1998-09-26 01:01:52 +04:00
/*
2002-01-30 09:08:46 +03:00
Unix SMB / CIFS implementation .
2001-01-12 01:49:30 +03:00
RPC pipe client
2001-08-28 01:32:06 +04:00
Copyright ( C ) Tim Potter 2000 - 2001
2003-02-26 02:53:38 +03:00
Copyright ( C ) Martin Pool 2003
2001-01-12 01:49:30 +03:00
1998-09-26 01:01:52 +04:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
2007-07-09 23:25:36 +04:00
the Free Software Foundation ; either version 3 of the License , or
1998-09-26 01:01:52 +04:00
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
2007-07-10 04:52:41 +04:00
along with this program . If not , see < http : //www.gnu.org/licenses/>.
1998-09-26 01:01:52 +04:00
*/
# include "includes.h"
2001-10-12 09:56:23 +04:00
# include "rpcclient.h"
2001-01-12 01:49:30 +03:00
2001-05-24 04:20:32 +04:00
DOM_SID domain_sid ;
2001-01-16 02:35:59 +03:00
2005-09-30 21:13:37 +04:00
static enum pipe_auth_type pipe_default_auth_type = PIPE_AUTH_TYPE_NONE ;
static enum pipe_auth_level pipe_default_auth_level = PIPE_AUTH_LEVEL_NONE ;
2006-10-17 03:27:38 +04:00
static unsigned int timeout = 0 ;
2003-02-26 02:53:38 +03:00
/* List to hold groups of commands.
*
* Commands are defined in a list of arrays : arrays are easy to
* statically declare , and lists are easier to dynamically extend .
*/
2001-05-24 04:20:32 +04:00
2001-04-28 04:32:56 +04:00
static struct cmd_list {
struct cmd_list * prev , * next ;
struct cmd_set * cmd_set ;
} * cmd_list ;
/****************************************************************************
handle completion of commands for readline
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2003-08-15 08:42:05 +04:00
static char * * completion_fn ( const char * text , int start , int end )
2001-04-28 04:32:56 +04:00
{
# define MAX_COMPLETIONS 100
char * * matches ;
int i , count = 0 ;
struct cmd_list * commands = cmd_list ;
#if 0 /* JERRY */
/* FIXME!!! -- what to do when completing argument? */
/* for words not at the start of the line fallback
to filename completion */
if ( start )
return NULL ;
# endif
/* make sure we have a list of valid commands */
2006-03-13 22:40:51 +03:00
if ( ! commands ) {
2001-04-28 04:32:56 +04:00
return NULL ;
2006-03-13 22:40:51 +03:00
}
2001-04-28 04:32:56 +04:00
2004-12-07 21:25:53 +03:00
matches = SMB_MALLOC_ARRAY ( char * , MAX_COMPLETIONS ) ;
2006-03-13 22:40:51 +03:00
if ( ! matches ) {
return NULL ;
}
2001-04-28 04:32:56 +04:00
2004-12-07 21:25:53 +03:00
matches [ count + + ] = SMB_STRDUP ( text ) ;
2006-03-13 22:40:51 +03:00
if ( ! matches [ 0 ] ) {
SAFE_FREE ( matches ) ;
return NULL ;
}
2001-04-28 04:32:56 +04:00
2006-03-13 22:40:51 +03:00
while ( commands & & count < MAX_COMPLETIONS - 1 ) {
if ( ! commands - > cmd_set ) {
2001-04-28 04:32:56 +04:00
break ;
2006-03-13 22:40:51 +03:00
}
2001-04-28 04:32:56 +04:00
2006-03-13 22:40:51 +03:00
for ( i = 0 ; commands - > cmd_set [ i ] . name ; i + + ) {
2001-04-28 04:32:56 +04:00
if ( ( strncmp ( text , commands - > cmd_set [ i ] . name , strlen ( text ) ) = = 0 ) & &
2003-03-18 09:30:30 +03:00
( ( commands - > cmd_set [ i ] . returntype = = RPC_RTYPE_NTSTATUS & &
commands - > cmd_set [ i ] . ntfn ) | |
( commands - > cmd_set [ i ] . returntype = = RPC_RTYPE_WERROR & &
2006-03-13 22:40:51 +03:00
commands - > cmd_set [ i ] . wfn ) ) ) {
2004-12-07 21:25:53 +03:00
matches [ count ] = SMB_STRDUP ( commands - > cmd_set [ i ] . name ) ;
2006-03-13 22:40:51 +03:00
if ( ! matches [ count ] ) {
for ( i = 0 ; i < count ; i + + ) {
SAFE_FREE ( matches [ count ] ) ;
}
SAFE_FREE ( matches ) ;
2001-04-28 04:32:56 +04:00
return NULL ;
2006-03-13 22:40:51 +03:00
}
2001-04-28 04:32:56 +04:00
count + + ;
}
}
commands = commands - > next ;
}
if ( count = = 2 ) {
2001-09-17 14:26:23 +04:00
SAFE_FREE ( matches [ 0 ] ) ;
2004-12-07 21:25:53 +03:00
matches [ 0 ] = SMB_STRDUP ( matches [ 1 ] ) ;
2001-04-28 04:32:56 +04:00
}
matches [ count ] = NULL ;
return matches ;
}
2007-06-07 05:13:43 +04:00
static char * next_command ( char * * cmdstr )
2001-05-31 22:35:14 +04:00
{
2007-06-07 05:13:43 +04:00
char * command ;
2001-05-31 22:35:14 +04:00
char * p ;
if ( ! cmdstr | | ! ( * cmdstr ) )
return NULL ;
2001-07-04 11:36:09 +04:00
p = strchr_m ( * cmdstr , ' ; ' ) ;
2001-05-31 22:35:14 +04:00
if ( p )
* p = ' \0 ' ;
2007-06-07 05:13:43 +04:00
command = SMB_STRDUP ( * cmdstr ) ;
2003-02-26 02:53:38 +03:00
if ( p )
* cmdstr = p + 1 ;
else
* cmdstr = NULL ;
2001-05-31 22:35:14 +04:00
return command ;
}
2001-10-22 10:13:38 +04:00
