This puts real netlogon connection caching to winbind. This becomes

important once we start doing schannel, as there would be a lot more
roundtrips for the second PIPE open and bind. With this patch logging
in to a member server is a matter of two (three if you count the
ack...) packets between us and the DC.

Volker

diff --git a/source/auth/auth_domain.c b/source/auth/auth_domain.c
index bc03fecf749742cfd7a9cb4b6e7c25a1855f98fa..827b4029d29fe4dd57992960bba02a0f11890d89 100644 (file)
--- a/source/auth/auth_domain.c
+++ b/source/auth/auth_domain.c
@@ -130,7 +130,6 @@ static NTSTATUS connect_to_domain_password_server(struct cli_state **cli,
        struct in_addr dest_ip;
        fstring remote_machine;
         NTSTATUS result;
-       uint32 neg_flags = 0x000001ff;
 
        *retry = False;
 
@@ -214,7 +213,7 @@ machine %s. Error was : %s.\n", remote_machine, cli_errstr(*cli)));
                return NT_STATUS_NO_MEMORY;
        }
 
-       result = cli_nt_setup_creds(*cli, sec_chan, trust_passwd, &neg_flags, 2);
+       result = cli_nt_establish_netlogon(*cli, sec_chan, trust_passwd);
 
         if (!NT_STATUS_IS_OK(result)) {
                DEBUG(0,("connect_to_domain_password_server: unable to setup the NETLOGON credentials to machine \
@@ -341,6 +340,7 @@ static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx,
          */
 
        nt_status = cli_netlogon_sam_network_logon(cli, mem_ctx,
+                                                  NULL,
                                                   user_info->smb_name.str, user_info->domain.str, 
                                                   user_info->wksta_name.str, chal, 
                                                   user_info->lm_resp, user_info->nt_resp, 

diff --git a/source/libsmb/namequery.c b/source/libsmb/namequery.c
index 18ce5e4bd9b3ea1e74c2f579b55df522e324deef..2c5a92ff10eb41216b4b6bdf04087bdb11476372 100644 (file)
--- a/source/libsmb/namequery.c
+++ b/source/libsmb/namequery.c
@@ -704,8 +704,8 @@ success:
  Resolve via "lmhosts" method.
 *********************************************************/
 
-static BOOL resolve_lmhosts(const char *name, int name_type,
-                         struct in_addr **return_iplist, int *return_count)
+BOOL resolve_lmhosts(const char *name, int name_type,
+                    struct in_addr **return_iplist, int *return_count)
 {
        /*
         * "lmhosts" means parse the local lmhosts file.

diff --git a/source/nsswitch/winbindd_cm.c b/source/nsswitch/winbindd_cm.c
index dbcfdcf88f9887c7261e714101c75be8f0bcb757..45cded75fa43940a2689964d0ac38c44ab2af9e7 100644 (file)
--- a/source/nsswitch/winbindd_cm.c
+++ b/source/nsswitch/winbindd_cm.c
@@ -415,21 +415,19 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index,
 static BOOL connection_ok(struct winbindd_cm_conn *conn)
 {
        if (!conn) {
-               smb_panic("Invalid paramater passed to conneciton_ok():  conn was NULL!\n");
+               smb_panic("Invalid parameter passed to connection_ok():  conn was NULL!\n");
                return False;
        }
 
        if (!conn->cli) {
-               DEBUG(0, ("Connection to %s for domain %s (pipe %s) has NULL conn->cli!\n", 
+               DEBUG(3, ("Connection to %s for domain %s (pipe %s) has NULL conn->cli!\n", 
                          conn->controller, conn->domain, conn->pipe_name));
-               smb_panic("connection_ok: conn->cli was null!");
                return False;
        }
 
        if (!conn->cli->initialised) {
-               DEBUG(0, ("Connection to %s for domain %s (pipe %s) was never initialised!\n", 
+               DEBUG(3, ("Connection to %s for domain %s (pipe %s) was never initialised!\n", 
                          conn->controller, conn->domain, conn->pipe_name));
-               smb_panic("connection_ok: conn->cli->initialised is False!");
                return False;
        }
 
