path: root/source3/rpc_client/cli_pipe.c

/* 
 *  Unix SMB/CIFS implementation.
 *  RPC Pipe client / server routines
 *  Largely rewritten by Jeremy Allison		    2005.
 *  
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 3 of the License, or
 *  (at your option) any later version.
 *  
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *  
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
 */

#include "includes.h"
#include "librpc/gen_ndr/cli_epmapper.h"
#include "../librpc/gen_ndr/ndr_schannel.h"
#include "../librpc/gen_ndr/ndr_dssetup.h"
#include "../librpc/gen_ndr/ndr_netlogon.h"
#include "../libcli/auth/schannel.h"
#include "../libcli/auth/spnego.h"
#include "smb_krb5.h"
#include "../libcli/auth/ntlmssp.h"
#include "rpc_client/cli_netlogon.h"
#include "librpc/gen_ndr/ndr_dcerpc.h"
#include "librpc/rpc/dcerpc.h"

#undef DBGC_CLASS
#define DBGC_CLASS DBGC_RPC_CLI

/********************************************************************
 Pipe description for a DEBUG
 ********************************************************************/
static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
				   struct rpc_pipe_client *cli)
{
	char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
	if (result == NULL) {
		return "pipe";
	}
	return result;
}

/********************************************************************
 Rpc pipe call id.
 ********************************************************************/

static uint32 get_rpc_call_id(void)
{
	static uint32 call_id = 0;
	return ++call_id;
}

/*******************************************************************
 Use SMBreadX to get rest of one fragment's worth of rpc data.
 Reads the whole size or give an error message
 ********************************************************************/

struct rpc_read_state {
	struct event_context *ev;
	struct rpc_cli_transport *transport;
	uint8_t *data;
	size_t size;
	size_t num_read;
};

static void rpc_read_done(struct tevent_req *subreq);

static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
					struct event_context *ev,
					struct rpc_cli_transport *transport,
					uint8_t *data, size_t size)
{
	struct tevent_req *req, *subreq;
	struct rpc_read_state *state;

	req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
	if (req == NULL) {
		return NULL;
	}
	state->ev = ev;
	state->transport = transport;
	state->data = data;
	state->size = size;
	state->num_read = 0;

	DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));

	subreq = transport->read_send(state, ev, (uint8_t *)data, size,
				      transport->priv);
	if (subreq == NULL) {
		goto fail;
	}
	tevent_req_set_callback(subreq, rpc_read_done, req);
	return req;

 fail:
	TALLOC_FREE(req);
	return NULL;
}

static void rpc_read_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct rpc_read_state *state = tevent_req_data(
		req, struct rpc_read_state);
	NTSTATUS status;
	ssize_t received;

	status = state->transport->read_recv(subreq, &received);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}

	state->num_read += received;
	if (state->num_read == state->size) {
		tevent_req_done(req);
		return;
	}

	subreq = state->transport->read_send(state, state->ev,
					     state->data + state->num_read,
					     state->size - state->num_read,
					     state->transport->priv);
	if (tevent_req_nomem(subreq, req)) {
		return;
	}
	tevent_req_set_callback(subreq, rpc_read_done, req);
}

static NTSTATUS rpc_read_recv(struct tevent_req *req)
{
	return tevent_req_simple_recv_ntstatus(req);
}

struct rpc_write_state {
	struct event_context *ev;
	struct rpc_cli_transport *transport;
	const uint8_t *data;
	size_t size;
	size_t num_written;
};

static void rpc_write_done(struct tevent_req *subreq);

static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
					 struct event_context *ev,
					 struct rpc_cli_transport *transport,
					 const uint8_t *data, size_t size)
{
	struct tevent_req *req, *subreq;
	struct rpc_write_state *state;

	req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
	if (req == NULL) {
		return NULL;
	}
	state->ev = ev;
	state->transport = transport;
	state->data = data;
	state->size = size;
	state->num_written = 0;

	DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));

	subreq = transport->write_send(state, ev, data, size, transport->priv);
	if (subreq == NULL) {
		goto fail;
	}
	tevent_req_set_callback(subreq, rpc_write_done, req);
	return req;
 fail:
	TALLOC_FREE(req);
	return NULL;
}

static void rpc_write_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct rpc_write_state *state = tevent_req_data(
		req, struct rpc_write_state);
	NTSTATUS status;
	ssize_t written;

	status = state->transport->write_recv(subreq, &written);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}

	state->num_written += written;

	if (state->num_written == state->size) {
		tevent_req_done(req);
		return;
	}

	subreq = state->transport->write_send(state, state->ev,
					      state->data + state->num_written,
					      state->size - state->num_written,
					      state->transport->priv);
	if (tevent_req_nomem(subreq, req)) {
		return;
	}
	tevent_req_set_callback(subreq, rpc_write_done, req);
}

static NTSTATUS rpc_write_recv(struct tevent_req *req)
{
	return tevent_req_simple_recv_ntstatus(req);
}


/****************************************************************************
 Try and get a PDU's worth of data from current_pdu. If not, then read more
 from the wire.
 ****************************************************************************/

struct get_complete_frag_state {
	struct event_context *ev;
	struct rpc_pipe_client *cli;
	uint16_t frag_len;
	DATA_BLOB *pdu;
};

static void get_complete_frag_got_header(struct tevent_req *subreq);
static void get_complete_frag_got_rest(struct tevent_req *subreq);

static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
						 struct event_context *ev,
						 struct rpc_pipe_client *cli,
						 DATA_BLOB *pdu)
{
	struct tevent_req *req, *subreq;
	struct get_complete_frag_state *state;
	size_t received;
	NTSTATUS status;

	req = tevent_req_create(mem_ctx, &state,
				struct get_complete_frag_state);
	if (req == NULL) {
		return NULL;
	}
	state->ev = ev;
	state->cli = cli;
	state->frag_len = RPC_HEADER_LEN;
	state->pdu = pdu;

	received = pdu->length;
	if (received < RPC_HEADER_LEN) {
		if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
			status = NT_STATUS_NO_MEMORY;
			goto post_status;
		}
		subreq = rpc_read_send(state, state->ev,
					state->cli->transport,
					pdu->data + received,
					RPC_HEADER_LEN - received);
		if (subreq == NULL) {
			status = NT_STATUS_NO_MEMORY;
			goto post_status;
		}
		tevent_req_set_callback(subreq, get_complete_frag_got_header,
					req);
		return req;
	}

	state->frag_len = dcerpc_get_frag_length(pdu);

	/*
	 * Ensure we have frag_len bytes of data.
	 */
	if (received < state->frag_len) {
		if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
			status = NT_STATUS_NO_MEMORY;
			goto post_status;
		}
		subreq = rpc_read_send(state, state->ev,
					state->cli->transport,
					pdu->data + received,
					state->frag_len - received);
		if (subreq == NULL) {
			status = NT_STATUS_NO_MEMORY;
			goto post_status;
		}
		tevent_req_set_callback(subreq, get_complete_frag_got_rest,
					req);
		return req;
	}

	status = NT_STATUS_OK;
 post_status:
	if (NT_STATUS_IS_OK(status)) {
		tevent_req_done(req);
	} else {
		tevent_req_nterror(req, status);
	}
	return tevent_req_post(req, ev);
}

static void get_complete_frag_got_header(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct get_complete_frag_state *state = tevent_req_data(
		req, struct get_complete_frag_state);
	NTSTATUS status;

	status = rpc_read_recv(subreq);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}

	state->frag_len = dcerpc_get_frag_length(state->pdu);

	if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
		tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
		return;
	}

	/*
	 * We're here in this piece of code because we've read exactly
	 * RPC_HEADER_LEN bytes into state->pdu.
	 */

	subreq = rpc_read_send(state, state->ev, state->cli->transport,
				state->pdu->data + RPC_HEADER_LEN,
				state->frag_len - RPC_HEADER_LEN);
	if (tevent_req_nomem(subreq, req)) {
		return;
	}
	tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
}

static void get_complete_frag_got_rest(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	NTSTATUS status;

	status = rpc_read_recv(subreq);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}
	tevent_req_done(req);
}

static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
{
	return tevent_req_simple_recv_ntstatus(req);
}

/****************************************************************************
 NTLMSSP specific sign/seal.
 Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
 In fact I should probably abstract these into identical pieces of code... JRA.
 ****************************************************************************/

static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli,
					struct ncacn_packet *pkt,
					DATA_BLOB *pdu,
					uint8 *p_ss_padding_len)
{
	struct dcerpc_auth auth_info;
	DATA_BLOB blob;
	NTSTATUS status;

	if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
	    || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
		return NT_STATUS_OK;
	}

	if (!cli->auth->a_u.ntlmssp_state) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* Ensure there's enough data for an authenticated response. */
	if ((pkt->auth_length > RPC_MAX_PDU_FRAG_LEN) ||
	    (pkt->frag_length < DCERPC_RESPONSE_LENGTH
				+ DCERPC_AUTH_TRAILER_LENGTH
				+ pkt->auth_length)) {
		DEBUG(0, ("auth_len %u is too long.\n",
			  (unsigned int)pkt->auth_length));
		return NT_STATUS_BUFFER_TOO_SMALL;
	}

	/* get the auth blob at the end of the packet */
	blob = data_blob_const(pdu->data + pkt->frag_length
				- DCERPC_AUTH_TRAILER_LENGTH
				- pkt->auth_length,
			       DCERPC_AUTH_TRAILER_LENGTH
				+ pkt->auth_length);

	status = dcerpc_pull_dcerpc_auth(cli, &blob, &auth_info, false);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall dcerpc_auth.\n"));
		return status;
	}

	/* Ensure auth_pad_len fits into the packet. */
	if (pkt->frag_length < DCERPC_RESPONSE_LENGTH
				+ auth_info.auth_pad_length
				+ DCERPC_AUTH_TRAILER_LENGTH
				+ pkt->auth_length) {
		DEBUG(0,("cli_pipe_verify_ntlmssp: auth_info.auth_pad_len "
			"too large (%u), auth_len (%u), frag_len = (%u).\n",
			(unsigned int)auth_info.auth_pad_length,
			(unsigned int)pkt->auth_length,
			(unsigned int)pkt->frag_length));
		return NT_STATUS_BUFFER_TOO_SMALL;
	}

	/*
	 * We need the full packet data + length (minus auth stuff) as well as the packet data + length
	 * after the RPC header.
	 * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
	 * functions as NTLMv2 checks the rpc headers also.
	 */

	switch (cli->auth->auth_level) {
	case DCERPC_AUTH_LEVEL_PRIVACY:
		/* Data is encrypted. */
		status = ntlmssp_unseal_packet(
					cli->auth->a_u.ntlmssp_state,
					pdu->data + DCERPC_RESPONSE_LENGTH,
					pkt->frag_length
						- DCERPC_RESPONSE_LENGTH
						- DCERPC_AUTH_TRAILER_LENGTH
						- pkt->auth_length,
					pdu->data,
					pkt->frag_length - pkt->auth_length,
					&auth_info.credentials);
		if (!NT_STATUS_IS_OK(status)) {
			DEBUG(0, ("failed to unseal packet from %s."
				  " Error was %s.\n",
				  rpccli_pipe_txt(talloc_tos(), cli),
				  nt_errstr(status)));
			return status;
		}
		break;

	case DCERPC_AUTH_LEVEL_INTEGRITY:
		/* Data is signed. */
		status = ntlmssp_check_packet(
					cli->auth->a_u.ntlmssp_state,
					pdu->data + DCERPC_RESPONSE_LENGTH,
					pkt->frag_length
						- DCERPC_RESPONSE_LENGTH
						- DCERPC_AUTH_TRAILER_LENGTH
						- pkt->auth_length,
					pdu->data,
					pkt->frag_length - pkt->auth_length,
					&auth_info.credentials);
		if (!NT_STATUS_IS_OK(status)) {
			DEBUG(0, ("check signing failed on packet from %s."
				  " Error was %s.\n",
				  rpccli_pipe_txt(talloc_tos(), cli),
				  nt_errstr(status)));
			return status;
		}
		break;

	default:
		DEBUG(0, ("cli_pipe_verify_ntlmssp: unknown internal "
			  "auth level %d\n", cli->auth->auth_level));
		return NT_STATUS_INVALID_INFO_CLASS;
	}

	/*
	 * Remember the padding length. We must remove it from the real data
	 * stream once the sign/seal is done.
	 */

