it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
+#include "popt_common.h"
#include "rpcclient.h"
#include "../libcli/auth/libcli_auth.h"
+#include "../librpc/gen_ndr/cli_lsa.h"
+#include "rpc_client/cli_lsarpc.h"
+#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "rpc_client/cli_netlogon.h"
+
+enum pipe_auth_type_spnego {
+ PIPE_AUTH_TYPE_SPNEGO_NONE = 0,
+ PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
+ PIPE_AUTH_TYPE_SPNEGO_KRB5
+};
-DOM_SID domain_sid;
+struct dom_sid domain_sid;
-static enum pipe_auth_type pipe_default_auth_type = PIPE_AUTH_TYPE_NONE;
-static enum pipe_auth_level pipe_default_auth_level = PIPE_AUTH_LEVEL_NONE;
+static enum dcerpc_AuthType pipe_default_auth_type = DCERPC_AUTH_TYPE_NONE;
+static enum pipe_auth_type_spnego pipe_default_auth_spnego_type = 0;
+static enum dcerpc_AuthLevel pipe_default_auth_level = DCERPC_AUTH_LEVEL_NONE;
static unsigned int timeout = 0;
static enum dcerpc_transport_t default_transport = NCACN_NP;
****************************************************************************/
static char **completion_fn(const char *text, int start, int end)
{
-#define MAX_COMPLETIONS 100
+#define MAX_COMPLETIONS 1000
char **matches;
int i, count=0;
struct cmd_list *commands = cmd_list;
if (!commands->cmd_set) {
break;
}
-
+
for (i=0; commands->cmd_set[i].name; i++) {
if ((strncmp(text, commands->cmd_set[i].name, strlen(text)) == 0) &&
(( commands->cmd_set[i].returntype == RPC_RTYPE_NTSTATUS &&
}
}
commands = commands->next;
-
}
if (count == 2) {
{
char *command;
char *p;
-
+
if (!cmdstr || !(*cmdstr))
return NULL;
-
+
p = strchr_m(*cmdstr, ';');
if (p)
*p = '\0';
*cmdstr = p + 1;
else
*cmdstr = NULL;
-
+
return command;
}
fprintf(stderr, "could not initialise lsa pipe. Error was %s\n", nt_errstr(result) );
goto error;
}
-
+
result = rpccli_lsa_open_policy(lsapipe, mem_ctx, True,
SEC_FLAG_MAXIMUM_ALLOWED,
&pol);
for (tmp = cmd_list; tmp; tmp = tmp->next)
{
tmp_set = tmp->cmd_set;
-
+
if (!StrCaseCmp(argv[1], tmp_set->name))
{
printf("Available commands on the %s pipe:\n\n", tmp_set->name);
if (i%3 == 0)
printf("\n");
}
-
+
/* drop out of the loop */
break;
}
if (argc == 2) {
for (tmp = cmd_list; tmp; tmp = tmp->next) {
-
+
tmp_set = tmp->cmd_set;
while(tmp_set->name) {
static NTSTATUS cmd_sign(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
int argc, const char **argv)
{
+ const char *p = "[KRB5|KRB5_SPNEGO|NTLMSSP|NTLMSSP_SPNEGO|SCHANNEL]";
const char *type = "NTLMSSP";
- pipe_default_auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
- pipe_default_auth_type = PIPE_AUTH_TYPE_NTLMSSP;
+ pipe_default_auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
if (argc > 2) {
- printf("Usage: %s [NTLMSSP|NTLMSSP_SPNEGO|SCHANNEL]\n", argv[0]);
+ printf("Usage: %s %s\n", argv[0], p);
return NT_STATUS_OK;
}
if (argc == 2) {
type = argv[1];
- if (strequal(type, "NTLMSSP")) {
- pipe_default_auth_type = PIPE_AUTH_TYPE_NTLMSSP;
+ if (strequal(type, "KRB5")) {
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_KRB5;
+ } else if (strequal(type, "KRB5_SPNEGO")) {
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+ pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_KRB5;
+ } else if (strequal(type, "NTLMSSP")) {
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
} else if (strequal(type, "NTLMSSP_SPNEGO")) {
- pipe_default_auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+ pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
} else if (strequal(type, "SCHANNEL")) {
- pipe_default_auth_type = PIPE_AUTH_TYPE_SCHANNEL;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
} else {
printf("unknown type %s\n", type);
+ printf("Usage: %s %s\n", argv[0], p);
return NT_STATUS_INVALID_LEVEL;
}
}
static NTSTATUS cmd_seal(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
int argc, const char **argv)
{
+ const char *p = "[KRB5|KRB5_SPNEGO|NTLMSSP|NTLMSSP_SPNEGO|SCHANNEL]";
const char *type = "NTLMSSP";
- pipe_default_auth_level = PIPE_AUTH_LEVEL_PRIVACY;
- pipe_default_auth_type = PIPE_AUTH_TYPE_NTLMSSP;
+ pipe_default_auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
if (argc > 2) {
- printf("Usage: %s [NTLMSSP|NTLMSSP_SPNEGO|SCHANNEL]\n", argv[0]);
+ printf("Usage: %s %s\n", argv[0], p);
return NT_STATUS_OK;
}
if (argc == 2) {
type = argv[1];
