Changeset 740 for vendor/current/source3/rpc_client

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

Location:

vendor/current/source3/rpc_client

Files:

• cli_lsarpc.c (modified) (32 diffs)
• cli_lsarpc.h (added)
• cli_netlogon.c (modified) (27 diffs)
• cli_netlogon.h (added)
• cli_pipe.c (modified) (86 diffs)
• cli_pipe.h (added)
• cli_pipe_schannel.c (added)
• cli_samr.c (modified) (16 diffs)
• cli_samr.h (added)
• cli_spoolss.c (modified) (64 diffs)
• cli_spoolss.h (added)
• cli_winreg.c (added)
• cli_winreg.h (added)
• cli_winreg_int.c (added)
• cli_winreg_int.h (added)
• cli_winreg_spoolss.c (added)
• cli_winreg_spoolss.h (added)
• init_lsa.c (modified) (1 diff)
• init_lsa.h (added)
• init_netlogon.c (modified) (1 diff)
• init_netlogon.h (added)
• init_samr.c (modified) (1 diff)
• init_samr.h (added)
• init_spoolss.c (modified) (5 diffs)
• init_spoolss.h (added)
• ndr.c (deleted)
• rpc_client.h (added)
• rpc_transport.h (added)
• rpc_transport_np.c (modified) (7 diffs)
• rpc_transport_smbd.c (deleted)
• rpc_transport_sock.c (modified) (2 diffs)
• rpc_transport_tstream.c (added)
• util_netlogon.c (added)
• util_netlogon.h (added)

vendor/current/source3/rpc_client/cli_lsarpc.c

@@ -24 +24 @@
 
 #include "includes.h"
-#include "../librpc/gen_ndr/cli_lsa.h"
+#include "rpc_client/rpc_client.h"
+#include "../librpc/gen_ndr/ndr_lsa_c.h"
+#include "rpc_client/cli_lsarpc.h"
+#include "rpc_client/init_lsa.h"
+#include "../libcli/security/security.h"
 
 /** @defgroup lsa LSA - Local Security Architecture
@@ -39 +43 @@
  **/
 
-/** Open a LSA policy handle
- *
- * @param cli Handle on an initialised SMB connection */
-
-NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
+NTSTATUS dcerpc_lsa_open_policy(struct dcerpc_binding_handle *h,
                                 TALLOC_CTX *mem_ctx,
-                                bool sec_qos, uint32 des_access,
-                                struct policy_handle *pol)
+                                bool sec_qos,
+                                uint32_t des_access,
+                                struct policy_handle *pol,
+                                NTSTATUS *result)
 {
         struct lsa_ObjectAttribute attr;
@@ -65 +67 @@
         }
 
-        return rpccli_lsa_OpenPolicy(cli, mem_ctx,
+        return dcerpc_lsa_OpenPolicy(h,
+                                     mem_ctx,
                                      &system_name,
                                      &attr,
                                      des_access,
-                                     pol);
+                                     pol,
+                                     result);
 }
 
 /** Open a LSA policy handle
-  *
-  * @param cli Handle on an initialised SMB connection
-  */
-
-NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
-                                 TALLOC_CTX *mem_ctx, bool sec_qos,
-                                 uint32 des_access, struct policy_handle *pol)
+ *
+ * @param cli Handle on an initialised SMB connection */
+
+NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
+                                TALLOC_CTX *mem_ctx,
+                                bool sec_qos, uint32 des_access,
+                                struct policy_handle *pol)
+{
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_lsa_open_policy(cli->binding_handle,
+                                        mem_ctx,
+                                        sec_qos,
+                                        des_access,
+                                        pol,
+                                        &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        return result;
+}
+
+NTSTATUS dcerpc_lsa_open_policy2(struct dcerpc_binding_handle *h,
+                                 TALLOC_CTX *mem_ctx,
+                                 const char *srv_name_slash,
+                                 bool sec_qos,
+                                 uint32_t des_access,
+                                 struct policy_handle *pol,
+                                 NTSTATUS *result)
 {
         struct lsa_ObjectAttribute attr;
@@ -97 +125 @@
         }
 
-        return rpccli_lsa_OpenPolicy2(cli, mem_ctx,
-                                      cli->srv_name_slash,
+        return dcerpc_lsa_OpenPolicy2(h,
+                                      mem_ctx,
+                                      srv_name_slash,
                                       &attr,
                                       des_access,
-                                      pol);
+                                      pol,
+                                      result);
+}
+
+/** Open a LSA policy handle
+  *
+  * @param cli Handle on an initialised SMB connection
+  */
+
+NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
+                                 TALLOC_CTX *mem_ctx, bool sec_qos,
+                                 uint32 des_access, struct policy_handle *pol)
+{
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_lsa_open_policy2(cli->binding_handle,
+                                         mem_ctx,
+                                         cli->srv_name_slash,
+                                         sec_qos,
+                                         des_access,
+                                         pol,
+                                         &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        return result;
 }
 
@@ -107 +163 @@
  *
  * internal version withOUT memory allocation of the target arrays.
- * this assumes suffciently sized arrays to store domains, names and types. */
-
-static NTSTATUS rpccli_lsa_lookup_sids_noalloc(struct rpc_pipe_client *cli,
+ * this assumes sufficiently sized arrays to store domains, names and types. */
+
+static NTSTATUS dcerpc_lsa_lookup_sids_noalloc(struct dcerpc_binding_handle *h,
                                                TALLOC_CTX *mem_ctx,
                                                struct policy_handle *pol,
                                                int num_sids,
-                                               const DOM_SID *sids,
+                                               const struct dom_sid *sids,
                                                char **domains,
                                                char **names,
                                                enum lsa_SidType *types,
-                                               bool use_lookupsids3)
-{
-        NTSTATUS result = NT_STATUS_OK;
-        TALLOC_CTX *tmp_ctx = NULL;
-        int i;
+                                               bool use_lookupsids3,
+                                               NTSTATUS *presult)
+{
+        NTSTATUS status = NT_STATUS_OK;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
         struct lsa_SidArray sid_array;
         struct lsa_RefDomainList *ref_domains = NULL;
         struct lsa_TransNameArray lsa_names;
+        enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_ALL;
         uint32_t count = 0;
-        uint16_t level = 1;
+        int i;
 
         ZERO_STRUCT(lsa_names);
-
-        tmp_ctx = talloc_new(mem_ctx);
-        if (!tmp_ctx) {
-                DEBUG(0, ("rpccli_lsa_lookup_sids_noalloc: out of memory!\n"));
-                result = NT_STATUS_UNSUCCESSFUL;
-                goto done;
-        }
 
         sid_array.num_sids = num_sids;
         sid_array.sids = TALLOC_ARRAY(mem_ctx, struct lsa_SidPtr, num_sids);
-        if (!sid_array.sids) {
+        if (sid_array.sids == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
 
         for (i = 0; i<num_sids; i++) {
-                sid_array.sids[i].sid = sid_dup_talloc(mem_ctx, &sids[i]);
+                sid_array.sids[i].sid = dom_sid_dup(mem_ctx, &sids[i]);
                 if (!sid_array.sids[i].sid) {
                         return NT_STATUS_NO_MEMORY;
@@ -156 +206 @@
                 ZERO_STRUCT(lsa_names2);
 
-                result = rpccli_lsa_LookupSids3(cli, mem_ctx,
+                status = dcerpc_lsa_LookupSids3(h,
+                                                mem_ctx,
                                                 &sid_array,
                                                 &ref_domains,
@@ -162 +213 @@
                                                 level,
                                                 &count,
-                                                0,
-                                                0);
-
-                if (!NT_STATUS_IS_ERR(result)) {
-                        lsa_names.count = lsa_names2.count;
-                        lsa_names.names = talloc_array(mem_ctx, struct lsa_TranslatedName, lsa_names.count);
-                        if (!lsa_names.names) {
+                                                LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES,
+                                                LSA_CLIENT_REVISION_2,
+                                                &result);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                if(!NT_STATUS_IS_ERR(result)) {
+                        lsa_names.count = lsa_names2.count;
+                        lsa_names.names = talloc_array(mem_ctx,
+                                                       struct lsa_TranslatedName,
+                                                       lsa_names.count);
+                        if (lsa_names.names == NULL) {
                                 return NT_STATUS_NO_MEMORY;
                         }
@@ -179 +236 @@
 
         } else {
-                result = rpccli_lsa_LookupSids(cli, mem_ctx,
+                status = dcerpc_lsa_LookupSids(h,
+                                               mem_ctx,
                                                pol,
                                                &sid_array,
@@ -185 +243 @@
                                                &lsa_names,
                                                level,
-                                               &count);
-        }
-
-        DEBUG(10, ("LSA_LOOKUPSIDS returned '%s', mapped count = %d'\n",
-                   nt_errstr(result), count));
+                                               &count,
+                                               &result);
+        }
+
+        DEBUG(10, ("LSA_LOOKUPSIDS returned status: '%s', result: '%s', "
+                   "mapped count = %d'\n",
+                   nt_errstr(status), nt_errstr(result), count));
+
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         if (!NT_STATUS_IS_OK(result) &&
@@ -195 +259 @@
             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
         {
-                /* An actual error occured */
-                goto done;
+                *presult = result;
+                return status;
         }
 
         /* Return output parameters */
-
         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) ||
             (count == 0))
@@ -209 +272 @@
                         (types)[i] = SID_NAME_UNKNOWN;
                 }
-                result = NT_STATUS_NONE_MAPPED;
-                goto done;
+                *presult = NT_STATUS_NONE_MAPPED;
+                return status;
         }
 
@@ -225 +288 @@
 
                         if (name) {
-                                (names)[i] = talloc_strdup(mem_ctx, name);
+                                (names)[i] = talloc_strdup(names, name);
                                 if ((names)[i] == NULL) {
                                         DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
-                                        result = NT_STATUS_UNSUCCESSFUL;
-                                        goto done;
+                                        *presult = NT_STATUS_UNSUCCESSFUL;
+                                        return status;
                                 }
                         } else {
                                 (names)[i] = NULL;
                         }
-                        domains[i] = talloc_strdup(
-                                mem_ctx, dom_name ? dom_name : "");
+                        domains[i] = talloc_strdup(domains,
+                                                   dom_name ? dom_name : "");
                         (types)[i] = lsa_names.names[i].sid_type;
                         if (((domains)[i] == NULL)) {
                                 DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
-                                result = NT_STATUS_UNSUCCESSFUL;
-                                goto done;
+                                *presult = NT_STATUS_UNSUCCESSFUL;
+                                return status;
                         }
 
@@ -250 +313 @@
         }
 
-done:
-        TALLOC_FREE(tmp_ctx);
-        return result;
+        *presult = NT_STATUS_OK;
+        return status;
 }
 
@@ -267 +329 @@
 #define LOOKUP_SIDS_HUNK_SIZE 1000
 
-static NTSTATUS rpccli_lsa_lookup_sids_generic(struct rpc_pipe_client *cli,
+static NTSTATUS dcerpc_lsa_lookup_sids_generic(struct dcerpc_binding_handle *h,
                                                TALLOC_CTX *mem_ctx,
                                                struct policy_handle *pol,
                                                int num_sids,
-                                               const DOM_SID *sids,
+                                               const struct dom_sid *sids,
                                                char ***pdomains,
                                                char ***pnames,
                                                enum lsa_SidType **ptypes,
-                                               bool use_lookupsids3)
-{
+                                               bool use_lookupsids3,
+                                               NTSTATUS *presult)
+{
+        NTSTATUS status = NT_STATUS_OK;
         NTSTATUS result = NT_STATUS_OK;
         int sids_left = 0;
         int sids_processed = 0;
-        const DOM_SID *hunk_sids = sids;
+        const struct dom_sid *hunk_sids = sids;
         char **hunk_domains;
         char **hunk_names;
@@ -287 +351 @@
         char **names = NULL;
         enum lsa_SidType *types = NULL;
+        bool have_mapped = false;
+        bool have_unmapped = false;
 
         if (num_sids) {
                 if (!(domains = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
-                        result = NT_STATUS_NO_MEMORY;
+                        status = NT_STATUS_NO_MEMORY;
                         goto fail;
                 }
@@ -297 +363 @@
                 if (!(names = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
-                        result = NT_STATUS_NO_MEMORY;
+                        status = NT_STATUS_NO_MEMORY;
                         goto fail;
                 }
@@ -303 +369 @@
                 if (!(types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
-                        result = NT_STATUS_NO_MEMORY;
+                        status = NT_STATUS_NO_MEMORY;
                         goto fail;
                 }
@@ -315 +381 @@
         while (sids_left > 0) {
                 int hunk_num_sids;
-                NTSTATUS hunk_result = NT_STATUS_OK;
+                NTSTATUS hunk_result = NT_STATUS_UNSUCCESSFUL;
 
                 hunk_num_sids = ((sids_left > LOOKUP_SIDS_HUNK_SIZE)
@@ -327 +393 @@
                            num_sids));
 
-                hunk_result = rpccli_lsa_lookup_sids_noalloc(cli,
-                                                             mem_ctx,
-                                                             pol,
-                                                             hunk_num_sids,
-                                                             hunk_sids,
-                                                             hunk_domains,
-                                                             hunk_names,
-                                                             hunk_types,
-                                                             use_lookupsids3);
+                status = dcerpc_lsa_lookup_sids_noalloc(h,
+                                                        mem_ctx,
+                                                        pol,
+                                                        hunk_num_sids,
+                                                        hunk_sids,
+                                                        hunk_domains,
+                                                        hunk_names,
+                                                        hunk_types,
+                                                        use_lookupsids3,
+                                                        &hunk_result);
+                if (!NT_STATUS_IS_OK(status)) {
+                        goto fail;
+                }
 
                 if (!NT_STATUS_IS_OK(hunk_result) &&
@@ -342 +412 @@
                 {
                         /* An actual error occured */
-                        result = hunk_result;
+                        *presult = hunk_result;
                         goto fail;
                 }
 
-                /* adapt overall result */
-                if (( NT_STATUS_IS_OK(result) &&
-                     !NT_STATUS_IS_OK(hunk_result))
-                    ||
-                    ( NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
-                     !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)))
-                {
-                        result = STATUS_SOME_UNMAPPED;
+                if (NT_STATUS_IS_OK(hunk_result)) {
+                        have_mapped = true;
+                }
+                if (NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)) {
+                        have_unmapped = true;
+                }
+                if (NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED)) {
+                        int i;
+                        for (i=0; i<hunk_num_sids; i++) {
+                                if (hunk_types[i] == SID_NAME_UNKNOWN) {
+                                        have_unmapped = true;
+                                } else {
+                                        have_mapped = true;
+                                }
+                        }
                 }
 
@@ -367 +444 @@
         *pnames = names;
         *ptypes = types;
-        return result;
+
+        if (!have_mapped) {
+                result = NT_STATUS_NONE_MAPPED;
+        }
+        if (have_unmapped) {
+                result = STATUS_SOME_UNMAPPED;
+        }
+        *presult = result;
+
+        return status;
 
 fail:
@@ -373 +459 @@
         TALLOC_FREE(names);
         TALLOC_FREE(types);
-        return result;
+
+        return status;
+}
+
+NTSTATUS dcerpc_lsa_lookup_sids(struct dcerpc_binding_handle *h,
+                                TALLOC_CTX *mem_ctx,
+                                struct policy_handle *pol,
+                                int num_sids,
+                                const struct dom_sid *sids,
+                                char ***pdomains,
+                                char ***pnames,
+                                enum lsa_SidType **ptypes,
+                                NTSTATUS *result)
+{
+        return dcerpc_lsa_lookup_sids_generic(h,
+                                              mem_ctx,
+                                              pol,
+                                              num_sids,
+                                              sids,
+                                              pdomains,
+                                              pnames,
+                                              ptypes,
+                                              false,
+                                              result);
 }
 
@@ -380 +489 @@
                                 struct policy_handle *pol,
                                 int num_sids,
-                                const DOM_SID *sids,
+                                const struct dom_sid *sids,
                                 char ***pdomains,
                                 char ***pnames,
                                 enum lsa_SidType **ptypes)
 {
-        return rpccli_lsa_lookup_sids_generic(cli, mem_ctx, pol, num_sids, sids,
-                                              pdomains, pnames, ptypes, false);
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_lsa_lookup_sids_generic(cli->binding_handle,
+                                                mem_ctx,
+                                                pol,
+                                                num_sids,
+                                                sids,
+                                                pdomains,
+                                                pnames,
+                                                ptypes,
+                                                false,
+                                                &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        return result;
+}
+
+NTSTATUS dcerpc_lsa_lookup_sids3(struct dcerpc_binding_handle *h,
+                                 TALLOC_CTX *mem_ctx,
+                                 struct policy_handle *pol,
+                                 int num_sids,
+                                 const struct dom_sid *sids,
+                                 char ***pdomains,
+                                 char ***pnames,
+                                 enum lsa_SidType **ptypes,
+                                 NTSTATUS *result)
+{
+        return dcerpc_lsa_lookup_sids_generic(h,
+                                              mem_ctx,
+                                              pol,
+                                              num_sids,
+                                              sids,
+                                              pdomains,
+                                              pnames,
+                                              ptypes,
+                                              true,
+                                              result);
 }
 
@@ -393 +540 @@
                                  struct policy_handle *pol,
                                  int num_sids,
-                                 const DOM_SID *sids,
+                                 const struct dom_sid *sids,
                                  char ***pdomains,
                                  char ***pnames,
                                  enum lsa_SidType **ptypes)
 {
-        return rpccli_lsa_lookup_sids_generic(cli, mem_ctx, pol, num_sids, sids,
-                                              pdomains, pnames, ptypes, true);
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_lsa_lookup_sids_generic(cli->binding_handle,
+                                                mem_ctx,
+                                                pol,
+                                                num_sids,
+                                                sids,
+                                                pdomains,
+                                                pnames,
+                                                ptypes,
+                                                true,
+                                                &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        return result;
 }
 
 /** Lookup a list of names */
 
-static NTSTATUS rpccli_lsa_lookup_names_generic(struct rpc_pipe_client *cli,
+static NTSTATUS dcerpc_lsa_lookup_names_generic(struct dcerpc_binding_handle *h,
                                                 TALLOC_CTX *mem_ctx,
-                                                struct policy_handle *pol, int num_names,
+                                                struct policy_handle *pol,
+                                                uint32_t num_names,
                                                 const char **names,
                                                 const char ***dom_names,
-                                                int level,
-                                                DOM_SID **sids,
+                                                enum lsa_LookupNamesLevel level,
+                                                struct dom_sid **sids,
                                                 enum lsa_SidType **types,
-                                                bool use_lookupnames4)
-{
-        NTSTATUS result;
-        int i;
+                                                bool use_lookupnames4,
+                                                NTSTATUS *presult)
+{
+        NTSTATUS status;
         struct lsa_String *lsa_names = NULL;
         struct lsa_RefDomainList *domains = NULL;
@@ -421 +585 @@
         struct lsa_TransSidArray3 sid_array3;
         uint32_t count = 0;
+        uint32_t i;
 
         ZERO_STRUCT(sid_array);
@@ -426 +591 @@
 
         lsa_names = TALLOC_ARRAY(mem_ctx, struct lsa_String, num_names);
-        if (!lsa_names) {
+        if (lsa_names == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
 
-        for (i=0; i<num_names; i++) {
+        for (i = 0; i < num_names; i++) {
                 init_lsa_String(&lsa_names[i], names[i]);
         }
 
         if (use_lookupnames4) {
-                result = rpccli_lsa_LookupNames4(cli, mem_ctx,
+                status = dcerpc_lsa_LookupNames4(h,
+                                                 mem_ctx,
                                                  num_names,
                                                  lsa_names,
@@ -442 +608 @@
                                                  level,
                                                  &count,
-                                                 0,
-                                                 0);
+                                                 LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES,
+                                                 LSA_CLIENT_REVISION_2,
+                                                 presult);
         } else {
-                result = rpccli_lsa_LookupNames(cli, mem_ctx,
-                                                pol,
+                status = dcerpc_lsa_LookupNames(h,
+                                                mem_ctx,
+                                                pol,
                                                 num_names,
                                                 lsa_names,
@@ -452 +620 @@
                                                 &sid_array,
                                                 level,
-                                                &count);
-        }
-
-        if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
-            NT_STATUS_V(STATUS_SOME_UNMAPPED)) {
-
+                                                &count,
+                                                presult);
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+
+        if (!NT_STATUS_IS_OK(*presult) &&
+            !NT_STATUS_EQUAL(*presult, STATUS_SOME_UNMAPPED)) {
                 /* An actual error occured */
-
                 goto done;
         }
 
         /* Return output parameters */
-
         if (count == 0) {
-                result = NT_STATUS_NONE_MAPPED;
+                *presult = NT_STATUS_NONE_MAPPED;
                 goto done;
         }
 
         if (num_names) {
-                if (!((*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_names)))) {
+                if (!((*sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, num_names)))) {
                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
-                        result = NT_STATUS_NO_MEMORY;
+                        *presult = NT_STATUS_NO_MEMORY;
                         goto done;
                 }
@@ -479 +648 @@
                 if (!((*types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_names)))) {
                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
-                        result = NT_STATUS_NO_MEMORY;
+                        *presult = NT_STATUS_NO_MEMORY;
                         goto done;
                 }
@@ -487 +656 @@
                         if (*dom_names == NULL) {
                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
-                                result = NT_STATUS_NO_MEMORY;
+                                *presult = NT_STATUS_NO_MEMORY;
                                 goto done;
                         }
@@ -501 +670 @@
         for (i = 0; i < num_names; i++) {
                 uint32_t dom_idx;
-                DOM_SID *sid = &(*sids)[i];
+                struct dom_sid *sid = &(*sids)[i];
 
                 if (use_lookupnames4) {
@@ -538 +707 @@
 
  done:
-
-        return result;
+        return status;
+}
+
+NTSTATUS dcerpc_lsa_lookup_names(struct dcerpc_binding_handle *h,
+                                 TALLOC_CTX *mem_ctx,
+                                 struct policy_handle *pol,
+                                 uint32_t num_names,
+                                 const char **names,
+                                 const char ***dom_names,
+                                 enum lsa_LookupNamesLevel level,
+                                 struct dom_sid **sids,
+                                 enum lsa_SidType **types,
+                                 NTSTATUS *result)
+{
+        return dcerpc_lsa_lookup_names_generic(h,
+                                               mem_ctx,
+                                               pol,
+                                               num_names,
+                                               names,
+                                               dom_names,
+                                               level,
+                                               sids,
+                                               types,
+                                               false,
+                                               result);
 }
 
 NTSTATUS rpccli_lsa_lookup_names(struct rpc_pipe_client *cli,
                                  TALLOC_CTX *mem_ctx,
-                                 struct policy_handle *pol, int num_names,
+                                 struct policy_handle *pol,
+                                 int num_names,
                                  const char **names,
                                  const char ***dom_names,
                                  int level,
-                                 DOM_SID **sids,
+                                 struct dom_sid **sids,
                                  enum lsa_SidType **types)
 {
-        return rpccli_lsa_lookup_names_generic(cli, mem_ctx, pol, num_names,
-                                               names, dom_names, level, sids,
-                                               types, false);
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_lsa_lookup_names(cli->binding_handle,
+                                         mem_ctx,
+                                         pol,
+                                         num_names,
+                                         names,
+                                         dom_names,
+                                         level,
+                                         sids,
+                                         types,
+                                         &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        return result;
+}
+
+NTSTATUS dcerpc_lsa_lookup_names4(struct dcerpc_binding_handle *h,
+                                  TALLOC_CTX *mem_ctx,
+                                  struct policy_handle *pol,
+                                  uint32_t num_names,
+                                  const char **names,
+                                  const char ***dom_names,
+                                  enum lsa_LookupNamesLevel level,
+                                  struct dom_sid **sids,
+                                  enum lsa_SidType **types,
+                                  NTSTATUS *result)
+{
+        return dcerpc_lsa_lookup_names_generic(h,
+                                               mem_ctx,
+                                               pol,
+                                               num_names,
+                                               names,
+                                               dom_names,
+                                               level,
+                                               sids,
+                                               types,
+                                               true,
+                                               result);
 }
 
 NTSTATUS rpccli_lsa_lookup_names4(struct rpc_pipe_client *cli,
                                   TALLOC_CTX *mem_ctx,
-                                  struct policy_handle *pol, int num_names,
+                                  struct policy_handle *pol,
+                                  int num_names,
                                   const char **names,
                                   const char ***dom_names,
                                   int level,
-                                  DOM_SID **sids,
+                                  struct dom_sid **sids,
                                   enum lsa_SidType **types)
 {
-        return rpccli_lsa_lookup_names_generic(cli, mem_ctx, pol, num_names,
-                                               names, dom_names, level, sids,
-                                               types, true);
-}
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_lsa_lookup_names4(cli->binding_handle,
+                                          mem_ctx,
+                                          pol,
+                                          num_names,
+                                          names,
+                                          dom_names,
+                                          level,
+                                          sids,
+                                          types,
+                                          &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        return result;
+}

vendor/current/source3/rpc_client/cli_netlogon.c

@@ -22 +22 @@
 
 #include "includes.h"
+#include "rpc_client/rpc_client.h"
 #include "../libcli/auth/libcli_auth.h"
-#include "../librpc/gen_ndr/cli_netlogon.h"
+#include "../librpc/gen_ndr/ndr_netlogon_c.h"
+#include "rpc_client/cli_netlogon.h"
+#include "rpc_client/init_netlogon.h"
+#include "rpc_client/util_netlogon.h"
+#include "../libcli/security/security.h"
 
 /****************************************************************************
@@ -40 +45 @@
                                      uint32_t *neg_flags_inout)
 {
+        NTSTATUS status;
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
         struct netr_Credential clnt_chal_send;
@@ -47 +53 @@
         fstring mach_acct;
         uint32_t neg_flags = *neg_flags_inout;
+        struct dcerpc_binding_handle *b = cli->binding_handle;
 
         if (!ndr_syntax_id_equal(&cli->abstract_syntax,
@@ -65 +72 @@
 
         /* Get the server challenge. */
-        result = rpccli_netr_ServerReqChallenge(cli, talloc_tos(),
+        status = dcerpc_netr_ServerReqChallenge(b, talloc_tos(),
                                                 cli->srv_name_slash,
                                                 clnt_name,
                                                 &clnt_chal_send,
-                                                &srv_chal_recv);
+                                                &srv_chal_recv,
+                                                &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
         if (!NT_STATUS_IS_OK(result)) {
                 return result;
@@ -75 +86 @@
 
         /* Calculate the session key and client credentials */
-        
+
         cli->dc = netlogon_creds_client_init(cli,
                                     mach_acct,
@@ -93 +104 @@
          */
 
-        result = rpccli_netr_ServerAuthenticate2(cli, talloc_tos(),
+        status = dcerpc_netr_ServerAuthenticate2(b, talloc_tos(),
                                                  cli->srv_name_slash,
                                                  cli->dc->account_name,
@@ -100 +111 @@
                                                  &clnt_chal_send, /* input. */
                                                  &srv_chal_recv, /* output. */
-                                                 &neg_flags);
-
+                                                 &neg_flags,
+                                                 &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
         /* we might be talking to NT4, so let's downgrade in that case and retry
          * with the returned neg_flags - gd */
@@ -149 +163 @@
                                    const char *password,
                                    const char *workstation,
+                                   uint16_t validation_level,
                                    int logon_type)
 {
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+        NTSTATUS status;
         struct netr_Authenticator clnt_creds;
         struct netr_Authenticator ret_creds;
@@ -157 +173 @@
         union netr_Validation validation;
         uint8_t authoritative;
-        int validation_level = 3;
         fstring clnt_name_slash;
-        uint8 zeros[16];
+        struct dcerpc_binding_handle *b = cli->binding_handle;
 
         ZERO_STRUCT(ret_creds);
-        ZERO_STRUCT(zeros);
 
         logon = TALLOC_ZERO_P(mem_ctx, union netr_LogonLevel);
@@ -264 +278 @@
         }
 
-        result = rpccli_netr_LogonSamLogon(cli, mem_ctx,
+        status = dcerpc_netr_LogonSamLogon(b, mem_ctx,
                                            cli->srv_name_slash,
                                            global_myname(),
@@ -273 +287 @@
                                            validation_level,
                                            &validation,
-                                           &authoritative);
+                                           &authoritative,
+                                           &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         /* Always check returned credentials */
@@ -282 +300 @@
 
         return result;
-}
-
-#define COPY_LSA_STRING(mem_ctx, in, out, name) do { \
-        if (in->name.string) { \
-                out->name.string = talloc_strdup(mem_ctx, in->name.string); \
-                NT_STATUS_HAVE_NO_MEMORY(out->name.string); \
-        } \
-} while (0)
-
-static NTSTATUS copy_netr_SamBaseInfo(TALLOC_CTX *mem_ctx,
-                                      const struct netr_SamBaseInfo *in,
-                                      struct netr_SamBaseInfo *out)
-{
-        /* first copy all, then realloc pointers */
-        *out = *in;
-
-        COPY_LSA_STRING(mem_ctx, in, out, account_name);
-        COPY_LSA_STRING(mem_ctx, in, out, full_name);
-        COPY_LSA_STRING(mem_ctx, in, out, logon_script);
-        COPY_LSA_STRING(mem_ctx, in, out, profile_path);
-        COPY_LSA_STRING(mem_ctx, in, out, home_directory);
-        COPY_LSA_STRING(mem_ctx, in, out, home_drive);
-
-        if (in->groups.count) {
-                out->groups.rids = (struct samr_RidWithAttribute *)
-                        talloc_memdup(mem_ctx, in->groups.rids,
-                                (sizeof(struct samr_RidWithAttribute) *
-                                        in->groups.count));
-                NT_STATUS_HAVE_NO_MEMORY(out->groups.rids);
-        }
-
-        COPY_LSA_STRING(mem_ctx, in, out, logon_server);
-        COPY_LSA_STRING(mem_ctx, in, out, domain);
-
-        if (in->domain_sid) {
-                out->domain_sid = sid_dup_talloc(mem_ctx, in->domain_sid);
-                NT_STATUS_HAVE_NO_MEMORY(out->domain_sid);
-        }
-
-        return NT_STATUS_OK;
 }
 