@@ -442,13 +440,13 @@ static BOOL connection_ok(struct winbindd_cm_conn *conn)
        return True;
 }
 
-/* Get a connection to the remote DC and open the pipe.  If there is already a connection, use that */
+/* Search the cache for a connection. If there is a broken one,
+   shut it down properly and return NULL. */
 
-static NTSTATUS get_connection_from_cache(const char *domain, const char *pipe_name,
-               struct winbindd_cm_conn **conn_out) 
+static void find_cm_connection(const char *domain, const char *pipe_name,
+                              struct winbindd_cm_conn **conn_out) 
 {
        struct winbindd_cm_conn *conn, conn_temp;
-       NTSTATUS result;
 
        for (conn = cm_conns; conn; conn = conn->next) {
                if (strequal(conn->domain, domain) && 
@@ -466,26 +464,47 @@ static NTSTATUS get_connection_from_cache(const char *domain, const char *pipe_n
                        }
                }
        }
-       
-       if (!conn) {
-               if (!(conn = malloc(sizeof(*conn))))
-                       return NT_STATUS_NO_MEMORY;
+
+       *conn_out = conn;
+}
+
+/* Initialize a new connection up to the RPC BIND. */
+
+static NTSTATUS new_cm_connection(const char *domain, const char *pipe_name,
+                                 struct winbindd_cm_conn **conn_out)
+{
+       struct winbindd_cm_conn *conn;
+       NTSTATUS result;
+
+       if (!(conn = malloc(sizeof(*conn))))
+               return NT_STATUS_NO_MEMORY;
                
-               ZERO_STRUCTP(conn);
+       ZERO_STRUCTP(conn);
                
-               if (!NT_STATUS_IS_OK(result = cm_open_connection(domain, get_pipe_index(pipe_name), conn))) {
-                       DEBUG(3, ("Could not open a connection to %s for %s (%s)\n", 
-                                 domain, pipe_name, nt_errstr(result)));
-                       SAFE_FREE(conn);
-                       return result;
-               }
-               DLIST_ADD(cm_conns, conn);              
+       if (!NT_STATUS_IS_OK(result = cm_open_connection(domain, get_pipe_index(pipe_name), conn))) {
+               DEBUG(3, ("Could not open a connection to %s for %s (%s)\n", 
+                         domain, pipe_name, nt_errstr(result)));
+               SAFE_FREE(conn);
+               return result;
        }
-       
+       DLIST_ADD(cm_conns, conn);
+
        *conn_out = conn;
        return NT_STATUS_OK;
 }
 
+/* Get a connection to the remote DC and open the pipe.  If there is already a connection, use that */
+
+static NTSTATUS get_connection_from_cache(const char *domain, const char *pipe_name,
+                                         struct winbindd_cm_conn **conn_out)
+{
+       find_cm_connection(domain, pipe_name, conn_out);
+
+       if (conn_out != NULL)
+               return NT_STATUS_OK;
+
+       return new_cm_connection(domain, pipe_name, conn_out);
+}
 
 /**********************************************************************************
 **********************************************************************************/
@@ -856,11 +875,11 @@ CLI_POLICY_HND *cm_get_sam_group_handle(char *domain, DOM_SID *domain_sid,
 NTSTATUS cm_get_netlogon_cli(const char *domain, 
                             const unsigned char *trust_passwd, 
                             uint32 sec_channel_type,
+                            BOOL fresh,
                             struct cli_state **cli)
 {
        NTSTATUS result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
        struct winbindd_cm_conn *conn;
-       uint32 neg_flags = 0x000001ff;
        fstring lock_name;
        BOOL got_mutex;
 
