samba-mirror/source3/rpc_client/cli_pipe_schannel.c

/*
 *  Unix SMB/CIFS implementation.
 *  RPC Pipe client / server routines
 *  Largely rewritten by Jeremy Allison		    2005.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 3 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
 */

#include "includes.h"
#include "../librpc/gen_ndr/ndr_schannel.h"
#include "../librpc/gen_ndr/ndr_netlogon.h"
#include "../libcli/auth/schannel.h"
#include "rpc_client/cli_netlogon.h"
#include "rpc_client/cli_pipe.h"
#include "librpc/rpc/dcerpc.h"
#include "passdb.h"
#include "../libcli/smb/smbXcli_base.h"
#include "libcli/auth/netlogon_creds_cli.h"
#include "auth/gensec/gensec.h"

#undef DBGC_CLASS
#define DBGC_CLASS DBGC_RPC_CLI

/****************************************************************************
 Open a named pipe to an SMB server and bind using schannel (bind type 68).
 Fetch the session key ourselves using a temporary netlogon pipe.
 ****************************************************************************/

NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
				    struct messaging_context *msg_ctx,
				    const struct ndr_interface_table *table,
				    enum dcerpc_transport_t transport,
				    const char *domain,
				    const char *remote_name,
				    const struct sockaddr_storage *remote_sockaddr,
				    struct rpc_pipe_client **presult,
				    TALLOC_CTX *mem_ctx,
				    struct netlogon_creds_cli_context **pcreds)
{
	TALLOC_CTX *frame = talloc_stackframe();
	struct rpc_pipe_client *result = NULL;
	NTSTATUS status;
	struct cli_credentials *cli_creds = NULL;
	struct netlogon_creds_cli_context *netlogon_creds = NULL;
	struct netlogon_creds_CredentialState *creds = NULL;
	uint32_t netlogon_flags;
	bool authenticate_kerberos;

	status = pdb_get_trust_credentials(domain, NULL,
					   frame, &cli_creds);
	if (!NT_STATUS_IS_OK(status)) {
		TALLOC_FREE(frame);
		return status;
	}

	cli_credentials_add_gensec_features(cli_creds,
					    GENSEC_FEATURE_NO_DELEGATION,
					    CRED_SPECIFIED);

	status = rpccli_create_netlogon_creds_ctx(cli_creds,
						  remote_name,
						  msg_ctx,
						  frame,
						  &netlogon_creds);
	if (!NT_STATUS_IS_OK(status)) {
		TALLOC_FREE(frame);
		return status;
	}

	if (table == &ndr_table_netlogon) {
		status = rpccli_connect_netlogon(cli,
						 transport,
						 remote_name,
						 remote_sockaddr,
						 netlogon_creds,
						 false, /* force_reauth */
						 cli_creds,
						 &result);
		if (!NT_STATUS_IS_OK(status)) {
			TALLOC_FREE(frame);
			return status;
		}
		goto done;
	}

	status = rpccli_setup_netlogon_creds(cli,
					     transport,
					     remote_name,
					     remote_sockaddr,
					     netlogon_creds,
					     false, /* force_reauth */
					     cli_creds);
	if (!NT_STATUS_IS_OK(status)) {
		TALLOC_FREE(frame);
		return status;
	}

	status = netlogon_creds_cli_get(netlogon_creds, frame, &creds);
	if (!NT_STATUS_IS_OK(status)) {
		TALLOC_FREE(frame);
		return status;
	}

	netlogon_flags = creds->negotiate_flags;
	authenticate_kerberos = creds->authenticate_kerberos;
	TALLOC_FREE(creds);

	if (authenticate_kerberos) {
		status = cli_rpc_pipe_open_with_creds(cli,
						      table,
						      transport,
						      DCERPC_AUTH_TYPE_KRB5,
						      DCERPC_AUTH_LEVEL_PRIVACY,
						      "netlogon",
						      remote_name,
						      remote_sockaddr,
						      cli_creds,
						      &result);
		if (!NT_STATUS_IS_OK(status)) {
			TALLOC_FREE(frame);
			return status;
		}
	} else if (netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC) {
		status = cli_rpc_pipe_open_schannel_with_creds(cli, table,
							       transport,
							       netlogon_creds,
							       remote_name,
							       remote_sockaddr,
							       &result);
		if (!NT_STATUS_IS_OK(status)) {
			TALLOC_FREE(frame);
			return status;
		}
	} else {
		status = cli_rpc_pipe_open_noauth(cli, table, &result);
		if (!NT_STATUS_IS_OK(status)) {
			TALLOC_FREE(frame);
			return status;
		}
	}

done:
	*presult = result;
	if (pcreds != NULL) {
		*pcreds = talloc_move(mem_ctx, &netlogon_creds);
	}

	TALLOC_FREE(frame);
	return NT_STATUS_OK;
}