@@ -391 +369 @@
 {
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+        NTSTATUS status;
         const char *workstation_name_slash;
         const char *server_name_slash;
-        uint8 zeros[16];
         struct netr_Authenticator clnt_creds;
         struct netr_Authenticator ret_creds;
@@ -402 +380 @@
         struct netr_ChallengeResponse lm;
         struct netr_ChallengeResponse nt;
+        struct dcerpc_binding_handle *b = cli->binding_handle;
 
         *info3 = NULL;
 
-        ZERO_STRUCT(zeros);
         ZERO_STRUCT(ret_creds);
 
@@ -462 +440 @@
         /* Marshall data and send request */
 
-        result = rpccli_netr_LogonSamLogon(cli, mem_ctx,
+        status = dcerpc_netr_LogonSamLogon(b, mem_ctx,
                                            server_name_slash,
                                            global_myname(),
@@ -471 +449 @@
                                            validation_level,
                                            &validation,
-                                           &authoritative);
-        if (!NT_STATUS_IS_OK(result)) {
-                return result;
+                                           &authoritative,
+                                           &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
         }
 
@@ -480 +459 @@
                 DEBUG(0,("rpccli_netlogon_sam_network_logon: credentials chain check failed\n"));
                 return NT_STATUS_ACCESS_DENIED;
+        }
+
+        if (!NT_STATUS_IS_OK(result)) {
+                return result;
         }
 
@@ -506 +489 @@
 {
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+        NTSTATUS status;
         const char *workstation_name_slash;
         const char *server_name_slash;
-        uint8 zeros[16];
         union netr_LogonLevel *logon = NULL;
         struct netr_NetworkInfo *network_info;
@@ -516 +499 @@
         struct netr_ChallengeResponse nt;
         uint32_t flags = 0;
+        struct dcerpc_binding_handle *b = cli->binding_handle;
 
         *info3 = NULL;
-
-        ZERO_STRUCT(zeros);
 
         ZERO_STRUCT(lm);
@@ -573 +555 @@
         /* Marshall data and send request */
 
-        result = rpccli_netr_LogonSamLogonEx(cli, mem_ctx,
+        status = dcerpc_netr_LogonSamLogonEx(b, mem_ctx,
                                              server_name_slash,
                                              global_myname(),
@@ -581 +563 @@
                                              &validation,
                                              &authoritative,
-                                             &flags);
+                                             &flags,
+                                             &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
         if (!NT_STATUS_IS_OK(result)) {
                 return result;
@@ -613 +600 @@
                                             enum netr_SchannelType sec_channel_type)
 {
-        NTSTATUS result;
+        NTSTATUS result, status;
         struct netr_Authenticator clnt_creds, srv_cred;
+        struct dcerpc_binding_handle *b = cli->binding_handle;
 
         if (!cli->dc) {
@@ -643 +631 @@
                                         &new_password);
 
-                result = rpccli_netr_ServerPasswordSet2(cli, mem_ctx,
+                status = dcerpc_netr_ServerPasswordSet2(b, mem_ctx,
                                                         cli->srv_name_slash,
                                                         cli->dc->account_name,
@@ -650 +638 @@
                                                         &clnt_creds,
                                                         &srv_cred,
-                                                        &new_password);
-                if (!NT_STATUS_IS_OK(result)) {
-                        DEBUG(0,("rpccli_netr_ServerPasswordSet2 failed: %s\n",
-                                nt_errstr(result)));
-                        return result;
+                                                        &new_password,
+                                                        &result);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("dcerpc_netr_ServerPasswordSet2 failed: %s\n",
+                                nt_errstr(status)));
+                        return status;
                 }
         } else {
@@ -662 +651 @@
                 netlogon_creds_des_encrypt(cli->dc, &new_password);
 
-                result = rpccli_netr_ServerPasswordSet(cli, mem_ctx,
+                status = dcerpc_netr_ServerPasswordSet(b, mem_ctx,
                                                        cli->srv_name_slash,
                                                        cli->dc->account_name,
@@ -669 +658 @@
                                                        &clnt_creds,
                                                        &srv_cred,
-                                                       &new_password);
-                if (!NT_STATUS_IS_OK(result)) {
-                        DEBUG(0,("rpccli_netr_ServerPasswordSet failed: %s\n",
-                                nt_errstr(result)));
-                        return result;
+                                                       &new_password,
+                                                       &result);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("dcerpc_netr_ServerPasswordSet failed: %s\n",
+                                nt_errstr(status)));
+                        return status;
                 }
         }
@@ -683 +673 @@
         }
 
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(0,("dcerpc_netr_ServerPasswordSet{2} failed: %s\n",
+                        nt_errstr(result)));
+                return result;
+        }
+
         return result;
 }

vendor/current/source3/rpc_client/cli_pipe.c

@@ -1 @@
-/* 
+/*
  *  Unix SMB/CIFS implementation.
- *  RPC Pipe client / server routines
+ *  RPC Pipe client routines
  *  Largely rewritten by Jeremy Allison             2005.
- *  
+ *  Heavily modified by Simo Sorce                  2010.
+ *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
  *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
- *  
+ *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *  
+ *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
@@ -19 +20 @@
 
 #include "includes.h"
-#include "librpc/gen_ndr/cli_epmapper.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "librpc/gen_ndr/ndr_epmapper_c.h"
 #include "../librpc/gen_ndr/ndr_schannel.h"
+#include "../librpc/gen_ndr/ndr_dssetup.h"
 #include "../libcli/auth/schannel.h"
 #include "../libcli/auth/spnego.h"
-#include "smb_krb5.h"
+#include "../libcli/auth/ntlmssp.h"
+#include "ntlmssp_wrap.h"
+#include "librpc/gen_ndr/ndr_dcerpc.h"
+#include "librpc/rpc/dcerpc.h"
+#include "librpc/crypto/gse.h"
+#include "librpc/crypto/spnego.h"
+#include "rpc_dce.h"
+#include "cli_pipe.h"
+#include "client.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_RPC_CLI
-
-static const char *get_pipe_name_from_iface(
-        TALLOC_CTX *mem_ctx, const struct ndr_interface_table *interface)
-{
-        int i;
-        const struct ndr_interface_string_array *ep = interface->endpoints;
-        char *p;
-
-        for (i=0; i<ep->count; i++) {
-                if (strncmp(ep->names[i], "ncacn_np:[\\pipe\\", 16) == 0) {
-                        break;
-                }
-        }
-        if (i == ep->count) {
-                return NULL;
-        }
-
-        /*
-         * extract the pipe name without \\pipe from for example
-         * ncacn_np:[\\pipe\\epmapper]
-         */
-        p = strchr(ep->names[i]+15, ']');
-        if (p == NULL) {
-                return "PIPE";
-        }
-        return talloc_strndup(mem_ctx, ep->names[i]+15, p - ep->names[i] - 15);
-}
-
-static const struct ndr_interface_table **interfaces;
-
-bool smb_register_ndr_interface(const struct ndr_interface_table *interface)
-{
-        int num_interfaces = talloc_array_length(interfaces);
-        const struct ndr_interface_table **tmp;
-        int i;
-
-        for (i=0; i<num_interfaces; i++) {
-                if (ndr_syntax_id_equal(&interfaces[i]->syntax_id,
-                                        &interface->syntax_id)) {
-                        return true;
-                }
-        }
-
-        tmp = talloc_realloc(NULL, interfaces,
-                             const struct ndr_interface_table *,
-                             num_interfaces + 1);
-        if (tmp == NULL) {
-                DEBUG(1, ("smb_register_ndr_interface: talloc failed\n"));
-                return false;
-        }
-        interfaces = tmp;
-        interfaces[num_interfaces] = interface;
-        return true;
-}
-
-static bool initialize_interfaces(void)
-{
-        if (!smb_register_ndr_interface(&ndr_table_lsarpc)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_dssetup)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_samr)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_netlogon)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_srvsvc)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_wkssvc)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_winreg)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_spoolss)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_netdfs)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_rpcecho)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_initshutdown)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_svcctl)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_eventlog)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_ntsvcs)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_epmapper)) {
-                return false;
-        }
-        if (!smb_register_ndr_interface(&ndr_table_drsuapi)) {
-                return false;
-        }
-        return true;
-}
-
-const struct ndr_interface_table *get_iface_from_syntax(
-        const struct ndr_syntax_id *syntax)
-{
-        int num_interfaces;
-        int i;
-
-        if (interfaces == NULL) {
-                if (!initialize_interfaces()) {
-                        return NULL;
-                }
-        }
-        num_interfaces = talloc_array_length(interfaces);
-
-        for (i=0; i<num_interfaces; i++) {
-                if (ndr_syntax_id_equal(&interfaces[i]->syntax_id, syntax)) {
-                        return interfaces[i];
-                }
-        }
-
-        return NULL;
-}
-
-/****************************************************************************
- Return the pipe name from the interface.
- ****************************************************************************/
-
-const char *get_pipe_name_from_syntax(TALLOC_CTX *mem_ctx,
-                                      const struct ndr_syntax_id *syntax)
-{
-        const struct ndr_interface_table *interface;
-        char *guid_str;
-        const char *result;
-
-        interface = get_iface_from_syntax(syntax);
-        if (interface != NULL) {
-                result = get_pipe_name_from_iface(mem_ctx, interface);
-                if (result != NULL) {
-                        return result;
-                }
-        }
-
-        /*
-         * Here we should ask \\epmapper, but for now our code is only
-         * interested in the known pipes mentioned in pipe_names[]
-         */
-
-        guid_str = GUID_string(talloc_tos(), &syntax->uuid);
-        if (guid_str == NULL) {
-                return NULL;
-        }
-        result = talloc_asprintf(mem_ctx, "Interface %s.%d", guid_str,
-                                 (int)syntax->if_version);
-        TALLOC_FREE(guid_str);
-
-        if (result == NULL) {
-                return "PIPE";
-        }
-        return result;
-}
-
-/********************************************************************
- Map internal value to wire value.
- ********************************************************************/
-
-static int map_pipe_auth_type_to_rpc_auth_type(enum pipe_auth_type auth_type)
-{
-        switch (auth_type) {
-
-        case PIPE_AUTH_TYPE_NONE:
-                return DCERPC_AUTH_TYPE_NONE;
-
-        case PIPE_AUTH_TYPE_NTLMSSP:
-                return DCERPC_AUTH_TYPE_NTLMSSP;
-
-        case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
-        case PIPE_AUTH_TYPE_SPNEGO_KRB5:
-                return DCERPC_AUTH_TYPE_SPNEGO;
-
-        case PIPE_AUTH_TYPE_SCHANNEL:
-                return DCERPC_AUTH_TYPE_SCHANNEL;
-
-        case PIPE_AUTH_TYPE_KRB5:
-                return DCERPC_AUTH_TYPE_KRB5;
-
-        default:
-                DEBUG(0,("map_pipe_auth_type_to_rpc_type: unknown pipe "
-                        "auth type %u\n",
-                        (unsigned int)auth_type ));
-                break;
-        }
-        return -1;
-}
 
 /********************************************************************
@@ -250 +61 @@
         return ++call_id;
 }
-
-/*
- * Realloc pdu to have a least "size" bytes
- */
-
-static bool rpc_grow_buffer(prs_struct *pdu, size_t size)
-{
-        size_t extra_size;
-
-        if (prs_data_size(pdu) >= size) {
-                return true;
-        }
-
-        extra_size = size - prs_data_size(pdu);
-
-        if (!prs_force_grow(pdu, extra_size)) {
-                DEBUG(0, ("rpc_grow_buffer: Failed to grow parse struct by "
-                          "%d bytes.\n", (int)extra_size));
-                return false;
-        }
-
-        DEBUG(5, ("rpc_grow_buffer: grew buffer by %d bytes to %u\n",
-                  (int)extra_size, prs_data_size(pdu)));
-        return true;
-}
-
 
 /*******************************************************************
@@ -442 +227 @@
 
 
-static NTSTATUS parse_rpc_header(struct rpc_pipe_client *cli,
-                                 struct rpc_hdr_info *prhdr,
-                                 prs_struct *pdu)
-{
-        /*
-         * This next call sets the endian bit correctly in current_pdu. We
-         * will propagate this to rbuf later.
-         */
-
-        if(!smb_io_rpc_hdr("rpc_hdr   ", prhdr, pdu, 0)) {
-                DEBUG(0, ("get_current_pdu: Failed to unmarshall RPC_HDR.\n"));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        if (prhdr->frag_len > cli->max_recv_frag) {
-                DEBUG(0, ("cli_pipe_get_current_pdu: Server sent fraglen %d,"
-                          " we only allow %d\n", (int)prhdr->frag_len,
-                          (int)cli->max_recv_frag));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        return NT_STATUS_OK;
-}
-
 /****************************************************************************
  Try and get a PDU's worth of data from current_pdu. If not, then read more
@@ -474 +235 @@
         struct event_context *ev;
         struct rpc_pipe_client *cli;
-        struct rpc_hdr_info *prhdr;
-        prs_struct *pdu;
+        uint16_t frag_len;
+        DATA_BLOB *pdu;
 };
 
@@ -484 +245 @@
                                                  struct event_context *ev,
                                                  struct rpc_pipe_client *cli,
-                                                 struct rpc_hdr_info *prhdr,
-                                                 prs_struct *pdu)
+                                                 DATA_BLOB *pdu)
 {
         struct tevent_req *req, *subreq;
         struct get_complete_frag_state *state;
-        uint32_t pdu_len;
+        size_t received;
         NTSTATUS status;
 
@@ -499 +259 @@
         state->ev = ev;
         state->cli = cli;
-        state->prhdr = prhdr;
+        state->frag_len = RPC_HEADER_LEN;
         state->pdu = pdu;
 
-        pdu_len = prs_data_size(pdu);
-        if (pdu_len < RPC_HEADER_LEN) {
-                if (!rpc_grow_buffer(pdu, RPC_HEADER_LEN)) {
+        received = pdu->length;
+        if (received < RPC_HEADER_LEN) {
+                if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
                         status = NT_STATUS_NO_MEMORY;
                         goto post_status;
                 }
-                subreq = rpc_read_send(
-                        state, state->ev,
-                        state->cli->transport,
-                        (uint8_t *)(prs_data_p(state->pdu) + pdu_len),
-                        RPC_HEADER_LEN - pdu_len);
+                subreq = rpc_read_send(state, state->ev,
+                                        state->cli->transport,
+                                        pdu->data + received,
+                                        RPC_HEADER_LEN - received);
                 if (subreq == NULL) {
                         status = NT_STATUS_NO_MEMORY;
@@ -522 +281 @@
         }
 
-        status = parse_rpc_header(cli, prhdr, pdu);
-        if (!NT_STATUS_IS_OK(status)) {
-                goto post_status;
-        }
+        state->frag_len = dcerpc_get_frag_length(pdu);
 
         /*
          * Ensure we have frag_len bytes of data.
          */
-        if (pdu_len < prhdr->frag_len) {
-                if (!rpc_grow_buffer(pdu, prhdr->frag_len)) {
+        if (received < state->frag_len) {
+                if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
                         status = NT_STATUS_NO_MEMORY;
                         goto post_status;
                 }
                 subreq = rpc_read_send(state, state->ev,
-                                       state->cli->transport,
-                                       (uint8_t *)(prs_data_p(pdu) + pdu_len),
-                                       prhdr->frag_len - pdu_len);
+                                        state->cli->transport,
+                                        pdu->data + received,
+                                        state->frag_len - received);
                 if (subreq == NULL) {
                         status = NT_STATUS_NO_MEMORY;
@@ -573 +329 @@
         }
 
-        status = parse_rpc_header(state->cli, state->prhdr, state->pdu);
-        if (!NT_STATUS_IS_OK(status)) {
-                tevent_req_nterror(req, status);
-                return;
-        }
-
-        if (!rpc_grow_buffer(state->pdu, state->prhdr->frag_len)) {
+        state->frag_len = dcerpc_get_frag_length(state->pdu);
+
+        if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
                 return;
@@ -589 +341 @@
          */
 
-        subreq = rpc_read_send(
-                state, state->ev, state->cli->transport,
-                (uint8_t *)(prs_data_p(state->pdu) + RPC_HEADER_LEN),
-                state->prhdr->frag_len - RPC_HEADER_LEN);
+        subreq = rpc_read_send(state, state->ev, state->cli->transport,
+                                state->pdu->data + RPC_HEADER_LEN,
+                                state->frag_len - RPC_HEADER_LEN);
         if (tevent_req_nomem(subreq, req)) {
                 return;
@@ -617 +368 @@
 {
         return tevent_req_simple_recv_ntstatus(req);
-}
-
-/****************************************************************************
- NTLMSSP specific sign/seal.
- Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
- In fact I should probably abstract these into identical pieces of code... JRA.
- ****************************************************************************/
-
-static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
-                                prs_struct *current_pdu,
-                                uint8 *p_ss_padding_len)
-{
-        RPC_HDR_AUTH auth_info;
-        uint32 save_offset = prs_offset(current_pdu);
-        uint32 auth_len = prhdr->auth_len;
-        NTLMSSP_STATE *ntlmssp_state = cli->auth->a_u.ntlmssp_state;
-        unsigned char *data = NULL;
-        size_t data_len;
-        unsigned char *full_packet_data = NULL;
-        size_t full_packet_data_len;
-        DATA_BLOB auth_blob;
-        NTSTATUS status;
-
-        if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
-            || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
-                return NT_STATUS_OK;
-        }
-
-        if (!ntlmssp_state) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Ensure there's enough data for an authenticated response. */
-        if ((auth_len > RPC_MAX_SIGN_SIZE) ||
-                        (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
-                DEBUG(0,("cli_pipe_verify_ntlmssp: auth_len %u is too large.\n",
-                        (unsigned int)auth_len ));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        /*
-         * We need the full packet data + length (minus auth stuff) as well as the packet data + length
-         * after the RPC header.
-         * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
-         * functions as NTLMv2 checks the rpc headers also.
-         */
-
-        data = (unsigned char *)(prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN);
-        data_len = (size_t)(prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len);
-
-        full_packet_data = (unsigned char *)prs_data_p(current_pdu);
-        full_packet_data_len = prhdr->frag_len - auth_len;
-
-        /* Pull the auth header and the following data into a blob. */
-        if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
-                DEBUG(0,("cli_pipe_verify_ntlmssp: cannot move offset to %u.\n",
-                        (unsigned int)RPC_HEADER_LEN + (unsigned int)RPC_HDR_RESP_LEN + (unsigned int)data_len ));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
-                DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall RPC_HDR_AUTH.\n"));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        auth_blob.data = (unsigned char *)prs_data_p(current_pdu) + prs_offset(current_pdu);
-        auth_blob.length = auth_len;
-
-        switch (cli->auth->auth_level) {
-                case DCERPC_AUTH_LEVEL_PRIVACY:
-                        /* Data is encrypted. */
-                        status = ntlmssp_unseal_packet(ntlmssp_state,
-                                                        data, data_len,
-                                                        full_packet_data,
-                                                        full_packet_data_len,
-                                                        &auth_blob);
-                        if (!NT_STATUS_IS_OK(status)) {
-                                DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unseal "
-                                        "packet from %s. Error was %s.\n",
-                                        rpccli_pipe_txt(talloc_tos(), cli),
-                                        nt_errstr(status) ));
-                                return status;
-                        }
-                        break;
-                case DCERPC_AUTH_LEVEL_INTEGRITY:
-                        /* Data is signed. */
-                        status = ntlmssp_check_packet(ntlmssp_state,
-                                                        data, data_len,
-                                                        full_packet_data,
-                                                        full_packet_data_len,
-                                                        &auth_blob);
-                        if (!NT_STATUS_IS_OK(status)) {
-                                DEBUG(0,("cli_pipe_verify_ntlmssp: check signing failed on "
-                                        "packet from %s. Error was %s.\n",
-                                        rpccli_pipe_txt(talloc_tos(), cli),
-                                        nt_errstr(status) ));
-                                return status;
-                        }
-                        break;
-                default:
-                        DEBUG(0, ("cli_pipe_verify_ntlmssp: unknown internal "
-                                  "auth level %d\n", cli->auth->auth_level));
-                        return NT_STATUS_INVALID_INFO_CLASS;
-        }
-
-        /*
-         * Return the current pointer to the data offset.
-         */
-
-        if(!prs_set_offset(current_pdu, save_offset)) {
-                DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
-                        (unsigned int)save_offset ));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        /*
-         * Remember the padding length. We must remove it from the real data
-         * stream once the sign/seal is done.
-         */
-
-        *p_ss_padding_len = auth_info.auth_pad_len;
-
-        return NT_STATUS_OK;
-}
-
-/****************************************************************************
- schannel specific sign/seal.
- ****************************************************************************/
-
-static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
-                                prs_struct *current_pdu,
-                                uint8 *p_ss_padding_len)
-{
-        RPC_HDR_AUTH auth_info;
-        uint32 auth_len = prhdr->auth_len;
-        uint32 save_offset = prs_offset(current_pdu);
-        struct schannel_state *schannel_auth =
-                cli->auth->a_u.schannel_auth;
-        uint8_t *data;
-        uint32 data_len;
-        DATA_BLOB blob;
-        NTSTATUS status;
-
-        if (cli->auth->auth_level == DCERPC_AUTH_LEVEL_NONE
-            || cli->auth->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
-                return NT_STATUS_OK;
-        }
-
-        if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
-                DEBUG(0,("cli_pipe_verify_schannel: auth_len %u.\n", (unsigned int)auth_len ));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!schannel_auth) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Ensure there's enough data for an authenticated response. */
-        if ((auth_len > RPC_MAX_SIGN_SIZE) ||
-                        (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
-                DEBUG(0,("cli_pipe_verify_schannel: auth_len %u is too large.\n",
-                        (unsigned int)auth_len ));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        data_len = prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
-
-        if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
-                DEBUG(0,("cli_pipe_verify_schannel: cannot move offset to %u.\n",
-                        (unsigned int)RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len ));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
-                DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshall RPC_HDR_AUTH.\n"));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
-                DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n",
-                        auth_info.auth_type));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        blob = data_blob_const(prs_data_p(current_pdu) + prs_offset(current_pdu), auth_len);
-
-        if (DEBUGLEVEL >= 10) {
-                dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
-        }
-
-        data = (uint8_t *)prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN;
-
-        switch (cli->auth->auth_level) {
-        case DCERPC_AUTH_LEVEL_PRIVACY:
-                status = netsec_incoming_packet(schannel_auth,
-                                                talloc_tos(),
-                                                true,
-                                                data,
-                                                data_len,
-                                                &blob);
-                break;
-        case DCERPC_AUTH_LEVEL_INTEGRITY:
-                status = netsec_incoming_packet(schannel_auth,
-                                                talloc_tos(),
-                                                false,
-                                                data,
-                                                data_len,
-                                                &blob);
-                break;
-        default:
-                status = NT_STATUS_INTERNAL_ERROR;
-                break;
-        }
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
-                                "Connection to %s (%s).\n",
-                                rpccli_pipe_txt(talloc_tos(), cli),
-                                nt_errstr(status)));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /*
-         * Return the current pointer to the data offset.
-         */
-
-        if(!prs_set_offset(current_pdu, save_offset)) {
-                DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
-                        (unsigned int)save_offset ));
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        /*
-         * Remember the padding length. We must remove it from the real data
-         * stream once the sign/seal is done.
-         */
-
-        *p_ss_padding_len = auth_info.auth_pad_len;
-
-        return NT_STATUS_OK;
-}
-
-/****************************************************************************
- Do the authentication checks on an incoming pdu. Check sign and unseal etc.
- ****************************************************************************/
-
-static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
-                                prs_struct *current_pdu,
-                                uint8 *p_ss_padding_len)
-{
-        NTSTATUS ret = NT_STATUS_OK;
-
-        /* Paranioa checks for auth_len. */
-        if (prhdr->auth_len) {
-                if (prhdr->auth_len > prhdr->frag_len) {
-                        return NT_STATUS_INVALID_PARAMETER;
-                }
-
-                if (prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < prhdr->auth_len ||
-                                prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < (unsigned int)RPC_HDR_AUTH_LEN) {
-                        /* Integer wrap attempt. */
-                        return NT_STATUS_INVALID_PARAMETER;
-                }
-        }
-
-        /*
-         * Now we have a complete RPC request PDU fragment, try and verify any auth data.
-         */
-
-        switch(cli->auth->auth_type) {
-                case PIPE_AUTH_TYPE_NONE:
-                        if (prhdr->auth_len) {
-                                DEBUG(3, ("cli_pipe_validate_rpc_response: "
-                                          "Connection to %s - got non-zero "
-                                          "auth len %u.\n",
-                                        rpccli_pipe_txt(talloc_tos(), cli),
-                                        (unsigned int)prhdr->auth_len ));
-                                return NT_STATUS_INVALID_PARAMETER;
-                        }
-                        break;
-
-                case PIPE_AUTH_TYPE_NTLMSSP:
-                case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
-                        ret = cli_pipe_verify_ntlmssp(cli, prhdr, current_pdu, p_ss_padding_len);
-                        if (!NT_STATUS_IS_OK(ret)) {
-                                return ret;
-                        }
-                        break;
-
-                case PIPE_AUTH_TYPE_SCHANNEL:
-                        ret = cli_pipe_verify_schannel(cli, prhdr, current_pdu, p_ss_padding_len);
-                        if (!NT_STATUS_IS_OK(ret)) {
-                                return ret;
-                        }
-                        break;
-
-                case PIPE_AUTH_TYPE_KRB5:
-                case PIPE_AUTH_TYPE_SPNEGO_KRB5:
-                default:
-                        DEBUG(3, ("cli_pipe_validate_rpc_response: Connection "
-                                  "to %s - unknown internal auth type %u.\n",
-                                  rpccli_pipe_txt(talloc_tos(), cli),
-                                  cli->auth->auth_type ));
-                        return NT_STATUS_INVALID_INFO_CLASS;
-        }
-
-        return NT_STATUS_OK;
 }
 
@@ -930 +374 @@
  ****************************************************************************/
 
-static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
-                        prs_struct *current_pdu,
-                        uint8 expected_pkt_type,
-                        char **ppdata,
-                        uint32 *pdata_len,
-                        prs_struct *return_data)
-{
-
+static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
+                                                struct rpc_pipe_client *cli,
+                                                struct ncacn_packet *pkt,
+                                                DATA_BLOB *pdu,
+                                                uint8_t expected_pkt_type,
+                                                DATA_BLOB *rdata,
+                                                DATA_BLOB *reply_pdu)
+{
+        struct dcerpc_response *r;
         NTSTATUS ret = NT_STATUS_OK;
-        uint32 current_pdu_len = prs_data_size(current_pdu);
-
-        if (current_pdu_len != prhdr->frag_len) {
-                DEBUG(5,("cli_pipe_validate_current_pdu: incorrect pdu length %u, expected %u\n",
-                        (unsigned int)current_pdu_len, (unsigned int)prhdr->frag_len ));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
+        size_t pad_len = 0;
 
         /*
@@ -951 +390 @@
          * header. Just in case the caller wants it.
          */
-        *ppdata = prs_data_p(current_pdu);
-        *pdata_len = current_pdu_len;
+        *rdata = *pdu;
 
         /* Ensure we have the correct type. */
-        switch (prhdr->pkt_type) {
-                case DCERPC_PKT_ALTER_RESP:
-                case DCERPC_PKT_BIND_ACK:
-
-                        /* Alter context and bind ack share the same packet definitions. */
-                        break;
-
-
-                case DCERPC_PKT_RESPONSE:
-                {
-                        RPC_HDR_RESP rhdr_resp;
-                        uint8 ss_padding_len = 0;
-
-                        if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
-                                DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
-                                return NT_STATUS_BUFFER_TOO_SMALL;
-                        }
-
-                        /* Here's where we deal with incoming sign/seal. */
-                        ret = cli_pipe_validate_rpc_response(cli, prhdr,
-                                        current_pdu, &ss_padding_len);
-                        if (!NT_STATUS_IS_OK(ret)) {
-                                return ret;
-                        }
-
-                        /* Point the return values at the NDR data. Remember to remove any ss padding. */
-                        *ppdata = prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
-
-                        if (current_pdu_len < RPC_HEADER_LEN + RPC_HDR_RESP_LEN + ss_padding_len) {
-                                return NT_STATUS_BUFFER_TOO_SMALL;
-                        }
-
-                        *pdata_len = current_pdu_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - ss_padding_len;
-
-                        /* Remember to remove the auth footer. */
-                        if (prhdr->auth_len) {
-                                /* We've already done integer wrap tests on auth_len in
-                                        cli_pipe_validate_rpc_response(). */
-                                if (*pdata_len < RPC_HDR_AUTH_LEN + prhdr->auth_len) {
-                                        return NT_STATUS_BUFFER_TOO_SMALL;
-                                }
-                                *pdata_len -= (RPC_HDR_AUTH_LEN + prhdr->auth_len);
-                        }
-
-                        DEBUG(10,("cli_pipe_validate_current_pdu: got pdu len %u, data_len %u, ss_len %u\n",
-                                current_pdu_len, *pdata_len, ss_padding_len ));
-
-                        /*
-                         * If this is the first reply, and the allocation hint is reasonably, try and
-                         * set up the return_data parse_struct to the correct size.
-                         */
-
-                        if ((prs_data_size(return_data) == 0) && rhdr_resp.alloc_hint && (rhdr_resp.alloc_hint < 15*1024*1024)) {
-                                if (!prs_set_buffer_size(return_data, rhdr_resp.alloc_hint)) {
-                                        DEBUG(0,("cli_pipe_validate_current_pdu: reply alloc hint %u "
-                                                "too large to allocate\n",
-                                                (unsigned int)rhdr_resp.alloc_hint ));
-                                        return NT_STATUS_NO_MEMORY;
-                                }
-                        }
-
-                        break;
+        switch (pkt->ptype) {
+        case DCERPC_PKT_ALTER_RESP:
+        case DCERPC_PKT_BIND_ACK:
+
+                /* Client code never receives this kind of packets */
+                break;
+
+
+        case DCERPC_PKT_RESPONSE:
+
+                r = &pkt->u.response;
+
+                /* Here's where we deal with incoming sign/seal. */
+                ret = dcerpc_check_auth(cli->auth, pkt,
+                                        &r->stub_and_verifier,
+                                        DCERPC_RESPONSE_LENGTH,
+                                        pdu, &pad_len);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        return ret;
                 }
 
