extra_size = size - prs_data_size(pdu);
 285
 286         if (!prs_force_grow(pdu, extra_size)) {
 287                 DEBUG(0, ("rpc_grow_buffer: Failed to grow parse struct by "
 288                           "%d bytes.\n", (int)extra_size));
 289                 return false;
 290         }
 291
 292         DEBUG(5, ("rpc_grow_buffer: grew buffer by %d bytes to %u\n",
 293                   (int)extra_size, prs_data_size(pdu)));
 294         return true;
 295 }
 296
 297 /*******************************************************************
 298 *******************************************************************/
 299
 300 NTSTATUS dcerpc_push_ncacn_packet(TALLOC_CTX *mem_ctx,
 301                                   enum dcerpc_pkt_type ptype,
 302                                   uint8_t pfc_flags,
 303                                   uint16_t frag_length,
 304                                   uint16_t auth_length,
 305                                   uint32_t call_id,
 306                                   union dcerpc_payload u,
 307                                   DATA_BLOB *blob)
 308 {
 309         struct ncacn_packet r;
 310         enum ndr_err_code ndr_err;
 311
 312         r.rpc_vers              = 5;
 313         r.rpc_vers_minor        = 0;
 314         r.ptype                 = ptype;
 315         r.pfc_flags             = pfc_flags;
 316         r.drep[0]               = DCERPC_DREP_LE;
 317         r.drep[1]               = 0;
 318         r.drep[2]               = 0;
 319         r.drep[3]               = 0;
 320         r.frag_length           = frag_length;
 321         r.auth_length           = auth_length;
 322         r.call_id               = call_id;
 323         r.u                     = u;
 324
 325         ndr_err = ndr_push_struct_blob(blob, mem_ctx, &r,
 326                 (ndr_push_flags_fn_t)ndr_push_ncacn_packet);
 327         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 328                 return ndr_map_error2ntstatus(ndr_err);
 329         }
 330
 331         if (DEBUGLEVEL >= 10) {
 332                 NDR_PRINT_DEBUG(ncacn_packet, &r);
 333         }
 334
 335         return NT_STATUS_OK;
 336 }
 337
 338 /*******************************************************************
 339 *******************************************************************/
 340
 341 NTSTATUS dcerpc_pull_ncacn_packet(TALLOC_CTX *mem_ctx,
 342                                   const DATA_BLOB *blob,
 343                                   struct ncacn_packet *r)
 344 {
 345         enum ndr_err_code ndr_err;
 346
 347         ndr_err = ndr_pull_struct_blob(blob, mem_ctx, r,
 348                 (ndr_pull_flags_fn_t)ndr_pull_ncacn_packet);
 349         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 350                 return ndr_map_error2ntstatus(ndr_err);
 351         }
 352
 353         if (DEBUGLEVEL >= 10) {
 354                 NDR_PRINT_DEBUG(ncacn_packet, r);
 355         }
 356
 357         return NT_STATUS_OK;
 358 }
 359
 360 /*******************************************************************
 361 *******************************************************************/
 362
 363 NTSTATUS dcerpc_pull_ncacn_packet_header(TALLOC_CTX *mem_ctx,
 364                                          const DATA_BLOB *blob,
 365                                          struct ncacn_packet_header *r)
 366 {
 367         enum ndr_err_code ndr_err;
 368
 369         ndr_err = ndr_pull_struct_blob(blob, mem_ctx, r,
 370                 (ndr_pull_flags_fn_t)ndr_pull_ncacn_packet_header);
 371         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 372                 return ndr_map_error2ntstatus(ndr_err);
 373         }
 374
 375         if (DEBUGLEVEL >= 10) {
 376                 NDR_PRINT_DEBUG(ncacn_packet_header, r);
 377         }
 378
 379         return NT_STATUS_OK;
 380 }
 381
 382 /*******************************************************************
 383  ********************************************************************/
 384
 385 static NTSTATUS dcerpc_push_schannel_bind(TALLOC_CTX *mem_ctx,
 386                                           struct NL_AUTH_MESSAGE *r,
 387                                           DATA_BLOB *blob)
 388 {
 389         enum ndr_err_code ndr_err;
 390
 391         ndr_err = ndr_push_struct_blob(blob, mem_ctx, r,
 392                 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 393         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 394                 return ndr_map_error2ntstatus(ndr_err);
 395         }
 396
 397         if (DEBUGLEVEL >= 10) {
 398                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, r);
 399         }
 400
 401         return NT_STATUS_OK;
 402 }
 403
 404 /*******************************************************************
 405  ********************************************************************/
 406
 407 static NTSTATUS dcerpc_pull_dcerpc_auth(TALLOC_CTX *mem_ctx,
 408                                         const DATA_BLOB *blob,
 409                                         struct dcerpc_auth *r)
 410 {
 411         enum ndr_err_code ndr_err;
 412
 413         ndr_err = ndr_pull_struct_blob(blob, mem_ctx, r,
 414                 (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
 415         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 416                 return ndr_map_error2ntstatus(ndr_err);
 417         }
 418
 419         if (DEBUGLEVEL >= 10) {
 420                 NDR_PRINT_DEBUG(dcerpc_auth, r);
 421         }
 422
 423         return NT_STATUS_OK;
 424 }
 425
 426 /*******************************************************************
 427  Use SMBreadX to get rest of one fragment's worth of rpc data.
 428  Reads the whole size or give an error message
 429  ********************************************************************/
 430
 431 struct rpc_read_state {
 432         struct event_context *ev;
 433         struct rpc_cli_transport *transport;
 434         uint8_t *data;
 435         size_t size;
 436         size_t num_read;
 437 };
 438
 439 static void rpc_read_done(struct tevent_req *subreq);
 440
 441 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
 442                                         struct event_context *ev,
 443                                         struct rpc_cli_transport *transport,
 444                                         uint8_t *data, size_t size)
 445 {
 446         struct tevent_req *req, *subreq;
 447         struct rpc_read_state *state;
 448
 449         req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
 450         if (req == NULL) {
 451                 return NULL;
 452         }
 453         state->ev = ev;
 454         state->transport = transport;
 455         state->data = data;
 456         state->size = size;
 457         state->num_read = 0;
 458
 459         DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
 460
 461         subreq = transport->read_send(state, ev, (uint8_t *)data, size,
 462                                       transport->priv);
 463         if (subreq == NULL) {
 464                 goto fail;
 465         }
 466         tevent_req_set_callback(subreq, rpc_read_done, req);
 467         return req;
 468
 469  fail:
 470         TALLOC_FREE(req);
 471         return NULL;
 472 }
 473
 474 static void rpc_read_done(struct tevent_req *subreq)
 475 {
 476         struct tevent_req *req = tevent_req_callback_data(
 477                 subreq, struct tevent_req);
 478         struct rpc_read_state *state = tevent_req_data(
 479                 req, struct rpc_read_state);
 480         NTSTATUS status;
 481         ssize_t received;
 482
 483         status = state->transport->read_recv(subreq, &received);
 484         TALLOC_FREE(subreq);
 485         if (!NT_STATUS_IS_OK(status)) {
 486                 tevent_req_nterror(req, status);
 487                 return;
 488         }
 489
 490         state->num_read += received;
 491         if (state->num_read == state->size) {
 492                 tevent_req_done(req);
 493                 return;
 494         }
 495
 496         subreq = state->transport->read_send(state, state->ev,
 497                                              state->data + state->num_read,
 498                                              state->size - state->num_read,
 499                                              state->transport->priv);
 500         if (tevent_req_nomem(subreq, req)) {
 501                 return;
 502         }
 503         tevent_req_set_callback(subreq, rpc_read_done, req);
 504 }
 505
 506 static NTSTATUS rpc_read_recv(struct tevent_req *req)
 507 {
 508         return tevent_req_simple_recv_ntstatus(req);
 509 }
 510
 511 struct rpc_write_state {
 512         struct event_context *ev;
 513         struct rpc_cli_transport *transport;
 514         const uint8_t *data;
 515         size_t size;
 516         size_t num_written;
 517 };
 518
 519 static void rpc_write_done(struct tevent_req *subreq);
 520
 521 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
 522                                          struct event_context *ev,
 523                                          struct rpc_cli_transport *transport,
 524                                          const uint8_t *data, size_t size)
 525 {
 526         struct tevent_req *req, *subreq;
 527         struct rpc_write_state *state;
 528
 529         req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
 530         if (req == NULL) {
 531                 return NULL;
 532         }
 533         state->ev = ev;
 534         state->transport = transport;
 535         state->data = data;
 536         state->size = size;
 537         state->num_written = 0;
 538
 539         DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
 540
 541         subreq = transport->write_send(state, ev, data, size, transport->priv);
 542         if (subreq == NULL) {
 543                 goto fail;
 544         }
 545         tevent_req_set_callback(subreq, rpc_write_done, req);
 546         return req;
 547  fail:
 548         TALLOC_FREE(req);
 549         return NULL;
 550 }
 551
 552 static void rpc_write_done(struct tevent_req *subreq)
 553 {
 554         struct tevent_req *req = tevent_req_callback_data(
 555                 subreq, struct tevent_req);
 556         struct rpc_write_state *state = tevent_req_data(
 557                 req, struct rpc_write_state);
 558         NTSTATUS status;
 559         ssize_t written;
 560
 561         status = state->transport->write_recv(subreq, &written);
 562         TALLOC_FREE(subreq);
 563         if (!NT_STATUS_IS_OK(status)) {
 564                 tevent_req_nterror(req, status);
 565                 return;
 566         }
 567
 568         state->num_written += written;
 569
 570         if (state->num_written == state->size) {
 571                 tevent_req_done(req);
 572                 return;
 573         }
 574
 575         subreq = state->transport->write_send(state, state->ev,
 576                                               state->data + state->num_written,
 577                                               state->size - state->num_written,
 578                                               state->transport->priv);
 579         if (tevent_req_nomem(subreq, req)) {
 580                 return;
 581         }
 582         tevent_req_set_callback(subreq, rpc_write_done, req);
 583 }
 584
 585 static NTSTATUS rpc_write_recv(struct tevent_req *req)
 586 {
 587         return tevent_req_simple_recv_ntstatus(req);
 588 }
 589
 590
 591 static NTSTATUS parse_rpc_header(struct rpc_pipe_client *cli,
 592                                  struct ncacn_packet_header *prhdr,
 593                                  prs_struct *pdu)
 594 {
 595         NTSTATUS status;
 596         DATA_BLOB blob = data_blob_const(prs_data_p(pdu), prs_data_size(pdu));
 597
 598         /*
 599          * This next call sets the endian bit correctly in current_pdu. We
 600          * will propagate this to rbuf later.
 601          */
 602
 603         status = dcerpc_pull_ncacn_packet_header(cli, &blob, prhdr);
 604         if (!NT_STATUS_IS_OK(status)) {
 605                 return status;
 606         }
 607
 608         if (!prs_set_offset(pdu, prs_offset(pdu) + RPC_HEADER_LEN)) {
 609                 return NT_STATUS_BUFFER_TOO_SMALL;
 610         }
 611
 612         if (UNMARSHALLING(pdu) && prhdr->drep[0] == 0) {
 613                 DEBUG(10,("parse_rpc_header: PDU data format is big-endian. Setting flag.\n"));
 614                 prs_set_endian_data(pdu, RPC_BIG_ENDIAN);
 615         }
 616
 617         if (prhdr->frag_length > cli->max_recv_frag) {
 618                 DEBUG(0, ("cli_pipe_get_current_pdu: Server sent fraglen %d,"
 619                           " we only allow %d\n", (int)prhdr->frag_length,
 620                           (int)cli->max_recv_frag));
 621                 return NT_STATUS_BUFFER_TOO_SMALL;
 622         }
 623
 624         return NT_STATUS_OK;
 625 }
 626
 627 /****************************************************************************
 628  Try and get a PDU's worth of data from current_pdu. If not, then read more
 629  from the wire.
 630  ****************************************************************************/
 631
 632 struct get_complete_frag_state {
 633         struct event_context *ev;
 634         struct rpc_pipe_client *cli;
 635         struct ncacn_packet_header *prhdr;
 636         prs_struct *pdu;
 637 };
 638
 639 static void get_complete_frag_got_header(struct tevent_req *subreq);
 640 static void get_complete_frag_got_rest(struct tevent_req *subreq);
 641
 642 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
 643                                                  struct event_context *ev,
 644                                                  struct rpc_pipe_client *cli,
 645                                                  struct ncacn_packet_header *prhdr,
 646                                                  prs_struct *pdu)
 647 {
 648         struct tevent_req *req, *subreq;
 649         struct get_complete_frag_state *state;
 650         uint32_t pdu_len;
 651         NTSTATUS status;
 652
 653         req = tevent_req_create(mem_ctx, &state,
 654                                 struct get_complete_frag_state);
 655         if (req == NULL) {
 656                 return NULL;
 657         }
 658         state->ev = ev;
 659         state->cli = cli;
 660         state->prhdr = prhdr;
 661         state->pdu = pdu;
 662
 663         pdu_len = prs_data_size(pdu);
 664         if (pdu_len < RPC_HEADER_LEN) {
 665                 if (!rpc_grow_buffer(pdu, RPC_HEADER_LEN)) {
 666                         status = NT_STATUS_NO_MEMORY;
 667                         goto post_status;
 668                 }
 669                 subreq = rpc_read_send(
 670                         state, state->ev,
 671                         state->cli->transport,
 672                         (uint8_t *)(prs_data_p(state->pdu) + pdu_len),
 673                         RPC_HEADER_LEN - pdu_len);
 674                 if (subreq == NULL) {
 675                         status = NT_STATUS_NO_MEMORY;
 676                         goto post_status;
 677                 }
 678                 tevent_req_set_callback(subreq, get_complete_frag_got_header,
 679                                         req);
 680                 return req;
 681         }
 682
 683         status = parse_rpc_header(cli, prhdr, pdu);
 684         if (!NT_STATUS_IS_OK(status)) {
 685                 goto post_status;
 686         }
 687
 688         /*
 689          * Ensure we have frag_len bytes of data.
 690          */
 691         if (pdu_len < prhdr->frag_length) {
 692                 if (!rpc_grow_buffer(pdu, prhdr->frag_length)) {
 693                         status = NT_STATUS_NO_MEMORY;
 694                         goto post_status;
 695                 }
 696                 subreq = rpc_read_send(state, state->ev,
 697                                        state->cli->transport,
 698                                        (uint8_t *)(prs_data_p(pdu) + pdu_len),
 699                                        prhdr->frag_length - pdu_len);
 700                 if (subreq == NULL) {
 701                         status = NT_STATUS_NO_MEMORY;
 702                         goto post_status;
 703                 }
 704                 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
 705                                         req);
 706                 return req;
 707         }
 708
 709         status = NT_STATUS_OK;
 710  post_status:
 711         if (NT_STATUS_IS_OK(status)) {
 712                 tevent_req_done(req);
 713         } else {
 714                 tevent_req_nterror(req, status);
 715         }
 716         return tevent_req_post(req, ev);
 717 }
 718
 719 static void get_complete_frag_got_header(struct tevent_req *subreq)
 720 {
 721         struct tevent_req *req = tevent_req_callback_data(
 722                 subreq, struct tevent_req);
 723         struct get_complete_frag_state *state = tevent_req_data(
 724                 req, struct get_complete_frag_state);
 725         NTSTATUS status;
 726
 727         status = rpc_read_recv(subreq);
 728         TALLOC_FREE(subreq);
 729         if (!NT_STATUS_IS_OK(status)) {
 730                 tevent_req_nterror(req, status);
 731                 return;
 732         }
 733
 734         status = parse_rpc_header(state->cli, state->prhdr, state->pdu);
 735         if (!NT_STATUS_IS_OK(status)) {
 736                 tevent_req_nterror(req, status);
 737                 return;
 738         }
 739
 740         if (!rpc_grow_buffer(state->pdu, state->prhdr->frag_length)) {
 741                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 742                 return;
 743         }
 744
 745         /*
 746          * We're here in this piece of code because we've read exactly
 747          * RPC_HEADER_LEN bytes into state->pdu.
 748          */
 749
 750         subreq = rpc_read_send(
 751                 state, state->ev, state->cli->transport,
 752                 (uint8_t *)(prs_data_p(state->pdu) + RPC_HEADER_LEN),
 753                 state->prhdr->frag_length - RPC_HEADER_LEN);
 754         if (tevent_req_nomem(subreq, req)) {
 755                 return;
 756         }
 757         tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
 758 }
 759
 760 static void get_complete_frag_got_rest(struct tevent_req *subreq)
 761 {
 762         struct tevent_req *req = tevent_req_callback_data(
 763                 subreq, struct tevent_req);
 764         NTSTATUS status;
 765
 766         status = rpc_read_recv(subreq);
 767         TALLOC_FREE(subreq);
 768         if (!NT_STATUS_IS_OK(status)) {
 769                 tevent_req_nterror(req, status);
 770                 return;
 771         }
 772         tevent_req_done(req);
 773 }
 774
 775 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
 776 {
 777         return tevent_req_simple_recv_ntstatus(req);
 778 }
 779
 780 /****************************************************************************
 781  NTLMSSP specific sign/seal.
 782  Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
 783  In fact I should probably abstract these into identical pieces of code... JRA.
 784  ****************************************************************************/
 785
 786 static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli,
 787                                 struct ncacn_packet_header *prhdr,
 788                                 prs_struct *current_pdu,
 789                                 uint8 *p_ss_padding_len)
 790 {
 791         struct dcerpc_auth auth_info;
 792         uint32 save_offset = prs_offset(current_pdu);
 793         uint32_t auth_len = prhdr->auth_length;
 794         struct ntlmssp_state *ntlmssp_state = cli->auth->a_u.ntlmssp_state;
 795         unsigned char *data = NULL;
 796         size_t data_len;
 797         unsigned char *full_packet_data = NULL;
 798         size_t full_packet_data_len;
 799         DATA_BLOB auth_blob;
 800         DATA_BLOB blob;
 801         NTSTATUS status;
 802
 803         if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
 804             || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
 805                 return NT_STATUS_OK;
 806         }
 807
 808         if (!ntlmssp_state) {
 809                 return NT_STATUS_INVALID_PARAMETER;
 810         }
 811
 812         /* Ensure there's enough data for an authenticated response. */
 813         if (auth_len > RPC_MAX_PDU_FRAG_LEN ||
 814                         prhdr->frag_length < RPC_HEADER_LEN +
 815                                              RPC_HDR_RESP_LEN +
 816                                              RPC_HDR_AUTH_LEN + auth_len) {
 817                 DEBUG(0,("cli_pipe_verify_ntlmssp: auth_len %u is too large.\n",
 818                         (unsigned int)auth_len ));
 819                 return NT_STATUS_BUFFER_TOO_SMALL;
 820         }
 821
 822         /*
 823          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
 824          * after the RPC header.
