dlls/rpcrt4/rpc_server.c

   1 /*
   2  * RPC server API
   3  *
   4  * Copyright 2001 Ove Kåven, TransGaming Technologies
   5  * Copyright 2004 Filip Navara
   6  * Copyright 2006-2008 Robert Shearman (for CodeWeavers)
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24 #include "wine/port.h"
  25
  26 #include <stdarg.h>
  27 #include <stdio.h>
  28 #include <string.h>
  29 #include <assert.h>
  30
  31 #include "windef.h"
  32 #include "winbase.h"
  33 #include "winerror.h"
  34
  35 #include "rpc.h"
  36 #include "rpcndr.h"
  37 #include "excpt.h"
  38
  39 #include "wine/debug.h"
  40 #include "wine/exception.h"
  41
  42 #include "rpc_server.h"
  43 #include "rpc_assoc.h"
  44 #include "rpc_message.h"
  45 #include "rpc_defs.h"
  46 #include "ncastatus.h"
  47 #include "secext.h"
  48
  49 WINE_DEFAULT_DEBUG_CHANNEL(rpc);
  50
  51 typedef struct _RpcPacket
  52 {
  53   struct _RpcConnection* conn;
  54   RpcPktHdr* hdr;
  55   RPC_MESSAGE* msg;
  56   unsigned char *auth_data;
  57   ULONG auth_length;
  58 } RpcPacket;
  59
  60 typedef struct _RpcObjTypeMap
  61 {
  62   /* FIXME: a hash table would be better. */
  63   struct _RpcObjTypeMap *next;
  64   UUID Object;
  65   UUID Type;
  66 } RpcObjTypeMap;
  67
  68 static RpcObjTypeMap *RpcObjTypeMaps;
  69
  70 /* list of type RpcServerProtseq */
  71 static struct list protseqs = LIST_INIT(protseqs);
  72 static struct list server_interfaces = LIST_INIT(server_interfaces);
  73 static struct list server_registered_auth_info = LIST_INIT(server_registered_auth_info);
  74
  75 static CRITICAL_SECTION server_cs;
  76 static CRITICAL_SECTION_DEBUG server_cs_debug =
  77 {
  78     0, 0, &server_cs,
  79     { &server_cs_debug.ProcessLocksList, &server_cs_debug.ProcessLocksList },
  80       0, 0, { (DWORD_PTR)(__FILE__ ": server_cs") }
  81 };
  82 static CRITICAL_SECTION server_cs = { &server_cs_debug, -1, 0, 0, 0, 0 };
  83
  84 static CRITICAL_SECTION listen_cs;
  85 static CRITICAL_SECTION_DEBUG listen_cs_debug =
  86 {
  87     0, 0, &listen_cs,
  88     { &listen_cs_debug.ProcessLocksList, &listen_cs_debug.ProcessLocksList },
  89       0, 0, { (DWORD_PTR)(__FILE__ ": listen_cs") }
  90 };
  91 static CRITICAL_SECTION listen_cs = { &listen_cs_debug, -1, 0, 0, 0, 0 };
  92
  93 static CRITICAL_SECTION server_auth_info_cs;
  94 static CRITICAL_SECTION_DEBUG server_auth_info_cs_debug =
  95 {
  96     0, 0, &server_auth_info_cs,
  97     { &server_auth_info_cs_debug.ProcessLocksList, &server_auth_info_cs_debug.ProcessLocksList },
  98       0, 0, { (DWORD_PTR)(__FILE__ ": server_auth_info_cs") }
  99 };
 100 static CRITICAL_SECTION server_auth_info_cs = { &server_auth_info_cs_debug, -1, 0, 0, 0, 0 };
 101
 102 /* whether the server is currently listening */
 103 static BOOL std_listen;
 104 /* number of manual listeners (calls to RpcServerListen) */
 105 static LONG manual_listen_count;
 106 /* total listeners including auto listeners */
 107 static LONG listen_count;
 108 /* event set once all listening is finished */
 109 static HANDLE listen_done_event;
 110
 111 static UUID uuid_nil;
 112
 113 static inline RpcObjTypeMap *LookupObjTypeMap(UUID *ObjUuid)
 114 {
 115   RpcObjTypeMap *rslt = RpcObjTypeMaps;
 116   RPC_STATUS dummy;
 117
 118   while (rslt) {
 119     if (! UuidCompare(ObjUuid, &rslt->Object, &dummy)) break;
 120     rslt = rslt->next;
 121   }
 122
 123   return rslt;
 124 }
 125
 126 static inline UUID *LookupObjType(UUID *ObjUuid)
 127 {
 128   RpcObjTypeMap *map = LookupObjTypeMap(ObjUuid);
 129   if (map)
 130     return &map->Type;
 131   else
 132     return &uuid_nil;
 133 }
 134
 135 static RpcServerInterface* RPCRT4_find_interface(UUID* object,
 136                                                  const RPC_SYNTAX_IDENTIFIER *if_id,
 137                                                  const RPC_SYNTAX_IDENTIFIER *transfer_syntax,
 138                                                  BOOL check_object)
 139 {
 140   UUID* MgrType = NULL;
 141   RpcServerInterface* cif;
 142   RPC_STATUS status;
 143
 144   if (check_object)
 145     MgrType = LookupObjType(object);
 146   EnterCriticalSection(&server_cs);
 147   LIST_FOR_EACH_ENTRY(cif, &server_interfaces, RpcServerInterface, entry) {
 148     if (!memcmp(if_id, &cif->If->InterfaceId, sizeof(RPC_SYNTAX_IDENTIFIER)) &&
 149         (!transfer_syntax || !memcmp(transfer_syntax, &cif->If->TransferSyntax, sizeof(RPC_SYNTAX_IDENTIFIER))) &&
 150         (check_object == FALSE || UuidEqual(MgrType, &cif->MgrTypeUuid, &status)) &&
 151         std_listen) {
 152       InterlockedIncrement(&cif->CurrentCalls);
 153       break;
 154     }
 155   }
 156   LeaveCriticalSection(&server_cs);
 157   if (&cif->entry == &server_interfaces) cif = NULL;
 158   TRACE("returning %p for object %s, if_id { %d.%d %s }\n", cif,
 159     debugstr_guid(object), if_id->SyntaxVersion.MajorVersion,
 160     if_id->SyntaxVersion.MinorVersion, debugstr_guid(&if_id->SyntaxGUID));
 161   return cif;
 162 }
 163
 164 static void RPCRT4_release_server_interface(RpcServerInterface *sif)
 165 {
 166   if (!InterlockedDecrement(&sif->CurrentCalls) &&
 167       sif->Delete) {
 168     /* sif must have been removed from server_interfaces before
 169      * CallsCompletedEvent is set */
 170     if (sif->CallsCompletedEvent)
 171       SetEvent(sif->CallsCompletedEvent);
 172     HeapFree(GetProcessHeap(), 0, sif);
 173   }
 174 }
 175
 176 static RpcPktHdr *handle_bind_error(RpcConnection *conn, RPC_STATUS error)
 177 {
 178     unsigned int reject_reason;
 179     switch (error)
 180     {
 181     case RPC_S_SERVER_TOO_BUSY:
 182         reject_reason = REJECT_TEMPORARY_CONGESTION;
 183         break;
 184     case ERROR_OUTOFMEMORY:
 185     case RPC_S_OUT_OF_RESOURCES:
 186         reject_reason = REJECT_LOCAL_LIMIT_EXCEEDED;
 187         break;
 188     case RPC_S_PROTOCOL_ERROR:
 189         reject_reason = REJECT_PROTOCOL_VERSION_NOT_SUPPORTED;
 190         break;
 191     case RPC_S_UNKNOWN_AUTHN_SERVICE:
 192         reject_reason = REJECT_UNKNOWN_AUTHN_SERVICE;
 193         break;
 194     case ERROR_ACCESS_DENIED:
 195         reject_reason = REJECT_INVALID_CHECKSUM;
 196         break;
 197     default:
 198         FIXME("unexpected status value %d\n", error);
 199         /* fall through */
 200     case RPC_S_INVALID_BOUND:
 201         reject_reason = REJECT_REASON_NOT_SPECIFIED;
 202         break;
 203     }
 204     return RPCRT4_BuildBindNackHeader(NDR_LOCAL_DATA_REPRESENTATION,
 205                                       RPC_VER_MAJOR, RPC_VER_MINOR,
 206                                       reject_reason);
 207 }
 208
 209 static RPC_STATUS process_bind_packet_no_send(
 210     RpcConnection *conn, RpcPktBindHdr *hdr, RPC_MESSAGE *msg,
 211     unsigned char *auth_data, ULONG auth_length, RpcPktHdr **ack_response,
 212     unsigned char **auth_data_out, ULONG *auth_length_out)
 213 {
 214   RPC_STATUS status;
 215   RpcContextElement *ctxt_elem;
 216   unsigned int i;
 217   RpcResult *results;
 218
 219   /* validate data */
 220   for (i = 0, ctxt_elem = msg->Buffer;
 221        i < hdr->num_elements;
 222        i++, ctxt_elem = (RpcContextElement *)&ctxt_elem->transfer_syntaxes[ctxt_elem->num_syntaxes])
 223   {
 224       if (((char *)ctxt_elem - (char *)msg->Buffer) > msg->BufferLength ||
 225           ((char *)&ctxt_elem->transfer_syntaxes[ctxt_elem->num_syntaxes] - (char *)msg->Buffer) > msg->BufferLength)
 226       {
 227           ERR("inconsistent data in packet - packet length %d, num elements %d\n",
 228               msg->BufferLength, hdr->num_elements);
 229           return RPC_S_INVALID_BOUND;
 230       }
 231   }
 232
 233   if (hdr->max_tsize < RPC_MIN_PACKET_SIZE ||
 234       !UuidIsNil(&conn->ActiveInterface.SyntaxGUID, &status) ||
 235       conn->server_binding)
 236   {
 237     TRACE("packet size less than min size, or active interface syntax guid non-null\n");
 238
 239     return RPC_S_INVALID_BOUND;
 240   }
 241
