?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix the build of nfs4_acls.c
[Samba.git] / source3 / libsmb / cliconnect.c
blob16c15ce7db96505f3eef1cea76b3475489ae426f
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../libcli/auth/libcli_auth.h"
23
24 static const struct {
25 int prot;
26 const char name[24];
27 } prots[10] = {
28 {PROTOCOL_CORE, "PC NETWORK PROGRAM 1.0"},
29 {PROTOCOL_COREPLUS, "MICROSOFT NETWORKS 1.03"},
30 {PROTOCOL_LANMAN1, "MICROSOFT NETWORKS 3.0"},
31 {PROTOCOL_LANMAN1, "LANMAN1.0"},
32 {PROTOCOL_LANMAN2, "LM1.2X002"},
33 {PROTOCOL_LANMAN2, "DOS LANMAN2.1"},
34 {PROTOCOL_LANMAN2, "LANMAN2.1"},
35 {PROTOCOL_LANMAN2, "Samba"},
36 {PROTOCOL_NT1, "NT LANMAN 1.0"},
37 {PROTOCOL_NT1, "NT LM 0.12"},
38 };
39
40 #define STAR_SMBSERVER "*SMBSERVER"
41
42 /**
43 * Set the user session key for a connection
44 * @param cli The cli structure to add it too
45 * @param session_key The session key used. (A copy of this is taken for the cli struct)
46 *
47 */
48
49 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
50 {
51 cli->user_session_key = data_blob(session_key.data, session_key.length);
52 }
53
54 /****************************************************************************
55 Do an old lanman2 style session setup.
56 ****************************************************************************/
57
58 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
59 const char *user,
60 const char *pass, size_t passlen,
61 const char *workgroup)
62 {
63 DATA_BLOB session_key = data_blob_null;
64 DATA_BLOB lm_response = data_blob_null;
65 NTSTATUS status;
66 fstring pword;
67 char *p;
68
69 if (passlen > sizeof(pword)-1) {
70 return NT_STATUS_INVALID_PARAMETER;
71 }
72
73 /* LANMAN servers predate NT status codes and Unicode and ignore those
74 smb flags so we must disable the corresponding default capabilities
75 that would otherwise cause the Unicode and NT Status flags to be
76 set (and even returned by the server) */
77
78 cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
79
80 /* if in share level security then don't send a password now */
81 if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
82 passlen = 0;
83
84 if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
85 /* Encrypted mode needed, and non encrypted password supplied. */
86 lm_response = data_blob(NULL, 24);
87 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
88 DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
89 return NT_STATUS_ACCESS_DENIED;
90 }
91 } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
92 /* Encrypted mode needed, and encrypted password supplied. */
93 lm_response = data_blob(pass, passlen);
94 } else if (passlen > 0) {
95 /* Plaintext mode needed, assume plaintext supplied. */
96 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
97 lm_response = data_blob(pass, passlen);
98 }
99
100 /* send a session setup command */
101 memset(cli->outbuf,'\0',smb_size);
102 cli_set_message(cli->outbuf,10, 0, True);
103 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
104 cli_setup_packet(cli);
105
106 SCVAL(cli->outbuf,smb_vwv0,0xFF);
107 SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
108 SSVAL(cli->outbuf,smb_vwv3,2);
109 SSVAL(cli->outbuf,smb_vwv4,1);
110 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
111 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
112
113 p = smb_buf(cli->outbuf);
114 memcpy(p,lm_response.data,lm_response.length);
115 p += lm_response.length;
116 p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
117 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
118 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
119 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
120 cli_setup_bcc(cli, p);
121
122 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
123 return cli_nt_error(cli);
124 }
125
126 show_msg(cli->inbuf);
127
128 if (cli_is_error(cli)) {
129 return cli_nt_error(cli);
130 }
131
132 /* use the returned vuid from now on */
133 cli->vuid = SVAL(cli->inbuf,smb_uid);
134 status = cli_set_username(cli, user);
135 if (!NT_STATUS_IS_OK(status)) {
136 return status;
137 }
138
139 if (session_key.data) {
140 /* Have plaintext orginal */
141 cli_set_session_key(cli, session_key);
142 }
143
144 return NT_STATUS_OK;
145 }
146
147 /****************************************************************************