 825          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
 826          * functions as NTLMv2 checks the rpc headers also.
 827          */
 828
 829         data = (unsigned char *)(prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN);
 830         data_len = (size_t)(prhdr->frag_length - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len);
 831
 832         full_packet_data = (unsigned char *)prs_data_p(current_pdu);
 833         full_packet_data_len = prhdr->frag_length - auth_len;
 834
 835         /* Pull the auth header and the following data into a blob. */
 836         /* NB. The offset of the auth_header is relative to the *end*
 837          * of the packet, not the start. */
 838         if(!prs_set_offset(current_pdu, prhdr->frag_length - RPC_HDR_AUTH_LEN - auth_len)) {
 839                 DEBUG(0,("cli_pipe_verify_ntlmssp: cannot move offset to %u.\n",
 840                         (unsigned int)RPC_HEADER_LEN + (unsigned int)RPC_HDR_RESP_LEN + (unsigned int)data_len ));
 841                 return NT_STATUS_BUFFER_TOO_SMALL;
 842         }
 843
 844         blob = data_blob_const(prs_data_p(current_pdu) + prs_offset(current_pdu),
 845                                prs_data_size(current_pdu) - prs_offset(current_pdu));
 846
 847         status = dcerpc_pull_dcerpc_auth(cli, &blob, &auth_info);
 848         if (!NT_STATUS_IS_OK(status)) {
 849                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall dcerpc_auth.\n"));
 850                 return status;
 851         }
 852
 853         /* Ensure auth_pad_len fits into the packet. */
 854         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_length +
 855                         RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_length) {
 856                 DEBUG(0,("cli_pipe_verify_ntlmssp: auth_info.auth_pad_len "
 857                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
 858                         (unsigned int)auth_info.auth_pad_length,
 859                         (unsigned int)auth_len,
 860                         (unsigned int)prhdr->frag_length));
 861                 return NT_STATUS_BUFFER_TOO_SMALL;
 862         }
 863
 864
 865         auth_blob = auth_info.credentials;
 866
 867         switch (cli->auth->auth_level) {
 868                 case DCERPC_AUTH_LEVEL_PRIVACY:
 869                         /* Data is encrypted. */
 870                         status = ntlmssp_unseal_packet(ntlmssp_state,
 871                                                         data, data_len,
 872                                                         full_packet_data,
 873                                                         full_packet_data_len,
 874                                                         &auth_blob);
 875                         if (!NT_STATUS_IS_OK(status)) {
 876                                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unseal "
 877                                         "packet from %s. Error was %s.\n",
 878                                         rpccli_pipe_txt(talloc_tos(), cli),
 879                                         nt_errstr(status) ));
 880                                 return status;
 881                         }
 882                         break;
 883                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 884                         /* Data is signed. */
 885                         status = ntlmssp_check_packet(ntlmssp_state,
 886                                                         data, data_len,
 887                                                         full_packet_data,
 888                                                         full_packet_data_len,
 889                                                         &auth_blob);
 890                         if (!NT_STATUS_IS_OK(status)) {
 891                                 DEBUG(0,("cli_pipe_verify_ntlmssp: check signing failed on "
 892                                         "packet from %s. Error was %s.\n",
 893                                         rpccli_pipe_txt(talloc_tos(), cli),
 894                                         nt_errstr(status) ));
 895                                 return status;
 896                         }
 897                         break;
 898                 default:
 899                         DEBUG(0, ("cli_pipe_verify_ntlmssp: unknown internal "
 900                                   "auth level %d\n", cli->auth->auth_level));
 901                         return NT_STATUS_INVALID_INFO_CLASS;
 902         }
 903
 904         /*
 905          * Return the current pointer to the data offset.
 906          */
 907
 908         if(!prs_set_offset(current_pdu, save_offset)) {
 909                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
 910                         (unsigned int)save_offset ));
 911                 return NT_STATUS_BUFFER_TOO_SMALL;
 912         }
 913
 914         /*
 915          * Remember the padding length. We must remove it from the real data
 916          * stream once the sign/seal is done.
 917          */
 918
 919         *p_ss_padding_len = auth_info.auth_pad_length;
 920
 921         return NT_STATUS_OK;
 922 }
 923
 924 /****************************************************************************
 925  schannel specific sign/seal.
 926  ****************************************************************************/
 927
 928 static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli,
 929                                 struct ncacn_packet_header *prhdr,
 930                                 prs_struct *current_pdu,
 931                                 uint8 *p_ss_padding_len)
 932 {
 933         RPC_HDR_AUTH auth_info;
 934         uint32_t auth_len = prhdr->auth_length;
 935         uint32 save_offset = prs_offset(current_pdu);
 936         struct schannel_state *schannel_auth =
 937                 cli->auth->a_u.schannel_auth;
 938         uint8_t *data;
 939         uint32 data_len;
 940         DATA_BLOB blob;
 941         NTSTATUS status;
 942
 943         if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
 944             || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
 945                 return NT_STATUS_OK;
 946         }
 947
 948         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
 949                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u.\n", (unsigned int)auth_len ));
 950                 return NT_STATUS_INVALID_PARAMETER;
 951         }
 952
 953         if (!schannel_auth) {
 954                 return NT_STATUS_INVALID_PARAMETER;
 955         }
 956
 957         /* Ensure there's enough data for an authenticated response. */
 958         if ((auth_len > RPC_MAX_PDU_FRAG_LEN) ||
 959                         (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_length)) {
 960                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u is too large.\n",
 961                         (unsigned int)auth_len ));
 962                 return NT_STATUS_INVALID_PARAMETER;
 963         }
 964
 965         data_len = prhdr->frag_length - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 966
 967         /* Pull the auth header and the following data into a blob. */
 968         /* NB. The offset of the auth_header is relative to the *end*
 969          * of the packet, not the start. */
 970         if(!prs_set_offset(current_pdu,
 971                         prhdr->frag_length - RPC_HDR_AUTH_LEN - auth_len)) {
 972                 DEBUG(0,("cli_pipe_verify_schannel: cannot move "
 973                         "offset to %u.\n",
 974                         (unsigned int)(prhdr->frag_length -
 975                                 RPC_HDR_AUTH_LEN - auth_len) ));
 976                 return NT_STATUS_BUFFER_TOO_SMALL;
 977         }
 978
 979         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
 980                 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshall RPC_HDR_AUTH.\n"));
 981                 return NT_STATUS_BUFFER_TOO_SMALL;
 982         }
 983
 984         /* Ensure auth_pad_len fits into the packet. */
 985         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
 986                         RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_length) {
 987                 DEBUG(0,("cli_pipe_verify_schannel: auth_info.auth_pad_len "
 988                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
 989                         (unsigned int)auth_info.auth_pad_len,
 990                         (unsigned int)auth_len,
 991                         (unsigned int)prhdr->frag_length));
 992                 return NT_STATUS_BUFFER_TOO_SMALL;
 993         }
 994
 995         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
 996                 DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n",
 997                         auth_info.auth_type));
 998                 return NT_STATUS_BUFFER_TOO_SMALL;
 999         }
1000
1001         blob = data_blob_const(prs_data_p(current_pdu) + prs_offset(current_pdu), auth_len);
1002
1003         if (DEBUGLEVEL >= 10) {
1004                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
1005         }
1006
1007         data = (uint8_t *)prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN;
1008
1009         switch (cli->auth->auth_level) {
1010         case DCERPC_AUTH_LEVEL_PRIVACY:
1011                 status = netsec_incoming_packet(schannel_auth,
1012                                                 talloc_tos(),
1013                                                 true,
1014                                                 data,
1015                                                 data_len,
1016                                                 &blob);
1017                 break;
1018         case DCERPC_AUTH_LEVEL_INTEGRITY:
1019                 status = netsec_incoming_packet(schannel_auth,
1020                                                 talloc_tos(),
1021                                                 false,
1022                                                 data,
1023                                                 data_len,
1024                                                 &blob);
1025                 break;
1026         default:
1027                 status = NT_STATUS_INTERNAL_ERROR;
1028                 break;
1029         }
1030
1031         if (!NT_STATUS_IS_OK(status)) {
1032                 DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
1033                                 "Connection to %s (%s).\n",
1034                                 rpccli_pipe_txt(talloc_tos(), cli),
1035                                 nt_errstr(status)));
1036                 return NT_STATUS_INVALID_PARAMETER;
1037         }
1038
1039         /*
1040          * Return the current pointer to the data offset.
1041          */
1042
1043         if(!prs_set_offset(current_pdu, save_offset)) {
1044                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1045                         (unsigned int)save_offset ));
1046                 return NT_STATUS_BUFFER_TOO_SMALL;
1047         }
1048
1049         /*
1050          * Remember the padding length. We must remove it from the real data
1051          * stream once the sign/seal is done.
1052          */
1053
1054         *p_ss_padding_len = auth_info.auth_pad_len;
1055
1056         return NT_STATUS_OK;
1057 }
1058
1059 /****************************************************************************
1060  Do the authentication checks on an incoming pdu. Check sign and unseal etc.
1061  ****************************************************************************/
1062
1063 static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli,
1064                                 struct ncacn_packet_header *prhdr,
1065                                 prs_struct *current_pdu,
1066                                 uint8 *p_ss_padding_len)
1067 {
1068         NTSTATUS ret = NT_STATUS_OK;
1069
1070         /* Paranioa checks for auth_len. */
1071         if (prhdr->auth_length) {
1072                 if (prhdr->auth_length > prhdr->frag_length) {
1073                         return NT_STATUS_INVALID_PARAMETER;
1074                 }
1075
1076                 if (prhdr->auth_length + (unsigned int)RPC_HDR_AUTH_LEN < prhdr->auth_length ||
1077                                 prhdr->auth_length + (unsigned int)RPC_HDR_AUTH_LEN < (unsigned int)RPC_HDR_AUTH_LEN) {
1078                         /* Integer wrap attempt. */
1079                         return NT_STATUS_INVALID_PARAMETER;
1080                 }
1081         }
1082
1083         /*
1084          * Now we have a complete RPC request PDU fragment, try and verify any auth data.
1085          */
1086
1087         switch(cli->auth->auth_type) {
1088                 case PIPE_AUTH_TYPE_NONE:
1089                         if (prhdr->auth_length) {
1090                                 DEBUG(3, ("cli_pipe_validate_rpc_response: "
1091                                           "Connection to %s - got non-zero "
1092                                           "auth len %u.\n",
1093                                         rpccli_pipe_txt(talloc_tos(), cli),
1094                                         (unsigned int)prhdr->auth_length));
1095                                 return NT_STATUS_INVALID_PARAMETER;
1096                         }
1097                         break;
1098
1099                 case PIPE_AUTH_TYPE_NTLMSSP:
1100                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1101                         ret = cli_pipe_verify_ntlmssp(cli, prhdr, current_pdu, p_ss_padding_len);
1102                         if (!NT_STATUS_IS_OK(ret)) {
1103                                 return ret;
1104                         }
1105                         break;
1106
1107                 case PIPE_AUTH_TYPE_SCHANNEL:
1108                         ret = cli_pipe_verify_schannel(cli, prhdr, current_pdu, p_ss_padding_len);
1109                         if (!NT_STATUS_IS_OK(ret)) {
1110                                 return ret;
1111                         }
1112                         break;
1113
1114                 case PIPE_AUTH_TYPE_KRB5:
1115                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
1116                 default:
1117                         DEBUG(3, ("cli_pipe_validate_rpc_response: Connection "
1118                                   "to %s - unknown internal auth type %u.\n",
1119                                   rpccli_pipe_txt(talloc_tos(), cli),
1120                                   cli->auth->auth_type ));
1121                         return NT_STATUS_INVALID_INFO_CLASS;
1122         }
1123
1124         return NT_STATUS_OK;
1125 }
1126
1127 /****************************************************************************
1128  Do basic authentication checks on an incoming pdu.
1129  ****************************************************************************/
1130
1131 static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli,
1132                         struct ncacn_packet_header *prhdr,
1133                         prs_struct *current_pdu,
1134                         uint8 expected_pkt_type,
1135                         char **ppdata,
1136                         uint32 *pdata_len,
1137                         prs_struct *return_data)
1138 {
1139
1140         NTSTATUS ret = NT_STATUS_OK;
1141         uint32 current_pdu_len = prs_data_size(current_pdu);
1142
1143         if (current_pdu_len != prhdr->frag_length) {
1144                 DEBUG(5,("cli_pipe_validate_current_pdu: incorrect pdu length %u, expected %u\n",
1145                         (unsigned int)current_pdu_len, (unsigned int)prhdr->frag_length));
1146                 return NT_STATUS_INVALID_PARAMETER;
1147         }
1148
1149         /*
1150          * Point the return values at the real data including the RPC
1151          * header. Just in case the caller wants it.
1152          */
1153         *ppdata = prs_data_p(current_pdu);
1154         *pdata_len = current_pdu_len;
1155
1156         /* Ensure we have the correct type. */
1157         switch (prhdr->ptype) {
1158                 case DCERPC_PKT_ALTER_RESP:
1159                 case DCERPC_PKT_BIND_ACK:
1160
1161                         /* Alter context and bind ack share the same packet definitions. */
1162                         break;
1163
1164
1165                 case DCERPC_PKT_RESPONSE:
1166                 {
1167                         RPC_HDR_RESP rhdr_resp;
1168                         uint8 ss_padding_len = 0;
1169
1170                         if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
1171                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
1172                                 return NT_STATUS_BUFFER_TOO_SMALL;
1173                         }
1174
1175                         /* Here's where we deal with incoming sign/seal. */
1176                         ret = cli_pipe_validate_rpc_response(cli, prhdr,
1177                                         current_pdu, &ss_padding_len);
1178                         if (!NT_STATUS_IS_OK(ret)) {
1179                                 return ret;
1180                         }
1181
1182                         /* Point the return values at the NDR data. Remember to remove any ss padding. */
1183                         *ppdata = prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
1184
1185                         if (current_pdu_len < RPC_HEADER_LEN + RPC_HDR_RESP_LEN + ss_padding_len) {
1186                                 return NT_STATUS_BUFFER_TOO_SMALL;
1187                         }
1188
1189                         *pdata_len = current_pdu_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - ss_padding_len;
1190
1191                         /* Remember to remove the auth footer. */
1192                         if (prhdr->auth_length) {
1193                                 /* We've already done integer wrap tests on auth_len in
1194                                         cli_pipe_validate_rpc_response(). */
1195                                 if (*pdata_len < RPC_HDR_AUTH_LEN + prhdr->auth_length) {
1196                                         return NT_STATUS_BUFFER_TOO_SMALL;
1197                                 }
1198                                 *pdata_len -= (RPC_HDR_AUTH_LEN + prhdr->auth_length);
1199                         }
1200
1201                         DEBUG(10,("cli_pipe_validate_current_pdu: got pdu len %u, data_len %u, ss_len %u\n",
1202                                 current_pdu_len, *pdata_len, ss_padding_len ));
1203
1204                         /*
1205                          * If this is the first reply, and the allocation hint is reasonably, try and
1206                          * set up the return_data parse_struct to the correct size.
1207                          */
1208
1209                         if ((prs_data_size(return_data) == 0) && rhdr_resp.alloc_hint && (rhdr_resp.alloc_hint < 15*1024*1024)) {
1210                                 if (!prs_set_buffer_size(return_data, rhdr_resp.alloc_hint)) {
1211                                         DEBUG(0,("cli_pipe_validate_current_pdu: reply alloc hint %u "
1212                                                 "too large to allocate\n",
1213                                                 (unsigned int)rhdr_resp.alloc_hint ));
1214                                         return NT_STATUS_NO_MEMORY;
1215                                 }
1216                         }
1217
1218                         break;
1219                 }
1220
1221                 case DCERPC_PKT_BIND_NAK:
1222                         DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
1223                                   "received from %s!\n",
1224                                   rpccli_pipe_txt(talloc_tos(), cli)));
1225                         /* Use this for now... */
1226                         return NT_STATUS_NETWORK_ACCESS_DENIED;
1227
1228                 case DCERPC_PKT_FAULT:
1229                 {
1230                         DATA_BLOB blob;
1231                         struct ncacn_packet r;
1232
1233                         blob = data_blob_const(prs_data_p(current_pdu),
1234                                                prs_data_size(current_pdu));
1235
1236                         ret = dcerpc_pull_ncacn_packet(cli, &blob, &r);
1237                         if (!NT_STATUS_IS_OK(ret)) {
1238                                 return ret;
1239                         }
1240                         DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
1241                                   "code %s received from %s!\n",
1242                                 dcerpc_errstr(talloc_tos(), r.u.fault.status),
1243                                 rpccli_pipe_txt(talloc_tos(), cli)));
1244
1245                         if (NT_STATUS_IS_OK(NT_STATUS(r.u.fault.status))) {
1246                                 return NT_STATUS_UNSUCCESSFUL;
1247                         } else {
1248                                 return NT_STATUS(r.u.fault.status);
1249                         }
1250                 }
1251
1252                 default:
1253                         DEBUG(0, ("cli_pipe_validate_current_pdu: unknown packet type %u received "
1254                                 "from %s!\n",
1255                                 (unsigned int)prhdr->ptype,
1256                                 rpccli_pipe_txt(talloc_tos(), cli)));
1257                         return NT_STATUS_INVALID_INFO_CLASS;
1258         }
1259
1260         if (prhdr->ptype != expected_pkt_type) {
1261                 DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
1262                           "got an unexpected RPC packet type - %u, not %u\n",
1263                         rpccli_pipe_txt(talloc_tos(), cli),
1264                         prhdr->ptype,
1265                         expected_pkt_type));
1266                 return NT_STATUS_INVALID_INFO_CLASS;
1267         }
1268
1269         /* Do this just before return - we don't want to modify any rpc header
1270            data before now as we may have needed to do cryptographic actions on
1271            it before. */
1272
1273         if ((prhdr->ptype == DCERPC_PKT_BIND_ACK) && !(prhdr->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
1274                 DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
1275                         "setting fragment first/last ON.\n"));
1276                 prhdr->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1277         }
1278
1279         return NT_STATUS_OK;
1280 }
1281
1282 /****************************************************************************
1283  Ensure we eat the just processed pdu from the current_pdu prs_struct.
1284  Normally the frag_len and buffer size will match, but on the first trans
1285  reply there is a theoretical chance that buffer size > frag_len, so we must
1286  deal with that.