	*p_ss_padding_len = auth_info.auth_pad_length;

	return NT_STATUS_OK;
}

/****************************************************************************
 schannel specific sign/seal.
 ****************************************************************************/

static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli,
					 struct ncacn_packet *pkt,
					 DATA_BLOB *pdu,
					 uint8 *p_ss_padding_len)
{
	struct dcerpc_auth auth_info;
	DATA_BLOB blob;
	NTSTATUS status;

	if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
	    || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
		return NT_STATUS_OK;
	}

	if (pkt->auth_length < NL_AUTH_SIGNATURE_SIZE) {
		DEBUG(0, ("auth_len %u.\n", (unsigned int)pkt->auth_length));
		return NT_STATUS_INVALID_PARAMETER;
	}

	if (!cli->auth->a_u.schannel_auth) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* Ensure there's enough data for an authenticated response. */
	if ((pkt->auth_length > RPC_MAX_PDU_FRAG_LEN) ||
	    (pkt->frag_length < DCERPC_RESPONSE_LENGTH
				+ DCERPC_AUTH_TRAILER_LENGTH
				+ pkt->auth_length)) {
		DEBUG(0, ("auth_len %u is too long.\n",
			  (unsigned int)pkt->auth_length));
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* get the auth blob at the end of the packet */
	blob = data_blob_const(pdu->data + pkt->frag_length
				- DCERPC_AUTH_TRAILER_LENGTH
				- pkt->auth_length,
			       DCERPC_AUTH_TRAILER_LENGTH
				+ pkt->auth_length);


	status = dcerpc_pull_dcerpc_auth(cli, &blob, &auth_info, false);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall dcerpc_auth.\n"));
		return status;
	}

	/* Ensure auth_pad_len fits into the packet. */
	if (pkt->frag_length < DCERPC_RESPONSE_LENGTH
				+ auth_info.auth_pad_length
				+ DCERPC_AUTH_TRAILER_LENGTH
				+ pkt->auth_length) {
		DEBUG(0,("cli_pipe_verify_schannel: auth_info.auth_pad_len "
			"too large (%u), auth_len (%u), frag_len = (%u).\n",
			(unsigned int)auth_info.auth_pad_length,
			(unsigned int)pkt->auth_length,
			(unsigned int)pkt->frag_length));
		return NT_STATUS_BUFFER_TOO_SMALL;
	}

	if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
		DEBUG(0, ("Invalid auth info %d on schannel\n",
			  auth_info.auth_type));
		return NT_STATUS_BUFFER_TOO_SMALL;
	}

	if (DEBUGLEVEL >= 10) {
		dump_NL_AUTH_SIGNATURE(talloc_tos(), &auth_info.credentials);
	}

	switch (cli->auth->auth_level) {
	case DCERPC_AUTH_LEVEL_PRIVACY:
		status = netsec_incoming_packet(
					cli->auth->a_u.schannel_auth,
					talloc_tos(),
					true,
					pdu->data + DCERPC_RESPONSE_LENGTH,
					pkt->frag_length
						- DCERPC_RESPONSE_LENGTH
						- DCERPC_AUTH_TRAILER_LENGTH
						- pkt->auth_length,
					&auth_info.credentials);
		break;
	case DCERPC_AUTH_LEVEL_INTEGRITY:
		status = netsec_incoming_packet(
					cli->auth->a_u.schannel_auth,
					talloc_tos(),
					false,
					pdu->data + DCERPC_RESPONSE_LENGTH,
					pkt->frag_length
						- DCERPC_RESPONSE_LENGTH
						- DCERPC_AUTH_TRAILER_LENGTH
						- pkt->auth_length,
					&auth_info.credentials);
		break;
	default:
		status = NT_STATUS_INTERNAL_ERROR;
		break;
	}

	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
				"Connection to %s (%s).\n",
				rpccli_pipe_txt(talloc_tos(), cli),
				nt_errstr(status)));
		return NT_STATUS_INVALID_PARAMETER;
	}

	/*
	 * Remember the padding length. We must remove it from the real data
	 * stream once the sign/seal is done.
	 */

	*p_ss_padding_len = auth_info.auth_pad_length;

	return NT_STATUS_OK;
}

/****************************************************************************
 Do the authentication checks on an incoming pdu. Check sign and unseal etc.
 ****************************************************************************/

static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli,
						struct ncacn_packet *pkt,
						DATA_BLOB *pdu,
						uint8 *p_ss_padding_len)
{
	NTSTATUS ret = NT_STATUS_OK;

	/* Paranioa checks for auth_len. */
	if (pkt->auth_length) {
		if (pkt->auth_length > pkt->frag_length) {
			return NT_STATUS_INVALID_PARAMETER;
		}

		if ((pkt->auth_length
		     + (unsigned int)DCERPC_AUTH_TRAILER_LENGTH
						< pkt->auth_length) ||
		    (pkt->auth_length
		     + (unsigned int)DCERPC_AUTH_TRAILER_LENGTH
			< (unsigned int)DCERPC_AUTH_TRAILER_LENGTH)) {
			/* Integer wrap attempt. */
			return NT_STATUS_INVALID_PARAMETER;
		}
	}

	/*
	 * Now we have a complete RPC request PDU fragment, try and verify any auth data.
	 */

	switch(cli->auth->auth_type) {
	case PIPE_AUTH_TYPE_NONE:
		if (pkt->auth_length) {
			DEBUG(3, ("cli_pipe_validate_rpc_response: "
				  "Connection to %s - got non-zero "
				  "auth len %u.\n",
				rpccli_pipe_txt(talloc_tos(), cli),
				(unsigned int)pkt->auth_length));
			return NT_STATUS_INVALID_PARAMETER;
		}
		break;

	case PIPE_AUTH_TYPE_NTLMSSP:
	case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
		ret = cli_pipe_verify_ntlmssp(cli, pkt, pdu,
						p_ss_padding_len);
		if (!NT_STATUS_IS_OK(ret)) {
			return ret;
		}
		break;

	case PIPE_AUTH_TYPE_SCHANNEL:
		ret = cli_pipe_verify_schannel(cli, pkt, pdu,
						p_ss_padding_len);
		if (!NT_STATUS_IS_OK(ret)) {
			return ret;
		}
		break;

	case PIPE_AUTH_TYPE_KRB5:
	case PIPE_AUTH_TYPE_SPNEGO_KRB5:
	default:
		DEBUG(3, ("cli_pipe_validate_rpc_response: Connection "
			  "to %s - unknown internal auth type %u.\n",
			  rpccli_pipe_txt(talloc_tos(), cli),
			  cli->auth->auth_type ));
		return NT_STATUS_INVALID_INFO_CLASS;
	}

	return NT_STATUS_OK;
}

/****************************************************************************
 Do basic authentication checks on an incoming pdu.
 ****************************************************************************/

static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
						struct rpc_pipe_client *cli,
						struct ncacn_packet *pkt,
						DATA_BLOB *pdu,
						uint8_t expected_pkt_type,
						DATA_BLOB *rdata,
						DATA_BLOB *reply_pdu)
{
	NTSTATUS ret = NT_STATUS_OK;
	uint8 ss_padding_len = 0;

	ret = dcerpc_pull_ncacn_packet(cli, pdu, pkt, false);
	if (!NT_STATUS_IS_OK(ret)) {
		return ret;
	}

	if (pdu->length != pkt->frag_length) {
		DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
			  (unsigned int)pdu->length,
			  (unsigned int)pkt->frag_length));
		return NT_STATUS_INVALID_PARAMETER;
	}

	/*
	 * Point the return values at the real data including the RPC
	 * header. Just in case the caller wants it.
	 */
	*rdata = *pdu;

	/* Ensure we have the correct type. */
	switch (pkt->ptype) {
	case DCERPC_PKT_ALTER_RESP:
	case DCERPC_PKT_BIND_ACK:

		/* Alter context and bind ack share the same packet definitions. */
		break;


	case DCERPC_PKT_RESPONSE:

		/* Here's where we deal with incoming sign/seal. */
		ret = cli_pipe_validate_rpc_response(cli, pkt, pdu,
						     &ss_padding_len);
		if (!NT_STATUS_IS_OK(ret)) {
			return ret;
		}

		/* Point the return values at the NDR data.
		 * Remember to remove any ss padding. */
		rdata->data = pdu->data + DCERPC_RESPONSE_LENGTH;

		if (pdu->length < DCERPC_RESPONSE_LENGTH + ss_padding_len) {
			return NT_STATUS_BUFFER_TOO_SMALL;
		}

		rdata->length = pdu->length
					- DCERPC_RESPONSE_LENGTH
					- ss_padding_len;

		/* Remember to remove the auth footer. */
		if (pkt->auth_length) {
			/* We've already done integer wrap tests on auth_len in
				cli_pipe_validate_rpc_response(). */
			if (rdata->length < DCERPC_AUTH_TRAILER_LENGTH
							+ pkt->auth_length) {
				return NT_STATUS_BUFFER_TOO_SMALL;
			}
			rdata->length -= (DCERPC_AUTH_TRAILER_LENGTH
							+ pkt->auth_length);
		}

		DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
			   (long unsigned int)pdu->length,
			   (long unsigned int)rdata->length,
			   (unsigned int)ss_padding_len));

		/*
		 * If this is the first reply, and the allocation hint is
		 * reasonable, try and set up the reply_pdu DATA_BLOB to the
		 * correct size.
		 */

		if ((reply_pdu->length == 0) &&
		    pkt->u.response.alloc_hint &&
		    (pkt->u.response.alloc_hint < 15*1024*1024)) {
			if (!data_blob_realloc(mem_ctx, reply_pdu,
						pkt->u.response.alloc_hint)) {
				DEBUG(0, ("reply alloc hint %d too "
					  "large to allocate\n",
				    (int)pkt->u.response.alloc_hint));
				return NT_STATUS_NO_MEMORY;
			}
		}

		break;

	case DCERPC_PKT_BIND_NAK:
		DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
			  "received from %s!\n",
			  rpccli_pipe_txt(talloc_tos(), cli)));
		/* Use this for now... */
		return NT_STATUS_NETWORK_ACCESS_DENIED;

	case DCERPC_PKT_FAULT:

		DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
			  "code %s received from %s!\n",
			  dcerpc_errstr(talloc_tos(),
			  pkt->u.fault.status),
			rpccli_pipe_txt(talloc_tos(), cli)));

		if (NT_STATUS_IS_OK(NT_STATUS(pkt->u.fault.status))) {
			return NT_STATUS_UNSUCCESSFUL;
		} else {
			return NT_STATUS(pkt->u.fault.status);
		}

	default:
		DEBUG(0, ("Unknown packet type %u received from %s!\n",
			(unsigned int)pkt->ptype,
			rpccli_pipe_txt(talloc_tos(), cli)));
		return NT_STATUS_INVALID_INFO_CLASS;
	}

	if (pkt->ptype != expected_pkt_type) {
		DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
			  "got an unexpected RPC packet type - %u, not %u\n",
			rpccli_pipe_txt(talloc_tos(), cli),
			pkt->ptype,
			expected_pkt_type));
		return NT_STATUS_INVALID_INFO_CLASS;
	}

	/* Do this just before return - we don't want to modify any rpc header
	   data before now as we may have needed to do cryptographic actions on
	   it before. */

	if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
	    !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
		DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
			"setting fragment first/last ON.\n"));
		pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST |
					DCERPC_PFC_FLAG_LAST;
	}

	return NT_STATUS_OK;
}

/****************************************************************************
 Call a remote api on an arbitrary pipe.  takes param, data and setup buffers.
****************************************************************************/

struct cli_api_pipe_state {
	struct event_context *ev;
	struct rpc_cli_transport *transport;
	uint8_t *rdata;
	uint32_t rdata_len;
};

static void cli_api_pipe_trans_done(struct tevent_req *subreq);
static void cli_api_pipe_write_done(struct tevent_req *subreq);
static void cli_api_pipe_read_done(struct tevent_req *subreq);

static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
					    struct event_context *ev,
					    struct rpc_cli_transport *transport,
					    uint8_t *data, size_t data_len,
					    uint32_t max_rdata_len)
{
	struct tevent_req *req, *subreq;
	struct cli_api_pipe_state *state;
	NTSTATUS status;

	req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
	if (req == NULL) {
		return NULL;
	}
	state->ev = ev;
	state->transport = transport;

	if (max_rdata_len < RPC_HEADER_LEN) {
		/*
		 * For a RPC reply we always need at least RPC_HEADER_LEN
		 * bytes. We check this here because we will receive
		 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
		 */
		status = NT_STATUS_INVALID_PARAMETER;
		goto post_status;
	}

	if (transport->trans_send != NULL) {
		subreq = transport->trans_send(state, ev, data, data_len,
					       max_rdata_len, transport->priv);
		if (subreq == NULL) {
			goto fail;
		}
		tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
		return req;
	}