148 Work out suitable capabilities to offer the server.
149 ****************************************************************************/
150
151 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
152 {
153 uint32 capabilities = CAP_NT_SMBS;
154
155 if (!cli->force_dos_errors)
156 capabilities |= CAP_STATUS32;
157
158 if (cli->use_level_II_oplocks)
159 capabilities |= CAP_LEVEL_II_OPLOCKS;
160
161 capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
162 return capabilities;
163 }
164
165 /****************************************************************************
166 Do a NT1 guest session setup.
167 ****************************************************************************/
168
169 struct cli_session_setup_guest_state {
170 struct cli_state *cli;
171 uint16_t vwv[16];
172 struct iovec bytes;
173 };
174
175 static void cli_session_setup_guest_done(struct tevent_req *subreq);
176
177 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
178 struct event_context *ev,
179 struct cli_state *cli,
180 struct tevent_req **psmbreq)
181 {
182 struct tevent_req *req, *subreq;
183 struct cli_session_setup_guest_state *state;
184 uint16_t *vwv;
185 uint8_t *bytes;
186
187 req = tevent_req_create(mem_ctx, &state,
188 struct cli_session_setup_guest_state);
189 if (req == NULL) {
190 return NULL;
191 }
192 state->cli = cli;
193 vwv = state->vwv;
194
195 SCVAL(vwv+0, 0, 0xFF);
196 SCVAL(vwv+0, 1, 0);
197 SSVAL(vwv+1, 0, 0);
198 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
199 SSVAL(vwv+3, 0, 2);
200 SSVAL(vwv+4, 0, cli->pid);
201 SIVAL(vwv+5, 0, cli->sesskey);
202 SSVAL(vwv+7, 0, 0);
203 SSVAL(vwv+8, 0, 0);
204 SSVAL(vwv+9, 0, 0);
205 SSVAL(vwv+10, 0, 0);
206 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
207
208 bytes = talloc_array(state, uint8_t, 0);
209
210 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* username */
211 NULL);
212 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
213 NULL);
214 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
215 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
216
217 if (bytes == NULL) {
218 TALLOC_FREE(req);
219 return NULL;
220 }
221
222 state->bytes.iov_base = (void *)bytes;
223 state->bytes.iov_len = talloc_get_size(bytes);
224
225 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
226 1, &state->bytes);
227 if (subreq == NULL) {
228 TALLOC_FREE(req);
229 return NULL;
230 }
231 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
232 *psmbreq = subreq;
233 return req;
234 }
235
236 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
237 struct event_context *ev,
238 struct cli_state *cli)
239 {
240 struct tevent_req *req, *subreq;
241 NTSTATUS status;
242
243 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
244 if (req == NULL) {
245 return NULL;
246 }
247
248 status = cli_smb_req_send(subreq);
249 if (NT_STATUS_IS_OK(status)) {
250 tevent_req_nterror(req, status);
251 return tevent_req_post(req, ev);
252 }
253 return req;
254 }
255
256 static void cli_session_setup_guest_done(struct tevent_req *subreq)
257 {
258 struct tevent_req *req = tevent_req_callback_data(
259 subreq, struct tevent_req);
260 struct cli_session_setup_guest_state *state = tevent_req_data(
261 req, struct cli_session_setup_guest_state);
262 struct cli_state *cli = state->cli;
263 uint32_t num_bytes;
264 char *inbuf;
265 uint8_t *bytes;
266 uint8_t *p;
267 NTSTATUS status;
268
269 status = cli_smb_recv(subreq, 0, NULL, NULL, &num_bytes, &bytes);
270 if (!NT_STATUS_IS_OK(status)) {
271 TALLOC_FREE(subreq);
272 tevent_req_nterror(req, status);
273 return;
274 }
275
276 inbuf = (char *)cli_smb_inbuf(subreq);
277 p = bytes;
278
279 cli->vuid = SVAL(inbuf, smb_uid);
280
281 p += clistr_pull(inbuf, cli->server_os, (char *)p, sizeof(fstring),
282 bytes+num_bytes-p, STR_TERMINATE);
283 p += clistr_pull(inbuf, cli->server_type, (char *)p, sizeof(fstring),
284 bytes+num_bytes-p, STR_TERMINATE);
285 p += clistr_pull(inbuf, cli->server_domain, (char *)p, sizeof(fstring),
286 bytes+num_bytes-p, STR_TERMINATE);
287
288 if (strstr(cli->server_type, "Samba")) {
289 cli->is_samba = True;
290 }
291
292 TALLOC_FREE(subreq);
293
294 status = cli_set_username(cli, "");
295 if (!NT_STATUS_IS_OK(status)) {
296 tevent_req_nterror(req, status);
297 return;
298 }
299 tevent_req_done(req);
300 }
301
302 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
303 {
304 return tevent_req_simple_recv_ntstatus(req);
305 }
306
307 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
308 {
309 TALLOC_CTX *frame = talloc_stackframe();
310 struct event_context *ev;
311 struct tevent_req *req;
312 NTSTATUS status = NT_STATUS_OK;
313
314 if (cli_has_async_calls(cli)) {
315 /*
316 * Can't use sync call while an async call is in flight
317 */