1287  ****************************************************************************/
1288
1289 static NTSTATUS cli_pipe_reset_current_pdu(struct rpc_pipe_client *cli,
1290                                            struct ncacn_packet_header *prhdr,
1291                                            prs_struct *current_pdu)
1292 {
1293         uint32 current_pdu_len = prs_data_size(current_pdu);
1294
1295         if (current_pdu_len < prhdr->frag_length) {
1296                 return NT_STATUS_BUFFER_TOO_SMALL;
1297         }
1298
1299         /* Common case. */
1300         if (current_pdu_len == (uint32)prhdr->frag_length) {
1301                 prs_mem_free(current_pdu);
1302                 prs_init_empty(current_pdu, prs_get_mem_context(current_pdu), UNMARSHALL);
1303                 /* Make current_pdu dynamic with no memory. */
1304                 prs_give_memory(current_pdu, 0, 0, True);
1305                 return NT_STATUS_OK;
1306         }
1307
1308         /*
1309          * Oh no ! More data in buffer than we processed in current pdu.
1310          * Cheat. Move the data down and shrink the buffer.
1311          */
1312
1313         memcpy(prs_data_p(current_pdu), prs_data_p(current_pdu) + prhdr->frag_length,
1314                         current_pdu_len - prhdr->frag_length);
1315
1316         /* Remember to set the read offset back to zero. */
1317         prs_set_offset(current_pdu, 0);
1318
1319         /* Shrink the buffer. */
1320         if (!prs_set_buffer_size(current_pdu, current_pdu_len - prhdr->frag_length)) {
1321                 return NT_STATUS_BUFFER_TOO_SMALL;
1322         }
1323
1324         return NT_STATUS_OK;
1325 }
1326
1327 /****************************************************************************
1328  Call a remote api on an arbitrary pipe.  takes param, data and setup buffers.
1329 ****************************************************************************/
1330
1331 struct cli_api_pipe_state {
1332         struct event_context *ev;
1333         struct rpc_cli_transport *transport;
1334         uint8_t *rdata;
1335         uint32_t rdata_len;
1336 };
1337
1338 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
1339 static void cli_api_pipe_write_done(struct tevent_req *subreq);
1340 static void cli_api_pipe_read_done(struct tevent_req *subreq);
1341
1342 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
1343                                             struct event_context *ev,
1344                                             struct rpc_cli_transport *transport,
1345                                             uint8_t *data, size_t data_len,
1346                                             uint32_t max_rdata_len)
1347 {
1348         struct tevent_req *req, *subreq;
1349         struct cli_api_pipe_state *state;
1350         NTSTATUS status;
1351
1352         req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
1353         if (req == NULL) {
1354                 return NULL;
1355         }
1356         state->ev = ev;
1357         state->transport = transport;
1358
1359         if (max_rdata_len < RPC_HEADER_LEN) {
1360                 /*
1361                  * For a RPC reply we always need at least RPC_HEADER_LEN
1362                  * bytes. We check this here because we will receive
1363                  * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
1364                  */
1365                 status = NT_STATUS_INVALID_PARAMETER;
1366                 goto post_status;
1367         }
1368
1369         if (transport->trans_send != NULL) {
1370                 subreq = transport->trans_send(state, ev, data, data_len,
1371                                                max_rdata_len, transport->priv);
1372                 if (subreq == NULL) {
1373                         goto fail;
1374                 }
1375                 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
1376                 return req;
1377         }
1378
1379         /*
1380          * If the transport does not provide a "trans" routine, i.e. for
1381          * example the ncacn_ip_tcp transport, do the write/read step here.
1382          */
1383
1384         subreq = rpc_write_send(state, ev, transport, data, data_len);
1385         if (subreq == NULL) {
1386                 goto fail;
1387         }
1388         tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
1389         return req;
1390
1391  post_status:
1392         tevent_req_nterror(req, status);
1393         return tevent_req_post(req, ev);
1394  fail:
1395         TALLOC_FREE(req);
1396         return NULL;
1397 }
1398
1399 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
1400 {
1401         struct tevent_req *req = tevent_req_callback_data(
1402                 subreq, struct tevent_req);
1403         struct cli_api_pipe_state *state = tevent_req_data(
1404                 req, struct cli_api_pipe_state);
1405         NTSTATUS status;
1406
1407         status = state->transport->trans_recv(subreq, state, &state->rdata,
1408                                               &state->rdata_len);
1409         TALLOC_FREE(subreq);
1410         if (!NT_STATUS_IS_OK(status)) {
1411                 tevent_req_nterror(req, status);
1412                 return;
1413         }
1414         tevent_req_done(req);
1415 }
1416
1417 static void cli_api_pipe_write_done(struct tevent_req *subreq)
1418 {
1419         struct tevent_req *req = tevent_req_callback_data(
1420                 subreq, struct tevent_req);
1421         struct cli_api_pipe_state *state = tevent_req_data(
1422                 req, struct cli_api_pipe_state);
1423         NTSTATUS status;
1424
1425         status = rpc_write_recv(subreq);
1426         TALLOC_FREE(subreq);
1427         if (!NT_STATUS_IS_OK(status)) {
1428                 tevent_req_nterror(req, status);
1429                 return;
1430         }
1431
1432         state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
1433         if (tevent_req_nomem(state->rdata, req)) {
1434                 return;
1435         }
1436
1437         /*
1438          * We don't need to use rpc_read_send here, the upper layer will cope
1439          * with a short read, transport->trans_send could also return less
1440          * than state->max_rdata_len.
1441          */
1442         subreq = state->transport->read_send(state, state->ev, state->rdata,
1443                                              RPC_HEADER_LEN,
1444                                              state->transport->priv);
1445         if (tevent_req_nomem(subreq, req)) {
1446                 return;
1447         }
1448         tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
1449 }
1450
1451 static void cli_api_pipe_read_done(struct tevent_req *subreq)
1452 {
1453         struct tevent_req *req = tevent_req_callback_data(
1454                 subreq, struct tevent_req);
1455         struct cli_api_pipe_state *state = tevent_req_data(
1456                 req, struct cli_api_pipe_state);
1457         NTSTATUS status;
1458         ssize_t received;
1459
1460         status = state->transport->read_recv(subreq, &received);
1461         TALLOC_FREE(subreq);
1462         if (!NT_STATUS_IS_OK(status)) {
1463                 tevent_req_nterror(req, status);
1464                 return;
1465         }
1466         state->rdata_len = received;
1467         tevent_req_done(req);
1468 }
1469
1470 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1471                                   uint8_t **prdata, uint32_t *prdata_len)
1472 {
1473         struct cli_api_pipe_state *state = tevent_req_data(
1474                 req, struct cli_api_pipe_state);
1475         NTSTATUS status;
1476
1477         if (tevent_req_is_nterror(req, &status)) {
1478                 return status;
1479         }
1480
1481         *prdata = talloc_move(mem_ctx, &state->rdata);
1482         *prdata_len = state->rdata_len;
1483         return NT_STATUS_OK;
1484 }
1485
1486 /****************************************************************************
1487  Send data on an rpc pipe via trans. The prs_struct data must be the last
1488  pdu fragment of an NDR data stream.
1489
1490  Receive response data from an rpc pipe, which may be large...
1491
1492  Read the first fragment: unfortunately have to use SMBtrans for the first
1493  bit, then SMBreadX for subsequent bits.
1494
1495  If first fragment received also wasn't the last fragment, continue
1496  getting fragments until we _do_ receive the last fragment.
1497
1498  Request/Response PDU's look like the following...
1499
1500  |<------------------PDU len----------------------------------------------->|
1501  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
1502
1503  +------------+-----------------+-------------+---------------+-------------+
1504  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
1505  +------------+-----------------+-------------+---------------+-------------+
1506
1507  Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
1508  signing & sealing being negotiated.
1509
1510  ****************************************************************************/
1511
1512 struct rpc_api_pipe_state {
1513         struct event_context *ev;
1514         struct rpc_pipe_client *cli;
1515         uint8_t expected_pkt_type;
1516
1517         prs_struct incoming_frag;
1518         struct ncacn_packet_header rhdr;
1519
1520         prs_struct incoming_pdu;        /* Incoming reply */
1521         uint32_t incoming_pdu_offset;
1522 };
1523
1524 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
1525 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
1526
1527 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
1528                                             struct event_context *ev,
1529                                             struct rpc_pipe_client *cli,
1530                                             prs_struct *data, /* Outgoing PDU */
1531                                             uint8_t expected_pkt_type)
1532 {
1533         struct tevent_req *req, *subreq;
1534         struct rpc_api_pipe_state *state;
1535         uint16_t max_recv_frag;
1536         NTSTATUS status;
1537
1538         req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
1539         if (req == NULL) {
1540                 return NULL;
1541         }
1542         state->ev = ev;
1543         state->cli = cli;
1544         state->expected_pkt_type = expected_pkt_type;
1545         state->incoming_pdu_offset = 0;
1546
1547         prs_init_empty(&state->incoming_frag, state, UNMARSHALL);
1548
1549         prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1550         /* Make incoming_pdu dynamic with no memory. */
1551         prs_give_memory(&state->incoming_pdu, NULL, 0, true);
1552
1553         /*
1554          * Ensure we're not sending too much.
1555          */
1556         if (prs_offset(data) > cli->max_xmit_frag) {
1557                 status = NT_STATUS_INVALID_PARAMETER;
1558                 goto post_status;
1559         }
1560
1561         DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
1562
1563         max_recv_frag = cli->max_recv_frag;
1564
1565 #if 0
1566         max_recv_frag = RPC_HEADER_LEN + 10 + (sys_random() % 32);
1567 #endif
1568
1569         subreq = cli_api_pipe_send(state, ev, cli->transport,
1570                                    (uint8_t *)prs_data_p(data),
1571                                    prs_offset(data), max_recv_frag);
1572         if (subreq == NULL) {
1573                 goto fail;
1574         }
1575         tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
1576         return req;
1577
1578  post_status:
1579         tevent_req_nterror(req, status);
1580         return tevent_req_post(req, ev);
1581  fail:
1582         TALLOC_FREE(req);
1583         return NULL;
1584 }
1585
1586 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
1587 {
1588         struct tevent_req *req = tevent_req_callback_data(
1589                 subreq, struct tevent_req);
1590         struct rpc_api_pipe_state *state = tevent_req_data(
1591                 req, struct rpc_api_pipe_state);
1592         NTSTATUS status;
1593         uint8_t *rdata = NULL;
1594         uint32_t rdata_len = 0;
1595
1596         status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
1597         TALLOC_FREE(subreq);
1598         if (!NT_STATUS_IS_OK(status)) {
1599                 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
1600                 tevent_req_nterror(req, status);
1601                 return;
1602         }
1603
1604         if (rdata == NULL) {
1605                 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
1606                          rpccli_pipe_txt(talloc_tos(), state->cli)));
1607                 tevent_req_done(req);
1608                 return;
1609         }
1610
1611         /*
1612          * This is equivalent to a talloc_steal - gives rdata to
1613          * the prs_struct state->incoming_frag.
1614          */
1615         prs_give_memory(&state->incoming_frag, (char *)rdata, rdata_len, true);
1616         rdata = NULL;
1617
1618         /* Ensure we have enough data for a pdu. */
1619         subreq = get_complete_frag_send(state, state->ev, state->cli,
1620                                         &state->rhdr, &state->incoming_frag);
1621         if (tevent_req_nomem(subreq, req)) {
1622                 return;
1623         }
1624         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1625 }
1626
1627 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
1628 {
1629         struct tevent_req *req = tevent_req_callback_data(
1630                 subreq, struct tevent_req);
1631         struct rpc_api_pipe_state *state = tevent_req_data(
1632                 req, struct rpc_api_pipe_state);
1633         NTSTATUS status;
1634         char *rdata = NULL;
1635         uint32_t rdata_len = 0;
1636
1637         status = get_complete_frag_recv(subreq);
1638         TALLOC_FREE(subreq);
1639         if (!NT_STATUS_IS_OK(status)) {
1640                 DEBUG(5, ("get_complete_frag failed: %s\n",
1641                           nt_errstr(status)));
1642                 tevent_req_nterror(req, status);
1643                 return;
1644         }
1645
1646         status = cli_pipe_validate_current_pdu(
1647                 state->cli, &state->rhdr, &state->incoming_frag,
1648                 state->expected_pkt_type, &rdata, &rdata_len,
1649                 &state->incoming_pdu);
1650
1651         DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
1652                   (unsigned)prs_data_size(&state->incoming_frag),
1653                   (unsigned)state->incoming_pdu_offset,
1654                   nt_errstr(status)));
1655
1656         if (!NT_STATUS_IS_OK(status)) {
1657                 tevent_req_nterror(req, status);
1658                 return;
1659         }
1660
1661         if ((state->rhdr.pfc_flags & DCERPC_PFC_FLAG_FIRST)
1662             && (state->rhdr.drep[0] == 0)) {
1663                 /*
1664                  * Set the data type correctly for big-endian data on the
1665                  * first packet.
1666                  */
1667                 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
1668                           "big-endian.\n",
1669                           rpccli_pipe_txt(talloc_tos(), state->cli)));
1670                 prs_set_endian_data(&state->incoming_pdu, RPC_BIG_ENDIAN);
1671         }
1672         /*
1673          * Check endianness on subsequent packets.
1674          */
1675         if (state->incoming_frag.bigendian_data
1676             != state->incoming_pdu.bigendian_data) {
1677                 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
1678                          "%s\n",
1679                          state->incoming_pdu.bigendian_data?"big":"little",
1680                          state->incoming_frag.bigendian_data?"big":"little"));
1681                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1682                 return;
1683         }
1684
1685         /* Now copy the data portion out of the pdu into rbuf. */
1686         if (!prs_force_grow(&state->incoming_pdu, rdata_len)) {
1687                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1688                 return;
1689         }
1690
1691         memcpy(prs_data_p(&state->incoming_pdu) + state->incoming_pdu_offset,
1692                rdata, (size_t)rdata_len);
1693         state->incoming_pdu_offset += rdata_len;
1694
1695         status = cli_pipe_reset_current_pdu(state->cli, &state->rhdr,
1696                                             &state->incoming_frag);
1697         if (!NT_STATUS_IS_OK(status)) {
1698                 tevent_req_nterror(req, status);
1699                 return;
1700         }
1701
1702         if (state->rhdr.pfc_flags & DCERPC_PFC_FLAG_LAST) {
1703                 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1704                           rpccli_pipe_txt(talloc_tos(), state->cli),
1705                           (unsigned)prs_data_size(&state->incoming_pdu)));
1706                 tevent_req_done(req);
1707                 return;
1708         }
1709
1710         subreq = get_complete_frag_send(state, state->ev, state->cli,
1711                                         &state->rhdr, &state->incoming_frag);
1712         if (tevent_req_nomem(subreq, req)) {
1713                 return;
1714         }
1715         tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1716 }
1717
1718 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1719                                   prs_struct *reply_pdu)
1720 {
1721         struct rpc_api_pipe_state *state = tevent_req_data(
1722                 req, struct rpc_api_pipe_state);
1723         NTSTATUS status;
1724
1725         if (tevent_req_is_nterror(req, &status)) {
1726                 return status;
1727         }
1728
1729         *reply_pdu = state->incoming_pdu;
1730         reply_pdu->mem_ctx = mem_ctx;
1731
1732         /*
1733          * Prevent state->incoming_pdu from being freed
1734          * when state is freed.
