cli_netlogon: Eliminate rpccli_setup_netlogon_creds_with_creds
[samba.git] / source3 / rpcclient / rpcclient.c
index 7b31e1547eefe73a929ac7f79abbdce5441a3399..c1039ed84c57a98e403ed4c2be6c8996167f3e54 100644 (file)
@@ -20,6 +20,7 @@
 */
 
 #include "includes.h"
+#include "../libcli/auth/netlogon_creds_cli.h"
 #include "popt_common.h"
 #include "rpcclient.h"
 #include "../libcli/auth/libcli_auth.h"
@@ -33,6 +34,7 @@
 #include "libsmb/libsmb.h"
 #include "auth/gensec/gensec.h"
 #include "../libcli/smb/smbXcli_base.h"
+#include "messages.h"
 
 enum pipe_auth_type_spnego {
        PIPE_AUTH_TYPE_SPNEGO_NONE = 0,
@@ -48,7 +50,10 @@ static enum dcerpc_AuthLevel pipe_default_auth_level = DCERPC_AUTH_LEVEL_NONE;
 static unsigned int timeout = 0;
 static enum dcerpc_transport_t default_transport = NCACN_NP;
 
-struct user_auth_info *rpcclient_auth_info;
+struct messaging_context *rpcclient_msg_ctx;
+struct cli_state *rpcclient_cli_state;
+struct netlogon_creds_cli_context *rpcclient_netlogon_creds;
+static const char *rpcclient_netlogon_domain;
 
 /* List to hold groups of commands.
  *
@@ -167,7 +172,7 @@ static void fetch_machine_sid(struct cli_state *cli)
                goto error;
        }
 
-       result = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
+       result = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
                                          &lsapipe);
        if (!NT_STATUS_IS_OK(result)) {
                fprintf(stderr, "could not initialise lsa pipe. Error was %s\n", nt_errstr(result) );
@@ -211,7 +216,7 @@ static void fetch_machine_sid(struct cli_state *cli)
                TALLOC_FREE(lsapipe);
        }
 
-       fprintf(stderr, "could not obtain sid for domain %s\n", cli->domain);
+       fprintf(stderr, "could not obtain sid from server\n");
 
        if (!NT_STATUS_IS_OK(result)) {
                fprintf(stderr, "error: %s\n", nt_errstr(result));
@@ -480,31 +485,57 @@ static NTSTATUS cmd_seal(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
        return cmd_set_ss_level();
 }
 
-static NTSTATUS cmd_timeout(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
-                           int argc, const char **argv)
+static NTSTATUS cmd_packet(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
+                          int argc, const char **argv)
 {
-       struct cmd_list *tmp;
+       const char *p = "[KRB5|KRB5_SPNEGO|NTLMSSP|NTLMSSP_SPNEGO|SCHANNEL]";
+       const char *type = "NTLMSSP";
+
+       pipe_default_auth_level = DCERPC_AUTH_LEVEL_PACKET;
+       pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 
        if (argc > 2) {
-               printf("Usage: %s timeout\n", argv[0]);
+               printf("Usage: %s %s\n", argv[0], p);
                return NT_STATUS_OK;
        }
 
        if (argc == 2) {
-               timeout = atoi(argv[1]);
+               type = argv[1];
+               if (strequal(type, "KRB5")) {
+                       pipe_default_auth_type = DCERPC_AUTH_TYPE_KRB5;
+               } else if (strequal(type, "KRB5_SPNEGO")) {
+                       pipe_default_auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+                       pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_KRB5;
+               } else if (strequal(type, "NTLMSSP")) {
+                       pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+               } else if (strequal(type, "NTLMSSP_SPNEGO")) {
+                       pipe_default_auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+                       pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
+               } else if (strequal(type, "SCHANNEL")) {
+                       pipe_default_auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
+               } else {
+                       printf("unknown type %s\n", type);
+                       printf("Usage: %s %s\n", argv[0], p);
+                       return NT_STATUS_INVALID_LEVEL;
+               }
+       }
 
-               for (tmp = cmd_list; tmp; tmp = tmp->next) {
+       d_printf("Setting %s - packet\n", type);
 
-                       struct cmd_set *tmp_set;
+       return cmd_set_ss_level();
+}
 
