2 Unix SMB/CIFS implementation.
4 dcerpc utility functions
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Jelmer Vernooij 2004
8 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
9 Copyright (C) Rafal Szczesniak 2006
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "lib/events/events.h"
27 #include "libcli/composite/composite.h"
28 #include "librpc/gen_ndr/ndr_epmapper_c.h"
29 #include "librpc/gen_ndr/ndr_dcerpc.h"
30 #include "librpc/gen_ndr/ndr_misc.h"
31 #include "librpc/rpc/dcerpc_proto.h"
32 #include "auth/credentials/credentials.h"
33 #include "param/param.h"
36 find a dcerpc call on an interface by name
38 const struct ndr_interface_call
*dcerpc_iface_find_call(const struct ndr_interface_table
*iface
,
42 for (i
=0;i
<iface
->num_calls
;i
++) {
43 if (strcmp(iface
->calls
[i
].name
, name
) == 0) {
44 return &iface
->calls
[i
];
51 push a ncacn_packet into a blob, potentially with auth info
53 NTSTATUS
ncacn_push_auth(DATA_BLOB
*blob
, TALLOC_CTX
*mem_ctx
,
54 struct smb_iconv_convenience
*iconv_convenience
,
55 struct ncacn_packet
*pkt
,
56 struct dcerpc_auth
*auth_info
)
59 enum ndr_err_code ndr_err
;
61 ndr
= ndr_push_init_ctx(mem_ctx
, iconv_convenience
);
63 return NT_STATUS_NO_MEMORY
;
66 if (!(pkt
->drep
[0] & DCERPC_DREP_LE
)) {
67 ndr
->flags
|= LIBNDR_FLAG_BIGENDIAN
;
70 if (pkt
->pfc_flags
& DCERPC_PFC_FLAG_OBJECT_UUID
) {
71 ndr
->flags
|= LIBNDR_FLAG_OBJECT_PRESENT
;
75 pkt
->auth_length
= auth_info
->credentials
.length
;
80 ndr_err
= ndr_push_ncacn_packet(ndr
, NDR_SCALARS
|NDR_BUFFERS
, pkt
);
81 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
82 return ndr_map_error2ntstatus(ndr_err
);
86 ndr_err
= ndr_push_dcerpc_auth(ndr
, NDR_SCALARS
|NDR_BUFFERS
, auth_info
);
87 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
88 return ndr_map_error2ntstatus(ndr_err
);
92 *blob
= ndr_push_blob(ndr
);
94 /* fill in the frag length */
95 dcerpc_set_frag_length(blob
, blob
->length
);
101 struct epm_map_binding_state
{
102 struct dcerpc_binding
*binding
;
103 const struct ndr_interface_table
*table
;
104 struct dcerpc_pipe
*pipe
;
105 struct policy_handle handle
;
107 struct epm_twr_t twr
;
108 struct epm_twr_t
*twr_r
;
113 static void continue_epm_recv_binding(struct composite_context
*ctx
);
114 static void continue_epm_map(struct rpc_request
*req
);
118 Stage 2 of epm_map_binding: Receive connected rpc pipe and send endpoint
121 static void continue_epm_recv_binding(struct composite_context
*ctx
)
123 struct rpc_request
*map_req
;
125 struct composite_context
*c
= talloc_get_type(ctx
->async
.private_data
,
126 struct composite_context
);
127 struct epm_map_binding_state
*s
= talloc_get_type(c
->private_data
,
128 struct epm_map_binding_state
);
130 /* receive result of rpc pipe connect request */
131 c
->status
= dcerpc_pipe_connect_b_recv(ctx
, c
, &s
->pipe
);
132 if (!composite_is_ok(c
)) return;
134 s
->pipe
->conn
->flags
|= DCERPC_NDR_REF_ALLOC
;
136 /* prepare requested binding parameters */
137 s
->binding
->object
= s
->table
->syntax_id
;
139 c
->status
= dcerpc_binding_build_tower(s
->pipe
, s
->binding
, &s
->twr
.tower
);
140 if (!composite_is_ok(c
)) return;
142 /* with some nice pretty paper around it of course */
143 s