 242   results = HeapAlloc(GetProcessHeap(), 0,
 243                       hdr->num_elements * sizeof(*results));
 244   if (!results)
 245     return RPC_S_OUT_OF_RESOURCES;
 246
 247   for (i = 0, ctxt_elem = (RpcContextElement *)msg->Buffer;
 248        i < hdr->num_elements;
 249        i++, ctxt_elem = (RpcContextElement *)&ctxt_elem->transfer_syntaxes[ctxt_elem->num_syntaxes])
 250   {
 251       RpcServerInterface* sif = NULL;
 252       unsigned int j;
 253
 254       for (j = 0; !sif && j < ctxt_elem->num_syntaxes; j++)
 255       {
 256           sif = RPCRT4_find_interface(NULL, &ctxt_elem->abstract_syntax,
 257                                       &ctxt_elem->transfer_syntaxes[j], FALSE);
 258           if (sif)
 259               break;
 260       }
 261       if (sif)
 262       {
 263           RPCRT4_release_server_interface(sif);
 264           TRACE("accepting bind request on connection %p for %s\n", conn,
 265                 debugstr_guid(&ctxt_elem->abstract_syntax.SyntaxGUID));
 266           results[i].result = RESULT_ACCEPT;
 267           results[i].reason = REASON_NONE;
 268           results[i].transfer_syntax = ctxt_elem->transfer_syntaxes[j];
 269
 270           /* save the interface for later use */
 271           /* FIXME: save linked list */
 272           conn->ActiveInterface = ctxt_elem->abstract_syntax;
 273       }
 274       else if ((sif = RPCRT4_find_interface(NULL, &ctxt_elem->abstract_syntax,
 275                                             NULL, FALSE)) != NULL)
 276       {
 277           RPCRT4_release_server_interface(sif);
 278           TRACE("not accepting bind request on connection %p for %s - no transfer syntaxes supported\n",
 279                 conn, debugstr_guid(&ctxt_elem->abstract_syntax.SyntaxGUID));
 280           results[i].result = RESULT_PROVIDER_REJECTION;
 281           results[i].reason = REASON_TRANSFER_SYNTAXES_NOT_SUPPORTED;
 282           memset(&results[i].transfer_syntax, 0, sizeof(results[i].transfer_syntax));
 283       }
 284       else
 285       {
 286           TRACE("not accepting bind request on connection %p for %s - abstract syntax not supported\n",
 287                 conn, debugstr_guid(&ctxt_elem->abstract_syntax.SyntaxGUID));
 288           results[i].result = RESULT_PROVIDER_REJECTION;
 289           results[i].reason = REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED;
 290           memset(&results[i].transfer_syntax, 0, sizeof(results[i].transfer_syntax));
 291       }
 292   }
 293
 294   /* create temporary binding */
 295   status = RPCRT4_MakeBinding(&conn->server_binding, conn);
 296   if (status != RPC_S_OK)
 297   {
 298       HeapFree(GetProcessHeap(), 0, results);
 299       return status;
 300   }
 301
 302   status = RpcServerAssoc_GetAssociation(rpcrt4_conn_get_name(conn),
 303                                          conn->NetworkAddr, conn->Endpoint,
 304                                          conn->NetworkOptions,
 305                                          hdr->assoc_gid,
 306                                          &conn->server_binding->Assoc);
 307   if (status != RPC_S_OK)
 308   {
 309       HeapFree(GetProcessHeap(), 0, results);
 310       return status;
 311   }
 312
 313   if (auth_length)
 314   {
 315       status = RPCRT4_ServerConnectionAuth(conn, TRUE,
 316                                            (RpcAuthVerifier *)auth_data,
 317                                            auth_length, auth_data_out,
 318                                            auth_length_out);
 319       if (status != RPC_S_OK)
 320       {
 321           HeapFree(GetProcessHeap(), 0, results);
 322           return status;
 323       }
 324   }
 325
 326   *ack_response = RPCRT4_BuildBindAckHeader(NDR_LOCAL_DATA_REPRESENTATION,
 327                                             RPC_MAX_PACKET_SIZE,
 328                                             RPC_MAX_PACKET_SIZE,
 329                                             conn->server_binding->Assoc->assoc_group_id,
 330                                             conn->Endpoint, hdr->num_elements,
 331                                             results);
 332   HeapFree(GetProcessHeap(), 0, results);
 333
 334   if (*ack_response)
 335       conn->MaxTransmissionSize = hdr->max_tsize;
 336   else
 337       status = RPC_S_OUT_OF_RESOURCES;
 338
 339   return status;
 340 }
 341
 342 static RPC_STATUS process_bind_packet(RpcConnection *conn, RpcPktBindHdr *hdr,
 343                                       RPC_MESSAGE *msg,
 344                                       unsigned char *auth_data,
 345                                       ULONG auth_length)
 346 {
 347     RPC_STATUS status;
 348     RpcPktHdr *response = NULL;
 349     unsigned char *auth_data_out = NULL;
 350     ULONG auth_length_out = 0;
 351
 352     status = process_bind_packet_no_send(conn, hdr, msg, auth_data, auth_length,
 353                                          &response, &auth_data_out,
 354                                          &auth_length_out);
 355     if (status != RPC_S_OK)
 356         response = handle_bind_error(conn, status);
 357     if (response)
 358         status = RPCRT4_SendWithAuth(conn, response, NULL, 0, auth_data_out, auth_length_out);
 359     else
 360         status = ERROR_OUTOFMEMORY;
 361     RPCRT4_FreeHeader(response);
 362
 363     return status;
 364 }
 365
 366
 367 static RPC_STATUS process_request_packet(RpcConnection *conn, RpcPktRequestHdr *hdr, RPC_MESSAGE *msg)
 368 {
 369   RPC_STATUS status;
 370   RpcPktHdr *response = NULL;
 371   RpcServerInterface* sif;
 372   RPC_DISPATCH_FUNCTION func;
 373   BOOL exception;
 374   UUID *object_uuid;
 375   NDR_SCONTEXT context_handle;
 376   void *buf = msg->Buffer;
 377
 378   /* fail if the connection isn't bound with an interface */
 379   if (UuidIsNil(&conn->ActiveInterface.SyntaxGUID, &status)) {
 380     /* FIXME: should send BindNack instead */
 381     response = RPCRT4_BuildFaultHeader(NDR_LOCAL_DATA_REPRESENTATION,
 382                                        status);
 383
 384     RPCRT4_Send(conn, response, NULL, 0);
 385     RPCRT4_FreeHeader(response);
 386     return RPC_S_OK;
 387   }
 388
 389   if (hdr->common.flags & RPC_FLG_OBJECT_UUID) {
 390     object_uuid = (UUID*)(hdr + 1);
 391   } else {
 392     object_uuid = NULL;
 393   }
 394
 395   sif = RPCRT4_find_interface(object_uuid, &conn->ActiveInterface, NULL, TRUE);
 396   if (!sif) {
 397     WARN("interface %s no longer registered, returning fault packet\n", debugstr_guid(&conn->ActiveInterface.SyntaxGUID));
 398     response = RPCRT4_BuildFaultHeader(NDR_LOCAL_DATA_REPRESENTATION,
 399                                        NCA_S_UNK_IF);
 400
 401     RPCRT4_Send(conn, response, NULL, 0);
 402     RPCRT4_FreeHeader(response);
 403     return RPC_S_OK;
 404   }
 405   msg->RpcInterfaceInformation = sif->If;
 406   /* copy the endpoint vector from sif to msg so that midl-generated code will use it */
 407   msg->ManagerEpv = sif->MgrEpv;
 408   if (object_uuid != NULL) {
 409     RPCRT4_SetBindingObject(msg->Handle, object_uuid);
 410   }
 411
 412   /* find dispatch function */
 413   msg->ProcNum = hdr->opnum;
 414   if (sif->Flags & RPC_IF_OLE) {
 415     /* native ole32 always gives us a dispatch table with a single entry
 416     * (I assume that's a wrapper for IRpcStubBuffer::Invoke) */
 417     func = *sif->If->DispatchTable->DispatchTable;
 418   } else {
 419     if (msg->ProcNum >= sif->If->DispatchTable->DispatchTableCount) {
 420       WARN("invalid procnum (%d/%d)\n", msg->ProcNum, sif->If->DispatchTable->DispatchTableCount);
 421       response = RPCRT4_BuildFaultHeader(NDR_LOCAL_DATA_REPRESENTATION,
 422                                          NCA_S_OP_RNG_ERROR);
 423
 424       RPCRT4_Send(conn, response, NULL, 0);
 425       RPCRT4_FreeHeader(response);
 426     }
 427     func = sif->If->DispatchTable->DispatchTable[msg->ProcNum];
 428   }
 429
 430   /* put in the drep. FIXME: is this more universally applicable?