-                       for (tmp_set = tmp->cmd_set; tmp_set->name; tmp_set++) {
-                               if (tmp_set->rpc_pipe == NULL) {
-                                       continue;
-                               }
 
-                               rpccli_set_timeout(tmp_set->rpc_pipe, timeout);
-                       }
-               }
+static NTSTATUS cmd_timeout(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
+                           int argc, const char **argv)
+{
+       if (argc > 2) {
+               printf("Usage: %s timeout\n", argv[0]);
+               return NT_STATUS_OK;
+       }
+
+       if (argc == 2) {
+               timeout = atoi(argv[1]);
        }
 
        printf("timeout is %d\n", timeout);
@@ -587,6 +618,7 @@ static struct cmd_set rpcclient_commands[] = {
        { "quit", RPC_RTYPE_NTSTATUS, cmd_quit, NULL,     NULL, NULL, "Exit program", "" },
        { "sign", RPC_RTYPE_NTSTATUS, cmd_sign, NULL,     NULL, NULL, "Force RPC pipe connections to be signed", "" },
        { "seal", RPC_RTYPE_NTSTATUS, cmd_seal, NULL,     NULL, NULL, "Force RPC pipe connections to be sealed", "" },
+       { "packet", RPC_RTYPE_NTSTATUS, cmd_packet, NULL,         NULL, NULL, "Force RPC pipe connections with packet authentication level", "" },
        { "schannel", RPC_RTYPE_NTSTATUS, cmd_schannel, NULL,     NULL, NULL,   "Force RPC pipe connections to be sealed with 'schannel'.  Assumes valid machine account to this domain controller.", "" },
        { "schannelsign", RPC_RTYPE_NTSTATUS, cmd_schannel_sign, NULL,    NULL, NULL, "Force RPC pipe connections to be signed (not sealed) with 'schannel'.  Assumes valid machine account to this domain controller.", "" },
        { "timeout", RPC_RTYPE_NTSTATUS, cmd_timeout, NULL,       NULL, NULL, "Set timeout (in milliseconds) for RPC operations", "" },
@@ -607,6 +639,7 @@ static struct cmd_set separator_command[] = {
 extern struct cmd_set lsarpc_commands[];
 extern struct cmd_set samr_commands[];
 extern struct cmd_set spoolss_commands[];
+extern struct cmd_set iremotewinspool_commands[];
 extern struct cmd_set netlogon_commands[];
 extern struct cmd_set srvsvc_commands[];
 extern struct cmd_set dfs_commands[];
@@ -621,6 +654,8 @@ extern struct cmd_set drsuapi_commands[];
 extern struct cmd_set eventlog_commands[];
 extern struct cmd_set winreg_commands[];
 extern struct cmd_set fss_commands[];
+extern struct cmd_set witness_commands[];
+extern struct cmd_set clusapi_commands[];
 
 static struct cmd_set *rpcclient_command_list[] = {
        rpcclient_commands,
@@ -628,6 +663,7 @@ static struct cmd_set *rpcclient_command_list[] = {
        ds_commands,
        samr_commands,
        spoolss_commands,
+       iremotewinspool_commands,
        netlogon_commands,
        srvsvc_commands,
        dfs_commands,
@@ -641,6 +677,8 @@ static struct cmd_set *rpcclient_command_list[] = {
        eventlog_commands,
        winreg_commands,
        fss_commands,
+       witness_commands,
+       clusapi_commands,
        NULL
 };
 
@@ -669,7 +707,7 @@ static NTSTATUS do_cmd(struct cli_state *cli,
                       struct user_auth_info *auth_info,
                       struct cmd_set *cmd_entry,
                       struct dcerpc_binding *binding,
-                      int argc, char **argv)
+                      int argc, const char **argv)
 {
        NTSTATUS ntresult;
        WERROR wresult;
@@ -678,7 +716,7 @@ static NTSTATUS do_cmd(struct cli_state *cli,
 
