1 files changed, 111 insertions, 450 deletions

diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 2cb52ece0b..6a8b867136 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -59,446 +59,94 @@ void dcerpc_pipe_close(struct dcerpc_pipe *p)
 	}
 }
 
-#define BLOB_CHECK_BOUNDS(blob, offset, len) do { \
-	if ((offset) > blob->length || (blob->length - (offset) < (len))) { \
-		return NT_STATUS_INVALID_PARAMETER; \
-	} \
-} while (0)
-
-#define DCERPC_ALIGN(offset, n) do { \
-	(offset) = ((offset) + ((n)-1)) & ~((n)-1); \
-} while (0)
-
-/*
-  pull a wire format uuid into a string. This will consume 16 bytes
-*/
-static char *dcerpc_pull_uuid(char *data, TALLOC_CTX *mem_ctx)
-{
-	uint32 time_low;
-	uint16 time_mid, time_hi_and_version;
-	uint8 clock_seq_hi_and_reserved;
-	uint8 clock_seq_low;
-	uint8 node[6];
-	int i;
-
-	time_low                  = IVAL(data, 0);
-	time_mid                  = SVAL(data, 4);
-	time_hi_and_version       = SVAL(data, 6);
-	clock_seq_hi_and_reserved = CVAL(data, 8);
-	clock_seq_low             = CVAL(data, 9);
-	for (i=0;i<6;i++) {
-		node[i]           = CVAL(data, 10 + i);
-	}
-
-	return talloc_asprintf(mem_ctx, 
-			       "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-			       time_low, time_mid, time_hi_and_version, 
-			       clock_seq_hi_and_reserved, clock_seq_low,
-			       node[0], node[1], node[2], node[3], node[4], node[5]);
-}
-
-/*
-  push a uuid_str into wire format. It will consume 16 bytes
-*/
-static NTSTATUS push_uuid_str(char *data, const char *uuid_str)
-{
-	uint32 time_low;
-	uint32 time_mid, time_hi_and_version;
-	uint32 clock_seq_hi_and_reserved;
-	uint32 clock_seq_low;
-	uint32 node[6];
-	int i;
-
-	if (11 != sscanf(uuid_str, "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-			 &time_low, &time_mid, &time_hi_and_version, 
-			 &clock_seq_hi_and_reserved, &clock_seq_low,
-			 &node[0], &node[1], &node[2], &node[3], &node[4], &node[5])) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-
-	SIVAL(data, 0, time_low);
-	SSVAL(data, 4, time_mid);
-	SSVAL(data, 6, time_hi_and_version);
-	SCVAL(data, 8, clock_seq_hi_and_reserved);
-	SCVAL(data, 9, clock_seq_low);
-	for (i=0;i<6;i++) {
-		SCVAL(data, 10 + i, node[i]);
-	}
-
-	return NT_STATUS_OK;
-}
-
-/*
-  pull a dcerpc syntax id from a blob
-*/
-static NTSTATUS dcerpc_pull_syntax_id(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
-				      uint32 *offset, 
-				      struct dcerpc_syntax_id *syntax)
-{
-	syntax->uuid_str = dcerpc_pull_uuid(blob->data + (*offset), mem_ctx);
-	if (!syntax->uuid_str) {
-		return NT_STATUS_NO_MEMORY;
-	}
-	(*offset) += 16;
-	syntax->if_version = IVAL(blob->data, *offset);
-	(*offset) += 4;
-	return NT_STATUS_OK;
-}
 