 431     perhaps we should move this outward... */
 432   msg->DataRepresentation =
 433     MAKELONG( MAKEWORD(hdr->common.drep[0], hdr->common.drep[1]),
 434               MAKEWORD(hdr->common.drep[2], hdr->common.drep[3]));
 435
 436   exception = FALSE;
 437
 438   /* dispatch */
 439   RPCRT4_SetThreadCurrentCallHandle(msg->Handle);
 440   __TRY {
 441     if (func) func(msg);
 442   } __EXCEPT_ALL {
 443     WARN("exception caught with code 0x%08x = %d\n", GetExceptionCode(), GetExceptionCode());
 444     exception = TRUE;
 445     if (GetExceptionCode() == STATUS_ACCESS_VIOLATION)
 446       status = ERROR_NOACCESS;
 447     else
 448       status = GetExceptionCode();
 449     response = RPCRT4_BuildFaultHeader(msg->DataRepresentation,
 450                                        RPC2NCA_STATUS(status));
 451   } __ENDTRY
 452     RPCRT4_SetThreadCurrentCallHandle(NULL);
 453
 454   /* release any unmarshalled context handles */
 455   while ((context_handle = RPCRT4_PopThreadContextHandle()) != NULL)
 456     RpcServerAssoc_ReleaseContextHandle(conn->server_binding->Assoc, context_handle, TRUE);
 457
 458   if (!exception)
 459     response = RPCRT4_BuildResponseHeader(msg->DataRepresentation,
 460                                           msg->BufferLength);
 461
 462   /* send response packet */
 463   if (response) {
 464     status = RPCRT4_Send(conn, response, exception ? NULL : msg->Buffer,
 465                          exception ? 0 : msg->BufferLength);
 466     RPCRT4_FreeHeader(response);
 467   } else
 468     ERR("out of memory\n");
 469
 470   msg->RpcInterfaceInformation = NULL;
 471   RPCRT4_release_server_interface(sif);
 472
 473   if (msg->Buffer == buf) buf = NULL;
 474   TRACE("freeing Buffer=%p\n", buf);
 475   I_RpcFree(buf);
 476
 477   return status;
 478 }
 479
 480 static RPC_STATUS process_auth3_packet(RpcConnection *conn,
 481                                        RpcPktCommonHdr *hdr,
 482                                        RPC_MESSAGE *msg,
 483                                        unsigned char *auth_data,
 484                                        ULONG auth_length)
 485 {
 486     RPC_STATUS status;
 487
 488     if (UuidIsNil(&conn->ActiveInterface.SyntaxGUID, &status) ||
 489         !auth_length || msg->BufferLength != 0)
 490         status = RPC_S_PROTOCOL_ERROR;
 491     else
 492     {
 493         status = RPCRT4_ServerConnectionAuth(conn, FALSE,
 494                                              (RpcAuthVerifier *)auth_data,
 495                                              auth_length, NULL, NULL);
 496     }
 497
 498     /* FIXME: client doesn't expect a response to this message so must store
 499      * status in connection so that fault packet can be returned when next
 500      * packet is received */
 501
 502     return RPC_S_OK;
 503 }
 504
 505 static void RPCRT4_process_packet(RpcConnection* conn, RpcPktHdr* hdr,
 506                                   RPC_MESSAGE* msg, unsigned char *auth_data,
 507                                   ULONG auth_length)
 508 {
 509   msg->Handle = (RPC_BINDING_HANDLE)conn->server_binding;
 510
 511   switch (hdr->common.ptype) {
 512     case PKT_BIND:
 513       TRACE("got bind packet\n");
 514       process_bind_packet(conn, &hdr->bind, msg, auth_data, auth_length);
 515       break;
 516
 517     case PKT_REQUEST:
 518       TRACE("got request packet\n");
 519       process_request_packet(conn, &hdr->request, msg);
 520       break;
 521
 522     case PKT_AUTH3:
 523       TRACE("got auth3 packet\n");
 524       process_auth3_packet(conn, &hdr->common, msg, auth_data, auth_length);
 525       break;
 526     default:
 527       FIXME("unhandled packet type %u\n", hdr->common.ptype);
 528       break;
 529   }
 530
 531   /* clean up */
 532   I_RpcFree(msg->Buffer);
 533   RPCRT4_FreeHeader(hdr);
 534   HeapFree(GetProcessHeap(), 0, msg);
 535   HeapFree(GetProcessHeap(), 0, auth_data);
 536 }
 537
 538 static DWORD CALLBACK RPCRT4_worker_thread(LPVOID the_arg)
 539 {
 540   RpcPacket *pkt = the_arg;
 541   RPCRT4_process_packet(pkt->conn, pkt->hdr, pkt->msg, pkt->auth_data,
 542                         pkt->auth_length);
 543   RPCRT4_ReleaseConnection(pkt->conn);
 544   HeapFree(GetProcessHeap(), 0, pkt);
 545   return 0;
 546 }
 547
 548 static DWORD CALLBACK RPCRT4_io_thread(LPVOID the_arg)
 549 {
 550   RpcConnection* conn = the_arg;
 551   RpcPktHdr *hdr;
 552   RPC_MESSAGE *msg;
 553   RPC_STATUS status;
 554   RpcPacket *packet;
 555   unsigned char *auth_data;
 556   ULONG auth_length;
 557
 558   TRACE("(%p)\n", conn);
 559
 560   for (;;) {
 561     msg = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(RPC_MESSAGE));
 562     if (!msg) break;
 563
 564     status = RPCRT4_ReceiveWithAuth(conn, &hdr, msg, &auth_data, &auth_length);
 565     if (status != RPC_S_OK) {
 566       WARN("receive failed with error %x\n", status);
 567       HeapFree(GetProcessHeap(), 0, msg);
 568       break;
 569     }
 570
 571     switch (hdr->common.ptype) {
 572     case PKT_BIND:
 573       TRACE("got bind packet\n");
 574
 575       status = process_bind_packet(conn, &hdr->bind, msg, auth_data,
 576                                    auth_length);
 577       break;
 578
 579     case PKT_REQUEST:
 580       TRACE("got request packet\n");
 581
 582       packet = HeapAlloc(GetProcessHeap(), 0, sizeof(RpcPacket));
 583       if (!packet) {
 584         I_RpcFree(msg->Buffer);
 585         RPCRT4_FreeHeader(hdr);
 586         HeapFree(GetProcessHeap(), 0, msg);
 587         HeapFree(GetProcessHeap(), 0, auth_data);
 588         goto exit;
 589       }
 590       packet->conn = RPCRT4_GrabConnection( conn );
 591       packet->hdr = hdr;
 592       packet->msg = msg;
 593       packet->auth_data = auth_data;
 594       packet->auth_length = auth_length;
 595       if (!QueueUserWorkItem(RPCRT4_worker_thread, packet, WT_EXECUTELONGFUNCTION)) {
 596         ERR("couldn't queue work item for worker thread, error was %d\n", GetLastError());
 597         HeapFree(GetProcessHeap(), 0, packet);
 598         status = RPC_S_OUT_OF_RESOURCES;
 599       } else {
 600         continue;
 601       }
 602       break;
 603
 604     case PKT_AUTH3:
 605       TRACE("got auth3 packet\n");
 606
 607       status = process_auth3_packet(conn, &hdr->common, msg, auth_data,
 608                                     auth_length);
 609       break;
 610     default:
 611       FIXME("unhandled packet type %u\n", hdr->common.ptype);
 612       break;
 613     }
 614
 615     I_RpcFree(msg->Buffer);
 616     RPCRT4_FreeHeader(hdr);
 617     HeapFree(GetProcessHeap(), 0, msg);
 618     HeapFree(GetProcessHeap(), 0, auth_data);
 619
 620     if (status != RPC_S_OK) {
 621       WARN("processing packet failed with error %u\n", status);
 622       break;
 623     }
 624   }
 625 exit:
 626   RPCRT4_ReleaseConnection(conn);
 627   return 0;
 628 }
 629
 630 void RPCRT4_new_client(RpcConnection* conn)
 631 {
 632   HANDLE thread = CreateThread(NULL, 0, RPCRT4_io_thread, conn, 0, NULL);
 633   if (!thread) {
 634     DWORD err = GetLastError();
 635     ERR("failed to create thread, error=%08x\n", err);
 636     RPCRT4_ReleaseConnection(conn);
 637   }
 638   /* we could set conn->thread, but then we'd have to make the io_thread wait
 639    * for that, otherwise the thread might finish, destroy the connection, and
 640    * free the memory we'd write to before we did, causing crashes and stuff -
 641    * so let's implement that later, when we really need conn->thread */
 642
 643   CloseHandle( thread );
 644 }
 645
 646 static DWORD CALLBACK RPCRT4_server_thread(LPVOID the_arg)
 647 {
 648   int res;
 649   unsigned int count;
 650   void *objs = NULL;
 651   RpcServerProtseq* cps = the_arg;
 652   RpcConnection* conn;
 653   BOOL set_ready_event = FALSE;
 654
 655   TRACE("(the_arg == ^%p)\n", the_arg);
 656
 657   for (;;) {
 658     objs = cps->ops->get_wait_array(cps, objs, &count);
 659
 660     if (set_ready_event)
 661     {
 662         /* signal to function that changed state that we are now sync'ed */
 663         SetEvent(cps->server_ready_event);
 664         set_ready_event = FALSE;
 665     }
 666
 667     /* start waiting */
 668     res = cps->ops->wait_for_new_connection(cps, count, objs);