        /* Create mem_ctx */
 
-       if (!(mem_ctx = talloc_init("do_cmd"))) {
+       if (!(mem_ctx = talloc_stackframe())) {
                DEBUG(0, ("talloc_init() failed\n"));
                return NT_STATUS_NO_MEMORY;
        }
@@ -686,42 +724,33 @@ static NTSTATUS do_cmd(struct cli_state *cli,
        /* Open pipe */
 
        if ((cmd_entry->table != NULL) && (cmd_entry->rpc_pipe == NULL)) {
+               enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS;
                switch (pipe_default_auth_type) {
                case DCERPC_AUTH_TYPE_NONE:
                        ntresult = cli_rpc_pipe_open_noauth_transport(
                                cli, default_transport,
-                               &cmd_entry->table->syntax_id,
+                               cmd_entry->table,
                                &cmd_entry->rpc_pipe);
                        break;
                case DCERPC_AUTH_TYPE_SPNEGO:
-               {
-                       /* won't happen, but if it does it will fail in cli_rpc_pipe_open_spnego() eventually */
-                       const char *oid = "INVALID";
                        switch (pipe_default_auth_spnego_type) {
                        case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
-                               oid = GENSEC_OID_NTLMSSP;
+                               use_kerberos = CRED_DONT_USE_KERBEROS;
                                break;
                        case PIPE_AUTH_TYPE_SPNEGO_KRB5:
-                               oid = GENSEC_OID_KERBEROS5;
+                               use_kerberos = CRED_MUST_USE_KERBEROS;
+                               break;
+                       case PIPE_AUTH_TYPE_SPNEGO_NONE:
+                               use_kerberos = CRED_AUTO_USE_KERBEROS;
                                break;
                        }
-                       ntresult = cli_rpc_pipe_open_spnego(
-                               cli, cmd_entry->table,
-                               default_transport,
-                               oid,
-                               pipe_default_auth_level,
-                               smbXcli_conn_remote_name(cli->conn),
-                               get_cmdline_auth_info_domain(auth_info),
-                               get_cmdline_auth_info_username(auth_info),
-                               get_cmdline_auth_info_password(auth_info),
-                               &cmd_entry->rpc_pipe);
-                       break;
-               }
+                       /* Fall through */
                case DCERPC_AUTH_TYPE_NTLMSSP:
                case DCERPC_AUTH_TYPE_KRB5:
                        ntresult = cli_rpc_pipe_open_generic_auth(
                                cli, cmd_entry->table,
                                default_transport,
+                               use_kerberos,
                                pipe_default_auth_type,
                                pipe_default_auth_level,
                                smbXcli_conn_remote_name(cli->conn),
@@ -731,67 +760,94 @@ static NTSTATUS do_cmd(struct cli_state *cli,
                                &cmd_entry->rpc_pipe);
                        break;
                case DCERPC_AUTH_TYPE_SCHANNEL:
+                       TALLOC_FREE(rpcclient_netlogon_creds);
                        ntresult = cli_rpc_pipe_open_schannel(
-                               cli, &cmd_entry->table->syntax_id,
+                               cli, rpcclient_msg_ctx,
+                               cmd_entry->table,
                                default_transport,
-                               pipe_default_auth_level,
-                               get_cmdline_auth_info_domain(auth_info),
-                               &cmd_entry->rpc_pipe);
+                               rpcclient_netlogon_domain,
+                               &cmd_entry->rpc_pipe,
+                               rpcclient_msg_ctx,
+                               &rpcclient_netlogon_creds);
                        break;
                default:
                        DEBUG(0, ("Could not initialise %s. Invalid "
                                  "auth type %u\n",
                                  cmd_entry->table->name,
                                  pipe_default_auth_type ));
+                       talloc_free(mem_ctx);
                        return NT_STATUS_UNSUCCESSFUL;
                }
                if (!NT_STATUS_IS_OK(ntresult)) {
                        DEBUG(0, ("Could not initialise %s. Error was %s\n",
                                  cmd_entry->table->name,
                                  nt_errstr(ntresult) ));
+                       talloc_free(mem_ctx);
                        return ntresult;
                }
 