->r
.in
.object
= &s
->guid
;
144 s
->r
.in
.map_tower
= &s
->twr
;
145 s
->r
.in
.entry_handle
= &s
->handle
;
146 s
->r
.in
.max_towers
= 1;
147 s
->r
.out
.entry_handle
= &s
->handle
;
149 /* send request for an endpoint mapping - a rpc request on connected pipe */
150 map_req
= dcerpc_epm_Map_send(s
->pipe
, c
, &s
->r
);
151 if (composite_nomem(map_req
, c
)) return;
153 composite_continue_rpc(c
, map_req
, continue_epm_map
, c
);
158 Stage 3 of epm_map_binding: Receive endpoint mapping and provide binding details
160 static void continue_epm_map(struct rpc_request
*req
)
162 struct composite_context
*c
= talloc_get_type(req
->async
.private_data
,
163 struct composite_context
);
164 struct epm_map_binding_state
*s
= talloc_get_type(c
->private_data
,
165 struct epm_map_binding_state
);
167 /* receive result of a rpc request */
168 c
->status
= dcerpc_ndr_request_recv(req
);
169 if (!composite_is_ok(c
)) return;
171 /* check the details */
172 if (s
->r
.out
.result
!= 0 || *s
->r
.out
.num_towers
!= 1) {
173 composite_error(c
, NT_STATUS_PORT_UNREACHABLE
);
177 s
->twr_r
= s
->r
.out
.towers
[0].twr
;
178 if (s
->twr_r
== NULL
) {
179 composite_error(c
, NT_STATUS_PORT_UNREACHABLE
);
183 if (s
->twr_r
->tower
.num_floors
!= s
->twr
.tower
.num_floors
||
184 s
->twr_r
->tower
.floors
[3].lhs
.protocol
!= s
->twr
.tower
.floors
[3].lhs
.protocol
) {
185 composite_error(c
, NT_STATUS_PORT_UNREACHABLE
);
189 /* get received endpoint */
190 s
->binding
->endpoint
= talloc_reference(s
->binding
,
191 dcerpc_floor_get_rhs_data(c
, &s
->twr_r
->tower
.floors
[3]));
192 if (composite_nomem(s
->binding
->endpoint
, c
)) return;
199 Request for endpoint mapping of dcerpc binding - try to request for endpoint
200 unless there is default one.
202 struct composite_context
*dcerpc_epm_map_binding_send(TALLOC_CTX
*mem_ctx
,
203 struct dcerpc_binding
*binding
,
204 const struct ndr_interface_table
*table
,
205 struct tevent_context
*ev
,
206 struct loadparm_context
*lp_ctx
)
208 struct composite_context
*c
;
209 struct epm_map_binding_state
*s
;
210 struct composite_context
*pipe_connect_req
;
211 struct cli_credentials
*anon_creds
;
214 struct dcerpc_binding
*epmapper_binding
;
221 /* composite context allocation and setup */
222 c
= composite_create(mem_ctx
, ev
);
227 s
= talloc_zero(c
, struct epm_map_binding_state
);
228 if (composite_nomem(s
, c
)) return c
;
231 s
->binding
= binding
;
234 /* anonymous credentials for rpc connection used to get endpoint mapping */
235 anon_creds
= cli_credentials_init(mem_ctx
);
236 cli_credentials_set_anonymous(anon_creds
);
239 First, check if there is a default endpoint specified in the IDL
242 struct dcerpc_binding
*default_binding
;
244 /* Find one of the default pipes for this interface */
245 for (i
= 0; i
< table
->endpoints
->count
; i
++) {
246 status
= dcerpc_parse_binding(mem_ctx
, table
->endpoints
->names
[i
], &default_binding
);
248 if (NT_STATUS_IS_OK(status
)) {
249 if (binding
->transport
== NCA_UNKNOWN
)
250 binding
->transport
= default_binding
->transport
;
251 if (default_binding
->transport
== binding
->transport
&&
252 default_binding
->endpoint
) {
253 binding
->endpoint
= talloc_reference(binding
, default_binding