	/*
	 * If the transport does not provide a "trans" routine, i.e. for
	 * example the ncacn_ip_tcp transport, do the write/read step here.
	 */

	subreq = rpc_write_send(state, ev, transport, data, data_len);
	if (subreq == NULL) {
		goto fail;
	}
	tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
	return req;

 post_status:
	tevent_req_nterror(req, status);
	return tevent_req_post(req, ev);
 fail:
	TALLOC_FREE(req);
	return NULL;
}

static void cli_api_pipe_trans_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct cli_api_pipe_state *state = tevent_req_data(
		req, struct cli_api_pipe_state);
	NTSTATUS status;

	status = state->transport->trans_recv(subreq, state, &state->rdata,
					      &state->rdata_len);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}
	tevent_req_done(req);
}

static void cli_api_pipe_write_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct cli_api_pipe_state *state = tevent_req_data(
		req, struct cli_api_pipe_state);
	NTSTATUS status;

	status = rpc_write_recv(subreq);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}

	state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
	if (tevent_req_nomem(state->rdata, req)) {
		return;
	}

	/*
	 * We don't need to use rpc_read_send here, the upper layer will cope
	 * with a short read, transport->trans_send could also return less
	 * than state->max_rdata_len.
	 */
	subreq = state->transport->read_send(state, state->ev, state->rdata,
					     RPC_HEADER_LEN,
					     state->transport->priv);
	if (tevent_req_nomem(subreq, req)) {
		return;
	}
	tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
}

static void cli_api_pipe_read_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct cli_api_pipe_state *state = tevent_req_data(
		req, struct cli_api_pipe_state);
	NTSTATUS status;
	ssize_t received;

	status = state->transport->read_recv(subreq, &received);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}
	state->rdata_len = received;
	tevent_req_done(req);
}

static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
				  uint8_t **prdata, uint32_t *prdata_len)
{
	struct cli_api_pipe_state *state = tevent_req_data(
		req, struct cli_api_pipe_state);
	NTSTATUS status;

	if (tevent_req_is_nterror(req, &status)) {
		return status;
	}

	*prdata = talloc_move(mem_ctx, &state->rdata);
	*prdata_len = state->rdata_len;
	return NT_STATUS_OK;
}

/****************************************************************************
 Send data on an rpc pipe via trans. The data must be the last
 pdu fragment of an NDR data stream.

 Receive response data from an rpc pipe, which may be large...

 Read the first fragment: unfortunately have to use SMBtrans for the first
 bit, then SMBreadX for subsequent bits.

 If first fragment received also wasn't the last fragment, continue
 getting fragments until we _do_ receive the last fragment.

 Request/Response PDU's look like the following...

 |<------------------PDU len----------------------------------------------->|
 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|

 +------------+-----------------+-------------+---------------+-------------+
 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 +------------+-----------------+-------------+---------------+-------------+

 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
 signing & sealing being negotiated.

 ****************************************************************************/

struct rpc_api_pipe_state {
	struct event_context *ev;
	struct rpc_pipe_client *cli;
	uint8_t expected_pkt_type;

	DATA_BLOB incoming_frag;
	struct ncacn_packet *pkt;

	/* Incoming reply */
	DATA_BLOB reply_pdu;
	size_t reply_pdu_offset;
	uint8_t endianess;
};

static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);

static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
					    struct event_context *ev,
					    struct rpc_pipe_client *cli,
					    DATA_BLOB *data, /* Outgoing PDU */
					    uint8_t expected_pkt_type)
{
	struct tevent_req *req, *subreq;
	struct rpc_api_pipe_state *state;
	uint16_t max_recv_frag;
	NTSTATUS status;

	req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
	if (req == NULL) {
		return NULL;
	}
	state->ev = ev;
	state->cli = cli;
	state->expected_pkt_type = expected_pkt_type;
	state->incoming_frag = data_blob_null;
	state->reply_pdu = data_blob_null;
	state->reply_pdu_offset = 0;
	state->endianess = DCERPC_DREP_LE;

	/*
	 * Ensure we're not sending too much.
	 */
	if (data->length > cli->max_xmit_frag) {
		status = NT_STATUS_INVALID_PARAMETER;
		goto post_status;
	}

	DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));

	/* get the header first, then fetch the rest once we have
	 * the frag_length available */
	max_recv_frag = RPC_HEADER_LEN;

	subreq = cli_api_pipe_send(state, ev, cli->transport,
				   data->data, data->length, max_recv_frag);
	if (subreq == NULL) {
		goto fail;
	}
	tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
	return req;

 post_status:
	tevent_req_nterror(req, status);
	return tevent_req_post(req, ev);
 fail:
	TALLOC_FREE(req);
	return NULL;
}

static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct rpc_api_pipe_state *state = tevent_req_data(
		req, struct rpc_api_pipe_state);
	NTSTATUS status;
	uint8_t *rdata = NULL;
	uint32_t rdata_len = 0;

	status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
		tevent_req_nterror(req, status);
		return;
	}

	if (rdata == NULL) {
		DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
			 rpccli_pipe_txt(talloc_tos(), state->cli)));
		tevent_req_done(req);
		return;
	}

	/*
	 * Move data on state->incoming_frag.
	 */
	state->incoming_frag.data = talloc_move(state, &rdata);
	state->incoming_frag.length = rdata_len;
	if (!state->incoming_frag.data) {
		tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
		return;
	}

	/* Ensure we have enough data for a pdu. */
	subreq = get_complete_frag_send(state, state->ev, state->cli,
					&state->incoming_frag);
	if (tevent_req_nomem(subreq, req)) {
		return;
	}
	tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
}

static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct rpc_api_pipe_state *state = tevent_req_data(
		req, struct rpc_api_pipe_state);
	NTSTATUS status;
	DATA_BLOB rdata = data_blob_null;

	status = get_complete_frag_recv(subreq);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(5, ("get_complete_frag failed: %s\n",
			  nt_errstr(status)));
		tevent_req_nterror(req, status);
		return;
	}

	state->pkt = talloc(state, struct ncacn_packet);
	if (!state->pkt) {
		tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
		return;
	}

	status = cli_pipe_validate_current_pdu(state,
						state->cli, state->pkt,
						&state->incoming_frag,
						state->expected_pkt_type,
						&rdata,
						&state->reply_pdu);

	DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
		  (unsigned)state->incoming_frag.length,
		  (unsigned)state->reply_pdu_offset,
		  nt_errstr(status)));

	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}

	if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
	    && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
		/*
		 * Set the data type correctly for big-endian data on the
		 * first packet.
		 */
		DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
			  "big-endian.\n",
			  rpccli_pipe_txt(talloc_tos(), state->cli)));
		state->endianess = 0x00; /* BIG ENDIAN */
	}
	/*
	 * Check endianness on subsequent packets.
	 */
	if (state->endianess != state->pkt->drep[0]) {
		DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
			 "%s\n",
			 state->endianess?"little":"big",
			 state->pkt->drep[0]?"little":"big"));
		tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
		return;
	}

	/* Now copy the data portion out of the pdu into rbuf. */
	if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
		if (!data_blob_realloc(NULL, &state->reply_pdu,
				state->reply_pdu_offset + rdata.length)) {
			tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
			return;
		}
	}

	memcpy(state->reply_pdu.data + state->reply_pdu_offset,
		rdata.data, rdata.length);
	state->reply_pdu_offset += rdata.length;

	/* reset state->incoming_frag, there is no need to free it,
	 * it will be reallocated to the right size the next time
	 * it is used */
	state->incoming_frag.length = 0;

	if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
		/* make sure the pdu length is right now that we
		 * have all the data available (alloc hint may
		 * have allocated more than was actually used) */
		state->reply_pdu.length = state->reply_pdu_offset;
		DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
			  rpccli_pipe_txt(talloc_tos(), state->cli),
			  (unsigned)state->reply_pdu.length));
		tevent_req_done(req);
		return;
	}

	subreq = get_complete_frag_send(state, state->ev, state->cli,
					&state->incoming_frag);
	if (tevent_req_nomem(subreq, req)) {
		return;
	}
	tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
}

static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
				  struct ncacn_packet **pkt,
				  DATA_BLOB *reply_pdu)
{
	struct rpc_api_pipe_state *state = tevent_req_data(
		req, struct rpc_api_pipe_state);
	NTSTATUS status;

	if (tevent_req_is_nterror(req, &status)) {
		return status;
	}

	/* return data to caller and assign it ownership of memory */
	if (reply_pdu) {
		reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
		reply_pdu->length = state->reply_pdu.length;
		state->reply_pdu.length = 0;
	} else {
		data_blob_free(&state->reply_pdu);
	}

	if (pkt) {
		*pkt = talloc_steal(mem_ctx, state->pkt);
	}

	return NT_STATUS_OK;
}

/*******************************************************************
 Creates krb5 auth bind.
 ********************************************************************/

static NTSTATUS create_krb5_auth_bind_req(struct rpc_pipe_client *cli,
					  enum dcerpc_AuthLevel auth_level,
					  DATA_BLOB *auth_info)
{
#ifdef HAVE_KRB5
	int ret;
	NTSTATUS status;
	struct kerberos_auth_struct *a = cli->auth->a_u.kerberos_auth;
	DATA_BLOB tkt = data_blob_null;
	DATA_BLOB tkt_wrapped = data_blob_null;

	DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
		a->service_principal ));

	/* Create the ticket for the service principal and return it in a gss-api wrapped blob. */

	ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
			&a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL, NULL);

	if (ret) {
		DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
			"failed with %s\n",
			a->service_principal,
			error_message(ret) ));

		data_blob_free(&tkt);
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* wrap that up in a nice GSS-API wrapping */
	tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);

	data_blob_free(&tkt);

	status = dcerpc_push_dcerpc_auth(cli,
					 DCERPC_AUTH_TYPE_KRB5,
					 auth_level,
					 0, /* auth_pad_length */
					 1, /* auth_context_id */
					 &tkt_wrapped,
					 auth_info);
	if (!NT_STATUS_IS_OK(status)) {
		data_blob_free(&tkt_wrapped);
		return status;
	}

	DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
	dump_data(5, tkt_wrapped.data, tkt_wrapped.length);

	return NT_STATUS_OK;
#else
	return NT_STATUS_INVALID_PARAMETER;
#endif
}

/*******************************************************************
 Creates SPNEGO NTLMSSP auth bind.
 ********************************************************************/

static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
							enum dcerpc_AuthLevel auth_level,
							DATA_BLOB *auth_info)
{
	NTSTATUS status;
	DATA_BLOB null_blob = data_blob_null;
	DATA_BLOB request = data_blob_null;
	DATA_BLOB spnego_msg = data_blob_null;

	DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
	status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
					null_blob,
					&request);

	if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
		data_blob_free(&request);
		return status;
	}

	/* Wrap this in SPNEGO. */
	spnego_msg = gen_negTokenInit(OID_NTLMSSP, request);

	data_blob_free(&request);

	status = dcerpc_push_dcerpc_auth(cli,
					 DCERPC_AUTH_TYPE_SPNEGO,
					 auth_level,
					 0, /* auth_pad_length */
					 1, /* auth_context_id */
					 &spnego_msg,
					 auth_info);
	if (!NT_STATUS_IS_OK(status)) {
		data_blob_free(&spnego_msg);
		return status;
	}

	DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
	dump_data(5, spnego_msg.data, spnego_msg.length);

	return NT_STATUS_OK;
}

/*******************************************************************
 Creates NTLMSSP auth bind.
 ********************************************************************/

static NTSTATUS create_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
						 enum dcerpc_AuthLevel auth_level,
						 DATA_BLOB *auth_info)
{
	NTSTATUS status;
	DATA_BLOB null_blob = data_blob_null;
	DATA_BLOB request = data_blob_null;

	DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
	status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
					null_blob,
					&request);

	if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
		data_blob_free(&request);
		return status;
	}

	status = dcerpc_push_dcerpc_auth(cli,
					 DCERPC_AUTH_TYPE_NTLMSSP,
					 auth_level,
					 0, /* auth_pad_length */
					 1, /* auth_context_id */
					 &request,
					 auth_info);
	if (!NT_STATUS_IS_OK(status)) {
		data_blob_free(&request);
		return status;
	}

	DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
	dump_data(5, request.data, request.length);

	return NT_STATUS_OK;
}

/*******************************************************************
 Creates schannel auth bind.
 ********************************************************************/

static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
						  enum dcerpc_AuthLevel auth_level,
						  DATA_BLOB *auth_info)
{
	NTSTATUS status;
	struct NL_AUTH_MESSAGE r;
	DATA_BLOB schannel_blob;