@@ -869,7 +888,30 @@ NTSTATUS cm_get_netlogon_cli(const char *domain,
 
        /* Open an initial conection - keep the mutex. */
 
-       if (!NT_STATUS_IS_OK(result = get_connection_from_cache(domain, PIPE_NETLOGON, &conn)))
+       find_cm_connection(domain, PIPE_NETLOGON, &conn);
+
+       if ( fresh && (conn != NULL) ) {
+               cli_shutdown(conn->cli);
+               conn->cli = NULL;
+
+               conn = NULL;
+
+               /* purge connection from cache */
+               find_cm_connection(domain, PIPE_NETLOGON, &conn);
+               if (conn != NULL) {
+                       DEBUG(0,("Could not purge connection\n"));
+                       return NT_STATUS_UNSUCCESSFUL;
+               }
+       }
+
+       if (conn != NULL) {
+               *cli = conn->cli;
+               return NT_STATUS_OK;
+       }
+
+       result = new_cm_connection(domain, PIPE_NETLOGON, &conn);
+
+       if (!NT_STATUS_IS_OK(result))
                return result;
        
        snprintf(lock_name, sizeof(lock_name), "NETLOGON\\%s", conn->controller);
@@ -878,38 +920,16 @@ NTSTATUS cm_get_netlogon_cli(const char *domain,
                DEBUG(0,("cm_get_netlogon_cli: mutex grab failed for %s\n", conn->controller));
        }
                        
-       result = cli_nt_setup_creds(conn->cli, sec_channel_type, trust_passwd, &neg_flags, 2);
+       result = cli_nt_establish_netlogon(conn->cli, sec_channel_type, trust_passwd);
        
        if (got_mutex)
                secrets_named_mutex_release(lock_name);
-                       
+                               
        if (!NT_STATUS_IS_OK(result)) {
-               DEBUG(0, ("error connecting to domain password server: %s\n",
-                         nt_errstr(result)));
-               
-               /* Hit the cache code again.  This cleans out the old connection and gets a new one */
-               if (conn->cli->fd == -1) {
-                       if (!NT_STATUS_IS_OK(result = get_connection_from_cache(domain, PIPE_NETLOGON, &conn)))
-                               return result;
-                       
-                       snprintf(lock_name, sizeof(lock_name), "NETLOGON\\%s", conn->controller);
-                       if (!(got_mutex = secrets_named_mutex(lock_name, WINBIND_SERVER_MUTEX_WAIT_TIME))) {
-                               DEBUG(0,("cm_get_netlogon_cli: mutex grab failed for %s\n", conn->controller));
-                       }
-                       
-                       /* Try again */
-                       result = cli_nt_setup_creds( conn->cli, sec_channel_type,trust_passwd, &neg_flags, 2);
-                       
-                       if (got_mutex)
-                               secrets_named_mutex_release(lock_name);
-               }
-               
-               if (!NT_STATUS_IS_OK(result)) {
-                       cli_shutdown(conn->cli);
-                       DLIST_REMOVE(cm_conns, conn);
-                       SAFE_FREE(conn);
-                       return result;
-               }
+               cli_shutdown(conn->cli);
+               DLIST_REMOVE(cm_conns, conn);
+               SAFE_FREE(conn);
+               return result;
        }
 
        *cli = conn->cli;

diff --git a/source/nsswitch/winbindd_misc.c b/source/nsswitch/winbindd_misc.c
index fb56d0e65747660e81c0e0530d9767e263109a03..436c95053e42017a23bae536725f66c2b63cee89 100644 (file)
--- a/source/nsswitch/winbindd_misc.c
+++ b/source/nsswitch/winbindd_misc.c
@@ -50,7 +50,9 @@ enum winbindd_result winbindd_check_machine_acct(struct winbindd_cli_state *stat
            the trust account password. */
 