->endpoint
);
254 talloc_free(default_binding
);
260 talloc_free(default_binding
);
266 epmapper_binding
= talloc_zero(c
, struct dcerpc_binding
);
267 if (composite_nomem(epmapper_binding
, c
)) return c
;
269 /* basic endpoint mapping data */
270 epmapper_binding
->transport
= binding
->transport
;
271 epmapper_binding
->host
= talloc_reference(epmapper_binding
, binding
->host
);
272 epmapper_binding
->target_hostname
= epmapper_binding
->host
;
273 epmapper_binding
->options
= NULL
;
274 epmapper_binding
->flags
= 0;
275 epmapper_binding
->assoc_group_id
= 0;
276 epmapper_binding
->endpoint
= NULL
;
278 /* initiate rpc pipe connection */
279 pipe_connect_req
= dcerpc_pipe_connect_b_send(c
, epmapper_binding
,
281 anon_creds
, c
->event_ctx
,
283 if (composite_nomem(pipe_connect_req
, c
)) return c
;
285 composite_continue(c
, pipe_connect_req
, continue_epm_recv_binding
, c
);
291 Receive result of endpoint mapping request
293 NTSTATUS
dcerpc_epm_map_binding_recv(struct composite_context
*c
)
295 NTSTATUS status
= composite_wait(c
);
303 Get endpoint mapping for rpc connection
305 _PUBLIC_ NTSTATUS
dcerpc_epm_map_binding(TALLOC_CTX
*mem_ctx
, struct dcerpc_binding
*binding
,
306 const struct ndr_interface_table
*table
, struct tevent_context
*ev
,
307 struct loadparm_context
*lp_ctx
)
309 struct composite_context
*c
;
311 c
= dcerpc_epm_map_binding_send(mem_ctx
, binding
, table
, ev
, lp_ctx
);
312 return dcerpc_epm_map_binding_recv(c
);
316 struct pipe_auth_state
{
317 struct dcerpc_pipe
*pipe
;
318 struct dcerpc_binding
*binding
;
319 const struct ndr_interface_table
*table
;
320 struct loadparm_context
*lp_ctx
;
321 struct cli_credentials
*credentials
;
325 static void continue_auth_schannel(struct composite_context
*ctx
);
326 static void continue_auth(struct composite_context
*ctx
);
327 static void continue_auth_none(struct composite_context
*ctx
);
328 static void continue_ntlmssp_connection(struct composite_context
*ctx
);
329 static void continue_spnego_after_wrong_pass(struct composite_context
*ctx
);
333 Stage 2 of pipe_auth: Receive result of schannel bind request
335 static void continue_auth_schannel(struct composite_context
*ctx
)
337 struct composite_context
*c
= talloc_get_type(ctx
->async
.private_data
,
338 struct composite_context
);
340 c
->status
= dcerpc_bind_auth_schannel_recv(ctx
);
341 if (!composite_is_ok(c
)) return;
348 Stage 2 of pipe_auth: Receive result of authenticated bind request
350 static void continue_auth(struct composite_context
*ctx
)
352 struct composite_context
*c
= talloc_get_type(ctx
->async
.private_data
,
353 struct composite_context
);
355 c
->status
= dcerpc_bind_auth_recv(ctx
);
356 if (!composite_is_ok(c
)) return;
361 Stage 2 of pipe_auth: Receive result of authenticated bind request, but handle fallbacks:
364 static void continue_auth_auto(struct composite_context
*ctx
)
366 struct composite_context
*c
= talloc_get_type(ctx
->async
.private_data
,
367 struct composite_context
);
368 struct pipe_auth_state
*s
= talloc_get_type(c
->private_data
, struct pipe_auth_state
);
369 struct composite_context
*sec_conn_req
;
371 c
->status
= dcerpc_bind_auth_recv(ctx
);
372 if (NT_STATUS_EQUAL(c
->status
, NT_STATUS_INVALID_PARAMETER