 /*
-  push a syntax id onto the wire. It will consume 20 bytes
+  build a GUID from a string
 */
-static NTSTATUS push_syntax_id(char *data, const struct dcerpc_syntax_id *syntax)
+static NTSTATUS guid_from_string(const char *s, struct GUID *guid)
 {
-	NTSTATUS status;
-
-	status = push_uuid_str(data, syntax->uuid_str);
-	SIVAL(data, 16, syntax->if_version);
-
-	return status;
-}
-
-/*
-  pull an auth verifier from a packet
-*/
-static NTSTATUS dcerpc_pull_auth_verifier(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
-					  uint32 *offset, 
-					  struct dcerpc_hdr *hdr,
-					  DATA_BLOB *auth)
-{
-	if (hdr->auth_length == 0) {
-		return NT_STATUS_OK;
-	}
-
-	BLOB_CHECK_BOUNDS(blob, *offset, hdr->auth_length);
-	*auth = data_blob_talloc(mem_ctx, blob->data + (*offset), hdr->auth_length);
-	if (!auth->data) {
-		return NT_STATUS_NO_MEMORY;
-	}
-	(*offset) += hdr->auth_length;
-	return NT_STATUS_OK;
-}
-
-/* 
-   parse a struct dcerpc_response
-*/
-static NTSTATUS dcerpc_pull_response(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
-				     uint32 *offset, 
-				     struct dcerpc_hdr *hdr,
-				     struct dcerpc_response *pkt)
-{
-	uint32 stub_len;
-	
-	BLOB_CHECK_BOUNDS(blob, *offset, 8);
-
-	pkt->alloc_hint   = IVAL(blob->data, (*offset) + 0);
-	pkt->context_id   = SVAL(blob->data, (*offset) + 4);
-	pkt->cancel_count = CVAL(blob->data, (*offset) + 6);
-
-	(*offset) += 8;
-
-	stub_len = blob->length - ((*offset) + hdr->auth_length);
-	BLOB_CHECK_BOUNDS(blob, *offset, stub_len);
-	pkt->stub_data = data_blob_talloc(mem_ctx, blob->data + (*offset), stub_len);
-	if (stub_len != 0 && !pkt->stub_data.data) {
-		return NT_STATUS_NO_MEMORY;
-	}
-	(*offset) += stub_len;
-
-	return dcerpc_pull_auth_verifier(blob, mem_ctx, offset, hdr, &pkt->auth_verifier);	
-}
-
-
-/* 
-   parse a struct bind_ack
-*/
-static NTSTATUS dcerpc_pull_bind_ack(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
-				     uint32 *offset, 
-				     struct dcerpc_hdr *hdr,
-				     struct dcerpc_bind_ack *pkt)
-{
-	uint16 len;
-	int i;
-	
-	BLOB_CHECK_BOUNDS(blob, *offset, 10);
-	pkt->max_xmit_frag  = SVAL(blob->data, (*offset) + 0);
-	pkt->max_recv_frag  = SVAL(blob->data, (*offset) + 2);
-	pkt->assoc_group_id = IVAL(blob->data, (*offset) + 4);
-	len                 = SVAL(blob->data, (*offset) + 8);
-	(*offset) += 10;
-
-	if (len) {
-		BLOB_CHECK_BOUNDS(blob, *offset, len);
-		pkt->secondary_address = talloc_strndup(mem_ctx, blob->data + (*offset), len);