        /* Don't shut this down - it belongs to the connection cache code */
-        result = cm_get_netlogon_cli(lp_workgroup(), trust_passwd, sec_channel_type, &cli);
+        result = cm_get_netlogon_cli(lp_workgroup(),
+                                    trust_passwd, sec_channel_type,
+                                    True, &cli);
 
         if (!NT_STATUS_IS_OK(result)) {
                 DEBUG(3, ("could not open handle to NETLOGON pipe\n"));

diff --git a/source/nsswitch/winbindd_pam.c b/source/nsswitch/winbindd_pam.c
index 2998372bd21b08e95f47d4dd947c56716f5960d8..3b306eed3b2eb2b9e9bcdbdd6cae96083a4b3ffc 100644 (file)
--- a/source/nsswitch/winbindd_pam.c
+++ b/source/nsswitch/winbindd_pam.c
@@ -68,6 +68,8 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state)
        TALLOC_CTX *mem_ctx = NULL;
        DATA_BLOB lm_resp;
        DATA_BLOB nt_resp;
+       DOM_CRED ret_creds;
+       int attempts = 0;
 
        /* Ensure null termination */
        state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
@@ -119,23 +121,35 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state)
                goto done;
        }
 
-       ZERO_STRUCT(info3);
+       do {
+               ZERO_STRUCT(info3);
+               ZERO_STRUCT(ret_creds);
        
-       /* Don't shut this down - it belongs to the connection cache code */
-        result = cm_get_netlogon_cli(lp_workgroup(), trust_passwd, 
-                                    sec_channel_type, 
-                                    &cli);
-
-        if (!NT_STATUS_IS_OK(result)) {
-                DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
-                goto done;
-        }
-
-       result = cli_netlogon_sam_network_logon(cli, mem_ctx,
-                                               name_user, name_domain, 
-                                               global_myname(), chal, 
-                                               lm_resp, nt_resp, 
-                                               &info3);
+               /* Don't shut this down - it belongs to the connection cache code */
+               result = cm_get_netlogon_cli(lp_workgroup(), trust_passwd, 
+                                            sec_channel_type, False, &cli);
+
+               if (!NT_STATUS_IS_OK(result)) {
+                       DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
+                       goto done;
+               }
+
+               result = cli_netlogon_sam_network_logon(cli, mem_ctx,
+                                                       &ret_creds,
+                                                       name_user, name_domain, 
+                                                       global_myname(), chal, 
+                                                       lm_resp, nt_resp,
+                                                       &info3);
+               attempts += 1;
+
+               /* We have to try a second time as cm_get_netlogon_cli
+                  might not yet have noticed that the DC has killed
+                  our connection. */
+
+       } while ( (attempts < 2) && (cli->fd == -1) );
+
+        
+       clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds);
         
        uni_group_cache_store_netlogon(mem_ctx, &info3);
 done:
@@ -176,6 +190,8 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state)
        const char *domain = NULL;
        const char *contact_domain;
        const char *workstation;
+       DOM_CRED ret_creds;
+       int attempts = 0;
 
        DATA_BLOB lm_resp, nt_resp;
 
@@ -264,21 +280,37 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state)
                goto done;
        }
 
-       ZERO_STRUCT(info3);
+       do {
+               ZERO_STRUCT(info3);
+               ZERO_STRUCT(ret_creds);
+
+               /* Don't shut this down - it belongs to the connection cache code */
+               result = cm_get_netlogon_cli(contact_domain, trust_passwd,
+                                            sec_channel_type, False, &cli);
+
+               if (!NT_STATUS_IS_OK(result)) {
+                       DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
+                                 nt_errstr(result)));
+                       goto done;
+               }
+
+               result = cli_netlogon_sam_network_logon(cli, mem_ctx,
+                                                       &ret_creds,
+                                                       user, domain,
+                                                       workstation,
+                                                       state->request.data.auth_crap.chal, 
+                                                       lm_resp, nt_resp, 
+                                                       &info3);
+
+               attempts += 1;
 
-       /* Don't shut this down - it belongs to the connection cache code */
-        result = cm_get_netlogon_cli(contact_domain, trust_passwd, sec_channel_type, &cli);
+               /* We have to try a second time as cm_get_netlogon_cli
+                  might not yet have noticed that the DC has killed
+                  our connection. */
 