)) {
374 * Retry with NTLMSSP auth as fallback
375 * send a request for secondary rpc connection
377 sec_conn_req
= dcerpc_secondary_connection_send(s
->pipe
,
379 composite_continue(c
, sec_conn_req
, continue_ntlmssp_connection
, c
);
381 } else if (NT_STATUS_EQUAL(c
->status
, NT_STATUS_LOGON_FAILURE
)) {
382 if (cli_credentials_wrong_password(s
->credentials
)) {
384 * Retry SPNEGO with a better password
385 * send a request for secondary rpc connection
387 sec_conn_req
= dcerpc_secondary_connection_send(s
->pipe
,
389 composite_continue(c
, sec_conn_req
, continue_spnego_after_wrong_pass
, c
);
394 if (!composite_is_ok(c
)) return;
400 Stage 3 of pipe_auth (fallback to NTLMSSP case): Receive secondary
401 rpc connection (the first one can't be used any more, due to the
402 bind nak) and perform authenticated bind request
404 static void continue_ntlmssp_connection(struct composite_context
*ctx
)
406 struct composite_context
*c
;
407 struct pipe_auth_state
*s
;
408 struct composite_context
*auth_req
;
409 struct dcerpc_pipe
*p2
;
411 c
= talloc_get_type(ctx
->async
.private_data
, struct composite_context
);
412 s
= talloc_get_type(c
->private_data
, struct pipe_auth_state
);
414 /* receive secondary rpc connection */
415 c
->status
= dcerpc_secondary_connection_recv(ctx
, &p2
);
416 if (!composite_is_ok(c
)) return;
419 talloc_steal(p2
, s
->pipe
);
422 /* initiate a authenticated bind */
423 auth_req
= dcerpc_bind_auth_send(c
, s
->pipe
, s
->table
,
425 lp_gensec_settings(c
, s
->lp_ctx
),
426 DCERPC_AUTH_TYPE_NTLMSSP
,
427 dcerpc_auth_level(s
->pipe
->conn
),
428 s
->table
->authservices
->names
[0]);
429 composite_continue(c
, auth_req
, continue_auth
, c
);
433 Stage 3 of pipe_auth (retry on wrong password): Receive secondary
434 rpc connection (the first one can't be used any more, due to the
435 bind nak) and perform authenticated bind request
437 static void continue_spnego_after_wrong_pass(struct composite_context
*ctx
)
439 struct composite_context
*c
;
440 struct pipe_auth_state
*s
;
441 struct composite_context
*auth_req
;
442 struct dcerpc_pipe
*p2
;
444 c
= talloc_get_type(ctx
->async
.private_data
, struct composite_context
);
445 s
= talloc_get_type(c
->private_data
, struct pipe_auth_state
);
447 /* receive secondary rpc connection */
448 c
->status
= dcerpc_secondary_connection_recv(ctx
, &p2
);
449 if (!composite_is_ok(c
)) return;
452 talloc_steal(p2
, s
->pipe
);
455 /* initiate a authenticated bind */
456 auth_req
= dcerpc_bind_auth_send(c
, s
->pipe
, s
->table
,
458 lp_gensec_settings(c
, s
->lp_ctx
),
459 DCERPC_AUTH_TYPE_SPNEGO
,
460 dcerpc_auth_level(s
->pipe
->conn
),
461 s
->table
->authservices
->names
[0]);
462 composite_continue(c
, auth_req
, continue_auth
, c
);
467 Stage 2 of pipe_auth: Receive result of non-authenticated bind request
469 static void continue_auth_none(struct composite_context
*ctx
)
471 struct composite_context
*c
= talloc_get_type(ctx
->async
.private_data
,
472 struct composite_context
);
474 c
->status
= dcerpc_bind_auth_none_recv(ctx
);
475 if (!composite_is_ok(c
)) return;
482 Request to perform an authenticated bind if required. Authentication
483 is determined using credentials passed and binding flags.