	/* Use lp_workgroup() if domain not specified */

	if (!cli->auth->domain || !cli->auth->domain[0]) {
		cli->auth->domain = talloc_strdup(cli, lp_workgroup());
		if (cli->auth->domain == NULL) {
			return NT_STATUS_NO_MEMORY;
		}
	}

	/*
	 * Now marshall the data into the auth parse_struct.
	 */

	r.MessageType			= NL_NEGOTIATE_REQUEST;
	r.Flags				= NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
					  NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
	r.oem_netbios_domain.a		= cli->auth->domain;
	r.oem_netbios_computer.a	= global_myname();

	status = dcerpc_push_schannel_bind(cli, &r, &schannel_blob);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	status = dcerpc_push_dcerpc_auth(cli,
					 DCERPC_AUTH_TYPE_SCHANNEL,
					 auth_level,
					 0, /* auth_pad_length */
					 1, /* auth_context_id */
					 &schannel_blob,
					 auth_info);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	return NT_STATUS_OK;
}

/*******************************************************************
 Creates the internals of a DCE/RPC bind request or alter context PDU.
 ********************************************************************/

static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
						enum dcerpc_pkt_type ptype,
						uint32 rpc_call_id,
						const struct ndr_syntax_id *abstract,
						const struct ndr_syntax_id *transfer,
						const DATA_BLOB *auth_info,
						DATA_BLOB *blob)
{
	uint16 auth_len = auth_info->length;
	NTSTATUS status;
	union dcerpc_payload u;
	struct dcerpc_ctx_list ctx_list;

	if (auth_len) {
		auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
	}

	ctx_list.context_id = 0;
	ctx_list.num_transfer_syntaxes = 1;
	ctx_list.abstract_syntax = *abstract;
	ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);

	u.bind.max_xmit_frag	= RPC_MAX_PDU_FRAG_LEN;
	u.bind.max_recv_frag	= RPC_MAX_PDU_FRAG_LEN;
	u.bind.assoc_group_id	= 0x0;
	u.bind.num_contexts	= 1;
	u.bind.ctx_list		= &ctx_list;
	u.bind.auth_info	= *auth_info;

	status = dcerpc_push_ncacn_packet(mem_ctx,
					  ptype,
					  DCERPC_PFC_FLAG_FIRST |
					  DCERPC_PFC_FLAG_LAST,
					  auth_len,
					  rpc_call_id,
					  &u,
					  blob);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
		return status;
	}

	return NT_STATUS_OK;
}

/*******************************************************************
 Creates a DCE/RPC bind request.
 ********************************************************************/

static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
				    struct rpc_pipe_client *cli,
				    uint32 rpc_call_id,
				    const struct ndr_syntax_id *abstract,
				    const struct ndr_syntax_id *transfer,
				    enum pipe_auth_type auth_type,
				    enum dcerpc_AuthLevel auth_level,
				    DATA_BLOB *rpc_out)
{
	DATA_BLOB auth_info = data_blob_null;
	NTSTATUS ret = NT_STATUS_OK;

	switch (auth_type) {
		case PIPE_AUTH_TYPE_SCHANNEL:
			ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &auth_info);
			if (!NT_STATUS_IS_OK(ret)) {
				return ret;
			}
			break;

		case PIPE_AUTH_TYPE_NTLMSSP:
			ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &auth_info);
			if (!NT_STATUS_IS_OK(ret)) {
				return ret;
			}
			break;

		case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
			ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &auth_info);
			if (!NT_STATUS_IS_OK(ret)) {
				return ret;
			}
			break;

		case PIPE_AUTH_TYPE_KRB5:
			ret = create_krb5_auth_bind_req(cli, auth_level, &auth_info);
			if (!NT_STATUS_IS_OK(ret)) {
				return ret;
			}
			break;

		case PIPE_AUTH_TYPE_NONE:
			break;

		default:
			/* "Can't" happen. */
			return NT_STATUS_INVALID_INFO_CLASS;
	}

	ret = create_bind_or_alt_ctx_internal(mem_ctx,
					      DCERPC_PKT_BIND,
					      rpc_call_id,
					      abstract,
					      transfer,
					      &auth_info,
					      rpc_out);
	return ret;
}

/*******************************************************************
 Create and add the NTLMSSP sign/seal auth header and data.
 ********************************************************************/

static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
					uint32 ss_padding_len,
					DATA_BLOB *rpc_out)
{
	DATA_BLOB auth_info;
	NTSTATUS status;
	DATA_BLOB auth_blob = data_blob_null;
	uint16_t data_and_pad_len = rpc_out->length - DCERPC_RESPONSE_LENGTH;

	if (!cli->auth->a_u.ntlmssp_state) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* marshall the dcerpc_auth with an actually empty auth_blob.
	 * this is needed because the ntmlssp signature includes the
	 * auth header */
	status = dcerpc_push_dcerpc_auth(rpc_out->data,
					map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
					cli->auth->auth_level,
					ss_padding_len,
					1 /* context id. */,
					&auth_blob,
					&auth_info);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	/* append the header */
	if (!data_blob_append(NULL, rpc_out,
				auth_info.data, auth_info.length)) {
		DEBUG(0, ("Failed to add %u bytes auth blob.\n",
			  (unsigned int)auth_info.length));
		return NT_STATUS_NO_MEMORY;
	}
	data_blob_free(&auth_info);

	switch (cli->auth->auth_level) {
	case DCERPC_AUTH_LEVEL_PRIVACY:
		/* Data portion is encrypted. */
		status = ntlmssp_seal_packet(cli->auth->a_u.ntlmssp_state,
					     rpc_out->data,
					     rpc_out->data
						+ DCERPC_RESPONSE_LENGTH,
					     data_and_pad_len,
					     rpc_out->data,
					     rpc_out->length,
					     &auth_blob);
		if (!NT_STATUS_IS_OK(status)) {
			return status;
		}
		break;

	case DCERPC_AUTH_LEVEL_INTEGRITY:
		/* Data is signed. */
		status = ntlmssp_sign_packet(cli->auth->a_u.ntlmssp_state,
					     rpc_out->data,
					     rpc_out->data
						+ DCERPC_RESPONSE_LENGTH,
					     data_and_pad_len,
					     rpc_out->data,
					     rpc_out->length,
					     &auth_blob);
		if (!NT_STATUS_IS_OK(status)) {
			return status;
		}
		break;

	default:
		/* Can't happen. */
		smb_panic("bad auth level");
		/* Notreached. */
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* Finally attach the blob. */
	if (!data_blob_append(NULL, rpc_out,
				auth_blob.data, auth_blob.length)) {
		DEBUG(0, ("Failed to add %u bytes auth blob.\n",
			  (unsigned int)auth_info.length));
		return NT_STATUS_NO_MEMORY;
	}
	data_blob_free(&auth_blob);

	return NT_STATUS_OK;
}

/*******************************************************************
 Create and add the schannel sign/seal auth header and data.
 ********************************************************************/

static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
					uint32 ss_padding_len,
					DATA_BLOB *rpc_out)
{
	DATA_BLOB auth_info;
	struct schannel_state *sas = cli->auth->a_u.schannel_auth;
	uint8_t *data_p = rpc_out->data + DCERPC_RESPONSE_LENGTH;
	size_t data_and_pad_len = rpc_out->length
					- DCERPC_RESPONSE_LENGTH;
	DATA_BLOB blob;
	NTSTATUS status;

	if (!sas) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
			sas->seq_num));

	switch (cli->auth->auth_level) {
	case DCERPC_AUTH_LEVEL_PRIVACY:
		status = netsec_outgoing_packet(sas,
						rpc_out->data,
						true,
						data_p,
						data_and_pad_len,
						&blob);
		break;
	case DCERPC_AUTH_LEVEL_INTEGRITY:
		status = netsec_outgoing_packet(sas,
						rpc_out->data,
						false,
						data_p,
						data_and_pad_len,
						&blob);
		break;
	default:
		status = NT_STATUS_INTERNAL_ERROR;
		break;
	}

	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(1,("add_schannel_auth_footer: failed to process packet: %s\n",
			nt_errstr(status)));
		return status;
	}

	if (DEBUGLEVEL >= 10) {
		dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
	}

	/* Finally marshall the blob. */
	status = dcerpc_push_dcerpc_auth(rpc_out->data,
		   map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
					cli->auth->auth_level,
					ss_padding_len,
					1 /* context id. */,
					&blob,
					&auth_info);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}
	data_blob_free(&blob);

	if (!data_blob_append(NULL, rpc_out,
				auth_info.data, auth_info.length)) {
		return NT_STATUS_NO_MEMORY;
	}
	data_blob_free(&auth_info);

	return NT_STATUS_OK;
}

/*******************************************************************
 Calculate how much data we're going to send in this packet, also
 work out any sign/seal padding length.
 ********************************************************************/

static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
					uint32 data_left,
					uint16 *p_frag_len,
					uint16 *p_auth_len,
					uint32 *p_ss_padding)
{
	uint32 data_space, data_len;

#if 0
	if ((data_left > 0) && (sys_random() % 2)) {
		data_left = MAX(data_left/2, 1);
	}
#endif

	switch (cli->auth->auth_level) {
		case DCERPC_AUTH_LEVEL_NONE:
		case DCERPC_AUTH_LEVEL_CONNECT:
			data_space = cli->max_xmit_frag - DCERPC_REQUEST_LENGTH;
			data_len = MIN(data_space, data_left);
			*p_ss_padding = 0;
			*p_auth_len = 0;
			*p_frag_len = DCERPC_REQUEST_LENGTH + data_len;
			return data_len;

		case DCERPC_AUTH_LEVEL_INTEGRITY:
		case DCERPC_AUTH_LEVEL_PRIVACY:
			/* Treat the same for all authenticated rpc requests. */
			switch(cli->auth->auth_type) {
				case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
				case PIPE_AUTH_TYPE_NTLMSSP:
					*p_auth_len = NTLMSSP_SIG_SIZE;
					break;
				case PIPE_AUTH_TYPE_SCHANNEL:
					*p_auth_len = NL_AUTH_SIGNATURE_SIZE;
					break;
				default:
					smb_panic("bad auth type");
					break;
			}

			data_space = cli->max_xmit_frag
					- DCERPC_REQUEST_LENGTH
					- DCERPC_AUTH_TRAILER_LENGTH
					- *p_auth_len;

			data_len = MIN(data_space, data_left);
			*p_ss_padding = 0;
			if (data_len % CLIENT_NDR_PADDING_SIZE) {
				*p_ss_padding = CLIENT_NDR_PADDING_SIZE - (data_len % CLIENT_NDR_PADDING_SIZE);
			}
			*p_frag_len = DCERPC_REQUEST_LENGTH
					+ data_len + *p_ss_padding
					+ DCERPC_AUTH_TRAILER_LENGTH
					+ *p_auth_len;
			return data_len;

		default:
			smb_panic("bad auth level");
			/* Notreached. */
			return 0;
	}
}

/*******************************************************************
 External interface.
 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
 and deals with signing/sealing details.
 ********************************************************************/

struct rpc_api_pipe_req_state {
	struct event_context *ev;
	struct rpc_pipe_client *cli;
	uint8_t op_num;
	uint32_t call_id;
	DATA_BLOB *req_data;
	uint32_t req_data_sent;
	DATA_BLOB rpc_out;
	DATA_BLOB reply_pdu;
};

static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
static void rpc_api_pipe_req_done(struct tevent_req *subreq);
static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
				  bool *is_last_frag);

struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
					 struct event_context *ev,
					 struct rpc_pipe_client *cli,
					 uint8_t op_num,
					 DATA_BLOB *req_data)
{
	struct tevent_req *req, *subreq;
	struct rpc_api_pipe_req_state *state;
	NTSTATUS status;
	bool is_last_frag;

	req = tevent_req_create(mem_ctx, &state,
				struct rpc_api_pipe_req_state);
	if (req == NULL) {
		return NULL;
	}
	state->ev = ev;
	state->cli = cli;
	state->op_num = op_num;
	state->req_data = req_data;
	state->req_data_sent = 0;
	state->call_id = get_rpc_call_id();
	state->reply_pdu = data_blob_null;
	state->rpc_out = data_blob_null;

	if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
					+ RPC_MAX_SIGN_SIZE) {
		/* Server is screwed up ! */
		status = NT_STATUS_INVALID_PARAMETER;
		goto post_status;
	}

	status = prepare_next_frag(state, &is_last_frag);
	if (!NT_STATUS_IS_OK(status)) {
		goto post_status;
	}

	if (is_last_frag) {
		subreq = rpc_api_pipe_send(state, ev, state->cli,
					   &state->rpc_out,
					   DCERPC_PKT_RESPONSE);
		if (subreq == NULL) {
			goto fail;
		}
		tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
	} else {
		subreq = rpc_write_send(state, ev, cli->transport,
					state->rpc_out.data,
					state->rpc_out.length);
		if (subreq == NULL) {
			goto fail;
		}
		tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
					req);
	}
	return req;

 post_status:
	tevent_req_nterror(req, status);
	return tevent_req_post(req, ev);
 fail:
	TALLOC_FREE(req);
	return NULL;
}

static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
				  bool *is_last_frag)
{
	uint32_t data_sent_thistime;
	uint16_t auth_len;
	uint16_t frag_len;
	uint8_t flags = 0;
	uint32_t ss_padding;
	uint32_t data_left;
	char pad[8] = { 0, };
	NTSTATUS status;
	union dcerpc_payload u;

	data_left = state->req_data->length - state->req_data_sent;

	data_sent_thistime = calculate_data_len_tosend(
		state->cli, data_left, &frag_len, &auth_len, &ss_padding);

	if (state->req_data_sent == 0) {
		flags = DCERPC_PFC_FLAG_FIRST;
	}

	if (data_sent_thistime == data_left) {
		flags |= DCERPC_PFC_FLAG_LAST;
	}

	data_blob_free(&state->rpc_out);