1735          */
1736         talloc_steal(mem_ctx, prs_data_p(reply_pdu));
1737         prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1738
1739         return NT_STATUS_OK;
1740 }
1741
1742 /*******************************************************************
1743  ********************************************************************/
1744
1745 static NTSTATUS dcerpc_push_dcerpc_auth(TALLOC_CTX *mem_ctx,
1746                                         enum dcerpc_AuthType auth_type,
1747                                         enum dcerpc_AuthLevel auth_level,
1748                                         uint8_t auth_pad_length,
1749                                         uint32_t auth_context_id,
1750                                         const DATA_BLOB *credentials,
1751                                         DATA_BLOB *blob)
1752 {
1753         struct dcerpc_auth r;
1754         enum ndr_err_code ndr_err;
1755
1756         r.auth_type             = auth_type;
1757         r.auth_level            = auth_level;
1758         r.auth_pad_length       = auth_pad_length;
1759         r.auth_reserved         = 0;
1760         r.auth_context_id       = auth_context_id;
1761         r.credentials           = *credentials;
1762
1763         ndr_err = ndr_push_struct_blob(blob, mem_ctx, &r,
1764                 (ndr_push_flags_fn_t)ndr_push_dcerpc_auth);
1765         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1766                 return ndr_map_error2ntstatus(ndr_err);
1767         }
1768
1769         if (DEBUGLEVEL >= 10) {
1770                 NDR_PRINT_DEBUG(dcerpc_auth, &r);
1771         }
1772
1773         return NT_STATUS_OK;
1774 }
1775
1776 /*******************************************************************
1777  Creates krb5 auth bind.
1778  ********************************************************************/
1779
1780 static NTSTATUS create_krb5_auth_bind_req(struct rpc_pipe_client *cli,
1781                                           enum dcerpc_AuthLevel auth_level,
1782                                           DATA_BLOB *auth_info)
1783 {
1784 #ifdef HAVE_KRB5
1785         int ret;
1786         NTSTATUS status;
1787         struct kerberos_auth_struct *a = cli->auth->a_u.kerberos_auth;
1788         DATA_BLOB tkt = data_blob_null;
1789         DATA_BLOB tkt_wrapped = data_blob_null;
1790
1791         DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
1792                 a->service_principal ));
1793
1794         /* Create the ticket for the service principal and return it in a gss-api wrapped blob. */
1795
1796         ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
1797                         &a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL, NULL);
1798
1799         if (ret) {
1800                 DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
1801                         "failed with %s\n",
1802                         a->service_principal,
1803                         error_message(ret) ));
1804
1805                 data_blob_free(&tkt);
1806                 return NT_STATUS_INVALID_PARAMETER;
1807         }
1808
1809         /* wrap that up in a nice GSS-API wrapping */
1810         tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
1811
1812         data_blob_free(&tkt);
1813
1814         status = dcerpc_push_dcerpc_auth(cli,
1815                                          DCERPC_AUTH_TYPE_KRB5,
1816                                          auth_level,
1817                                          0, /* auth_pad_length */
1818                                          1, /* auth_context_id */
1819                                          &tkt_wrapped,
1820                                          auth_info);
1821         if (!NT_STATUS_IS_OK(status)) {
1822                 data_blob_free(&tkt_wrapped);
1823                 return status;
1824         }
1825
1826         DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
1827         dump_data(5, tkt_wrapped.data, tkt_wrapped.length);
1828
1829         return NT_STATUS_OK;
1830 #else
1831         return NT_STATUS_INVALID_PARAMETER;
1832 #endif
1833 }
1834
1835 /*******************************************************************
1836  Creates SPNEGO NTLMSSP auth bind.
1837  ********************************************************************/
1838
1839 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1840                                                         enum dcerpc_AuthLevel auth_level,
1841                                                         DATA_BLOB *auth_info)
1842 {
1843         NTSTATUS status;
1844         DATA_BLOB null_blob = data_blob_null;
1845         DATA_BLOB request = data_blob_null;
1846         DATA_BLOB spnego_msg = data_blob_null;
1847
1848         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1849         status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1850                                         null_blob,
1851                                         &request);
1852
1853         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1854                 data_blob_free(&request);
1855                 return status;
1856         }
1857
1858         /* Wrap this in SPNEGO. */
1859         spnego_msg = gen_negTokenInit(OID_NTLMSSP, request);
1860
1861         data_blob_free(&request);
1862
1863         status = dcerpc_push_dcerpc_auth(cli,
1864                                          DCERPC_AUTH_TYPE_SPNEGO,
1865                                          auth_level,
1866                                          0, /* auth_pad_length */
1867                                          1, /* auth_context_id */
1868                                          &spnego_msg,
1869                                          auth_info);
1870         if (!NT_STATUS_IS_OK(status)) {
1871                 data_blob_free(&spnego_msg);
1872                 return status;
1873         }
1874
1875         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1876         dump_data(5, spnego_msg.data, spnego_msg.length);
1877
1878         return NT_STATUS_OK;
1879 }
1880
1881 /*******************************************************************
1882  Creates NTLMSSP auth bind.
1883  ********************************************************************/
1884
1885 static NTSTATUS create_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1886                                                  enum dcerpc_AuthLevel auth_level,
1887                                                  DATA_BLOB *auth_info)
1888 {
1889         NTSTATUS status;
1890         DATA_BLOB null_blob = data_blob_null;
1891         DATA_BLOB request = data_blob_null;
1892
1893         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1894         status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1895                                         null_blob,
1896                                         &request);
1897
1898         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1899                 data_blob_free(&request);
1900                 return status;
1901         }
1902
1903         status = dcerpc_push_dcerpc_auth(cli,
1904                                          DCERPC_AUTH_TYPE_NTLMSSP,
1905                                          auth_level,
1906                                          0, /* auth_pad_length */
1907                                          1, /* auth_context_id */
1908                                          &request,
1909                                          auth_info);
1910         if (!NT_STATUS_IS_OK(status)) {
1911                 data_blob_free(&request);
1912                 return status;
1913         }
1914
1915         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1916         dump_data(5, request.data, request.length);
1917
1918         return NT_STATUS_OK;
1919 }
1920
1921 /*******************************************************************
1922  Creates schannel auth bind.
1923  ********************************************************************/
1924
1925 static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1926                                                   enum dcerpc_AuthLevel auth_level,
1927                                                   DATA_BLOB *auth_info)
1928 {
1929         NTSTATUS status;
1930         struct NL_AUTH_MESSAGE r;
1931         DATA_BLOB schannel_blob;
1932
1933         /* Use lp_workgroup() if domain not specified */
1934
1935         if (!cli->auth->domain || !cli->auth->domain[0]) {
1936                 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1937                 if (cli->auth->domain == NULL) {
1938                         return NT_STATUS_NO_MEMORY;
1939                 }
1940         }
1941
1942         /*
1943          * Now marshall the data into the auth parse_struct.
1944          */
1945
1946         r.MessageType                   = NL_NEGOTIATE_REQUEST;
1947         r.Flags                         = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1948                                           NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1949         r.oem_netbios_domain.a          = cli->auth->domain;
1950         r.oem_netbios_computer.a        = global_myname();
1951
1952         status = dcerpc_push_schannel_bind(cli, &r, &schannel_blob);
1953         if (!NT_STATUS_IS_OK(status)) {
1954                 return status;
1955         }
1956
1957         status = dcerpc_push_dcerpc_auth(cli,
1958                                          DCERPC_AUTH_TYPE_SCHANNEL,
1959                                          auth_level,
1960                                          0, /* auth_pad_length */
1961                                          1, /* auth_context_id */
1962                                          &schannel_blob,
1963                                          auth_info);
1964         if (!NT_STATUS_IS_OK(status)) {
1965                 return status;
1966         }
1967
1968         return NT_STATUS_OK;
1969 }
1970
1971 /*******************************************************************
1972  ********************************************************************/
1973
1974 static NTSTATUS init_dcerpc_ctx_list(TALLOC_CTX *mem_ctx,
1975                                      const struct ndr_syntax_id *abstract_syntax,
1976                                      const struct ndr_syntax_id *transfer_syntax,
1977                                      struct dcerpc_ctx_list **ctx_list_p)
1978 {
1979         struct dcerpc_ctx_list *ctx_list;
1980
1981         ctx_list = talloc_array(mem_ctx, struct dcerpc_ctx_list, 1);
1982         NT_STATUS_HAVE_NO_MEMORY(ctx_list);
1983
1984         ctx_list[0].context_id                  = 0;
1985         ctx_list[0].num_transfer_syntaxes       = 1;
1986         ctx_list[0].abstract_syntax             = *abstract_syntax;
1987         ctx_list[0].transfer_syntaxes           = talloc_array(ctx_list,
1988                                                                struct ndr_syntax_id,
1989                                                                ctx_list[0].num_transfer_syntaxes);
1990         NT_STATUS_HAVE_NO_MEMORY(ctx_list[0].transfer_syntaxes);
1991         ctx_list[0].transfer_syntaxes[0]        = *transfer_syntax;
1992
1993         *ctx_list_p = ctx_list;
1994
1995         return NT_STATUS_OK;
1996 }
1997
1998 /*******************************************************************
1999  Creates the internals of a DCE/RPC bind request or alter context PDU.
2000  ********************************************************************/
2001
2002 static NTSTATUS create_bind_or_alt_ctx_internal(enum dcerpc_pkt_type ptype,
2003                                                 prs_struct *rpc_out,
2004                                                 uint32 rpc_call_id,
2005                                                 const struct ndr_syntax_id *abstract,
2006                                                 const struct ndr_syntax_id *transfer,
2007                                                 const DATA_BLOB *auth_info)
2008 {
2009         uint16 auth_len = auth_info->length;
2010         uint16 frag_len = 0;
2011         NTSTATUS status;
2012         union dcerpc_payload u;
2013         DATA_BLOB blob;
2014         struct dcerpc_ctx_list *ctx_list;
2015
2016         status = init_dcerpc_ctx_list(rpc_out->mem_ctx, abstract, transfer,
2017                                       &ctx_list);
2018         if (!NT_STATUS_IS_OK(status)) {
2019                 return status;
2020         }
2021
2022         u.bind.max_xmit_frag    = RPC_MAX_PDU_FRAG_LEN;
2023         u.bind.max_recv_frag    = RPC_MAX_PDU_FRAG_LEN;
2024         u.bind.assoc_group_id   = 0x0;
2025         u.bind.num_contexts     = 1;
2026         u.bind.ctx_list         = ctx_list;
2027         u.bind.auth_info        = *auth_info;
2028
2029         /* Start building the frag length. */
2030         frag_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&u.bind) + auth_len;
2031
2032         status = dcerpc_push_ncacn_packet(rpc_out->mem_ctx,
2033                                           ptype,
2034                                           DCERPC_PFC_FLAG_FIRST |
2035                                           DCERPC_PFC_FLAG_LAST,
2036                                           frag_len,
2037                                           auth_len ? auth_len - RPC_HDR_AUTH_LEN : 0,
2038                                           rpc_call_id,
2039                                           u,
2040                                           &blob);
2041         if (!NT_STATUS_IS_OK(status)) {
2042                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
2043                 return status;
2044         }
2045
2046         if (!prs_copy_data_in(rpc_out, (char *)blob.data, blob.length)) {
2047                 return NT_STATUS_NO_MEMORY;
2048         }
2049
2050         return NT_STATUS_OK;
2051 }
2052
2053 /*******************************************************************
2054  Creates a DCE/RPC bind request.
2055  ********************************************************************/
2056
2057 static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
2058                                     prs_struct *rpc_out,
2059                                     uint32 rpc_call_id,
2060                                     const struct ndr_syntax_id *abstract,
2061                                     const struct ndr_syntax_id *transfer,
2062                                     enum pipe_auth_type auth_type,
2063                                     enum dcerpc_AuthLevel auth_level)
2064 {
2065         DATA_BLOB auth_info = data_blob_null;
2066         NTSTATUS ret = NT_STATUS_OK;
2067
2068         switch (auth_type) {
2069                 case PIPE_AUTH_TYPE_SCHANNEL:
2070                         ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &auth_info);
2071                         if (!NT_STATUS_IS_OK(ret)) {
2072                                 return ret;
2073                         }
2074                         break;
2075
2076                 case PIPE_AUTH_TYPE_NTLMSSP:
2077                         ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &auth_info);
2078                         if (!NT_STATUS_IS_OK(ret)) {
2079                                 return ret;
2080                         }
2081                         break;
2082
2083                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2084                         ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &auth_info);
2085                         if (!NT_STATUS_IS_OK(ret)) {
2086                                 return ret;
2087                         }
2088                         break;
2089
2090                 case PIPE_AUTH_TYPE_KRB5:
2091                         ret = create_krb5_auth_bind_req(cli, auth_level, &auth_info);
2092                         if (!NT_STATUS_IS_OK(ret)) {
2093                                 return ret;
2094                         }
2095                         break;
2096
2097                 case PIPE_AUTH_TYPE_NONE:
2098                         break;
2099
2100                 default:
2101                         /* "Can't" happen. */
2102                         return NT_STATUS_INVALID_INFO_CLASS;
2103         }
2104
2105         ret = create_bind_or_alt_ctx_internal(DCERPC_PKT_BIND,
2106                                               rpc_out,
2107                                               rpc_call_id,
2108                                               abstract,
2109                                               transfer,
2110                                               &auth_info);
2111         return ret;
2112 }
2113
2114 /*******************************************************************
2115  Create and add the NTLMSSP sign/seal auth header and data.
2116  ********************************************************************/
2117
2118 static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
2119                                         RPC_HDR *phdr,
2120                                         uint32 ss_padding_len,
2121                                         prs_struct *outgoing_pdu)
2122 {
2123         RPC_HDR_AUTH auth_info;
2124         NTSTATUS status;
2125         DATA_BLOB auth_blob = data_blob_null;
2126         uint16 data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
2127         TALLOC_CTX *frame;
2128
2129         if (!cli->auth->a_u.ntlmssp_state) {
2130                 return NT_STATUS_INVALID_PARAMETER;
2131         }
2132
2133         frame = talloc_stackframe();
2134
2135         /* Init and marshall the auth header. */
2136         init_rpc_hdr_auth(&auth_info,
2137                         map_pipe_auth_type_to_rpc_auth_type(
2138                                 cli->auth->auth_type),
2139                         cli->auth->auth_level,
2140                         ss_padding_len,
2141                         1 /* context id. */);
2142
2143         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
2144                 DEBUG(0,("add_ntlmssp_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
2145                 talloc_free(frame);
2146                 return NT_STATUS_NO_MEMORY;
2147         }
2148
2149         switch (cli->auth->auth_level) {
2150                 case DCERPC_AUTH_LEVEL_PRIVACY:
2151                         /* Data portion is encrypted. */
2152                         status = ntlmssp_seal_packet(cli->auth->a_u.ntlmssp_state,
2153                                                      frame,
2154                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
2155                                         data_and_pad_len,
2156                                         (unsigned char *)prs_data_p(outgoing_pdu),
2157                                         (size_t)prs_offset(outgoing_pdu),
2158                                         &auth_blob);
2159                         if (!NT_STATUS_IS_OK(status)) {
2160                                 talloc_free(frame);
2161                                 return status;
2162                         }
2163                         break;
2164
2165                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2166                         /* Data is signed. */
2167                         status = ntlmssp_sign_packet(cli->auth->a_u.ntlmssp_state,
2168                                                      frame,
2169                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
2170                                         data_and_pad_len,
2171                                         (unsigned char *)prs_data_p(outgoing_pdu),
2172                                         (size_t)prs_offset(outgoing_pdu),
2173                                         &auth_blob);
2174                         if (!NT_STATUS_IS_OK(status)) {
2175                                 talloc_free(frame);
2176                                 return status;
2177                         }
2178                         break;
2179
2180                 default:
2181                         /* Can't happen. */
2182                         smb_panic("bad auth level");
2183                         /* Notreached. */
2184                         return NT_STATUS_INVALID_PARAMETER;
2185         }
2186
2187         /* Finally marshall the blob. */
2188
2189         if (!prs_copy_data_in(outgoing_pdu, (const char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
2190                 DEBUG(0,("add_ntlmssp_auth_footer: failed to add %u bytes auth blob.\n",
2191                         (unsigned int)NTLMSSP_SIG_SIZE));
2192                 talloc_free(frame);
2193                 return NT_STATUS_NO_MEMORY;
2194         }
2195
2196         talloc_free(frame);
2197         return NT_STATUS_OK;
2198 }
2199
2200 /*******************************************************************
2201  Create and add the schannel sign/seal auth header and data.
2202  ********************************************************************/
2203
2204 static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
2205                                         RPC_HDR *phdr,
2206                                         uint32 ss_padding_len,
2207                                         prs_struct *outgoing_pdu)
2208 {
2209         RPC_HDR_AUTH auth_info;
2210         struct schannel_state *sas = cli->auth->a_u.schannel_auth;
2211         char *data_p = prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
2212         size_t data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
2213         DATA_BLOB blob;
2214         NTSTATUS status;
2215
2216         if (!sas) {
2217                 return NT_STATUS_INVALID_PARAMETER;
2218         }
2219
2220         /* Init and marshall the auth header. */
2221         init_rpc_hdr_auth(&auth_info,
2222                         map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
2223                         cli->auth->auth_level,
2224                         ss_padding_len,
2225                         1 /* context id. */);
2226
2227         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
2228                 DEBUG(0,("add_schannel_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
2229                 return NT_STATUS_NO_MEMORY;
2230         }
2231
2232         DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
2233                         sas->seq_num));
2234
2235         switch (cli->auth->auth_level) {
2236         case DCERPC_AUTH_LEVEL_PRIVACY:
2237                 status = netsec_outgoing_packet(sas,
2238                                                 talloc_tos(),
2239                                                 true,
2240                                                 (uint8_t *)data_p,
2241                                                 data_and_pad_len,
2242                                                 &blob);
2243                 break;
2244         case DCERPC_AUTH_LEVEL_INTEGRITY:
2245                 status = netsec_outgoing_packet(sas,
2246                                                 talloc_tos(),
2247                                                 false,
2248                                                 (uint8_t *)data_p,
2249                                                 data_and_pad_len,
2250                                                 &blob);
2251                 break;
2252         default:
2253                 status = NT_STATUS_INTERNAL_ERROR;
2254                 break;
2255         }
2256
2257         if (!NT_STATUS_IS_OK(status)) {
2258                 DEBUG(1,("add_schannel_auth_footer: failed to process packet: %s\n",
2259                         nt_errstr(status)));
2260                 return status;
2261         }
2262
2263         if (DEBUGLEVEL >= 10) {
2264                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2265         }
2266
2267         /* Finally marshall the blob. */
2268         if (!prs_copy_data_in(outgoing_pdu, (const char *)blob.data, blob.length)) {
2269                 return NT_STATUS_NO_MEMORY;
2270         }
2271
2272         return NT_STATUS_OK;
2273 }
2274
2275 /*******************************************************************
2276  Calculate how much data we're going to send in this packet, also
2277  work out any sign/seal padding length.