318 status = NT_STATUS_INVALID_PARAMETER;
319 goto fail;
320 }
321
322 ev = event_context_init(frame);
323 if (ev == NULL) {
324 status = NT_STATUS_NO_MEMORY;
325 goto fail;
326 }
327
328 req = cli_session_setup_guest_send(frame, ev, cli);
329 if (req == NULL) {
330 status = NT_STATUS_NO_MEMORY;
331 goto fail;
332 }
333
334 if (!tevent_req_poll(req, ev)) {
335 status = map_nt_error_from_unix(errno);
336 goto fail;
337 }
338
339 status = cli_session_setup_guest_recv(req);
340 fail:
341 TALLOC_FREE(frame);
342 if (!NT_STATUS_IS_OK(status)) {
343 cli_set_error(cli, status);
344 }
345 return status;
346 }
347
348 /****************************************************************************
349 Do a NT1 plaintext session setup.
350 ****************************************************************************/
351
352 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
353 const char *user, const char *pass,
354 const char *workgroup)
355 {
356 uint32 capabilities = cli_session_setup_capabilities(cli);
357 char *p;
358 NTSTATUS status;
359 fstring lanman;
360
361 fstr_sprintf( lanman, "Samba %s", samba_version_string());
362
363 memset(cli->outbuf, '\0', smb_size);
364 cli_set_message(cli->outbuf,13,0,True);
365 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
366 cli_setup_packet(cli);
367
368 SCVAL(cli->outbuf,smb_vwv0,0xFF);
369 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
370 SSVAL(cli->outbuf,smb_vwv3,2);
371 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
372 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
373 SSVAL(cli->outbuf,smb_vwv8,0);
374 SIVAL(cli->outbuf,smb_vwv11,capabilities);
375 p = smb_buf(cli->outbuf);
376
377 /* check wether to send the ASCII or UNICODE version of the password */
378
379 if ( (capabilities & CAP_UNICODE) == 0 ) {
380 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
381 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
382 }
383 else {
384 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
385 * the space taken by the unicode password to be one byte too
386 * long (as we're on an odd byte boundary here). Reduce the
387 * count by 1 to cope with this. Fixes smbclient against NetApp
388 * servers which can't cope. Fix from
389 * bryan.kolodziej@allenlund.com in bug #3840.
390 */
391 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
392 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
393 }
394
395 p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
396 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
397 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
398 p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
399 cli_setup_bcc(cli, p);
400
401 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
402 return cli_nt_error(cli);
403 }
404
405 show_msg(cli->inbuf);
406
407 if (cli_is_error(cli)) {
408 return cli_nt_error(cli);
409 }
410
411 cli->vuid = SVAL(cli->inbuf,smb_uid);
412 p = smb_buf(cli->inbuf);
413 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
414 -1, STR_TERMINATE);
415 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
416 -1, STR_TERMINATE);
417 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
418 -1, STR_TERMINATE);
419 status = cli_set_username(cli, user);
420 if (!NT_STATUS_IS_OK(status)) {
421 return status;
422 }
423 if (strstr(cli->server_type, "Samba")) {
424 cli->is_samba = True;
425 }
426
427 return NT_STATUS_OK;
428 }
429
430 /****************************************************************************
431 do a NT1 NTLM/LM encrypted session setup - for when extended security
432 is not negotiated.
433 @param cli client state to create do session setup on
434 @param user username
435 @param pass *either* cleartext password (passlen !=24) or LM response.
436 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
437 @param workgroup The user's domain.
438 ****************************************************************************/
439
440 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
441 const char *pass, size_t passlen,
442 const char *ntpass, size_t ntpasslen,
443 const char *workgroup)
444 {
445 uint32 capabilities = cli_session_setup_capabilities(cli);
446 DATA_BLOB lm_response = data_blob_null;
447 DATA_BLOB nt_response = data_blob_null;
448 DATA_BLOB session_key = data_blob_null;
449 NTSTATUS result;
450 char *p;
451 bool ok;
452
453 if (passlen == 0) {
454 /* do nothing - guest login */
455 } else if (passlen != 24) {
456 if (lp_client_ntlmv2_auth()) {
457 DATA_BLOB server_chal;
458 DATA_BLOB names_blob;
459 server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
460
461 /* note that the 'workgroup' here is a best guess - we don't know
462 the server's domain at this point. The 'server name' is also
463 dodgy...