/* Fetch the SID for this computer */
2001-07-20 08:38:58 +04:00
2002-07-15 14:35:28 +04:00
static void fetch_machine_sid ( struct cli_state * cli )
2001-01-16 02:35:59 +03:00
{
POLICY_HND pol ;
2001-09-04 11:13:01 +04:00
NTSTATUS result = NT_STATUS_OK ;
uint32 info_class = 5 ;
2004-01-17 01:15:35 +03:00
char * domain_name = NULL ;
2001-01-16 02:35:59 +03:00
static BOOL got_domain_sid ;
2001-04-28 04:32:56 +04:00
TALLOC_CTX * mem_ctx ;
2004-01-17 01:15:35 +03:00
DOM_SID * dom_sid = NULL ;
2005-09-30 21:13:37 +04:00
struct rpc_pipe_client * lsapipe = NULL ;
2001-01-16 02:35:59 +03:00
if ( got_domain_sid ) return ;
2005-09-30 21:13:37 +04:00
if ( ! ( mem_ctx = talloc_init ( " fetch_machine_sid " ) ) ) {
2002-07-15 14:35:28 +04:00
DEBUG ( 0 , ( " fetch_machine_sid: talloc_init returned NULL! \n " ) ) ;
2001-04-28 04:32:56 +04:00
goto error ;
}
2005-09-30 21:13:37 +04:00
if ( ( lsapipe = cli_rpc_pipe_open_noauth ( cli , PI_LSARPC , & result ) ) = = NULL ) {
fprintf ( stderr , " could not initialise lsa pipe. Error was %s \n " , nt_errstr ( result ) ) ;
2001-01-16 02:35:59 +03:00
goto error ;
}
2001-03-14 23:22:57 +03:00
2005-09-30 21:13:37 +04:00
result = rpccli_lsa_open_policy ( lsapipe , mem_ctx , True ,
2001-09-04 11:13:01 +04:00
SEC_RIGHTS_MAXIMUM_ALLOWED ,
& pol ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
2001-01-16 02:35:59 +03:00
goto error ;
}
2005-09-30 21:13:37 +04:00
result = rpccli_lsa_query_info_policy ( lsapipe , mem_ctx , & pol , info_class ,
2004-01-17 01:15:35 +03:00
& domain_name , & dom_sid ) ;
2001-09-04 11:13:01 +04:00
if ( ! NT_STATUS_IS_OK ( result ) ) {
2001-01-16 02:35:59 +03:00
goto error ;
}
got_domain_sid = True ;
2004-01-17 01:15:35 +03:00
sid_copy ( & domain_sid , dom_sid ) ;
2001-01-16 02:35:59 +03:00
2006-09-21 02:49:02 +04:00
rpccli_lsa_Close ( lsapipe , mem_ctx , & pol ) ;
2005-09-30 21:13:37 +04:00
cli_rpc_pipe_close ( lsapipe ) ;
2001-04-28 04:32:56 +04:00
talloc_destroy ( mem_ctx ) ;
2001-01-16 02:35:59 +03:00
return ;
error :
2005-09-30 21:13:37 +04:00
if ( lsapipe ) {
cli_rpc_pipe_close ( lsapipe ) ;
}
2001-03-16 01:06:53 +03:00
fprintf ( stderr , " could not obtain sid for domain %s \n " , cli - > domain ) ;
2001-01-16 02:35:59 +03:00
2001-09-04 11:13:01 +04:00
if ( ! NT_STATUS_IS_OK ( result ) ) {
2002-03-17 07:36:35 +03:00
fprintf ( stderr , " error: %s \n " , nt_errstr ( result ) ) ;
2001-01-16 02:35:59 +03:00
}
exit ( 1 ) ;
}
2002-04-03 03:28:40 +04:00
/* List the available commands on a given pipe */
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_listcommands ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
2003-02-26 02:53:38 +03:00
int argc , const char * * argv )
2002-04-03 03:28:40 +04:00
{
struct cmd_list * tmp ;
struct cmd_set * tmp_set ;
int i ;
/* Usage */
if ( argc ! = 2 ) {
printf ( " Usage: %s <pipe> \n " , argv [ 0 ] ) ;
return NT_STATUS_OK ;
}
/* Help on one command */
for ( tmp = cmd_list ; tmp ; tmp = tmp - > next )
{
tmp_set = tmp - > cmd_set ;
if ( ! StrCaseCmp ( argv [ 1 ] , tmp_set - > name ) )
{
printf ( " Available commands on the %s pipe: \n \n " , tmp_set - > name ) ;
i = 0 ;
tmp_set + + ;
while ( tmp_set - > name ) {
2005-06-08 17:59:03 +04:00
printf ( " %30s " , tmp_set - > name ) ;
2002-04-03 03:28:40 +04:00
tmp_set + + ;
i + + ;
2005-06-08 17:59:03 +04:00
if ( i % 3 = = 0 )
2002-04-03 03:28:40 +04:00
printf ( " \n " ) ;
}
/* drop out of the loop */
break ;
}
}
printf ( " \n \n " ) ;
return NT_STATUS_OK ;
}
2001-01-12 01:49:30 +03:00
2001-07-20 08:38:58 +04:00
/* Display help on commands */
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_help ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
2003-02-26 02:53:38 +03:00
int argc , const char * * argv )
2001-01-12 01:49:30 +03:00
{
2001-07-20 08:38:58 +04:00
struct cmd_list * tmp ;
struct cmd_set * tmp_set ;
/* Usage */
if ( argc > 2 ) {
printf ( " Usage: %s [command] \n " , argv [ 0 ] ) ;
2001-09-15 07:57:12 +04:00
return NT_STATUS_OK ;
2001-07-20 08:38:58 +04:00
}
/* Help on one command */
if ( argc = = 2 ) {
for ( tmp = cmd_list ; tmp ; tmp = tmp - > next ) {
tmp_set = tmp - > cmd_set ;
while ( tmp_set - > name ) {
if ( strequal ( argv [ 1 ] , tmp_set - > name ) ) {
if ( tmp_set - > usage & &
tmp_set - > usage [ 0 ] )
printf ( " %s \n " , tmp_set - > usage ) ;
else
printf ( " No help for %s \n " , tmp_set - > name ) ;
2001-09-15 07:57:12 +04:00
return NT_STATUS_OK ;
2001-07-20 08:38:58 +04:00
}
tmp_set + + ;
}
}
2001-01-12 01:49:30 +03:00
2001-07-20 08:38:58 +04:00