-		if (!pkt->secondary_address) {
-			return NT_STATUS_NO_MEMORY;
-		}
-		(*offset) += len;
-	}
-
-	DCERPC_ALIGN(*offset, 4);
-	BLOB_CHECK_BOUNDS(blob, *offset, 4);
-	pkt->num_results = CVAL(blob->data, *offset); 
-	(*offset) += 4;
-
-	if (pkt->num_results > 0) {
-		pkt->ctx_list = talloc(mem_ctx, sizeof(pkt->ctx_list[0]) * pkt->num_results);
-		if (!pkt->ctx_list) {
-			return NT_STATUS_NO_MEMORY;
-		}
-	}
-
-	for (i=0;i<pkt->num_results;i++) {
-		NTSTATUS status;
-
-		BLOB_CHECK_BOUNDS(blob, *offset, 24);
-		pkt->ctx_list[i].result = SVAL(blob->data, *offset);
-		pkt->ctx_list[i].reason = SVAL(blob->data, 2 + *offset);
-		(*offset) += 4;
-		status = dcerpc_pull_syntax_id(blob, mem_ctx, offset, &pkt->ctx_list[i].syntax);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
-	}
-
-	return dcerpc_pull_auth_verifier(blob, mem_ctx, offset, hdr, &pkt->auth_verifier);
-}
-
-
-/* 
-   parse a dcerpc header
-*/
-static NTSTATUS dcerpc_pull_hdr(DATA_BLOB *blob, uint32 *offset, struct dcerpc_hdr *hdr)
-{
-	BLOB_CHECK_BOUNDS(blob, *offset, 16);
-	
-	hdr->rpc_vers       = CVAL(blob->data, (*offset) + 0);
-	hdr->rpc_vers_minor = CVAL(blob->data, (*offset) + 1);
-	hdr->ptype          = CVAL(blob->data, (*offset) + 2);
-	hdr->pfc_flags      = CVAL(blob->data, (*offset) + 3);
-	memcpy(hdr->drep, blob->data + (*offset) + 4, 4);
-	hdr->frag_length    = SVAL(blob->data, (*offset) + 8);
-	hdr->auth_length    = SVAL(blob->data, (*offset) + 10);
-	hdr->call_id        = IVAL(blob->data, (*offset) + 12);
-
-	(*offset) += 16;
-
-	return NT_STATUS_OK;
+        uint32 time_low;
+        uint32 time_mid, time_hi_and_version;
+        uint32 clock_seq_hi_and_reserved;
+        uint32 clock_seq_low;
+        uint32 node[6];
+        int i;
+
+        if (11 != sscanf(s, "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+                         &time_low, &time_mid, &time_hi_and_version, 
+                         &clock_seq_hi_and_reserved, &clock_seq_low,
+                         &node[0], &node[1], &node[2], &node[3], &node[4], &node[5])) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        SIVAL(guid->info, 0, time_low);
+        SSVAL(guid->info, 4, time_mid);
+        SSVAL(guid->info, 6, time_hi_and_version);
+        SCVAL(guid->info, 8, clock_seq_hi_and_reserved);
+        SCVAL(guid->info, 9, clock_seq_low);
+        for (i=0;i<6;i++) {
+                SCVAL(guid->info, 10 + i, node[i]);
+        }
+
+        return NT_STATUS_OK;
 }
 