464 */
465 names_blob = NTLMv2_generate_names_blob(NULL, cli->called.name, workgroup);
466
467 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass, &server_chal,
468 &names_blob,
469 &lm_response, &nt_response, NULL, &session_key)) {
470 data_blob_free(&names_blob);
471 data_blob_free(&server_chal);
472 return NT_STATUS_ACCESS_DENIED;
473 }
474 data_blob_free(&names_blob);
475 data_blob_free(&server_chal);
476
477 } else {
478 uchar nt_hash[16];
479 E_md4hash(pass, nt_hash);
480
481 #ifdef LANMAN_ONLY
482 nt_response = data_blob_null;
483 #else
484 nt_response = data_blob(NULL, 24);
485 SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
486 #endif
487 /* non encrypted password supplied. Ignore ntpass. */
488 if (lp_client_lanman_auth()) {
489 lm_response = data_blob(NULL, 24);
490 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
491 /* Oops, the LM response is invalid, just put
492 the NT response there instead */
493 data_blob_free(&lm_response);
494 lm_response = data_blob(nt_response.data, nt_response.length);
495 }
496 } else {
497 /* LM disabled, place NT# in LM field instead */
498 lm_response = data_blob(nt_response.data, nt_response.length);
499 }
500
501 session_key = data_blob(NULL, 16);
502 #ifdef LANMAN_ONLY
503 E_deshash(pass, session_key.data);
504 memset(&session_key.data[8], '\0', 8);
505 #else
506 SMBsesskeygen_ntv1(nt_hash, session_key.data);
507 #endif
508 }
509 cli_temp_set_signing(cli);
510 } else {
511 /* pre-encrypted password supplied. Only used for
512 security=server, can't do
513 signing because we don't have original key */
514
515 lm_response = data_blob(pass, passlen);
516 nt_response = data_blob(ntpass, ntpasslen);
517 }
518
519 /* send a session setup command */
520 memset(cli->outbuf,'\0',smb_size);
521
522 cli_set_message(cli->outbuf,13,0,True);
523 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
524 cli_setup_packet(cli);
525
526 SCVAL(cli->outbuf,smb_vwv0,0xFF);
527 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
528 SSVAL(cli->outbuf,smb_vwv3,2);
529 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
530 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
531 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
532 SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
533 SIVAL(cli->outbuf,smb_vwv11,capabilities);
534 p = smb_buf(cli->outbuf);
535 if (lm_response.length) {
536 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
537 }
538 if (nt_response.length) {
539 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
540 }
541 p += clistr_push(cli, p, user, -1, STR_TERMINATE);
542
543 /* Upper case here might help some NTLMv2 implementations */
544 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
545 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
546 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
547 cli_setup_bcc(cli, p);
548
549 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
550 result = cli_nt_error(cli);
551 goto end;
552 }
553
554 /* show_msg(cli->inbuf); */
555
556 if (cli_is_error(cli)) {
557 result = cli_nt_error(cli);
558 goto end;
559 }
560
561 #ifdef LANMAN_ONLY
562 ok = cli_simple_set_signing(cli, session_key, lm_response);
563 #else
564 ok = cli_simple_set_signing(cli, session_key, nt_response);
565 #endif
566 if (ok) {
567 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
568 result = NT_STATUS_ACCESS_DENIED;
569 goto end;
570 }
571 }
572
573 /* use the returned vuid from now on */
574 cli->vuid = SVAL(cli->inbuf,smb_uid);
575
576 p = smb_buf(cli->inbuf);
577 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
578 -1, STR_TERMINATE);
579 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
580 -1, STR_TERMINATE);
581 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
582 -1, STR_TERMINATE);
583
584 if (strstr(cli->server_type, "Samba")) {
585 cli->is_samba = True;
586 }
587
588 result = cli_set_username(cli, user);
589 if (!NT_STATUS_IS_OK(result)) {
590 goto end;
591 }
592
593 if (session_key.data) {
594 /* Have plaintext orginal */
595 cli_set_session_key(cli, session_key);
596 }
597
598 result = NT_STATUS_OK;
599 end:
600 data_blob_free(&lm_response);
601 data_blob_free(&nt_response);
602 data_blob_free(&session_key);
603 return result;
604 }
605