printf ( " No such command: %s \n " , argv [ 1 ] ) ;
2001-09-15 07:57:12 +04:00
return NT_STATUS_OK ;
2001-07-20 08:38:58 +04:00
}
/* List all commands */
for ( tmp = cmd_list ; tmp ; tmp = tmp - > next ) {
tmp_set = tmp - > cmd_set ;
while ( tmp_set - > name ) {
2001-01-12 01:49:30 +03:00
2001-07-20 08:38:58 +04:00
printf ( " %15s \t \t %s \n " , tmp_set - > name ,
2001-12-21 04:16:37 +03:00
tmp_set - > description ? tmp_set - > description :
" " ) ;
2001-07-20 08:38:58 +04:00
tmp_set + + ;
2001-01-12 01:49:30 +03:00
}
}
2001-09-15 07:57:12 +04:00
return NT_STATUS_OK ;
2001-01-12 01:49:30 +03:00
}
2001-07-20 08:38:58 +04:00
/* Change the debug level */
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_debuglevel ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
2003-02-26 02:53:38 +03:00
int argc , const char * * argv )
2001-01-12 01:49:30 +03:00
{
if ( argc > 2 ) {
printf ( " Usage: %s [debuglevel] \n " , argv [ 0 ] ) ;
2001-08-27 23:46:22 +04:00
return NT_STATUS_OK ;
2001-01-12 01:49:30 +03:00
}
if ( argc = = 2 ) {
DEBUGLEVEL = atoi ( argv [ 1 ] ) ;
}
printf ( " debuglevel is %d \n " , DEBUGLEVEL ) ;
2001-08-27 23:46:22 +04:00
return NT_STATUS_OK ;
2001-01-12 01:49:30 +03:00
}
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_quit ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
2003-02-26 02:53:38 +03:00
int argc , const char * * argv )
2001-01-16 02:35:59 +03:00
{
exit ( 0 ) ;
2001-08-27 23:46:22 +04:00
return NT_STATUS_OK ; /* NOTREACHED */
2001-01-16 02:35:59 +03:00
}
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_set_ss_level ( void )
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
{
2005-09-30 21:13:37 +04:00
struct cmd_list * tmp ;
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
2005-09-30 21:13:37 +04:00
/* Close any existing connections not at this level. */
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
2005-09-30 21:13:37 +04:00
for ( tmp = cmd_list ; tmp ; tmp = tmp - > next ) {
struct cmd_set * tmp_set ;
for ( tmp_set = tmp - > cmd_set ; tmp_set - > name ; tmp_set + + ) {
if ( tmp_set - > rpc_pipe = = NULL ) {
continue ;
}
if ( tmp_set - > rpc_pipe - > auth . auth_type ! = pipe_default_auth_type | |
tmp_set - > rpc_pipe - > auth . auth_level ! = pipe_default_auth_level ) {
cli_rpc_pipe_close ( tmp_set - > rpc_pipe ) ;
tmp_set - > rpc_pipe = NULL ;
}
}
}
return NT_STATUS_OK ;
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
}
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_sign ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
int argc , const char * * argv )
{
2005-09-30 21:13:37 +04:00
pipe_default_auth_level = PIPE_AUTH_LEVEL_INTEGRITY ;
pipe_default_auth_type = PIPE_AUTH_TYPE_NTLMSSP ;
if ( argc > 2 ) {
printf ( " Usage: %s [NTLMSSP|NTLMSSP_SPNEGO|SCHANNEL] \n " , argv [ 0 ] ) ;
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
return NT_STATUS_OK ;
}
2003-07-25 05:26:19 +04:00
if ( argc = = 2 ) {
2005-09-30 21:13:37 +04:00
if ( strequal ( argv [ 1 ] , " NTLMSSP " ) ) {
pipe_default_auth_type = PIPE_AUTH_TYPE_NTLMSSP ;
} else if ( strequal ( argv [ 1 ] , " NTLMSSP_SPNEGO " ) ) {
pipe_default_auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP ;
} else if ( strequal ( argv [ 1 ] , " SCHANNEL " ) ) {
pipe_default_auth_type = PIPE_AUTH_TYPE_SCHANNEL ;
} else {
printf ( " unknown type %s \n " , argv [ 1 ] ) ;
return NT_STATUS_INVALID_LEVEL ;
}
2003-07-25 05:26:19 +04:00
}
2005-09-30 21:13:37 +04:00
printf ( " debuglevel is %d \n " , DEBUGLEVEL ) ;
return cmd_set_ss_level ( ) ;
}
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_seal ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
int argc , const char * * argv )
{
pipe_default_auth_level = PIPE_AUTH_LEVEL_PRIVACY ;
pipe_default_auth_type = PIPE_AUTH_TYPE_NTLMSSP ;
if ( argc > 2 ) {
printf ( " Usage: %s [NTLMSSP|NTLMSSP_SPNEGO|SCHANNEL] \n " , argv [ 0 ] ) ;
return NT_STATUS_OK ;
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
}
2005-09-30 21:13:37 +04:00
if ( argc = = 2 ) {
if ( strequal ( argv [ 1 ] , " NTLMSSP " ) ) {
pipe_default_auth_type = PIPE_AUTH_TYPE_NTLMSSP ;
} else if ( strequal ( argv [ 1 ] , " NTLMSSP_SPNEGO " ) ) {
pipe_default_auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP ;
} else if ( strequal ( argv [ 1 ] , " SCHANNEL " ) ) {
pipe_default_auth_type = PIPE_AUTH_TYPE_SCHANNEL ;
} else {
printf ( " unknown type %s \n " , argv [ 1 ] ) ;
return NT_STATUS_INVALID_LEVEL ;
}
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