-                case DCERPC_PKT_BIND_NAK:
-                        DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
-                                  "received from %s!\n",
-                                  rpccli_pipe_txt(talloc_tos(), cli)));
-                        /* Use this for now... */
-                        return NT_STATUS_NETWORK_ACCESS_DENIED;
-
-                case DCERPC_PKT_FAULT:
-                {
-                        RPC_HDR_RESP rhdr_resp;
-                        RPC_HDR_FAULT fault_resp;
-
-                        if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
-                                DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
-                                return NT_STATUS_BUFFER_TOO_SMALL;
-                        }
-
-                        if(!smb_io_rpc_hdr_fault("fault", &fault_resp, current_pdu, 0)) {
-                                DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_FAULT.\n"));
-                                return NT_STATUS_BUFFER_TOO_SMALL;
-                        }
-
-                        DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
-                                  "code %s received from %s!\n",
-                                dcerpc_errstr(talloc_tos(), NT_STATUS_V(fault_resp.status)),
-                                rpccli_pipe_txt(talloc_tos(), cli)));
-                        if (NT_STATUS_IS_OK(fault_resp.status)) {
-                                return NT_STATUS_UNSUCCESSFUL;
-                        } else {
-                                return fault_resp.status;
+                if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
+                        return NT_STATUS_BUFFER_TOO_SMALL;
+                }
+
+                /* Point the return values at the NDR data. */
+                rdata->data = r->stub_and_verifier.data;
+
+                if (pkt->auth_length) {
+                        /* We've already done integer wrap tests in
+                         * dcerpc_check_auth(). */
+                        rdata->length = r->stub_and_verifier.length
+                                         - pad_len
+                                         - DCERPC_AUTH_TRAILER_LENGTH
+                                         - pkt->auth_length;
+                } else {
+                        rdata->length = r->stub_and_verifier.length;
+                }
+
+                DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
+                           (long unsigned int)pdu->length,
+                           (long unsigned int)rdata->length,
+                           (unsigned int)pad_len));
+
+                /*
+                 * If this is the first reply, and the allocation hint is
+                 * reasonable, try and set up the reply_pdu DATA_BLOB to the
+                 * correct size.
+                 */
+
+                if ((reply_pdu->length == 0) &&
+                    r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
+                        if (!data_blob_realloc(mem_ctx, reply_pdu,
+                                                        r->alloc_hint)) {
+                                DEBUG(0, ("reply alloc hint %d too "
+                                          "large to allocate\n",
+                                          (int)r->alloc_hint));
+                                return NT_STATUS_NO_MEMORY;
                         }
                 }
 
-                default:
-                        DEBUG(0, ("cli_pipe_validate_current_pdu: unknown packet type %u received "
-                                "from %s!\n",
-                                (unsigned int)prhdr->pkt_type,
-                                rpccli_pipe_txt(talloc_tos(), cli)));
-                        return NT_STATUS_INVALID_INFO_CLASS;
-        }
-
-        if (prhdr->pkt_type != expected_pkt_type) {
-                DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
-                          "got an unexpected RPC packet type - %u, not %u\n",
-                        rpccli_pipe_txt(talloc_tos(), cli),
-                        prhdr->pkt_type,
-                        expected_pkt_type));
+                break;
+
+        case DCERPC_PKT_BIND_NAK:
+                DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
+                          rpccli_pipe_txt(talloc_tos(), cli)));
+                /* Use this for now... */
+                return NT_STATUS_NETWORK_ACCESS_DENIED;
+
+        case DCERPC_PKT_FAULT:
+
+                DEBUG(1, (__location__ ": RPC fault code %s received "
+                          "from %s!\n",
+                          dcerpc_errstr(talloc_tos(),
+                          pkt->u.fault.status),
+                          rpccli_pipe_txt(talloc_tos(), cli)));
+
+                return dcerpc_fault_to_nt_status(pkt->u.fault.status);
+
+        default:
+                DEBUG(0, (__location__ "Unknown packet type %u received "
+                          "from %s!\n",
+                          (unsigned int)pkt->ptype,
+                          rpccli_pipe_txt(talloc_tos(), cli)));
+                return NT_STATUS_INVALID_INFO_CLASS;
+        }
+
+        if (pkt->ptype != expected_pkt_type) {
+                DEBUG(3, (__location__ ": Connection to %s got an unexpected "
+                          "RPC packet type - %u, not %u\n",
+                          rpccli_pipe_txt(talloc_tos(), cli),
+                          pkt->ptype, expected_pkt_type));
                 return NT_STATUS_INVALID_INFO_CLASS;
         }
@@ -1073 +492 @@
            it before. */
 
-        if ((prhdr->pkt_type == DCERPC_PKT_BIND_ACK) && !(prhdr->flags & DCERPC_PFC_FLAG_LAST)) {
-                DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
-                        "setting fragment first/last ON.\n"));
-                prhdr->flags |= DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST;
-        }
-
-        return NT_STATUS_OK;
-}
-
-/****************************************************************************
- Ensure we eat the just processed pdu from the current_pdu prs_struct.
- Normally the frag_len and buffer size will match, but on the first trans
- reply there is a theoretical chance that buffer size > frag_len, so we must
- deal with that.
- ****************************************************************************/
-
-static NTSTATUS cli_pipe_reset_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr, prs_struct *current_pdu)
-{
-        uint32 current_pdu_len = prs_data_size(current_pdu);
-
-        if (current_pdu_len < prhdr->frag_len) {
-                return NT_STATUS_BUFFER_TOO_SMALL;
-        }
-
-        /* Common case. */
-        if (current_pdu_len == (uint32)prhdr->frag_len) {
-                prs_mem_free(current_pdu);
-                prs_init_empty(current_pdu, prs_get_mem_context(current_pdu), UNMARSHALL);
-                /* Make current_pdu dynamic with no memory. */
-                prs_give_memory(current_pdu, 0, 0, True);
-                return NT_STATUS_OK;
-        }
-
-        /*
-         * Oh no ! More data in buffer than we processed in current pdu.
-         * Cheat. Move the data down and shrink the buffer.
-         */
-
-        memcpy(prs_data_p(current_pdu), prs_data_p(current_pdu) + prhdr->frag_len,
-                        current_pdu_len - prhdr->frag_len);
-
-        /* Remember to set the read offset back to zero. */
-        prs_set_offset(current_pdu, 0);
-
-        /* Shrink the buffer. */
-        if (!prs_set_buffer_size(current_pdu, current_pdu_len - prhdr->frag_len)) {
-                return NT_STATUS_BUFFER_TOO_SMALL;
+        if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
+            !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
+                DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
+                          "fragment first/last ON.\n"));
+                pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
         }
 
@@ -1188 +565 @@
         tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
         return req;
-
-        status = NT_STATUS_INVALID_PARAMETER;
 
  post_status:
@@ -1287 +662 @@
 
 /****************************************************************************
- Send data on an rpc pipe via trans. The prs_struct data must be the last
+ Send data on an rpc pipe via trans. The data must be the last
  pdu fragment of an NDR data stream.
 
@@ -1317 +692 @@
         uint8_t expected_pkt_type;
 
-        prs_struct incoming_frag;
-        struct rpc_hdr_info rhdr;
-
-        prs_struct incoming_pdu;        /* Incoming reply */
-        uint32_t incoming_pdu_offset;
+        DATA_BLOB incoming_frag;
+        struct ncacn_packet *pkt;
+
+        /* Incoming reply */
+        DATA_BLOB reply_pdu;
+        size_t reply_pdu_offset;
+        uint8_t endianess;
 };
-
-static int rpc_api_pipe_state_destructor(struct rpc_api_pipe_state *state)
-{
-        prs_mem_free(&state->incoming_frag);
-        prs_mem_free(&state->incoming_pdu);
-        return 0;
-}
 
 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
+static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
 
 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
                                             struct event_context *ev,
                                             struct rpc_pipe_client *cli,
-                                            prs_struct *data, /* Outgoing PDU */
+                                            DATA_BLOB *data, /* Outgoing PDU */
                                             uint8_t expected_pkt_type)
 {
@@ -1352 +723 @@
         state->cli = cli;
         state->expected_pkt_type = expected_pkt_type;
-        state->incoming_pdu_offset = 0;
-
-        prs_init_empty(&state->incoming_frag, state, UNMARSHALL);
-
-        prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
-        /* Make incoming_pdu dynamic with no memory. */
-        prs_give_memory(&state->incoming_pdu, NULL, 0, true);
-
-        talloc_set_destructor(state, rpc_api_pipe_state_destructor);
+        state->incoming_frag = data_blob_null;
+        state->reply_pdu = data_blob_null;
+        state->reply_pdu_offset = 0;
+        state->endianess = DCERPC_DREP_LE;
 
         /*
          * Ensure we're not sending too much.
          */
-        if (prs_offset(data) > cli->max_xmit_frag) {
+        if (data->length > cli->max_xmit_frag) {
                 status = NT_STATUS_INVALID_PARAMETER;
                 goto post_status;
@@ -1372 +738 @@
         DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
 
-        max_recv_frag = cli->max_recv_frag;
-
-#if 0
-        max_recv_frag = RPC_HEADER_LEN + 10 + (sys_random() % 32);
-#endif
+        if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
+                subreq = rpc_write_send(state, ev, cli->transport,
+                                        data->data, data->length);
+                if (subreq == NULL) {
+                        goto fail;
+                }
+                tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
+                return req;
+        }
+
+        /* get the header first, then fetch the rest once we have
+         * the frag_length available */
+        max_recv_frag = RPC_HEADER_LEN;
 
         subreq = cli_api_pipe_send(state, ev, cli->transport,
-                                   (uint8_t *)prs_data_p(data),
-                                   prs_offset(data), max_recv_frag);
+                                   data->data, data->length, max_recv_frag);
         if (subreq == NULL) {
                 goto fail;
@@ -1395 +768 @@
 }
 
+static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
+{
+        struct tevent_req *req =
+                tevent_req_callback_data(subreq,
+                struct tevent_req);
+        NTSTATUS status;
+
+        status = rpc_write_recv(subreq);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                tevent_req_nterror(req, status);
+                return;
+        }
+
+        tevent_req_done(req);
+}
+
 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
 {
@@ -1404 +794 @@
         uint8_t *rdata = NULL;
         uint32_t rdata_len = 0;
-        char *rdata_copy;
 
         status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
@@ -1422 +811 @@
 
         /*
-         * Give the memory received from cli_trans as dynamic to the current
-         * pdu. Duplicating it sucks, but prs_struct doesn't know about talloc
-         * :-(
+         * Move data on state->incoming_frag.
          */
-        rdata_copy = (char *)memdup(rdata, rdata_len);
-        TALLOC_FREE(rdata);
-        if (tevent_req_nomem(rdata_copy, req)) {
-                return;
-        }
-        prs_give_memory(&state->incoming_frag, rdata_copy, rdata_len, true);
+        state->incoming_frag.data = talloc_move(state, &rdata);
+        state->incoming_frag.length = rdata_len;
+        if (!state->incoming_frag.data) {
+                tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+                return;
+        }
 
         /* Ensure we have enough data for a pdu. */
         subreq = get_complete_frag_send(state, state->ev, state->cli,
-                                        &state->rhdr, &state->incoming_frag);
+                                        &state->incoming_frag);
         if (tevent_req_nomem(subreq, req)) {
                 return;
@@ -1449 +836 @@
                 req, struct rpc_api_pipe_state);
         NTSTATUS status;
-        char *rdata = NULL;
-        uint32_t rdata_len = 0;
+        DATA_BLOB rdata = data_blob_null;
 
         status = get_complete_frag_recv(subreq);
@@ -1461 +847 @@
         }
 
-        status = cli_pipe_validate_current_pdu(
-                state->cli, &state->rhdr, &state->incoming_frag,
-                state->expected_pkt_type, &rdata, &rdata_len,
-                &state->incoming_pdu);
+        state->pkt = talloc(state, struct ncacn_packet);
+        if (!state->pkt) {
+                tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+                return;
+        }
+
+        status = dcerpc_pull_ncacn_packet(state->pkt,
+                                          &state->incoming_frag,
+                                          state->pkt,
+                                          !state->endianess);
+        if (!NT_STATUS_IS_OK(status)) {
+                tevent_req_nterror(req, status);
+                return;
+        }
+
+        if (state->incoming_frag.length != state->pkt->frag_length) {
+                DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
+                          (unsigned int)state->incoming_frag.length,
+                          (unsigned int)state->pkt->frag_length));
+                tevent_req_nterror(req,  NT_STATUS_INVALID_PARAMETER);
+                return;
+        }
+
+        status = cli_pipe_validate_current_pdu(state,
+                                                state->cli, state->pkt,
+                                                &state->incoming_frag,
+                                                state->expected_pkt_type,
+                                                &rdata,
+                                                &state->reply_pdu);
 
         DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
-                  (unsigned)prs_data_size(&state->incoming_frag),
-                  (unsigned)state->incoming_pdu_offset,
+                  (unsigned)state->incoming_frag.length,
+                  (unsigned)state->reply_pdu_offset,
                   nt_errstr(status)));
 
@@ -1476 +887 @@
         }
 
-        if ((state->rhdr.flags & DCERPC_PFC_FLAG_FIRST)
-            && (state->rhdr.pack_type[0] == 0)) {
+        if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
+            && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
                 /*
                  * Set the data type correctly for big-endian data on the
@@ -1485 +896 @@
                           "big-endian.\n",
                           rpccli_pipe_txt(talloc_tos(), state->cli)));
-                prs_set_endian_data(&state->incoming_pdu, RPC_BIG_ENDIAN);
+                state->endianess = 0x00; /* BIG ENDIAN */
         }
         /*
          * Check endianness on subsequent packets.
          */
-        if (state->incoming_frag.bigendian_data
-            != state->incoming_pdu.bigendian_data) {
+        if (state->endianess != state->pkt->drep[0]) {
                 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
                          "%s\n",
-                         state->incoming_pdu.bigendian_data?"big":"little",
-                         state->incoming_frag.bigendian_data?"big":"little"));
+                         state->endianess?"little":"big",
+                         state->pkt->drep[0]?"little":"big"));
                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                 return;
@@ -1501 +911 @@
 
         /* Now copy the data portion out of the pdu into rbuf. */
-        if (!prs_force_grow(&state->incoming_pdu, rdata_len)) {
-                tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
-                return;
-        }
-
-        memcpy(prs_data_p(&state->incoming_pdu) + state->incoming_pdu_offset,
-               rdata, (size_t)rdata_len);
-        state->incoming_pdu_offset += rdata_len;
-
-        status = cli_pipe_reset_current_pdu(state->cli, &state->rhdr,
-                                            &state->incoming_frag);
-        if (!NT_STATUS_IS_OK(status)) {
-                tevent_req_nterror(req, status);
-                return;
-        }
-
-        if (state->rhdr.flags & DCERPC_PFC_FLAG_LAST) {
+        if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
+                if (!data_blob_realloc(NULL, &state->reply_pdu,
+                                state->reply_pdu_offset + rdata.length)) {
+                        tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+                        return;
+                }
+        }
+
+        memcpy(state->reply_pdu.data + state->reply_pdu_offset,
+                rdata.data, rdata.length);
+        state->reply_pdu_offset += rdata.length;
+
+        /* reset state->incoming_frag, there is no need to free it,
+         * it will be reallocated to the right size the next time
+         * it is used */
+        state->incoming_frag.length = 0;
+
+        if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
+                /* make sure the pdu length is right now that we
+                 * have all the data available (alloc hint may
+                 * have allocated more than was actually used) */
+                state->reply_pdu.length = state->reply_pdu_offset;
                 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
                           rpccli_pipe_txt(talloc_tos(), state->cli),
-                          (unsigned)prs_data_size(&state->incoming_pdu)));
+                          (unsigned)state->reply_pdu.length));
                 tevent_req_done(req);
                 return;
@@ -1526 +941 @@
 
         subreq = get_complete_frag_send(state, state->ev, state->cli,
-                                        &state->rhdr, &state->incoming_frag);
+                                        &state->incoming_frag);
         if (tevent_req_nomem(subreq, req)) {
                 return;
@@ -1534 +949 @@
 
 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
-                                  prs_struct *reply_pdu)
+                                  struct ncacn_packet **pkt,
+                                  DATA_BLOB *reply_pdu)
 {
         struct rpc_api_pipe_state *state = tevent_req_data(
@@ -1544 +960 @@
         }
 
-        *reply_pdu = state->incoming_pdu;
-        reply_pdu->mem_ctx = mem_ctx;
-
-        /*
-         * Prevent state->incoming_pdu from being freed in
-         * rpc_api_pipe_state_destructor()
-         */
-        prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
+        /* return data to caller and assign it ownership of memory */
+        if (reply_pdu) {
+                reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
+                reply_pdu->length = state->reply_pdu.length;
+                state->reply_pdu.length = 0;
+        } else {
+                data_blob_free(&state->reply_pdu);
+        }
+
+        if (pkt) {
+                *pkt = talloc_steal(mem_ctx, state->pkt);
+        }
+
+        return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ Creates spnego auth bind.
+ ********************************************************************/
+
+static NTSTATUS create_spnego_auth_bind_req(TALLOC_CTX *mem_ctx,
+                                            struct pipe_auth_data *auth,
+                                            DATA_BLOB *auth_token)
+{
+        struct spnego_context *spnego_ctx;
+        DATA_BLOB in_token = data_blob_null;
+        NTSTATUS status;
+
+        spnego_ctx = talloc_get_type_abort(auth->auth_ctx,
+                                           struct spnego_context);
+
+        /* Negotiate the initial auth token */
+        status = spnego_get_client_auth_token(mem_ctx, spnego_ctx,
+                                              &in_token, auth_token);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        DEBUG(5, ("Created GSS Authentication Token:\n"));
+        dump_data(5, auth_token->data, auth_token->length);
 
         return NT_STATUS_OK;
@@ -1560 +1008 @@
  ********************************************************************/
 
-static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
-                                                enum dcerpc_AuthLevel auth_level,
-                                                RPC_HDR_AUTH *pauth_out,
-                                                prs_struct *auth_data)
-{
-#ifdef HAVE_KRB5
-        int ret;
-        struct kerberos_auth_struct *a = cli->auth->a_u.kerberos_auth;
-        DATA_BLOB tkt = data_blob_null;
-        DATA_BLOB tkt_wrapped = data_blob_null;
-
-        /* We may change the pad length before marshalling. */
-        init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_KRB5, (int)auth_level, 0, 1);
-
-        DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
-                a->service_principal ));
-
-        /* Create the ticket for the service principal and return it in a gss-api wrapped blob. */
-
-        ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
-                        &a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL, NULL);
-
-        if (ret) {
-                DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
-                        "failed with %s\n",
-                        a->service_principal,
-                        error_message(ret) ));
-
-                data_blob_free(&tkt);
-                prs_mem_free(auth_data);
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* wrap that up in a nice GSS-API wrapping */
-        tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
-
-        data_blob_free(&tkt);
-
-        /* Auth len in the rpc header doesn't include auth_header. */
-        if (!prs_copy_data_in(auth_data, (char *)tkt_wrapped.data, tkt_wrapped.length)) {
-                data_blob_free(&tkt_wrapped);
-                prs_mem_free(auth_data);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
-        dump_data(5, tkt_wrapped.data, tkt_wrapped.length);
-
-        data_blob_free(&tkt_wrapped);
-        return NT_STATUS_OK;
-#else
-        return NT_STATUS_INVALID_PARAMETER;
-#endif
-}
-
-/*******************************************************************
- Creates SPNEGO NTLMSSP auth bind.
- ********************************************************************/
-
-static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
-                                                enum dcerpc_AuthLevel auth_level,
-                                                RPC_HDR_AUTH *pauth_out,
-                                                prs_struct *auth_data)
-{
-        NTSTATUS nt_status;
-        DATA_BLOB null_blob = data_blob_null;
-        DATA_BLOB request = data_blob_null;
-        DATA_BLOB spnego_msg = data_blob_null;
-
-        /* We may change the pad length before marshalling. */
-        init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_SPNEGO, (int)auth_level, 0, 1);
-
-        DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
-        nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
-                                        null_blob,
-                                        &request);
-
-        if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                data_blob_free(&request);
-                prs_mem_free(auth_data);
-                return nt_status;
-        }
-
-        /* Wrap this in SPNEGO. */
-        spnego_msg = gen_negTokenInit(OID_NTLMSSP, request);
-
-        data_blob_free(&request);
-
-        /* Auth len in the rpc header doesn't include auth_header. */
-        if (!prs_copy_data_in(auth_data, (char *)spnego_msg.data, spnego_msg.length)) {
-                data_blob_free(&spnego_msg);
-                prs_mem_free(auth_data);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
-        dump_data(5, spnego_msg.data, spnego_msg.length);
-
-        data_blob_free(&spnego_msg);
+static NTSTATUS create_gssapi_auth_bind_req(TALLOC_CTX *mem_ctx,
+                                            struct pipe_auth_data *auth,
+                                            DATA_BLOB *auth_token)
+{
+        struct gse_context *gse_ctx;
+        DATA_BLOB in_token = data_blob_null;
+        NTSTATUS status;
+
+        gse_ctx = talloc_get_type_abort(auth->auth_ctx,
+                                        struct gse_context);
+
+        /* Negotiate the initial auth token */
+        status = gse_get_client_auth_token(mem_ctx, gse_ctx,
+                                           &in_token,
+                                           auth_token);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        DEBUG(5, ("Created GSS Authentication Token:\n"));
+        dump_data(5, auth_token->data, auth_token->length);
+
         return NT_STATUS_OK;
 }
@@ -1666 +1037 @@
  ********************************************************************/
 
-static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
-                                                enum dcerpc_AuthLevel auth_level,
-                                                RPC_HDR_AUTH *pauth_out,
-                                                prs_struct *auth_data)
-{
-        NTSTATUS nt_status;
+static NTSTATUS create_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
+                                                 DATA_BLOB *auth_token)
+{
+        struct auth_ntlmssp_state *ntlmssp_ctx;
         DATA_BLOB null_blob = data_blob_null;
-        DATA_BLOB request = data_blob_null;
-
-        /* We may change the pad length before marshalling. */
-        init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_NTLMSSP, (int)auth_level, 0, 1);
+        NTSTATUS status;
+
+        ntlmssp_ctx = talloc_get_type_abort(cli->auth->auth_ctx,
+                                            struct auth_ntlmssp_state);
 
         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
-        nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
-                                        null_blob,
-                                        &request);
-
-        if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                data_blob_free(&request);
-                prs_mem_free(auth_data);
-                return nt_status;
-        }
-
-        /* Auth len in the rpc header doesn't include auth_header. */
-        if (!prs_copy_data_in(auth_data, (char *)request.data, request.length)) {
-                data_blob_free(&request);
-                prs_mem_free(auth_data);
-                return NT_STATUS_NO_MEMORY;
+        status = auth_ntlmssp_update(ntlmssp_ctx, null_blob, auth_token);
+
+        if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+                data_blob_free(auth_token);
+                return status;
         }
 
         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
-        dump_data(5, request.data, request.length);
-
-        data_blob_free(&request);
+        dump_data(5, auth_token->data, auth_token->length);
+
         return NT_STATUS_OK;
 }
@@ -1707 +1065 @@
  ********************************************************************/
 
-static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
-                                                enum dcerpc_AuthLevel auth_level,
-                                                RPC_HDR_AUTH *pauth_out,
-                                                prs_struct *auth_data)
-{
+static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
+                                                  DATA_BLOB *auth_token)
+{
+        NTSTATUS status;
         struct NL_AUTH_MESSAGE r;
-        enum ndr_err_code ndr_err;
-        DATA_BLOB blob;
-
-        /* We may change the pad length before marshalling. */
-        init_rpc_hdr_auth(pauth_out, DCERPC_AUTH_TYPE_SCHANNEL, (int)auth_level, 0, 1);
 
         /* Use lp_workgroup() if domain not specified */
@@ -1738 +1090 @@
         r.oem_netbios_computer.a        = global_myname();
 
-        ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &r,
-                       (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
-                prs_mem_free(auth_data);
-                return ndr_map_error2ntstatus(ndr_err);
-        }
-
-        if (DEBUGLEVEL >= 10) {
-                NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &r);
-        }
-
-        if (!prs_copy_data_in(auth_data, (const char *)blob.data, blob.length))
-        {
-                prs_mem_free(auth_data);
-                return NT_STATUS_NO_MEMORY;
+        status = dcerpc_push_schannel_bind(cli, &r, auth_token);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
         }
 
@@ -1763 +1102 @@
  ********************************************************************/
 
-static NTSTATUS create_bind_or_alt_ctx_internal(enum dcerpc_pkt_type pkt_type,
-                                                prs_struct *rpc_out, 
+static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
+                                                enum dcerpc_pkt_type ptype,
                                                 uint32 rpc_call_id,
                                                 const struct ndr_syntax_id *abstract,
                                                 const struct ndr_syntax_id *transfer,
-                                                RPC_HDR_AUTH *phdr_auth,
-                                                prs_struct *pauth_info)
-{
-        RPC_HDR hdr;
-        RPC_HDR_RB hdr_rb;
-        RPC_CONTEXT rpc_ctx;
-        uint16 auth_len = prs_offset(pauth_info);
-        uint8 ss_padding_len = 0;
-        uint16 frag_len = 0;
-
-        /* create the RPC context. */
-        init_rpc_context(&rpc_ctx, 0 /* context id */, abstract, transfer);
-
-        /* create the bind request RPC_HDR_RB */
-        init_rpc_hdr_rb(&hdr_rb, RPC_MAX_PDU_FRAG_LEN, RPC_MAX_PDU_FRAG_LEN, 0x0, &rpc_ctx);
-
-        /* Start building the frag length. */
-        frag_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
-
-        /* Do we need to pad ? */
+                                                const DATA_BLOB *auth_info,
+                                                DATA_BLOB *blob)
+{
+        uint16 auth_len = auth_info->length;
+        NTSTATUS status;
+        union dcerpc_payload u;
+        struct dcerpc_ctx_list ctx_list;
+
         if (auth_len) {
-                uint16 data_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
-                if (data_len % 8) {
-                        ss_padding_len = 8 - (data_len % 8);
-                        phdr_auth->auth_pad_len = ss_padding_len;
-                }
-                frag_len += RPC_HDR_AUTH_LEN + auth_len + ss_padding_len;
-        }
-
-        /* Create the request RPC_HDR */
-        init_rpc_hdr(&hdr, pkt_type, DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST, rpc_call_id, frag_len, auth_len);
-
-        /* Marshall the RPC header */
-        if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
-                DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR.\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* Marshall the bind request data */
-        if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
-                DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /*
-         * Grow the outgoing buffer to store any auth info.
-         */
-
-        if(auth_len != 0) {
-                if (ss_padding_len) {
-                        char pad[8];
-                        memset(pad, '\0', 8);
-                        if (!prs_copy_data_in(rpc_out, pad, ss_padding_len)) {
-                                DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall padding.\n"));
-                                return NT_STATUS_NO_MEMORY;
-                        }
-                }
-
-                if(!smb_io_rpc_hdr_auth("hdr_auth", phdr_auth, rpc_out, 0)) {
-                        DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_AUTH.\n"));
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-
-                if(!prs_append_prs_data( rpc_out, pauth_info)) {
-                        DEBUG(0,("create_bind_or_alt_ctx_internal: failed to grow parse struct to add auth.\n"));
-                        return NT_STATUS_NO_MEMORY;
-                }
+                auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
+        }
+
+        ctx_list.context_id = 0;
+        ctx_list.num_transfer_syntaxes = 1;
+        ctx_list.abstract_syntax = *abstract;
+        ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
+
+        u.bind.max_xmit_frag    = RPC_MAX_PDU_FRAG_LEN;
+        u.bind.max_recv_frag    = RPC_MAX_PDU_FRAG_LEN;
+        u.bind.assoc_group_id   = 0x0;
+        u.bind.num_contexts     = 1;
+        u.bind.ctx_list         = &ctx_list;
+        u.bind.auth_info        = *auth_info;
+
+        status = dcerpc_push_ncacn_packet(mem_ctx,
+                                          ptype,
+                                          DCERPC_PFC_FLAG_FIRST |
+                                          DCERPC_PFC_FLAG_LAST,
+                                          auth_len,
+                                          rpc_call_id,
+                                          &u,
+                                          blob);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
+                return status;
         }
 
@@ -1845 +1151 @@
  ********************************************************************/
 