 /* 
-   parse a dcerpc header. It consumes 16 bytes
-*/
-static void dcerpc_push_hdr(char *data, struct dcerpc_hdr *hdr)
-{
-	SCVAL(data, 0, hdr->rpc_vers);
-	SCVAL(data, 1, hdr->rpc_vers_minor);
-	SCVAL(data, 2, hdr->ptype);
-	SCVAL(data, 3, hdr->pfc_flags);
-	memcpy(data + 4, hdr->drep, 4);
-	SSVAL(data, 8, hdr->frag_length);
-	SSVAL(data, 12, hdr->call_id);
-}
-
-
-
-/* 
    parse a data blob into a dcerpc_packet structure. This handles both
    input and output packets
 */
 NTSTATUS dcerpc_pull(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct dcerpc_packet *pkt)
 {
-	NTSTATUS status;
-	uint32 offset = 0;
+	struct ndr_pull *ndr;
 
-	status = dcerpc_pull_hdr(blob, &offset, &pkt->hdr);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
-
-	switch (pkt->hdr.ptype) {
-	case DCERPC_PKT_BIND_ACK:
-		status = dcerpc_pull_bind_ack(blob, mem_ctx, &offset, &pkt->hdr, &pkt->out.bind_ack);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}		
-		break;
-
-	case DCERPC_PKT_RESPONSE:
-		status = dcerpc_pull_response(blob, mem_ctx, &offset, &pkt->hdr, &pkt->out.response);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}		
-		break;
-
-	default:
-		return NT_STATUS_NET_WRITE_FAULT;
-	}
-
-	return status;
-}
-
-
-/* 
-   push a dcerpc_bind into a blob
-*/
-static NTSTATUS dcerpc_push_bind(DATA_BLOB *blob, uint32 *offset,
-				 struct dcerpc_hdr *hdr,
-				 struct dcerpc_bind *pkt)
-{
-	int i, j;
-
-	SSVAL(blob->data, (*offset) + 0, pkt->max_xmit_frag);
-	SSVAL(blob->data, (*offset) + 2, pkt->max_recv_frag);
-	SIVAL(blob->data, (*offset) + 4, pkt->assoc_group_id);
-	SCVAL(blob->data, (*offset) + 8, pkt->num_contexts);
-	(*offset) += 12;
-
-	for (i=0;i<pkt->num_contexts;i++) {
-		NTSTATUS status;
-
-		SSVAL(blob->data, (*offset) + 0, pkt->ctx_list[i].context_id);
-		SCVAL(blob->data, (*offset) + 2, pkt->ctx_list[i].num_transfer_syntaxes);
-		status = push_syntax_id(blob->data + (*offset) + 4, &pkt->ctx_list[i].abstract_syntax);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
-		(*offset) += 24;
-		for (j=0;j<pkt->ctx_list[i].num_transfer_syntaxes;j++) {
-			status = push_syntax_id(blob->data + (*offset), 
-						&pkt->ctx_list[i].transfer_syntaxes[j]);
-			if (!NT_STATUS_IS_OK(status)) {
-				return status;
-			}
-			(*offset) += 20;
-		}
+	ndr = ndr_pull_init_blob(blob, mem_ctx);
+	if (!ndr) {
+		return NT_STATUS_NO_MEMORY;
 	}
 
-	return NT_STATUS_OK;
-}
-
-/* 
-   push a dcerpc_request into a blob
-*/
-static NTSTATUS dcerpc_push_request(DATA_BLOB *blob, uint32 *offset,
-				    struct dcerpc_hdr *hdr,
-				    struct dcerpc_request *pkt)
-{
-	SIVAL(blob->data, (*offset) + 0, pkt->alloc_hint);
-	SSVAL(blob->data, (*offset) + 4, pkt->context_id);
-	SSVAL(blob->data, (*offset) + 6, pkt->opnum);
-
-	(*offset) += 8;
-
-	memcpy(blob->data + (*offset), pkt->stub_data.data, pkt->stub_data.length);
-	(*offset) += pkt->stub_data.length;
-
-	memcpy(blob->data + (*offset), pkt->auth_verifier.data, pkt->auth_verifier.length);
-	(*offset) += pkt->auth_verifier.length;
-
-	return NT_STATUS_OK;
+	return ndr_pull_dcerpc_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
 }
 
 
-/*
-  work out the wire size of a dcerpc packet 
-*/
-static uint32 dcerpc_wire_size(struct dcerpc_packet *pkt)
-{
-	int i;
-	uint32 size = 0;
-
-	size += 16; /* header */
-
-	switch (pkt->hdr.ptype) {
-	case DCERPC_PKT_REQUEST:
-		size += 8;
-		size += pkt->in.request.stub_data.length;
-		size += pkt->in.request.auth_verifier.length;
-		break;
-
-	case DCERPC_PKT_RESPONSE:
-		size += 8;
-		size += pkt->out.response.stub_data.length;
-		size += pkt->hdr.auth_length;
-		break;
-
-	case DCERPC_PKT_BIND:
-		size += 12;
-		for (i=0;i<pkt->in.bind.num_contexts;i++) {
-			size += 24;
-			size += pkt->in.bind.ctx_list[i].num_transfer_syntaxes * 20;
-		}
-		size += pkt->hdr.auth_length;
-		break;
-
-	case DCERPC_PKT_BIND_ACK:
-		size += 10;
-		if (pkt->out.bind_ack.secondary_address) {
-			size += strlen(pkt->out.bind_ack.secondary_address) + 1;
-		}
-		size += 4;
-		size += pkt->out.bind_ack.num_results * 24;
-		size += pkt->hdr.auth_length;
-		break;
-	}
-
-	return size;
-}
-
 /* 
    push a dcerpc_packet into a blob. This handles both input and
    output packets
 */
 NTSTATUS dcerpc_push(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct dcerpc_packet *pkt)
 {
-	uint32 offset = 0;
-	uint32 wire_size;
+	struct ndr_push *ndr;
 	NTSTATUS status;
 