}
2005-09-30 21:13:37 +04:00
return cmd_set_ss_level ( ) ;
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
}
2006-10-17 03:27:38 +04:00
static NTSTATUS cmd_timeout ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
int argc , const char * * argv )
{
struct cmd_list * tmp ;
if ( argc > 2 ) {
printf ( " Usage: %s timeout \n " , argv [ 0 ] ) ;
return NT_STATUS_OK ;
}
if ( argc = = 2 ) {
timeout = atoi ( argv [ 1 ] ) ;
for ( tmp = cmd_list ; tmp ; tmp = tmp - > next ) {
struct cmd_set * tmp_set ;
for ( tmp_set = tmp - > cmd_set ; tmp_set - > name ; tmp_set + + ) {
if ( tmp_set - > rpc_pipe = = NULL ) {
continue ;
}
cli_set_timeout ( tmp_set - > rpc_pipe - > cli , timeout ) ;
}
}
}
printf ( " timeout is %d \n " , timeout ) ;
return NT_STATUS_OK ;
}
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_none ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
int argc , const char * * argv )
{
pipe_default_auth_level = PIPE_AUTH_LEVEL_NONE ;
pipe_default_auth_type = PIPE_AUTH_TYPE_NONE ;
return cmd_set_ss_level ( ) ;
}
2003-10-02 01:18:32 +04:00
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_schannel ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
2003-10-02 01:18:32 +04:00
int argc , const char * * argv )
{
d_printf ( " Setting schannel - sign and seal \n " ) ;
2005-09-30 21:13:37 +04:00
pipe_default_auth_level = PIPE_AUTH_LEVEL_PRIVACY ;
pipe_default_auth_type = PIPE_AUTH_TYPE_SCHANNEL ;
return cmd_set_ss_level ( ) ;
2003-10-02 01:18:32 +04:00
}
2005-09-30 21:13:37 +04:00
static NTSTATUS cmd_schannel_sign ( struct rpc_pipe_client * cli , TALLOC_CTX * mem_ctx ,
2003-10-02 01:18:32 +04:00
int argc , const char * * argv )
{
d_printf ( " Setting schannel - sign only \n " ) ;
2005-09-30 21:13:37 +04:00
pipe_default_auth_level = PIPE_AUTH_LEVEL_INTEGRITY ;
pipe_default_auth_type = PIPE_AUTH_TYPE_SCHANNEL ;
return cmd_set_ss_level ( ) ;
2003-10-02 01:18:32 +04:00
}
2003-02-26 02:53:38 +03:00
/* Built in rpcclient commands */
2001-01-12 01:49:30 +03:00
static struct cmd_set rpcclient_commands [ ] = {
2001-07-20 08:38:58 +04:00
{ " GENERAL OPTIONS " } ,
2005-09-30 21:13:37 +04:00
{ " help " , RPC_RTYPE_NTSTATUS , cmd_help , NULL , - 1 , NULL , " Get help on commands " , " [command] " } ,
{ " ? " , RPC_RTYPE_NTSTATUS , cmd_help , NULL , - 1 , NULL , " Get help on commands " , " [command] " } ,
{ " debuglevel " , RPC_RTYPE_NTSTATUS , cmd_debuglevel , NULL , - 1 , NULL , " Set debug level " , " level " } ,
2006-09-19 22:32:13 +04:00
{ " debug " , RPC_RTYPE_NTSTATUS , cmd_debuglevel , NULL , - 1 , NULL , " Set debug level " , " level " } ,
2005-09-30 21:13:37 +04:00
{ " list " , RPC_RTYPE_NTSTATUS , cmd_listcommands , NULL , - 1 , NULL , " List available commands on <pipe> " , " pipe " } ,
{ " exit " , RPC_RTYPE_NTSTATUS , cmd_quit , NULL , - 1 , NULL , " Exit program " , " " } ,
{ " quit " , RPC_RTYPE_NTSTATUS , cmd_quit , NULL , - 1 , NULL , " Exit program " , " " } ,
{ " sign " , RPC_RTYPE_NTSTATUS , cmd_sign , NULL , - 1 , NULL , " Force RPC pipe connections to be signed " , " " } ,
{ " seal " , RPC_RTYPE_NTSTATUS , cmd_seal , NULL , - 1 , NULL , " Force RPC pipe connections to be sealed " , " " } ,
{ " schannel " , RPC_RTYPE_NTSTATUS , cmd_schannel , NULL , - 1 , NULL , " Force RPC pipe connections to be sealed with 'schannel'. Assumes valid machine account to this domain controller. " , " " } ,
{ " schannelsign " , RPC_RTYPE_NTSTATUS , cmd_schannel_sign , NULL , - 1 , NULL , " Force RPC pipe connections to be signed (not sealed) with 'schannel'. Assumes valid machine account to this domain controller. " , " " } ,
2006-10-17 03:28:48 +04:00
{ " timeout " , RPC_RTYPE_NTSTATUS , cmd_timeout , NULL , - 1 , NULL , " Set timeout (in milliseonds) for RPC operations " , " " } ,
2005-09-30 21:13:37 +04:00
{ " none " , RPC_RTYPE_NTSTATUS , cmd_none , NULL , - 1 , NULL , " Force RPC pipe connections to have no special properties " , " " } ,
2001-07-20 08:38:58 +04:00
{ NULL }
2001-01-12 01:49:30 +03:00
} ;
2001-03-15 05:15:05 +03:00
static struct cmd_set separator_command [ ] = {
2005-09-30 21:13:37 +04:00
{ " --------------- " , MAX_RPC_RETURN_TYPE , NULL , NULL , - 1 , NULL , " ---------------------- " } ,
2001-07-20 08:38:58 +04:00
{ NULL }
2001-03-15 05:15:05 +03:00
} ;
2001-05-24 04:20:32 +04:00
/* Various pipe commands */
2006-07-11 22:01:26 +04:00
extern struct cmd_set unixinfo_commands [ ] ;
2001-05-24 04:20:32 +04:00
extern struct cmd_set lsarpc_commands [ ] ;
extern struct cmd_set samr_commands [ ] ;