-               if (ndr_syntax_id_equal(&cmd_entry->table->syntax_id,
-                                       &ndr_table_netlogon.syntax_id)) {
-                       uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
-                       enum netr_SchannelType sec_channel_type;
-                       uchar trust_password[16];
-                       const char *machine_account;
-
-                       if (!get_trust_pw_hash(get_cmdline_auth_info_domain(auth_info),
-                                              trust_password, &machine_account,
-                                              &sec_channel_type))
-                       {
-                               return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+               if (rpcclient_netlogon_creds == NULL && cmd_entry->use_netlogon_creds) {
+                       const char *dc_name = cmd_entry->rpc_pipe->desthost;
+                       const char *domain = rpcclient_netlogon_domain;
+                       struct cli_credentials *creds = NULL;
+
+                       ntresult = pdb_get_trust_credentials(domain, NULL,
+                                                            mem_ctx, &creds);
+                       if (!NT_STATUS_IS_OK(ntresult)) {
+                               DEBUG(0, ("Failed to fetch trust credentials for "
+                                         "%s to connect to %s: %s\n",
+                                         domain, cmd_entry->table->name,
+                                         nt_errstr(ntresult)));
+                               TALLOC_FREE(cmd_entry->rpc_pipe);
+                               talloc_free(mem_ctx);
+                               return ntresult;
                        }
 
-                       ntresult = rpccli_netlogon_setup_creds(cmd_entry->rpc_pipe,
-                                               cmd_entry->rpc_pipe->desthost,   /* server name */
-                                               get_cmdline_auth_info_domain(auth_info),  /* domain */
-                                               lp_netbios_name(), /* client name */
-                                               machine_account, /* machine account name */
-                                               trust_password,
-                                               sec_channel_type,
-                                               &neg_flags);
+                       ntresult = rpccli_create_netlogon_creds_ctx(creds,
+                                                       dc_name,
+                                                       rpcclient_msg_ctx,
+                                                       rpcclient_msg_ctx,
+                                                       &rpcclient_netlogon_creds);
+                       if (!NT_STATUS_IS_OK(ntresult)) {
+                               DEBUG(0, ("Could not initialise credentials for %s.\n",
+                                         cmd_entry->table->name));
+                               TALLOC_FREE(cmd_entry->rpc_pipe);
+                               TALLOC_FREE(mem_ctx);
+                               return ntresult;
+                       }
 
+                       ntresult = rpccli_setup_netlogon_creds(
+                               cli,
+                               NCACN_NP,
+                               rpcclient_netlogon_creds,
+                               false, /* force_reauth */
+                               creds);
+                       TALLOC_FREE(creds);
                        if (!NT_STATUS_IS_OK(ntresult)) {
                                DEBUG(0, ("Could not initialise credentials for %s.\n",
                                          cmd_entry->table->name));
+                               TALLOC_FREE(cmd_entry->rpc_pipe);
+                               TALLOC_FREE(rpcclient_netlogon_creds);
+                               TALLOC_FREE(mem_ctx);
                                return ntresult;
                        }
                }
        }
 
+       /* Set timeout for new connections */
+       if (cmd_entry->rpc_pipe) {
+               rpccli_set_timeout(cmd_entry->rpc_pipe, timeout);
+       }
+
        /* Run command */
 
        if ( cmd_entry->returntype == RPC_RTYPE_NTSTATUS ) {
-               ntresult = cmd_entry->ntfn(cmd_entry->rpc_pipe, mem_ctx, argc, (const char **) argv);
+               ntresult = cmd_entry->ntfn(cmd_entry->rpc_pipe, mem_ctx, argc, argv);
                if (!NT_STATUS_IS_OK(ntresult)) {
                        printf("result was %s\n", nt_errstr(ntresult));
                }
        } else {
-               wresult = cmd_entry->wfn(cmd_entry->rpc_pipe, mem_ctx, argc, (const char **) argv);
+               wresult = cmd_entry->wfn(cmd_entry->rpc_pipe, mem_ctx, argc, argv);
                /* print out the DOS error */
                if (!W_ERROR_IS_OK(wresult)) {
                        printf( "result was %s\n", win_errstr(wresult));
@@ -801,7 +857,7 @@ static NTSTATUS do_cmd(struct cli_state *cli,
 
        /* Cleanup */
 
-       talloc_destroy(mem_ctx);
+       talloc_free(mem_ctx);
 
        return ntresult;
 }
@@ -821,9 +877,9 @@ static NTSTATUS process_cmd(struct user_auth_info *auth_info,
        NTSTATUS result = NT_STATUS_OK;
        int ret;
        int argc;
-       char **argv = NULL;
+       const char **argv = NULL;
 