-static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
-                                prs_struct *rpc_out, 
-                                uint32 rpc_call_id,
-                                const struct ndr_syntax_id *abstract,
-                                const struct ndr_syntax_id *transfer,
-                                enum pipe_auth_type auth_type,
-                                enum dcerpc_AuthLevel auth_level)
-{
-        RPC_HDR_AUTH hdr_auth;
-        prs_struct auth_info;
+static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
+                                    struct rpc_pipe_client *cli,
+                                    struct pipe_auth_data *auth,
+                                    uint32 rpc_call_id,
+                                    const struct ndr_syntax_id *abstract,
+                                    const struct ndr_syntax_id *transfer,
+                                    DATA_BLOB *rpc_out)
+{
+        DATA_BLOB auth_token = data_blob_null;
+        DATA_BLOB auth_info = data_blob_null;
         NTSTATUS ret = NT_STATUS_OK;
 
-        ZERO_STRUCT(hdr_auth);
-        if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
-                return NT_STATUS_NO_MEMORY;
-
-        switch (auth_type) {
-                case PIPE_AUTH_TYPE_SCHANNEL:
-                        ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
-                        if (!NT_STATUS_IS_OK(ret)) {
-                                prs_mem_free(&auth_info);
-                                return ret;
-                        }
-                        break;
-
-                case PIPE_AUTH_TYPE_NTLMSSP:
-                        ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
-                        if (!NT_STATUS_IS_OK(ret)) {
-                                prs_mem_free(&auth_info);
-                                return ret;
-                        }
-                        break;
-
-                case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
-                        ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
-                        if (!NT_STATUS_IS_OK(ret)) {
-                                prs_mem_free(&auth_info);
-                                return ret;
-                        }
-                        break;
-
-                case PIPE_AUTH_TYPE_KRB5:
-                        ret = create_krb5_auth_bind_req(cli, auth_level, &hdr_auth, &auth_info);
-                        if (!NT_STATUS_IS_OK(ret)) {
-                                prs_mem_free(&auth_info);
-                                return ret;
-                        }
-                        break;
-
-                case PIPE_AUTH_TYPE_NONE:
-                        break;
-
-                default:
-                        /* "Can't" happen. */
-                        return NT_STATUS_INVALID_INFO_CLASS;
-        }
-
-        ret = create_bind_or_alt_ctx_internal(DCERPC_PKT_BIND,
-                                                rpc_out, 
-                                                rpc_call_id,
-                                                abstract,
-                                                transfer,
-                                                &hdr_auth,
+        switch (auth->auth_type) {
+        case DCERPC_AUTH_TYPE_SCHANNEL:
+                ret = create_schannel_auth_rpc_bind_req(cli, &auth_token);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        return ret;
+                }
+                break;
+
+        case DCERPC_AUTH_TYPE_NTLMSSP:
+                ret = create_ntlmssp_auth_rpc_bind_req(cli, &auth_token);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        return ret;
+                }
+                break;
+
+        case DCERPC_AUTH_TYPE_SPNEGO:
+                ret = create_spnego_auth_bind_req(cli, auth, &auth_token);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        return ret;
+                }
+                break;
+
+        case DCERPC_AUTH_TYPE_KRB5:
+                ret = create_gssapi_auth_bind_req(mem_ctx, auth, &auth_token);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        return ret;
+                }
+                break;
+
+        case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
+                auth_token = data_blob_talloc(mem_ctx,
+                                              "NCALRPC_AUTH_TOKEN",
+                                              18);
+                break;
+
+        case DCERPC_AUTH_TYPE_NONE:
+                break;
+
+        default:
+                /* "Can't" happen. */
+                return NT_STATUS_INVALID_INFO_CLASS;
+        }
+
+        if (auth_token.length != 0) {
+                ret = dcerpc_push_dcerpc_auth(cli,
+                                                auth->auth_type,
+                                                auth->auth_level,
+                                                0, /* auth_pad_length */
+                                                1, /* auth_context_id */
+                                                &auth_token,
                                                 &auth_info);
-
-        prs_mem_free(&auth_info);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        return ret;
+                }
+                data_blob_free(&auth_token);
+        }
+
+        ret = create_bind_or_alt_ctx_internal(mem_ctx,
+                                              DCERPC_PKT_BIND,
+                                              rpc_call_id,
+                                              abstract,
+                                              transfer,
+                                              &auth_info,
+                                              rpc_out);
         return ret;
-}
-
-/*******************************************************************
- Create and add the NTLMSSP sign/seal auth header and data.
- ********************************************************************/
-
-static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
-                                        RPC_HDR *phdr,
-                                        uint32 ss_padding_len,
-                                        prs_struct *outgoing_pdu)
-{
-        RPC_HDR_AUTH auth_info;
-        NTSTATUS status;
-        DATA_BLOB auth_blob = data_blob_null;
-        uint16 data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
-
-        if (!cli->auth->a_u.ntlmssp_state) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Init and marshall the auth header. */
-        init_rpc_hdr_auth(&auth_info,
-                        map_pipe_auth_type_to_rpc_auth_type(
-                                cli->auth->auth_type),
-                        cli->auth->auth_level,
-                        ss_padding_len,
-                        1 /* context id. */);
-
-        if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
-                DEBUG(0,("add_ntlmssp_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
-                data_blob_free(&auth_blob);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        switch (cli->auth->auth_level) {
-                case DCERPC_AUTH_LEVEL_PRIVACY:
-                        /* Data portion is encrypted. */
-                        status = ntlmssp_seal_packet(cli->auth->a_u.ntlmssp_state,
-                                        (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
-                                        data_and_pad_len,
-                                        (unsigned char *)prs_data_p(outgoing_pdu),
-                                        (size_t)prs_offset(outgoing_pdu),
-                                        &auth_blob);
-                        if (!NT_STATUS_IS_OK(status)) {
-                                data_blob_free(&auth_blob);
-                                return status;
-                        }
-                        break;
-
-                case DCERPC_AUTH_LEVEL_INTEGRITY:
-                        /* Data is signed. */
-                        status = ntlmssp_sign_packet(cli->auth->a_u.ntlmssp_state,
-                                        (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
-                                        data_and_pad_len,
-                                        (unsigned char *)prs_data_p(outgoing_pdu),
-                                        (size_t)prs_offset(outgoing_pdu),
-                                        &auth_blob);
-                        if (!NT_STATUS_IS_OK(status)) {
-                                data_blob_free(&auth_blob);
-                                return status;
-                        }
-                        break;
-
-                default:
-                        /* Can't happen. */
-                        smb_panic("bad auth level");
-                        /* Notreached. */
-                        return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Finally marshall the blob. */
-
-        if (!prs_copy_data_in(outgoing_pdu, (const char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
-                DEBUG(0,("add_ntlmssp_auth_footer: failed to add %u bytes auth blob.\n",
-                        (unsigned int)NTLMSSP_SIG_SIZE));
-                data_blob_free(&auth_blob);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        data_blob_free(&auth_blob);
-        return NT_STATUS_OK;
-}
-
-/*******************************************************************
- Create and add the schannel sign/seal auth header and data.
- ********************************************************************/
-
-static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
-                                        RPC_HDR *phdr,
-                                        uint32 ss_padding_len,
-                                        prs_struct *outgoing_pdu)
-{
-        RPC_HDR_AUTH auth_info;
-        struct schannel_state *sas = cli->auth->a_u.schannel_auth;
-        char *data_p = prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
-        size_t data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
-        DATA_BLOB blob;
-        NTSTATUS status;
-
-        if (!sas) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Init and marshall the auth header. */
-        init_rpc_hdr_auth(&auth_info,
-                        map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
-                        cli->auth->auth_level,
-                        ss_padding_len,
-                        1 /* context id. */);
-
-        if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
-                DEBUG(0,("add_schannel_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
-                        sas->seq_num));
-
-        switch (cli->auth->auth_level) {
-        case DCERPC_AUTH_LEVEL_PRIVACY:
-                status = netsec_outgoing_packet(sas,
-                                                talloc_tos(),
-                                                true,
-                                                (uint8_t *)data_p,
-                                                data_and_pad_len,
-                                                &blob);
-                break;
-        case DCERPC_AUTH_LEVEL_INTEGRITY:
-                status = netsec_outgoing_packet(sas,
-                                                talloc_tos(),
-                                                false,
-                                                (uint8_t *)data_p,
-                                                data_and_pad_len,
-                                                &blob);
-                break;
-        default:
-                status = NT_STATUS_INTERNAL_ERROR;
-                break;
-        }
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1,("add_schannel_auth_footer: failed to process packet: %s\n",
-                        nt_errstr(status)));
-                return status;
-        }
-
-        if (DEBUGLEVEL >= 10) {
-                dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
-        }
-
-        /* Finally marshall the blob. */
-        if (!prs_copy_data_in(outgoing_pdu, (const char *)blob.data, blob.length)) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        return NT_STATUS_OK;
-}
-
-/*******************************************************************
- Calculate how much data we're going to send in this packet, also
- work out any sign/seal padding length.
- ********************************************************************/
-
-static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
-                                        uint32 data_left,
-                                        uint16 *p_frag_len,
-                                        uint16 *p_auth_len,
-                                        uint32 *p_ss_padding)
-{
-        uint32 data_space, data_len;
-
-#if 0
-        if ((data_left > 0) && (sys_random() % 2)) {
-                data_left = MAX(data_left/2, 1);
-        }
-#endif
-
-        switch (cli->auth->auth_level) {
-                case DCERPC_AUTH_LEVEL_NONE:
-                case DCERPC_AUTH_LEVEL_CONNECT:
-                        data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN;
-                        data_len = MIN(data_space, data_left);
-                        *p_ss_padding = 0;
-                        *p_auth_len = 0;
-                        *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + data_len;
-                        return data_len;
-
-                case DCERPC_AUTH_LEVEL_INTEGRITY:
-                case DCERPC_AUTH_LEVEL_PRIVACY:
-                        /* Treat the same for all authenticated rpc requests. */
-                        switch(cli->auth->auth_type) {
-                                case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
-                                case PIPE_AUTH_TYPE_NTLMSSP:
-                                        *p_auth_len = NTLMSSP_SIG_SIZE;
-                                        break;
-                                case PIPE_AUTH_TYPE_SCHANNEL:
-                                        *p_auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
-                                        break;
-                                default:
-                                        smb_panic("bad auth type");
-                                        break;
-                        }
-
-                        data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
-                                                RPC_HDR_AUTH_LEN - *p_auth_len;
-
-                        data_len = MIN(data_space, data_left);
-                        *p_ss_padding = 0;
-                        if (data_len % 8) {
-                                *p_ss_padding = 8 - (data_len % 8);
-                        }
-                        *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN +                /* Normal headers. */
-                                        data_len + *p_ss_padding +              /* data plus padding. */
-                                        RPC_HDR_AUTH_LEN + *p_auth_len;         /* Auth header and auth data. */
-                        return data_len;
-
-                default:
-                        smb_panic("bad auth level");
-                        /* Notreached. */
-                        return 0;
-        }
 }
 
@@ -2147 +1242 @@
         uint8_t op_num;
         uint32_t call_id;
-        prs_struct *req_data;
+        DATA_BLOB *req_data;
         uint32_t req_data_sent;
-        prs_struct outgoing_frag;
-        prs_struct reply_pdu;
+        DATA_BLOB rpc_out;
+        DATA_BLOB reply_pdu;
 };
-
-static int rpc_api_pipe_req_state_destructor(struct rpc_api_pipe_req_state *s)
-{
-        prs_mem_free(&s->outgoing_frag);
-        prs_mem_free(&s->reply_pdu);
-        return 0;
-}
 
 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
@@ -2169 +1257 @@
                                          struct rpc_pipe_client *cli,
                                          uint8_t op_num,
-                                         prs_struct *req_data)
+                                         DATA_BLOB *req_data)
 {
         struct tevent_req *req, *subreq;
@@ -2187 +1275 @@
         state->req_data_sent = 0;
         state->call_id = get_rpc_call_id();
-
-        if (cli->max_xmit_frag
-            < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_MAX_SIGN_SIZE) {
+        state->reply_pdu = data_blob_null;
+        state->rpc_out = data_blob_null;
+
+        if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
+                                        + RPC_MAX_SIGN_SIZE) {
                 /* Server is screwed up ! */
                 status = NT_STATUS_INVALID_PARAMETER;
@@ -2195 +1285 @@
         }
 
-        prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
-
-        if (!prs_init(&state->outgoing_frag, cli->max_xmit_frag,
-                      state, MARSHALL)) {
-                goto fail;
-        }
-
-        talloc_set_destructor(state, rpc_api_pipe_req_state_destructor);
-
         status = prepare_next_frag(state, &is_last_frag);
         if (!NT_STATUS_IS_OK(status)) {
@@ -2211 +1292 @@
         if (is_last_frag) {
                 subreq = rpc_api_pipe_send(state, ev, state->cli,
-                                           &state->outgoing_frag,
+                                           &state->rpc_out,
                                            DCERPC_PKT_RESPONSE);
                 if (subreq == NULL) {
@@ -2218 +1299 @@
                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
         } else {
-                subreq = rpc_write_send(
-                        state, ev, cli->transport,
-                        (uint8_t *)prs_data_p(&state->outgoing_frag),
-                        prs_offset(&state->outgoing_frag));
+                subreq = rpc_write_send(state, ev, cli->transport,
+                                        state->rpc_out.data,
+                                        state->rpc_out.length);
                 if (subreq == NULL) {
                         goto fail;
@@ -2241 +1321 @@
                                   bool *is_last_frag)
 {
-        RPC_HDR hdr;
-        RPC_HDR_REQ hdr_req;
-        uint32_t data_sent_thistime;
-        uint16_t auth_len;
-        uint16_t frag_len;
+        size_t data_sent_thistime;
+        size_t auth_len;
+        size_t frag_len;
         uint8_t flags = 0;
-        uint32_t ss_padding;
-        uint32_t data_left;
-        char pad[8] = { 0, };
-        NTSTATUS status;
-
-        data_left = prs_offset(state->req_data) - state->req_data_sent;
-
-        data_sent_thistime = calculate_data_len_tosend(
-                state->cli, data_left, &frag_len, &auth_len, &ss_padding);
+        size_t pad_len;
+        size_t data_left;
+        NTSTATUS status;
+        union dcerpc_payload u;
+
+        data_left = state->req_data->length - state->req_data_sent;
+
+        status = dcerpc_guess_sizes(state->cli->auth,
+                                    DCERPC_REQUEST_LENGTH, data_left,
+                                    state->cli->max_xmit_frag,
+                                    CLIENT_NDR_PADDING_SIZE,
+                                    &data_sent_thistime,
+                                    &frag_len, &auth_len, &pad_len);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         if (state->req_data_sent == 0) {
@@ -2265 +1350 @@
         }
 
-        if (!prs_set_offset(&state->outgoing_frag, 0)) {
+        data_blob_free(&state->rpc_out);
+
+        ZERO_STRUCT(u.request);
+
+        u.request.alloc_hint    = state->req_data->length;
+        u.request.context_id    = 0;
+        u.request.opnum         = state->op_num;
+
+        status = dcerpc_push_ncacn_packet(state,
+                                          DCERPC_PKT_REQUEST,
+                                          flags,
+                                          auth_len,
+                                          state->call_id,
+                                          &u,
+                                          &state->rpc_out);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
+         * compute it right for requests because the auth trailer is missing
+         * at this stage */
+        dcerpc_set_frag_length(&state->rpc_out, frag_len);
+
+        /* Copy in the data. */
+        if (!data_blob_append(NULL, &state->rpc_out,
+                                state->req_data->data + state->req_data_sent,
+                                data_sent_thistime)) {
                 return NT_STATUS_NO_MEMORY;
         }
 
-        /* Create and marshall the header and request header. */
-        init_rpc_hdr(&hdr, DCERPC_PKT_REQUEST, flags, state->call_id, frag_len,
-                     auth_len);
-
-        if (!smb_io_rpc_hdr("hdr    ", &hdr, &state->outgoing_frag, 0)) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* Create the rpc request RPC_HDR_REQ */
-        init_rpc_hdr_req(&hdr_req, prs_offset(state->req_data),
-                         state->op_num);
-
-        if (!smb_io_rpc_hdr_req("hdr_req", &hdr_req,
-                                &state->outgoing_frag, 0)) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* Copy in the data, plus any ss padding. */
-        if (!prs_append_some_prs_data(&state->outgoing_frag,
-                                      state->req_data, state->req_data_sent,
-                                      data_sent_thistime)) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* Copy the sign/seal padding data. */
-        if (!prs_copy_data_in(&state->outgoing_frag, pad, ss_padding)) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* Generate any auth sign/seal and add the auth footer. */
-        switch (state->cli->auth->auth_type) {
-        case PIPE_AUTH_TYPE_NONE:
-                status = NT_STATUS_OK;
+        switch (state->cli->auth->auth_level) {
+        case DCERPC_AUTH_LEVEL_NONE:
+        case DCERPC_AUTH_LEVEL_CONNECT:
+        case DCERPC_AUTH_LEVEL_PACKET:
                 break;
-        case PIPE_AUTH_TYPE_NTLMSSP:
-        case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
-                status = add_ntlmssp_auth_footer(state->cli, &hdr, ss_padding,
-                                                 &state->outgoing_frag);
-                break;
-        case PIPE_AUTH_TYPE_SCHANNEL:
-                status = add_schannel_auth_footer(state->cli, &hdr, ss_padding,
-                                                  &state->outgoing_frag);
+        case DCERPC_AUTH_LEVEL_INTEGRITY:
+        case DCERPC_AUTH_LEVEL_PRIVACY:
+                status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
+                                                &state->rpc_out);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 break;
         default:
-                status = NT_STATUS_INVALID_PARAMETER;
-                break;
+                return NT_STATUS_INVALID_PARAMETER;
         }
 
@@ -2347 +1428 @@
         if (is_last_frag) {
                 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
-                                           &state->outgoing_frag,
+                                           &state->rpc_out,
                                            DCERPC_PKT_RESPONSE);
                 if (tevent_req_nomem(subreq, req)) {
@@ -2354 +1435 @@
                 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
         } else {
-                subreq = rpc_write_send(
-                        state, state->ev,
-                        state->cli->transport,
-                        (uint8_t *)prs_data_p(&state->outgoing_frag),
-                        prs_offset(&state->outgoing_frag));
+                subreq = rpc_write_send(state, state->ev,
+                                        state->cli->transport,
+                                        state->rpc_out.data,
+                                        state->rpc_out.length);
                 if (tevent_req_nomem(subreq, req)) {
                         return;
@@ -2375 +1455 @@
         NTSTATUS status;
 
-        status = rpc_api_pipe_recv(subreq, state, &state->reply_pdu);
+        status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
         TALLOC_FREE(subreq);
         if (!NT_STATUS_IS_OK(status)) {
@@ -2385 +1465 @@
 
 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
-                               prs_struct *reply_pdu)
+                               DATA_BLOB *reply_pdu)
 {
         struct rpc_api_pipe_req_state *state = tevent_req_data(
@@ -2396 +1476 @@
                  * none. The rpccli_* caller routines expect this.
                  */
-                prs_init_empty(reply_pdu, mem_ctx, UNMARSHALL);
+                *reply_pdu = data_blob_null;
                 return status;
         }
 
-        *reply_pdu = state->reply_pdu;
-        reply_pdu->mem_ctx = mem_ctx;
-
-        /*
-         * Prevent state->req_pdu from being freed in
-         * rpc_api_pipe_req_state_destructor()
-         */
-        prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
+        /* return data to caller and assign it ownership of memory */
+        reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
+        reply_pdu->length = state->reply_pdu.length;
+        state->reply_pdu.length = 0;
 
         return NT_STATUS_OK;
 }
-
-#if 0
-/****************************************************************************
- Set the handle state.
-****************************************************************************/
-
-static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
-                                   const char *pipe_name, uint16 device_state)
-{
-        bool state_set = False;
-        char param[2];
-        uint16 setup[2]; /* only need 2 uint16 setup parameters */
-        char *rparam = NULL;
-        char *rdata = NULL;
-        uint32 rparam_len, rdata_len;
-
-        if (pipe_name == NULL)
-                return False;
-
-        DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
-                 cli->fnum, pipe_name, device_state));
-
-        /* create parameters: device state */
-        SSVAL(param, 0, device_state);
-
-        /* create setup parameters. */
-        setup[0] = 0x0001; 
-        setup[1] = cli->fnum; /* pipe file handle.  got this from an SMBOpenX. */
-
-        /* send the data on \PIPE\ */
-        if (cli_api_pipe(cli->cli, "\\PIPE\\",
-                    setup, 2, 0,                /* setup, length, max */
-                    param, 2, 0,                /* param, length, max */
-                    NULL, 0, 1024,              /* data, length, max */
-                    &rparam, &rparam_len,        /* return param, length */
-                    &rdata, &rdata_len))         /* return data, length */
-        {
-                DEBUG(5, ("Set Handle state: return OK\n"));
-                state_set = True;
-        }
-
-        SAFE_FREE(rparam);
-        SAFE_FREE(rdata);
-
-        return state_set;
-}
-#endif
 
 /****************************************************************************
@@ -2463 +1492 @@
 ****************************************************************************/
 
-static bool check_bind_response(RPC_HDR_BA *hdr_ba,
+static bool check_bind_response(const struct dcerpc_bind_ack *r,
                                 const struct ndr_syntax_id *transfer)
 {
-        if ( hdr_ba->addr.len == 0) {
+        struct dcerpc_ack_ctx ctx;
+
+        if (r->secondary_address_size == 0) {
                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
         }
 
+        if (r->num_results < 1 || !r->ctx_list) {
+                return false;
+        }
+
+        ctx = r->ctx_list[0];
+
         /* check the transfer syntax */
-        if ((hdr_ba->transfer.if_version != transfer->if_version) ||
-             (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
+        if ((ctx.syntax.if_version != transfer->if_version) ||
+             (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
                 return False;
         }
 
-        if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
+        if (r->num_results != 0x1 || ctx.result != 0) {
                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
-                          hdr_ba->res.num_results, hdr_ba->res.reason));
+                          r->num_results, ctx.reason));
         }
 
@@ -2493 +1530 @@
  ********************************************************************/
 
-static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
+static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
+                                struct rpc_pipe_client *cli,
                                 uint32 rpc_call_id,
-                                enum pipe_auth_type auth_type,
+                                enum dcerpc_AuthType auth_type,
                                 enum dcerpc_AuthLevel auth_level,
                                 DATA_BLOB *pauth_blob,
-                                prs_struct *rpc_out)
-{
-        RPC_HDR hdr;
-        RPC_HDR_AUTH hdr_auth;
-        uint32 pad = 0;
-
-        /* Create the request RPC_HDR */
-        init_rpc_hdr(&hdr, DCERPC_PKT_AUTH3, DCERPC_PFC_FLAG_FIRST|DCERPC_PFC_FLAG_LAST, rpc_call_id,
-                     RPC_HEADER_LEN + 4 /* pad */ + RPC_HDR_AUTH_LEN + pauth_blob->length,
-                     pauth_blob->length );
-
-        /* Marshall it. */
-        if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
-                DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR.\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /*
-                I'm puzzled about this - seems to violate the DCE RPC auth rules,
-                about padding - shouldn't this pad to length 8 ? JRA.
-        */
-
-        /* 4 bytes padding. */
-        if (!prs_uint32("pad", rpc_out, 0, &pad)) {
-                DEBUG(0,("create_rpc_bind_auth3: failed to marshall 4 byte pad.\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* Create the request RPC_HDR_AUTHA */
-        init_rpc_hdr_auth(&hdr_auth,
-                        map_pipe_auth_type_to_rpc_auth_type(auth_type),
-                        auth_level, 0, 1);
-
-        if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rpc_out, 0)) {
-                DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR_AUTHA.\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /*
-         * Append the auth data to the outgoing buffer.
-         */
-
-        if(!prs_copy_data_in(rpc_out, (char *)pauth_blob->data, pauth_blob->length)) {
-                DEBUG(0,("create_rpc_bind_auth3: failed to marshall auth blob.\n"));
-                return NT_STATUS_NO_MEMORY;
+                                DATA_BLOB *rpc_out)
+{
+        NTSTATUS status;
+        union dcerpc_payload u;
+
+        u.auth3._pad = 0;
+
+        status = dcerpc_push_dcerpc_auth(mem_ctx,
+                                         auth_type,
+                                         auth_level,
+                                         0, /* auth_pad_length */
+                                         1, /* auth_context_id */
+                                         pauth_blob,
+                                         &u.auth3.auth_info);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        status = dcerpc_push_ncacn_packet(mem_ctx,
+                                          DCERPC_PKT_AUTH3,
+                                          DCERPC_PFC_FLAG_FIRST |
+                                          DCERPC_PFC_FLAG_LAST,
+                                          pauth_blob->length,
+                                          rpc_call_id,
+                                          &u,
+                                          rpc_out);
+        data_blob_free(&u.auth3.auth_info);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
+                return status;
         }
 
@@ -2553 +1576 @@
  ********************************************************************/
 
-static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
+static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
+                                        enum dcerpc_AuthType auth_type,
+                                        enum dcerpc_AuthLevel auth_level,
+                                        uint32 rpc_call_id,
                                         const struct ndr_syntax_id *abstract,
                                         const struct ndr_syntax_id *transfer,
-                                        enum dcerpc_AuthLevel auth_level,
                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
-                                        prs_struct *rpc_out)
-{
-        RPC_HDR_AUTH hdr_auth;
-        prs_struct auth_info;
-        NTSTATUS ret = NT_STATUS_OK;
-
-        ZERO_STRUCT(hdr_auth);
-        if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
-                return NT_STATUS_NO_MEMORY;
-
-        /* We may change the pad length before marshalling. */
-        init_rpc_hdr_auth(&hdr_auth, DCERPC_AUTH_TYPE_SPNEGO, (int)auth_level, 0, 1);
-
-        if (pauth_blob->length) {
-                if (!prs_copy_data_in(&auth_info, (const char *)pauth_blob->data, pauth_blob->length)) {
-                        prs_mem_free(&auth_info);
-                        return NT_STATUS_NO_MEMORY;
-                }
-        }
-
-        ret = create_bind_or_alt_ctx_internal(DCERPC_PKT_ALTER,
-                                                rpc_out, 
-                                                rpc_call_id,
-                                                abstract,
-                                                transfer,
-                                                &hdr_auth,
-                                                &auth_info);
-        prs_mem_free(&auth_info);
-        return ret;
+                                        DATA_BLOB *rpc_out)
+{
+        DATA_BLOB auth_info;
+        NTSTATUS status;
+
+        status = dcerpc_push_dcerpc_auth(mem_ctx,
+                                         auth_type,
+                                         auth_level,
+                                         0, /* auth_pad_length */
+                                         1, /* auth_context_id */
+                                         pauth_blob,
+                                         &auth_info);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        status = create_bind_or_alt_ctx_internal(mem_ctx,
+                                                 DCERPC_PKT_ALTER,
+                                                 rpc_call_id,
+                                                 abstract,
+                                                 transfer,
+                                                 &auth_info,
+                                                 rpc_out);
+        data_blob_free(&auth_info);
+        return status;
 }
 
@@ -2596 +1617 @@
         struct event_context *ev;
         struct rpc_pipe_client *cli;
-        prs_struct rpc_out;
+        DATA_BLOB rpc_out;
+        bool auth3;
         uint32_t rpc_call_id;
 };
 
-static int rpc_pipe_bind_state_destructor(struct rpc_pipe_bind_state *state)
-{
-        prs_mem_free(&state->rpc_out);
-        return 0;
-}
-
 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
-static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
-                                           struct rpc_pipe_bind_state *state,
-                                           struct rpc_hdr_info *phdr,
-                                           prs_struct *reply_pdu);
-static void rpc_bind_auth3_write_done(struct tevent_req *subreq);
-static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
-                                                    struct rpc_pipe_bind_state *state,
-                                                    struct rpc_hdr_info *phdr,
-                                                    prs_struct *reply_pdu);
-static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq);
+static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
+                                   struct rpc_pipe_bind_state *state,
+                                   DATA_BLOB *credentials);
+static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
+                                     struct rpc_pipe_bind_state *state,
+                                     DATA_BLOB *credentials);
 
 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
                                       struct event_context *ev,
                                       struct rpc_pipe_client *cli,
-                                      struct cli_pipe_auth_data *auth)
+                                      struct pipe_auth_data *auth)
 {
         struct tevent_req *req, *subreq;
@@ -2641 +1653 @@
         state->rpc_call_id = get_rpc_call_id();
 
-        prs_init_empty(&state->rpc_out, state, MARSHALL);
-        talloc_set_destructor(state, rpc_pipe_bind_state_destructor);
-
         cli->auth = talloc_move(cli, &auth);
 
         /* Marshall the outgoing data. */
-        status = create_rpc_bind_req(cli, &state->rpc_out,
+        status = create_rpc_bind_req(state, cli,
+                                     cli->auth,
                                      state->rpc_call_id,
                                      &cli->abstract_syntax,
                                      &cli->transfer_syntax,
-                                     cli->auth->auth_type,
-                                     cli->auth->auth_level);
+                                     &state->rpc_out);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -2680 +1689 @@
         struct rpc_pipe_bind_state *state = tevent_req_data(
                 req, struct rpc_pipe_bind_state);
-        prs_struct reply_pdu;
-        struct rpc_hdr_info hdr;
-        struct rpc_hdr_ba_info hdr_ba;
-        NTSTATUS status;
-
-        status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
+        struct pipe_auth_data *pauth = state->cli->auth;
+        struct auth_ntlmssp_state *ntlmssp_ctx;
+        struct spnego_context *spnego_ctx;
+        struct gse_context *gse_ctx;
+        struct ncacn_packet *pkt = NULL;
+        struct dcerpc_auth auth;
+        DATA_BLOB auth_token = data_blob_null;
+        NTSTATUS status;
+
+        status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
         TALLOC_FREE(subreq);
         if (!NT_STATUS_IS_OK(status)) {
@@ -2695 +1708 @@
         }
 