extern struct cmd_set spoolss_commands [ ] ;
extern struct cmd_set netlogon_commands [ ] ;
extern struct cmd_set srvsvc_commands [ ] ;
2001-06-06 11:35:08 +04:00
extern struct cmd_set dfs_commands [ ] ;
2002-10-04 23:33:41 +04:00
extern struct cmd_set ds_commands [ ] ;
2003-04-14 06:08:03 +04:00
extern struct cmd_set echo_commands [ ] ;
2003-10-24 17:49:29 +04:00
extern struct cmd_set shutdown_commands [ ] ;
2005-09-30 21:13:37 +04:00
extern struct cmd_set test_commands [ ] ;
2001-05-24 04:20:32 +04:00
static struct cmd_set * rpcclient_command_list [ ] = {
rpcclient_commands ,
2006-07-11 22:01:26 +04:00
unixinfo_commands ,
2001-05-24 04:20:32 +04:00
lsarpc_commands ,
2002-10-04 23:33:41 +04:00
ds_commands ,
2001-05-24 04:20:32 +04:00
samr_commands ,
spoolss_commands ,
netlogon_commands ,
srvsvc_commands ,
2001-06-06 11:35:08 +04:00
dfs_commands ,
2003-04-14 06:08:03 +04:00
echo_commands ,
2003-10-24 17:49:29 +04:00
shutdown_commands ,
2005-09-30 21:13:37 +04:00
test_commands ,
2001-05-24 04:20:32 +04:00
NULL
} ;
2001-10-12 09:56:23 +04:00
static void add_command_set ( struct cmd_set * cmd_set )
2001-01-12 01:49:30 +03:00
{
struct cmd_list * entry ;
2004-12-07 21:25:53 +03:00
if ( ! ( entry = SMB_MALLOC_P ( struct cmd_list ) ) ) {
2001-01-12 01:49:30 +03:00
DEBUG ( 0 , ( " out of memory \n " ) ) ;
return ;
}
ZERO_STRUCTP ( entry ) ;
entry - > cmd_set = cmd_set ;
DLIST_ADD ( cmd_list , entry ) ;
}
2003-02-26 02:53:38 +03:00
/**
* Call an rpcclient function , passing an argv array .
*
* @ param cmd Command to run , as a single string .
* */
static NTSTATUS do_cmd ( struct cli_state * cli ,
struct cmd_set * cmd_entry ,
int argc , char * * argv )
{
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
NTSTATUS ntresult ;
WERROR wresult ;
2003-02-26 02:53:38 +03:00
TALLOC_CTX * mem_ctx ;
2001-01-12 01:49:30 +03:00
2003-02-26 02:53:38 +03:00
/* Create mem_ctx */
2001-01-12 21:19:57 +03:00
2003-02-26 02:53:38 +03:00
if ( ! ( mem_ctx = talloc_init ( " do_cmd " ) ) ) {
DEBUG ( 0 , ( " talloc_init() failed \n " ) ) ;
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
return NT_STATUS_NO_MEMORY ;
2001-01-12 01:49:30 +03:00
}
2003-02-26 02:53:38 +03:00
/* Open pipe */
2001-10-12 09:56:23 +04:00
2005-09-30 21:13:37 +04:00
if ( cmd_entry - > pipe_idx ! = - 1 & & cmd_entry - > rpc_pipe = = NULL ) {
switch ( pipe_default_auth_type ) {
case PIPE_AUTH_TYPE_NONE :
cmd_entry - > rpc_pipe = cli_rpc_pipe_open_noauth ( cli ,
cmd_entry - > pipe_idx ,
& ntresult ) ;
break ;
case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP :
cmd_entry - > rpc_pipe = cli_rpc_pipe_open_spnego_ntlmssp ( cli ,
cmd_entry - > pipe_idx ,
pipe_default_auth_level ,
lp_workgroup ( ) ,
cmdline_auth_info . username ,
cmdline_auth_info . password ,
& ntresult ) ;
break ;
case PIPE_AUTH_TYPE_NTLMSSP :
cmd_entry - > rpc_pipe = cli_rpc_pipe_open_ntlmssp ( cli ,
cmd_entry - > pipe_idx ,
pipe_default_auth_level ,
lp_workgroup ( ) ,
cmdline_auth_info . username ,
cmdline_auth_info . password ,
& ntresult ) ;
break ;
case PIPE_AUTH_TYPE_SCHANNEL :
cmd_entry - > rpc_pipe = cli_rpc_pipe_open_schannel ( cli ,
cmd_entry - > pipe_idx ,
pipe_default_auth_level ,
lp_workgroup ( ) ,
& ntresult ) ;
break ;
default :
DEBUG ( 0 , ( " Could not initialise %s. Invalid auth type %u \n " ,
cli_get_pipe_name ( cmd_entry - > pipe_idx ) ,
pipe_default_auth_type ) ) ;
return NT_STATUS_UNSUCCESSFUL ;
}
if ( ! cmd_entry - > rpc_pipe ) {
DEBUG ( 0 , ( " Could not initialise %s. Error was %s \n " ,
cli_get_pipe_name ( cmd_entry - > pipe_idx ) ,
nt_errstr ( ntresult ) ) ) ;
return ntresult ;
2003-05-08 12:02:52 +04:00
}
2003-07-30 21:29:00 +04:00
2005-09-30 21:13:37 +04:00
if ( cmd_entry - > pipe_idx = = PI_NETLOGON ) {
2007-09-28 07:54:42 +04:00
uint32 neg_flags = NETLOGON_NEG_SELECT_AUTH2_FLAGS ;
2005-09-30 21:13:37 +04:00
uint32 sec_channel_type ;
uchar trust_password [ 16 ] ;
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
2005-09-30 21:13:37 +04:00
if ( ! secrets_fetch_trust_account_password ( lp_workgroup ( ) ,
trust_password ,
NULL , & sec_channel_type ) ) {
return NT_STATUS_UNSUCCESSFUL ;
}
Jeremy requested that I get my NTLMSSP patch into CVS. He didn't request
the schannel code, but I've included that anyway. :-)
This patch revives the client-side NTLMSSP support for RPC named pipes
in Samba, and cleans up the client and server schannel code. The use of the
new code is enabled by the 'sign', 'seal' and 'schannel' commands in
rpcclient.