-       if ((ret = poptParseArgvString(cmd, &argc, (const char ***) &argv)) != 0) {
+       if ((ret = poptParseArgvString(cmd, &argc, &argv)) != 0) {
                fprintf(stderr, "rpcclient: %s\n", poptStrerror(ret));
                return NT_STATUS_UNSUCCESSFUL;
        }
@@ -875,6 +931,7 @@ out_free:
 
  int main(int argc, char *argv[])
 {
+       const char **const_argv = discard_const_p(const char *, argv);
        int                     opt;
        static char             *cmdstr = NULL;
        const char *server;
@@ -888,8 +945,12 @@ out_free:
        TALLOC_CTX *frame = talloc_stackframe();
        uint32_t flags = 0;
        struct dcerpc_binding *binding = NULL;
+       enum dcerpc_transport_t transport;
+       uint32_t bflags = 0;
        const char *binding_string = NULL;
-       char *user, *domain, *q;
+       const char *host;
+       int signing_state = SMB_SIGNING_IPC_DEFAULT;
+       struct tevent_context *ev_ctx = NULL;
 
        /* make sure the vars that get altered (4th field) are in
           a fixed location or certain compilers complain */
@@ -905,7 +966,7 @@ out_free:
                POPT_TABLEEND
        };
 
-       load_case_tables();
+       smb_init_locale();
 
        zero_sockaddr(&server_ss);
 
@@ -914,16 +975,11 @@ out_free:
        /* the following functions are part of the Samba debugging
           facilities.  See lib/debug.c */
        setup_logging("rpcclient", DEBUG_STDOUT);
-
-       rpcclient_auth_info = user_auth_info_init(frame);
-       if (rpcclient_auth_info == NULL) {
-               exit(1);
-       }
-       popt_common_set_auth_info(rpcclient_auth_info);
+       lp_set_cmdline("log level", "0");
 
        /* Parse options */
 
-       pc = poptGetContext("rpcclient", argc, (const char **) argv,
+       pc = poptGetContext("rpcclient", argc, const_argv,
                            long_options, 0);
 
        if (argc == 1) {
@@ -958,33 +1014,43 @@ out_free:
        }
 
        poptFreeContext(pc);
+       popt_burn_cmdline_password(argc, argv);
 
-       if (!init_names()) {
+       ev_ctx = samba_tevent_context_init(frame);
+       if (ev_ctx == NULL) {
+               fprintf(stderr, "Could not init event context\n");
                result = 1;
                goto done;
        }
 
-       /* Load smb.conf file */
-
-       if (!lp_load_global(get_dyn_CONFIGFILE()))
-               fprintf(stderr, "Can't load %s\n", get_dyn_CONFIGFILE());
+       nt_status = messaging_init_client(ev_ctx,
+                                         ev_ctx,
+                                         &rpcclient_msg_ctx);
+       if (geteuid() != 0 &&
+                       NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
+               /*
+                * Normal to fail to initialize messaging context
+                * if we're not root as we don't have ability to
+                * read lock directory.
+                */
+               DBG_NOTICE("Unable to initialize messaging context. "
+                       "Must be root to do that.\n");
+       } else if (!NT_STATUS_IS_OK(nt_status)) {
+               fprintf(stderr, "Could not init messaging context\n");
+               result = 1;
+               goto done;
+       }
 
-       /* We must load interfaces after we load the smb.conf */
-       load_interfaces();
+       if (!init_names()) {
+               result = 1;
+               goto done;
+       }
 
        /*
         * Get password
         * from stdin if necessary
         */
 
-       if (get_cmdline_auth_info_use_machine_account(rpcclient_auth_info) &&
-           !set_cmdline_auth_info_machine_account_creds(rpcclient_auth_info)) {
-               result = 1;
-               goto done;
-       }
-
-       set_cmdline_auth_info_getpass(rpcclient_auth_info);
-
        if ((server[0] == '/' && server[1] == '/') ||
                        (server[0] == '\\' && server[1] ==  '\\')) {
                server += 2;
@@ -1008,78 +1074,102 @@ out_free:
                }
        }
 