 669
 670     if (res == -1 || (res == 0 && !std_listen))
 671     {
 672       /* cleanup */
 673       cps->ops->free_wait_array(cps, objs);
 674       EnterCriticalSection(&cps->cs);
 675       for (conn = cps->conn; conn; conn = conn->Next)
 676         RPCRT4_CloseConnection(conn);
 677       LeaveCriticalSection(&cps->cs);
 678
 679       if (res == 0 && !std_listen)
 680         SetEvent(cps->server_ready_event);
 681       break;
 682     }
 683     else if (res == 0)
 684       set_ready_event = TRUE;
 685   }
 686   return 0;
 687 }
 688
 689 /* tells the server thread that the state has changed and waits for it to
 690  * make the changes */
 691 static void RPCRT4_sync_with_server_thread(RpcServerProtseq *ps)
 692 {
 693   /* make sure we are the only thread sync'ing the server state, otherwise
 694    * there is a race with the server thread setting an older state and setting
 695    * the server_ready_event when the new state hasn't yet been applied */
 696   WaitForSingleObject(ps->mgr_mutex, INFINITE);
 697
 698   ps->ops->signal_state_changed(ps);
 699
 700   /* wait for server thread to make the requested changes before returning */
 701   WaitForSingleObject(ps->server_ready_event, INFINITE);
 702
 703   ReleaseMutex(ps->mgr_mutex);
 704 }
 705
 706 static RPC_STATUS RPCRT4_start_listen_protseq(RpcServerProtseq *ps, BOOL auto_listen)
 707 {
 708   RPC_STATUS status = RPC_S_OK;
 709   HANDLE server_thread;
 710
 711   EnterCriticalSection(&listen_cs);
 712   if (ps->is_listening) goto done;
 713
 714   if (!ps->mgr_mutex) ps->mgr_mutex = CreateMutexW(NULL, FALSE, NULL);
 715   if (!ps->server_ready_event) ps->server_ready_event = CreateEventW(NULL, FALSE, FALSE, NULL);
 716   server_thread = CreateThread(NULL, 0, RPCRT4_server_thread, ps, 0, NULL);
 717   if (!server_thread)
 718   {
 719     status = RPC_S_OUT_OF_RESOURCES;
 720     goto done;
 721   }
 722   ps->is_listening = TRUE;
 723   CloseHandle(server_thread);
 724
 725 done:
 726   LeaveCriticalSection(&listen_cs);
 727   return status;
 728 }
 729
 730 static RPC_STATUS RPCRT4_start_listen(BOOL auto_listen)
 731 {
 732   RPC_STATUS status = RPC_S_ALREADY_LISTENING;
 733   RpcServerProtseq *cps;
 734
 735   TRACE("\n");
 736
 737   EnterCriticalSection(&listen_cs);
 738   if (auto_listen || (manual_listen_count++ == 0))
 739   {
 740     status = RPC_S_OK;
 741     if (++listen_count == 1)
 742       std_listen = TRUE;
 743   }
 744   LeaveCriticalSection(&listen_cs);
 745
 746   if (std_listen)
 747   {
 748     EnterCriticalSection(&server_cs);
 749     LIST_FOR_EACH_ENTRY(cps, &protseqs, RpcServerProtseq, entry)
 750     {
 751       status = RPCRT4_start_listen_protseq(cps, TRUE);
 752       if (status != RPC_S_OK)
 753         break;
 754
 755       /* make sure server is actually listening on the interface before
 756        * returning */
 757       RPCRT4_sync_with_server_thread(cps);
 758     }
 759     LeaveCriticalSection(&server_cs);
 760   }
 761
 762   return status;
 763 }
 764
 765 static RPC_STATUS RPCRT4_stop_listen(BOOL auto_listen)
 766 {
 767   RPC_STATUS status = RPC_S_OK;
 768
 769   EnterCriticalSection(&listen_cs);
 770
 771   if (!std_listen)
 772   {
 773     status = RPC_S_NOT_LISTENING;
 774     goto done;
 775   }
 776
 777   if (auto_listen || (--manual_listen_count == 0))
 778   {
 779     if (listen_count != 0 && --listen_count == 0) {
 780       RpcServerProtseq *cps;
 781
 782       std_listen = FALSE;
 783       LeaveCriticalSection(&listen_cs);
 784
 785       LIST_FOR_EACH_ENTRY(cps, &protseqs, RpcServerProtseq, entry)
 786         RPCRT4_sync_with_server_thread(cps);
 787
 788       EnterCriticalSection(&listen_cs);
 789       if (listen_done_event) SetEvent( listen_done_event );
 790       listen_done_event = 0;
 791       goto done;
 792     }
 793     assert(listen_count >= 0);
 794   }
 795
 796 done:
 797   LeaveCriticalSection(&listen_cs);
 798   return status;
 799 }
 800
 801 static BOOL RPCRT4_protseq_is_endpoint_registered(RpcServerProtseq *protseq, const char *endpoint)
 802 {
 803   RpcConnection *conn;
 804   EnterCriticalSection(&protseq->cs);
 805   for (conn = protseq->conn; conn; conn = conn->Next)
 806   {
 807     if (!endpoint || !strcmp(endpoint, conn->Endpoint))
 808       break;
 809   }
 810   LeaveCriticalSection(&protseq->cs);
 811   return (conn != NULL);
 812 }
 813
 814 static RPC_STATUS RPCRT4_use_protseq(RpcServerProtseq* ps, const char *endpoint)
 815 {
 816   RPC_STATUS status;
 817
 818   EnterCriticalSection(&ps->cs);
 819
 820   if (RPCRT4_protseq_is_endpoint_registered(ps, endpoint))
 821     status = RPC_S_OK;
 822   else
 823     status = ps->ops->open_endpoint(ps, endpoint);
 824
 825   LeaveCriticalSection(&ps->cs);
 826
 827   if (status != RPC_S_OK)
 828     return status;
 829
 830   if (std_listen)
 831   {
 832     status = RPCRT4_start_listen_protseq(ps, FALSE);
 833     if (status == RPC_S_OK)
 834       RPCRT4_sync_with_server_thread(ps);
 835   }
 836
 837   return status;
 838 }
 839
 840 /***********************************************************************
 841  *             RpcServerInqBindings (RPCRT4.@)
 842  */
 843 RPC_STATUS WINAPI RpcServerInqBindings( RPC_BINDING_VECTOR** BindingVector )
 844 {
 845   RPC_STATUS status;
 846   DWORD count;
 847   RpcServerProtseq* ps;
 848   RpcConnection* conn;
 849
 850   if (BindingVector)
 851     TRACE("(*BindingVector == ^%p)\n", *BindingVector);
 852   else
 853     ERR("(BindingVector == NULL!!?)\n");
 854
 855   EnterCriticalSection(&server_cs);
 856   /* count connections */
 857   count = 0;
 858   LIST_FOR_EACH_ENTRY(ps, &protseqs, RpcServerProtseq, entry) {
 859     EnterCriticalSection(&ps->cs);
 860     for (conn = ps->conn; conn; conn = conn->Next)
 861       count++;
 862     LeaveCriticalSection(&ps->cs);
 863   }
 864   if (count) {
 865     /* export bindings */
 866     *BindingVector = HeapAlloc(GetProcessHeap(), 0,
 867                               sizeof(RPC_BINDING_VECTOR) +
 868                               sizeof(RPC_BINDING_HANDLE)*(count-1));
 869     (*BindingVector)->Count = count;
 870     count = 0;
 871     LIST_FOR_EACH_ENTRY(ps, &protseqs, RpcServerProtseq, entry) {
 872       EnterCriticalSection(&ps->cs);
 873       for (conn = ps->conn; conn; conn = conn->Next) {
 874        RPCRT4_MakeBinding((RpcBinding**)&(*BindingVector)->BindingH[count],
 875                           conn);
 876        count++;
 877       }
 878       LeaveCriticalSection(&ps->cs);
 879     }
 880     status = RPC_S_OK;
 881   } else {
 882     *BindingVector = NULL;
 883     status = RPC_S_NO_BINDINGS;
 884   }
 885   LeaveCriticalSection(&server_cs);
 886   return status;
 887 }
 888
 889 /***********************************************************************
 890  *             RpcServerUseProtseqEpA (RPCRT4.@)
 891  */
 892 RPC_STATUS WINAPI RpcServerUseProtseqEpA( RPC_CSTR Protseq, UINT MaxCalls, RPC_CSTR Endpoint, LPVOID SecurityDescriptor )
 893 {
 894   RPC_POLICY policy;
 895
 896   TRACE( "(%s,%u,%s,%p)\n", Protseq, MaxCalls, Endpoint, SecurityDescriptor );
 897
 898   /* This should provide the default behaviour */
 899   policy.Length        = sizeof( policy );
 900   policy.EndpointFlags = 0;
 901   policy.NICFlags      = 0;
 902
 903   return RpcServerUseProtseqEpExA( Protseq, MaxCalls, Endpoint, SecurityDescriptor, &policy );
 904 }
 905
 906 /***********************************************************************
 907  *             RpcServerUseProtseqEpW (RPCRT4.@)
 908  */
 909 RPC_STATUS WINAPI RpcServerUseProtseqEpW( RPC_WSTR Protseq, UINT MaxCalls, RPC_WSTR Endpoint, LPVOID SecurityDescriptor )
 910 {
 911   RPC_POLICY policy;
 912
 913   TRACE( "(%s,%u,%s,%p)\n", debugstr_w( Protseq ), MaxCalls, debugstr_w( Endpoint ), SecurityDescriptor );
 914
 915   /* This should provide the default behaviour */
 916   policy.Length        = sizeof( policy );
 917   policy.EndpointFlags = 0;
 918   policy.NICFlags      = 0;
 919
 920   return RpcServerUseProtseqEpExW( Protseq, MaxCalls, Endpoint, SecurityDescriptor, &policy );
 921 }
 922
 923 /***********************************************************************
 924  *             alloc_serverprotoseq (internal)
 925  *
 926  * Must be called with server_cs held.