The aim was to prove that our separate NTLMSSP client library actually
implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation,
in the hope that knowing this will assist us in correctly implementing
NTLMSSP signing for SMB packets. (Still not yet functional)
This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with
calls to libsmb/ntlmssp.c. In the process, we have gained the ability to
use the more secure NT password, and the ability to sign-only, instead of
having to seal the pipe connection. (Previously we were limited to sealing,
and could only use the LM-password derived key).
Our new client-side NTLMSSP code also needed alteration to cope with our
comparatively simple server-side implementation. A future step is to replace
it with calls to the same NTLMSSP library.
Also included in this patch is the schannel 'sign only' patch I submitted to
the team earlier. While not enabled (and not functional, at this stage) the
work in this patch makes the code paths *much* easier to follow. I have also
included similar hooks in rpccleint to allow the use of schannel on *any* pipe.
rpcclient now defaults to not using schannel (or any other extra per-pipe
authenticiation) for any connection. The 'schannel' command enables schannel
for all pipes until disabled.
This code is also much more secure than the previous code, as changes to our
cli_pipe routines ensure that the authentication footer cannot be removed
by an attacker, and more error states are correctly handled.
(The same needs to be done to our server)
Andrew Bartlett
(This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2003-07-14 12:46:32 +04:00
2005-09-30 21:13:37 +04:00
ntresult = rpccli_netlogon_setup_creds ( cmd_entry - > rpc_pipe ,
2005-11-04 03:03:55 +03:00
cli - > desthost , /* server name */
lp_workgroup ( ) , /* domain */
global_myname ( ) , /* client name */
global_myname ( ) , /* machine account name */
2005-09-30 21:13:37 +04:00
trust_password ,
sec_channel_type ,
& neg_flags ) ;
if ( ! NT_STATUS_IS_OK ( ntresult ) ) {
DEBUG ( 0 , ( " Could not initialise credentials for %s. \n " ,
cli_get_pipe_name ( cmd_entry - > pipe_idx ) ) ) ;
return ntresult ;
}
2003-02-26 02:53:38 +03:00
}
2003-04-09 19:54:17 +04:00
}
2001-10-12 09:56:23 +04:00
2005-09-30 21:13:37 +04:00
/* Run command */
2003-03-18 09:30:30 +03:00
2005-09-30 21:13:37 +04:00
if ( cmd_entry - > returntype = = RPC_RTYPE_NTSTATUS ) {
ntresult = cmd_entry - > ntfn ( cmd_entry - > rpc_pipe , mem_ctx , argc , ( const char * * ) argv ) ;
if ( ! NT_STATUS_IS_OK ( ntresult ) ) {
printf ( " result was %s \n " , nt_errstr ( ntresult ) ) ;
}
} else {
wresult = cmd_entry - > wfn ( cmd_entry - > rpc_pipe , mem_ctx , argc , ( const char * * ) argv ) ;
/* print out the DOS error */
if ( ! W_ERROR_IS_OK ( wresult ) ) {
printf ( " result was %s \n " , dos_errstr ( wresult ) ) ;
}
ntresult = W_ERROR_IS_OK ( wresult ) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ;
}
2001-10-12 09:56:23 +04:00
2003-02-26 02:53:38 +03:00
/* Cleanup */
2001-10-12 09:56:23 +04:00
2003-02-26 02:53:38 +03:00
talloc_destroy ( mem_ctx ) ;
2001-10-12 09:56:23 +04:00
2003-03-18 09:30:30 +03:00
return ntresult ;
2001-01-12 01:49:30 +03:00
}
2003-02-26 02:53:38 +03:00
/**
* Process a command entered at the prompt or as part of - c
*
* @ returns The NTSTATUS from running the command .