- if (strequal(type, "NTLMSSP")) {
- pipe_default_auth_type = PIPE_AUTH_TYPE_NTLMSSP;
+ if (strequal(type, "KRB5")) {
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_KRB5;
+ } else if (strequal(type, "KRB5_SPNEGO")) {
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+ pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_KRB5;
+ } else if (strequal(type, "NTLMSSP")) {
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
} else if (strequal(type, "NTLMSSP_SPNEGO")) {
- pipe_default_auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+ pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
} else if (strequal(type, "SCHANNEL")) {
- pipe_default_auth_type = PIPE_AUTH_TYPE_SCHANNEL;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
} else {
printf("unknown type %s\n", type);
+ printf("Usage: %s %s\n", argv[0], p);
return NT_STATUS_INVALID_LEVEL;
}
}
timeout = atoi(argv[1]);
for (tmp = cmd_list; tmp; tmp = tmp->next) {
-
+
struct cmd_set *tmp_set;
for (tmp_set = tmp->cmd_set; tmp_set->name; tmp_set++) {
static NTSTATUS cmd_none(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
int argc, const char **argv)
{
- pipe_default_auth_level = PIPE_AUTH_LEVEL_NONE;
- pipe_default_auth_type = PIPE_AUTH_TYPE_NONE;
+ pipe_default_auth_level = DCERPC_AUTH_LEVEL_NONE;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_NONE;
+ pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NONE;
return cmd_set_ss_level();
}
int argc, const char **argv)
{
d_printf("Setting schannel - sign and seal\n");
- pipe_default_auth_level = PIPE_AUTH_LEVEL_PRIVACY;
- pipe_default_auth_type = PIPE_AUTH_TYPE_SCHANNEL;
+ pipe_default_auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
return cmd_set_ss_level();
}
int argc, const char **argv)
{
d_printf("Setting schannel - sign only\n");
- pipe_default_auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
- pipe_default_auth_type = PIPE_AUTH_TYPE_SCHANNEL;
+ pipe_default_auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
return cmd_set_ss_level();
}
extern struct cmd_set ntsvcs_commands[];
extern struct cmd_set drsuapi_commands[];
extern struct cmd_set eventlog_commands[];
+extern struct cmd_set winreg_commands[];
static struct cmd_set *rpcclient_command_list[] = {
rpcclient_commands,
ntsvcs_commands,
drsuapi_commands,
eventlog_commands,
+ winreg_commands,
NULL
};
{
NTSTATUS ntresult;
WERROR wresult;
-
+
TALLOC_CTX *mem_ctx;
/* Create mem_ctx */
if ((cmd_entry->interface != NULL) && (cmd_entry->rpc_pipe == NULL)) {
switch (pipe_default_auth_type) {
- case PIPE_AUTH_TYPE_NONE:
- ntresult = cli_rpc_pipe_open_noauth_transport(
- cli, default_transport,
- cmd_entry->interface,
- &cmd_entry->rpc_pipe);
- break;
+ case DCERPC_AUTH_TYPE_NONE:
+ ntresult = cli_rpc_pipe_open_noauth_transport(
+ cli, default_transport,
+ cmd_entry->interface,
+ &cmd_entry->rpc_pipe);
+ break;
+ case DCERPC_AUTH_TYPE_SPNEGO:
+ switch (pipe_default_auth_spnego_type) {
case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
ntresult = cli_rpc_pipe_open_spnego_ntlmssp(
- cli, cmd_entry->interface,
- default_transport,
- pipe_default_auth_level,
- get_cmdline_auth_info_domain(auth_info),
- get_cmdline_auth_info_username(auth_info),
- get_cmdline_auth_info_password(auth_info),
- &cmd_entry->rpc_pipe);
+ cli, cmd_entry->interface,
+ default_transport,
+ pipe_default_auth_level,
+ get_cmdline_auth_info_domain(auth_info),
+ get_cmdline_auth_info_username(auth_info),
+ get_cmdline_auth_info_password(auth_info),
+ &cmd_entry->rpc_pipe);
break;
- case PIPE_AUTH_TYPE_NTLMSSP:
- ntresult = cli_rpc_pipe_open_ntlmssp(
- cli, cmd_entry->interface,
- default_transport,
- pipe_default_auth_level,
- get_cmdline_auth_info_domain(auth_info),
- get_cmdline_auth_info_username(auth_info),
- get_cmdline_auth_info_password(auth_info),
- &cmd_entry->rpc_pipe);
- break;
- case PIPE_AUTH_TYPE_SCHANNEL:
- ntresult = cli_rpc_pipe_open_schannel(
- cli, cmd_entry->interface,
- default_transport,
- pipe_default_auth_level,
- lp_workgroup(),
- &cmd_entry->rpc_pipe);
+ case PIPE_AUTH_TYPE_SPNEGO_KRB5:
+ ntresult = cli_rpc_pipe_open_spnego_krb5(
+ cli, cmd_entry->interface,
+ default_transport,
+ pipe_default_auth_level,
+ cli->desthost,
+ NULL, NULL,
+ &cmd_entry->rpc_pipe);
break;
default:
- DEBUG(0, ("Could not initialise %s. Invalid "
- "auth type %u\n",