2278  ********************************************************************/
2279
2280 static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
2281                                         uint32 data_left,
2282                                         uint16 *p_frag_len,
2283                                         uint16 *p_auth_len,
2284                                         uint32 *p_ss_padding)
2285 {
2286         uint32 data_space, data_len;
2287
2288 #if 0
2289         if ((data_left > 0) && (sys_random() % 2)) {
2290                 data_left = MAX(data_left/2, 1);
2291         }
2292 #endif
2293
2294         switch (cli->auth->auth_level) {
2295                 case DCERPC_AUTH_LEVEL_NONE:
2296                 case DCERPC_AUTH_LEVEL_CONNECT:
2297                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN;
2298                         data_len = MIN(data_space, data_left);
2299                         *p_ss_padding = 0;
2300                         *p_auth_len = 0;
2301                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + data_len;
2302                         return data_len;
2303
2304                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2305                 case DCERPC_AUTH_LEVEL_PRIVACY:
2306                         /* Treat the same for all authenticated rpc requests. */
2307                         switch(cli->auth->auth_type) {
2308                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2309                                 case PIPE_AUTH_TYPE_NTLMSSP:
2310                                         *p_auth_len = NTLMSSP_SIG_SIZE;
2311                                         break;
2312                                 case PIPE_AUTH_TYPE_SCHANNEL:
2313                                         *p_auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
2314                                         break;
2315                                 default:
2316                                         smb_panic("bad auth type");
2317                                         break;
2318                         }
2319
2320                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2321                                                 RPC_HDR_AUTH_LEN - *p_auth_len;
2322
2323                         data_len = MIN(data_space, data_left);
2324                         *p_ss_padding = 0;
2325                         if (data_len % CLIENT_NDR_PADDING_SIZE) {
2326                                 *p_ss_padding = CLIENT_NDR_PADDING_SIZE - (data_len % CLIENT_NDR_PADDING_SIZE);
2327                         }
2328                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN +                /* Normal headers. */
2329                                         data_len + *p_ss_padding +              /* data plus padding. */
2330                                         RPC_HDR_AUTH_LEN + *p_auth_len;         /* Auth header and auth data. */
2331                         return data_len;
2332
2333                 default:
2334                         smb_panic("bad auth level");
2335                         /* Notreached. */
2336                         return 0;
2337         }
2338 }
2339
2340 /*******************************************************************
2341  External interface.
2342  Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
2343  Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
2344  and deals with signing/sealing details.
2345  ********************************************************************/
2346
2347 struct rpc_api_pipe_req_state {
2348         struct event_context *ev;
2349         struct rpc_pipe_client *cli;
2350         uint8_t op_num;
2351         uint32_t call_id;
2352         prs_struct *req_data;
2353         uint32_t req_data_sent;
2354         prs_struct outgoing_frag;
2355         prs_struct reply_pdu;
2356 };
2357
2358 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
2359 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
2360 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2361                                   bool *is_last_frag);
2362
2363 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
2364                                          struct event_context *ev,
2365                                          struct rpc_pipe_client *cli,
2366                                          uint8_t op_num,
2367                                          prs_struct *req_data)
2368 {
2369         struct tevent_req *req, *subreq;
2370         struct rpc_api_pipe_req_state *state;
2371         NTSTATUS status;
2372         bool is_last_frag;
2373
2374         req = tevent_req_create(mem_ctx, &state,
2375                                 struct rpc_api_pipe_req_state);
2376         if (req == NULL) {
2377                 return NULL;
2378         }
2379         state->ev = ev;
2380         state->cli = cli;
2381         state->op_num = op_num;
2382         state->req_data = req_data;
2383         state->req_data_sent = 0;
2384         state->call_id = get_rpc_call_id();
2385
2386         if (cli->max_xmit_frag
2387             < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_MAX_SIGN_SIZE) {
2388                 /* Server is screwed up ! */
2389                 status = NT_STATUS_INVALID_PARAMETER;
2390                 goto post_status;
2391         }
2392
2393         prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2394
2395         if (!prs_init(&state->outgoing_frag, cli->max_xmit_frag,
2396                       state, MARSHALL)) {
2397                 goto fail;
2398         }
2399
2400         status = prepare_next_frag(state, &is_last_frag);
2401         if (!NT_STATUS_IS_OK(status)) {
2402                 goto post_status;
2403         }
2404
2405         if (is_last_frag) {
2406                 subreq = rpc_api_pipe_send(state, ev, state->cli,
2407                                            &state->outgoing_frag,
2408                                            DCERPC_PKT_RESPONSE);
2409                 if (subreq == NULL) {
2410                         goto fail;
2411                 }
2412                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
2413         } else {
2414                 subreq = rpc_write_send(
2415                         state, ev, cli->transport,
2416                         (uint8_t *)prs_data_p(&state->outgoing_frag),
2417                         prs_offset(&state->outgoing_frag));
2418                 if (subreq == NULL) {
2419                         goto fail;
2420                 }
2421                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
2422                                         req);
2423         }
2424         return req;
2425
2426  post_status:
2427         tevent_req_nterror(req, status);
2428         return tevent_req_post(req, ev);
2429  fail:
2430         TALLOC_FREE(req);
2431         return NULL;
2432 }
2433
2434 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2435                                   bool *is_last_frag)
2436 {
2437         RPC_HDR hdr;
2438         RPC_HDR_REQ hdr_req;
2439         uint32_t data_sent_thistime;
2440         uint16_t auth_len;
2441         uint16_t frag_len;
2442         uint8_t flags = 0;
2443         uint32_t ss_padding;
2444         uint32_t data_left;
2445         char pad[8] = { 0, };
2446         NTSTATUS status;
2447
2448         data_left = prs_offset(state->req_data) - state->req_data_sent;
2449
2450         data_sent_thistime = calculate_data_len_tosend(
2451                 state->cli, data_left, &frag_len, &auth_len, &ss_padding);
2452
2453         if (state->req_data_sent == 0) {
2454                 flags = DCERPC_PFC_FLAG_FIRST;
2455         }
2456
2457         if (data_sent_thistime == data_left) {
2458                 flags |= DCERPC_PFC_FLAG_LAST;
2459         }
2460
2461         if (!prs_set_offset(&state->outgoing_frag, 0)) {
2462                 return NT_STATUS_NO_MEMORY;
2463         }
2464
2465         /* Create and marshall the header and request header. */
2466         init_rpc_hdr(&hdr, DCERPC_PKT_REQUEST, flags, state->call_id, frag_len,
2467                      auth_len);
2468
2469         if (!smb_io_rpc_hdr("hdr    ", &hdr, &state->outgoing_frag, 0)) {
2470                 return NT_STATUS_NO_MEMORY;
2471         }
2472
2473         /* Create the rpc request RPC_HDR_REQ */
2474         init_rpc_hdr_req(&hdr_req, prs_offset(state->req_data),
2475                          state->op_num);
2476
2477         if (!smb_io_rpc_hdr_req("hdr_req", &hdr_req,
2478                                 &state->outgoing_frag, 0)) {
2479                 return NT_STATUS_NO_MEMORY;
2480         }
2481
2482         /* Copy in the data, plus any ss padding. */
2483         if (!prs_append_some_prs_data(&state->outgoing_frag,
2484                                       state->req_data, state->req_data_sent,
2485                                       data_sent_thistime)) {
2486                 return NT_STATUS_NO_MEMORY;
2487         }
2488
2489         /* Copy the sign/seal padding data. */
2490         if (!prs_copy_data_in(&state->outgoing_frag, pad, ss_padding)) {
2491                 return NT_STATUS_NO_MEMORY;
2492         }
2493
2494         /* Generate any auth sign/seal and add the auth footer. */
2495         switch (state->cli->auth->auth_type) {
2496         case PIPE_AUTH_TYPE_NONE:
2497                 status = NT_STATUS_OK;
2498                 break;
2499         case PIPE_AUTH_TYPE_NTLMSSP:
2500         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2501                 status = add_ntlmssp_auth_footer(state->cli, &hdr, ss_padding,
2502                                                  &state->outgoing_frag);
2503                 break;
2504         case PIPE_AUTH_TYPE_SCHANNEL:
2505                 status = add_schannel_auth_footer(state->cli, &hdr, ss_padding,
2506                                                   &state->outgoing_frag);
2507                 break;
2508         default:
2509                 status = NT_STATUS_INVALID_PARAMETER;
2510                 break;
2511         }
2512
2513         state->req_data_sent += data_sent_thistime;
2514         *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
2515
2516         return status;
2517 }
2518
2519 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
2520 {
2521         struct tevent_req *req = tevent_req_callback_data(
2522                 subreq, struct tevent_req);
2523         struct rpc_api_pipe_req_state *state = tevent_req_data(
2524                 req, struct rpc_api_pipe_req_state);
2525         NTSTATUS status;
2526         bool is_last_frag;
2527
2528         status = rpc_write_recv(subreq);
2529         TALLOC_FREE(subreq);
2530         if (!NT_STATUS_IS_OK(status)) {
2531                 tevent_req_nterror(req, status);
2532                 return;
2533         }
2534
2535         status = prepare_next_frag(state, &is_last_frag);
2536         if (!NT_STATUS_IS_OK(status)) {
2537                 tevent_req_nterror(req, status);
2538                 return;
2539         }
2540
2541         if (is_last_frag) {
2542                 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2543                                            &state->outgoing_frag,
2544                                            DCERPC_PKT_RESPONSE);
2545                 if (tevent_req_nomem(subreq, req)) {
2546                         return;
2547                 }
2548                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
2549         } else {
2550                 subreq = rpc_write_send(
2551                         state, state->ev,
2552                         state->cli->transport,
2553                         (uint8_t *)prs_data_p(&state->outgoing_frag),
2554                         prs_offset(&state->outgoing_frag));
2555                 if (tevent_req_nomem(subreq, req)) {
2556                         return;
2557                 }
2558                 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
2559                                         req);
2560         }
2561 }
2562
2563 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
2564 {
2565         struct tevent_req *req = tevent_req_callback_data(
2566                 subreq, struct tevent_req);
2567         struct rpc_api_pipe_req_state *state = tevent_req_data(
2568                 req, struct rpc_api_pipe_req_state);
2569         NTSTATUS status;
2570
2571         status = rpc_api_pipe_recv(subreq, state, &state->reply_pdu);
2572         TALLOC_FREE(subreq);
2573         if (!NT_STATUS_IS_OK(status)) {
2574                 tevent_req_nterror(req, status);
2575                 return;
2576         }
2577         tevent_req_done(req);
2578 }
2579
2580 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2581                                prs_struct *reply_pdu)
2582 {
2583         struct rpc_api_pipe_req_state *state = tevent_req_data(
2584                 req, struct rpc_api_pipe_req_state);
2585         NTSTATUS status;
2586
2587         if (tevent_req_is_nterror(req, &status)) {
2588                 /*
2589                  * We always have to initialize to reply pdu, even if there is
2590                  * none. The rpccli_* caller routines expect this.
2591                  */
2592                 prs_init_empty(reply_pdu, mem_ctx, UNMARSHALL);
2593                 return status;
2594         }
2595
2596         *reply_pdu = state->reply_pdu;
2597         reply_pdu->mem_ctx = mem_ctx;
2598
2599         /*
2600          * Prevent state->req_pdu from being freed
2601          * when state is freed.
2602          */
2603         talloc_steal(mem_ctx, prs_data_p(reply_pdu));
2604         prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2605
2606         return NT_STATUS_OK;
2607 }
2608
2609 #if 0
2610 /****************************************************************************
2611  Set the handle state.
2612 ****************************************************************************/
2613
2614 static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
2615                                    const char *pipe_name, uint16 device_state)
2616 {
2617         bool state_set = False;
2618         char param[2];
2619         uint16 setup[2]; /* only need 2 uint16 setup parameters */
2620         char *rparam = NULL;
2621         char *rdata = NULL;
2622         uint32 rparam_len, rdata_len;
2623
2624         if (pipe_name == NULL)
2625                 return False;
2626
2627         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
2628                  cli->fnum, pipe_name, device_state));
2629
2630         /* create parameters: device state */
2631         SSVAL(param, 0, device_state);
2632
2633         /* create setup parameters. */
2634         setup[0] = 0x0001;
2635         setup[1] = cli->fnum; /* pipe file handle.  got this from an SMBOpenX. */
2636
2637         /* send the data on \PIPE\ */
2638         if (cli_api_pipe(cli->cli, "\\PIPE\\",
2639                     setup, 2, 0,                /* setup, length, max */
2640                     param, 2, 0,                /* param, length, max */
2641                     NULL, 0, 1024,              /* data, length, max */
2642                     &rparam, &rparam_len,        /* return param, length */
2643                     &rdata, &rdata_len))         /* return data, length */
2644         {
2645                 DEBUG(5, ("Set Handle state: return OK\n"));
2646                 state_set = True;
2647         }
2648
2649         SAFE_FREE(rparam);
2650         SAFE_FREE(rdata);
2651
2652         return state_set;
2653 }
2654 #endif
2655
2656 /****************************************************************************
2657  Check the rpc bind acknowledge response.
2658 ****************************************************************************/
2659
2660 static bool check_bind_response(RPC_HDR_BA *hdr_ba,
2661                                 const struct ndr_syntax_id *transfer)
2662 {
2663         if ( hdr_ba->addr.len == 0) {
2664                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
2665         }
2666
2667         /* check the transfer syntax */
2668         if ((hdr_ba->transfer.if_version != transfer->if_version) ||
2669              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
2670                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
2671                 return False;
2672         }
2673
2674         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
2675                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
2676                           hdr_ba->res.num_results, hdr_ba->res.reason));
2677         }
2678
2679         DEBUG(5,("check_bind_response: accepted!\n"));
2680         return True;
2681 }
2682
2683 /*******************************************************************
2684  Creates a DCE/RPC bind authentication response.
2685  This is the packet that is sent back to the server once we
2686  have received a BIND-ACK, to finish the third leg of
2687  the authentication handshake.
2688  ********************************************************************/
2689
2690 static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
2691                                 uint32 rpc_call_id,
2692                                 enum pipe_auth_type auth_type,
2693                                 enum dcerpc_AuthLevel auth_level,
2694                                 DATA_BLOB *pauth_blob,
2695                                 prs_struct *rpc_out)
2696 {
2697         RPC_HDR hdr;
2698         RPC_HDR_AUTH hdr_auth;
2699         uint32 pad = 0;
2700
2701         /* Create the request RPC_HDR */
2702         init_rpc_hdr(&hdr, DCERPC_PKT_AUTH3, DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST, rpc_call_id,
2703                      RPC_HEADER_LEN + 4 /* pad */ + RPC_HDR_AUTH_LEN + pauth_blob->length,
2704                      pauth_blob->length );
2705
2706         /* Marshall it. */
2707         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
2708                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR.\n"));
2709                 return NT_STATUS_NO_MEMORY;
2710         }
2711
2712         /*
2713                 I'm puzzled about this - seems to violate the DCE RPC auth rules,
2714                 about padding - shouldn't this pad to length CLIENT_NDR_PADDING_SIZE ? JRA.
2715         */
2716
2717         /* 4 bytes padding. */
2718         if (!prs_uint32("pad", rpc_out, 0, &pad)) {
2719                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall 4 byte pad.\n"));
2720                 return NT_STATUS_NO_MEMORY;
2721         }
2722
2723         /* Create the request RPC_HDR_AUTHA */
2724         init_rpc_hdr_auth(&hdr_auth,
2725                         map_pipe_auth_type_to_rpc_auth_type(auth_type),
2726                         auth_level, 0, 1);
2727
2728         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rpc_out, 0)) {
2729                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR_AUTHA.\n"));
2730                 return NT_STATUS_NO_MEMORY;
2731         }
2732
2733         /*
2734          * Append the auth data to the outgoing buffer.
2735          */
2736
2737         if(!prs_copy_data_in(rpc_out, (char *)pauth_blob->data, pauth_blob->length)) {
2738                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall auth blob.\n"));
2739                 return NT_STATUS_NO_MEMORY;
2740         }
2741
2742         return NT_STATUS_OK;
2743 }
2744
2745 /*******************************************************************
2746  Creates a DCE/RPC bind alter context authentication request which
2747  may contain a spnego auth blobl
2748  ********************************************************************/
2749
2750 static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
2751                                         const struct ndr_syntax_id *abstract,
2752                                         const struct ndr_syntax_id *transfer,
2753                                         enum dcerpc_AuthLevel auth_level,
2754                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
2755                                         prs_struct *rpc_out)
2756 {
2757         DATA_BLOB auth_info;
2758         NTSTATUS status;
2759
2760         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(rpc_out),
2761                                          DCERPC_AUTH_TYPE_SPNEGO,
2762                                          auth_level,
2763                                          0, /* auth_pad_length */
2764                                          1, /* auth_context_id */
2765                                          pauth_blob,
2766                                          &auth_info);
2767         if (!NT_STATUS_IS_OK(status)) {
2768                 return status;
2769         }
2770
2771
2772         status = create_bind_or_alt_ctx_internal(DCERPC_PKT_ALTER,
2773                                                  rpc_out,
2774                                                  rpc_call_id,
2775                                                  abstract,
2776                                                  transfer,
2777                                                  &auth_info);
2778         if (!NT_STATUS_IS_OK(status)) {
2779                 return status;
2780         }
2781
2782         return status;
2783 }
2784
2785 /****************************************************************************
2786  Do an rpc bind.
2787 ****************************************************************************/
2788
2789 struct rpc_pipe_bind_state {
2790         struct event_context *ev;
2791         struct rpc_pipe_client *cli;
2792         prs_struct rpc_out;
2793         uint32_t rpc_call_id;
2794 };
2795
2796 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
2797 static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
2798                                            struct rpc_pipe_bind_state *state,
2799                                            struct rpc_hdr_info *phdr,
2800                                            prs_struct *reply_pdu);
2801 static void rpc_bind_auth3_write_done(struct tevent_req *subreq);
2802 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
2803                                                     struct rpc_pipe_bind_state *state,
2804                                                     struct rpc_hdr_info *phdr,
2805                                                     prs_struct *reply_pdu);
2806 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq);
2807
2808 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
2809                                       struct event_context *ev,
2810                                       struct rpc_pipe_client *cli,
2811                                       struct cli_pipe_auth_data *auth)
2812 {
2813         struct tevent_req *req, *subreq;
2814         struct rpc_pipe_bind_state *state;
2815         NTSTATUS status;
2816
2817         req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
2818         if (req == NULL) {
2819                 return NULL;
2820         }
2821
2822         DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
2823                 rpccli_pipe_txt(talloc_tos(), cli),
2824                 (unsigned int)auth->auth_type,
2825                 (unsigned int)auth->auth_level ));
2826
2827         state->ev = ev;
2828         state->cli = cli;
2829         state->rpc_call_id = get_rpc_call_id();
2830
2831         prs_init_empty(&state->rpc_out, state, MARSHALL);
2832
2833         cli->auth = talloc_move(cli, &auth);
2834
2835         /* Marshall the outgoing data. */
2836         status = create_rpc_bind_req(cli, &state->rpc_out,
2837                                      state->rpc_call_id,
2838                                      &cli->abstract_syntax,
2839                                      &cli->transfer_syntax,
2840                                      cli->auth->auth_type,
2841                                      cli->auth->auth_level);
2842
2843         if (!NT_STATUS_IS_OK(status)) {
2844                 goto post_status;
2845         }
2846
2847         subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
2848                                    DCERPC_PKT_BIND_ACK);
2849         if (subreq == NULL) {
2850                 goto fail;
2851         }
2852         tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2853         return req;
2854
2855  post_status:
2856         tevent_req_nterror(req, status);
2857         return tevent_req_post(req, ev);
2858  fail:
2859         TALLOC_FREE(req);
2860         return NULL;
2861 }
2862
2863 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
2864 {
2865         struct tevent_req *req = tevent_req_callback_data(
2866                 subreq, struct tevent_req);
2867         struct rpc_pipe_bind_state *state = tevent_req_data(
2868                 req, struct rpc_pipe_bind_state);
2869         prs_struct reply_pdu;
2870         struct rpc_hdr_info hdr;
2871         struct rpc_hdr_ba_info hdr_ba;
2872         NTSTATUS status;
2873
2874         status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2875         TALLOC_FREE(subreq);
2876         if (!NT_STATUS_IS_OK(status)) {
2877                 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
2878                           rpccli_pipe_txt(talloc_tos(), state->cli),
2879                           nt_errstr(status)));
2880                 tevent_req_nterror(req, status);
2881                 return;
2882         }
2883
2884         /* Unmarshall the RPC header */
2885         if (!smb_io_rpc_hdr("hdr", &hdr, &reply_pdu, 0)) {
2886                 DEBUG(0, ("rpc_pipe_bind: failed to unmarshall RPC_HDR.\n"));
2887                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2888                 return;
2889         }
2890
2891         if (!smb_io_rpc_hdr_ba("", &hdr_ba, &reply_pdu, 0)) {
2892                 DEBUG(0, ("rpc_pipe_bind: Failed to unmarshall "
2893                           "RPC_HDR_BA.\n"));
2894                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2895                 return;
2896         }
2897
2898         if (!check_bind_response(&hdr_ba, &state->cli->transfer_syntax)) {
2899                 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
2900                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2901                 return;
2902         }
2903
2904         state->cli->max_xmit_frag = hdr_ba.bba.max_tsize;
2905         state->cli->max_recv_frag = hdr_ba.bba.max_rsize;
2906
2907         /*
2908          * For authenticated binds we may need to do 3 or 4 leg binds.
