source3/rpc_client/cli_pipe_schannel.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "../librpc/gen_ndr/ndr_schannel.h"
  22 #include "../librpc/gen_ndr/ndr_netlogon.h"
  23 #include "../libcli/auth/schannel.h"
  24 #include "rpc_client/cli_netlogon.h"
  25 #include "rpc_client/cli_pipe.h"
  26 #include "librpc/rpc/dcerpc.h"
  27 #include "passdb.h"
  28 #include "libsmb/libsmb.h"
  29 #include "../libcli/smb/smbXcli_base.h"
  30 #include "libcli/auth/netlogon_creds_cli.h"
  31
  32 #undef DBGC_CLASS
  33 #define DBGC_CLASS DBGC_RPC_CLI
  34
  35 /****************************************************************************
  36  Open a named pipe to an SMB server and bind using schannel (bind type 68).
  37  Fetch the session key ourselves using a temporary netlogon pipe.
  38  ****************************************************************************/
  39
  40 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
  41                                     struct messaging_context *msg_ctx,
  42                                     const struct ndr_interface_table *table,
  43                                     enum dcerpc_transport_t transport,
  44                                     const char *domain,
  45                                     const char *remote_name,
  46                                     const struct sockaddr_storage *remote_sockaddr,
  47                                     struct rpc_pipe_client **presult,
  48                                     TALLOC_CTX *mem_ctx,
  49                                     struct netlogon_creds_cli_context **pcreds)
  50 {
  51         TALLOC_CTX *frame = talloc_stackframe();
  52         struct rpc_pipe_client *result = NULL;
  53         NTSTATUS status;
  54         struct cli_credentials *cli_creds = NULL;
  55         struct netlogon_creds_cli_context *netlogon_creds = NULL;
  56         struct netlogon_creds_CredentialState *creds = NULL;
  57         uint32_t netlogon_flags;
  58
  59         status = pdb_get_trust_credentials(domain, NULL,
  60                                            frame, &cli_creds);
  61         if (!NT_STATUS_IS_OK(status)) {
  62                 TALLOC_FREE(frame);
  63                 return status;
  64         }
  65
  66         status = rpccli_create_netlogon_creds_ctx(cli_creds,
  67                                                   remote_name,
  68                                                   msg_ctx,
  69                                                   frame,
  70                                                   &netlogon_creds);
  71         if (!NT_STATUS_IS_OK(status)) {
  72                 TALLOC_FREE(frame);
  73                 return status;
  74         }
  75
  76         if (table == &ndr_table_netlogon) {
  77                 status = rpccli_connect_netlogon(cli,
  78                                                  transport,
  79                                                  remote_name,
  80                                                  remote_sockaddr,
  81                                                  netlogon_creds,
  82                                                  false, /* force_reauth */
  83                                                  cli_creds,
  84                                                  &result);
  85                 if (!NT_STATUS_IS_OK(status)) {
  86                         TALLOC_FREE(frame);
  87                         return status;
  88                 }
  89                 goto done;
  90         }
  91
  92         status = rpccli_setup_netlogon_creds(cli,
  93                                              transport,
  94                                              remote_name,
  95                                              remote_sockaddr,
  96                                              netlogon_creds,
  97                                              false, /* force_reauth */
  98                                              cli_creds);
  99         if (!NT_STATUS_IS_OK(status)) {
 100                 TALLOC_FREE(frame);
 101                 return status;
 102         }
 103
 104         status = netlogon_creds_cli_get(netlogon_creds, frame, &creds);
 105         if (!NT_STATUS_IS_OK(status)) {
 106                 TALLOC_FREE(frame);
 107                 return status;
 108         }
 109
 110         netlogon_flags = creds->negotiate_flags;
 111         TALLOC_FREE(creds);
 112
 113         if (netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC) {
 114                 status = cli_rpc_pipe_open_schannel_with_creds(cli, table,
 115                                                                transport,
 116                                                                netlogon_creds,
 117                                                                remote_name,
 118                                                                remote_sockaddr,
 119                                                                &result);
 120                 if (!NT_STATUS_IS_OK(status)) {
 121                         TALLOC_FREE(frame);
 122                         return status;
 123                 }
 124         } else {
 125                 status = cli_rpc_pipe_open_noauth(cli, table, &result);
 126                 if (!NT_STATUS_IS_OK(status)) {
 127                         TALLOC_FREE(frame);
 128                         return status;
 129                 }
 130         }
 131
 132 done:
 133         *presult = result;
 134         if (pcreds != NULL) {
 135                 *pcreds = talloc_move(mem_ctx, &netlogon_creds);
 136         }
 137
 138         TALLOC_FREE(frame);
 139         return NT_STATUS_OK;
 140 }