-	/* work out how big the packet will be on the wire */
-	wire_size = dcerpc_wire_size(pkt);
-
-	(*blob) = data_blob_talloc(mem_ctx, NULL, wire_size);
-	if (!blob->data) {
+	ndr = ndr_push_init_ctx(mem_ctx);
+	if (!ndr) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	pkt->hdr.frag_length = wire_size;
-
-	dcerpc_push_hdr(blob->data + offset, &pkt->hdr);
-	offset += 16;
+	status = ndr_push_dcerpc_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
 
-	switch (pkt->hdr.ptype) {
-	case DCERPC_PKT_BIND:
-		status = dcerpc_push_bind(blob, &offset, &pkt->hdr, &pkt->in.bind);
-		break;
+	*blob = ndr_push_blob(ndr);
 
-	case DCERPC_PKT_REQUEST:
-		status = dcerpc_push_request(blob, &offset, &pkt->hdr, &pkt->in.request);
-		break;
-		
-	default:
-		status = NT_STATUS_NET_WRITE_FAULT;
-	}
+	/* fill in the frag length */
+	SSVAL(blob->data, 8, blob->length);
 
 	return status;
 }
 
 
-
-
 /* 
    fill in the fixed values in a dcerpc header 
 */
-static void init_dcerpc_hdr(struct dcerpc_hdr *hdr)
+static void init_dcerpc_hdr(struct dcerpc_packet *pkt)
 {
-        hdr->rpc_vers = 5;
-        hdr->rpc_vers_minor = 0;
-        hdr->drep[0] = 0x10; /* Little endian */
-        hdr->drep[1] = 0;
-        hdr->drep[2] = 0;
-        hdr->drep[3] = 0;
+	pkt->rpc_vers = 5;
+	pkt->rpc_vers_minor = 0;
+	pkt->drep[0] = 0x10; /* Little endian */
+	pkt->drep[1] = 0;
+	pkt->drep[2] = 0;
+	pkt->drep[3] = 0;
 }
 
 
@@ -510,38 +158,39 @@ NTSTATUS dcerpc_bind(struct dcerpc_pipe *p,
 		     const struct dcerpc_syntax_id *transfer_syntax)
 {
 	TALLOC_CTX *mem_ctx;
-        struct dcerpc_packet pkt;
+	struct dcerpc_packet pkt;
 	NTSTATUS status;
 	DATA_BLOB blob;
 	DATA_BLOB blob_out;
+	struct dcerpc_syntax_id tsyntax;
 
 	mem_ctx = talloc_init("dcerpc_bind");
 	if (!mem_ctx) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	init_dcerpc_hdr(&pkt.hdr);
+	init_dcerpc_hdr(&pkt);
 
-	pkt.hdr.ptype = DCERPC_PKT_BIND;
-	pkt.hdr.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
-	pkt.hdr.call_id = p->call_id++;
-	pkt.hdr.auth_length = 0;
+	pkt.ptype = DCERPC_PKT_BIND;
+	pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
+	pkt.call_id = p->call_id++;
+	pkt.auth_length = 0;
 
-        pkt.in.bind.max_xmit_frag = 0x2000;
-        pkt.in.bind.max_recv_frag = 0x2000;
-        pkt.in.bind.assoc_group_id = 0;
-        pkt.in.bind.num_contexts = 1;
-	pkt.in.bind.ctx_list = talloc(mem_ctx, sizeof(pkt.in.bind.ctx_list[0]));
-	if (!pkt.in.bind.ctx_list) {
+	pkt.u.bind.max_xmit_frag = 0x2000;
+	pkt.u.bind.max_recv_frag = 0x2000;
+	pkt.u.bind.assoc_group_id = 0;
+	pkt.u.bind.num_contexts = 1;
+	pkt.u.bind.ctx_list = talloc(mem_ctx, sizeof(pkt.u.bind.ctx_list[0]));
+	if (!pkt.u.bind.ctx_list) {
 		talloc_destroy(mem_ctx);
 		return NT_STATUS_NO_MEMORY;
 	}
-	pkt.in.bind.ctx_list[0].context_id = 0;
-	pkt.in.bind.ctx_list[0].num_transfer_syntaxes = 1;
-	pkt.in.bind.ctx_list[0].abstract_syntax = *syntax;
-	pkt.in.bind.ctx_list[0].transfer_syntaxes = transfer_syntax;
-
-	pkt.in.bind.auth_verifier = data_blob(NULL, 0);
+	pkt.u.bind.ctx_list[0].context_id = 0;
+	pkt.u.bind.ctx_list[0].num_transfer_syntaxes = 1;
+	pkt.u.bind.ctx_list[0].abstract_syntax = *syntax;
+	tsyntax = *transfer_syntax;
+	pkt.u.bind.ctx_list[0].transfer_syntaxes = &tsyntax;
+	pkt.u.bind.auth_verifier = data_blob(NULL, 0);
 