* */
2001-09-04 11:13:01 +04:00
static NTSTATUS process_cmd ( struct cli_state * cli , char * cmd )
2001-01-12 01:49:30 +03:00
{
struct cmd_list * temp_list ;
2001-09-04 11:13:01 +04:00
NTSTATUS result = NT_STATUS_OK ;
2003-02-26 02:53:38 +03:00
int ret ;
int argc ;
char * * argv = NULL ;
2001-05-04 08:15:48 +04:00
2003-02-26 02:53:38 +03:00
if ( ( ret = poptParseArgvString ( cmd , & argc , ( const char * * * ) & argv ) ) ! = 0 ) {
fprintf ( stderr , " rpcclient: %s \n " , poptStrerror ( ret ) ) ;
return NT_STATUS_UNSUCCESSFUL ;
2001-01-12 01:49:30 +03:00
}
2003-02-26 02:53:38 +03:00
/* Walk through a dlist of arrays of commands. */
2001-01-12 01:49:30 +03:00
for ( temp_list = cmd_list ; temp_list ; temp_list = temp_list - > next ) {
struct cmd_set * temp_set = temp_list - > cmd_set ;
2003-02-26 02:53:38 +03:00
while ( temp_set - > name ) {
if ( strequal ( argv [ 0 ] , temp_set - > name ) ) {
2003-03-18 09:30:30 +03:00
if ( ! ( temp_set - > returntype = = RPC_RTYPE_NTSTATUS & & temp_set - > ntfn ) & &
! ( temp_set - > returntype = = RPC_RTYPE_WERROR & & temp_set - > wfn ) ) {
2003-02-26 02:53:38 +03:00
fprintf ( stderr , " Invalid command \n " ) ;
goto out_free ;
}
result = do_cmd ( cli , temp_set , argc , argv ) ;
2001-10-12 09:56:23 +04:00
2003-02-26 02:53:38 +03:00
goto out_free ;
2001-01-12 01:49:30 +03:00
}
temp_set + + ;
}
}
2003-02-26 02:53:38 +03:00
if ( argv [ 0 ] ) {
printf ( " command not found: %s \n " , argv [ 0 ] ) ;
2001-01-12 01:49:30 +03:00
}
2003-02-26 02:53:38 +03:00
out_free :
2003-03-18 09:30:30 +03:00
/* moved to do_cmd()
2001-09-04 11:13:01 +04:00
if ( ! NT_STATUS_IS_OK ( result ) ) {
2002-03-17 07:36:35 +03:00
printf ( " result was %s \n " , nt_errstr ( result ) ) ;
2001-01-12 01:49:30 +03:00
}
2003-03-18 09:30:30 +03:00
*/
2001-01-12 01:49:30 +03:00
2006-03-12 20:44:00 +03:00
/* NOTE: popt allocates the whole argv, including the
* strings , as a single block . So a single free is
* enough to release it - - we don ' t free the
* individual strings . rtfm . */
free ( argv ) ;
2003-02-26 02:53:38 +03:00
2001-01-12 01:49:30 +03:00
return result ;
}
2001-03-14 23:22:57 +03:00
2001-01-12 01:49:30 +03:00
/* Main function */
1998-09-26 01:01:52 +04:00
2000-07-03 08:28:29 +04:00
int main ( int argc , char * argv [ ] )
1999-12-13 16:27:58 +03:00
{
2001-03-16 01:06:53 +03:00
int opt ;
2003-04-14 07:31:19 +04:00
static char * cmdstr = NULL ;
2002-07-15 14:35:28 +04:00
const char * server ;
2001-12-03 10:42:18 +03:00
struct cli_state * cli ;
2003-04-14 07:31:19 +04:00
static char * opt_ipaddr = NULL ;
2002-03-08 06:31:01 +03:00
struct cmd_set * * cmd_set ;
struct in_addr server_ip ;
NTSTATUS nt_status ;
2005-01-10 13:23:57 +03:00
static int opt_port = 0 ;
2006-02-08 22:28:25 +03:00
fstring new_workgroup ;
2002-03-08 06:31:01 +03:00
/* make sure the vars that get altered (4th field) are in
a fixed location or certain compilers complain */
2002-03-07 21:56:51 +03:00
poptContext pc ;
struct poptOption long_options [ ] = {
2002-09-25 19:19:00 +04:00
POPT_AUTOHELP
2002-10-28 22:45:47 +03:00
{ " command " , ' c ' , POPT_ARG_STRING , & cmdstr , ' c ' , " Execute semicolon separated cmds " , " COMMANDS " } ,
{ " dest-ip " , ' I ' , POPT_ARG_STRING , & opt_ipaddr , ' I ' , " Specify destination IP address " , " IP " } ,
2005-01-10 13:23:57 +03:00
{ " port " , ' p ' , POPT_ARG_INT , & opt_port , ' p ' , " Specify port number " , " PORT " } ,
2003-04-14 07:31:19 +04:00
POPT_COMMON_SAMBA
POPT_COMMON_CONNECTION
POPT_COMMON_CREDENTIALS
POPT_TABLEEND
2002-03-07 21:56:51 +03:00
} ;
2005-12-29 22:30:06 +03:00
load_case_tables ( ) ;
2003-03-18 09:30:30 +03:00
ZERO_STRUCT ( server_ip ) ;
2001-01-12 01:49:30 +03:00
setlinebuf ( stdout ) ;
2003-04-28 11:05:50 +04:00
/* the following functions are part of the Samba debugging
facilities . See lib / debug . c */
2006-03-15 00:01:30 +03:00
setup_logging ( " rpcclient " , True ) ;
2003-04-28 11:05:50 +04:00
2002-02-26 23:04:54 +03:00
/* Parse options */
2002-03-07 07:03:21 +03:00
2002-09-25 19:19:00 +04:00
pc = poptGetContext ( " rpcclient " , argc , ( const char * * ) argv ,
long_options , 0 ) ;
2002-03-07 07:03:21 +03:00
if ( argc = = 1 ) {
2002-09-25 19:19:00 +04:00
poptPrintHelp ( pc , stderr , 0 ) ;
2002-02-26 23:04:54 +03:00
return 0 ;
}
2002-03-07 21:56:51 +03:00
while ( ( opt = poptGetNextOpt ( pc ) ) ! = - 1 ) {
2001-01-12 01:49:30 +03:00
switch ( opt ) {
2002-07-15 14:35:28 +04:00
case ' I ' :
2002-09-25 19:19:00 +04:00
if ( ( server_ip . s_addr = inet_addr ( opt_ipaddr ) ) = = INADDR_NONE ) {
2002-07-15 14:35:28 +04:00
fprintf ( stderr , " %s not a valid IP address \n " ,
opt_ipaddr ) ;
return 1 ;
}
2001-01-12 01:49:30 +03:00
}
}
2001-07-08 22:25:56 +04:00
2002-07-15 14:35:28 +04:00
/* Get server as remaining unparsed argument. Print usage if more
than one unparsed argument is present . */
server = poptGetArg ( pc ) ;
if ( ! server | | poptGetArg ( pc ) ) {
2002-09-25 19:19:00 +04:00
poptPrintHelp ( pc , stderr , 0 ) ;
2002-07-15 14:35:28 +04:00
return 1 ;
}
2002-04-04 08:29:09 +04:00
poptFreeContext ( pc ) ;
2006-02-08 02:30:31 +03:00
load_interfaces ( ) ;
if ( ! init_names ( ) )
return 1 ;
2006-02-08 22:28:25 +03:00
/* save the workgroup...
