s3-librpc Make cli_rpc_pipe_open_spnego_ntlmssp() generic

This also avoids passing NULL as the server to
gensec_set_target_hostname() in spnego_generic_init_client().

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c
index 9091d879b8247bda0519ad92654419cf989a56f1..2ddf7bceb1110d5d5cb6b098eccc77079ad7798a 100644 (file)
--- a/source3/rpc_client/cli_pipe.c
+++ b/source3/rpc_client/cli_pipe.c
@@ -2926,96 +2926,21 @@ NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
        return NT_STATUS_OK;
 }
 
-NTSTATUS cli_rpc_pipe_open_spnego_krb5(struct cli_state *cli,
-                                       const struct ndr_syntax_id *interface,
-                                       enum dcerpc_transport_t transport,
-                                       enum dcerpc_AuthLevel auth_level,
-                                       const char *server,
-                                       const char *username,
-                                       const char *password,
-                                       struct rpc_pipe_client **presult)
-{
-       struct rpc_pipe_client *result;
-       struct pipe_auth_data *auth;
-       struct spnego_context *spnego_ctx;
-       NTSTATUS status;
-       const char *target_service = "cifs"; /* TODO: Determine target service from the bindings or interface table */
-
-       status = cli_rpc_pipe_open(cli, transport, interface, &result);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
-
-       auth = talloc(result, struct pipe_auth_data);
-       if (auth == NULL) {
-               status = NT_STATUS_NO_MEMORY;
-               goto err_out;
-       }
-       auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
-       auth->auth_level = auth_level;
-
-       if (!username) {
-               username = "";
-       }
-       auth->user_name = talloc_strdup(auth, username);
-       if (!auth->user_name) {
-               status = NT_STATUS_NO_MEMORY;
-               goto err_out;
-       }
-
-       /* Fixme, should we fetch/set the Realm ? */
-       auth->domain = talloc_strdup(auth, "");
-       if (!auth->domain) {
-               status = NT_STATUS_NO_MEMORY;
-               goto err_out;
-       }
-
-       status = spnego_generic_init_client(auth,
-                                           GENSEC_OID_KERBEROS5,
-                                           (auth->auth_level ==
-                                               DCERPC_AUTH_LEVEL_INTEGRITY),
-                                           (auth->auth_level ==
-                                               DCERPC_AUTH_LEVEL_PRIVACY),
-                                           true,
-                                           server, target_service,
-                                           auth->domain, auth->user_name, password,
-                                           &spnego_ctx);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0, ("spnego_init_client returned %s\n",
-                         nt_errstr(status)));
-               goto err_out;
-       }
-       auth->auth_ctx = spnego_ctx;
-
-       status = rpc_pipe_bind(result, auth);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
-                         nt_errstr(status)));
-               goto err_out;
-       }
-
-       *presult = result;
-       return NT_STATUS_OK;
-
-err_out:
-       TALLOC_FREE(result);
-       return status;
-}
-
-NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
-                                         const struct ndr_syntax_id *interface,
-                                         enum dcerpc_transport_t transport,
-                                         enum dcerpc_AuthLevel auth_level,
-                                         const char *domain,
-                                         const char *username,
-                                         const char *password,
-                                         struct rpc_pipe_client **presult)
+NTSTATUS cli_rpc_pipe_open_spnego(struct cli_state *cli,
+                                 const struct ndr_syntax_id *interface,
+                                 enum dcerpc_transport_t transport,
+                                 const char *oid,
+                                 enum dcerpc_AuthLevel auth_level,
+                                 const char *server,
+                                 const char *domain,
+                                 const char *username,
+                                 const char *password,
+                                 struct rpc_pipe_client **presult)
 {
        struct rpc_pipe_client *result;
        struct pipe_auth_data *auth;
        struct spnego_context *spnego_ctx;
        NTSTATUS status;
-       const char *server = NULL;
        const char *target_service = "cifs"; /* TODO: Determine target service from the bindings or interface table */
 
        status = cli_rpc_pipe_open(cli, transport, interface, &result);
@@ -3050,7 +2975,7 @@ NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
        }
 