2909          */
2910
2911         switch(state->cli->auth->auth_type) {
2912
2913         case PIPE_AUTH_TYPE_NONE:
2914         case PIPE_AUTH_TYPE_SCHANNEL:
2915                 /* Bind complete. */
2916                 tevent_req_done(req);
2917                 break;
2918
2919         case PIPE_AUTH_TYPE_NTLMSSP:
2920                 /* Need to send AUTH3 packet - no reply. */
2921                 status = rpc_finish_auth3_bind_send(req, state, &hdr,
2922                                                     &reply_pdu);
2923                 if (!NT_STATUS_IS_OK(status)) {
2924                         tevent_req_nterror(req, status);
2925                 }
2926                 break;
2927
2928         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2929                 /* Need to send alter context request and reply. */
2930                 status = rpc_finish_spnego_ntlmssp_bind_send(req, state, &hdr,
2931                                                              &reply_pdu);
2932                 if (!NT_STATUS_IS_OK(status)) {
2933                         tevent_req_nterror(req, status);
2934                 }
2935                 break;
2936
2937         case PIPE_AUTH_TYPE_KRB5:
2938                 /* */
2939
2940         default:
2941                 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
2942                          (unsigned int)state->cli->auth->auth_type));
2943                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2944         }
2945 }
2946
2947 static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
2948                                            struct rpc_pipe_bind_state *state,
2949                                            struct rpc_hdr_info *phdr,
2950                                            prs_struct *reply_pdu)
2951 {
2952         DATA_BLOB server_response = data_blob_null;
2953         DATA_BLOB client_reply = data_blob_null;
2954         struct rpc_hdr_auth_info hdr_auth;
2955         struct tevent_req *subreq;
2956         NTSTATUS status;
2957
2958         if ((phdr->auth_len == 0)
2959             || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2960                 return NT_STATUS_INVALID_PARAMETER;
2961         }
2962
2963         if (!prs_set_offset(
2964                     reply_pdu,
2965                     phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2966                 return NT_STATUS_INVALID_PARAMETER;
2967         }
2968
2969         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2970                 return NT_STATUS_INVALID_PARAMETER;
2971         }
2972
2973         /* TODO - check auth_type/auth_level match. */
2974
2975         server_response = data_blob_talloc(talloc_tos(), NULL, phdr->auth_len);
2976         prs_copy_data_out((char *)server_response.data, reply_pdu,
2977                           phdr->auth_len);
2978
2979         status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2980                                 server_response, &client_reply);
2981
2982         if (!NT_STATUS_IS_OK(status)) {
2983                 DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
2984                           "blob failed: %s.\n", nt_errstr(status)));
2985                 return status;
2986         }
2987
2988         prs_init_empty(&state->rpc_out, talloc_tos(), MARSHALL);
2989
2990         status = create_rpc_bind_auth3(state->cli, state->rpc_call_id,
2991                                        state->cli->auth->auth_type,
2992                                        state->cli->auth->auth_level,
2993                                        &client_reply, &state->rpc_out);
2994         data_blob_free(&client_reply);
2995
2996         if (!NT_STATUS_IS_OK(status)) {
2997                 return status;
2998         }
2999
3000         subreq = rpc_write_send(state, state->ev, state->cli->transport,
3001                                 (uint8_t *)prs_data_p(&state->rpc_out),
3002                                 prs_offset(&state->rpc_out));
3003         if (subreq == NULL) {
3004                 return NT_STATUS_NO_MEMORY;
3005         }
3006         tevent_req_set_callback(subreq, rpc_bind_auth3_write_done, req);
3007         return NT_STATUS_OK;
3008 }
3009
3010 static void rpc_bind_auth3_write_done(struct tevent_req *subreq)
3011 {
3012         struct tevent_req *req = tevent_req_callback_data(
3013                 subreq, struct tevent_req);
3014         NTSTATUS status;
3015
3016         status = rpc_write_recv(subreq);
3017         TALLOC_FREE(subreq);
3018         if (!NT_STATUS_IS_OK(status)) {
3019                 tevent_req_nterror(req, status);
3020                 return;
3021         }
3022         tevent_req_done(req);
3023 }
3024
3025 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
3026                                                     struct rpc_pipe_bind_state *state,
3027                                                     struct rpc_hdr_info *phdr,
3028                                                     prs_struct *reply_pdu)
3029 {
3030         DATA_BLOB server_spnego_response = data_blob_null;
3031         DATA_BLOB server_ntlm_response = data_blob_null;
3032         DATA_BLOB client_reply = data_blob_null;
3033         DATA_BLOB tmp_blob = data_blob_null;
3034         RPC_HDR_AUTH hdr_auth;
3035         struct tevent_req *subreq;
3036         NTSTATUS status;
3037
3038         if ((phdr->auth_len == 0)
3039             || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
3040                 return NT_STATUS_INVALID_PARAMETER;
3041         }
3042
3043         /* Process the returned NTLMSSP blob first. */
3044         if (!prs_set_offset(
3045                     reply_pdu,
3046                     phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
3047                 return NT_STATUS_INVALID_PARAMETER;
3048         }
3049
3050         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
3051                 return NT_STATUS_INVALID_PARAMETER;
3052         }
3053
3054         server_spnego_response = data_blob(NULL, phdr->auth_len);
3055         prs_copy_data_out((char *)server_spnego_response.data,
3056                           reply_pdu, phdr->auth_len);
3057
3058         /*
3059          * The server might give us back two challenges - tmp_blob is for the
3060          * second.
3061          */
3062         if (!spnego_parse_challenge(server_spnego_response,
3063                                     &server_ntlm_response, &tmp_blob)) {
3064                 data_blob_free(&server_spnego_response);
3065                 data_blob_free(&server_ntlm_response);
3066                 data_blob_free(&tmp_blob);
3067                 return NT_STATUS_INVALID_PARAMETER;
3068         }
3069
3070         /* We're finished with the server spnego response and the tmp_blob. */
3071         data_blob_free(&server_spnego_response);
3072         data_blob_free(&tmp_blob);
3073
3074         status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
3075                                 server_ntlm_response, &client_reply);
3076
3077         /* Finished with the server_ntlm response */
3078         data_blob_free(&server_ntlm_response);
3079
3080         if (!NT_STATUS_IS_OK(status)) {
3081                 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
3082                           "using server blob failed.\n"));
3083                 data_blob_free(&client_reply);
3084                 return status;
3085         }
3086
3087         /* SPNEGO wrap the client reply. */
3088         tmp_blob = spnego_gen_auth(client_reply);
3089         data_blob_free(&client_reply);
3090         client_reply = tmp_blob;
3091         tmp_blob = data_blob_null;
3092
3093         /* Now prepare the alter context pdu. */
3094         prs_init_empty(&state->rpc_out, state, MARSHALL);
3095
3096         status = create_rpc_alter_context(state->rpc_call_id,
3097                                           &state->cli->abstract_syntax,
3098                                           &state->cli->transfer_syntax,
3099                                           state->cli->auth->auth_level,
3100                                           &client_reply,
3101                                           &state->rpc_out);
3102         data_blob_free(&client_reply);
3103
3104         if (!NT_STATUS_IS_OK(status)) {
3105                 return status;
3106         }
3107
3108         subreq = rpc_api_pipe_send(state, state->ev, state->cli,
3109                                    &state->rpc_out, DCERPC_PKT_ALTER_RESP);
3110         if (subreq == NULL) {
3111                 return NT_STATUS_NO_MEMORY;
3112         }
3113         tevent_req_set_callback(subreq, rpc_bind_ntlmssp_api_done, req);
3114         return NT_STATUS_OK;
3115 }
3116
3117 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq)
3118 {
3119         struct tevent_req *req = tevent_req_callback_data(
3120                 subreq, struct tevent_req);
3121         struct rpc_pipe_bind_state *state = tevent_req_data(
3122                 req, struct rpc_pipe_bind_state);
3123         DATA_BLOB server_spnego_response = data_blob_null;
3124         DATA_BLOB tmp_blob = data_blob_null;
3125         prs_struct reply_pdu;
3126         struct rpc_hdr_info hdr;
3127         struct rpc_hdr_auth_info hdr_auth;
3128         NTSTATUS status;
3129
3130         status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
3131         TALLOC_FREE(subreq);
3132         if (!NT_STATUS_IS_OK(status)) {
3133                 tevent_req_nterror(req, status);
3134                 return;
3135         }
3136
3137         /* Get the auth blob from the reply. */
3138         if (!smb_io_rpc_hdr("rpc_hdr   ", &hdr, &reply_pdu, 0)) {
3139                 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: Failed to "
3140                           "unmarshall RPC_HDR.\n"));
3141                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
3142                 return;
3143         }
3144
3145         if (!prs_set_offset(
3146                     &reply_pdu,
3147                     hdr.frag_len - hdr.auth_len - RPC_HDR_AUTH_LEN)) {
3148                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
3149                 return;
3150         }
3151
3152         if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &reply_pdu, 0)) {
3153                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
3154                 return;
3155         }
3156
3157         server_spnego_response = data_blob(NULL, hdr.auth_len);
3158         prs_copy_data_out((char *)server_spnego_response.data, &reply_pdu,
3159                           hdr.auth_len);
3160
3161         /* Check we got a valid auth response. */
3162         if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK,
3163                                         OID_NTLMSSP, &tmp_blob)) {
3164                 data_blob_free(&server_spnego_response);
3165                 data_blob_free(&tmp_blob);
3166                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
3167                 return;
3168         }
3169
3170         data_blob_free(&server_spnego_response);
3171         data_blob_free(&tmp_blob);
3172
3173         DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
3174                  "%s.\n", rpccli_pipe_txt(talloc_tos(), state->cli)));
3175         tevent_req_done(req);
3176 }
3177
3178 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
3179 {
3180         return tevent_req_simple_recv_ntstatus(req);
3181 }
3182
3183 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
3184                        struct cli_pipe_auth_data *auth)
3185 {
3186         TALLOC_CTX *frame = talloc_stackframe();
3187         struct event_context *ev;
3188         struct tevent_req *req;
3189         NTSTATUS status = NT_STATUS_OK;
3190
3191         ev = event_context_init(frame);
3192         if (ev == NULL) {
3193                 status = NT_STATUS_NO_MEMORY;
3194                 goto fail;
3195         }
3196
3197         req = rpc_pipe_bind_send(frame, ev, cli, auth);
3198         if (req == NULL) {
3199                 status = NT_STATUS_NO_MEMORY;
3200                 goto fail;
3201         }
3202
3203         if (!tevent_req_poll(req, ev)) {
3204                 status = map_nt_error_from_unix(errno);
3205                 goto fail;
3206         }
3207
3208         status = rpc_pipe_bind_recv(req);
3209  fail:
3210         TALLOC_FREE(frame);
3211         return status;
3212 }
3213
3214 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
3215
3216 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
3217                                 unsigned int timeout)
3218 {
3219         unsigned int old;
3220
3221         if (rpc_cli->transport == NULL) {
3222                 return RPCCLI_DEFAULT_TIMEOUT;
3223         }
3224
3225         if (rpc_cli->transport->set_timeout == NULL) {
3226                 return RPCCLI_DEFAULT_TIMEOUT;
3227         }
3228
3229         old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
3230         if (old == 0) {
3231                 return RPCCLI_DEFAULT_TIMEOUT;
3232         }
3233
3234         return old;
3235 }
3236
3237 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
3238 {
3239         if (rpc_cli == NULL) {
3240                 return false;
3241         }
3242
3243         if (rpc_cli->transport == NULL) {
3244                 return false;
3245         }
3246
3247         return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
3248 }
3249
3250 bool rpccli_get_pwd_hash(struct rpc_pipe_client *rpc_cli, uint8_t nt_hash[16])
3251 {
3252         struct cli_state *cli;
3253
3254         if ((rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_NTLMSSP)
3255             || (rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP)) {
3256                 memcpy(nt_hash, rpc_cli->auth->a_u.ntlmssp_state->nt_hash, 16);
3257                 return true;
3258         }
3259
3260         cli = rpc_pipe_np_smb_conn(rpc_cli);
3261         if (cli == NULL) {
3262                 return false;
3263         }
3264         E_md4hash(cli->password ? cli->password : "", nt_hash);
3265         return true;
3266 }
3267
3268 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
3269                                struct cli_pipe_auth_data **presult)
3270 {
3271         struct cli_pipe_auth_data *result;
3272
3273         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3274         if (result == NULL) {
3275                 return NT_STATUS_NO_MEMORY;
3276         }
3277
3278         result->auth_type = PIPE_AUTH_TYPE_NONE;
3279         result->auth_level = DCERPC_AUTH_LEVEL_NONE;
3280
3281         result->user_name = talloc_strdup(result, "");
3282         result->domain = talloc_strdup(result, "");
3283         if ((result->user_name == NULL) || (result->domain == NULL)) {
3284                 TALLOC_FREE(result);
3285                 return NT_STATUS_NO_MEMORY;
3286         }
3287
3288         *presult = result;
3289         return NT_STATUS_OK;
3290 }
3291
3292 static int cli_auth_ntlmssp_data_destructor(struct cli_pipe_auth_data *auth)
3293 {
3294         ntlmssp_end(&auth->a_u.ntlmssp_state);
3295         return 0;
3296 }
3297
3298 static NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
3299                                   enum pipe_auth_type auth_type,
3300                                   enum dcerpc_AuthLevel auth_level,
3301                                   const char *domain,
3302                                   const char *username,
3303                                   const char *password,
3304                                   struct cli_pipe_auth_data **presult)
3305 {
3306         struct cli_pipe_auth_data *result;
3307         NTSTATUS status;
3308
3309         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3310         if (result == NULL) {
3311                 return NT_STATUS_NO_MEMORY;
3312         }
3313
3314         result->auth_type = auth_type;
3315         result->auth_level = auth_level;
3316
3317         result->user_name = talloc_strdup(result, username);
3318         result->domain = talloc_strdup(result, domain);
3319         if ((result->user_name == NULL) || (result->domain == NULL)) {
3320                 status = NT_STATUS_NO_MEMORY;
3321                 goto fail;
3322         }
3323
3324         status = ntlmssp_client_start(NULL,
3325                                       global_myname(),
3326                                       lp_workgroup(),
3327                                       lp_client_ntlmv2_auth(),
3328                                       &result->a_u.ntlmssp_state);
3329         if (!NT_STATUS_IS_OK(status)) {
3330                 goto fail;
3331         }
3332
3333         talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
3334
3335         status = ntlmssp_set_username(result->a_u.ntlmssp_state, username);
3336         if (!NT_STATUS_IS_OK(status)) {
3337                 goto fail;
3338         }
3339
3340         status = ntlmssp_set_domain(result->a_u.ntlmssp_state, domain);
3341         if (!NT_STATUS_IS_OK(status)) {
3342                 goto fail;
3343         }
3344
3345         status = ntlmssp_set_password(result->a_u.ntlmssp_state, password);
3346         if (!NT_STATUS_IS_OK(status)) {
3347                 goto fail;
3348         }
3349
3350         /*
3351          * Turn off sign+seal to allow selected auth level to turn it back on.