 927  */
 928 static RPC_STATUS alloc_serverprotoseq(UINT MaxCalls, const char *Protseq, RpcServerProtseq **ps)
 929 {
 930   const struct protseq_ops *ops = rpcrt4_get_protseq_ops(Protseq);
 931
 932   if (!ops)
 933   {
 934     FIXME("protseq %s not supported\n", debugstr_a(Protseq));
 935     return RPC_S_PROTSEQ_NOT_SUPPORTED;
 936   }
 937
 938   *ps = ops->alloc();
 939   if (!*ps)
 940     return RPC_S_OUT_OF_RESOURCES;
 941   (*ps)->MaxCalls = MaxCalls;
 942   (*ps)->Protseq = RPCRT4_strdupA(Protseq);
 943   (*ps)->ops = ops;
 944   (*ps)->MaxCalls = 0;
 945   (*ps)->conn = NULL;
 946   InitializeCriticalSection(&(*ps)->cs);
 947   (*ps)->cs.DebugInfo->Spare[0] = (DWORD_PTR)(__FILE__ ": RpcServerProtseq.cs");
 948   (*ps)->is_listening = FALSE;
 949   (*ps)->mgr_mutex = NULL;
 950   (*ps)->server_ready_event = NULL;
 951
 952   list_add_head(&protseqs, &(*ps)->entry);
 953
 954   TRACE("new protseq %p created for %s\n", *ps, Protseq);
 955
 956   return RPC_S_OK;
 957 }
 958
 959 /* must be called with server_cs held */
 960 static void destroy_serverprotoseq(RpcServerProtseq *ps)
 961 {
 962     RPCRT4_strfree(ps->Protseq);
 963     ps->cs.DebugInfo->Spare[0] = 0;
 964     DeleteCriticalSection(&ps->cs);
 965     CloseHandle(ps->mgr_mutex);
 966     CloseHandle(ps->server_ready_event);
 967     list_remove(&ps->entry);
 968     HeapFree(GetProcessHeap(), 0, ps);
 969 }
 970
 971 /* Finds a given protseq or creates a new one if one doesn't already exist */
 972 static RPC_STATUS RPCRT4_get_or_create_serverprotseq(UINT MaxCalls, const char *Protseq, RpcServerProtseq **ps)
 973 {
 974     RPC_STATUS status;
 975     RpcServerProtseq *cps;
 976
 977     EnterCriticalSection(&server_cs);
 978
 979     LIST_FOR_EACH_ENTRY(cps, &protseqs, RpcServerProtseq, entry)
 980         if (!strcmp(cps->Protseq, Protseq))
 981         {
 982             TRACE("found existing protseq object for %s\n", Protseq);
 983             *ps = cps;
 984             LeaveCriticalSection(&server_cs);
 985             return S_OK;
 986         }
 987
 988     status = alloc_serverprotoseq(MaxCalls, Protseq, ps);
 989
 990     LeaveCriticalSection(&server_cs);
 991
 992     return status;
 993 }
 994
 995 /***********************************************************************
 996  *             RpcServerUseProtseqEpExA (RPCRT4.@)
 997  */
 998 RPC_STATUS WINAPI RpcServerUseProtseqEpExA( RPC_CSTR Protseq, UINT MaxCalls, RPC_CSTR Endpoint, LPVOID SecurityDescriptor,
 999                                             PRPC_POLICY lpPolicy )
1000 {
1001   RpcServerProtseq* ps;
1002   RPC_STATUS status;
1003
1004   TRACE("(%s,%u,%s,%p,{%u,%u,%u})\n", debugstr_a((const char *)Protseq),
1005        MaxCalls, debugstr_a((const char *)Endpoint), SecurityDescriptor,
1006        lpPolicy->Length, lpPolicy->EndpointFlags, lpPolicy->NICFlags );
1007
1008   status = RPCRT4_get_or_create_serverprotseq(MaxCalls, (const char *)Protseq, &ps);
1009   if (status != RPC_S_OK)
1010     return status;
1011
1012   return RPCRT4_use_protseq(ps, (const char *)Endpoint);
1013 }
1014
1015 /***********************************************************************
1016  *             RpcServerUseProtseqEpExW (RPCRT4.@)
1017  */
1018 RPC_STATUS WINAPI RpcServerUseProtseqEpExW( RPC_WSTR Protseq, UINT MaxCalls, RPC_WSTR Endpoint, LPVOID SecurityDescriptor,
1019                                             PRPC_POLICY lpPolicy )
1020 {
1021   RpcServerProtseq* ps;
1022   RPC_STATUS status;
1023   LPSTR ProtseqA;
1024   LPSTR EndpointA;
1025
1026   TRACE("(%s,%u,%s,%p,{%u,%u,%u})\n", debugstr_w( Protseq ), MaxCalls,
1027        debugstr_w( Endpoint ), SecurityDescriptor,
1028        lpPolicy->Length, lpPolicy->EndpointFlags, lpPolicy->NICFlags );
1029
1030   ProtseqA = RPCRT4_strdupWtoA(Protseq);
1031   status = RPCRT4_get_or_create_serverprotseq(MaxCalls, ProtseqA, &ps);
1032   RPCRT4_strfree(ProtseqA);
1033   if (status != RPC_S_OK)
1034     return status;
1035
1036   EndpointA = RPCRT4_strdupWtoA(Endpoint);
1037   status = RPCRT4_use_protseq(ps, EndpointA);
1038   RPCRT4_strfree(EndpointA);
1039   return status;
1040 }
1041
1042 /***********************************************************************
1043  *             RpcServerUseProtseqA (RPCRT4.@)
1044  */
1045 RPC_STATUS WINAPI RpcServerUseProtseqA(RPC_CSTR Protseq, unsigned int MaxCalls, void *SecurityDescriptor)
1046 {
1047   RPC_STATUS status;
1048   RpcServerProtseq* ps;
1049
1050   TRACE("(Protseq == %s, MaxCalls == %d, SecurityDescriptor == ^%p)\n", debugstr_a((char*)Protseq), MaxCalls, SecurityDescriptor);
1051
1052   status = RPCRT4_get_or_create_serverprotseq(MaxCalls, (const char *)Protseq, &ps);
1053   if (status != RPC_S_OK)
1054     return status;
1055
1056   return RPCRT4_use_protseq(ps, NULL);
1057 }
1058
1059 /***********************************************************************
1060  *             RpcServerUseProtseqW (RPCRT4.@)
1061  */
1062 RPC_STATUS WINAPI RpcServerUseProtseqW(RPC_WSTR Protseq, unsigned int MaxCalls, void *SecurityDescriptor)
1063 {
1064   RPC_STATUS status;
1065   RpcServerProtseq* ps;
1066   LPSTR ProtseqA;
1067
1068   TRACE("Protseq == %s, MaxCalls == %d, SecurityDescriptor == ^%p)\n", debugstr_w(Protseq), MaxCalls, SecurityDescriptor);
1069
1070   ProtseqA = RPCRT4_strdupWtoA(Protseq);
1071   status = RPCRT4_get_or_create_serverprotseq(MaxCalls, ProtseqA, &ps);
1072   RPCRT4_strfree(ProtseqA);
1073   if (status != RPC_S_OK)
1074     return status;
1075
1076   return RPCRT4_use_protseq(ps, NULL);
1077 }
1078
1079 void RPCRT4_destroy_all_protseqs(void)
1080 {
1081     RpcServerProtseq *cps, *cursor2;
1082
1083     if (listen_count != 0)
1084         std_listen = FALSE;
1085
1086     EnterCriticalSection(&server_cs);
1087     LIST_FOR_EACH_ENTRY_SAFE(cps, cursor2, &protseqs, RpcServerProtseq, entry)
1088     {
1089         if (listen_count != 0)
1090             RPCRT4_sync_with_server_thread(cps);
1091         destroy_serverprotoseq(cps);
1092     }
1093     LeaveCriticalSection(&server_cs);
1094     DeleteCriticalSection(&server_cs);
1095     DeleteCriticalSection(&listen_cs);
1096 }
1097
1098 /***********************************************************************
1099  *             RpcServerRegisterIf (RPCRT4.@)
1100  */
1101 RPC_STATUS WINAPI RpcServerRegisterIf( RPC_IF_HANDLE IfSpec, UUID* MgrTypeUuid, RPC_MGR_EPV* MgrEpv )
1102 {
1103   TRACE("(%p,%s,%p)\n", IfSpec, debugstr_guid(MgrTypeUuid), MgrEpv);
1104   return RpcServerRegisterIf3( IfSpec, MgrTypeUuid, MgrEpv, 0, RPC_C_LISTEN_MAX_CALLS_DEFAULT, (UINT)-1, NULL, NULL );
1105 }
1106
1107 /***********************************************************************
1108  *             RpcServerRegisterIfEx (RPCRT4.@)
1109  */
1110 RPC_STATUS WINAPI RpcServerRegisterIfEx( RPC_IF_HANDLE IfSpec, UUID* MgrTypeUuid, RPC_MGR_EPV* MgrEpv,