FIXME ! ! do we need to do this for other options as well
( or maybe a generic way to keep lp_load ( ) from overwriting
everything ) ? */
fstrcpy ( new_workgroup , lp_workgroup ( ) ) ;
2006-02-08 02:30:31 +03:00
/* Load smb.conf file */
if ( ! lp_load ( dyn_CONFIGFILE , True , False , False , True ) )
fprintf ( stderr , " Can't load %s \n " , dyn_CONFIGFILE ) ;
2006-02-08 22:28:25 +03:00
if ( strlen ( new_workgroup ) ! = 0 )
set_global_myworkgroup ( new_workgroup ) ;
2001-03-14 23:22:57 +03:00
/*
2001-12-03 10:42:18 +03:00
* Get password
2001-03-14 23:22:57 +03:00
* from stdin if necessary
*/
2001-12-03 10:42:18 +03:00
2003-04-14 07:31:19 +04:00
if ( ! cmdline_auth_info . got_pass ) {
2001-12-03 10:42:18 +03:00
char * pass = getpass ( " Password: " ) ;
if ( pass ) {
2003-04-14 07:31:19 +04:00
pstrcpy ( cmdline_auth_info . password , pass ) ;
2001-12-03 10:42:18 +03:00
}
}
2006-05-13 03:13:36 +04:00
if ( ( server [ 0 ] = = ' / ' & & server [ 1 ] = = ' / ' ) | |
( server [ 0 ] = = ' \\ ' & & server [ 1 ] = = ' \\ ' ) ) {
2006-05-11 22:59:41 +04:00
server + = 2 ;
}
2002-11-13 02:20:50 +03:00
nt_status = cli_full_connection ( & cli , global_myname ( ) , server ,
2005-01-10 13:23:57 +03:00
opt_ipaddr ? & server_ip : NULL , opt_port ,
2001-12-03 10:42:18 +03:00
" IPC$ " , " IPC " ,
2003-08-14 05:08:00 +04:00
cmdline_auth_info . username ,
lp_workgroup ( ) ,
cmdline_auth_info . password ,
cmdline_auth_info . use_kerberos ? CLI_FULL_CONNECTION_USE_KERBEROS : 0 ,
2003-07-31 03:49:29 +04:00
cmdline_auth_info . signing_state , NULL ) ;
2001-12-03 10:42:18 +03:00
if ( ! NT_STATUS_IS_OK ( nt_status ) ) {
2002-08-17 19:33:49 +04:00
DEBUG ( 0 , ( " Cannot connect to server. Error was %s \n " , nt_errstr ( nt_status ) ) ) ;
2001-07-28 02:54:50 +04:00
return 1 ;
2001-03-14 23:22:57 +03:00
}
2001-05-24 04:20:32 +04:00
2005-09-30 21:13:37 +04:00
#if 0 /* COMMENT OUT FOR TESTING */
2003-04-14 07:31:19 +04:00
memset ( cmdline_auth_info . password , ' X ' , sizeof ( cmdline_auth_info . password ) ) ;
2005-09-30 21:13:37 +04:00
# endif
2001-12-03 10:42:18 +03:00
2001-03-14 23:22:57 +03:00
/* Load command lists */
2001-03-16 01:06:53 +03:00
2006-10-17 03:27:38 +04:00
timeout = cli_set_timeout ( cli , 10000 ) ;
2001-05-24 04:20:32 +04:00
cmd_set = rpcclient_command_list ;
2001-03-16 01:06:53 +03:00
2001-05-24 04:20:32 +04:00
while ( * cmd_set ) {
add_command_set ( * cmd_set ) ;
add_command_set ( separator_command ) ;
cmd_set + + ;
}
2001-01-12 01:49:30 +03:00
2001-12-03 10:42:18 +03:00
fetch_machine_sid ( cli ) ;
2001-10-22 10:13:38 +04:00
/* Do anything specified with -c */
2003-04-14 07:31:19 +04:00
if ( cmdstr & & cmdstr [ 0 ] ) {
2001-05-31 22:35:14 +04:00
char * cmd ;
char * p = cmdstr ;
2003-04-28 09:54:37 +04:00
int result = 0 ;
2001-05-31 22:35:14 +04:00
while ( ( cmd = next_command ( & p ) ) ! = NULL ) {
2003-04-28 09:54:37 +04:00
NTSTATUS cmd_result = process_cmd ( cli , cmd ) ;
2007-06-07 05:13:43 +04:00
SAFE_FREE ( cmd ) ;
2003-04-28 09:54:37 +04:00
result = NT_STATUS_IS_ERR ( cmd_result ) ;
2001-05-31 22:35:14 +04:00
}
2001-12-03 10:42:18 +03:00
cli_shutdown ( cli ) ;
2003-04-28 09:54:37 +04:00
return result ;
2001-05-31 22:35:14 +04:00
}
2001-01-12 01:49:30 +03:00
2001-03-14 23:22:57 +03:00
/* Loop around accepting commands */
2001-05-24 04:20:32 +04:00
2001-01-12 01:49:30 +03:00
while ( 1 ) {
2001-04-28 04:32:56 +04:00
pstring prompt ;
2001-03-19 03:32:16 +03:00
char * line ;
2001-01-12 21:19:57 +03:00
2001-03-14 23:22:57 +03:00
slprintf ( prompt , sizeof ( prompt ) - 1 , " rpcclient $> " ) ;
2001-01-12 01:49:30 +03:00
2001-04-28 04:32:56 +04:00
line = smb_readline ( prompt , NULL , completion_fn ) ;
2001-01-12 01:49:30 +03:00
2001-05-04 05:04:23 +04:00
if ( line = = NULL )
break ;
if ( line [ 0 ] ! = ' \n ' )
2001-12-03 10:42:18 +03:00
process_cmd ( cli , line ) ;
2001-01-12 01:49:30 +03:00
}
2001-12-03 10:42:18 +03:00
cli_shutdown ( cli ) ;
2001-05-04 05:04:23 +04:00
return 0 ;
}