-        /* Unmarshall the RPC header */
-        if (!smb_io_rpc_hdr("hdr", &hdr, &reply_pdu, 0)) {
-                DEBUG(0, ("rpc_pipe_bind: failed to unmarshall RPC_HDR.\n"));
-                prs_mem_free(&reply_pdu);
+        if (state->auth3) {
+                tevent_req_done(req);
+                return;
+        }
+
+        if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
+                DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
                 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
                 return;
         }
 
-        if (!smb_io_rpc_hdr_ba("", &hdr_ba, &reply_pdu, 0)) {
-                DEBUG(0, ("rpc_pipe_bind: Failed to unmarshall "
-                          "RPC_HDR_BA.\n"));
-                prs_mem_free(&reply_pdu);
-                tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
-                return;
-        }
-
-        if (!check_bind_response(&hdr_ba, &state->cli->transfer_syntax)) {
-                DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
-                prs_mem_free(&reply_pdu);
-                tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
-                return;
-        }
-
-        state->cli->max_xmit_frag = hdr_ba.bba.max_tsize;
-        state->cli->max_recv_frag = hdr_ba.bba.max_rsize;
+        state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
+        state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
+
+        switch(pauth->auth_type) {
+
+        case DCERPC_AUTH_TYPE_NONE:
+        case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
+        case DCERPC_AUTH_TYPE_SCHANNEL:
+                /* Bind complete. */
+                tevent_req_done(req);
+                return;
+
+        case DCERPC_AUTH_TYPE_NTLMSSP:
+        case DCERPC_AUTH_TYPE_SPNEGO:
+        case DCERPC_AUTH_TYPE_KRB5:
+                /* Paranoid lenght checks */
+                if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
+                                                + pkt->auth_length) {
+                        tevent_req_nterror(req,
+                                        NT_STATUS_INFO_LENGTH_MISMATCH);
+                        return;
+                }
+                /* get auth credentials */
+                status = dcerpc_pull_dcerpc_auth(talloc_tos(),
+                                                 &pkt->u.bind_ack.auth_info,
+                                                 &auth, false);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
+                                  nt_errstr(status)));
+                        tevent_req_nterror(req, status);
+                        return;
+                }
+                break;
+
+        default:
+                goto err_out;
+        }
 
         /*
@@ -2725 +1761 @@
          */
 
-        switch(state->cli->auth->auth_type) {
-
-        case PIPE_AUTH_TYPE_NONE:
-        case PIPE_AUTH_TYPE_SCHANNEL:
+        switch(pauth->auth_type) {
+
+        case DCERPC_AUTH_TYPE_NONE:
+        case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
+        case DCERPC_AUTH_TYPE_SCHANNEL:
                 /* Bind complete. */
-                prs_mem_free(&reply_pdu);
                 tevent_req_done(req);
-                break;
-
-        case PIPE_AUTH_TYPE_NTLMSSP:
-                /* Need to send AUTH3 packet - no reply. */
-                status = rpc_finish_auth3_bind_send(req, state, &hdr,
-                                                    &reply_pdu);
-                prs_mem_free(&reply_pdu);
-                if (!NT_STATUS_IS_OK(status)) {
-                        tevent_req_nterror(req, status);
+                return;
+
+        case DCERPC_AUTH_TYPE_NTLMSSP:
+                ntlmssp_ctx = talloc_get_type_abort(pauth->auth_ctx,
+                                                    struct auth_ntlmssp_state);
+                status = auth_ntlmssp_update(ntlmssp_ctx,
+                                             auth.credentials, &auth_token);
+                if (NT_STATUS_EQUAL(status,
+                                    NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+                        status = rpc_bind_next_send(req, state,
+                                                        &auth_token);
+                } else if (NT_STATUS_IS_OK(status)) {
+                        status = rpc_bind_finish_send(req, state,
+                                                        &auth_token);
                 }
                 break;
 
-        case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
-                /* Need to send alter context request and reply. */
-                status = rpc_finish_spnego_ntlmssp_bind_send(req, state, &hdr,
-                                                             &reply_pdu);
-                prs_mem_free(&reply_pdu);
+        case DCERPC_AUTH_TYPE_SPNEGO:
+                spnego_ctx = talloc_get_type_abort(pauth->auth_ctx,
+                                                   struct spnego_context);
+                status = spnego_get_client_auth_token(state,
+                                                spnego_ctx,
+                                                &auth.credentials,
+                                                &auth_token);
                 if (!NT_STATUS_IS_OK(status)) {
-                        tevent_req_nterror(req, status);
+                        break;
+                }
+                if (auth_token.length == 0) {
+                        /* Bind complete. */
+                        tevent_req_done(req);
+                        return;
+                }
+                if (spnego_require_more_processing(spnego_ctx)) {
+                        status = rpc_bind_next_send(req, state,
+                                                        &auth_token);
+                } else {
+                        status = rpc_bind_finish_send(req, state,
+                                                        &auth_token);
                 }
                 break;
 
-        case PIPE_AUTH_TYPE_KRB5:
-                /* */
+        case DCERPC_AUTH_TYPE_KRB5:
+                gse_ctx = talloc_get_type_abort(pauth->auth_ctx,
+                                                struct gse_context);
+                status = gse_get_client_auth_token(state,
+                                                   gse_ctx,
+                                                   &auth.credentials,
+                                                   &auth_token);
+                if (!NT_STATUS_IS_OK(status)) {
+                        break;
+                }
+
+                if (gse_require_more_processing(gse_ctx)) {
+                        status = rpc_bind_next_send(req, state, &auth_token);
+                } else {
+                        status = rpc_bind_finish_send(req, state, &auth_token);
+                }
+                break;
 
         default:
-                DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
-                         (unsigned int)state->cli->auth->auth_type));
-                prs_mem_free(&reply_pdu);
-                tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
-        }
-}
-
-static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
-                                           struct rpc_pipe_bind_state *state,
-                                           struct rpc_hdr_info *phdr,
-                                           prs_struct *reply_pdu)
-{
-        DATA_BLOB server_response = data_blob_null;
-        DATA_BLOB client_reply = data_blob_null;
-        struct rpc_hdr_auth_info hdr_auth;
+                goto err_out;
+        }
+
+        if (!NT_STATUS_IS_OK(status)) {
+                tevent_req_nterror(req, status);
+        }
+        return;
+
+err_out:
+        DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
+                 (unsigned int)state->cli->auth->auth_type));
+        tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+}
+
+static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
+                                   struct rpc_pipe_bind_state *state,
+                                   DATA_BLOB *auth_token)
+{
+        struct pipe_auth_data *auth = state->cli->auth;
         struct tevent_req *subreq;
         NTSTATUS status;
 
-        if ((phdr->auth_len == 0)
-            || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!prs_set_offset(
-                    reply_pdu,
-                    phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* TODO - check auth_type/auth_level match. */
-
-        server_response = data_blob_talloc(talloc_tos(), NULL, phdr->auth_len);
-        prs_copy_data_out((char *)server_response.data, reply_pdu,
-                          phdr->auth_len);
-
-        status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
-                                server_response, &client_reply);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
-                          "blob failed: %s.\n", nt_errstr(status)));
-                return status;
-        }
-
-        prs_init_empty(&state->rpc_out, talloc_tos(), MARSHALL);
-
-        status = create_rpc_bind_auth3(state->cli, state->rpc_call_id,
-                                       state->cli->auth->auth_type,
-                                       state->cli->auth->auth_level,
-                                       &client_reply, &state->rpc_out);
-        data_blob_free(&client_reply);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        subreq = rpc_write_send(state, state->ev, state->cli->transport,
-                                (uint8_t *)prs_data_p(&state->rpc_out),
-                                prs_offset(&state->rpc_out));
-        if (subreq == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
-        tevent_req_set_callback(subreq, rpc_bind_auth3_write_done, req);
-        return NT_STATUS_OK;
-}
-
-static void rpc_bind_auth3_write_done(struct tevent_req *subreq)
-{
-        struct tevent_req *req = tevent_req_callback_data(
-                subreq, struct tevent_req);
-        NTSTATUS status;
-
-        status = rpc_write_recv(subreq);
-        TALLOC_FREE(subreq);
-        if (!NT_STATUS_IS_OK(status)) {
-                tevent_req_nterror(req, status);
-                return;
-        }
-        tevent_req_done(req);
-}
-
-static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
-                                                    struct rpc_pipe_bind_state *state,
-                                                    struct rpc_hdr_info *phdr,
-                                                    prs_struct *reply_pdu)
-{
-        DATA_BLOB server_spnego_response = data_blob_null;
-        DATA_BLOB server_ntlm_response = data_blob_null;
-        DATA_BLOB client_reply = data_blob_null;
-        DATA_BLOB tmp_blob = data_blob_null;
-        RPC_HDR_AUTH hdr_auth;
-        struct tevent_req *subreq;
-        NTSTATUS status;
-
-        if ((phdr->auth_len == 0)
-            || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Process the returned NTLMSSP blob first. */
-        if (!prs_set_offset(
-                    reply_pdu,
-                    phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        server_spnego_response = data_blob(NULL, phdr->auth_len);
-        prs_copy_data_out((char *)server_spnego_response.data,
-                          reply_pdu, phdr->auth_len);
-
-        /*
-         * The server might give us back two challenges - tmp_blob is for the
-         * second.
-         */
-        if (!spnego_parse_challenge(server_spnego_response,
-                                    &server_ntlm_response, &tmp_blob)) {
-                data_blob_free(&server_spnego_response);
-                data_blob_free(&server_ntlm_response);
-                data_blob_free(&tmp_blob);
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* We're finished with the server spnego response and the tmp_blob. */
-        data_blob_free(&server_spnego_response);
-        data_blob_free(&tmp_blob);
-
-        status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
-                                server_ntlm_response, &client_reply);
-
-        /* Finished with the server_ntlm response */
-        data_blob_free(&server_ntlm_response);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
-                          "using server blob failed.\n"));
-                data_blob_free(&client_reply);
-                return status;
-        }
-
-        /* SPNEGO wrap the client reply. */
-        tmp_blob = spnego_gen_auth(client_reply);
-        data_blob_free(&client_reply);
-        client_reply = tmp_blob;
-        tmp_blob = data_blob_null;
-
         /* Now prepare the alter context pdu. */
-        prs_init_empty(&state->rpc_out, state, MARSHALL);
-
-        status = create_rpc_alter_context(state->rpc_call_id,
+        data_blob_free(&state->rpc_out);
+
+        status = create_rpc_alter_context(state,
+                                          auth->auth_type,
+                                          auth->auth_level,
+                                          state->rpc_call_id,
                                           &state->cli->abstract_syntax,
                                           &state->cli->transfer_syntax,
-                                          state->cli->auth->auth_level,
-                                          &client_reply,
+                                          auth_token,
                                           &state->rpc_out);
-        data_blob_free(&client_reply);
-
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -2931 +1870 @@
                 return NT_STATUS_NO_MEMORY;
         }
-        tevent_req_set_callback(subreq, rpc_bind_ntlmssp_api_done, req);
+        tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
         return NT_STATUS_OK;
 }
 
-static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq)
-{
-        struct tevent_req *req = tevent_req_callback_data(
-                subreq, struct tevent_req);
-        struct rpc_pipe_bind_state *state = tevent_req_data(
-                req, struct rpc_pipe_bind_state);
-        DATA_BLOB server_spnego_response = data_blob_null;
-        DATA_BLOB tmp_blob = data_blob_null;
-        prs_struct reply_pdu;
-        struct rpc_hdr_info hdr;
-        struct rpc_hdr_auth_info hdr_auth;
-        NTSTATUS status;
-
-        status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
-        TALLOC_FREE(subreq);
-        if (!NT_STATUS_IS_OK(status)) {
-                tevent_req_nterror(req, status);
-                return;
-        }
-
-        /* Get the auth blob from the reply. */
-        if (!smb_io_rpc_hdr("rpc_hdr   ", &hdr, &reply_pdu, 0)) {
-                DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: Failed to "
-                          "unmarshall RPC_HDR.\n"));
-                tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
-                return;
-        }
-
-        if (!prs_set_offset(
-                    &reply_pdu,
-                    hdr.frag_len - hdr.auth_len - RPC_HDR_AUTH_LEN)) {
-                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                return;
-        }
-
-        if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &reply_pdu, 0)) {
-                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                return;
-        }
-
-        server_spnego_response = data_blob(NULL, hdr.auth_len);
-        prs_copy_data_out((char *)server_spnego_response.data, &reply_pdu,
-                          hdr.auth_len);
-
-        /* Check we got a valid auth response. */
-        if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK,
-                                        OID_NTLMSSP, &tmp_blob)) {
-                data_blob_free(&server_spnego_response);
-                data_blob_free(&tmp_blob);
-                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                return;
-        }
-
-        data_blob_free(&server_spnego_response);
-        data_blob_free(&tmp_blob);
-
-        DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
-                 "%s.\n", rpccli_pipe_txt(talloc_tos(), state->cli)));
-        tevent_req_done(req);
+static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
+                                     struct rpc_pipe_bind_state *state,
+                                     DATA_BLOB *auth_token)
+{
+        struct pipe_auth_data *auth = state->cli->auth;
+        struct tevent_req *subreq;
+        NTSTATUS status;
+
+        state->auth3 = true;
+
+        /* Now prepare the auth3 context pdu. */
+        data_blob_free(&state->rpc_out);
+
+        status = create_rpc_bind_auth3(state, state->cli,
+                                        state->rpc_call_id,
+                                        auth->auth_type,
+                                        auth->auth_level,
+                                        auth_token,
+                                        &state->rpc_out);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        subreq = rpc_api_pipe_send(state, state->ev, state->cli,
+                                   &state->rpc_out, DCERPC_PKT_AUTH3);
+        if (subreq == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
+        return NT_STATUS_OK;
 }
 
@@ -3002 +1912 @@
 
 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
-                       struct cli_pipe_auth_data *auth)
+                       struct pipe_auth_data *auth)
 {
         TALLOC_CTX *frame = talloc_stackframe();
@@ -3068 +1978 @@
 }
 
+struct rpccli_bh_state {
+        struct rpc_pipe_client *rpc_cli;
+};
+
+static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
+{
+        struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
+                                     struct rpccli_bh_state);
+
+        return rpccli_is_connected(hs->rpc_cli);
+}
+
+static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
+                                      uint32_t timeout)
+{
+        struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
+                                     struct rpccli_bh_state);
+
+        return rpccli_set_timeout(hs->rpc_cli, timeout);
+}
+
+struct rpccli_bh_raw_call_state {
+        DATA_BLOB in_data;
+        DATA_BLOB out_data;
+        uint32_t out_flags;
+};
+
+static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
+
+static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
+                                                  struct tevent_context *ev,
+                                                  struct dcerpc_binding_handle *h,
+                                                  const struct GUID *object,
+                                                  uint32_t opnum,
+                                                  uint32_t in_flags,
+                                                  const uint8_t *in_data,
+                                                  size_t in_length)
+{
+        struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
+                                     struct rpccli_bh_state);
+        struct tevent_req *req;
+        struct rpccli_bh_raw_call_state *state;
+        bool ok;
+        struct tevent_req *subreq;
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct rpccli_bh_raw_call_state);
+        if (req == NULL) {
+                return NULL;
+        }
+        state->in_data.data = discard_const_p(uint8_t, in_data);
+        state->in_data.length = in_length;
+
+        ok = rpccli_bh_is_connected(h);
+        if (!ok) {
+                tevent_req_nterror(req, NT_STATUS_INVALID_CONNECTION);
+                return tevent_req_post(req, ev);
+        }
+
+        subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
+                                       opnum, &state->in_data);
+        if (tevent_req_nomem(subreq, req)) {
+                return tevent_req_post(req, ev);
+        }
+        tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
+
+        return req;
+}
+
+static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
+{
+        struct tevent_req *req =
+                tevent_req_callback_data(subreq,
+                struct tevent_req);
+        struct rpccli_bh_raw_call_state *state =
+                tevent_req_data(req,
+                struct rpccli_bh_raw_call_state);
+        NTSTATUS status;
+
+        state->out_flags = 0;
+
+        /* TODO: support bigendian responses */
+
+        status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                tevent_req_nterror(req, status);
+                return;
+        }
+
+        tevent_req_done(req);
+}
+
+static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
+                                        TALLOC_CTX *mem_ctx,
+                                        uint8_t **out_data,
+                                        size_t *out_length,
+                                        uint32_t *out_flags)
+{
+        struct rpccli_bh_raw_call_state *state =
+                tevent_req_data(req,
+                struct rpccli_bh_raw_call_state);
+        NTSTATUS status;
+
+        if (tevent_req_is_nterror(req, &status)) {
+                tevent_req_received(req);
+                return status;
+        }
+
+        *out_data = talloc_move(mem_ctx, &state->out_data.data);
+        *out_length = state->out_data.length;
+        *out_flags = state->out_flags;
+        tevent_req_received(req);
+        return NT_STATUS_OK;
+}
+
+struct rpccli_bh_disconnect_state {
+        uint8_t _dummy;
+};
+
+static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
+                                                struct tevent_context *ev,
+                                                struct dcerpc_binding_handle *h)
+{
+        struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
+                                     struct rpccli_bh_state);
+        struct tevent_req *req;
+        struct rpccli_bh_disconnect_state *state;
+        bool ok;
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct rpccli_bh_disconnect_state);
+        if (req == NULL) {
+                return NULL;
+        }
+
+        ok = rpccli_bh_is_connected(h);
+        if (!ok) {
+                tevent_req_nterror(req, NT_STATUS_INVALID_CONNECTION);
+                return tevent_req_post(req, ev);
+        }
+
+        /*
+         * TODO: do a real async disconnect ...
+         *
+         * For now the caller needs to free rpc_cli
+         */
+        hs->rpc_cli = NULL;
+
+        tevent_req_done(req);
+        return tevent_req_post(req, ev);
+}
+
+static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
+{
+        NTSTATUS status;
+
+        if (tevent_req_is_nterror(req, &status)) {
+                tevent_req_received(req);
+                return status;
+        }
+
+        tevent_req_received(req);
+        return NT_STATUS_OK;
+}
+
+static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
+{
+        return true;
+}
+
+static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
+                                   int ndr_flags,
+                                   const void *_struct_ptr,
+                                   const struct ndr_interface_call *call)
+{
+        void *struct_ptr = discard_const(_struct_ptr);
+
+        if (DEBUGLEVEL < 10) {
+                return;
+        }
+
+        if (ndr_flags & NDR_IN) {
+                ndr_print_function_debug(call->ndr_print,
+                                         call->name,
+                                         ndr_flags,
+                                         struct_ptr);
+        }
+        if (ndr_flags & NDR_OUT) {
+                ndr_print_function_debug(call->ndr_print,
+                                         call->name,
+                                         ndr_flags,
+                                         struct_ptr);
+        }
+}
+
+static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
+        .name                   = "rpccli",
+        .is_connected           = rpccli_bh_is_connected,
+        .set_timeout            = rpccli_bh_set_timeout,
+        .raw_call_send          = rpccli_bh_raw_call_send,
+        .raw_call_recv          = rpccli_bh_raw_call_recv,
+        .disconnect_send        = rpccli_bh_disconnect_send,
+        .disconnect_recv        = rpccli_bh_disconnect_recv,
+
+        .ref_alloc              = rpccli_bh_ref_alloc,
+        .do_ndr_print           = rpccli_bh_do_ndr_print,
+};
+
+/* initialise a rpc_pipe_client binding handle */
+struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c)
+{
+        struct dcerpc_binding_handle *h;
+        struct rpccli_bh_state *hs;
+
+        h = dcerpc_binding_handle_create(c,
+                                         &rpccli_bh_ops,
+                                         NULL,
+                                         NULL, /* TODO */
+                                         &hs,
+                                         struct rpccli_bh_state,
+                                         __location__);
+        if (h == NULL) {
+                return NULL;
+        }
+        hs->rpc_cli = c;
+
+        return h;
+}
+
 bool rpccli_get_pwd_hash(struct rpc_pipe_client *rpc_cli, uint8_t nt_hash[16])
 {
+        struct auth_ntlmssp_state *a = NULL;
         struct cli_state *cli;
 
-        if ((rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_NTLMSSP)
-            || (rpc_cli->auth->auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP)) {
-                memcpy(nt_hash, rpc_cli->auth->a_u.ntlmssp_state->nt_hash, 16);
+        if (rpc_cli->auth->auth_type == DCERPC_AUTH_TYPE_NTLMSSP) {
+                a = talloc_get_type_abort(rpc_cli->auth->auth_ctx,
+                                          struct auth_ntlmssp_state);
+        } else if (rpc_cli->auth->auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
+                struct spnego_context *spnego_ctx;
+                enum spnego_mech auth_type;
+                void *auth_ctx;
+                NTSTATUS status;
+
+                spnego_ctx = talloc_get_type_abort(rpc_cli->auth->auth_ctx,
+                                                   struct spnego_context);
+                status = spnego_get_negotiated_mech(spnego_ctx,
+                                                    &auth_type, &auth_ctx);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return false;
+                }
+
+                if (auth_type == SPNEGO_NTLMSSP) {
+                        a = talloc_get_type_abort(auth_ctx,
+                                                  struct auth_ntlmssp_state);
+                }
+        }
+
+        if (a) {
+                memcpy(nt_hash, auth_ntlmssp_get_nt_hash(a), 16);
                 return true;
         }
@@ -3086 +2249 @@
 }
 
-NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
-                               struct cli_pipe_auth_data **presult)
-{
-        struct cli_pipe_auth_data *result;
-
-        result = talloc(mem_ctx, struct cli_pipe_auth_data);
+NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
+                                  struct pipe_auth_data **presult)
+{
+        struct pipe_auth_data *result;
+
+        result = talloc(mem_ctx, struct pipe_auth_data);
         if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
 
-        result->auth_type = PIPE_AUTH_TYPE_NONE;
-        result->auth_level = DCERPC_AUTH_LEVEL_NONE;
+        result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
+        result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 
         result->user_name = talloc_strdup(result, "");
@@ -3110 +2273 @@
 }
 
-static int cli_auth_ntlmssp_data_destructor(struct cli_pipe_auth_data *auth)
-{
-        ntlmssp_end(&auth->a_u.ntlmssp_state);
+NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
+                               struct pipe_auth_data **presult)
+{
+        struct pipe_auth_data *result;
+
+        result = talloc(mem_ctx, struct pipe_auth_data);
+        if (result == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        result->auth_type = DCERPC_AUTH_TYPE_NONE;
+        result->auth_level = DCERPC_AUTH_LEVEL_NONE;
+
+        result->user_name = talloc_strdup(result, "");
+        result->domain = talloc_strdup(result, "");
+        if ((result->user_name == NULL) || (result->domain == NULL)) {
+                TALLOC_FREE(result);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        *presult = result;
+        return NT_STATUS_OK;
+}
+
+static int cli_auth_ntlmssp_data_destructor(struct pipe_auth_data *auth)
+{
+        TALLOC_FREE(auth->auth_ctx);
         return 0;
 }
 
 static NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
-                                  enum pipe_auth_type auth_type,
+                                  enum dcerpc_AuthType auth_type,
                                   enum dcerpc_AuthLevel auth_level,
                                   const char *domain,
                                   const char *username,
                                   const char *password,
-                                  struct cli_pipe_auth_data **presult)
-{
-        struct cli_pipe_auth_data *result;
-        NTSTATUS status;
-
-        result = talloc(mem_ctx, struct cli_pipe_auth_data);
+                                  struct pipe_auth_data **presult)
+{
+        struct auth_ntlmssp_state *ntlmssp_ctx;
+        struct pipe_auth_data *result;
+        NTSTATUS status;
+
+        result = talloc(mem_ctx, struct pipe_auth_data);
         if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
@@ -3142 +2330 @@
         }
 
-        status = ntlmssp_client_start(&result->a_u.ntlmssp_state);
+        status = auth_ntlmssp_client_start(NULL,
+                                      global_myname(),
+                                      lp_workgroup(),
+                                      lp_client_ntlmv2_auth(),
+                                      &ntlmssp_ctx);
         if (!NT_STATUS_IS_OK(status)) {
                 goto fail;
@@ -3149 +2341 @@
         talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
 
-        status = ntlmssp_set_username(result->a_u.ntlmssp_state, username);
+        status = auth_ntlmssp_set_username(ntlmssp_ctx, username);
         if (!NT_STATUS_IS_OK(status)) {
                 goto fail;
         }
 
-        status = ntlmssp_set_domain(result->a_u.ntlmssp_state, domain);
+        status = auth_ntlmssp_set_domain(ntlmssp_ctx, domain);
         if (!NT_STATUS_IS_OK(status)) {
                 goto fail;
         }
 
-        status = ntlmssp_set_password(result->a_u.ntlmssp_state, password);
+        status = auth_ntlmssp_set_password(ntlmssp_ctx, password);
         if (!NT_STATUS_IS_OK(status)) {
                 goto fail;
@@ -3167 +2359 @@
          * Turn off sign+seal to allow selected auth level to turn it back on.
          */
-        result->a_u.ntlmssp_state->neg_flags &=
-                ~(NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL);
+        auth_ntlmssp_and_flags(ntlmssp_ctx, ~(NTLMSSP_NEGOTIATE_SIGN |
+                                                NTLMSSP_NEGOTIATE_SEAL));
 
         if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
-                result->a_u.ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+                auth_ntlmssp_or_flags(ntlmssp_ctx, NTLMSSP_NEGOTIATE_SIGN);
         } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
-                result->a_u.ntlmssp_state->neg_flags
-                        |= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
-        }
-
+                auth_ntlmssp_or_flags(ntlmssp_ctx, NTLMSSP_NEGOTIATE_SEAL |
+                                                     NTLMSSP_NEGOTIATE_SIGN);
+        }
+
+        result->auth_ctx = ntlmssp_ctx;
         *presult = result;
         return NT_STATUS_OK;
@@ -3188 +2381 @@
                                    enum dcerpc_AuthLevel auth_level,
                                    struct netlogon_creds_CredentialState *creds,
-                                   struct cli_pipe_auth_data **presult)
-{
-        struct cli_pipe_auth_data *result;
-
-        result = talloc(mem_ctx, struct cli_pipe_auth_data);
+                                   struct pipe_auth_data **presult)
+{
+        struct schannel_state *schannel_auth;
+        struct pipe_auth_data *result;
+
+        result = talloc(mem_ctx, struct pipe_auth_data);
         if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
 
-        result->auth_type = PIPE_AUTH_TYPE_SCHANNEL;
+        result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
         result->auth_level = auth_level;
 
@@ -3206 +2400 @@
         }
 
-        result->a_u.schannel_auth = talloc(result, struct schannel_state);
-        if (result->a_u.schannel_auth == NULL) {
+        schannel_auth = talloc(result, struct schannel_state);
+        if (schannel_auth == NULL) {
                 goto fail;
         }
 
-        result->a_u.schannel_auth->state = SCHANNEL_STATE_START;
-        result->a_u.schannel_auth->seq_num = 0;
-        result->a_u.schannel_auth->initiator = true;
-        result->a_u.schannel_auth->creds = netlogon_creds_copy(result, creds);
-
+        schannel_auth->state = SCHANNEL_STATE_START;
+        schannel_auth->seq_num = 0;
+        schannel_auth->initiator = true;
+        schannel_auth->creds = netlogon_creds_copy(result, creds);
+
+        result->auth_ctx = schannel_auth;
         *presult = result;
         return NT_STATUS_OK;
@@ -3222 +2417 @@
         TALLOC_FREE(result);
         return NT_STATUS_NO_MEMORY;
-}
-
-#ifdef HAVE_KRB5
-static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
-{
-        data_blob_free(&auth->session_key);
-        return 0;
-}
-#endif
-
-static NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
-                                   enum dcerpc_AuthLevel auth_level,
-                                   const char *service_princ,
-                                   const char *username,
-                                   const char *password,
-                                   struct cli_pipe_auth_data **presult)
-{
-#ifdef HAVE_KRB5
-        struct cli_pipe_auth_data *result;
-
-        if ((username != NULL) && (password != NULL)) {
-                int ret = kerberos_kinit_password(username, password, 0, NULL);
-                if (ret != 0) {
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        result = talloc(mem_ctx, struct cli_pipe_auth_data);
-        if (result == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        result->auth_type = PIPE_AUTH_TYPE_KRB5;
-        result->auth_level = auth_level;
-
-        /*
-         * Username / domain need fixing!
-         */
-        result->user_name = talloc_strdup(result, "");
-        result->domain = talloc_strdup(result, "");
-        if ((result->user_name == NULL) || (result->domain == NULL)) {
-                goto fail;
-        }
-
-        result->a_u.kerberos_auth = TALLOC_ZERO_P(
-                result, struct kerberos_auth_struct);
-        if (result->a_u.kerberos_auth == NULL) {
-                goto fail;
-        }
-        talloc_set_destructor(result->a_u.kerberos_auth,
-                              cli_auth_kerberos_data_destructor);
-
-        result->a_u.kerberos_auth->service_principal = talloc_strdup(
-                result, service_princ);
-        if (result->a_u.kerberos_auth->service_principal == NULL) {
-                goto fail;
-        }
-
-        *presult = result;
-        return NT_STATUS_OK;
-
- fail:
-        TALLOC_FREE(result);
-        return NT_STATUS_NO_MEMORY;
-#else
-        return NT_STATUS_NOT_SUPPORTED;
-#endif
 }
 