485 struct composite_context
*dcerpc_pipe_auth_send(struct dcerpc_pipe
*p
,
486 struct dcerpc_binding
*binding
,
487 const struct ndr_interface_table
*table
,
488 struct cli_credentials
*credentials
,
489 struct loadparm_context
*lp_ctx
)
491 struct composite_context
*c
;
492 struct pipe_auth_state
*s
;
493 struct composite_context
*auth_schannel_req
;
494 struct composite_context
*auth_req
;
495 struct composite_context
*auth_none_req
;
496 struct dcerpc_connection
*conn
;
499 /* composite context allocation and setup */
500 c
= composite_create(p
, p
->conn
->event_ctx
);
501 if (c
== NULL
) return NULL
;
503 s
= talloc_zero(c
, struct pipe_auth_state
);
504 if (composite_nomem(s
, c
)) return c
;
507 /* store parameters in state structure */
508 s
->binding
= binding
;
510 s
->credentials
= credentials
;
514 conn
= s
->pipe
->conn
;
515 conn
->flags
= binding
->flags
;
518 conn
->flags
|= DCERPC_DEBUG_PRINT_BOTH
;
521 /* remember the binding string for possible secondary connections */
522 conn
->binding_string
= dcerpc_binding_string(p
, binding
);
524 if (cli_credentials_is_anonymous(s
->credentials
)) {
525 auth_none_req
= dcerpc_bind_auth_none_send(c
, s
->pipe
, s
->table
);
526 composite_continue(c
, auth_none_req
, continue_auth_none
, c
);
530 if ((binding
->flags
& DCERPC_SCHANNEL
) &&
531 !cli_credentials_get_netlogon_creds(s
->credentials
)) {
532 /* If we don't already have netlogon credentials for
533 * the schannel bind, then we have to get these
535 auth_schannel_req
= dcerpc_bind_auth_schannel_send(c
, s
->pipe
, s
->table
,
536 s
->credentials
, s
->lp_ctx
,
537 dcerpc_auth_level(conn
));
538 composite_continue(c
, auth_schannel_req
, continue_auth_schannel
, c
);
543 * we rely on the already authenticated CIFS connection
544 * if not doing sign or seal
546 if (conn
->transport
.transport
== NCACN_NP
&&
547 !(s
->binding
->flags
& (DCERPC_SIGN
|DCERPC_SEAL
))) {
548 auth_none_req
= dcerpc_bind_auth_none_send(c
, s
->pipe
, s
->table
);
549 composite_continue(c
, auth_none_req
, continue_auth_none
, c
);
554 /* Perform an authenticated DCE-RPC bind
556 if (!(conn
->flags
& (DCERPC_SIGN
|DCERPC_SEAL
))) {
558 we are doing an authenticated connection,
559 but not using sign or seal. We must force
560 the CONNECT dcerpc auth type as a NONE auth
561 type doesn't allow authentication
562 information to be passed.
564 conn
->flags
|= DCERPC_CONNECT
;
567 if (s
->binding
->flags
& DCERPC_AUTH_SPNEGO
) {
568 auth_type
= DCERPC_AUTH_TYPE_SPNEGO
;
570 } else if (s
->binding
->flags
& DCERPC_AUTH_KRB5
) {
571 auth_type
= DCERPC_AUTH_TYPE_KRB5
;
573 } else if (s
->binding
->flags
& DCERPC_SCHANNEL
) {
574 auth_type
= DCERPC_AUTH_TYPE_SCHANNEL
;
576 } else if (s
->binding
->flags
& DCERPC_AUTH_NTLM
) {
577 auth_type
= DCERPC_AUTH_TYPE_NTLMSSP
;
580 /* try SPNEGO with fallback to NTLMSSP */
581 auth_req
= dcerpc_bind_auth_send(c
, s
->pipe
, s
->table
,
583 lp_gensec_settings(c
, s
->lp_ctx
),
584 DCERPC_AUTH_TYPE_SPNEGO
,
585 dcerpc_auth_level(conn
),
586 s
->table
->authservices
->names
[0]);
587 composite_continue(c
, auth_req
, continue_auth_auto
, c
);
591 auth_req
= dcerpc_bind_auth_send(c
, s
->pipe
, s
->table
,
593 lp_gensec_settings(c
, s
->lp_ctx
),
595 dcerpc_auth_level(conn
),
596 s
->table
->authservices
->names
[0]);
597 composite_continue(c
, auth_req
, continue_auth
, c
);
603 Receive result of authenticated bind request on dcerpc pipe