	ZERO_STRUCT(u.request);

	u.request.alloc_hint	= state->req_data->length;
	u.request.context_id	= 0;
	u.request.opnum		= state->op_num;

	status = dcerpc_push_ncacn_packet(state,
					  DCERPC_PKT_REQUEST,
					  flags,
					  auth_len,
					  state->call_id,
					  &u,
					  &state->rpc_out);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	/* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
	 * compute it right for requests */
	dcerpc_set_frag_length(&state->rpc_out, frag_len);

	/* Copy in the data, plus any ss padding. */
	if (!data_blob_append(NULL, &state->rpc_out,
				state->req_data->data + state->req_data_sent,
				data_sent_thistime)) {
		return NT_STATUS_NO_MEMORY;
	}

	if (ss_padding) {
		/* Copy the sign/seal padding data. */
		if (!data_blob_append(NULL, &state->rpc_out,
					pad, ss_padding)) {
			return NT_STATUS_NO_MEMORY;
		}
	}

	/* Generate any auth sign/seal and add the auth footer. */
	switch (state->cli->auth->auth_type) {
	case PIPE_AUTH_TYPE_NONE:
		status = NT_STATUS_OK;
		break;
	case PIPE_AUTH_TYPE_NTLMSSP:
	case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
		status = add_ntlmssp_auth_footer(state->cli, ss_padding,
						 &state->rpc_out);
		break;
	case PIPE_AUTH_TYPE_SCHANNEL:
		status = add_schannel_auth_footer(state->cli, ss_padding,
						  &state->rpc_out);
		break;
	default:
		status = NT_STATUS_INVALID_PARAMETER;
		break;
	}

	state->req_data_sent += data_sent_thistime;
	*is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);

	return status;
}

static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct rpc_api_pipe_req_state *state = tevent_req_data(
		req, struct rpc_api_pipe_req_state);
	NTSTATUS status;
	bool is_last_frag;

	status = rpc_write_recv(subreq);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}

	status = prepare_next_frag(state, &is_last_frag);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}

	if (is_last_frag) {
		subreq = rpc_api_pipe_send(state, state->ev, state->cli,
					   &state->rpc_out,
					   DCERPC_PKT_RESPONSE);
		if (tevent_req_nomem(subreq, req)) {
			return;
		}
		tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
	} else {
		subreq = rpc_write_send(state, state->ev,
					state->cli->transport,
					state->rpc_out.data,
					state->rpc_out.length);
		if (tevent_req_nomem(subreq, req)) {
			return;
		}
		tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
					req);
	}
}

static void rpc_api_pipe_req_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct rpc_api_pipe_req_state *state = tevent_req_data(
		req, struct rpc_api_pipe_req_state);
	NTSTATUS status;

	status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}
	tevent_req_done(req);
}

NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
			       DATA_BLOB *reply_pdu)
{
	struct rpc_api_pipe_req_state *state = tevent_req_data(
		req, struct rpc_api_pipe_req_state);
	NTSTATUS status;

	if (tevent_req_is_nterror(req, &status)) {
		/*
		 * We always have to initialize to reply pdu, even if there is
		 * none. The rpccli_* caller routines expect this.
		 */
		*reply_pdu = data_blob_null;
		return status;
	}

	/* return data to caller and assign it ownership of memory */
	reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
	reply_pdu->length = state->reply_pdu.length;
	state->reply_pdu.length = 0;

	return NT_STATUS_OK;
}

#if 0
/****************************************************************************
 Set the handle state.
****************************************************************************/

static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
				   const char *pipe_name, uint16 device_state)
{
	bool state_set = False;
	char param[2];
	uint16 setup[2]; /* only need 2 uint16 setup parameters */
	char *rparam = NULL;
	char *rdata = NULL;
	uint32 rparam_len, rdata_len;

	if (pipe_name == NULL)
		return False;

	DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
		 cli->fnum, pipe_name, device_state));

	/* create parameters: device state */
	SSVAL(param, 0, device_state);

	/* create setup parameters. */
	setup[0] = 0x0001; 
	setup[1] = cli->fnum; /* pipe file handle.  got this from an SMBOpenX. */

	/* send the data on \PIPE\ */
	if (cli_api_pipe(cli->cli, "\\PIPE\\",
	            setup, 2, 0,                /* setup, length, max */
	            param, 2, 0,                /* param, length, max */
	            NULL, 0, 1024,              /* data, length, max */
	            &rparam, &rparam_len,        /* return param, length */
	            &rdata, &rdata_len))         /* return data, length */
	{
		DEBUG(5, ("Set Handle state: return OK\n"));
		state_set = True;
	}

	SAFE_FREE(rparam);
	SAFE_FREE(rdata);

	return state_set;
}
#endif

/****************************************************************************
 Check the rpc bind acknowledge response.
****************************************************************************/

static bool check_bind_response(const struct dcerpc_bind_ack *r,
				const struct ndr_syntax_id *transfer)
{
	struct dcerpc_ack_ctx ctx;

	if (r->secondary_address_size == 0) {
		DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
	}

	if (r->num_results < 1 || !r->ctx_list) {
		return false;
	}

	ctx = r->ctx_list[0];

	/* check the transfer syntax */
	if ((ctx.syntax.if_version != transfer->if_version) ||
	     (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
		DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
		return False;
	}

	if (r->num_results != 0x1 || ctx.result != 0) {
		DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
		          r->num_results, ctx.reason));
	}

	DEBUG(5,("check_bind_response: accepted!\n"));
	return True;
}

/*******************************************************************
 Creates a DCE/RPC bind authentication response.
 This is the packet that is sent back to the server once we
 have received a BIND-ACK, to finish the third leg of
 the authentication handshake.
 ********************************************************************/

static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
				struct rpc_pipe_client *cli,
				uint32 rpc_call_id,
				enum pipe_auth_type auth_type,
				enum dcerpc_AuthLevel auth_level,
				DATA_BLOB *pauth_blob,
				DATA_BLOB *rpc_out)
{
	NTSTATUS status;
	union dcerpc_payload u;

	u.auth3._pad = 0;

	status = dcerpc_push_dcerpc_auth(mem_ctx,
			map_pipe_auth_type_to_rpc_auth_type(auth_type),
					 auth_level,
					 0, /* auth_pad_length */
					 1, /* auth_context_id */
					 pauth_blob,
					 &u.auth3.auth_info);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	status = dcerpc_push_ncacn_packet(mem_ctx,
					  DCERPC_PKT_AUTH3,
					  DCERPC_PFC_FLAG_FIRST |
					  DCERPC_PFC_FLAG_LAST,
					  pauth_blob->length,
					  rpc_call_id,
					  &u,
					  rpc_out);
	data_blob_free(&u.auth3.auth_info);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
		return status;
	}

	return NT_STATUS_OK;
}

/*******************************************************************
 Creates a DCE/RPC bind alter context authentication request which
 may contain a spnego auth blobl
 ********************************************************************/

static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
					uint32 rpc_call_id,
					const struct ndr_syntax_id *abstract,
					const struct ndr_syntax_id *transfer,
					enum dcerpc_AuthLevel auth_level,
					const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
					DATA_BLOB *rpc_out)
{
	DATA_BLOB auth_info;
	NTSTATUS status;

	status = dcerpc_push_dcerpc_auth(mem_ctx,
					 DCERPC_AUTH_TYPE_SPNEGO,
					 auth_level,
					 0, /* auth_pad_length */
					 1, /* auth_context_id */
					 pauth_blob,
					 &auth_info);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	status = create_bind_or_alt_ctx_internal(mem_ctx,
						 DCERPC_PKT_ALTER,
						 rpc_call_id,
						 abstract,
						 transfer,
						 &auth_info,
						 rpc_out);
	data_blob_free(&auth_info);
	return status;
}

/****************************************************************************
 Do an rpc bind.
****************************************************************************/

struct rpc_pipe_bind_state {
	struct event_context *ev;
	struct rpc_pipe_client *cli;
	DATA_BLOB rpc_out;
	uint32_t rpc_call_id;
};

static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
					   struct rpc_pipe_bind_state *state,
					   struct ncacn_packet *r);
static void rpc_bind_auth3_write_done(struct tevent_req *subreq);
static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
						    struct rpc_pipe_bind_state *state,
						    struct ncacn_packet *r,
						    DATA_BLOB *reply_pdu);
static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq);

struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
				      struct event_context *ev,
				      struct rpc_pipe_client *cli,
				      struct cli_pipe_auth_data *auth)
{
	struct tevent_req *req, *subreq;
	struct rpc_pipe_bind_state *state;
	NTSTATUS status;

	req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
	if (req == NULL) {
		return NULL;
	}

	DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
		rpccli_pipe_txt(talloc_tos(), cli),
		(unsigned int)auth->auth_type,
		(unsigned int)auth->auth_level ));

	state->ev = ev;
	state->cli = cli;
	state->rpc_call_id = get_rpc_call_id();
	state->rpc_out = data_blob_null;

	cli->auth = talloc_move(cli, &auth);

	/* Marshall the outgoing data. */
	status = create_rpc_bind_req(state, cli,
				     state->rpc_call_id,
				     &cli->abstract_syntax,
				     &cli->transfer_syntax,
				     cli->auth->auth_type,
				     cli->auth->auth_level,
				     &state->rpc_out);

	if (!NT_STATUS_IS_OK(status)) {
		goto post_status;
	}

	subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
				   DCERPC_PKT_BIND_ACK);
	if (subreq == NULL) {
		goto fail;
	}
	tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
	return req;

 post_status:
	tevent_req_nterror(req, status);
	return tevent_req_post(req, ev);
 fail:
	TALLOC_FREE(req);
	return NULL;
}

static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct rpc_pipe_bind_state *state = tevent_req_data(
		req, struct rpc_pipe_bind_state);
	DATA_BLOB reply_pdu;
	struct ncacn_packet *pkt;
	NTSTATUS status;

	status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, &reply_pdu);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
			  rpccli_pipe_txt(talloc_tos(), state->cli),
			  nt_errstr(status)));
		tevent_req_nterror(req, status);
		return;
	}

	if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
		DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
		tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
		return;
	}

	state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
	state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;

	/*
	 * For authenticated binds we may need to do 3 or 4 leg binds.
	 */

	switch(state->cli->auth->auth_type) {

	case PIPE_AUTH_TYPE_NONE:
	case PIPE_AUTH_TYPE_SCHANNEL:
		/* Bind complete. */
		tevent_req_done(req);
		break;

	case PIPE_AUTH_TYPE_NTLMSSP:
		/* Need to send AUTH3 packet - no reply. */
		status = rpc_finish_auth3_bind_send(req, state, pkt);
		if (!NT_STATUS_IS_OK(status)) {
			tevent_req_nterror(req, status);
		}
		break;

	case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
		/* Need to send alter context request and reply. */
		status = rpc_finish_spnego_ntlmssp_bind_send(req, state, pkt,
							     &reply_pdu);
		if (!NT_STATUS_IS_OK(status)) {
			tevent_req_nterror(req, status);
		}
		break;

	case PIPE_AUTH_TYPE_KRB5:
		/* */

	default:
		DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
			 (unsigned int)state->cli->auth->auth_type));
		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
	}
}

static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
					   struct rpc_pipe_bind_state *state,
					   struct ncacn_packet *r)
{
	DATA_BLOB client_reply = data_blob_null;
	struct dcerpc_auth auth;
	struct tevent_req *subreq;
	NTSTATUS status;

	if ((r->auth_length == 0)
	    || (r->frag_length < DCERPC_AUTH_TRAILER_LENGTH
					+ r->auth_length)) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	status = dcerpc_pull_dcerpc_auth(talloc_tos(),
					 &r->u.bind_ack.auth_info,
					 &auth, false);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
			  nt_errstr(status)));
		return status;
	}