 	status = dcerpc_push(&blob, mem_ctx, &pkt);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -561,14 +210,14 @@ NTSTATUS dcerpc_bind(struct dcerpc_pipe *p,
 		return status;
 	}
 
-	if (pkt.hdr.ptype != DCERPC_PKT_BIND_ACK ||
-	    pkt.out.bind_ack.num_results == 0 ||
-	    pkt.out.bind_ack.ctx_list[0].result != 0) {
+	if (pkt.ptype != DCERPC_PKT_BIND_ACK ||
+	    pkt.u.bind_ack.num_results == 0 ||
+	    pkt.u.bind_ack.ctx_list[0].result != 0) {
 		status = NT_STATUS_UNSUCCESSFUL;
 	}
 
-	p->srv_max_xmit_frag = pkt.out.bind_ack.max_xmit_frag;
-	p->srv_max_recv_frag = pkt.out.bind_ack.max_recv_frag;
+	p->srv_max_xmit_frag = pkt.u.bind_ack.max_xmit_frag;
+	p->srv_max_recv_frag = pkt.u.bind_ack.max_recv_frag;
 
 	talloc_destroy(mem_ctx);
 
@@ -581,11 +230,20 @@ NTSTATUS dcerpc_bind_byuuid(struct dcerpc_pipe *p,
 {
 	struct dcerpc_syntax_id syntax;
 	struct dcerpc_syntax_id transfer_syntax;
+	NTSTATUS status;
 
-	syntax.uuid_str = uuid;
+	status = guid_from_string(uuid, &syntax.uuid);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(2,("Invalid uuid string in dcerpc_bind_byuuid\n"));
+		return status;
+	}
 	syntax.if_version = version;
 
-	transfer_syntax.uuid_str = "8a885d04-1ceb-11c9-9fe8-08002b104860";
+	status = guid_from_string("8a885d04-1ceb-11c9-9fe8-08002b104860", 
+				   &transfer_syntax.uuid);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
 	transfer_syntax.if_version = 2;
 
 	return dcerpc_bind(p, &syntax, &transfer_syntax);
@@ -606,7 +264,7 @@ NTSTATUS dcerpc_request(struct dcerpc_pipe *p,
 	DATA_BLOB blob_in, blob_out, payload;
 	uint32 remaining, chunk_size;
 
-	init_dcerpc_hdr(&pkt.hdr);
+	init_dcerpc_hdr(&pkt);
 
 	remaining = stub_data_in->length;
 
@@ -614,26 +272,25 @@ NTSTATUS dcerpc_request(struct dcerpc_pipe *p,
 	   request header size */
 	chunk_size = p->srv_max_recv_frag - 24;
 
-	pkt.hdr.ptype = DCERPC_PKT_REQUEST;
-	pkt.hdr.call_id = p->call_id++;
-	pkt.hdr.auth_length = 0;
-	pkt.in.request.alloc_hint = remaining;
-	pkt.in.request.context_id = 0;
-	pkt.in.request.opnum = opnum;
-	pkt.in.request.auth_verifier = data_blob(NULL, 0);
+	pkt.ptype = DCERPC_PKT_REQUEST;
+	pkt.call_id = p->call_id++;
+	pkt.auth_length = 0;
+	pkt.u.request.alloc_hint = remaining;
+	pkt.u.request.context_id = 0;
+	pkt.u.request.opnum = opnum;
 