@@ -3311 +2439 @@
         result->abstract_syntax = *abstract_syntax;
         result->transfer_syntax = ndr_transfer_syntax;
-        result->dispatch = cli_do_rpc_ndr;
-        result->dispatch_send = cli_do_rpc_ndr_send;
-        result->dispatch_recv = cli_do_rpc_ndr_recv;
 
         result->desthost = talloc_strdup(result, host);
@@ -3344 +2469 @@
 
         result->transport->transport = NCACN_IP_TCP;
+
+        result->binding_handle = rpccli_bh_create(result);
+        if (result->binding_handle == NULL) {
+                TALLOC_FREE(result);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         *presult = result;
@@ -3364 +2495 @@
         NTSTATUS status;
         struct rpc_pipe_client *epm_pipe = NULL;
-        struct cli_pipe_auth_data *auth = NULL;
+        struct dcerpc_binding_handle *epm_handle = NULL;
+        struct pipe_auth_data *auth = NULL;
         struct dcerpc_binding *map_binding = NULL;
         struct dcerpc_binding *res_binding = NULL;
@@ -3374 +2506 @@
         struct epm_twr_p_t towers;
         TALLOC_CTX *tmp_ctx = talloc_stackframe();
+        uint32_t result = 0;
 
         if (pport == NULL) {
                 status = NT_STATUS_INVALID_PARAMETER;
                 goto done;
+        }
+
+        if (ndr_syntax_id_equal(abstract_syntax,
+                                &ndr_table_epmapper.syntax_id)) {
+                *pport = 135;
+                return NT_STATUS_OK;
         }
 
@@ -3388 +2527 @@
                 goto done;
         }
+        epm_handle = epm_pipe->binding_handle;
 
         status = rpccli_anon_bind_data(tmp_ctx, &auth);
@@ -3441 +2581 @@
         /* ask the endpoint mapper for the port */
 
-        status = rpccli_epm_Map(epm_pipe,
+        status = dcerpc_epm_Map(epm_handle,
                                 tmp_ctx,
                                 CONST_DISCARD(struct GUID *,
@@ -3449 +2589 @@
                                 max_towers,
                                 &num_towers,
-                                &towers);
-
-        if (!NT_STATUS_IS_OK(status)) {
+                                &towers,
+                                &result);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+
+        if (result != EPMAPPER_STATUS_OK) {
+                status = NT_STATUS_UNSUCCESSFUL;
                 goto done;
         }
@@ -3522 +2668 @@
         result->abstract_syntax = *abstract_syntax;
         result->transfer_syntax = ndr_transfer_syntax;
-        result->dispatch = cli_do_rpc_ndr;
-        result->dispatch_send = cli_do_rpc_ndr_send;
-        result->dispatch_recv = cli_do_rpc_ndr_recv;
 
         result->desthost = get_myname(result);
@@ -3545 +2688 @@
         ZERO_STRUCT(addr);
         addr.sun_family = AF_UNIX;
-        strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
+        strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
 
         if (sys_connect(fd, (struct sockaddr *)(void *)&addr) == -1) {
@@ -3561 +2704 @@
 
         result->transport->transport = NCALRPC;
+
+        result->binding_handle = rpccli_bh_create(result);
+        if (result->binding_handle == NULL) {
+                TALLOC_FREE(result);
+                return NT_STATUS_NO_MEMORY;
+        }
 
         *presult = result;
@@ -3615 +2764 @@
         result->abstract_syntax = *abstract_syntax;
         result->transfer_syntax = ndr_transfer_syntax;
-        result->dispatch = cli_do_rpc_ndr;
-        result->dispatch_send = cli_do_rpc_ndr_send;
-        result->dispatch_recv = cli_do_rpc_ndr_recv;
         result->desthost = talloc_strdup(result, cli->desthost);
         result->srv_name_slash = talloc_asprintf_strupper_m(
@@ -3650 +2796 @@
         talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
 
-        *presult = result;
-        return NT_STATUS_OK;
-}
-
-NTSTATUS rpc_pipe_open_local(TALLOC_CTX *mem_ctx,
-                             struct rpc_cli_smbd_conn *conn,
-                             const struct ndr_syntax_id *syntax,
-                             struct rpc_pipe_client **presult)
-{
-        struct rpc_pipe_client *result;
-        struct cli_pipe_auth_data *auth;
-        NTSTATUS status;
-
-        result = talloc(mem_ctx, struct rpc_pipe_client);
-        if (result == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
-        result->abstract_syntax = *syntax;
-        result->transfer_syntax = ndr_transfer_syntax;
-        result->dispatch = cli_do_rpc_ndr;
-        result->dispatch_send = cli_do_rpc_ndr_send;
-        result->dispatch_recv = cli_do_rpc_ndr_recv;
-        result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
-        result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
-
-        result->desthost = talloc_strdup(result, global_myname());
-        result->srv_name_slash = talloc_asprintf_strupper_m(
-                result, "\\\\%s", global_myname());
-        if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
+        result->binding_handle = rpccli_bh_create(result);
+        if (result->binding_handle == NULL) {
                 TALLOC_FREE(result);
                 return NT_STATUS_NO_MEMORY;
         }
-
-        status = rpc_transport_smbd_init(result, conn, syntax,
-                                         &result->transport);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("rpc_transport_smbd_init failed: %s\n",
-                          nt_errstr(status)));
-                TALLOC_FREE(result);
-                return status;
-        }
-
-        status = rpccli_anon_bind_data(result, &auth);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("rpccli_anon_bind_data failed: %s\n",
-                          nt_errstr(status)));
-                TALLOC_FREE(result);
-                return status;
-        }
-
-        status = rpc_pipe_bind(result, auth);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
-                TALLOC_FREE(result);
-                return status;
-        }
-
-        result->transport->transport = NCACN_INTERNAL;
 
         *presult = result;
@@ -3743 +2836 @@
 {
         struct rpc_pipe_client *result;
-        struct cli_pipe_auth_data *auth;
+        struct pipe_auth_data *auth;
         NTSTATUS status;
 
@@ -3820 +2913 @@
  ****************************************************************************/
 
-static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
-                                                   const struct ndr_syntax_id *interface,
-                                                   enum dcerpc_transport_t transport,
-                                                   enum pipe_auth_type auth_type,
-                                                   enum dcerpc_AuthLevel auth_level,
-                                                   const char *domain,
-                                                   const char *username,
-                                                   const char *password,
-                                                   struct rpc_pipe_client **presult)
-{
-        struct rpc_pipe_client *result;
-        struct cli_pipe_auth_data *auth;
-        NTSTATUS status;
-
-        status = cli_rpc_pipe_open(cli, transport, interface, &result);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = rpccli_ntlmssp_bind_data(
-                result, auth_type, auth_level, domain, username,
-                password, &auth);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
-                          nt_errstr(status)));
-                goto err;
-        }
-
-        status = rpc_pipe_bind(result, auth);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
-                        nt_errstr(status) ));
-                goto err;
-        }
-
-        DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
-                "machine %s and bound NTLMSSP as user %s\\%s.\n",
-                  get_pipe_name_from_syntax(talloc_tos(), interface),
-                  cli->desthost, domain, username ));
-
-        *presult = result;
-        return NT_STATUS_OK;
-
-  err:
-
-        TALLOC_FREE(result);
-        return status;
-}
-
-/****************************************************************************
- External interface.
- Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
- ****************************************************************************/
-
 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
                                    const struct ndr_syntax_id *interface,
@@ -3883 +2922 @@
                                    struct rpc_pipe_client **presult)
 {
-        return cli_rpc_pipe_open_ntlmssp_internal(cli,
-                                                interface,
-                                                transport,
-                                                PIPE_AUTH_TYPE_NTLMSSP,
-                                                auth_level,
-                                                domain,
-                                                username,
-                                                password,
-                                                presult);
+        struct rpc_pipe_client *result;
+        struct pipe_auth_data *auth = NULL;
+        enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+        NTSTATUS status;
+
+        status = cli_rpc_pipe_open(cli, transport, interface, &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        status = rpccli_ntlmssp_bind_data(result,
+                                          auth_type, auth_level,
+                                          domain, username, password,
+                                          &auth);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
+                          nt_errstr(status)));
+                goto err;
+        }
+
+        status = rpc_pipe_bind(result, auth);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
+                        nt_errstr(status) ));
+                goto err;
+        }
+
+        DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
+                "machine %s and bound NTLMSSP as user %s\\%s.\n",
+                  get_pipe_name_from_syntax(talloc_tos(), interface),
+                  cli->desthost, domain, username ));
+
+        *presult = result;
+        return NT_STATUS_OK;
+
+  err:
+
+        TALLOC_FREE(result);
+        return status;
 }
 
 /****************************************************************************
  External interface.
- Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
+ Open a named pipe to an SMB server and bind using schannel (bind type 68)
+ using session_key. sign and seal.
+
+ The *pdc will be stolen onto this new pipe
  ****************************************************************************/
+
+NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
+                                             const struct ndr_syntax_id *interface,
+                                             enum dcerpc_transport_t transport,
+                                             enum dcerpc_AuthLevel auth_level,
+                                             const char *domain,
+                                             struct netlogon_creds_CredentialState **pdc,
+                                             struct rpc_pipe_client **presult)
+{
+        struct rpc_pipe_client *result;
+        struct pipe_auth_data *auth;
+        NTSTATUS status;
+
+        status = cli_rpc_pipe_open(cli, transport, interface, &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        status = rpccli_schannel_bind_data(result, domain, auth_level,
+                                           *pdc, &auth);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
+                          nt_errstr(status)));
+                TALLOC_FREE(result);
+                return status;
+        }
+
+        status = rpc_pipe_bind(result, auth);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
+                          "cli_rpc_pipe_bind failed with error %s\n",
+                          nt_errstr(status) ));
+                TALLOC_FREE(result);
+                return status;
+        }
+
+        /*
+         * The credentials on a new netlogon pipe are the ones we are passed
+         * in - copy them over
+         */
+        result->dc = netlogon_creds_copy(result, *pdc);
+        if (result->dc == NULL) {
+                TALLOC_FREE(result);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
+                  "for domain %s and bound using schannel.\n",
+                  get_pipe_name_from_syntax(talloc_tos(), interface),
+                  cli->desthost, domain ));
+
+        *presult = result;
+        return NT_STATUS_OK;
+}
+
+/****************************************************************************
+ Open a named pipe to an SMB server and bind using krb5 (bind type 16).
+ The idea is this can be called with service_princ, username and password all
+ NULL so long as the caller has a TGT.
+ ****************************************************************************/
+
+NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
+                                const struct ndr_syntax_id *interface,
+                                enum dcerpc_transport_t transport,
+                                enum dcerpc_AuthLevel auth_level,
+                                const char *server,
+                                const char *username,
+                                const char *password,
+                                struct rpc_pipe_client **presult)
+{
+        struct rpc_pipe_client *result;
+        struct pipe_auth_data *auth;
+        struct gse_context *gse_ctx;
+        NTSTATUS status;
+
+        status = cli_rpc_pipe_open(cli, transport, interface, &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        auth = talloc(result, struct pipe_auth_data);
+        if (auth == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto err_out;
+        }
+        auth->auth_type = DCERPC_AUTH_TYPE_KRB5;
+        auth->auth_level = auth_level;
+
+        if (!username) {
+                username = "";
+        }
+        auth->user_name = talloc_strdup(auth, username);
+        if (!auth->user_name) {
+                status = NT_STATUS_NO_MEMORY;
+                goto err_out;
+        }
+
+        /* Fixme, should we fetch/set the Realm ? */
+        auth->domain = talloc_strdup(auth, "");
+        if (!auth->domain) {
+                status = NT_STATUS_NO_MEMORY;
+                goto err_out;
+        }
+
+        status = gse_init_client(auth,
+                                 (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY),
+                                 (auth_level == DCERPC_AUTH_LEVEL_PRIVACY),
+                                 NULL, server, "cifs", username, password,
+                                 GSS_C_DCE_STYLE, &gse_ctx);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("gse_init_client returned %s\n",
+                          nt_errstr(status)));
+                goto err_out;
+        }
+        auth->auth_ctx = gse_ctx;
+
+        status = rpc_pipe_bind(result, auth);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
+                          nt_errstr(status)));
+                goto err_out;
+        }
+
+        *presult = result;
+        return NT_STATUS_OK;
+
+err_out:
+        TALLOC_FREE(result);
+        return status;
+}
+
+NTSTATUS cli_rpc_pipe_open_spnego_krb5(struct cli_state *cli,
+                                        const struct ndr_syntax_id *interface,
+                                        enum dcerpc_transport_t transport,
+                                        enum dcerpc_AuthLevel auth_level,
+                                        const char *server,
+                                        const char *username,
+                                        const char *password,
+                                        struct rpc_pipe_client **presult)
+{
+        struct rpc_pipe_client *result;
+        struct pipe_auth_data *auth;
+        struct spnego_context *spnego_ctx;
+        NTSTATUS status;
+
+        status = cli_rpc_pipe_open(cli, transport, interface, &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        auth = talloc(result, struct pipe_auth_data);
+        if (auth == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto err_out;
+        }
+        auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+        auth->auth_level = auth_level;
+
+        if (!username) {
+                username = "";
+        }
+        auth->user_name = talloc_strdup(auth, username);
+        if (!auth->user_name) {
+                status = NT_STATUS_NO_MEMORY;
+                goto err_out;
+        }
+
+        /* Fixme, should we fetch/set the Realm ? */
+        auth->domain = talloc_strdup(auth, "");
+        if (!auth->domain) {
+                status = NT_STATUS_NO_MEMORY;
+                goto err_out;
+        }
+
+        status = spnego_gssapi_init_client(auth,
+                                           (auth->auth_level ==
+                                                DCERPC_AUTH_LEVEL_INTEGRITY),
+                                           (auth->auth_level ==
+                                                DCERPC_AUTH_LEVEL_PRIVACY),
+                                           true,
+                                           NULL, server, "cifs",
+                                           username, password,
+                                           &spnego_ctx);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("spnego_init_client returned %s\n",
+                          nt_errstr(status)));
+                goto err_out;
+        }
+        auth->auth_ctx = spnego_ctx;
+
+        status = rpc_pipe_bind(result, auth);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
+                          nt_errstr(status)));
+                goto err_out;
+        }
+
+        *presult = result;
+        return NT_STATUS_OK;
+
+err_out:
+        TALLOC_FREE(result);
+        return status;
+}
 
 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
@@ -3908 +3184 @@
                                           struct rpc_pipe_client **presult)
 {
-        return cli_rpc_pipe_open_ntlmssp_internal(cli,
-                                                interface,
-                                                transport,
-                                                PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
-                                                auth_level,
-                                                domain,
-                                                username,
-                                                password,
-                                                presult);
-}
-
-/****************************************************************************
-  Get a the schannel session key out of an already opened netlogon pipe.
- ****************************************************************************/
-static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
-                                                struct cli_state *cli,
-                                                const char *domain,
-                                                uint32 *pneg_flags)
-{
-        enum netr_SchannelType sec_chan_type = 0;
-        unsigned char machine_pwd[16];
-        const char *machine_account;
-        NTSTATUS status;
-
-        /* Get the machine account credentials from secrets.tdb. */
-        if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
-                               &sec_chan_type))
-        {
-                DEBUG(0, ("get_schannel_session_key: could not fetch "
-                        "trust account password for domain '%s'\n",
-                        domain));
-                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
-        }
-
-        status = rpccli_netlogon_setup_creds(netlogon_pipe,
-                                        cli->desthost, /* server name */
-                                        domain,        /* domain */
-                                        global_myname(), /* client name */
-                                        machine_account, /* machine account name */
-                                        machine_pwd,
-                                        sec_chan_type,
-                                        pneg_flags);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(3, ("get_schannel_session_key_common: "
-                          "rpccli_netlogon_setup_creds failed with result %s "
-                          "to server %s, domain %s, machine account %s.\n",
-                          nt_errstr(status), cli->desthost, domain,
-                          machine_account ));
+        struct rpc_pipe_client *result;
+        struct pipe_auth_data *auth;
+        struct spnego_context *spnego_ctx;
+        NTSTATUS status;
+
+        status = cli_rpc_pipe_open(cli, transport, interface, &result);
+        if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
-        if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
-                DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
-                        cli->desthost));
-                return NT_STATUS_INVALID_NETWORK_RESPONSE;
-        }
-
-        return NT_STATUS_OK;;
-}
-
-/****************************************************************************
- Open a netlogon pipe and get the schannel session key.
- Now exposed to external callers.
- ****************************************************************************/
-
-
-NTSTATUS get_schannel_session_key(struct cli_state *cli,
-                                  const char *domain,
-                                  uint32 *pneg_flags,
-                                  struct rpc_pipe_client **presult)
-{
-        struct rpc_pipe_client *netlogon_pipe = NULL;
-        NTSTATUS status;
-
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
-                                          &netlogon_pipe);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
-                                                 pneg_flags);
-        if (!NT_STATUS_IS_OK(status)) {
-                TALLOC_FREE(netlogon_pipe);
-                return status;
-        }
-
-        *presult = netlogon_pipe;
-        return NT_STATUS_OK;
-}
-
-/****************************************************************************
- External interface.
- Open a named pipe to an SMB server and bind using schannel (bind type 68)
- using session_key. sign and seal.
-
- The *pdc will be stolen onto this new pipe
- ****************************************************************************/
-
-NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
-                                             const struct ndr_syntax_id *interface,
-                                             enum dcerpc_transport_t transport,
-                                             enum dcerpc_AuthLevel auth_level,
-                                             const char *domain,
-                                             struct netlogon_creds_CredentialState **pdc,
-                                             struct rpc_pipe_client **presult)
-{
-        struct rpc_pipe_client *result;
-        struct cli_pipe_auth_data *auth;
-        NTSTATUS status;
-
-        status = cli_rpc_pipe_open(cli, transport, interface, &result);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = rpccli_schannel_bind_data(result, domain, auth_level,
-                                           *pdc, &auth);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
+        auth = talloc(result, struct pipe_auth_data);
+        if (auth == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto err_out;
+        }
+        auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+        auth->auth_level = auth_level;
+
+        if (!username) {
+                username = "";
+        }
+        auth->user_name = talloc_strdup(auth, username);
+        if (!auth->user_name) {
+                status = NT_STATUS_NO_MEMORY;
+                goto err_out;
+        }
+
+        if (!domain) {
+                domain = "";
+        }
+        auth->domain = talloc_strdup(auth, domain);
+        if (!auth->domain) {
+                status = NT_STATUS_NO_MEMORY;
+                goto err_out;
+        }
+
+        status = spnego_ntlmssp_init_client(auth,
+                                            (auth->auth_level ==
+                                                DCERPC_AUTH_LEVEL_INTEGRITY),
+                                            (auth->auth_level ==
+                                                DCERPC_AUTH_LEVEL_PRIVACY),
+                                            true,
+                                            domain, username, password,
+                                            &spnego_ctx);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("spnego_init_client returned %s\n",
                           nt_errstr(status)));
-                TALLOC_FREE(result);
-                return status;
-        }
+                goto err_out;
+        }
+        auth->auth_ctx = spnego_ctx;
 
         status = rpc_pipe_bind(result, auth);
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
-                          "cli_rpc_pipe_bind failed with error %s\n",
-                          nt_errstr(status) ));
-                TALLOC_FREE(result);
-                return status;
-        }
-
-        /*
-         * The credentials on a new netlogon pipe are the ones we are passed
-         * in - copy them over
-         */
-        result->dc = netlogon_creds_copy(result, *pdc);
-        if (result->dc == NULL) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
-                  "for domain %s and bound using schannel.\n",
-                  get_pipe_name_from_syntax(talloc_tos(), interface),
-                  cli->desthost, domain ));
+                DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
+                          nt_errstr(status)));
+                goto err_out;
+        }
 
         *presult = result;
         return NT_STATUS_OK;
-}
-
-/****************************************************************************
- Open a named pipe to an SMB server and bind using schannel (bind type 68).
- Fetch the session key ourselves using a temporary netlogon pipe. This
- version uses an ntlmssp auth bound netlogon pipe to get the key.
- ****************************************************************************/
-
-static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
-                                                      const char *domain,
-                                                      const char *username,
-                                                      const char *password,
-                                                      uint32 *pneg_flags,
-                                                      struct rpc_pipe_client **presult)
-{
-        struct rpc_pipe_client *netlogon_pipe = NULL;
-        NTSTATUS status;
-
-        status = cli_rpc_pipe_open_spnego_ntlmssp(
-                cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
-                DCERPC_AUTH_LEVEL_PRIVACY,
-                domain, username, password, &netlogon_pipe);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
-                                                 pneg_flags);
-        if (!NT_STATUS_IS_OK(status)) {
-                TALLOC_FREE(netlogon_pipe);
-                return status;
-        }
-
-        *presult = netlogon_pipe;
-        return NT_STATUS_OK;
-}
-
-/****************************************************************************
- Open a named pipe to an SMB server and bind using schannel (bind type 68).
- Fetch the session key ourselves using a temporary netlogon pipe. This version
- uses an ntlmssp bind to get the session key.
- ****************************************************************************/
-
-NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
-                                                 const struct ndr_syntax_id *interface,
-                                                 enum dcerpc_transport_t transport,
-                                                 enum dcerpc_AuthLevel auth_level,
-                                                 const char *domain,
-                                                 const char *username,
-                                                 const char *password,
-                                                 struct rpc_pipe_client **presult)
-{
-        uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
-        struct rpc_pipe_client *netlogon_pipe = NULL;
-        struct rpc_pipe_client *result = NULL;
-        NTSTATUS status;
-
-        status = get_schannel_session_key_auth_ntlmssp(
-                cli, domain, username, password, &neg_flags, &netlogon_pipe);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
-                        "key from server %s for domain %s.\n",
-                        cli->desthost, domain ));
-                return status;
-        }
-
-        status = cli_rpc_pipe_open_schannel_with_key(
-                cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
-                &result);
-
-        /* Now we've bound using the session key we can close the netlog pipe. */
-        TALLOC_FREE(netlogon_pipe);
-
-        if (NT_STATUS_IS_OK(status)) {
-                *presult = result;
-        }
+
+err_out:
+        TALLOC_FREE(result);
         return status;
-}
-
-/****************************************************************************
- Open a named pipe to an SMB server and bind using schannel (bind type 68).
- Fetch the session key ourselves using a temporary netlogon pipe.
- ****************************************************************************/
-
-NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
-                                    const struct ndr_syntax_id *interface,
-                                    enum dcerpc_transport_t transport,
-                                    enum dcerpc_AuthLevel auth_level,
-                                    const char *domain,
-                                    struct rpc_pipe_client **presult)
-{
-        uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
-        struct rpc_pipe_client *netlogon_pipe = NULL;
-        struct rpc_pipe_client *result = NULL;
-        NTSTATUS status;
-
-        status = get_schannel_session_key(cli, domain, &neg_flags,
-                                          &netlogon_pipe);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
-                        "key from server %s for domain %s.\n",
-                        cli->desthost, domain ));
-                return status;
-        }
-
-        status = cli_rpc_pipe_open_schannel_with_key(
-                cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
-                &result);
-
-        /* Now we've bound using the session key we can close the netlog pipe. */
-        TALLOC_FREE(netlogon_pipe);
-
-        if (NT_STATUS_IS_OK(status)) {
-                *presult = result;
-        }
-
-        return status;
-}
-
-/****************************************************************************
- Open a named pipe to an SMB server and bind using krb5 (bind type 16).
- The idea is this can be called with service_princ, username and password all
- NULL so long as the caller has a TGT.
- ****************************************************************************/
-
-NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
-                                const struct ndr_syntax_id *interface,
-                                enum dcerpc_AuthLevel auth_level,
-                                const char *service_princ,
-                                const char *username,
-                                const char *password,
-                                struct rpc_pipe_client **presult)
-{
-#ifdef HAVE_KRB5
-        struct rpc_pipe_client *result;
-        struct cli_pipe_auth_data *auth;
-        NTSTATUS status;
-
-        status = cli_rpc_pipe_open(cli, NCACN_NP, interface, &result);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = rpccli_kerberos_bind_data(result, auth_level, service_princ,
-                                           username, password, &auth);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("rpccli_kerberos_bind_data returned %s\n",
-                          nt_errstr(status)));
-                TALLOC_FREE(result);
-                return status;
-        }
-
-        status = rpc_pipe_bind(result, auth);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
-                          "with error %s\n", nt_errstr(status)));
-                TALLOC_FREE(result);
-                return status;
-        }
-
-        *presult = result;
-        return NT_STATUS_OK;
-#else
-        DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
-        return NT_STATUS_NOT_IMPLEMENTED;
-#endif
 }
 
@@ -4232 +3254 @@
                              DATA_BLOB *session_key)
 {
+        struct pipe_auth_data *a = cli->auth;
+        struct schannel_state *schannel_auth;
+        struct auth_ntlmssp_state *ntlmssp_ctx;
+        struct spnego_context *spnego_ctx;
+        struct gse_context *gse_ctx;
+        DATA_BLOB sk = data_blob_null;
+        bool make_dup = false;
+
         if (!session_key || !cli) {
                 return NT_STATUS_INVALID_PARAMETER;
@@ -4241 +3271 @@
 
         switch (cli->auth->auth_type) {
-                case PIPE_AUTH_TYPE_SCHANNEL:
-                        *session_key = data_blob_talloc(mem_ctx,
-                                cli->auth->a_u.schannel_auth->creds->session_key, 16);
-                        break;
-                case PIPE_AUTH_TYPE_NTLMSSP:
-                case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
-                        *session_key = data_blob_talloc(mem_ctx,
-                                cli->auth->a_u.ntlmssp_state->session_key.data,
-                                cli->auth->a_u.ntlmssp_state->session_key.length);
-                        break;
-                case PIPE_AUTH_TYPE_KRB5:
-                case PIPE_AUTH_TYPE_SPNEGO_KRB5:
-                        *session_key = data_blob_talloc(mem_ctx,
-                                cli->auth->a_u.kerberos_auth->session_key.data,
-                                cli->auth->a_u.kerberos_auth->session_key.length);
-                        break;
-                case PIPE_AUTH_TYPE_NONE:
-                        *session_key = data_blob_talloc(mem_ctx,
-                                cli->auth->user_session_key.data,
-                                cli->auth->user_session_key.length);
-                        break;
-                default:
-                        return NT_STATUS_NO_USER_SESSION_KEY;
+        case DCERPC_AUTH_TYPE_SCHANNEL:
+                schannel_auth = talloc_get_type_abort(a->auth_ctx,
+                                                      struct schannel_state);
+                sk = data_blob_const(schannel_auth->creds->session_key, 16);
+                make_dup = true;
+                break;
+        case DCERPC_AUTH_TYPE_SPNEGO:
+                spnego_ctx = talloc_get_type_abort(a->auth_ctx,
+                                                   struct spnego_context);
+                sk = spnego_get_session_key(mem_ctx, spnego_ctx);
+                make_dup = false;
+                break;
+        case DCERPC_AUTH_TYPE_NTLMSSP:
+                ntlmssp_ctx = talloc_get_type_abort(a->auth_ctx,
+                                                    struct auth_ntlmssp_state);
+                sk = auth_ntlmssp_get_session_key(ntlmssp_ctx);
+                make_dup = true;
+                break;
+        case DCERPC_AUTH_TYPE_KRB5:
+                gse_ctx = talloc_get_type_abort(a->auth_ctx,
+                                                struct gse_context);
+                sk = gse_get_session_key(mem_ctx, gse_ctx);
+                make_dup = false;
+                break;
+        case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
+        case DCERPC_AUTH_TYPE_NONE:
+                sk = data_blob_const(a->user_session_key.data,
+                                     a->user_session_key.length);
+                make_dup = true;
+                break;
+        default:
+                break;
+        }
+
+        if (!sk.data) {
+                return NT_STATUS_NO_USER_SESSION_KEY;
+        }
+
+        if (make_dup) {
+                *session_key = data_blob_dup_talloc(mem_ctx, &sk);
+        } else {
+                *session_key = sk;
         }
 

vendor/current/source3/rpc_client/cli_samr.c

@@ -23 +23 @@
 
 #include "includes.h"
+#include "rpc_client/rpc_client.h"
 #include "../libcli/auth/libcli_auth.h"
-#include "../librpc/gen_ndr/cli_samr.h"
+#include "../librpc/gen_ndr/ndr_samr_c.h"
+#include "rpc_client/cli_samr.h"
+#include "../lib/crypto/arcfour.h"
+#include "rpc_client/init_lsa.h"
 
 /* User change password */
 
-NTSTATUS rpccli_samr_chgpasswd_user(struct rpc_pipe_client *cli,
+NTSTATUS dcerpc_samr_chgpasswd_user(struct dcerpc_binding_handle *h,
                                     TALLOC_CTX *mem_ctx,
                                     struct policy_handle *user_handle,
                                     const char *newpassword,
-                                    const char *oldpassword)
-{
-        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+                                    const char *oldpassword,
+                                    NTSTATUS *presult)
+{
+        NTSTATUS status;
         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
 
@@ -62 +67 @@
         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
 
-        result = rpccli_samr_ChangePasswordUser(cli, mem_ctx,
+        status = dcerpc_samr_ChangePasswordUser(h,
+                                                mem_ctx,
                                                 user_handle,
                                                 true,
@@ -73 +79 @@
                                                 &hash5,
                                                 true,
-                                                &hash6);
+                                                &hash6,
+                                                presult);
+
+        return status;
+}
+
+NTSTATUS rpccli_samr_chgpasswd_user(struct rpc_pipe_client *cli,
+                                    TALLOC_CTX *mem_ctx,
+                                    struct policy_handle *user_handle,
+                                    const char *newpassword,
+                                    const char *oldpassword)
+{
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_samr_chgpasswd_user(cli->binding_handle,
+                                            mem_ctx,
+                                            user_handle,
+                                            newpassword,
+                                            oldpassword,
+                                            &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         return result;
 }
 