	/* TODO - check auth_type/auth_level match. */

	status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
				auth.credentials, &client_reply);

	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
			  "blob failed: %s.\n", nt_errstr(status)));
		return status;
	}

	data_blob_free(&state->rpc_out);

	status = create_rpc_bind_auth3(state,
				       state->cli, state->rpc_call_id,
				       state->cli->auth->auth_type,
				       state->cli->auth->auth_level,
				       &client_reply, &state->rpc_out);
	data_blob_free(&client_reply);

	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	subreq = rpc_write_send(state, state->ev, state->cli->transport,
				state->rpc_out.data, state->rpc_out.length);
	if (subreq == NULL) {
		return NT_STATUS_NO_MEMORY;
	}
	tevent_req_set_callback(subreq, rpc_bind_auth3_write_done, req);
	return NT_STATUS_OK;
}

static void rpc_bind_auth3_write_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	NTSTATUS status;

	status = rpc_write_recv(subreq);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}
	tevent_req_done(req);
}

static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
						    struct rpc_pipe_bind_state *state,
						    struct ncacn_packet *r,
						    DATA_BLOB *reply_pdu)
{
	DATA_BLOB server_ntlm_response = data_blob_null;
	DATA_BLOB client_reply = data_blob_null;
	DATA_BLOB tmp_blob = data_blob_null;
	struct dcerpc_auth auth_info;
	DATA_BLOB auth_blob;
	struct tevent_req *subreq;
	NTSTATUS status;

	if ((r->auth_length == 0)
	    || (r->frag_length < DCERPC_AUTH_TRAILER_LENGTH
					+ r->auth_length)) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* Process the returned NTLMSSP blob first. */
	auth_blob = data_blob_const(reply_pdu->data
					+ r->frag_length
					- DCERPC_AUTH_TRAILER_LENGTH
					- r->auth_length,
				    DCERPC_AUTH_TRAILER_LENGTH
					+ r->auth_length);

	status = dcerpc_pull_dcerpc_auth(state, &auth_blob, &auth_info, false);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
		return status;
	}

	/*
	 * The server might give us back two challenges - tmp_blob is for the
	 * second.
	 */
	if (!spnego_parse_challenge(auth_info.credentials,
				    &server_ntlm_response, &tmp_blob)) {
		data_blob_free(&server_ntlm_response);
		data_blob_free(&tmp_blob);
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* We're finished with the server spnego response and the tmp_blob. */
	data_blob_free(&tmp_blob);

	status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
				server_ntlm_response, &client_reply);

	/* Finished with the server_ntlm response */
	data_blob_free(&server_ntlm_response);

	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
			  "using server blob failed.\n"));
		data_blob_free(&client_reply);
		return status;
	}

	/* SPNEGO wrap the client reply. */
	tmp_blob = spnego_gen_auth(client_reply);
	data_blob_free(&client_reply);
	client_reply = tmp_blob;
	tmp_blob = data_blob_null;

	/* Now prepare the alter context pdu. */
	data_blob_free(&state->rpc_out);

	status = create_rpc_alter_context(state,
					  state->rpc_call_id,
					  &state->cli->abstract_syntax,
					  &state->cli->transfer_syntax,
					  state->cli->auth->auth_level,
					  &client_reply,
					  &state->rpc_out);
	data_blob_free(&client_reply);

	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	subreq = rpc_api_pipe_send(state, state->ev, state->cli,
				   &state->rpc_out, DCERPC_PKT_ALTER_RESP);
	if (subreq == NULL) {
		return NT_STATUS_NO_MEMORY;
	}
	tevent_req_set_callback(subreq, rpc_bind_ntlmssp_api_done, req);
	return NT_STATUS_OK;
}

static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq)
{
	struct tevent_req *req = tevent_req_callback_data(
		subreq, struct tevent_req);
	struct rpc_pipe_bind_state *state = tevent_req_data(
		req, struct rpc_pipe_bind_state);
	DATA_BLOB tmp_blob = data_blob_null;
	struct ncacn_packet *pkt;
	struct dcerpc_auth auth;
	NTSTATUS status;

	status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
	TALLOC_FREE(subreq);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}

	status = dcerpc_pull_dcerpc_auth(pkt,
					 &pkt->u.alter_resp.auth_info,
					 &auth, false);
	if (!NT_STATUS_IS_OK(status)) {
		tevent_req_nterror(req, status);
		return;
	}

	/* Check we got a valid auth response. */
	if (!spnego_parse_auth_response(auth.credentials,
					NT_STATUS_OK,
					OID_NTLMSSP, &tmp_blob)) {
		data_blob_free(&tmp_blob);
		tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
		return;
	}

	data_blob_free(&tmp_blob);

	DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
		 "%s.\n", rpccli_pipe_txt(talloc_tos(), state->cli)));
	tevent_req_done(req);
}

NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
{
	return tevent_req_simple_recv_ntstatus(req);
}

NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
		       struct cli_pipe_auth_data *auth)
{
	TALLOC_CTX *frame = talloc_stackframe();
	struct event_context *ev;
	struct tevent_req *req;
	NTSTATUS status = NT_STATUS_OK;

	ev = event_context_init(frame);
	if (ev == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto fail;
	}

	req = rpc_pipe_bind_send(frame, ev, cli, auth);
	if (req == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto fail;
	}

	if (!tevent_req_poll(req, ev)) {
		status = map_nt_error_from_unix(errno);
		goto fail;
	}

	status = rpc_pipe_bind_recv(req);
 fail:
	TALLOC_FREE(frame);
	return status;
}

#define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */

unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
				unsigned int timeout)
{
	unsigned int old;

	if (rpc_cli->transport == NULL) {
		return RPCCLI_DEFAULT_TIMEOUT;
	}

	if (rpc_cli->transport->set_timeout == NULL) {
		return RPCCLI_DEFAULT_TIMEOUT;
	}

	old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
	if (old == 0) {
		return RPCCLI_DEFAULT_TIMEOUT;
	}

	return old;
}

bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
{
	if (rpc_cli == NULL) {
		return false;
	}

	if (rpc_cli->transport == NULL) {
		return false;
	}

	return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
}

bool rpccli_get_pwd_hash(struct rpc_pipe_client *rpc_cli, uint8_t nt_hash[16])
{
	struct cli_state *cli;

	if ((rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_NTLMSSP)
	    || (rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP)) {
		memcpy(nt_hash, rpc_cli->auth->a_u.ntlmssp_state->nt_hash, 16);
		return true;
	}

	cli = rpc_pipe_np_smb_conn(rpc_cli);
	if (cli == NULL) {
		return false;
	}
	E_md4hash(cli->password ? cli->password : "", nt_hash);
	return true;
}

NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
			       struct cli_pipe_auth_data **presult)
{
	struct cli_pipe_auth_data *result;

	result = talloc(mem_ctx, struct cli_pipe_auth_data);
	if (result == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	result->auth_type = PIPE_AUTH_TYPE_NONE;
	result->auth_level = DCERPC_AUTH_LEVEL_NONE;

	result->user_name = talloc_strdup(result, "");
	result->domain = talloc_strdup(result, "");
	if ((result->user_name == NULL) || (result->domain == NULL)) {
		TALLOC_FREE(result);
		return NT_STATUS_NO_MEMORY;
	}

	*presult = result;
	return NT_STATUS_OK;
}

static int cli_auth_ntlmssp_data_destructor(struct cli_pipe_auth_data *auth)
{
	TALLOC_FREE(auth->a_u.ntlmssp_state);
	return 0;
}

static NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
				  enum pipe_auth_type auth_type,
				  enum dcerpc_AuthLevel auth_level,
				  const char *domain,
				  const char *username,
				  const char *password,
				  struct cli_pipe_auth_data **presult)
{
	struct cli_pipe_auth_data *result;
	NTSTATUS status;

	result = talloc(mem_ctx, struct cli_pipe_auth_data);
	if (result == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	result->auth_type = auth_type;
	result->auth_level = auth_level;

	result->user_name = talloc_strdup(result, username);
	result->domain = talloc_strdup(result, domain);
	if ((result->user_name == NULL) || (result->domain == NULL)) {
		status = NT_STATUS_NO_MEMORY;
		goto fail;
	}

	status = ntlmssp_client_start(NULL,
				      global_myname(),
				      lp_workgroup(),
				      lp_client_ntlmv2_auth(),
				      &result->a_u.ntlmssp_state);
	if (!NT_STATUS_IS_OK(status)) {
		goto fail;
	}

	talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);

	status = ntlmssp_set_username(result->a_u.ntlmssp_state, username);
	if (!NT_STATUS_IS_OK(status)) {
		goto fail;
	}

	status = ntlmssp_set_domain(result->a_u.ntlmssp_state, domain);
	if (!NT_STATUS_IS_OK(status)) {
		goto fail;
	}

	status = ntlmssp_set_password(result->a_u.ntlmssp_state, password);
	if (!NT_STATUS_IS_OK(status)) {
		goto fail;
	}

	/*
	 * Turn off sign+seal to allow selected auth level to turn it back on.
	 */
	result->a_u.ntlmssp_state->neg_flags &=
		~(NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL);

	if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
		result->a_u.ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
	} else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
		result->a_u.ntlmssp_state->neg_flags
			|= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
	}

	*presult = result;
	return NT_STATUS_OK;

 fail:
	TALLOC_FREE(result);
	return status;
}

NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
				   enum dcerpc_AuthLevel auth_level,
				   struct netlogon_creds_CredentialState *creds,
				   struct cli_pipe_auth_data **presult)
{
	struct cli_pipe_auth_data *result;

	result = talloc(mem_ctx, struct cli_pipe_auth_data);
	if (result == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	result->auth_type = PIPE_AUTH_TYPE_SCHANNEL;
	result->auth_level = auth_level;

	result->user_name = talloc_strdup(result, "");
	result->domain = talloc_strdup(result, domain);
	if ((result->user_name == NULL) || (result->domain == NULL)) {
		goto fail;
	}

	result->a_u.schannel_auth = talloc(result, struct schannel_state);
	if (result->a_u.schannel_auth == NULL) {
		goto fail;
	}

	result->a_u.schannel_auth->state = SCHANNEL_STATE_START;
	result->a_u.schannel_auth->seq_num = 0;
	result->a_u.schannel_auth->initiator = true;
	result->a_u.schannel_auth->creds = creds;

	*presult = result;
	return NT_STATUS_OK;

 fail:
	TALLOC_FREE(result);
	return NT_STATUS_NO_MEMORY;
}

#ifdef HAVE_KRB5
static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
{
	data_blob_free(&auth->session_key);
	return 0;
}
#endif

static NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
				   enum dcerpc_AuthLevel auth_level,
				   const char *service_princ,
				   const char *username,
				   const char *password,
				   struct cli_pipe_auth_data **presult)
{
#ifdef HAVE_KRB5
	struct cli_pipe_auth_data *result;

	if ((username != NULL) && (password != NULL)) {
		int ret = kerberos_kinit_password(username, password, 0, NULL);
		if (ret != 0) {
			return NT_STATUS_ACCESS_DENIED;
		}
	}

	result = talloc(mem_ctx, struct cli_pipe_auth_data);
	if (result == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	result->auth_type = PIPE_AUTH_TYPE_KRB5;
	result->auth_level = auth_level;

	/*
	 * Username / domain need fixing!
	 */
	result->user_name = talloc_strdup(result, "");
	result->domain = talloc_strdup(result, "");
	if ((result->user_name == NULL) || (result->domain == NULL)) {
		goto fail;
	}

	result->a_u.kerberos_auth = TALLOC_ZERO_P(
		result, struct kerberos_auth_struct);
	if (result->a_u.kerberos_auth == NULL) {
		goto fail;
	}
	talloc_set_destructor(result->a_u.kerberos_auth,
			      cli_auth_kerberos_data_destructor);

	result->a_u.kerberos_auth->service_principal = talloc_strdup(
		result, service_princ);
	if (result->a_u.kerberos_auth->service_principal == NULL) {
		goto fail;
	}

	*presult = result;
	return NT_STATUS_OK;

 fail:
	TALLOC_FREE(result);
	return NT_STATUS_NO_MEMORY;
#else
	return NT_STATUS_NOT_SUPPORTED;
#endif
}