        status = spnego_generic_init_client(auth,
-                                           GENSEC_OID_NTLMSSP,
+                                           oid,
                                            (auth->auth_level ==
                                                DCERPC_AUTH_LEVEL_INTEGRITY),
                                            (auth->auth_level ==

diff --git a/source3/rpc_client/cli_pipe.h b/source3/rpc_client/cli_pipe.h
index a9d5784643044a79bf7abdaf7406780582fe2f4e..25c9fca825633b7427c98d28b760aef325f2ae3b 100644 (file)
--- a/source3/rpc_client/cli_pipe.h
+++ b/source3/rpc_client/cli_pipe.h
@@ -95,14 +95,16 @@ NTSTATUS cli_rpc_pipe_open_generic_auth(struct cli_state *cli,
                                        const char *password,
                                        struct rpc_pipe_client **presult);
 
-NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
-                                         const struct ndr_syntax_id *interface,
-                                         enum dcerpc_transport_t transport,
-                                         enum dcerpc_AuthLevel auth_level,
-                                         const char *domain,
-                                         const char *username,
-                                         const char *password,
-                                         struct rpc_pipe_client **presult);
+NTSTATUS cli_rpc_pipe_open_spnego(struct cli_state *cli,
+                                 const struct ndr_syntax_id *interface,
+                                 enum dcerpc_transport_t transport,
+                                 const char *oid,
+                                 enum dcerpc_AuthLevel auth_level,
+                                 const char *server,
+                                 const char *domain,
+                                 const char *username,
+                                 const char *password,
+                                 struct rpc_pipe_client **presult);
 
 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
                                             const struct ndr_syntax_id *interface,
@@ -137,15 +139,6 @@ NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
                                const char *password,
                                struct rpc_pipe_client **presult);
 
-NTSTATUS cli_rpc_pipe_open_spnego_krb5(struct cli_state *cli,
-                                       const struct ndr_syntax_id *interface,
-                                       enum dcerpc_transport_t transport,
-                                       enum dcerpc_AuthLevel auth_level,
-                                       const char *server,
-                                       const char *username,
-                                       const char *password,
-                                       struct rpc_pipe_client **presult);
-
 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
                             struct rpc_pipe_client *cli,
                             DATA_BLOB *session_key);

diff --git a/source3/rpc_client/cli_pipe_schannel.c b/source3/rpc_client/cli_pipe_schannel.c
index 2c937df0f0985fd382c2c8098dadf21df58cadae..4a11f08a12b3880e5df977d96d253144b910dcda 100644 (file)
--- a/source3/rpc_client/cli_pipe_schannel.c
+++ b/source3/rpc_client/cli_pipe_schannel.c
@@ -27,6 +27,7 @@
 #include "librpc/rpc/dcerpc.h"
 #include "passdb.h"
 #include "libsmb/libsmb.h"
+#include "auth/gensec/gensec.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_RPC_CLI
@@ -98,9 +99,11 @@ static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
        struct rpc_pipe_client *netlogon_pipe = NULL;
        NTSTATUS status;
 
-       status = cli_rpc_pipe_open_spnego_ntlmssp(
+       status = cli_rpc_pipe_open_spnego(
                cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
+               GENSEC_OID_NTLMSSP,
                DCERPC_AUTH_LEVEL_PRIVACY,
+               cli_state_remote_name(cli),
                domain, username, password, &netlogon_pipe);
        if (!NT_STATUS_IS_OK(status)) {
                return status;

diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c
index 27deff56ffce44425bb3e287e13485aa2adf0226..39b54bf0524ab8674704f2ffac7acd0f76a35e7e 100644 (file)
--- a/source3/rpcclient/rpcclient.c
+++ b/source3/rpcclient/rpcclient.c
@@ -31,6 +31,7 @@
 #include "../libcli/security/security.h"
 #include "passdb.h"
 #include "libsmb/libsmb.h"
+#include "auth/gensec/gensec.h"
 