3352          */
3353         result->a_u.ntlmssp_state->neg_flags &=
3354                 ~(NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL);
3355
3356         if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
3357                 result->a_u.ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
3358         } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
3359                 result->a_u.ntlmssp_state->neg_flags
3360                         |= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
3361         }
3362
3363         *presult = result;
3364         return NT_STATUS_OK;
3365
3366  fail:
3367         TALLOC_FREE(result);
3368         return status;
3369 }
3370
3371 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
3372                                    enum dcerpc_AuthLevel auth_level,
3373                                    struct netlogon_creds_CredentialState *creds,
3374                                    struct cli_pipe_auth_data **presult)
3375 {
3376         struct cli_pipe_auth_data *result;
3377
3378         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3379         if (result == NULL) {
3380                 return NT_STATUS_NO_MEMORY;
3381         }
3382
3383         result->auth_type = PIPE_AUTH_TYPE_SCHANNEL;
3384         result->auth_level = auth_level;
3385
3386         result->user_name = talloc_strdup(result, "");
3387         result->domain = talloc_strdup(result, domain);
3388         if ((result->user_name == NULL) || (result->domain == NULL)) {
3389                 goto fail;
3390         }
3391
3392         result->a_u.schannel_auth = talloc(result, struct schannel_state);
3393         if (result->a_u.schannel_auth == NULL) {
3394                 goto fail;
3395         }
3396
3397         result->a_u.schannel_auth->state = SCHANNEL_STATE_START;
3398         result->a_u.schannel_auth->seq_num = 0;
3399         result->a_u.schannel_auth->initiator = true;
3400         result->a_u.schannel_auth->creds = creds;
3401
3402         *presult = result;
3403         return NT_STATUS_OK;
3404
3405  fail:
3406         TALLOC_FREE(result);
3407         return NT_STATUS_NO_MEMORY;
3408 }
3409
3410 #ifdef HAVE_KRB5
3411 static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
3412 {
3413         data_blob_free(&auth->session_key);
3414         return 0;
3415 }
3416 #endif
3417
3418 static NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
3419                                    enum dcerpc_AuthLevel auth_level,
3420                                    const char *service_princ,
3421                                    const char *username,
3422                                    const char *password,
3423                                    struct cli_pipe_auth_data **presult)
3424 {
3425 #ifdef HAVE_KRB5
3426         struct cli_pipe_auth_data *result;
3427
3428         if ((username != NULL) && (password != NULL)) {
3429                 int ret = kerberos_kinit_password(username, password, 0, NULL);
3430                 if (ret != 0) {
3431                         return NT_STATUS_ACCESS_DENIED;
3432                 }
3433         }
3434
3435         result = talloc(mem_ctx, struct cli_pipe_auth_data);
3436         if (result == NULL) {
3437                 return NT_STATUS_NO_MEMORY;
3438         }
3439
3440         result->auth_type = PIPE_AUTH_TYPE_KRB5;
3441         result->auth_level = auth_level;
3442
3443         /*
3444          * Username / domain need fixing!
3445          */
3446         result->user_name = talloc_strdup(result, "");
3447         result->domain = talloc_strdup(result, "");
3448         if ((result->user_name == NULL) || (result->domain == NULL)) {
3449                 goto fail;
3450         }
3451
3452         result->a_u.kerberos_auth = TALLOC_ZERO_P(
3453                 result, struct kerberos_auth_struct);
3454         if (result->a_u.kerberos_auth == NULL) {
3455                 goto fail;
3456         }
3457         talloc_set_destructor(result->a_u.kerberos_auth,
3458                               cli_auth_kerberos_data_destructor);
3459
3460         result->a_u.kerberos_auth->service_principal = talloc_strdup(
3461                 result, service_princ);
3462         if (result->a_u.kerberos_auth->service_principal == NULL) {
3463                 goto fail;
3464         }
3465
3466         *presult = result;
3467         return NT_STATUS_OK;
3468
3469  fail:
3470         TALLOC_FREE(result);
3471         return NT_STATUS_NO_MEMORY;
3472 #else
3473         return NT_STATUS_NOT_SUPPORTED;
3474 #endif
3475 }
3476
3477 /**
3478  * Create an rpc pipe client struct, connecting to a tcp port.
3479  */
3480 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
3481                                        uint16_t port,
3482                                        const struct ndr_syntax_id *abstract_syntax,
3483                                        struct rpc_pipe_client **presult)
3484 {
3485         struct rpc_pipe_client *result;
3486         struct sockaddr_storage addr;
3487         NTSTATUS status;
3488         int fd;
3489
3490         result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
3491         if (result == NULL) {
3492                 return NT_STATUS_NO_MEMORY;
3493         }
3494
3495         result->abstract_syntax = *abstract_syntax;
3496         result->transfer_syntax = ndr_transfer_syntax;
3497         result->dispatch = cli_do_rpc_ndr;
3498         result->dispatch_send = cli_do_rpc_ndr_send;
3499         result->dispatch_recv = cli_do_rpc_ndr_recv;
3500
3501         result->desthost = talloc_strdup(result, host);
3502         result->srv_name_slash = talloc_asprintf_strupper_m(
3503                 result, "\\\\%s", result->desthost);
3504         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3505                 status = NT_STATUS_NO_MEMORY;
3506                 goto fail;
3507         }
3508
3509         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3510         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3511
3512         if (!resolve_name(host, &addr, 0, false)) {
3513                 status = NT_STATUS_NOT_FOUND;
3514                 goto fail;
3515         }
3516
3517         status = open_socket_out(&addr, port, 60, &fd);
3518         if (!NT_STATUS_IS_OK(status)) {
3519                 goto fail;
3520         }
3521         set_socket_options(fd, lp_socket_options());
3522
3523         status = rpc_transport_sock_init(result, fd, &result->transport);
3524         if (!NT_STATUS_IS_OK(status)) {
3525                 close(fd);
3526                 goto fail;
3527         }
3528
3529         result->transport->transport = NCACN_IP_TCP;
3530
3531         *presult = result;
3532         return NT_STATUS_OK;
3533
3534  fail:
3535         TALLOC_FREE(result);
3536         return status;
3537 }
3538
3539 /**
3540  * Determine the tcp port on which a dcerpc interface is listening
3541  * for the ncacn_ip_tcp transport via the endpoint mapper of the
3542  * target host.
3543  */
3544 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
3545                                       const struct ndr_syntax_id *abstract_syntax,
3546                                       uint16_t *pport)
3547 {
3548         NTSTATUS status;
3549         struct rpc_pipe_client *epm_pipe = NULL;
3550         struct cli_pipe_auth_data *auth = NULL;
3551         struct dcerpc_binding *map_binding = NULL;
3552         struct dcerpc_binding *res_binding = NULL;
3553         struct epm_twr_t *map_tower = NULL;
3554         struct epm_twr_t *res_towers = NULL;
3555         struct policy_handle *entry_handle = NULL;
3556         uint32_t num_towers = 0;
3557         uint32_t max_towers = 1;
3558         struct epm_twr_p_t towers;
3559         TALLOC_CTX *tmp_ctx = talloc_stackframe();
3560
3561         if (pport == NULL) {
3562                 status = NT_STATUS_INVALID_PARAMETER;
3563                 goto done;
3564         }
3565
3566         /* open the connection to the endpoint mapper */
3567         status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
3568                                         &ndr_table_epmapper.syntax_id,
3569                                         &epm_pipe);
3570
3571         if (!NT_STATUS_IS_OK(status)) {
3572                 goto done;
3573         }
3574
3575         status = rpccli_anon_bind_data(tmp_ctx, &auth);
3576         if (!NT_STATUS_IS_OK(status)) {
3577                 goto done;
3578         }
3579
3580         status = rpc_pipe_bind(epm_pipe, auth);
3581         if (!NT_STATUS_IS_OK(status)) {
3582                 goto done;
3583         }
3584
3585         /* create tower for asking the epmapper */
3586
3587         map_binding = TALLOC_ZERO_P(tmp_ctx, struct dcerpc_binding);
3588         if (map_binding == NULL) {
3589                 status = NT_STATUS_NO_MEMORY;
3590                 goto done;
3591         }
3592
3593         map_binding->transport = NCACN_IP_TCP;
3594         map_binding->object = *abstract_syntax;
3595         map_binding->host = host; /* needed? */
3596         map_binding->endpoint = "0"; /* correct? needed? */
3597
3598         map_tower = TALLOC_ZERO_P(tmp_ctx, struct epm_twr_t);
3599         if (map_tower == NULL) {
3600                 status = NT_STATUS_NO_MEMORY;
3601                 goto done;
3602         }
3603
3604         status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
3605                                             &(map_tower->tower));
3606         if (!NT_STATUS_IS_OK(status)) {
3607                 goto done;
3608         }
3609
3610         /* allocate further parameters for the epm_Map call */
3611
3612         res_towers = TALLOC_ARRAY(tmp_ctx, struct epm_twr_t, max_towers);
3613         if (res_towers == NULL) {
3614                 status = NT_STATUS_NO_MEMORY;
3615                 goto done;
3616         }
3617         towers.twr = res_towers;
3618
3619         entry_handle = TALLOC_ZERO_P(tmp_ctx, struct policy_handle);
3620         if (entry_handle == NULL) {
3621                 status = NT_STATUS_NO_MEMORY;
3622                 goto done;
3623         }
3624
3625         /* ask the endpoint mapper for the port */
3626
3627         status = rpccli_epm_Map(epm_pipe,
3628                                 tmp_ctx,
3629                                 CONST_DISCARD(struct GUID *,
3630                                               &(abstract_syntax->uuid)),
3631                                 map_tower,
3632                                 entry_handle,
3633                                 max_towers,
3634                                 &num_towers,
3635                                 &towers);
3636
3637         if (!NT_STATUS_IS_OK(status)) {
3638                 goto done;
3639         }
3640
3641         if (num_towers != 1) {
3642                 status = NT_STATUS_UNSUCCESSFUL;
3643                 goto done;
3644         }
3645
3646         /* extract the port from the answer */
3647
3648         status = dcerpc_binding_from_tower(tmp_ctx,
3649                                            &(towers.twr->tower),
3650                                            &res_binding);
3651         if (!NT_STATUS_IS_OK(status)) {
3652                 goto done;
3653         }
3654
3655         /* are further checks here necessary? */
3656         if (res_binding->transport != NCACN_IP_TCP) {
3657                 status = NT_STATUS_UNSUCCESSFUL;
3658                 goto done;
3659         }
3660
3661         *pport = (uint16_t)atoi(res_binding->endpoint);
3662
3663 done:
3664         TALLOC_FREE(tmp_ctx);
3665         return status;
3666 }
3667
3668 /**
3669  * Create a rpc pipe client struct, connecting to a host via tcp.
3670  * The port is determined by asking the endpoint mapper on the given
3671  * host.
3672  */
3673 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
3674                            const struct ndr_syntax_id *abstract_syntax,
3675                            struct rpc_pipe_client **presult)
3676 {
3677         NTSTATUS status;
3678         uint16_t port = 0;
3679
3680         status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
3681         if (!NT_STATUS_IS_OK(status)) {
3682                 return status;
3683         }
3684
3685         return rpc_pipe_open_tcp_port(mem_ctx, host, port,
3686                                         abstract_syntax, presult);
3687 }
3688
3689 /********************************************************************
3690  Create a rpc pipe client struct, connecting to a unix domain socket
3691  ********************************************************************/
3692 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
3693                                const struct ndr_syntax_id *abstract_syntax,
3694                                struct rpc_pipe_client **presult)
3695 {
3696         struct rpc_pipe_client *result;
3697         struct sockaddr_un addr;
3698         NTSTATUS status;
3699         int fd;
3700
3701         result = talloc_zero(mem_ctx, struct rpc_pipe_client);
3702         if (result == NULL) {
3703                 return NT_STATUS_NO_MEMORY;
3704         }
3705
3706         result->abstract_syntax = *abstract_syntax;
3707         result->transfer_syntax = ndr_transfer_syntax;
3708         result->dispatch = cli_do_rpc_ndr;
3709         result->dispatch_send = cli_do_rpc_ndr_send;
3710         result->dispatch_recv = cli_do_rpc_ndr_recv;
3711
3712         result->desthost = get_myname(result);
3713         result->srv_name_slash = talloc_asprintf_strupper_m(
3714                 result, "\\\\%s", result->desthost);
3715         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3716                 status = NT_STATUS_NO_MEMORY;
3717                 goto fail;
3718         }
3719
3720         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3721         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3722
3723         fd = socket(AF_UNIX, SOCK_STREAM, 0);
3724         if (fd == -1) {
3725                 status = map_nt_error_from_unix(errno);
3726                 goto fail;
3727         }
3728
3729         ZERO_STRUCT(addr);
3730         addr.sun_family = AF_UNIX;
3731         strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
3732
3733         if (sys_connect(fd, (struct sockaddr *)(void *)&addr) == -1) {
3734                 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
3735                           strerror(errno)));
3736                 close(fd);
3737                 return map_nt_error_from_unix(errno);
3738         }
3739
3740         status = rpc_transport_sock_init(result, fd, &result->transport);
3741         if (!NT_STATUS_IS_OK(status)) {
3742                 close(fd);
3743                 goto fail;
3744         }
3745
3746         result->transport->transport = NCALRPC;
3747
3748         *presult = result;
3749         return NT_STATUS_OK;
3750
3751  fail:
3752         TALLOC_FREE(result);
3753         return status;
3754 }
3755
3756 struct rpc_pipe_client_np_ref {
3757         struct cli_state *cli;
3758         struct rpc_pipe_client *pipe;
3759 };
3760
3761 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
3762 {
3763         DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
3764         return 0;
3765 }
3766
3767 /****************************************************************************
3768  Open a named pipe over SMB to a remote server.
3769  *
3770  * CAVEAT CALLER OF THIS FUNCTION:
3771  *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
3772  *    so be sure that this function is called AFTER any structure (vs pointer)
3773  *    assignment of the cli.  In particular, libsmbclient does structure
3774  *    assignments of cli, which invalidates the data in the returned
3775  *    rpc_pipe_client if this function is called before the structure assignment
3776  *    of cli.
3777  *
3778  ****************************************************************************/
3779
3780 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
3781                                  const struct ndr_syntax_id *abstract_syntax,
3782                                  struct rpc_pipe_client **presult)
3783 {
3784         struct rpc_pipe_client *result;
3785         NTSTATUS status;
3786         struct rpc_pipe_client_np_ref *np_ref;
3787
3788         /* sanity check to protect against crashes */
3789
3790         if ( !cli ) {
3791                 return NT_STATUS_INVALID_HANDLE;
3792         }
3793
3794         result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
3795         if (result == NULL) {
3796                 return NT_STATUS_NO_MEMORY;
3797         }
3798
3799         result->abstract_syntax = *abstract_syntax;
3800         result->transfer_syntax = ndr_transfer_syntax;
3801         result->dispatch = cli_do_rpc_ndr;
3802         result->dispatch_send = cli_do_rpc_ndr_send;
3803         result->dispatch_recv = cli_do_rpc_ndr_recv;
3804         result->desthost = talloc_strdup(result, cli->desthost);
3805         result->srv_name_slash = talloc_asprintf_strupper_m(
3806                 result, "\\\\%s", result->desthost);
3807
3808         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3809         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3810
3811         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3812                 TALLOC_FREE(result);
3813                 return NT_STATUS_NO_MEMORY;
3814         }
3815
3816         status = rpc_transport_np_init(result, cli, abstract_syntax,
3817                                        &result->transport);
3818         if (!NT_STATUS_IS_OK(status)) {
3819                 TALLOC_FREE(result);
3820                 return status;
3821         }
3822
3823         result->transport->transport = NCACN_NP;
3824
3825         np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
3826         if (np_ref == NULL) {
3827                 TALLOC_FREE(result);
3828                 return NT_STATUS_NO_MEMORY;
3829         }
3830         np_ref->cli = cli;
3831         np_ref->pipe = result;
3832
3833         DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
3834         talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
3835
3836         *presult = result;
3837         return NT_STATUS_OK;
3838 }
3839
3840 NTSTATUS rpc_pipe_open_local(TALLOC_CTX *mem_ctx,
3841                              struct rpc_cli_smbd_conn *conn,
3842                              const struct ndr_syntax_id *syntax,
3843                              struct rpc_pipe_client **presult)
3844 {
3845         struct rpc_pipe_client *result;
3846         struct cli_pipe_auth_data *auth;
3847         NTSTATUS status;
3848
3849         result = talloc(mem_ctx, struct rpc_pipe_client);
3850         if (result == NULL) {
3851                 return NT_STATUS_NO_MEMORY;
3852         }
3853         result->abstract_syntax = *syntax;
3854         result->transfer_syntax = ndr_transfer_syntax;
3855         result->dispatch = cli_do_rpc_ndr;
3856         result->dispatch_send = cli_do_rpc_ndr_send;
3857         result->dispatch_recv = cli_do_rpc_ndr_recv;
3858         result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3859         result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3860
3861         result->desthost = talloc_strdup(result, global_myname());
3862         result->srv_name_slash = talloc_asprintf_strupper_m(
3863                 result, "\\\\%s", global_myname());
3864         if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3865                 TALLOC_FREE(result);
3866                 return NT_STATUS_NO_MEMORY;
3867         }
3868
3869         status = rpc_transport_smbd_init(result, conn, syntax,
3870                                          &result->transport);
3871         if (!NT_STATUS_IS_OK(status)) {
3872                 DEBUG(1, ("rpc_transport_smbd_init failed: %s\n",
3873                           nt_errstr(status)));
3874                 TALLOC_FREE(result);
3875                 return status;
3876         }
3877
3878         status = rpccli_anon_bind_data(result, &auth);
3879         if (!NT_STATUS_IS_OK(status)) {
3880                 DEBUG(1, ("rpccli_anon_bind_data failed: %s\n",
3881                           nt_errstr(status)));
3882                 TALLOC_FREE(result);
3883                 return status;
3884         }
3885
3886         status = rpc_pipe_bind(result, auth);
3887         if (!NT_STATUS_IS_OK(status)) {
3888                 DEBUG(1, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
3889                 TALLOC_FREE(result);
3890                 return status;
3891         }
3892
3893         result->transport->transport = NCACN_INTERNAL;
3894
3895         *presult = result;
3896         return NT_STATUS_OK;
3897 }
3898
3899 /****************************************************************************
3900  Open a pipe to a remote server.
3901  ****************************************************************************/
3902
3903 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3904                                   enum dcerpc_transport_t transport,
3905                                   const struct ndr_syntax_id *interface,
3906                                   struct rpc_pipe_client **presult)
3907 {
3908         switch (transport) {
3909         case NCACN_IP_TCP:
3910                 return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
3911                                          presult);
3912         case NCACN_NP:
3913                 return rpc_pipe_open_np(cli, interface, presult);
3914         default:
3915                 return NT_STATUS_NOT_IMPLEMENTED;
3916         }
3917 }
3918
3919 /****************************************************************************