1111                        UINT Flags, UINT MaxCalls, RPC_IF_CALLBACK_FN* IfCallbackFn )
1112 {
1113   TRACE("(%p,%s,%p,%u,%u,%p)\n", IfSpec, debugstr_guid(MgrTypeUuid), MgrEpv, Flags, MaxCalls, IfCallbackFn);
1114   return RpcServerRegisterIf3( IfSpec, MgrTypeUuid, MgrEpv, Flags, MaxCalls, (UINT)-1, IfCallbackFn, NULL );
1115 }
1116
1117 /***********************************************************************
1118  *             RpcServerRegisterIf2 (RPCRT4.@)
1119  */
1120 RPC_STATUS WINAPI RpcServerRegisterIf2( RPC_IF_HANDLE IfSpec, UUID* MgrTypeUuid, RPC_MGR_EPV* MgrEpv,
1121                       UINT Flags, UINT MaxCalls, UINT MaxRpcSize, RPC_IF_CALLBACK_FN* IfCallbackFn )
1122 {
1123   return RpcServerRegisterIf3( IfSpec, MgrTypeUuid, MgrEpv, Flags, MaxCalls, MaxRpcSize, IfCallbackFn, NULL );
1124 }
1125
1126 /***********************************************************************
1127  *             RpcServerRegisterIf3 (RPCRT4.@)
1128  */
1129 RPC_STATUS WINAPI RpcServerRegisterIf3( RPC_IF_HANDLE IfSpec, UUID* MgrTypeUuid, RPC_MGR_EPV* MgrEpv,
1130     UINT Flags, UINT MaxCalls, UINT MaxRpcSize, RPC_IF_CALLBACK_FN* IfCallbackFn, void* SecurityDescriptor)
1131 {
1132   PRPC_SERVER_INTERFACE If = IfSpec;
1133   RpcServerInterface* sif;
1134   unsigned int i;
1135
1136   TRACE("(%p,%s,%p,%u,%u,%u,%p,%p)\n", IfSpec, debugstr_guid(MgrTypeUuid), MgrEpv, Flags, MaxCalls,
1137         MaxRpcSize, IfCallbackFn, SecurityDescriptor);
1138
1139   if (SecurityDescriptor)
1140       FIXME("Unsupported SecurityDescriptor argument.\n");
1141
1142   TRACE(" interface id: %s %d.%d\n", debugstr_guid(&If->InterfaceId.SyntaxGUID),
1143                                      If->InterfaceId.SyntaxVersion.MajorVersion,
1144                                      If->InterfaceId.SyntaxVersion.MinorVersion);
1145   TRACE(" transfer syntax: %s %d.%d\n", debugstr_guid(&If->TransferSyntax.SyntaxGUID),
1146                                         If->TransferSyntax.SyntaxVersion.MajorVersion,
1147                                         If->TransferSyntax.SyntaxVersion.MinorVersion);
1148   TRACE(" dispatch table: %p\n", If->DispatchTable);
1149   if (If->DispatchTable) {
1150     TRACE("  dispatch table count: %d\n", If->DispatchTable->DispatchTableCount);
1151     for (i=0; i<If->DispatchTable->DispatchTableCount; i++) {
1152       TRACE("   entry %d: %p\n", i, If->DispatchTable->DispatchTable[i]);
1153     }
1154     TRACE("  reserved: %ld\n", If->DispatchTable->Reserved);
1155   }
1156   TRACE(" protseq endpoint count: %d\n", If->RpcProtseqEndpointCount);
1157   TRACE(" default manager epv: %p\n", If->DefaultManagerEpv);
1158   TRACE(" interpreter info: %p\n", If->InterpreterInfo);
1159
1160   sif = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(RpcServerInterface));
1161   sif->If           = If;
1162   if (MgrTypeUuid) {
1163     sif->MgrTypeUuid = *MgrTypeUuid;
1164     sif->MgrEpv       = MgrEpv;
1165   } else {
1166     memset(&sif->MgrTypeUuid, 0, sizeof(UUID));
1167     sif->MgrEpv       = If->DefaultManagerEpv;
1168   }
1169   sif->Flags        = Flags;
1170   sif->MaxCalls     = MaxCalls;
1171   sif->MaxRpcSize   = MaxRpcSize;
1172   sif->IfCallbackFn = IfCallbackFn;
1173
1174   EnterCriticalSection(&server_cs);
1175   list_add_head(&server_interfaces, &sif->entry);
1176   LeaveCriticalSection(&server_cs);
1177
1178   if (sif->Flags & RPC_IF_AUTOLISTEN)
1179       RPCRT4_start_listen(TRUE);
1180
1181   return RPC_S_OK;
1182 }
1183
1184 /***********************************************************************
1185  *             RpcServerUnregisterIf (RPCRT4.@)
1186  */
1187 RPC_STATUS WINAPI RpcServerUnregisterIf( RPC_IF_HANDLE IfSpec, UUID* MgrTypeUuid, UINT WaitForCallsToComplete )
1188 {
1189   PRPC_SERVER_INTERFACE If = IfSpec;
1190   HANDLE event = NULL;
1191   BOOL found = FALSE;
1192   BOOL completed = TRUE;
1193   RpcServerInterface *cif;
1194   RPC_STATUS status;
1195
1196   TRACE("(IfSpec == (RPC_IF_HANDLE)^%p (%s), MgrTypeUuid == %s, WaitForCallsToComplete == %u)\n",
1197     IfSpec, debugstr_guid(&If->InterfaceId.SyntaxGUID), debugstr_guid(MgrTypeUuid), WaitForCallsToComplete);
1198
1199   EnterCriticalSection(&server_cs);
1200   LIST_FOR_EACH_ENTRY(cif, &server_interfaces, RpcServerInterface, entry) {
1201     if ((!IfSpec || !memcmp(&If->InterfaceId, &cif->If->InterfaceId, sizeof(RPC_SYNTAX_IDENTIFIER))) &&
1202         UuidEqual(MgrTypeUuid, &cif->MgrTypeUuid, &status)) {
1203       list_remove(&cif->entry);
1204       TRACE("unregistering cif %p\n", cif);
1205       if (cif->CurrentCalls) {
1206         completed = FALSE;
1207         cif->Delete = TRUE;
1208         if (WaitForCallsToComplete)
1209           cif->CallsCompletedEvent = event = CreateEventW(NULL, FALSE, FALSE, NULL);
1210       }
1211       found = TRUE;
1212       break;
1213     }
1214   }
1215   LeaveCriticalSection(&server_cs);
1216
1217   if (!found) {
1218     ERR("not found for object %s\n", debugstr_guid(MgrTypeUuid));
1219     return RPC_S_UNKNOWN_IF;
1220   }
1221
1222   if (completed)
1223     HeapFree(GetProcessHeap(), 0, cif);
1224   else if (event) {
1225     /* sif will be freed when the last call is completed, so be careful not to
1226      * touch that memory here as that could happen before we get here */
1227     WaitForSingleObject(event, INFINITE);
1228     CloseHandle(event);
1229   }
1230
1231   return RPC_S_OK;
1232 }
1233
1234 /***********************************************************************
1235  *             RpcServerUnregisterIfEx (RPCRT4.@)
1236  */
1237 RPC_STATUS WINAPI RpcServerUnregisterIfEx( RPC_IF_HANDLE IfSpec, UUID* MgrTypeUuid, int RundownContextHandles )
1238 {
1239   FIXME("(IfSpec == (RPC_IF_HANDLE)^%p, MgrTypeUuid == %s, RundownContextHandles == %d): stub\n",
1240     IfSpec, debugstr_guid(MgrTypeUuid), RundownContextHandles);
1241
1242   return RPC_S_OK;
1243 }
1244
1245 /***********************************************************************
1246  *             RpcObjectSetType (RPCRT4.@)
1247  *
1248  * PARAMS
1249  *   ObjUuid  [I] "Object" UUID
1250  *   TypeUuid [I] "Type" UUID
1251  *
1252  * RETURNS
1253  *   RPC_S_OK                 The call succeeded
1254  *   RPC_S_INVALID_OBJECT     The provided object (nil) is not valid
1255  *   RPC_S_ALREADY_REGISTERED The provided object is already registered
1256  *
1257  * Maps "Object" UUIDs to "Type" UUIDs.  Passing the nil UUID as the type
1258  * resets the mapping for the specified object UUID to nil (the default).
1259  * The nil object is always associated with the nil type and cannot be
1260  * reassigned.  Servers can support multiple implementations on the same
1261  * interface by registering different end-point vectors for the different
1262  * types.  There's no need to call this if a server only supports the nil
1263  * type, as is typical.