 enum pipe_auth_type_spnego {
        PIPE_AUTH_TYPE_SPNEGO_NONE = 0,
@@ -690,30 +691,29 @@ static NTSTATUS do_cmd(struct cli_state *cli,
                                &cmd_entry->rpc_pipe);
                        break;
                case DCERPC_AUTH_TYPE_SPNEGO:
+               {
+                       /* won't happen, but if it does it will fail in cli_rpc_pipe_open_spnego() eventually */
+                       const char *oid = "INVALID";
                        switch (pipe_default_auth_spnego_type) {
                        case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
-                               ntresult = cli_rpc_pipe_open_spnego_ntlmssp(
-                                               cli, cmd_entry->interface,
-                                               default_transport,
-                                               pipe_default_auth_level,
-                                               get_cmdline_auth_info_domain(auth_info),
-                                               get_cmdline_auth_info_username(auth_info),
-                                               get_cmdline_auth_info_password(auth_info),
-                                               &cmd_entry->rpc_pipe);
+                               oid = GENSEC_OID_NTLMSSP;
                                break;
                        case PIPE_AUTH_TYPE_SPNEGO_KRB5:
-                               ntresult = cli_rpc_pipe_open_spnego_krb5(
-                                               cli, cmd_entry->interface,
-                                               default_transport,
-                                               pipe_default_auth_level,
-                                               cli_state_remote_name(cli),
-                                               NULL, NULL,
-                                               &cmd_entry->rpc_pipe);
+                               oid = GENSEC_OID_KERBEROS5;
                                break;
-                       default:
-                               ntresult = NT_STATUS_INTERNAL_ERROR;
                        }
+                       ntresult = cli_rpc_pipe_open_spnego(
+                               cli, cmd_entry->interface,
+                               default_transport,
+                               oid,
+                               pipe_default_auth_level,
+                               cli_state_remote_name(cli),
+                               get_cmdline_auth_info_domain(auth_info),
+                               get_cmdline_auth_info_username(auth_info),
+                               get_cmdline_auth_info_password(auth_info),
+                               &cmd_entry->rpc_pipe);
                        break;
+               }
                case DCERPC_AUTH_TYPE_NTLMSSP:
                case DCERPC_AUTH_TYPE_KRB5:
                        ntresult = cli_rpc_pipe_open_generic_auth(

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index 85630502734a0ca872f51ca1c20c1eb70b59a418..5d8826127bc8878e8d65e5ac82b1f877e58bffe6 100644 (file)
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -76,6 +76,7 @@
 #include "../libcli/security/security.h"
 #include "passdb.h"
 #include "messages.h"
+#include "auth/gensec/gensec.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
@@ -2189,14 +2190,16 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 
        /* We have an authenticated connection. Use a NTLMSSP SPNEGO
           authenticated SAMR pipe with sign & seal. */
-       status = cli_rpc_pipe_open_spnego_ntlmssp(conn->cli,
-                                                 &ndr_table_samr.syntax_id,
-                                                 NCACN_NP,
-                                                 DCERPC_AUTH_LEVEL_PRIVACY,
-                                                 domain_name,
-                                                 machine_account,
-                                                 machine_password,
-                                                 &conn->samr_pipe);
+       status = cli_rpc_pipe_open_spnego(conn->cli,
+                                         &ndr_table_samr.syntax_id,
+                                         NCACN_NP,
+                                         GENSEC_OID_NTLMSSP,
+                                         DCERPC_AUTH_LEVEL_PRIVACY,
+                                         cli_state_remote_name(conn->cli),
+                                         domain_name,
+                                         machine_account,
+                                         machine_password,
+                                         &conn->samr_pipe);
 
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
@@ -2427,9 +2430,11 @@ NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 
        /* We have an authenticated connection. Use a NTLMSSP SPNEGO
         * authenticated LSA pipe with sign & seal. */
-       result = cli_rpc_pipe_open_spnego_ntlmssp
+       result = cli_rpc_pipe_open_spnego
                (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
+                GENSEC_OID_NTLMSSP,
                 DCERPC_AUTH_LEVEL_PRIVACY,
+                cli_state_remote_name(conn->cli),
                 conn->cli->domain, conn->cli->user_name, conn->cli->password,
                 &conn->lsa_pipe);