/**
 * Create an rpc pipe client struct, connecting to a tcp port.
 */
static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
				       uint16_t port,
				       const struct ndr_syntax_id *abstract_syntax,
				       struct rpc_pipe_client **presult)
{
	struct rpc_pipe_client *result;
	struct sockaddr_storage addr;
	NTSTATUS status;
	int fd;

	result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
	if (result == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	result->abstract_syntax = *abstract_syntax;
	result->transfer_syntax = ndr_transfer_syntax;
	result->dispatch = cli_do_rpc_ndr;
	result->dispatch_send = cli_do_rpc_ndr_send;
	result->dispatch_recv = cli_do_rpc_ndr_recv;

	result->desthost = talloc_strdup(result, host);
	result->srv_name_slash = talloc_asprintf_strupper_m(
		result, "\\\\%s", result->desthost);
	if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
		status = NT_STATUS_NO_MEMORY;
		goto fail;
	}

	result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
	result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;

	if (!resolve_name(host, &addr, 0, false)) {
		status = NT_STATUS_NOT_FOUND;
		goto fail;
	}

	status = open_socket_out(&addr, port, 60, &fd);
	if (!NT_STATUS_IS_OK(status)) {
		goto fail;
	}
	set_socket_options(fd, lp_socket_options());

	status = rpc_transport_sock_init(result, fd, &result->transport);
	if (!NT_STATUS_IS_OK(status)) {
		close(fd);
		goto fail;
	}

	result->transport->transport = NCACN_IP_TCP;

	*presult = result;
	return NT_STATUS_OK;

 fail:
	TALLOC_FREE(result);
	return status;
}

/**
 * Determine the tcp port on which a dcerpc interface is listening
 * for the ncacn_ip_tcp transport via the endpoint mapper of the
 * target host.
 */
static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
				      const struct ndr_syntax_id *abstract_syntax,
				      uint16_t *pport)
{
	NTSTATUS status;
	struct rpc_pipe_client *epm_pipe = NULL;
	struct cli_pipe_auth_data *auth = NULL;
	struct dcerpc_binding *map_binding = NULL;
	struct dcerpc_binding *res_binding = NULL;
	struct epm_twr_t *map_tower = NULL;
	struct epm_twr_t *res_towers = NULL;
	struct policy_handle *entry_handle = NULL;
	uint32_t num_towers = 0;
	uint32_t max_towers = 1;
	struct epm_twr_p_t towers;
	TALLOC_CTX *tmp_ctx = talloc_stackframe();

	if (pport == NULL) {
		status = NT_STATUS_INVALID_PARAMETER;
		goto done;
	}

	/* open the connection to the endpoint mapper */
	status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
					&ndr_table_epmapper.syntax_id,
					&epm_pipe);

	if (!NT_STATUS_IS_OK(status)) {
		goto done;
	}

	status = rpccli_anon_bind_data(tmp_ctx, &auth);
	if (!NT_STATUS_IS_OK(status)) {
		goto done;
	}

	status = rpc_pipe_bind(epm_pipe, auth);
	if (!NT_STATUS_IS_OK(status)) {
		goto done;
	}

	/* create tower for asking the epmapper */

	map_binding = TALLOC_ZERO_P(tmp_ctx, struct dcerpc_binding);
	if (map_binding == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto done;
	}

	map_binding->transport = NCACN_IP_TCP;
	map_binding->object = *abstract_syntax;
	map_binding->host = host; /* needed? */
	map_binding->endpoint = "0"; /* correct? needed? */

	map_tower = TALLOC_ZERO_P(tmp_ctx, struct epm_twr_t);
	if (map_tower == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto done;
	}

	status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
					    &(map_tower->tower));
	if (!NT_STATUS_IS_OK(status)) {
		goto done;
	}

	/* allocate further parameters for the epm_Map call */

	res_towers = TALLOC_ARRAY(tmp_ctx, struct epm_twr_t, max_towers);
	if (res_towers == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto done;
	}
	towers.twr = res_towers;

	entry_handle = TALLOC_ZERO_P(tmp_ctx, struct policy_handle);
	if (entry_handle == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto done;
	}

	/* ask the endpoint mapper for the port */

	status = rpccli_epm_Map(epm_pipe,
				tmp_ctx,
				CONST_DISCARD(struct GUID *,
					      &(abstract_syntax->uuid)),
				map_tower,
				entry_handle,
				max_towers,
				&num_towers,
				&towers);

	if (!NT_STATUS_IS_OK(status)) {
		goto done;
	}

	if (num_towers != 1) {
		status = NT_STATUS_UNSUCCESSFUL;
		goto done;
	}

	/* extract the port from the answer */

	status = dcerpc_binding_from_tower(tmp_ctx,
					   &(towers.twr->tower),
					   &res_binding);
	if (!NT_STATUS_IS_OK(status)) {
		goto done;
	}

	/* are further checks here necessary? */
	if (res_binding->transport != NCACN_IP_TCP) {
		status = NT_STATUS_UNSUCCESSFUL;
		goto done;
	}

	*pport = (uint16_t)atoi(res_binding->endpoint);

done:
	TALLOC_FREE(tmp_ctx);
	return status;
}

/**
 * Create a rpc pipe client struct, connecting to a host via tcp.
 * The port is determined by asking the endpoint mapper on the given
 * host.
 */
NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
			   const struct ndr_syntax_id *abstract_syntax,
			   struct rpc_pipe_client **presult)
{
	NTSTATUS status;
	uint16_t port = 0;

	status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	return rpc_pipe_open_tcp_port(mem_ctx, host, port,
					abstract_syntax, presult);
}

/********************************************************************
 Create a rpc pipe client struct, connecting to a unix domain socket
 ********************************************************************/
NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
			       const struct ndr_syntax_id *abstract_syntax,
			       struct rpc_pipe_client **presult)
{
	struct rpc_pipe_client *result;
	struct sockaddr_un addr;
	NTSTATUS status;
	int fd;

	result = talloc_zero(mem_ctx, struct rpc_pipe_client);
	if (result == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	result->abstract_syntax = *abstract_syntax;
	result->transfer_syntax = ndr_transfer_syntax;
	result->dispatch = cli_do_rpc_ndr;
	result->dispatch_send = cli_do_rpc_ndr_send;
	result->dispatch_recv = cli_do_rpc_ndr_recv;

	result->desthost = get_myname(result);
	result->srv_name_slash = talloc_asprintf_strupper_m(
		result, "\\\\%s", result->desthost);
	if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
		status = NT_STATUS_NO_MEMORY;
		goto fail;
	}

	result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
	result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;

	fd = socket(AF_UNIX, SOCK_STREAM, 0);
	if (fd == -1) {
		status = map_nt_error_from_unix(errno);
		goto fail;
	}

	ZERO_STRUCT(addr);
	addr.sun_family = AF_UNIX;
	strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));

	if (sys_connect(fd, (struct sockaddr *)(void *)&addr) == -1) {
		DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
			  strerror(errno)));
		close(fd);
		return map_nt_error_from_unix(errno);
	}

	status = rpc_transport_sock_init(result, fd, &result->transport);
	if (!NT_STATUS_IS_OK(status)) {
		close(fd);
		goto fail;
	}

	result->transport->transport = NCALRPC;

	*presult = result;
	return NT_STATUS_OK;

 fail:
	TALLOC_FREE(result);
	return status;
}

struct rpc_pipe_client_np_ref {
	struct cli_state *cli;
	struct rpc_pipe_client *pipe;
};

static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
{
	DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
	return 0;
}

/****************************************************************************
 Open a named pipe over SMB to a remote server.
 *
 * CAVEAT CALLER OF THIS FUNCTION:
 *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
 *    so be sure that this function is called AFTER any structure (vs pointer)
 *    assignment of the cli.  In particular, libsmbclient does structure
 *    assignments of cli, which invalidates the data in the returned
 *    rpc_pipe_client if this function is called before the structure assignment
 *    of cli.
 * 
 ****************************************************************************/

static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
				 const struct ndr_syntax_id *abstract_syntax,
				 struct rpc_pipe_client **presult)
{
	struct rpc_pipe_client *result;
	NTSTATUS status;
	struct rpc_pipe_client_np_ref *np_ref;

	/* sanity check to protect against crashes */

	if ( !cli ) {
		return NT_STATUS_INVALID_HANDLE;
	}

	result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
	if (result == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	result->abstract_syntax = *abstract_syntax;
	result->transfer_syntax = ndr_transfer_syntax;
	result->dispatch = cli_do_rpc_ndr;
	result->dispatch_send = cli_do_rpc_ndr_send;
	result->dispatch_recv = cli_do_rpc_ndr_recv;
	result->desthost = talloc_strdup(result, cli->desthost);
	result->srv_name_slash = talloc_asprintf_strupper_m(
		result, "\\\\%s", result->desthost);

	result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
	result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;

	if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
		TALLOC_FREE(result);
		return NT_STATUS_NO_MEMORY;
	}

	status = rpc_transport_np_init(result, cli, abstract_syntax,
				       &result->transport);
	if (!NT_STATUS_IS_OK(status)) {
		TALLOC_FREE(result);
		return status;
	}

	result->transport->transport = NCACN_NP;

	np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
	if (np_ref == NULL) {
		TALLOC_FREE(result);
		return NT_STATUS_NO_MEMORY;
	}
	np_ref->cli = cli;
	np_ref->pipe = result;

	DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
	talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);

	*presult = result;
	return NT_STATUS_OK;
}

NTSTATUS rpc_pipe_open_local(TALLOC_CTX *mem_ctx,
			     struct rpc_cli_smbd_conn *conn,
			     const struct ndr_syntax_id *syntax,
			     struct rpc_pipe_client **presult)
{
	struct rpc_pipe_client *result;
	struct cli_pipe_auth_data *auth;
	NTSTATUS status;

	result = talloc(mem_ctx, struct rpc_pipe_client);
	if (result == NULL) {
		return NT_STATUS_NO_MEMORY;
	}
	result->abstract_syntax = *syntax;
	result->transfer_syntax = ndr_transfer_syntax;
	result->dispatch = cli_do_rpc_ndr;
	result->dispatch_send = cli_do_rpc_ndr_send;
	result->dispatch_recv = cli_do_rpc_ndr_recv;
	result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
	result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;

	result->desthost = talloc_strdup(result, global_myname());
	result->srv_name_slash = talloc_asprintf_strupper_m(
		result, "\\\\%s", global_myname());
	if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
		TALLOC_FREE(result);
		return NT_STATUS_NO_MEMORY;
	}

	status = rpc_transport_smbd_init(result, conn, syntax,
					 &result->transport);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(1, ("rpc_transport_smbd_init failed: %s\n",
			  nt_errstr(status)));
		TALLOC_FREE(result);
		return status;
	}

	status = rpccli_anon_bind_data(result, &auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(1, ("rpccli_anon_bind_data failed: %s\n",
			  nt_errstr(status)));
		TALLOC_FREE(result);
		return status;
	}

	status = rpc_pipe_bind(result, auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(1, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
		TALLOC_FREE(result);
		return status;
	}

	result->transport->transport = NCACN_INTERNAL;

	*presult = result;
	return NT_STATUS_OK;
}

/****************************************************************************
 Open a pipe to a remote server.
 ****************************************************************************/

static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
				  enum dcerpc_transport_t transport,
				  const struct ndr_syntax_id *interface,
				  struct rpc_pipe_client **presult)
{
	switch (transport) {
	case NCACN_IP_TCP:
		return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
					 presult);
	case NCACN_NP:
		return rpc_pipe_open_np(cli, interface, presult);
	default:
		return NT_STATUS_NOT_IMPLEMENTED;
	}
}

/****************************************************************************
 Open a named pipe to an SMB server and bind anonymously.
 ****************************************************************************/

NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
					    enum dcerpc_transport_t transport,
					    const struct ndr_syntax_id *interface,
					    struct rpc_pipe_client **presult)
{
	struct rpc_pipe_client *result;
	struct cli_pipe_auth_data *auth;
	NTSTATUS status;

	status = cli_rpc_pipe_open(cli, transport, interface, &result);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	status = rpccli_anon_bind_data(result, &auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
			  nt_errstr(status)));
		TALLOC_FREE(result);
		return status;
	}

	/*
	 * This is a bit of an abstraction violation due to the fact that an
	 * anonymous bind on an authenticated SMB inherits the user/domain
	 * from the enclosing SMB creds
	 */

