4 files changed, 33 insertions, 15 deletions
diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h
index 9083bfb795..16bf52cec2 100644
--- a/source4/librpc/rpc/dcerpc.h
+++ b/source4/librpc/rpc/dcerpc.h
@@ -63,6 +63,9 @@ struct dcerpc_pipe {
 		/* a callback to the dcerpc code when a full fragment
 		   has been received */
 		void (*recv_data)(struct dcerpc_pipe *, DATA_BLOB *, NTSTATUS status);
+
+		/* get the transport level session key */
+		NTSTATUS (*session_key)(struct dcerpc_pipe *, DATA_BLOB *);
 	} transport;
 
 	/* the last fault code from a DCERPC fault */
diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c
index deef2232bf..fa9101bbd6 100644
--- a/source4/librpc/rpc/dcerpc_smb.c
+++ b/source4/librpc/rpc/dcerpc_smb.c
@@ -348,6 +348,21 @@ static const char *smb_peer_name(struct dcerpc_pipe *p)
 	return smb->tree->session->transport->called.name;
 }
 
+/*
+  fetch the user session key 
+*/
+NTSTATUS smb_session_key(struct dcerpc_pipe *p, DATA_BLOB *session_key)
+{
+	struct smb_private *smb = p->transport.private;
+
+	if (smb->tree->session->user_session_key.data) {
+		*session_key = smb->tree->session->user_session_key;
+		return NT_STATUS_OK;
+	}
+
+	return NT_STATUS_NO_USER_SESSION_KEY;
+}
+
 /* 
    open a rpc connection to a named pipe 
 */
@@ -410,6 +425,7 @@ NTSTATUS dcerpc_pipe_open_smb(struct dcerpc_pipe **p,
 	(*p)->transport.private = NULL;
 	(*p)->transport.shutdown_pipe = smb_shutdown_pipe;
 	(*p)->transport.peer_name = smb_peer_name;
+	(*p)->transport.session_key = smb_session_key;
 
 	(*p)->transport.send_request = smb_send_request;
 	(*p)->transport.send_read = send_read_request;
diff --git a/source4/librpc/rpc/dcerpc_tcp.c b/source4/librpc/rpc/dcerpc_tcp.c
index 896675a7f8..c290891b61 100644
--- a/source4/librpc/rpc/dcerpc_tcp.c
+++ b/source4/librpc/rpc/dcerpc_tcp.c
@@ -272,6 +272,18 @@ static const char *tcp_peer_name(struct dcerpc_pipe *p)
 }
 
 
+/*
+  fetch the user session key 
+*/
+NTSTATUS tcp_session_key(struct dcerpc_pipe *p, DATA_BLOB *session_key)
+{
+	/* this took quite a few CPU cycles to find ... */
+	session_key->data = "SystemLibraryDTC";
+	session_key->length = 16;
+
+	return NT_STATUS_OK;
+}
+
 /* 
    open a rpc connection to a named pipe 
 */
@@ -319,6 +331,7 @@ NTSTATUS dcerpc_pipe_open_tcp(struct dcerpc_pipe **p,
 
 	(*p)->transport.shutdown_pipe = tcp_shutdown_pipe;
 	(*p)->transport.peer_name = tcp_peer_name;
+	(*p)->transport.session_key = tcp_session_key;
 	
 	tcp = talloc((*p), sizeof(*tcp));
 	if (!tcp) {
diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c
index c04937353c..fc9f6c847d 100644
--- a/source4/librpc/rpc/dcerpc_util.c
+++ b/source4/librpc/rpc/dcerpc_util.c
@@ -699,21 +699,7 @@ NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p, struct dcerpc_pipe *
 NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p,
 				  DATA_BLOB *session_key)
 {
-	struct smbcli_tree *tree;
-
-	if (p->security_state.generic_state) {
-		return gensec_session_key(p->security_state.generic_state, session_key);
-	}
-	
-	tree = dcerpc_smb_tree(p);
-	if (tree) {
-		if (tree->session->user_session_key.data) {
-			*session_key = tree->session->user_session_key;
-			return NT_STATUS_OK;
-		}
-	}
-
-	return NT_STATUS_NO_USER_SESSION_KEY;
+	return p->transport.session_key(p, session_key);
 }