-       if (binding->transport == NCA_UNKNOWN) {
-               binding->transport = NCACN_NP;
+       transport = dcerpc_binding_get_transport(binding);
+
+       if (transport == NCA_UNKNOWN) {
+               nt_status = dcerpc_binding_set_transport(binding, NCACN_NP);
+               if (!NT_STATUS_IS_OK(nt_status)) {
+                       result = -1;
+                       goto done;
+               }
        }
 
-       if (binding->flags & DCERPC_SIGN) {
+       host = dcerpc_binding_get_string_option(binding, "host");
+
+       bflags = dcerpc_binding_get_flags(binding);
+       if (bflags & DCERPC_CONNECT) {
+               pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+               pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+       }
+       if (bflags & DCERPC_PACKET) {
+               pipe_default_auth_level = DCERPC_AUTH_LEVEL_PACKET;
+               pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+       }
+       if (bflags & DCERPC_SIGN) {
                pipe_default_auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
                pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
        }
-       if (binding->flags & DCERPC_SEAL) {
+       if (bflags & DCERPC_SEAL) {
                pipe_default_auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
                pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
        }
-       if (binding->flags & DCERPC_AUTH_SPNEGO) {
+       if (bflags & DCERPC_AUTH_SPNEGO) {
                pipe_default_auth_type = DCERPC_AUTH_TYPE_SPNEGO;
                pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
        }
-       if (binding->flags & DCERPC_AUTH_NTLM) {
-               /* If neither Integrity or Privacy are requested then
-                * Use just Connect level */
-               if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
-                       pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
-               }
-
+       if (bflags & DCERPC_AUTH_NTLM) {
                if (pipe_default_auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
                        pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
                } else {
                        pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
                }
        }
-       if (binding->flags & DCERPC_AUTH_KRB5) {
-               /* If neither Integrity or Privacy are requested then
-                * Use just Connect level */
-               if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
-                       pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
-               }
-
+       if (bflags & DCERPC_AUTH_KRB5) {
                if (pipe_default_auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
                        pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_KRB5;
                } else {
                        pipe_default_auth_type = DCERPC_AUTH_TYPE_KRB5;
                }
        }
+       if (pipe_default_auth_type != DCERPC_AUTH_TYPE_NONE) {
+               /* If nothing is requested then default to integrity */
+               if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
+                       pipe_default_auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
+               }
+       }
 
-       if (get_cmdline_auth_info_use_kerberos(rpcclient_auth_info)) {
+       signing_state = get_cmdline_auth_info_signing_state(
+                       popt_get_cmdline_auth_info());
+       switch (signing_state) {
+       case SMB_SIGNING_OFF:
+               lp_set_cmdline("client ipc signing", "no");
+               break;
+       case SMB_SIGNING_REQUIRED:
+               lp_set_cmdline("client ipc signing", "required");
+               break;
+       }
+
+       if (get_cmdline_auth_info_use_kerberos(popt_get_cmdline_auth_info())) {
                flags |= CLI_FULL_CONNECTION_USE_KERBEROS |
                         CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
        }
-       if (get_cmdline_auth_info_use_ccache(rpcclient_auth_info)) {
+       if (get_cmdline_auth_info_use_ccache(popt_get_cmdline_auth_info())) {
                flags |= CLI_FULL_CONNECTION_USE_CCACHE;
        }
-
-       user = talloc_strdup(frame, get_cmdline_auth_info_username(rpcclient_auth_info));
-       SMB_ASSERT(user != NULL);
-       domain = talloc_strdup(frame, lp_workgroup());
-       SMB_ASSERT(domain != NULL);
-       set_cmdline_auth_info_domain(rpcclient_auth_info, domain);
-
-       if ((q = strchr_m(user,'\\'))) {
-               *q = 0;
-               set_cmdline_auth_info_domain(rpcclient_auth_info, user);
-               set_cmdline_auth_info_username(rpcclient_auth_info, q+1);
+       if (get_cmdline_auth_info_use_pw_nt_hash(
+                       popt_get_cmdline_auth_info())) {
+               flags |= CLI_FULL_CONNECTION_USE_NT_HASH;
        }
 