1264  */
1265 RPC_STATUS WINAPI RpcObjectSetType( UUID* ObjUuid, UUID* TypeUuid )
1266 {
1267   RpcObjTypeMap *map = RpcObjTypeMaps, *prev = NULL;
1268   RPC_STATUS dummy;
1269
1270   TRACE("(ObjUUID == %s, TypeUuid == %s).\n", debugstr_guid(ObjUuid), debugstr_guid(TypeUuid));
1271   if ((! ObjUuid) || UuidIsNil(ObjUuid, &dummy)) {
1272     /* nil uuid cannot be remapped */
1273     return RPC_S_INVALID_OBJECT;
1274   }
1275
1276   /* find the mapping for this object if there is one ... */
1277   while (map) {
1278     if (! UuidCompare(ObjUuid, &map->Object, &dummy)) break;
1279     prev = map;
1280     map = map->next;
1281   }
1282   if ((! TypeUuid) || UuidIsNil(TypeUuid, &dummy)) {
1283     /* ... and drop it from the list */
1284     if (map) {
1285       if (prev)
1286         prev->next = map->next;
1287       else
1288         RpcObjTypeMaps = map->next;
1289       HeapFree(GetProcessHeap(), 0, map);
1290     }
1291   } else {
1292     /* ... , fail if we found it ... */
1293     if (map)
1294       return RPC_S_ALREADY_REGISTERED;
1295     /* ... otherwise create a new one and add it in. */
1296     map = HeapAlloc(GetProcessHeap(), 0, sizeof(RpcObjTypeMap));
1297     map->Object = *ObjUuid;
1298     map->Type = *TypeUuid;
1299     map->next = NULL;
1300     if (prev)
1301       prev->next = map; /* prev is the last map in the linklist */
1302     else
1303       RpcObjTypeMaps = map;
1304   }
1305
1306   return RPC_S_OK;
1307 }
1308
1309 struct rpc_server_registered_auth_info
1310 {
1311     struct list entry;
1312     USHORT auth_type;
1313     WCHAR *package_name;
1314     WCHAR *principal;
1315     ULONG max_token;
1316 };
1317
1318 static RPC_STATUS find_security_package(ULONG auth_type, SecPkgInfoW **packages_buf, SecPkgInfoW **ret)
1319 {
1320     SECURITY_STATUS sec_status;
1321     SecPkgInfoW *packages;
1322     ULONG package_count;
1323     ULONG i;
1324
1325     sec_status = EnumerateSecurityPackagesW(&package_count, &packages);
1326     if (sec_status != SEC_E_OK)
1327     {
1328         ERR("EnumerateSecurityPackagesW failed with error 0x%08x\n", sec_status);
1329         return RPC_S_SEC_PKG_ERROR;
1330     }
1331
1332     for (i = 0; i < package_count; i++)
1333         if (packages[i].wRPCID == auth_type)
1334             break;
1335
1336     if (i == package_count)
1337     {
1338         WARN("unsupported AuthnSvc %u\n", auth_type);
1339         FreeContextBuffer(packages);
1340         return RPC_S_UNKNOWN_AUTHN_SERVICE;
1341     }
1342
1343     TRACE("found package %s for service %u\n", debugstr_w(packages[i].Name), auth_type);
1344     *packages_buf = packages;
1345     *ret = packages + i;
1346     return RPC_S_OK;
1347 }
1348
1349 RPC_STATUS RPCRT4_ServerGetRegisteredAuthInfo(
1350     USHORT auth_type, CredHandle *cred, TimeStamp *exp, ULONG *max_token)
1351 {
1352     RPC_STATUS status = RPC_S_UNKNOWN_AUTHN_SERVICE;
1353     struct rpc_server_registered_auth_info *auth_info;
1354     SECURITY_STATUS sec_status;
1355
1356     EnterCriticalSection(&server_auth_info_cs);
1357     LIST_FOR_EACH_ENTRY(auth_info, &server_registered_auth_info, struct rpc_server_registered_auth_info, entry)
1358     {
1359         if (auth_info->auth_type == auth_type)
1360         {
1361             sec_status = AcquireCredentialsHandleW((SEC_WCHAR *)auth_info->principal, auth_info->package_name,
1362                                                    SECPKG_CRED_INBOUND, NULL, NULL, NULL, NULL,
1363                                                    cred, exp);
1364             if (sec_status != SEC_E_OK)
1365             {
1366                 status = RPC_S_SEC_PKG_ERROR;
1367                 break;
1368             }
1369
1370             *max_token = auth_info->max_token;
1371             status = RPC_S_OK;
1372             break;
1373         }
1374     }
1375     LeaveCriticalSection(&server_auth_info_cs);
1376
1377     return status;
1378 }
1379
1380 void RPCRT4_ServerFreeAllRegisteredAuthInfo(void)
1381 {
1382     struct rpc_server_registered_auth_info *auth_info, *cursor2;
1383
1384     EnterCriticalSection(&server_auth_info_cs);
1385     LIST_FOR_EACH_ENTRY_SAFE(auth_info, cursor2, &server_registered_auth_info, struct rpc_server_registered_auth_info, entry)
1386     {
1387         HeapFree(GetProcessHeap(), 0, auth_info->package_name);
1388         HeapFree(GetProcessHeap(), 0, auth_info->principal);
1389         HeapFree(GetProcessHeap(), 0, auth_info);
1390     }
1391     LeaveCriticalSection(&server_auth_info_cs);
1392     DeleteCriticalSection(&server_auth_info_cs);
1393 }
1394
1395 /***********************************************************************
1396  *             RpcServerRegisterAuthInfoA (RPCRT4.@)
1397  */
1398 RPC_STATUS WINAPI RpcServerRegisterAuthInfoA( RPC_CSTR ServerPrincName, ULONG AuthnSvc, RPC_AUTH_KEY_RETRIEVAL_FN GetKeyFn,
1399                             LPVOID Arg )
1400 {
1401     WCHAR *principal_name = NULL;
1402     RPC_STATUS status;
1403
1404     TRACE("(%s,%u,%p,%p)\n", ServerPrincName, AuthnSvc, GetKeyFn, Arg);
1405
1406     if(ServerPrincName && !(principal_name = RPCRT4_strdupAtoW((const char*)ServerPrincName)))
1407         return RPC_S_OUT_OF_RESOURCES;
1408
1409     status = RpcServerRegisterAuthInfoW(principal_name, AuthnSvc, GetKeyFn, Arg);
1410
1411     HeapFree(GetProcessHeap(), 0, principal_name);
1412     return status;
1413 }
1414
1415 /***********************************************************************
1416  *             RpcServerRegisterAuthInfoW (RPCRT4.@)
1417  */
1418 RPC_STATUS WINAPI RpcServerRegisterAuthInfoW( RPC_WSTR ServerPrincName, ULONG AuthnSvc, RPC_AUTH_KEY_RETRIEVAL_FN GetKeyFn,
1419                             LPVOID Arg )
1420 {
1421     struct rpc_server_registered_auth_info *auth_info;
1422     SecPkgInfoW *packages, *package;
1423     WCHAR *package_name;
1424     ULONG max_token;
1425     RPC_STATUS status;
1426
1427     TRACE("(%s,%u,%p,%p)\n", debugstr_w(ServerPrincName), AuthnSvc, GetKeyFn, Arg);
1428
1429     status = find_security_package(AuthnSvc, &packages, &package);
1430     if (status != RPC_S_OK)
1431         return status;
1432
1433     package_name = RPCRT4_strdupW(package->Name);
1434     max_token = package->cbMaxToken;
1435     FreeContextBuffer(packages);
1436     if (!package_name)
1437         return RPC_S_OUT_OF_RESOURCES;
1438
1439     auth_info = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(*auth_info));
1440     if (!auth_info) {
1441         HeapFree(GetProcessHeap(), 0, package_name);
1442         return RPC_S_OUT_OF_RESOURCES;
1443     }
1444
1445     if (ServerPrincName && !(auth_info->principal = RPCRT4_strdupW(ServerPrincName))) {
1446         HeapFree(GetProcessHeap(), 0, package_name);
1447         HeapFree(GetProcessHeap(), 0, auth_info);
1448         return RPC_S_OUT_OF_RESOURCES;
1449     }
1450
1451     auth_info->auth_type = AuthnSvc;
1452     auth_info->package_name = package_name;
1453     auth_info->max_token = max_token;
1454
1455     EnterCriticalSection(&server_auth_info_cs);
1456     list_add_tail(&server_registered_auth_info, &auth_info->entry);
1457     LeaveCriticalSection(&server_auth_info_cs);
1458
1459     return RPC_S_OK;
1460 }
1461
1462 /******************************************************************************
1463  * RpcServerInqDefaultPrincNameA   (rpcrt4.@)
1464  */
1465 RPC_STATUS RPC_ENTRY RpcServerInqDefaultPrincNameA(ULONG AuthnSvc, RPC_CSTR *PrincName)
1466 {
1467     RPC_STATUS ret;
1468     RPC_WSTR principalW;
1469
1470     TRACE("%u, %p\n", AuthnSvc, PrincName);
1471
1472     if ((ret = RpcServerInqDefaultPrincNameW( AuthnSvc, &principalW )) == RPC_S_OK)