	TALLOC_FREE(auth->user_name);
	TALLOC_FREE(auth->domain);

	auth->user_name = talloc_strdup(auth, cli->user_name);
	auth->domain = talloc_strdup(auth, cli->domain);
	auth->user_session_key = data_blob_talloc(auth,
		cli->user_session_key.data,
		cli->user_session_key.length);

	if ((auth->user_name == NULL) || (auth->domain == NULL)) {
		TALLOC_FREE(result);
		return NT_STATUS_NO_MEMORY;
	}

	status = rpc_pipe_bind(result, auth);
	if (!NT_STATUS_IS_OK(status)) {
		int lvl = 0;
		if (ndr_syntax_id_equal(interface,
					&ndr_table_dssetup.syntax_id)) {
			/* non AD domains just don't have this pipe, avoid
			 * level 0 statement in that case - gd */
			lvl = 3;
		}
		DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
			    "%s failed with error %s\n",
			    get_pipe_name_from_syntax(talloc_tos(), interface),
			    nt_errstr(status) ));
		TALLOC_FREE(result);
		return status;
	}

	DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
		  "%s and bound anonymously.\n",
		  get_pipe_name_from_syntax(talloc_tos(), interface),
		  cli->desthost));

	*presult = result;
	return NT_STATUS_OK;
}

/****************************************************************************
 ****************************************************************************/

NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
				  const struct ndr_syntax_id *interface,
				  struct rpc_pipe_client **presult)
{
	return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
						  interface, presult);
}

/****************************************************************************
 Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
 ****************************************************************************/

static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
						   const struct ndr_syntax_id *interface,
						   enum dcerpc_transport_t transport,
						   enum pipe_auth_type auth_type,
						   enum dcerpc_AuthLevel auth_level,
						   const char *domain,
						   const char *username,
						   const char *password,
						   struct rpc_pipe_client **presult)
{
	struct rpc_pipe_client *result;
	struct cli_pipe_auth_data *auth;
	NTSTATUS status;

	status = cli_rpc_pipe_open(cli, transport, interface, &result);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	status = rpccli_ntlmssp_bind_data(
		result, auth_type, auth_level, domain, username,
		password, &auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
			  nt_errstr(status)));
		goto err;
	}

	status = rpc_pipe_bind(result, auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
			nt_errstr(status) ));
		goto err;
	}

	DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
		"machine %s and bound NTLMSSP as user %s\\%s.\n",
		  get_pipe_name_from_syntax(talloc_tos(), interface),
		  cli->desthost, domain, username ));

	*presult = result;
	return NT_STATUS_OK;

  err:

	TALLOC_FREE(result);
	return status;
}

/****************************************************************************
 External interface.
 Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
 ****************************************************************************/

NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
				   const struct ndr_syntax_id *interface,
				   enum dcerpc_transport_t transport,
				   enum dcerpc_AuthLevel auth_level,
				   const char *domain,
				   const char *username,
				   const char *password,
				   struct rpc_pipe_client **presult)
{
	return cli_rpc_pipe_open_ntlmssp_internal(cli,
						interface,
						transport,
						PIPE_AUTH_TYPE_NTLMSSP,
						auth_level,
						domain,
						username,
						password,
						presult);
}

/****************************************************************************
 External interface.
 Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
 ****************************************************************************/

NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
					  const struct ndr_syntax_id *interface,
					  enum dcerpc_transport_t transport,
					  enum dcerpc_AuthLevel auth_level,
					  const char *domain,
					  const char *username,
					  const char *password,
					  struct rpc_pipe_client **presult)
{
	return cli_rpc_pipe_open_ntlmssp_internal(cli,
						interface,
						transport,
						PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
						auth_level,
						domain,
						username,
						password,
						presult);
}

/****************************************************************************
  Get a the schannel session key out of an already opened netlogon pipe.
 ****************************************************************************/
static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
						struct cli_state *cli,
						const char *domain,
						uint32 *pneg_flags)
{
	enum netr_SchannelType sec_chan_type = 0;
	unsigned char machine_pwd[16];
	const char *machine_account;
	NTSTATUS status;

	/* Get the machine account credentials from secrets.tdb. */
	if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
			       &sec_chan_type))
	{
		DEBUG(0, ("get_schannel_session_key: could not fetch "
			"trust account password for domain '%s'\n",
			domain));
		return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
	}

	status = rpccli_netlogon_setup_creds(netlogon_pipe,
					cli->desthost, /* server name */
					domain,	       /* domain */
					global_myname(), /* client name */
					machine_account, /* machine account name */
					machine_pwd,
					sec_chan_type,
					pneg_flags);

	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(3, ("get_schannel_session_key_common: "
			  "rpccli_netlogon_setup_creds failed with result %s "
			  "to server %s, domain %s, machine account %s.\n",
			  nt_errstr(status), cli->desthost, domain,
			  machine_account ));
		return status;
	}

	if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
		DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
			cli->desthost));
		return NT_STATUS_INVALID_NETWORK_RESPONSE;
	}

	return NT_STATUS_OK;;
}

/****************************************************************************
 Open a netlogon pipe and get the schannel session key.
 Now exposed to external callers.
 ****************************************************************************/


NTSTATUS get_schannel_session_key(struct cli_state *cli,
				  const char *domain,
				  uint32 *pneg_flags,
				  struct rpc_pipe_client **presult)
{
	struct rpc_pipe_client *netlogon_pipe = NULL;
	NTSTATUS status;

	status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
					  &netlogon_pipe);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
						 pneg_flags);
	if (!NT_STATUS_IS_OK(status)) {
		TALLOC_FREE(netlogon_pipe);
		return status;
	}

	*presult = netlogon_pipe;
	return NT_STATUS_OK;
}

/****************************************************************************
 External interface.
 Open a named pipe to an SMB server and bind using schannel (bind type 68)
 using session_key. sign and seal.

 The *pdc will be stolen onto this new pipe
 ****************************************************************************/

NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
					     const struct ndr_syntax_id *interface,
					     enum dcerpc_transport_t transport,
					     enum dcerpc_AuthLevel auth_level,
					     const char *domain,
					     struct netlogon_creds_CredentialState **pdc,
					     struct rpc_pipe_client **presult)
{
	struct rpc_pipe_client *result;
	struct cli_pipe_auth_data *auth;
	NTSTATUS status;

	status = cli_rpc_pipe_open(cli, transport, interface, &result);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	status = rpccli_schannel_bind_data(result, domain, auth_level,
					   *pdc, &auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
			  nt_errstr(status)));
		TALLOC_FREE(result);
		return status;
	}

	status = rpc_pipe_bind(result, auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
			  "cli_rpc_pipe_bind failed with error %s\n",
			  nt_errstr(status) ));
		TALLOC_FREE(result);
		return status;
	}

	/*
	 * The credentials on a new netlogon pipe are the ones we are passed
	 * in - reference them in
	 */
	result->dc = talloc_move(result, pdc);

	DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
		  "for domain %s and bound using schannel.\n",
		  get_pipe_name_from_syntax(talloc_tos(), interface),
		  cli->desthost, domain ));

	*presult = result;
	return NT_STATUS_OK;
}

/****************************************************************************
 Open a named pipe to an SMB server and bind using schannel (bind type 68).
 Fetch the session key ourselves using a temporary netlogon pipe. This
 version uses an ntlmssp auth bound netlogon pipe to get the key.
 ****************************************************************************/

static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
						      const char *domain,
						      const char *username,
						      const char *password,
						      uint32 *pneg_flags,
						      struct rpc_pipe_client **presult)
{
	struct rpc_pipe_client *netlogon_pipe = NULL;
	NTSTATUS status;

	status = cli_rpc_pipe_open_spnego_ntlmssp(
		cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
		DCERPC_AUTH_LEVEL_PRIVACY,
		domain, username, password, &netlogon_pipe);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
						 pneg_flags);
	if (!NT_STATUS_IS_OK(status)) {
		TALLOC_FREE(netlogon_pipe);
		return status;
	}

	*presult = netlogon_pipe;
	return NT_STATUS_OK;
}

/****************************************************************************
 Open a named pipe to an SMB server and bind using schannel (bind type 68).
 Fetch the session key ourselves using a temporary netlogon pipe. This version
 uses an ntlmssp bind to get the session key.
 ****************************************************************************/

NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
						 const struct ndr_syntax_id *interface,
						 enum dcerpc_transport_t transport,
						 enum dcerpc_AuthLevel auth_level,
						 const char *domain,
						 const char *username,
						 const char *password,
						 struct rpc_pipe_client **presult)
{
	uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
	struct rpc_pipe_client *netlogon_pipe = NULL;
	struct rpc_pipe_client *result = NULL;
	NTSTATUS status;

	status = get_schannel_session_key_auth_ntlmssp(
		cli, domain, username, password, &neg_flags, &netlogon_pipe);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
			"key from server %s for domain %s.\n",
			cli->desthost, domain ));
		return status;
	}

	status = cli_rpc_pipe_open_schannel_with_key(
		cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
		&result);

	/* Now we've bound using the session key we can close the netlog pipe. */
	TALLOC_FREE(netlogon_pipe);

	if (NT_STATUS_IS_OK(status)) {
		*presult = result;
	}
	return status;
}

/****************************************************************************
 Open a named pipe to an SMB server and bind using schannel (bind type 68).
 Fetch the session key ourselves using a temporary netlogon pipe.
 ****************************************************************************/

NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
				    const struct ndr_syntax_id *interface,
				    enum dcerpc_transport_t transport,
				    enum dcerpc_AuthLevel auth_level,
				    const char *domain,
				    struct rpc_pipe_client **presult)
{
	uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
	struct rpc_pipe_client *netlogon_pipe = NULL;
	struct rpc_pipe_client *result = NULL;
	NTSTATUS status;

	status = get_schannel_session_key(cli, domain, &neg_flags,
					  &netlogon_pipe);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
			"key from server %s for domain %s.\n",
			cli->desthost, domain ));
		return status;
	}

	status = cli_rpc_pipe_open_schannel_with_key(
		cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
		&result);

	/* Now we've bound using the session key we can close the netlog pipe. */
	TALLOC_FREE(netlogon_pipe);

	if (NT_STATUS_IS_OK(status)) {
		*presult = result;
	}

	return status;
}

/****************************************************************************
 Open a named pipe to an SMB server and bind using krb5 (bind type 16).
 The idea is this can be called with service_princ, username and password all
 NULL so long as the caller has a TGT.
 ****************************************************************************/

NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
				const struct ndr_syntax_id *interface,
				enum dcerpc_AuthLevel auth_level,
				const char *service_princ,
				const char *username,
				const char *password,
				struct rpc_pipe_client **presult)
{
#ifdef HAVE_KRB5
	struct rpc_pipe_client *result;
	struct cli_pipe_auth_data *auth;
	NTSTATUS status;

	status = cli_rpc_pipe_open(cli, NCACN_NP, interface, &result);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	status = rpccli_kerberos_bind_data(result, auth_level, service_princ,
					   username, password, &auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("rpccli_kerberos_bind_data returned %s\n",
			  nt_errstr(status)));
		TALLOC_FREE(result);
		return status;
	}

	status = rpc_pipe_bind(result, auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
			  "with error %s\n", nt_errstr(status)));
		TALLOC_FREE(result);
		return status;
	}

	*presult = result;
	return NT_STATUS_OK;
#else
	DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
	return NT_STATUS_NOT_IMPLEMENTED;
#endif
}

NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
			     struct rpc_pipe_client *cli,
			     DATA_BLOB *session_key)
{
	if (!session_key || !cli) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	if (!cli->auth) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	switch (cli->auth->auth_type) {
		case PIPE_AUTH_TYPE_SCHANNEL:
			*session_key = data_blob_talloc(mem_ctx,
				cli->auth->a_u.schannel_auth->creds->session_key, 16);
			break;
		case PIPE_AUTH_TYPE_NTLMSSP:
		case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
			*session_key = data_blob_talloc(mem_ctx,
				cli->auth->a_u.ntlmssp_state->session_key.data,
				cli->auth->a_u.ntlmssp_state->session_key.length);
			break;
		case PIPE_AUTH_TYPE_KRB5:
		case PIPE_AUTH_TYPE_SPNEGO_KRB5:
			*session_key = data_blob_talloc(mem_ctx,
				cli->auth->a_u.kerberos_auth->session_key.data,
				cli->auth->a_u.kerberos_auth->session_key.length);
			break;
		case PIPE_AUTH_TYPE_NONE:
			*session_key = data_blob_talloc(mem_ctx,
				cli->auth->user_session_key.data,
				cli->auth->user_session_key.length);
			break;
		default:
			return NT_STATUS_NO_USER_SESSION_KEY;
	}

	return NT_STATUS_OK;
}