- get_pipe_name_from_iface(
- cmd_entry->interface),
- pipe_default_auth_type ));
- return NT_STATUS_UNSUCCESSFUL;
+ ntresult = NT_STATUS_INTERNAL_ERROR;
+ }
+ break;
+ case DCERPC_AUTH_TYPE_NTLMSSP:
+ ntresult = cli_rpc_pipe_open_ntlmssp(
+ cli, cmd_entry->interface,
+ default_transport,
+ pipe_default_auth_level,
+ get_cmdline_auth_info_domain(auth_info),
+ get_cmdline_auth_info_username(auth_info),
+ get_cmdline_auth_info_password(auth_info),
+ &cmd_entry->rpc_pipe);
+ break;
+ case DCERPC_AUTH_TYPE_SCHANNEL:
+ ntresult = cli_rpc_pipe_open_schannel(
+ cli, cmd_entry->interface,
+ default_transport,
+ pipe_default_auth_level,
+ get_cmdline_auth_info_domain(auth_info),
+ &cmd_entry->rpc_pipe);
+ break;
+ case DCERPC_AUTH_TYPE_KRB5:
+ ntresult = cli_rpc_pipe_open_krb5(
+ cli, cmd_entry->interface,
+ default_transport,
+ pipe_default_auth_level,
+ cli->desthost,
+ NULL, NULL,
+ &cmd_entry->rpc_pipe);
+ break;
+ default:
+ DEBUG(0, ("Could not initialise %s. Invalid "
+ "auth type %u\n",
+ get_pipe_name_from_syntax(
+ talloc_tos(),
+ cmd_entry->interface),
+ pipe_default_auth_type ));
+ return NT_STATUS_UNSUCCESSFUL;
}
if (!NT_STATUS_IS_OK(ntresult)) {
DEBUG(0, ("Could not initialise %s. Error was %s\n",
- get_pipe_name_from_iface(
- cmd_entry->interface),
+ get_pipe_name_from_syntax(
+ talloc_tos(), cmd_entry->interface),
nt_errstr(ntresult) ));
return ntresult;
}
if (ndr_syntax_id_equal(cmd_entry->interface,
&ndr_table_netlogon.syntax_id)) {
uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
- uint32 sec_channel_type;
+ enum netr_SchannelType sec_channel_type;
uchar trust_password[16];
-
- if (!secrets_fetch_trust_account_password(lp_workgroup(),
- trust_password,
- NULL, &sec_channel_type)) {
- return NT_STATUS_UNSUCCESSFUL;
+ const char *machine_account;
+
+ if (!get_trust_pw_hash(get_cmdline_auth_info_domain(auth_info),
+ trust_password, &machine_account,
+ &sec_channel_type))
+ {
+ return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
}
-
+
ntresult = rpccli_netlogon_setup_creds(cmd_entry->rpc_pipe,
cli->desthost, /* server name */
- lp_workgroup(), /* domain */
+ get_cmdline_auth_info_domain(auth_info), /* domain */
global_myname(), /* client name */
- global_myname(), /* machine account name */
+ machine_account, /* machine account name */
trust_password,
sec_channel_type,
&neg_flags);
if (!NT_STATUS_IS_OK(ntresult)) {
DEBUG(0, ("Could not initialise credentials for %s.\n",
- get_pipe_name_from_iface(
+ get_pipe_name_from_syntax(
+ talloc_tos(),
cmd_entry->interface)));
return ntresult;
}
binding->transport = NCACN_NP;
}
+ if (binding->flags & DCERPC_SIGN) {
+ pipe_default_auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+ }
+ if (binding->flags & DCERPC_SEAL) {
+ pipe_default_auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+ }
+ if (binding->flags & DCERPC_AUTH_SPNEGO) {
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+ pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
+ }
+ if (binding->flags & DCERPC_AUTH_NTLM) {
+ /* If neither Integrity or Privacy are requested then
+ * Use just Connect level */
+ if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
+ pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+ }
+
+ if (pipe_default_auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
+ pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
+ } else {
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+ }
+ }
+ if (binding->flags & DCERPC_AUTH_KRB5) {
+ /* If neither Integrity or Privacy are requested then
+ * Use just Connect level */
+ if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
+ pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+ }
+
+ if (pipe_default_auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
+ pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_KRB5;
+ } else {
+ pipe_default_auth_type = DCERPC_AUTH_TYPE_KRB5;
+ }
+ }
+
if (get_cmdline_auth_info_use_kerberos(rpcclient_auth_info)) {
flags |= CLI_FULL_CONNECTION_USE_KERBEROS |
CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
}
+ if (get_cmdline_auth_info_use_ccache(rpcclient_auth_info)) {
+ flags |= CLI_FULL_CONNECTION_USE_CCACHE;
+ }
user = talloc_strdup(frame, get_cmdline_auth_info_username(rpcclient_auth_info));
SMB_ASSERT(user != NULL);
git.samba.org / samba.git / blobdiff