-        if (!NT_STATUS_IS_OK(result)) {
-                DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n", nt_errstr(result)));
-                goto done;
-        }
+       } while ( (attempts < 2) && (cli->fd == -1) );
 
-       result = cli_netlogon_sam_network_logon(cli, mem_ctx,
-                                               user, domain,
-                                               workstation, state->request.data.auth_crap.chal, 
-                                               lm_resp, nt_resp, 
-                                               &info3);
+       clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds);
         
        if (NT_STATUS_IS_OK(result)) {
                uni_group_cache_store_netlogon(mem_ctx, &info3);

diff --git a/source/rpc_client/cli_netlogon.c b/source/rpc_client/cli_netlogon.c
index 72240ca7d2248fb55280ad43bc98aff1b33cfa99..831101ed81e4e7bb25d85dc0604e7befca8773ab 100644 (file)
--- a/source/rpc_client/cli_netlogon.c
+++ b/source/rpc_client/cli_netlogon.c
@@ -472,6 +472,7 @@ NTSTATUS cli_netlogon_sam_deltas(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 /* Logon domain user */
 
 NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
+                               DOM_CRED *ret_creds,
                                 const char *username, const char *password,
                                 int logon_type)
 {
@@ -486,6 +487,7 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 
        ZERO_STRUCT(q);
        ZERO_STRUCT(r);
+       ZERO_STRUCT(dummy_rtn_creds);
 
        /* Initialise parse structures */
 
@@ -498,8 +500,8 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 
         q.validation_level = validation_level;
 
-       memset(&dummy_rtn_creds, '\0', sizeof(dummy_rtn_creds));
-       dummy_rtn_creds.timestamp.time = time(NULL);
+       if (ret_creds == NULL)
+               ret_creds = &dummy_rtn_creds;
 
         ctr.switch_value = logon_type;
 
@@ -542,7 +544,7 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
         }
 
         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname(),
-                      &clnt_creds, &dummy_rtn_creds, logon_type,
+                      &clnt_creds, ret_creds, logon_type,
                       &ctr);
 
         /* Marshall data and send request */
@@ -563,6 +565,7 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
         /* Return results */
 
        result = r.status;
+       memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
 
  done:
        prs_mem_free(&qbuf);
@@ -579,6 +582,7 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
  **/
 
 NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
+                                       DOM_CRED *ret_creds,
                                        const char *username, const char *domain, const char *workstation, 
                                        const uint8 chal[8], 
                                        DATA_BLOB lm_response, DATA_BLOB nt_response,
@@ -598,6 +602,7 @@ NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_c
        
        ZERO_STRUCT(q);
        ZERO_STRUCT(r);
+       ZERO_STRUCT(dummy_rtn_creds);
 
        workstation_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", workstation);
        
@@ -617,8 +622,8 @@ NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_c
 
        q.validation_level = validation_level;
 
-       memset(&dummy_rtn_creds, '\0', sizeof(dummy_rtn_creds));
-       dummy_rtn_creds.timestamp.time = time(NULL);
+       if (ret_creds == NULL)
+               ret_creds = &dummy_rtn_creds;
 
         ctr.switch_value = NET_LOGON_TYPE;
 
@@ -629,7 +634,7 @@ NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_c
                      lm_response.data, lm_response.length, nt_response.data, nt_response.length);
  
         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname(),
-                      &clnt_creds, &dummy_rtn_creds, NET_LOGON_TYPE,
+                      &clnt_creds, ret_creds, NET_LOGON_TYPE,
                       &ctr);
 