 	/* we send a series of pdus without waiting for a reply until
 	   the last pdu */
 	while (remaining > chunk_size) {
 		if (remaining == stub_data_in->length) {
-			pkt.hdr.pfc_flags = DCERPC_PFC_FLAG_FIRST;
+			pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST;
 		} else {
-			pkt.hdr.pfc_flags = 0;
+			pkt.pfc_flags = 0;
 		}
 
-		pkt.in.request.stub_data.data = stub_data_in->data + 
+		pkt.u.request.stub_and_verifier.data = stub_data_in->data + 
 			(stub_data_in->length - remaining);
-		pkt.in.request.stub_data.length = chunk_size;
+		pkt.u.request.stub_and_verifier.length = chunk_size;
 
 		status = dcerpc_push(&blob_in, mem_ctx, &pkt);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -651,14 +308,14 @@ NTSTATUS dcerpc_request(struct dcerpc_pipe *p,
 	/* now we send a pdu with LAST_FRAG sent and get the first
 	   part of the reply */
 	if (remaining == stub_data_in->length) {
-		pkt.hdr.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
+		pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
 	} else {
-		pkt.hdr.pfc_flags = DCERPC_PFC_FLAG_LAST;
+		pkt.pfc_flags = DCERPC_PFC_FLAG_LAST;
 	}
-	pkt.in.request.stub_data.data = stub_data_in->data + 
+	pkt.u.request.stub_and_verifier.data = stub_data_in->data + 
 		(stub_data_in->length - remaining);
-	pkt.in.request.stub_data.length = remaining;
-	
+	pkt.u.request.stub_and_verifier.length = remaining;
+
 	status = dcerpc_push(&blob_in, mem_ctx, &pkt);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
@@ -672,19 +329,23 @@ NTSTATUS dcerpc_request(struct dcerpc_pipe *p,
 		return status;
 	}
 
-	if (pkt.hdr.ptype != DCERPC_PKT_RESPONSE) {
+	if (pkt.ptype == DCERPC_PKT_FAULT) {
+		return NT_STATUS_NET_WRITE_FAULT;
+	}
+
+	if (pkt.ptype != DCERPC_PKT_RESPONSE) {
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
-	if (!(pkt.hdr.pfc_flags & DCERPC_PFC_FLAG_FIRST)) {
+	if (!(pkt.pfc_flags & DCERPC_PFC_FLAG_FIRST)) {
 		/* something is badly wrong! */
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
-	payload = pkt.out.response.stub_data;
+	payload = pkt.u.response.stub_and_verifier;
 
 	/* continue receiving fragments */
-	while (!(pkt.hdr.pfc_flags & DCERPC_PFC_FLAG_LAST)) {
+	while (!(pkt.pfc_flags & DCERPC_PFC_FLAG_LAST)) {
 		uint32 length;
 
 		status = dcerpc_raw_packet_secondary(p, mem_ctx, &blob_out);
@@ -697,16 +358,16 @@ NTSTATUS dcerpc_request(struct dcerpc_pipe *p,
 			return status;
 		}
 
-		if (pkt.hdr.pfc_flags & DCERPC_PFC_FLAG_FIRST) {
+		if (pkt.pfc_flags & DCERPC_PFC_FLAG_FIRST) {
 			/* start of another packet!? */
 			return NT_STATUS_UNSUCCESSFUL;
 		}
 
-		if (pkt.hdr.ptype != DCERPC_PKT_RESPONSE) {
+		if (pkt.ptype != DCERPC_PKT_RESPONSE) {
 			return NT_STATUS_UNSUCCESSFUL;
 		}
 
-		length = pkt.out.response.stub_data.length;
+		length = pkt.u.response.stub_and_verifier.length;
 
 		payload.data = talloc_realloc(mem_ctx, 
 					      payload.data, 
@@ -716,7 +377,7 @@ NTSTATUS dcerpc_request(struct dcerpc_pipe *p,
 		}
 
 		memcpy(payload.data + payload.length,
-		       pkt.out.response.stub_data.data,
+		       pkt.u.response.stub_and_verifier.data,
 		       length);
 
 		payload.length += length;