+       rpcclient_netlogon_domain = get_cmdline_auth_info_domain(
+                       popt_get_cmdline_auth_info());
+       if (rpcclient_netlogon_domain == NULL ||
+           rpcclient_netlogon_domain[0] == '\0')
+       {
+               rpcclient_netlogon_domain = lp_workgroup();
+       }
 
-       nt_status = cli_full_connection(&cli, lp_netbios_name(), binding->host,
+       nt_status = cli_full_connection(&cli, lp_netbios_name(), host,
                                        opt_ipaddr ? &server_ss : NULL, opt_port,
                                        "IPC$", "IPC",
-                                       get_cmdline_auth_info_username(rpcclient_auth_info),
-                                       get_cmdline_auth_info_domain(rpcclient_auth_info),
-                                       get_cmdline_auth_info_password(rpcclient_auth_info),
+                                       get_cmdline_auth_info_username(
+                                               popt_get_cmdline_auth_info()),
+                                       get_cmdline_auth_info_domain(
+                                               popt_get_cmdline_auth_info()),
+                                       get_cmdline_auth_info_password(
+                                               popt_get_cmdline_auth_info()),
                                        flags,
-                                       get_cmdline_auth_info_signing_state(rpcclient_auth_info));
+                                       SMB_SIGNING_IPC_DEFAULT);
 
        if (!NT_STATUS_IS_OK(nt_status)) {
                DEBUG(0,("Cannot connect to server.  Error was %s\n", nt_errstr(nt_status)));
@@ -1087,11 +1177,14 @@ out_free:
                goto done;
        }
 
-       if (get_cmdline_auth_info_smb_encrypt(rpcclient_auth_info)) {
+       if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) {
                nt_status = cli_cm_force_encryption(cli,
-                                       get_cmdline_auth_info_username(rpcclient_auth_info),
-                                       get_cmdline_auth_info_password(rpcclient_auth_info),
-                                       get_cmdline_auth_info_domain(rpcclient_auth_info),
+                                       get_cmdline_auth_info_username(
+                                               popt_get_cmdline_auth_info()),
+                                       get_cmdline_auth_info_password(
+                                               popt_get_cmdline_auth_info()),
+                                       get_cmdline_auth_info_domain(
+                                               popt_get_cmdline_auth_info()),
                                        "IPC$");
                if (!NT_STATUS_IS_OK(nt_status)) {
                        result = 1;
@@ -1104,8 +1197,10 @@ out_free:
 #endif
 
        /* Load command lists */
+       rpcclient_cli_state = cli;
 
-       timeout = cli_set_timeout(cli, 10000);
+       timeout = 10000;
+       cli_set_timeout(cli, timeout);
 
        cmd_set = rpcclient_command_list;
 
@@ -1115,7 +1210,7 @@ out_free:
                cmd_set++;
        }
 
-       default_transport = binding->transport;
+       default_transport = dcerpc_binding_get_transport(binding);
 
        fetch_machine_sid(cli);
 
@@ -1127,8 +1222,9 @@ out_free:
                result = 0;
 
                 while((cmd=next_command(&p)) != NULL) {
-                        NTSTATUS cmd_result = process_cmd(rpcclient_auth_info, cli,
-                                                         binding, cmd);
+                        NTSTATUS cmd_result = process_cmd(
+                                               popt_get_cmdline_auth_info(),
+                                               cli, binding, cmd);
                        SAFE_FREE(cmd);
                        result = NT_STATUS_IS_ERR(cmd_result);
                 }
@@ -1143,18 +1239,26 @@ out_free:
 
                line = smb_readline("rpcclient $> ", NULL, completion_fn);
 
-               if (line == NULL)
+               if (line == NULL) {
+                       printf("\n");
                        break;
+               }
 
                if (line[0] != '\n')
-                       process_cmd(rpcclient_auth_info, cli, binding, line);
+                       process_cmd(popt_get_cmdline_auth_info(), cli,
+                               binding, line);
                SAFE_FREE(line);
        }
 
 done:
+       rpcclient_cli_state = NULL;
        if (cli != NULL) {
                cli_shutdown(cli);
        }
+       popt_free_cmdline_auth_info();
+       netlogon_creds_cli_close_global_db();
+       TALLOC_FREE(rpcclient_msg_ctx);
+       TALLOC_FREE(ev_ctx);
        TALLOC_FREE(frame);
        return result;
 }