1473     {
1474         if (!(*PrincName = (RPC_CSTR)RPCRT4_strdupWtoA( principalW ))) return RPC_S_OUT_OF_MEMORY;
1475         RpcStringFreeW( &principalW );
1476     }
1477     return ret;
1478 }
1479
1480 /******************************************************************************
1481  * RpcServerInqDefaultPrincNameW   (rpcrt4.@)
1482  */
1483 RPC_STATUS RPC_ENTRY RpcServerInqDefaultPrincNameW(ULONG AuthnSvc, RPC_WSTR *PrincName)
1484 {
1485     ULONG len = 0;
1486
1487     FIXME("%u, %p\n", AuthnSvc, PrincName);
1488
1489     if (AuthnSvc != RPC_C_AUTHN_WINNT) return RPC_S_UNKNOWN_AUTHN_SERVICE;
1490
1491     GetUserNameExW( NameSamCompatible, NULL, &len );
1492     if (GetLastError() != ERROR_MORE_DATA) return RPC_S_INTERNAL_ERROR;
1493
1494     if (!(*PrincName = HeapAlloc( GetProcessHeap(), 0, len * sizeof(WCHAR) )))
1495         return RPC_S_OUT_OF_MEMORY;
1496
1497     GetUserNameExW( NameSamCompatible, *PrincName, &len );
1498     return RPC_S_OK;
1499 }
1500
1501 /***********************************************************************
1502  *             RpcServerListen (RPCRT4.@)
1503  */
1504 RPC_STATUS WINAPI RpcServerListen( UINT MinimumCallThreads, UINT MaxCalls, UINT DontWait )
1505 {
1506   RPC_STATUS status = RPC_S_OK;
1507
1508   TRACE("(%u,%u,%u)\n", MinimumCallThreads, MaxCalls, DontWait);
1509
1510   if (list_empty(&protseqs))
1511     return RPC_S_NO_PROTSEQS_REGISTERED;
1512
1513   status = RPCRT4_start_listen(FALSE);
1514
1515   if (DontWait || (status != RPC_S_OK)) return status;
1516
1517   return RpcMgmtWaitServerListen();
1518 }
1519
1520 /***********************************************************************
1521  *             RpcMgmtServerWaitListen (RPCRT4.@)
1522  */
1523 RPC_STATUS WINAPI RpcMgmtWaitServerListen( void )
1524 {
1525   HANDLE event;
1526
1527   TRACE("()\n");
1528
1529   EnterCriticalSection(&listen_cs);
1530
1531   if (!std_listen) {
1532     LeaveCriticalSection(&listen_cs);
1533     return RPC_S_NOT_LISTENING;
1534   }
1535   if (listen_done_event) {
1536     LeaveCriticalSection(&listen_cs);
1537     return RPC_S_ALREADY_LISTENING;
1538   }
1539   event = CreateEventW( NULL, TRUE, FALSE, NULL );
1540   listen_done_event = event;
1541
1542   LeaveCriticalSection(&listen_cs);
1543
1544   TRACE( "waiting for server calls to finish\n" );
1545   WaitForSingleObject( event, INFINITE );
1546   TRACE( "done waiting\n" );
1547
1548   CloseHandle( event );
1549   return RPC_S_OK;
1550 }
1551
1552 /***********************************************************************
1553  *             RpcMgmtStopServerListening (RPCRT4.@)
1554  */
1555 RPC_STATUS WINAPI RpcMgmtStopServerListening ( RPC_BINDING_HANDLE Binding )
1556 {
1557   TRACE("(Binding == (RPC_BINDING_HANDLE)^%p)\n", Binding);
1558
1559   if (Binding) {
1560     FIXME("client-side invocation not implemented.\n");
1561     return RPC_S_WRONG_KIND_OF_BINDING;
1562   }
1563
1564   return RPCRT4_stop_listen(FALSE);
1565 }
1566
1567 /***********************************************************************
1568  *             RpcMgmtEnableIdleCleanup (RPCRT4.@)
1569  */
1570 RPC_STATUS WINAPI RpcMgmtEnableIdleCleanup(void)
1571 {
1572     FIXME("(): stub\n");
1573     return RPC_S_OK;
1574 }
1575
1576 /***********************************************************************
1577  *             I_RpcServerStartListening (RPCRT4.@)
1578  */
1579 RPC_STATUS WINAPI I_RpcServerStartListening( HWND hWnd )
1580 {
1581   FIXME( "(%p): stub\n", hWnd );
1582
1583   return RPC_S_OK;
1584 }
1585
1586 /***********************************************************************
1587  *             I_RpcServerStopListening (RPCRT4.@)
1588  */
1589 RPC_STATUS WINAPI I_RpcServerStopListening( void )
1590 {
1591   FIXME( "(): stub\n" );
1592
1593   return RPC_S_OK;
1594 }
1595
1596 /***********************************************************************
1597  *             I_RpcWindowProc (RPCRT4.@)
1598  */
1599 UINT WINAPI I_RpcWindowProc( void *hWnd, UINT Message, UINT wParam, ULONG lParam )
1600 {
1601   FIXME( "(%p,%08x,%08x,%08x): stub\n", hWnd, Message, wParam, lParam );
1602
1603   return 0;
1604 }
1605
1606 /***********************************************************************
1607  *             RpcMgmtInqIfIds (RPCRT4.@)
1608  */
1609 RPC_STATUS WINAPI RpcMgmtInqIfIds(RPC_BINDING_HANDLE Binding, RPC_IF_ID_VECTOR **IfIdVector)
1610 {
1611   FIXME("(%p,%p): stub\n", Binding, IfIdVector);
1612   return RPC_S_INVALID_BINDING;
1613 }
1614
1615 /***********************************************************************
1616  *             RpcMgmtInqStats (RPCRT4.@)
1617  */
1618 RPC_STATUS WINAPI RpcMgmtInqStats(RPC_BINDING_HANDLE Binding, RPC_STATS_VECTOR **Statistics)
1619 {
1620   RPC_STATS_VECTOR *stats;
1621
1622   FIXME("(%p,%p)\n", Binding, Statistics);
1623
1624   if ((stats = HeapAlloc(GetProcessHeap(), 0, sizeof(RPC_STATS_VECTOR))))
1625   {
1626     stats->Count = 1;
1627     stats->Stats[0] = 0;
1628     *Statistics = stats;
1629     return RPC_S_OK;
1630   }
1631   return RPC_S_OUT_OF_RESOURCES;
1632 }
1633
1634 /***********************************************************************
1635  *             RpcMgmtStatsVectorFree (RPCRT4.@)
1636  */
1637 RPC_STATUS WINAPI RpcMgmtStatsVectorFree(RPC_STATS_VECTOR **StatsVector)
1638 {
1639   FIXME("(%p)\n", StatsVector);
1640
1641   if (StatsVector)
1642   {
1643     HeapFree(GetProcessHeap(), 0, *StatsVector);
1644     *StatsVector = NULL;
1645   }
1646   return RPC_S_OK;
1647 }
1648
1649 /***********************************************************************
1650  *             RpcMgmtEpEltInqBegin (RPCRT4.@)
1651  */
1652 RPC_STATUS WINAPI RpcMgmtEpEltInqBegin(RPC_BINDING_HANDLE Binding, ULONG InquiryType,
1653     RPC_IF_ID *IfId, ULONG VersOption, UUID *ObjectUuid, RPC_EP_INQ_HANDLE* InquiryContext)
1654 {
1655   FIXME("(%p,%u,%p,%u,%p,%p): stub\n",
1656         Binding, InquiryType, IfId, VersOption, ObjectUuid, InquiryContext);
1657   return RPC_S_INVALID_BINDING;
1658 }
1659
1660 /***********************************************************************
1661  *             RpcMgmtIsServerListening (RPCRT4.@)
1662  */
1663 RPC_STATUS WINAPI RpcMgmtIsServerListening(RPC_BINDING_HANDLE Binding)
1664 {
1665   RPC_STATUS status = RPC_S_NOT_LISTENING;
1666
1667   TRACE("(%p)\n", Binding);
1668
1669   if (Binding) {
1670     RpcBinding *rpc_binding = (RpcBinding*)Binding;
1671     status = RPCRT4_IsServerListening(rpc_binding->Protseq, rpc_binding->Endpoint);
1672   }else {
1673     EnterCriticalSection(&listen_cs);
1674     if (manual_listen_count > 0) status = RPC_S_OK;
1675     LeaveCriticalSection(&listen_cs);
1676   }
1677
1678   return status;
1679 }
1680
1681 /***********************************************************************
1682  *             RpcMgmtSetAuthorizationFn (RPCRT4.@)
1683  */
1684 RPC_STATUS WINAPI RpcMgmtSetAuthorizationFn(RPC_MGMT_AUTHORIZATION_FN fn)
1685 {
1686   FIXME("(%p): stub\n", fn);
1687   return RPC_S_OK;
1688 }
1689
1690 /***********************************************************************
1691  *             RpcMgmtSetServerStackSize (RPCRT4.@)
1692  */
1693 RPC_STATUS WINAPI RpcMgmtSetServerStackSize(ULONG ThreadStackSize)
1694 {
1695   FIXME("(0x%x): stub\n", ThreadStackSize);
1696   return RPC_S_OK;
1697 }
1698
1699 /***********************************************************************
1700  *             I_RpcGetCurrentCallHandle (RPCRT4.@)
1701  */
1702 RPC_BINDING_HANDLE WINAPI I_RpcGetCurrentCallHandle(void)
1703 {
1704     TRACE("\n");
1705     return RPCRT4_GetThreadCurrentCallHandle();
1706 }