-
 /* User change password */
 
-NTSTATUS rpccli_samr_chgpasswd_user2(struct rpc_pipe_client *cli,
+NTSTATUS dcerpc_samr_chgpasswd_user2(struct dcerpc_binding_handle *h,
                                      TALLOC_CTX *mem_ctx,
+                                     const char *srv_name_slash,
                                      const char *username,
                                      const char *newpassword,
-                                     const char *oldpassword)
-{
-        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+                                     const char *oldpassword,
+                                     NTSTATUS *presult)
+{
+        NTSTATUS status;
         struct samr_CryptPassword new_nt_password;
         struct samr_CryptPassword new_lm_password;
@@ -93 +123 @@
         struct samr_Password old_lanman_hash_enc;
 
-        uchar old_nt_hash[16];
-        uchar old_lanman_hash[16];
-        uchar new_nt_hash[16];
-        uchar new_lanman_hash[16];
+        uint8_t old_nt_hash[16];
+        uint8_t old_lanman_hash[16];
+        uint8_t new_nt_hash[16];
+        uint8_t new_lanman_hash[16];
         struct lsa_String server, account;
 
         DEBUG(10,("rpccli_samr_chgpasswd_user2\n"));
 
-        init_lsa_String(&server, cli->srv_name_slash);
+        init_lsa_String(&server, srv_name_slash);
         init_lsa_String(&account, username);
 
@@ -130 +160 @@
         E_old_pw_hash(new_nt_hash, old_nt_hash, old_nt_hash_enc.hash);
 
-        result = rpccli_samr_ChangePasswordUser2(cli, mem_ctx,
+        status = dcerpc_samr_ChangePasswordUser2(h,
+                                                 mem_ctx,
                                                  &server,
                                                  &account,
@@ -137 +168 @@
                                                  true,
                                                  &new_lm_password,
-                                                 &old_lanman_hash_enc);
+                                                 &old_lanman_hash_enc,
+                                                 presult);
+
+        return status;
+}
+
+NTSTATUS rpccli_samr_chgpasswd_user2(struct rpc_pipe_client *cli,
+                                     TALLOC_CTX *mem_ctx,
+                                     const char *username,
+                                     const char *newpassword,
+                                     const char *oldpassword)
+{
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_samr_chgpasswd_user2(cli->binding_handle,
+                                             mem_ctx,
+                                             cli->srv_name_slash,
+                                             username,
+                                             newpassword,
+                                             oldpassword,
+                                             &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         return result;
@@ -143 +198 @@
 
 /* User change password given blobs */
+
+NTSTATUS dcerpc_samr_chng_pswd_auth_crap(struct dcerpc_binding_handle *h,
+                                         TALLOC_CTX *mem_ctx,
+                                         const char *srv_name_slash,
+                                         const char *username,
+                                         DATA_BLOB new_nt_password_blob,
+                                         DATA_BLOB old_nt_hash_enc_blob,
+                                         DATA_BLOB new_lm_password_blob,
+                                         DATA_BLOB old_lm_hash_enc_blob,
+                                         NTSTATUS *presult)
+{
+        NTSTATUS status;
+        struct samr_CryptPassword new_nt_password;
+        struct samr_CryptPassword new_lm_password;
+        struct samr_Password old_nt_hash_enc;
+        struct samr_Password old_lm_hash_enc;
+        struct lsa_String server, account;
+
+        DEBUG(10,("rpccli_samr_chng_pswd_auth_crap\n"));
+
+        ZERO_STRUCT(new_nt_password);
+        ZERO_STRUCT(new_lm_password);
+        ZERO_STRUCT(old_nt_hash_enc);
+        ZERO_STRUCT(old_lm_hash_enc);
+
+        init_lsa_String(&server, srv_name_slash);
+        init_lsa_String(&account, username);
+
+        if (new_nt_password_blob.data && new_nt_password_blob.length >= 516) {
+                memcpy(&new_nt_password.data, new_nt_password_blob.data, 516);
+        }
+
+        if (new_lm_password_blob.data && new_lm_password_blob.length >= 516) {
+                memcpy(&new_lm_password.data, new_lm_password_blob.data, 516);
+        }
+
+        if (old_nt_hash_enc_blob.data && old_nt_hash_enc_blob.length >= 16) {
+                memcpy(&old_nt_hash_enc.hash, old_nt_hash_enc_blob.data, 16);
+        }
+
+        if (old_lm_hash_enc_blob.data && old_lm_hash_enc_blob.length >= 16) {
+                memcpy(&old_lm_hash_enc.hash, old_lm_hash_enc_blob.data, 16);
+        }
+
+        status = dcerpc_samr_ChangePasswordUser2(h,
+                                                 mem_ctx,
+                                                 &server,
+                                                 &account,
+                                                 &new_nt_password,
+                                                 &old_nt_hash_enc,
+                                                 true,
+                                                 &new_lm_password,
+                                                 &old_lm_hash_enc,
+                                                 presult);
+
+        return status;
+}
 
 NTSTATUS rpccli_samr_chng_pswd_auth_crap(struct rpc_pipe_client *cli,
@@ -152 +264 @@
                                          DATA_BLOB old_lm_hash_enc_blob)
 {
+        NTSTATUS status;
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-        struct samr_CryptPassword new_nt_password;
-        struct samr_CryptPassword new_lm_password;
-        struct samr_Password old_nt_hash_enc;
-        struct samr_Password old_lm_hash_enc;
-        struct lsa_String server, account;
-
-        ZERO_STRUCT(new_nt_password);
-        ZERO_STRUCT(new_lm_password);
-        ZERO_STRUCT(old_nt_hash_enc);
-        ZERO_STRUCT(old_lm_hash_enc);
-
-        DEBUG(10,("rpccli_samr_chng_pswd_auth_crap\n"));
-
-        init_lsa_String(&server, cli->srv_name_slash);
-        init_lsa_String(&account, username);
-
-        if (new_nt_password_blob.data && new_nt_password_blob.length >= 516) {
-                memcpy(&new_nt_password.data, new_nt_password_blob.data, 516);
-        }
-        if (new_lm_password_blob.data && new_lm_password_blob.length >= 516) {
-                memcpy(&new_lm_password.data, new_lm_password_blob.data, 516);
-        }
-        if (old_nt_hash_enc_blob.data && old_nt_hash_enc_blob.length >= 16) {
-                memcpy(&old_nt_hash_enc.hash, old_nt_hash_enc_blob.data, 16);
-        }
-        if (old_lm_hash_enc_blob.data && old_lm_hash_enc_blob.length >= 16) {
-                memcpy(&old_lm_hash_enc.hash, old_lm_hash_enc_blob.data, 16);
-        }
-
-        result = rpccli_samr_ChangePasswordUser2(cli, mem_ctx,
-                                                 &server,
-                                                 &account,
-                                                 &new_nt_password,
-                                                 &old_nt_hash_enc,
-                                                 true,
-                                                 &new_lm_password,
-                                                 &old_lm_hash_enc);
+
+        status = dcerpc_samr_chng_pswd_auth_crap(cli->binding_handle,
+                                                 mem_ctx,
+                                                 cli->srv_name_slash,
+                                                 username,
+                                                 new_nt_password_blob,
+                                                 old_nt_hash_enc_blob,
+                                                 new_lm_password_blob,
+                                                 old_lm_hash_enc_blob,
+                                                 &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
         return result;
 }
 
-
 /* change password 3 */
 
-NTSTATUS rpccli_samr_chgpasswd_user3(struct rpc_pipe_client *cli,
+NTSTATUS dcerpc_samr_chgpasswd_user3(struct dcerpc_binding_handle *h,
                                      TALLOC_CTX *mem_ctx,
+                                     const char *srv_name_slash,
                                      const char *username,
                                      const char *newpassword,
                                      const char *oldpassword,
                                      struct samr_DomInfo1 **dominfo1,
-                                     struct samr_ChangeReject **reject)
+                                     struct userPwdChangeFailureInformation **reject,
+                                     NTSTATUS *presult)
 {
         NTSTATUS status;
@@ -211 +302 @@
         struct samr_Password old_lanman_hash_enc;
 
-        uchar old_nt_hash[16];
-        uchar old_lanman_hash[16];
-        uchar new_nt_hash[16];
-        uchar new_lanman_hash[16];
+        uint8_t old_nt_hash[16];
+        uint8_t old_lanman_hash[16];
+        uint8_t new_nt_hash[16];
+        uint8_t new_lanman_hash[16];
 
         struct lsa_String server, account;
@@ -220 +311 @@
         DEBUG(10,("rpccli_samr_chgpasswd_user3\n"));
 
-        init_lsa_String(&server, cli->srv_name_slash);
+        init_lsa_String(&server, srv_name_slash);
         init_lsa_String(&account, username);
 
@@ -249 +340 @@
         E_old_pw_hash(new_nt_hash, old_nt_hash, old_nt_hash_enc.hash);
 
-        status = rpccli_samr_ChangePasswordUser3(cli, mem_ctx,
+        status = dcerpc_samr_ChangePasswordUser3(h,
+                                                 mem_ctx,
                                                  &server,
                                                  &account,
@@ -259 +351 @@
                                                  NULL,
                                                  dominfo1,
-                                                 reject);
+                                                 reject,
+                                                 presult);
+
         return status;
+}
+
+NTSTATUS rpccli_samr_chgpasswd_user3(struct rpc_pipe_client *cli,
+                                     TALLOC_CTX *mem_ctx,
+                                     const char *username,
+                                     const char *newpassword,
+                                     const char *oldpassword,
+                                     struct samr_DomInfo1 **dominfo1,
+                                     struct userPwdChangeFailureInformation **reject)
+{
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_samr_chgpasswd_user3(cli->binding_handle,
+                                             mem_ctx,
+                                             cli->srv_name_slash,
+                                             username,
+                                             newpassword,
+                                             oldpassword,
+                                             dominfo1,
+                                             reject,
+                                             &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        return result;
 }
 
@@ -268 +389 @@
    obtained by inspection using ethereal and NT4 running User Manager. */
 
-void get_query_dispinfo_params(int loop_count, uint32 *max_entries,
-                               uint32 *max_size)
+void dcerpc_get_query_dispinfo_params(int loop_count,
+                                      uint32_t *max_entries,
+                                      uint32_t *max_size)
 {
         switch(loop_count) {
@@ -295 +417 @@
 }
 
-NTSTATUS rpccli_try_samr_connects(struct rpc_pipe_client *cli,
+NTSTATUS dcerpc_try_samr_connects(struct dcerpc_binding_handle *h,
                                   TALLOC_CTX *mem_ctx,
+                                  const char *srv_name_slash,
                                   uint32_t access_mask,
-                                  struct policy_handle *connect_pol)
+                                  struct policy_handle *connect_pol,
+                                  NTSTATUS *presult)
 {
         NTSTATUS status;
@@ -310 +434 @@
         info_in.info1 = info1;
 
-        status = rpccli_samr_Connect5(cli, mem_ctx,
-                                      cli->srv_name_slash,
+        status = dcerpc_samr_Connect5(h,
+                                      mem_ctx,
+                                      srv_name_slash,
                                       access_mask,
                                       1,
@@ -317 +442 @@
                                       &lvl_out,
                                       &info_out,
-                                      connect_pol);
-        if (NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = rpccli_samr_Connect4(cli, mem_ctx,
-                                      cli->srv_name_slash,
+                                      connect_pol,
+                                      presult);
+        if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(*presult)) {
+                return status;
+        }
+
+        status = dcerpc_samr_Connect4(h,
+                                      mem_ctx,
+                                      srv_name_slash,
                                       SAMR_CONNECT_W2K,
                                       access_mask,
-                                      connect_pol);
-        if (NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = rpccli_samr_Connect2(cli, mem_ctx,
-                                      cli->srv_name_slash,
+                                      connect_pol,
+                                      presult);
+        if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(*presult)) {
+                return status;
+        }
+
+        status = dcerpc_samr_Connect2(h,
+                                      mem_ctx,
+                                      srv_name_slash,
                                       access_mask,
-                                      connect_pol);
+                                      connect_pol,
+                                      presult);
+
         return status;
 }
 
+NTSTATUS rpccli_try_samr_connects(struct rpc_pipe_client *cli,
+                                  TALLOC_CTX *mem_ctx,
+                                  uint32_t access_mask,
+                                  struct policy_handle *connect_pol)
+{
+        NTSTATUS status;
+        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+
+        status = dcerpc_try_samr_connects(cli->binding_handle,
+                                          mem_ctx,
+                                          cli->srv_name_slash,
+                                          access_mask,
+                                          connect_pol,
+                                          &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        return result;
+}
+
+/* vim: set ts=8 sw=8 noet cindent: */

vendor/current/source3/rpc_client/cli_spoolss.c

@@ -24 +24 @@
 
 #include "includes.h"
-#include "../librpc/gen_ndr/cli_spoolss.h"
+#include "rpc_client/rpc_client.h"
+#include "../librpc/gen_ndr/ndr_spoolss_c.h"
+#include "rpc_client/cli_spoolss.h"
 
 /**********************************************************************
@@ -41 +43 @@
         union spoolss_UserLevel userlevel;
         struct spoolss_UserLevel1 level1;
+        struct dcerpc_binding_handle *b = cli->binding_handle;
 
         ZERO_STRUCT(devmode_ctr);
@@ -55 +58 @@
         userlevel.level1 = &level1;
 
-        status = rpccli_spoolss_OpenPrinterEx(cli, mem_ctx,
+        status = dcerpc_spoolss_OpenPrinterEx(b, mem_ctx,
                                               printername,
                                               NULL,
@@ -65 +68 @@
                                               &werror);
 
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+
         if (!W_ERROR_IS_OK(werror)) {
                 return werror;
-        }
-
-        if (!NT_STATUS_IS_OK(status)) {
-                return ntstatus_to_werror(status);
         }
 
@@ -92 +95 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_GetPrinterDriver(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_GetPrinterDriver(b, mem_ctx,
                                                  handle,
                                                  architecture,
@@ -107 +111 @@
                                                  &needed,
                                                  &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
                 offered = needed;
@@ -112 +119 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_GetPrinterDriver(cli, mem_ctx,
+                status = dcerpc_spoolss_GetPrinterDriver(b, mem_ctx,
                                                          handle,
                                                          architecture,
@@ -121 +128 @@
                                                          &needed,
                                                          &werror);
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
         }
 
@@ -146 +156 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_GetPrinterDriver2(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_GetPrinterDriver2(b, mem_ctx,
                                                   handle,
                                                   architecture,
@@ -165 +176 @@
                                                   server_minor_version,
                                                   &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
                 offered = needed;
@@ -170 +185 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_GetPrinterDriver2(cli, mem_ctx,
+                status = dcerpc_spoolss_GetPrinterDriver2(b, mem_ctx,
                                                           handle,
                                                           architecture,
@@ -184 +199 @@
                                                           &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -203 +221 @@
         struct spoolss_UserLevel1 level1;
         struct policy_handle handle;
+        struct dcerpc_binding_handle *b = cli->binding_handle;
 
         ZERO_STRUCT(devmode_ctr);
@@ -219 +238 @@
         userlevel_ctr.user_info.level1 = &level1;
 
-        status = rpccli_spoolss_AddPrinterEx(cli, mem_ctx,
+        status = dcerpc_spoolss_AddPrinterEx(b, mem_ctx,
                                              cli->srv_name_slash,
                                              info_ctr,
@@ -227 +246 @@
                                              &handle,
                                              &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+
         return result;
 }
@@ -245 +268 @@
         DATA_BLOB buffer;
         uint32_t needed;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_GetPrinter(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_GetPrinter(b, mem_ctx,
                                            handle,
                                            level,
@@ -259 +283 @@
                                            &needed,
                                            &werror);
-
-        if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
-
-                offered = needed;
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-
-                status = rpccli_spoolss_GetPrinter(cli, mem_ctx,
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+
+        if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
+
+                offered = needed;
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+
+                status = dcerpc_spoolss_GetPrinter(b, mem_ctx,
                                                    handle,
                                                    level,
@@ -275 +302 @@
                                                    &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -295 +325 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_GetJob(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_GetJob(b, mem_ctx,
                                        handle,
                                        job_id,
@@ -310 +341 @@
                                        &needed,
                                        &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
@@ -316 +350 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_GetJob(cli, mem_ctx,
+                status = dcerpc_spoolss_GetJob(b, mem_ctx,
                                                handle,
                                                job_id,
@@ -326 +360 @@
                                                &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -346 +383 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_EnumForms(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_EnumForms(b, mem_ctx,
                                           handle,
                                           level,
@@ -361 +399 @@
                                           &needed,
                                           &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
@@ -367 +408 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_EnumForms(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumForms(b, mem_ctx,
                                                   handle,
                                                   level,
@@ -377 +418 @@
                                                   &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -398 +442 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_EnumPrintProcessors(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_EnumPrintProcessors(b, mem_ctx,
                                                     servername,
                                                     environment,
@@ -414 +459 @@
                                                     &needed,
                                                     &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
@@ -420 +468 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_EnumPrintProcessors(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumPrintProcessors(b, mem_ctx,
                                                             servername,
                                                             environment,
@@ -431 +479 @@
                                                             &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -452 +503 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_EnumPrintProcDataTypes(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_EnumPrintProcDataTypes(b, mem_ctx,
                                                        servername,
                                                        print_processor_name,
@@ -468 +520 @@
                                                        &needed,
                                                        &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
@@ -474 +529 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_EnumPrintProcDataTypes(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumPrintProcDataTypes(b, mem_ctx,
                                                                servername,
                                                                print_processor_name,
@@ -485 +540 @@
                                                                &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -505 +563 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_EnumPorts(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_EnumPorts(b, mem_ctx,
                                           servername,
                                           level,
@@ -520 +579 @@
                                           &needed,
                                           &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
@@ -526 +588 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_EnumPorts(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumPorts(b, mem_ctx,
                                                   servername,
                                                   level,
@@ -536 +598 @@
                                                   &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -556 +621 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_EnumMonitors(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_EnumMonitors(b, mem_ctx,
                                              servername,
                                              level,
@@ -571 +637 @@
                                              &needed,
                                              &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
@@ -577 +646 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_EnumMonitors(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumMonitors(b, mem_ctx,
                                                      servername,
                                                      level,
@@ -586 +655 @@
                                                      &needed,
                                                      &werror);
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
         }
 
@@ -609 +681 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_EnumJobs(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_EnumJobs(b, mem_ctx,
                                          handle,
                                          firstjob,
@@ -626 +699 @@
                                          &needed,
                                          &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
@@ -632 +708 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_EnumJobs(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumJobs(b, mem_ctx,
                                                  handle,
                                                  firstjob,
@@ -644 +720 @@
                                                  &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -665 +744 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_EnumPrinterDrivers(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_EnumPrinterDrivers(b, mem_ctx,
                                                    server,
                                                    environment,
@@ -681 +761 @@
                                                    &needed,
                                                    &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
@@ -687 +770 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_EnumPrinterDrivers(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumPrinterDrivers(b, mem_ctx,
                                                    server,
                                                    environment,
@@ -698 +781 @@
                                                    &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -719 +805 @@
         uint32_t needed;
         DATA_BLOB buffer;
-
-        if (offered > 0) {
-                buffer = data_blob_talloc_zero(mem_ctx, offered);
-                W_ERROR_HAVE_NO_MEMORY(buffer.data);
-        }
-
-        status = rpccli_spoolss_EnumPrinters(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        if (offered > 0) {
+                buffer = data_blob_talloc_zero(mem_ctx, offered);
+                W_ERROR_HAVE_NO_MEMORY(buffer.data);
+        }
+
+        status = dcerpc_spoolss_EnumPrinters(b, mem_ctx,
                                              flags,
                                              server,
@@ -735 +822 @@
                                              &needed,
                                              &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_INSUFFICIENT_BUFFER)) {
@@ -741 +831 @@
                 W_ERROR_HAVE_NO_MEMORY(buffer.data);
 
-                status = rpccli_spoolss_EnumPrinters(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumPrinters(b, mem_ctx,
                                                      flags,
                                                      server,
@@ -752 +842 @@
                                                      &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         return werror;
@@ -773 +866 @@
         uint32_t needed;
         uint8_t *data;
+        struct dcerpc_binding_handle *b = cli->binding_handle;
 
         data = talloc_zero_array(mem_ctx, uint8_t, offered);
         W_ERROR_HAVE_NO_MEMORY(data);
 
-        status = rpccli_spoolss_GetPrinterData(cli, mem_ctx,
+        status = dcerpc_spoolss_GetPrinterData(b, mem_ctx,
                                                handle,
                                                value_name,
@@ -785 +879 @@
                                                &needed,
                                                &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_MORE_DATA)) {
@@ -791 +888 @@
                 W_ERROR_HAVE_NO_MEMORY(data);
 
-                status = rpccli_spoolss_GetPrinterData(cli, mem_ctx,
+                status = dcerpc_spoolss_GetPrinterData(b, mem_ctx,
                                                        handle,
                                                        value_name,
@@ -800 +897 @@
                                                        &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         *data_p = data;
@@ -823 +923 @@
         union spoolss_KeyNames _key_buffer;
         uint32_t _ndr_size;
-
-        status = rpccli_spoolss_EnumPrinterKey(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        status = dcerpc_spoolss_EnumPrinterKey(b, mem_ctx,
                                                handle,
                                                key_name,
@@ -832 +933 @@
                                                &needed,
                                                &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_MORE_DATA)) {
                 offered = needed;
-                status = rpccli_spoolss_EnumPrinterKey(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumPrinterKey(b, mem_ctx,
                                                        handle,
                                                        key_name,
@@ -844 +948 @@
                                                        &werror);
         }
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         *key_buffer = _key_buffer.string_array;
@@ -865 +972 @@
         WERROR werror;
         uint32_t needed;
-
-        status = rpccli_spoolss_EnumPrinterDataEx(cli, mem_ctx,
+        struct dcerpc_binding_handle *b = cli->binding_handle;
+
+        status = dcerpc_spoolss_EnumPrinterDataEx(b, mem_ctx,
                                                   handle,
                                                   key_name,
@@ -874 +982 @@
                                                   &needed,
                                                   &werror);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
 
         if (W_ERROR_EQUAL(werror, WERR_MORE_DATA)) {
                 offered = needed;
 
-                status = rpccli_spoolss_EnumPrinterDataEx(cli, mem_ctx,
+                status = dcerpc_spoolss_EnumPrinterDataEx(b, mem_ctx,
                                                           handle,
                                                           key_name,
@@ -887 +998 @@
                                                           &werror);
         }
-
-        return werror;
-}
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+
+        return werror;
+}

vendor/current/source3/rpc_client/init_lsa.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "rpc_client/init_lsa.h"
+#include "../librpc/gen_ndr/lsa.h"
 
 /*******************************************************************

vendor/current/source3/rpc_client/init_netlogon.c

@@ -20 +20 @@
 #include "includes.h"
 #include "../libcli/auth/libcli_auth.h"
+#include "../lib/crypto/arcfour.h"
+#include "rpc_client/init_netlogon.h"
 
 /*************************************************************************

vendor/current/source3/rpc_client/init_samr.c

@@ -20 +20 @@
 #include "includes.h"
 #include "../libcli/auth/libcli_auth.h"
+#include "../lib/crypto/md5.h"
+#include "../lib/crypto/arcfour.h"
+#include "rpc_client/init_samr.h"
 
 /*************************************************************************

vendor/current/source3/rpc_client/init_spoolss.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "../librpc/gen_ndr/ndr_spoolss.h"
+#include "rpc_client/init_spoolss.h"
+#include "../libcli/security/security.h"
+#include "secrets.h"
+#include "passdb/machine_sid.h"
 
 /*******************************************************************
@@ -42 +47 @@
 }
 
+time_t spoolss_Time_to_time_t(const struct spoolss_Time *r)
+{
+        struct tm unixtime;
+
+        unixtime.tm_year        = r->year - 1900;
+        unixtime.tm_mon         = r->month - 1;
+        unixtime.tm_wday        = r->day_of_week;
+        unixtime.tm_mday        = r->day;
+        unixtime.tm_hour        = r->hour;
+        unixtime.tm_min         = r->minute;
+        unixtime.tm_sec         = r->second;
+
+        return mktime(&unixtime);
+}
+
 /*******************************************************************
  ********************************************************************/
@@ -51 +71 @@
 {
         enum ndr_err_code ndr_err;
-        ndr_err = ndr_pull_union_blob(blob, mem_ctx, NULL, data, type,
+        ndr_err = ndr_pull_union_blob(blob, mem_ctx, data, type,
                         (ndr_pull_flags_fn_t)ndr_pull_spoolss_PrinterData);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -67 +87 @@
 {
         enum ndr_err_code ndr_err;
-        ndr_err = ndr_push_union_blob(blob, mem_ctx, NULL, data, type,
+        ndr_err = ndr_push_union_blob(blob, mem_ctx, data, type,
                         (ndr_push_flags_fn_t)ndr_push_spoolss_PrinterData);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -103 +123 @@
         s->averageppm           = i->averageppm;
 }
+
+/****************************************************************************
+****************************************************************************/
+
+bool driver_info_ctr_to_info8(struct spoolss_AddDriverInfoCtr *r,
+                              struct spoolss_DriverInfo8 *_info8)
+{
+        struct spoolss_DriverInfo8 info8;
+
+        ZERO_STRUCT(info8);
+
+        switch (r->level) {
+        case 3:
+                info8.version           = r->info.info3->version;
+                info8.driver_name       = r->info.info3->driver_name;
+                info8.architecture      = r->info.info3->architecture;
+                info8.driver_path       = r->info.info3->driver_path;
+                info8.data_file         = r->info.info3->data_file;
+                info8.config_file       = r->info.info3->config_file;
+                info8.help_file         = r->info.info3->help_file;
+                info8.monitor_name      = r->info.info3->monitor_name;
+                info8.default_datatype  = r->info.info3->default_datatype;
+                if (r->info.info3->dependent_files && r->info.info3->dependent_files->string) {
+                        info8.dependent_files   = r->info.info3->dependent_files->string;
+                }
+                break;
+        case 6:
+                info8.version           = r->info.info6->version;
+                info8.driver_name       = r->info.info6->driver_name;
+                info8.architecture      = r->info.info6->architecture;
+                info8.driver_path       = r->info.info6->driver_path;
+                info8.data_file         = r->info.info6->data_file;
+                info8.config_file       = r->info.info6->config_file;
+                info8.help_file         = r->info.info6->help_file;
+                info8.monitor_name      = r->info.info6->monitor_name;
+                info8.default_datatype  = r->info.info6->default_datatype;
+                if (r->info.info6->dependent_files && r->info.info6->dependent_files->string) {
+                        info8.dependent_files   = r->info.info6->dependent_files->string;
+                }
+                info8.driver_date       = r->info.info6->driver_date;
+                info8.driver_version    = r->info.info6->driver_version;
+                info8.manufacturer_name = r->info.info6->manufacturer_name;
+                info8.manufacturer_url  = r->info.info6->manufacturer_url;
+                info8.hardware_id       = r->info.info6->hardware_id;
+                info8.provider          = r->info.info6->provider;
+                break;
+        case 8:
+                info8.version           = r->info.info8->version;
+                info8.driver_name       = r->info.info8->driver_name;
+                info8.architecture      = r->info.info8->architecture;
+                info8.driver_path       = r->info.info8->driver_path;
+                info8.data_file         = r->info.info8->data_file;
+                info8.config_file       = r->info.info8->config_file;
+                info8.help_file         = r->info.info8->help_file;
+                info8.monitor_name      = r->info.info8->monitor_name;
+                info8.default_datatype  = r->info.info8->default_datatype;
+                if (r->info.info8->dependent_files && r->info.info8->dependent_files->string) {
+                        info8.dependent_files   = r->info.info8->dependent_files->string;
+                }
+                if (r->info.info8->previous_names && r->info.info8->previous_names->string) {
+                        info8.previous_names    = r->info.info8->previous_names->string;
+                }
+                info8.driver_date       = r->info.info8->driver_date;
+                info8.driver_version    = r->info.info8->driver_version;
+                info8.manufacturer_name = r->info.info8->manufacturer_name;
+                info8.manufacturer_url  = r->info.info8->manufacturer_url;
+                info8.hardware_id       = r->info.info8->hardware_id;
+                info8.provider          = r->info.info8->provider;
+                info8.print_processor   = r->info.info8->print_processor;
+                info8.vendor_setup      = r->info.info8->vendor_setup;
+                if (r->info.info8->color_profiles && r->info.info8->color_profiles->string) {
+                        info8.color_profiles = r->info.info8->color_profiles->string;
+                }
+                info8.inf_path          = r->info.info8->inf_path;
+                info8.printer_driver_attributes = r->info.info8->printer_driver_attributes;
+                if (r->info.info8->core_driver_dependencies && r->info.info8->core_driver_dependencies->string) {
+                        info8.core_driver_dependencies = r->info.info8->core_driver_dependencies->string;
+                }
+                info8.min_inbox_driver_ver_date = r->info.info8->min_inbox_driver_ver_date;
+                info8.min_inbox_driver_ver_version = r->info.info8->min_inbox_driver_ver_version;
+                break;
+        default:
+                return false;
+        }
+
+        *_info8 = info8;
+
+        return true;
+}
+
+/****************************************************************************
+ Create and allocate a default devicemode.
+****************************************************************************/
+
+WERROR spoolss_create_default_devmode(TALLOC_CTX *mem_ctx,
+                                      const char *devicename,
+                                      struct spoolss_DeviceMode **devmode)
+{
+        struct spoolss_DeviceMode *dm;
+        char *dname;
+
+        dm = talloc_zero(mem_ctx, struct spoolss_DeviceMode);
+        if (dm == NULL) {
+                return WERR_NOMEM;
+        }
+
+        dname = talloc_asprintf(dm, "%s", devicename);
+        if (dname == NULL) {
+                return WERR_NOMEM;
+        }
+        if (strlen(dname) > MAXDEVICENAME) {
+                dname[MAXDEVICENAME] = '\0';
+        }
+        dm->devicename = dname;
+
+        dm->formname = talloc_strdup(dm, "Letter");
+        if (dm->formname == NULL) {
+                return WERR_NOMEM;
+        }
+
+        dm->specversion          = DMSPEC_NT4_AND_ABOVE;
+        dm->driverversion        = 0x0400;
+        dm->size                 = 0x00DC;
+        dm->__driverextra_length = 0;
+        dm->fields               = DEVMODE_FORMNAME |
+                                   DEVMODE_TTOPTION |
+                                   DEVMODE_PRINTQUALITY |
+                                   DEVMODE_DEFAULTSOURCE |
+                                   DEVMODE_COPIES |
+                                   DEVMODE_SCALE |
+                                   DEVMODE_PAPERSIZE |
+                                   DEVMODE_ORIENTATION;
+        dm->orientation          = DMORIENT_PORTRAIT;
+        dm->papersize            = DMPAPER_LETTER;
+        dm->paperlength          = 0;
+        dm->paperwidth           = 0;
+        dm->scale                = 0x64;
+        dm->copies               = 1;
+        dm->defaultsource        = DMBIN_FORMSOURCE;
+        dm->printquality         = DMRES_HIGH;           /* 0x0258 */
+        dm->color                = DMRES_MONOCHROME;
+        dm->duplex               = DMDUP_SIMPLEX;
+        dm->yresolution          = 0;
+        dm->ttoption             = DMTT_SUBDEV;
+        dm->collate              = DMCOLLATE_FALSE;
+        dm->icmmethod            = 0;
+        dm->icmintent            = 0;
+        dm->mediatype            = 0;
+        dm->dithertype           = 0;
+
+        dm->logpixels            = 0;
+        dm->bitsperpel           = 0;
+        dm->pelswidth            = 0;
+        dm->pelsheight           = 0;
+        dm->displayflags         = 0;
+        dm->displayfrequency     = 0;
+        dm->reserved1            = 0;
+        dm->reserved2            = 0;
+        dm->panningwidth         = 0;
+        dm->panningheight        = 0;
+
+        dm->driverextra_data.data = NULL;
+        dm->driverextra_data.length = 0;
+
+        *devmode = dm;
+        return WERR_OK;
+}
+
+WERROR spoolss_create_default_secdesc(TALLOC_CTX *mem_ctx,
+                                      struct spoolss_security_descriptor **secdesc)
+{
+        struct security_ace ace[7];     /* max number of ace entries */
+        int i = 0;
+        uint32_t sa;
+        struct security_acl *psa = NULL;
+        struct security_descriptor *psd = NULL;
+        struct dom_sid adm_sid;
+        size_t sd_size;
+
+        /* Create an ACE where Everyone is allowed to print */
+
+        sa = PRINTER_ACE_PRINT;
+        init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
+                     sa, SEC_ACE_FLAG_CONTAINER_INHERIT);
+
+        /* Add the domain admins group if we are a DC */
+
+        if ( IS_DC ) {
+                struct dom_sid domadmins_sid;
+
+                sid_compose(&domadmins_sid, get_global_sam_sid(),
+                            DOMAIN_RID_ADMINS);
+
+                sa = PRINTER_ACE_FULL_CONTROL;
+                init_sec_ace(&ace[i++], &domadmins_sid,
+                        SEC_ACE_TYPE_ACCESS_ALLOWED, sa,
+                        SEC_ACE_FLAG_OBJECT_INHERIT | SEC_ACE_FLAG_INHERIT_ONLY);
+                init_sec_ace(&ace[i++], &domadmins_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
+                        sa, SEC_ACE_FLAG_CONTAINER_INHERIT);
+        }
+        else if (secrets_fetch_domain_sid(lp_workgroup(), &adm_sid)) {
+                sid_append_rid(&adm_sid, DOMAIN_RID_ADMINISTRATOR);
+
+                sa = PRINTER_ACE_FULL_CONTROL;
+                init_sec_ace(&ace[i++], &adm_sid,
+                        SEC_ACE_TYPE_ACCESS_ALLOWED, sa,
+                        SEC_ACE_FLAG_OBJECT_INHERIT | SEC_ACE_FLAG_INHERIT_ONLY);
+                init_sec_ace(&ace[i++], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
+                        sa, SEC_ACE_FLAG_CONTAINER_INHERIT);
+        }
+
+        /* add BUILTIN\Administrators as FULL CONTROL */
+
+        sa = PRINTER_ACE_FULL_CONTROL;
+        init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
+                SEC_ACE_TYPE_ACCESS_ALLOWED, sa,
+                SEC_ACE_FLAG_OBJECT_INHERIT | SEC_ACE_FLAG_INHERIT_ONLY);
+        init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
+                SEC_ACE_TYPE_ACCESS_ALLOWED,
+                sa, SEC_ACE_FLAG_CONTAINER_INHERIT);
+
+        /* add BUILTIN\Print Operators as FULL CONTROL */
+
+        sa = PRINTER_ACE_FULL_CONTROL;
+        init_sec_ace(&ace[i++], &global_sid_Builtin_Print_Operators,
+                SEC_ACE_TYPE_ACCESS_ALLOWED, sa,
+                SEC_ACE_FLAG_OBJECT_INHERIT | SEC_ACE_FLAG_INHERIT_ONLY);
+        init_sec_ace(&ace[i++], &global_sid_Builtin_Print_Operators,
+                SEC_ACE_TYPE_ACCESS_ALLOWED,
+                sa, SEC_ACE_FLAG_CONTAINER_INHERIT);
+
+        /* Make the security descriptor owned by the BUILTIN\Administrators */
+
+        /* The ACL revision number in rpc_secdesc.h differs from the one
+           created by NT when setting ACE entries in printer
+           descriptors.  NT4 complains about the property being edited by a
+           NT5 machine. */
+
+        if ((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, i, ace)) != NULL) {
+                psd = make_sec_desc(mem_ctx,
+                                    SD_REVISION,
+                                    SEC_DESC_SELF_RELATIVE,
+                                    &global_sid_Builtin_Administrators,
+                                    &global_sid_Builtin_Administrators,
+                                    NULL,
+                                    psa,
+                                    &sd_size);
+        }
+
+        if (psd == NULL) {
+                DEBUG(0,("construct_default_printer_sd: Failed to make SEC_DESC.\n"));
+                return WERR_NOMEM;
+        }
+
+        DEBUG(4,("construct_default_printer_sdb: size = %u.\n",
+                 (unsigned int)sd_size));
+
+        *secdesc = psd;
+
+        return WERR_OK;
+}