605 This returns *p, which may be different to the one originally
606 supllied, as it rebinds to a new pipe due to authentication fallback
609 NTSTATUS
dcerpc_pipe_auth_recv(struct composite_context
*c
, TALLOC_CTX
*mem_ctx
,
610 struct dcerpc_pipe
**p
)
614 struct pipe_auth_state
*s
= talloc_get_type(c
->private_data
,
615 struct pipe_auth_state
);
616 status
= composite_wait(c
);
617 if (!NT_STATUS_IS_OK(status
)) {
618 char *uuid_str
= GUID_string(s
->pipe
, &s
->table
->syntax_id
.uuid
);
619 DEBUG(0, ("Failed to bind to uuid %s - %s\n", uuid_str
, nt_errstr(status
)));
620 talloc_free(uuid_str
);
622 talloc_steal(mem_ctx
, s
->pipe
);
632 Perform an authenticated bind if needed - sync version
634 This may change *p, as it rebinds to a new pipe due to authentication fallback
636 _PUBLIC_ NTSTATUS
dcerpc_pipe_auth(TALLOC_CTX
*mem_ctx
,
637 struct dcerpc_pipe
**p
,
638 struct dcerpc_binding
*binding
,
639 const struct ndr_interface_table
*table
,
640 struct cli_credentials
*credentials
,
641 struct loadparm_context
*lp_ctx
)
643 struct composite_context
*c
;
645 c
= dcerpc_pipe_auth_send(*p
, binding
, table
, credentials
, lp_ctx
);
646 return dcerpc_pipe_auth_recv(c
, mem_ctx
, p
);
650 NTSTATUS
dcerpc_generic_session_key(struct dcerpc_connection
*c
,
651 DATA_BLOB
*session_key
)
653 /* this took quite a few CPU cycles to find ... */
654 session_key
->data
= discard_const_p(unsigned char, "SystemLibraryDTC");
655 session_key
->length
= 16;
660 fetch the user session key - may be default (above) or the SMB session key
662 The key is always truncated to 16 bytes
664 _PUBLIC_ NTSTATUS
dcerpc_fetch_session_key(struct dcerpc_pipe
*p
,
665 DATA_BLOB
*session_key
)
668 status
= p
->conn
->security_state
.session_key(p
->conn
, session_key
);
669 if (!NT_STATUS_IS_OK(status
)) {
673 session_key
->length
= MIN(session_key
->length
, 16);
680 log a rpc packet in a format suitable for ndrdump. This is especially useful
681 for sealed packets, where ethereal cannot easily see the contents
683 this triggers on a debug level of >= 10
685 _PUBLIC_
void dcerpc_log_packet(const char *lockdir
,
686 const struct ndr_interface_table
*ndr
,
687 uint32_t opnum
, uint32_t flags
,
690 const int num_examples
= 20;
693 if (lockdir
== NULL
) return;
695 for (i
=0;i
<num_examples
;i
++) {
697 asprintf(&name
, "%s/rpclog/%s-%u.%d.%s",
698 lockdir
, ndr
->name
, opnum
, i
,
699 (flags
&NDR_IN
)?"in":"out");
703 if (!file_exist(name
)) {
704 if (file_save(name
, pkt
->data
, pkt
->length
)) {
705 DEBUG(10,("Logged rpc packet to %s\n", name
));
717 create a secondary context from a primary connection
719 this uses dcerpc_alter_context() to create a new dcerpc context_id
721 _PUBLIC_ NTSTATUS
dcerpc_secondary_context(struct dcerpc_pipe
*p
,
722 struct dcerpc_pipe
**pp2
,
723 const struct ndr_interface_table
*table
)
726 struct dcerpc_pipe
*p2
;
728 p2
= talloc_zero(p
, struct dcerpc_pipe
);
730 return NT_STATUS_NO_MEMORY
;
732 p2
->conn
= talloc_reference(p2
, p
->conn
);
733 p2
->request_timeout
= p
->request_timeout
;
735 p2
->context_id
= ++p
->conn
->next_context_id
;
737 p2
->syntax
= table
->syntax_id
;
739 p2
->transfer_syntax
= p
->transfer_syntax
;
741 p2
->binding
= talloc_reference(p2
, p
->binding
);
743 status
= dcerpc_alter_context(p2
, p2
, &p2
->syntax
, &p2
->transfer_syntax
);
744 if (!NT_STATUS_IS_OK(status
)) {