         /* Marshall data and send request */
@@ -659,6 +664,7 @@ NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_c
         /* Return results */
 
        result = r.status;
+       memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
 
  done:
        prs_mem_free(&qbuf);

diff --git a/source/rpc_client/cli_pipe.c b/source/rpc_client/cli_pipe.c
index f8472f3cfc1f0a86ac750f97b9afc521b6cb2af1..223d6a707e9c5b941c40136572f836c5ad4cf300 100644 (file)
--- a/source/rpc_client/cli_pipe.c
+++ b/source/rpc_client/cli_pipe.c
@@ -1563,8 +1563,8 @@ BOOL cli_nt_session_open(struct cli_state *cli, const int pipe_idx)
  Open a session to the NETLOGON pipe using schannel.
  ****************************************************************************/
 
-BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password,
-                         int sec_chan)
+NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan,
+                              const char *trust_password)
 {
        NTSTATUS result;
        uint32 neg_flags = 0x000001ff;
@@ -1573,22 +1573,12 @@ BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password,
        if (lp_client_schannel() != False)
                neg_flags |= NETLOGON_NEG_SCHANNEL;
 
-
-       if (!cli_nt_session_open(cli, PI_NETLOGON)) {
-               return False;
-       }
-
-       if (!secrets_init()) {
-               DEBUG(3,("Failed to init secrets.tdb\n"));
-               return False;
-       }
-
        result = cli_nt_setup_creds(cli, sec_chan, trust_password,
                                    &neg_flags, 2);
 
        if (!NT_STATUS_IS_OK(result)) {
                cli_nt_session_close(cli);
-               return False;
+               return result;
        }
 
        if ((lp_client_schannel() == True) &&
@@ -1596,12 +1586,12 @@ BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password,
 
                DEBUG(3, ("Server did not offer schannel\n"));
                cli_nt_session_close(cli);
-               return False;
+               return NT_STATUS_UNSUCCESSFUL;
        }
 
        if ((lp_client_schannel() == False) ||
            ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
-               return True;
+               return NT_STATUS_OK;
        }
 
        /* Server offered schannel, so try it. */
@@ -1624,7 +1614,7 @@ BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password,
                                 "Error was %s\n",
                                 PIPE_NETLOGON, cli->desthost,
                                 cli_errstr(cli)));
-                       return False;
+                       return NT_STATUS_UNSUCCESSFUL;
                }
                
                cli->nt_pipe_fnum = (uint16)fnum;
@@ -1635,7 +1625,7 @@ BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password,
                                 "Error was %s\n",
                                 PIPE_NETLOGON, cli->desthost,
                                 cli_errstr(cli)));
-                       return False;
+                       return NT_STATUS_UNSUCCESSFUL;
                }
 
                cli->nt_pipe_fnum = (uint16)fnum;
@@ -1645,17 +1635,17 @@ BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password,
                        DEBUG(0,("Pipe hnd state failed.  Error was %s\n",
                                  cli_errstr(cli)));
                        cli_close(cli, cli->nt_pipe_fnum);
-                       return False;
+                       return NT_STATUS_UNSUCCESSFUL;
                }
        }
 
        if (!rpc_pipe_bind(cli, PI_NETLOGON, global_myname(), True)) {
                DEBUG(2,("rpc bind to %s failed\n", PIPE_NETLOGON));
                cli_close(cli, cli->nt_pipe_fnum);
-               return False;
+               return NT_STATUS_UNSUCCESSFUL;
        }
 
-       return True;
+       return NT_STATUS_OK;
 }
 
 

diff --git a/source/rpcclient/cmd_netlogon.c b/source/rpcclient/cmd_netlogon.c
index 32fa9c3699f2501f222eef150a9670ece9c00c09..0ec78a067342fb28920045171cff76f96726719b 100644 (file)
--- a/source/rpcclient/cmd_netlogon.c
+++ b/source/rpcclient/cmd_netlogon.c
@@ -275,6 +275,7 @@ static NTSTATUS cmd_netlogon_sam_logon(struct cli_state *cli,
         const char *username, *password;
        uint32 neg_flags = 0x000001ff;
        int auth_level = 2;
+       DOM_CRED ret_creds;
 