vendor/current/source3/rpc_client/rpc_transport_np.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "rpc_client/rpc_transport.h"
+#include "libsmb/cli_np_tstream.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_RPC_CLI
 
-struct rpc_transport_np_state {
-        struct cli_state *cli;
-        const char *pipe_name;
-        uint16_t fnum;
-};
-
-static bool rpc_np_is_connected(void *priv)
-{
-        struct rpc_transport_np_state *np_transport = talloc_get_type_abort(
-                priv, struct rpc_transport_np_state);
-        bool ok;
-
-        if (np_transport->cli == NULL) {
-                return false;
-        }
-
-        ok = cli_state_is_connected(np_transport->cli);
-        if (!ok) {
-                np_transport->cli = NULL;
-                return false;
-        }
-
-        return true;
-}
-
-static unsigned int rpc_np_set_timeout(void *priv, unsigned int timeout)
-{
-        struct rpc_transport_np_state *np_transport = talloc_get_type_abort(
-                priv, struct rpc_transport_np_state);
-        bool ok;
-
-        if (np_transport->cli == NULL) {
-                return false;
-        }
-
-        ok = rpc_np_is_connected(np_transport);
-        if (!ok) {
-                return 0;
-        }
-
-        return cli_set_timeout(np_transport->cli, timeout);
-}
-
-static int rpc_transport_np_state_destructor(struct rpc_transport_np_state *s)
-{
-        if (!rpc_np_is_connected(s)) {
-                DEBUG(10, ("socket was closed, no need to send close request.\n"));
-                return 0;
-        }
-
-        /* TODO: do not use a sync call with a destructor!!! */
-        if (!NT_STATUS_IS_OK(cli_close(s->cli, s->fnum))) {
-                DEBUG(1, ("rpc_transport_np_state_destructor: cli_close "
-                          "failed on pipe %s. Error was %s\n", s->pipe_name,
-                          cli_errstr(s->cli)));
-        }
-        DEBUG(10, ("rpc_pipe_destructor: closed %s\n", s->pipe_name));
-        /*
-         * We can't do much on failure
-         */
-        return 0;
-}
-
-struct rpc_np_write_state {
-        struct rpc_transport_np_state *np_transport;
-        size_t size;
-        size_t written;
-};
-
-static void rpc_np_write_done(struct tevent_req *subreq);
-
-static struct tevent_req *rpc_np_write_send(TALLOC_CTX *mem_ctx,
-                                            struct event_context *ev,
-                                            const uint8_t *data, size_t size,
-                                            void *priv)
-{
-        struct rpc_transport_np_state *np_transport = talloc_get_type_abort(
-                priv, struct rpc_transport_np_state);
-        struct tevent_req *req, *subreq;
-        struct rpc_np_write_state *state;
-        bool ok;
-
-        req = tevent_req_create(mem_ctx, &state, struct rpc_np_write_state);
-        if (req == NULL) {
-                return NULL;
-        }
-
-        ok = rpc_np_is_connected(np_transport);
-        if (!ok) {
-                tevent_req_nterror(req, NT_STATUS_CONNECTION_INVALID);
-                return tevent_req_post(req, ev);
-        }
-
-        state->np_transport = np_transport;
-        state->size = size;
-
-
-        subreq = cli_write_andx_send(mem_ctx, ev, np_transport->cli,
-                                     np_transport->fnum,
-                                     8, /* 8 means message mode. */
-                                     data, 0, size);
-        if (tevent_req_nomem(subreq, req)) {
-                return tevent_req_post(req, ev);
-        }
-        tevent_req_set_callback(subreq, rpc_np_write_done, req);
-        return req;
-}
-
-static void rpc_np_write_done(struct tevent_req *subreq)
-{
-        struct tevent_req *req = tevent_req_callback_data(
-                subreq, struct tevent_req);
-        struct rpc_np_write_state *state = tevent_req_data(
-                req, struct rpc_np_write_state);
-        NTSTATUS status;
-
-        status = cli_write_andx_recv(subreq, &state->written);
-        TALLOC_FREE(subreq);
-        if (!NT_STATUS_IS_OK(status)) {
-                state->np_transport->cli = NULL;
-                tevent_req_nterror(req, status);
-                return;
-        }
-        tevent_req_done(req);
-}
-
-static NTSTATUS rpc_np_write_recv(struct tevent_req *req, ssize_t *pwritten)
-{
-        struct rpc_np_write_state *state = tevent_req_data(
-                req, struct rpc_np_write_state);
-        NTSTATUS status;
-
-        if (tevent_req_is_nterror(req, &status)) {
-                return status;
-        }
-        *pwritten = state->written;
-        return NT_STATUS_OK;
-}
-
-struct rpc_np_read_state {
-        struct rpc_transport_np_state *np_transport;
-        uint8_t *data;
-        size_t size;
-        ssize_t received;
-};
-
-static void rpc_np_read_done(struct tevent_req *subreq);
-
-static struct tevent_req *rpc_np_read_send(TALLOC_CTX *mem_ctx,
-                                           struct event_context *ev,
-                                           uint8_t *data, size_t size,
-                                           void *priv)
-{
-        struct rpc_transport_np_state *np_transport = talloc_get_type_abort(
-                priv, struct rpc_transport_np_state);
-        struct tevent_req *req, *subreq;
-        struct rpc_np_read_state *state;
-        bool ok;
-
-        req = tevent_req_create(mem_ctx, &state, struct rpc_np_read_state);
-        if (req == NULL) {
-                return NULL;
-        }
-
-        ok = rpc_np_is_connected(np_transport);
-        if (!ok) {
-                tevent_req_nterror(req, NT_STATUS_CONNECTION_INVALID);
-                return tevent_req_post(req, ev);
-        }
-
-        state->np_transport = np_transport;
-        state->data = data;
-        state->size = size;
-
-        subreq = cli_read_andx_send(mem_ctx, ev, np_transport->cli,
-                                    np_transport->fnum, 0, size);
-        if (subreq == NULL) {
-                goto fail;
-        }
-        tevent_req_set_callback(subreq, rpc_np_read_done, req);
-        return req;
- fail:
-        TALLOC_FREE(req);
-        return NULL;
-}
-
-static void rpc_np_read_done(struct tevent_req *subreq)
-{
-        struct tevent_req *req = tevent_req_callback_data(
-                subreq, struct tevent_req);
-        struct rpc_np_read_state *state = tevent_req_data(
-                req, struct rpc_np_read_state);
-        NTSTATUS status;
-        uint8_t *rcvbuf;
-
-        /* We must free subreq in this function as there is
-           a timer event attached to it. */
-
-        status = cli_read_andx_recv(subreq, &state->received, &rcvbuf);
-        /*
-         * We can't TALLOC_FREE(subreq) as usual here, as rcvbuf still is a
-         * child of that.
-         */
-        if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
-                status = NT_STATUS_OK;
-        }
-        if (!NT_STATUS_IS_OK(status)) {
-                TALLOC_FREE(subreq);
-                state->np_transport->cli = NULL;
-                tevent_req_nterror(req, status);
-                return;
-        }
-
-        if (state->received > state->size) {
-                TALLOC_FREE(subreq);
-                state->np_transport->cli = NULL;
-                tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
-                return;
-        }
-
-        if (state->received == 0) {
-                TALLOC_FREE(subreq);
-                state->np_transport->cli = NULL;
-                tevent_req_nterror(req, NT_STATUS_PIPE_BROKEN);
-                return;
-        }
-
-        memcpy(state->data, rcvbuf, state->received);
-        TALLOC_FREE(subreq);
-        tevent_req_done(req);
-}
-
-static NTSTATUS rpc_np_read_recv(struct tevent_req *req, ssize_t *preceived)
-{
-        struct rpc_np_read_state *state = tevent_req_data(
-                req, struct rpc_np_read_state);
-        NTSTATUS status;
-
-        if (tevent_req_is_nterror(req, &status)) {
-                return status;
-        }
-        *preceived = state->received;
-        return NT_STATUS_OK;
-}
-
-struct rpc_np_trans_state {
-        struct rpc_transport_np_state *np_transport;
-        uint16_t setup[2];
-        uint32_t max_rdata_len;
-        uint8_t *rdata;
-        uint32_t rdata_len;
-};
-
-static void rpc_np_trans_done(struct tevent_req *subreq);
-
-static struct tevent_req *rpc_np_trans_send(TALLOC_CTX *mem_ctx,
-                                            struct event_context *ev,
-                                            uint8_t *data, size_t data_len,
-                                            uint32_t max_rdata_len,
-                                            void *priv)
-{
-        struct rpc_transport_np_state *np_transport = talloc_get_type_abort(
-                priv, struct rpc_transport_np_state);
-        struct tevent_req *req, *subreq;
-        struct rpc_np_trans_state *state;
-        bool ok;
-
-        req = tevent_req_create(mem_ctx, &state, struct rpc_np_trans_state);
-        if (req == NULL) {
-                return NULL;
-        }
-
-        ok = rpc_np_is_connected(np_transport);
-        if (!ok) {
-                tevent_req_nterror(req, NT_STATUS_CONNECTION_INVALID);
-                return tevent_req_post(req, ev);
-        }
-
-        state->np_transport = np_transport;
-        state->max_rdata_len = max_rdata_len;
-
-        SSVAL(state->setup+0, 0, TRANSACT_DCERPCCMD);
-        SSVAL(state->setup+1, 0, np_transport->fnum);
-
-        subreq = cli_trans_send(
-                state, ev, np_transport->cli, SMBtrans,
-                "\\PIPE\\", 0, 0, 0, state->setup, 2, 0,
-                NULL, 0, 0, data, data_len, max_rdata_len);
-        if (subreq == NULL) {
-                goto fail;
-        }
-        tevent_req_set_callback(subreq, rpc_np_trans_done, req);
-        return req;
-
- fail:
-        TALLOC_FREE(req);
-        return NULL;
-}
-
-static void rpc_np_trans_done(struct tevent_req *subreq)
-{
-        struct tevent_req *req = tevent_req_callback_data(
-                subreq, struct tevent_req);
-        struct rpc_np_trans_state *state = tevent_req_data(
-                req, struct rpc_np_trans_state);
-        NTSTATUS status;
-
-        status = cli_trans_recv(subreq, state, NULL, NULL, NULL, NULL,
-                                &state->rdata, &state->rdata_len);
-        TALLOC_FREE(subreq);
-        if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
-                status = NT_STATUS_OK;
-        }
-        if (!NT_STATUS_IS_OK(status)) {
-                state->np_transport->cli = NULL;
-                tevent_req_nterror(req, status);
-                return;
-        }
-
-        if (state->rdata_len > state->max_rdata_len) {
-                state->np_transport->cli = NULL;
-                tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
-                return;
-        }
-
-        if (state->rdata_len == 0) {
-                state->np_transport->cli = NULL;
-                tevent_req_nterror(req, NT_STATUS_PIPE_BROKEN);
-                return;
-        }
-
-        tevent_req_done(req);
-}
-
-static NTSTATUS rpc_np_trans_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
-                                  uint8_t **prdata, uint32_t *prdata_len)
-{
-        struct rpc_np_trans_state *state = tevent_req_data(
-                req, struct rpc_np_trans_state);
-        NTSTATUS status;
-
-        if (tevent_req_is_nterror(req, &status)) {
-                return status;
-        }
-        *prdata = talloc_move(mem_ctx, &state->rdata);
-        *prdata_len = state->rdata_len;
-        return NT_STATUS_OK;
-}
-
 struct rpc_transport_np_init_state {
         struct rpc_cli_transport *transport;
-        struct rpc_transport_np_state *transport_np;
 };
 
@@ -384 +37 @@
                                               const struct ndr_syntax_id *abstract_syntax)
 {
-        struct tevent_req *req, *subreq;
+        struct tevent_req *req;
         struct rpc_transport_np_init_state *state;
-        bool ok;
+        const char *pipe_name;
+        struct tevent_req *subreq;
 
         req = tevent_req_create(mem_ctx, &state,
@@ -394 +48 @@
         }
 
-        ok = cli_state_is_connected(cli);
-        if (!ok) {
-                tevent_req_nterror(req, NT_STATUS_CONNECTION_INVALID);
+        pipe_name = get_pipe_name_from_syntax(state, abstract_syntax);
+        if (tevent_req_nomem(pipe_name, req)) {
                 return tevent_req_post(req, ev);
         }
 
-        state->transport = talloc(state, struct rpc_cli_transport);
-        if (tevent_req_nomem(state->transport, req)) {
-                return tevent_req_post(req, ev);
-        }
-        state->transport_np = talloc(state->transport,
-                                     struct rpc_transport_np_state);
-        if (tevent_req_nomem(state->transport_np, req)) {
-                return tevent_req_post(req, ev);
-        }
-        state->transport->priv = state->transport_np;
-
-        state->transport_np->pipe_name = get_pipe_name_from_syntax(
-                state->transport_np, abstract_syntax);
-        state->transport_np->cli = cli;
-
-        subreq = cli_ntcreate_send(
-                state, ev, cli, state->transport_np->pipe_name, 0,
-                DESIRED_ACCESS_PIPE, 0, FILE_SHARE_READ|FILE_SHARE_WRITE,
-                FILE_OPEN, 0, 0);
+        subreq = tstream_cli_np_open_send(state, ev, cli, pipe_name);
         if (tevent_req_nomem(subreq, req)) {
                 return tevent_req_post(req, ev);
         }
-        tevent_req_set_callback(subreq, rpc_transport_np_init_pipe_open,
-                                req);
+        tevent_req_set_callback(subreq, rpc_transport_np_init_pipe_open, req);
+
         return req;
 }
@@ -434 +69 @@
                 req, struct rpc_transport_np_init_state);
         NTSTATUS status;
+        struct tstream_context *stream;
 
-        status = cli_ntcreate_recv(subreq, &state->transport_np->fnum);
+        status = tstream_cli_np_open_recv(subreq, state, &stream);
         TALLOC_FREE(subreq);
         if (!NT_STATUS_IS_OK(status)) {
@@ -442 +78 @@
         }
 
-        talloc_set_destructor(state->transport_np,
-                              rpc_transport_np_state_destructor);
+        status = rpc_transport_tstream_init(state,
+                                            &stream,
+                                            &state->transport);
+        if (!NT_STATUS_IS_OK(status)) {
+                tevent_req_nterror(req, status);
+                return;
+        }
+
         tevent_req_done(req);
 }
@@ -458 +100 @@
                 return status;
         }
-
-        state->transport->write_send = rpc_np_write_send;
-        state->transport->write_recv = rpc_np_write_recv;
-        state->transport->read_send = rpc_np_read_send;
-        state->transport->read_recv = rpc_np_read_recv;
-        state->transport->trans_send = rpc_np_trans_send;
-        state->transport->trans_recv = rpc_np_trans_recv;
-        state->transport->is_connected = rpc_np_is_connected;
-        state->transport->set_timeout = rpc_np_set_timeout;
 
         *presult = talloc_move(mem_ctx, &state->transport);
@@ -503 +136 @@
         return status;
 }
-
-struct cli_state *rpc_pipe_np_smb_conn(struct rpc_pipe_client *p)
-{
-        struct rpc_transport_np_state *state = talloc_get_type(
-                p->transport->priv, struct rpc_transport_np_state);
-
-        if (state == NULL) {
-                return NULL;
-        }
-        return state->cli;
-}

vendor/current/source3/rpc_client/rpc_transport_sock.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "../lib/tsocket/tsocket.h"
+#include "rpc_client/rpc_transport.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_RPC_CLI
-
-struct rpc_transport_sock_state {
-        int fd;
-        int timeout;
-};
-
-static void rpc_sock_disconnect(struct rpc_transport_sock_state *s)
-{
-        if (s->fd != -1) {
-                close(s->fd);
-                s->fd = -1;
-        }
-}
-
-static int rpc_transport_sock_state_destructor(struct rpc_transport_sock_state *s)
-{
-        rpc_sock_disconnect(s);
-        return 0;
-}
-
-static bool rpc_sock_is_connected(void *priv)
-{
-        struct rpc_transport_sock_state *sock_transp = talloc_get_type_abort(
-                priv, struct rpc_transport_sock_state);
-
-        if (sock_transp->fd == -1) {
-                return false;
-        }
-
-        return true;
-}
-
-static unsigned int rpc_sock_set_timeout(void *priv, unsigned int timeout)
-{
-        struct rpc_transport_sock_state *sock_transp = talloc_get_type_abort(
-                priv, struct rpc_transport_sock_state);
-        int orig_timeout;
-        bool ok;
-
-        ok = rpc_sock_is_connected(sock_transp);
-        if (!ok) {
-                return 0;
-        }
-
-        orig_timeout = sock_transp->timeout;
-
-        sock_transp->timeout = timeout;
-
-        return orig_timeout;
-}
-
-struct rpc_sock_read_state {
-        struct rpc_transport_sock_state *transp;
-        ssize_t received;
-};
-
-static void rpc_sock_read_done(struct tevent_req *subreq);
-
-static struct tevent_req *rpc_sock_read_send(TALLOC_CTX *mem_ctx,
-                                             struct event_context *ev,
-                                             uint8_t *data, size_t size,
-                                             void *priv)
-{
-        struct rpc_transport_sock_state *sock_transp = talloc_get_type_abort(
-                priv, struct rpc_transport_sock_state);
-        struct tevent_req *req, *subreq;
-        struct rpc_sock_read_state *state;
-        struct timeval endtime;
-
-        req = tevent_req_create(mem_ctx, &state, struct rpc_sock_read_state);
-        if (req == NULL) {
-                return NULL;
-        }
-        if (!rpc_sock_is_connected(sock_transp)) {
-                tevent_req_nterror(req, NT_STATUS_CONNECTION_INVALID);
-                return tevent_req_post(req, ev);
-        }
-        state->transp = sock_transp;
-        endtime = timeval_current_ofs(0, sock_transp->timeout * 1000);
-        subreq = async_recv_send(state, ev, sock_transp->fd, data, size, 0);
-        if (subreq == NULL) {
-                goto fail;
-        }
-
-        if (!tevent_req_set_endtime(subreq, ev, endtime)) {
-                goto fail;
-        }
-
-        tevent_req_set_callback(subreq, rpc_sock_read_done, req);
-        return req;
- fail:
-        TALLOC_FREE(req);
-        return NULL;
-}
-
-static void rpc_sock_read_done(struct tevent_req *subreq)
-{
-        struct tevent_req *req = tevent_req_callback_data(
-                subreq, struct tevent_req);
-        struct rpc_sock_read_state *state = tevent_req_data(
-                req, struct rpc_sock_read_state);
-        int err;
-
-        /* We must free subreq in this function as there is
-          a timer event attached to it. */
-
-        state->received = async_recv_recv(subreq, &err);
-
-        if (state->received == -1) {
-                TALLOC_FREE(subreq);
-                rpc_sock_disconnect(state->transp);
-                tevent_req_nterror(req, map_nt_error_from_unix(err));
-                return;
-        }
-        TALLOC_FREE(subreq);
-        tevent_req_done(req);
-}
-
-static NTSTATUS rpc_sock_read_recv(struct tevent_req *req, ssize_t *preceived)
-{
-        struct rpc_sock_read_state *state = tevent_req_data(
-                req, struct rpc_sock_read_state);
-        NTSTATUS status;
-
-        if (tevent_req_is_nterror(req, &status)) {
-                return status;
-        }
-        *preceived = state->received;
-        return NT_STATUS_OK;
-}
-
-struct rpc_sock_write_state {
-        struct rpc_transport_sock_state *transp;
-        ssize_t sent;
-};
-
-static void rpc_sock_write_done(struct tevent_req *subreq);
-
-static struct tevent_req *rpc_sock_write_send(TALLOC_CTX *mem_ctx,
-                                              struct event_context *ev,
-                                              const uint8_t *data, size_t size,
-                                              void *priv)
-{
-        struct rpc_transport_sock_state *sock_transp = talloc_get_type_abort(
-                priv, struct rpc_transport_sock_state);
-        struct tevent_req *req, *subreq;
-        struct rpc_sock_write_state *state;
-        struct timeval endtime;
-
-        req = tevent_req_create(mem_ctx, &state, struct rpc_sock_write_state);
-        if (req == NULL) {
-                return NULL;
-        }
-        if (!rpc_sock_is_connected(sock_transp)) {
-                tevent_req_nterror(req, NT_STATUS_CONNECTION_INVALID);
-                return tevent_req_post(req, ev);
-        }
-        state->transp = sock_transp;
-        endtime = timeval_current_ofs(0, sock_transp->timeout * 1000);
-        subreq = async_send_send(state, ev, sock_transp->fd, data, size, 0);
-        if (subreq == NULL) {
-                goto fail;
-        }
-
-        if (!tevent_req_set_endtime(subreq, ev, endtime)) {
-                goto fail;
-        }
-
-        tevent_req_set_callback(subreq, rpc_sock_write_done, req);
-        return req;
- fail:
-        TALLOC_FREE(req);
-        return NULL;
-}
-
-static void rpc_sock_write_done(struct tevent_req *subreq)
-{
-        struct tevent_req *req = tevent_req_callback_data(
-                subreq, struct tevent_req);
-        struct rpc_sock_write_state *state = tevent_req_data(
-                req, struct rpc_sock_write_state);
-        int err;
-
-        /* We must free subreq in this function as there is
-          a timer event attached to it. */
-
-        state->sent = async_send_recv(subreq, &err);
-
-        if (state->sent == -1) {
-                TALLOC_FREE(subreq);
-                rpc_sock_disconnect(state->transp);
-                tevent_req_nterror(req, map_nt_error_from_unix(err));
-                return;
-        }
-        TALLOC_FREE(subreq);
-        tevent_req_done(req);
-}
-
-static NTSTATUS rpc_sock_write_recv(struct tevent_req *req, ssize_t *psent)
-{
-        struct rpc_sock_write_state *state = tevent_req_data(
-                req, struct rpc_sock_write_state);
-        NTSTATUS status;
-
-        if (tevent_req_is_nterror(req, &status)) {
-                return status;
-        }
-        *psent = state->sent;
-        return NT_STATUS_OK;
-}
 
 NTSTATUS rpc_transport_sock_init(TALLOC_CTX *mem_ctx, int fd,
@@ -237 +29 @@
 {
         struct rpc_cli_transport *result;
-        struct rpc_transport_sock_state *state;
+        struct tstream_context *stream;
+        int ret;
+        NTSTATUS status;
 
-        result = talloc(mem_ctx, struct rpc_cli_transport);
-        if (result == NULL) {
-                return NT_STATUS_NO_MEMORY;
+        set_blocking(fd, false);
+
+        ret = tstream_bsd_existing_socket(mem_ctx, fd, &stream);
+        if (ret != 0) {
+                status = map_nt_error_from_unix(errno);
+                return status;
         }
-        state = talloc(result, struct rpc_transport_sock_state);
-        if (state == NULL) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
+
+        status = rpc_transport_tstream_init(mem_ctx,
+                                            &stream,
+                                            &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(stream);
+                return status;
         }
-        result->priv = state;
-
-        state->fd = fd;
-        state->timeout = 10000; /* 10 seconds. */
-        talloc_set_destructor(state, rpc_transport_sock_state_destructor);
-
-        result->trans_send = NULL;
-        result->trans_recv = NULL;
-        result->write_send = rpc_sock_write_send;
-        result->write_recv = rpc_sock_write_recv;
-        result->read_send = rpc_sock_read_send;
-        result->read_recv = rpc_sock_read_recv;
-        result->is_connected = rpc_sock_is_connected;
-        result->set_timeout = rpc_sock_set_timeout;
 
         *presult = result;