3920  Open a named pipe to an SMB server and bind anonymously.
3921  ****************************************************************************/
3922
3923 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
3924                                             enum dcerpc_transport_t transport,
3925                                             const struct ndr_syntax_id *interface,
3926                                             struct rpc_pipe_client **presult)
3927 {
3928         struct rpc_pipe_client *result;
3929         struct cli_pipe_auth_data *auth;
3930         NTSTATUS status;
3931
3932         status = cli_rpc_pipe_open(cli, transport, interface, &result);
3933         if (!NT_STATUS_IS_OK(status)) {
3934                 return status;
3935         }
3936
3937         status = rpccli_anon_bind_data(result, &auth);
3938         if (!NT_STATUS_IS_OK(status)) {
3939                 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3940                           nt_errstr(status)));
3941                 TALLOC_FREE(result);
3942                 return status;
3943         }
3944
3945         /*
3946          * This is a bit of an abstraction violation due to the fact that an
3947          * anonymous bind on an authenticated SMB inherits the user/domain
3948          * from the enclosing SMB creds
3949          */
3950
3951         TALLOC_FREE(auth->user_name);
3952         TALLOC_FREE(auth->domain);
3953
3954         auth->user_name = talloc_strdup(auth, cli->user_name);
3955         auth->domain = talloc_strdup(auth, cli->domain);
3956         auth->user_session_key = data_blob_talloc(auth,
3957                 cli->user_session_key.data,
3958                 cli->user_session_key.length);
3959
3960         if ((auth->user_name == NULL) || (auth->domain == NULL)) {
3961                 TALLOC_FREE(result);
3962                 return NT_STATUS_NO_MEMORY;
3963         }
3964
3965         status = rpc_pipe_bind(result, auth);
3966         if (!NT_STATUS_IS_OK(status)) {
3967                 int lvl = 0;
3968                 if (ndr_syntax_id_equal(interface,
3969                                         &ndr_table_dssetup.syntax_id)) {
3970                         /* non AD domains just don't have this pipe, avoid
3971                          * level 0 statement in that case - gd */
3972                         lvl = 3;
3973                 }
3974                 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3975                             "%s failed with error %s\n",
3976                             get_pipe_name_from_syntax(talloc_tos(), interface),
3977                             nt_errstr(status) ));
3978                 TALLOC_FREE(result);
3979                 return status;
3980         }
3981
3982         DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3983                   "%s and bound anonymously.\n",
3984                   get_pipe_name_from_syntax(talloc_tos(), interface),
3985                   cli->desthost));
3986
3987         *presult = result;
3988         return NT_STATUS_OK;
3989 }
3990
3991 /****************************************************************************
3992  ****************************************************************************/
3993
3994 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3995                                   const struct ndr_syntax_id *interface,
3996                                   struct rpc_pipe_client **presult)
3997 {
3998         return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
3999                                                   interface, presult);
4000 }
4001
4002 /****************************************************************************
4003  Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
4004  ****************************************************************************/
4005
4006 static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
4007                                                    const struct ndr_syntax_id *interface,
4008                                                    enum dcerpc_transport_t transport,
4009                                                    enum pipe_auth_type auth_type,
4010                                                    enum dcerpc_AuthLevel auth_level,
4011                                                    const char *domain,
4012                                                    const char *username,
4013                                                    const char *password,
4014                                                    struct rpc_pipe_client **presult)
4015 {
4016         struct rpc_pipe_client *result;
4017         struct cli_pipe_auth_data *auth;
4018         NTSTATUS status;
4019
4020         status = cli_rpc_pipe_open(cli, transport, interface, &result);
4021         if (!NT_STATUS_IS_OK(status)) {
4022                 return status;
4023         }
4024
4025         status = rpccli_ntlmssp_bind_data(
4026                 result, auth_type, auth_level, domain, username,
4027                 password, &auth);
4028         if (!NT_STATUS_IS_OK(status)) {
4029                 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
4030                           nt_errstr(status)));
4031                 goto err;
4032         }
4033
4034         status = rpc_pipe_bind(result, auth);
4035         if (!NT_STATUS_IS_OK(status)) {
4036                 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
4037                         nt_errstr(status) ));
4038                 goto err;
4039         }
4040
4041         DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
4042                 "machine %s and bound NTLMSSP as user %s\\%s.\n",
4043                   get_pipe_name_from_syntax(talloc_tos(), interface),
4044                   cli->desthost, domain, username ));
4045
4046         *presult = result;
4047         return NT_STATUS_OK;
4048
4049   err:
4050
4051         TALLOC_FREE(result);
4052         return status;
4053 }
4054
4055 /****************************************************************************
4056  External interface.
4057  Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
4058  ****************************************************************************/
4059
4060 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
4061                                    const struct ndr_syntax_id *interface,
4062                                    enum dcerpc_transport_t transport,
4063                                    enum dcerpc_AuthLevel auth_level,
4064                                    const char *domain,
4065                                    const char *username,
4066                                    const char *password,
4067                                    struct rpc_pipe_client **presult)
4068 {
4069         return cli_rpc_pipe_open_ntlmssp_internal(cli,
4070                                                 interface,
4071                                                 transport,
4072                                                 PIPE_AUTH_TYPE_NTLMSSP,
4073                                                 auth_level,
4074                                                 domain,
4075                                                 username,
4076                                                 password,
4077                                                 presult);
4078 }
4079
4080 /****************************************************************************
4081  External interface.
4082  Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
4083  ****************************************************************************/
4084
4085 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
4086                                           const struct ndr_syntax_id *interface,
4087                                           enum dcerpc_transport_t transport,
4088                                           enum dcerpc_AuthLevel auth_level,
4089                                           const char *domain,
4090                                           const char *username,
4091                                           const char *password,
4092                                           struct rpc_pipe_client **presult)
4093 {
4094         return cli_rpc_pipe_open_ntlmssp_internal(cli,
4095                                                 interface,
4096                                                 transport,
4097                                                 PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
4098                                                 auth_level,
4099                                                 domain,
4100                                                 username,
4101                                                 password,
4102                                                 presult);
4103 }
4104
4105 /****************************************************************************
4106   Get a the schannel session key out of an already opened netlogon pipe.
4107  ****************************************************************************/
4108 static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
4109                                                 struct cli_state *cli,
4110                                                 const char *domain,
4111                                                 uint32 *pneg_flags)
4112 {
4113         enum netr_SchannelType sec_chan_type = 0;
4114         unsigned char machine_pwd[16];
4115         const char *machine_account;
4116         NTSTATUS status;
4117
4118         /* Get the machine account credentials from secrets.tdb. */
4119         if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
4120                                &sec_chan_type))
4121         {
4122                 DEBUG(0, ("get_schannel_session_key: could not fetch "
4123                         "trust account password for domain '%s'\n",
4124                         domain));
4125                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
4126         }
4127
4128         status = rpccli_netlogon_setup_creds(netlogon_pipe,
4129                                         cli->desthost, /* server name */
4130                                         domain,        /* domain */
4131                                         global_myname(), /* client name */
4132                                         machine_account, /* machine account name */
4133                                         machine_pwd,
4134                                         sec_chan_type,
4135                                         pneg_flags);
4136
4137         if (!NT_STATUS_IS_OK(status)) {
4138                 DEBUG(3, ("get_schannel_session_key_common: "
4139                           "rpccli_netlogon_setup_creds failed with result %s "
4140                           "to server %s, domain %s, machine account %s.\n",
4141                           nt_errstr(status), cli->desthost, domain,
4142                           machine_account ));
4143                 return status;
4144         }
4145
4146         if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
4147                 DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
4148                         cli->desthost));
4149                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
4150         }
4151
4152         return NT_STATUS_OK;;
4153 }
4154
4155 /****************************************************************************
4156  Open a netlogon pipe and get the schannel session key.
4157  Now exposed to external callers.
4158  ****************************************************************************/
4159
4160
4161 NTSTATUS get_schannel_session_key(struct cli_state *cli,
4162                                   const char *domain,
4163                                   uint32 *pneg_flags,
4164                                   struct rpc_pipe_client **presult)
4165 {
4166         struct rpc_pipe_client *netlogon_pipe = NULL;
4167         NTSTATUS status;
4168
4169         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
4170                                           &netlogon_pipe);
4171         if (!NT_STATUS_IS_OK(status)) {
4172                 return status;
4173         }
4174
4175         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
4176                                                  pneg_flags);
4177         if (!NT_STATUS_IS_OK(status)) {
4178                 TALLOC_FREE(netlogon_pipe);
4179                 return status;
4180         }
4181
4182         *presult = netlogon_pipe;
4183         return NT_STATUS_OK;
4184 }
4185
4186 /****************************************************************************
4187  External interface.
4188  Open a named pipe to an SMB server and bind using schannel (bind type 68)
4189  using session_key. sign and seal.
4190
4191  The *pdc will be stolen onto this new pipe
4192  ****************************************************************************/
4193
4194 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
4195                                              const struct ndr_syntax_id *interface,
4196                                              enum dcerpc_transport_t transport,
4197                                              enum dcerpc_AuthLevel auth_level,
4198                                              const char *domain,
4199                                              struct netlogon_creds_CredentialState **pdc,
4200                                              struct rpc_pipe_client **presult)
4201 {
4202         struct rpc_pipe_client *result;
4203         struct cli_pipe_auth_data *auth;
4204         NTSTATUS status;
4205
4206         status = cli_rpc_pipe_open(cli, transport, interface, &result);
4207         if (!NT_STATUS_IS_OK(status)) {
4208                 return status;
4209         }
4210
4211         status = rpccli_schannel_bind_data(result, domain, auth_level,
4212                                            *pdc, &auth);
4213         if (!NT_STATUS_IS_OK(status)) {
4214                 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
4215                           nt_errstr(status)));
4216                 TALLOC_FREE(result);
4217                 return status;
4218         }
4219
4220         status = rpc_pipe_bind(result, auth);
4221         if (!NT_STATUS_IS_OK(status)) {
4222                 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
4223                           "cli_rpc_pipe_bind failed with error %s\n",
4224                           nt_errstr(status) ));
4225                 TALLOC_FREE(result);
4226                 return status;
4227         }
4228
4229         /*
4230          * The credentials on a new netlogon pipe are the ones we are passed
4231          * in - reference them in
4232          */
4233         result->dc = talloc_move(result, pdc);
4234
4235         DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
4236                   "for domain %s and bound using schannel.\n",
4237                   get_pipe_name_from_syntax(talloc_tos(), interface),
4238                   cli->desthost, domain ));
4239
4240         *presult = result;
4241         return NT_STATUS_OK;
4242 }
4243
4244 /****************************************************************************
4245  Open a named pipe to an SMB server and bind using schannel (bind type 68).
4246  Fetch the session key ourselves using a temporary netlogon pipe. This
4247  version uses an ntlmssp auth bound netlogon pipe to get the key.
4248  ****************************************************************************/
4249
4250 static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
4251                                                       const char *domain,
4252                                                       const char *username,
4253                                                       const char *password,
4254                                                       uint32 *pneg_flags,
4255                                                       struct rpc_pipe_client **presult)
4256 {
4257         struct rpc_pipe_client *netlogon_pipe = NULL;
4258         NTSTATUS status;
4259
4260         status = cli_rpc_pipe_open_spnego_ntlmssp(
4261                 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
4262                 DCERPC_AUTH_LEVEL_PRIVACY,
4263                 domain, username, password, &netlogon_pipe);
4264         if (!NT_STATUS_IS_OK(status)) {
4265                 return status;
4266         }
4267
4268         status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
4269                                                  pneg_flags);
4270         if (!NT_STATUS_IS_OK(status)) {
4271                 TALLOC_FREE(netlogon_pipe);
4272                 return status;
4273         }
4274
4275         *presult = netlogon_pipe;
4276         return NT_STATUS_OK;
4277 }
4278
4279 /****************************************************************************
4280  Open a named pipe to an SMB server and bind using schannel (bind type 68).
4281  Fetch the session key ourselves using a temporary netlogon pipe. This version
4282  uses an ntlmssp bind to get the session key.
4283  ****************************************************************************/
4284
4285 NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
4286                                                  const struct ndr_syntax_id *interface,
4287                                                  enum dcerpc_transport_t transport,
4288                                                  enum dcerpc_AuthLevel auth_level,
4289                                                  const char *domain,
4290                                                  const char *username,
4291                                                  const char *password,
4292                                                  struct rpc_pipe_client **presult)
4293 {
4294         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
4295         struct rpc_pipe_client *netlogon_pipe = NULL;
4296         struct rpc_pipe_client *result = NULL;
4297         NTSTATUS status;
4298
4299         status = get_schannel_session_key_auth_ntlmssp(
4300                 cli, domain, username, password, &neg_flags, &netlogon_pipe);
4301         if (!NT_STATUS_IS_OK(status)) {
4302                 DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
4303                         "key from server %s for domain %s.\n",
4304                         cli->desthost, domain ));
4305                 return status;
4306         }
4307
4308         status = cli_rpc_pipe_open_schannel_with_key(
4309                 cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
4310                 &result);
4311
4312         /* Now we've bound using the session key we can close the netlog pipe. */
4313         TALLOC_FREE(netlogon_pipe);
4314
4315         if (NT_STATUS_IS_OK(status)) {
4316                 *presult = result;
4317         }
4318         return status;
4319 }
4320
4321 /****************************************************************************
4322  Open a named pipe to an SMB server and bind using schannel (bind type 68).
4323  Fetch the session key ourselves using a temporary netlogon pipe.
4324  ****************************************************************************/
4325
4326 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
4327                                     const struct ndr_syntax_id *interface,
4328                                     enum dcerpc_transport_t transport,
4329                                     enum dcerpc_AuthLevel auth_level,
4330                                     const char *domain,
4331                                     struct rpc_pipe_client **presult)
4332 {
4333         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
4334         struct rpc_pipe_client *netlogon_pipe = NULL;
4335         struct rpc_pipe_client *result = NULL;
4336         NTSTATUS status;
4337
4338         status = get_schannel_session_key(cli, domain, &neg_flags,
4339                                           &netlogon_pipe);
4340         if (!NT_STATUS_IS_OK(status)) {
4341                 DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
4342                         "key from server %s for domain %s.\n",
4343                         cli->desthost, domain ));
4344                 return status;
4345         }
4346
4347         status = cli_rpc_pipe_open_schannel_with_key(
4348                 cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
4349                 &result);
4350
4351         /* Now we've bound using the session key we can close the netlog pipe. */
4352         TALLOC_FREE(netlogon_pipe);
4353
4354         if (NT_STATUS_IS_OK(status)) {
4355                 *presult = result;
4356         }
4357
4358         return status;
4359 }
4360
4361 /****************************************************************************
4362  Open a named pipe to an SMB server and bind using krb5 (bind type 16).
4363  The idea is this can be called with service_princ, username and password all
4364  NULL so long as the caller has a TGT.
4365  ****************************************************************************/
4366
4367 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
4368                                 const struct ndr_syntax_id *interface,
4369                                 enum dcerpc_AuthLevel auth_level,
4370                                 const char *service_princ,
4371                                 const char *username,
4372                                 const char *password,
4373                                 struct rpc_pipe_client **presult)
4374 {
4375 #ifdef HAVE_KRB5
4376         struct rpc_pipe_client *result;
4377         struct cli_pipe_auth_data *auth;
4378         NTSTATUS status;
4379
4380         status = cli_rpc_pipe_open(cli, NCACN_NP, interface, &result);
4381         if (!NT_STATUS_IS_OK(status)) {
4382                 return status;
4383         }
4384
4385         status = rpccli_kerberos_bind_data(result, auth_level, service_princ,
4386                                            username, password, &auth);
4387         if (!NT_STATUS_IS_OK(status)) {
4388                 DEBUG(0, ("rpccli_kerberos_bind_data returned %s\n",
4389                           nt_errstr(status)));
4390                 TALLOC_FREE(result);
4391                 return status;
4392         }
4393
4394         status = rpc_pipe_bind(result, auth);
4395         if (!NT_STATUS_IS_OK(status)) {
4396                 DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
4397                           "with error %s\n", nt_errstr(status)));
4398                 TALLOC_FREE(result);
4399                 return status;
4400         }
4401
4402         *presult = result;
4403         return NT_STATUS_OK;
4404 #else
4405         DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
4406         return NT_STATUS_NOT_IMPLEMENTED;
4407 #endif
4408 }
4409
4410 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
4411                              struct rpc_pipe_client *cli,
4412                              DATA_BLOB *session_key)
4413 {
4414         if (!session_key || !cli) {
4415                 return NT_STATUS_INVALID_PARAMETER;
4416         }
4417
4418         if (!cli->auth) {
4419                 return NT_STATUS_INVALID_PARAMETER;
4420         }
4421
4422         switch (cli->auth->auth_type) {
4423                 case PIPE_AUTH_TYPE_SCHANNEL:
4424                         *session_key = data_blob_talloc(mem_ctx,
4425                                 cli->auth->a_u.schannel_auth->creds->session_key, 16);
4426                         break;
4427                 case PIPE_AUTH_TYPE_NTLMSSP:
4428                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
4429                         *session_key = data_blob_talloc(mem_ctx,
4430                                 cli->auth->a_u.ntlmssp_state->session_key.data,
4431                                 cli->auth->a_u.ntlmssp_state->session_key.length);
4432                         break;
4433                 case PIPE_AUTH_TYPE_KRB5:
4434                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
4435                         *session_key = data_blob_talloc(mem_ctx,
4436                                 cli->auth->a_u.kerberos_auth->session_key.data,
4437                                 cli->auth->a_u.kerberos_auth->session_key.length);
4438                         break;
4439                 case PIPE_AUTH_TYPE_NONE:
4440                         *session_key = data_blob_talloc(mem_ctx,
4441                                 cli->auth->user_session_key.data,
4442                                 cli->auth->user_session_key.length);
4443                         break;
4444                 default:
4445                         return NT_STATUS_NO_USER_SESSION_KEY;
4446         }
4447
4448         return NT_STATUS_OK;
4449 }