         /* Check arguments */
 
@@ -299,7 +300,13 @@ static NTSTATUS cmd_netlogon_sam_logon(struct cli_state *cli,
 
         /* Perform the sam logon */
 
-        result = cli_netlogon_sam_logon(cli, mem_ctx, username, password, logon_type);
+       ZERO_STRUCT(ret_creds);
+
+        result = cli_netlogon_sam_logon(cli, mem_ctx, &ret_creds, username, password, logon_type);
+
+       clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds);
+       
+        result = cli_netlogon_sam_logon(cli, mem_ctx, &ret_creds, username, password, logon_type);
 
        if (!NT_STATUS_IS_OK(result))
                goto done;

diff --git a/source/rpcclient/rpcclient.c b/source/rpcclient/rpcclient.c
index b01e2d694c55b8573bc89d68018ef61f3d17f2b9..a1b0a8cd34550d41e035b0e77777487552e0bccd 100644 (file)
--- a/source/rpcclient/rpcclient.c
+++ b/source/rpcclient/rpcclient.c
@@ -391,6 +391,14 @@ static NTSTATUS do_cmd(struct cli_state *cli,
 
        /* Open pipe */
 
+       if (cmd_entry->pipe_idx != -1) {
+               if (!cli_nt_session_open(cli, cmd_entry->pipe_idx)) {
+                       DEBUG(0, ("Could not initialise %s\n",
+                                 get_pipe_name_from_index(cmd_entry->pipe_idx)));
+                       return NT_STATUS_UNSUCCESSFUL;
+               }
+       }
+
        if (cmd_entry->pipe_idx == PI_NETLOGON) {
                uchar trust_password[16];
                uint32 sec_channel_type;
@@ -401,19 +409,11 @@ static NTSTATUS do_cmd(struct cli_state *cli,
                        return NT_STATUS_UNSUCCESSFUL;
                }
 
-               if (!cli_nt_open_netlogon(cli, trust_password,
-                                         sec_channel_type)) {
+               if (!NT_STATUS_IS_OK(cli_nt_establish_netlogon(cli, sec_channel_type,
+                                                              trust_password))) {
                        DEBUG(0, ("Could not initialise NETLOGON pipe\n"));
                        return NT_STATUS_UNSUCCESSFUL;
                }
-       } else {
-               if (cmd_entry->pipe_idx != -1) {
-                       if (!cli_nt_session_open(cli, cmd_entry->pipe_idx)) {
-                               DEBUG(0, ("Could not initialise %s\n",
-                                         get_pipe_name_from_index(cmd_entry->pipe_idx)));
-                               return NT_STATUS_UNSUCCESSFUL;
-                       }
-               }
        }
 
      /* Run command */

diff --git a/source/utils/net_rpc_samsync.c b/source/utils/net_rpc_samsync.c
index 42bb480844a4b56deae915548b840c284fa7bc82..fd00fa6bc31fc79b13b5eaf58eaf9192250c7003 100644 (file)
--- a/source/utils/net_rpc_samsync.c
+++ b/source/utils/net_rpc_samsync.c
@@ -209,6 +209,11 @@ int rpc_samdump(int argc, const char **argv)
 
        fstrcpy(cli->domain, lp_workgroup());
 
+       if (!cli_nt_session_open(cli, PI_NETLOGON)) {
+               DEBUG(0,("Could not open connection to NETLOGON pipe\n"));
+               goto fail;
+       }
+
        if (!secrets_fetch_trust_account_password(lp_workgroup(),
                                                  trust_password,
                                                  NULL, &sec_channel)) {
@@ -216,7 +221,8 @@ int rpc_samdump(int argc, const char **argv)
                goto fail;
        }
 
-       if (!cli_nt_open_netlogon(cli, trust_password, sec_channel)) {
+       if (!NT_STATUS_IS_OK(cli_nt_establish_netlogon(cli, sec_channel,
+                                                      trust_password))) {
                DEBUG(0,("Error connecting to NETLOGON pipe\n"));
                goto fail;
        }