606 /****************************************************************************
607 Send a extended security session setup blob
608 ****************************************************************************/
609
610 static bool cli_session_setup_blob_send(struct cli_state *cli, DATA_BLOB blob)
611 {
612 uint32 capabilities = cli_session_setup_capabilities(cli);
613 char *p;
614
615 capabilities |= CAP_EXTENDED_SECURITY;
616
617 /* send a session setup command */
618 memset(cli->outbuf,'\0',smb_size);
619
620 cli_set_message(cli->outbuf,12,0,True);
621 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
622
623 cli_setup_packet(cli);
624
625 SCVAL(cli->outbuf,smb_vwv0,0xFF);
626 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
627 SSVAL(cli->outbuf,smb_vwv3,2);
628 SSVAL(cli->outbuf,smb_vwv4,1);
629 SIVAL(cli->outbuf,smb_vwv5,0);
630 SSVAL(cli->outbuf,smb_vwv7,blob.length);
631 SIVAL(cli->outbuf,smb_vwv10,capabilities);
632 p = smb_buf(cli->outbuf);
633 memcpy(p, blob.data, blob.length);
634 p += blob.length;
635 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
636 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
637 cli_setup_bcc(cli, p);
638 return cli_send_smb(cli);
639 }
640
641 /****************************************************************************
642 Send a extended security session setup blob, returning a reply blob.
643 ****************************************************************************/
644
645 static DATA_BLOB cli_session_setup_blob_receive(struct cli_state *cli)
646 {
647 DATA_BLOB blob2 = data_blob_null;
648 char *p;
649 size_t len;
650
651 if (!cli_receive_smb(cli))
652 return blob2;
653
654 show_msg(cli->inbuf);
655
656 if (cli_is_error(cli) && !NT_STATUS_EQUAL(cli_nt_error(cli),
657 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
658 return blob2;
659 }
660
661 /* use the returned vuid from now on */
662 cli->vuid = SVAL(cli->inbuf,smb_uid);
663
664 p = smb_buf(cli->inbuf);
665
666 blob2 = data_blob(p, SVAL(cli->inbuf, smb_vwv3));
667
668 p += blob2.length;
669 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
670 -1, STR_TERMINATE);
671
672 /* w2k with kerberos doesn't properly null terminate this field */
673 len = smb_bufrem(cli->inbuf, p);
674 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
675 len, 0);
676
677 return blob2;
678 }
679
680 #ifdef HAVE_KRB5
681 /****************************************************************************
682 Send a extended security session setup blob, returning a reply blob.
683 ****************************************************************************/
684
685 /* The following is calculated from :
686 * (smb_size-4) = 35
687 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
688 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
689 * end of packet.
690 */
691
692 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
693
694 static bool cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
695 {
696 int32 remaining = blob.length;
697 int32 cur = 0;
698 DATA_BLOB send_blob = data_blob_null;
699 int32 max_blob_size = 0;
700 DATA_BLOB receive_blob = data_blob_null;
701
702 if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
703 DEBUG(0,("cli_session_setup_blob: cli->max_xmit too small "
704 "(was %u, need minimum %u)\n",
705 (unsigned int)cli->max_xmit,
706 BASE_SESSSETUP_BLOB_PACKET_SIZE));
707 cli_set_nt_error(cli, NT_STATUS_INVALID_PARAMETER);
708 return False;
709 }
710
711 max_blob_size = cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE;
712
713 while ( remaining > 0) {
714 if (remaining >= max_blob_size) {
715 send_blob.length = max_blob_size;
716 remaining -= max_blob_size;
717 } else {
718 send_blob.length = remaining;
719 remaining = 0;
720 }
721
722 send_blob.data = &blob.data[cur];
723 cur += send_blob.length;
724
725 DEBUG(10, ("cli_session_setup_blob: Remaining (%u) sending (%u) current (%u)\n",
726 (unsigned int)remaining,
727 (unsigned int)send_blob.length,
728 (unsigned int)cur ));
729
730 if (!cli_session_setup_blob_send(cli, send_blob)) {
731 DEBUG(0, ("cli_session_setup_blob: send failed\n"));
732 return False;
733 }
734
735 receive_blob = cli_session_setup_blob_receive(cli);
736 data_blob_free(&receive_blob);
737
738 if (cli_is_error(cli) &&
739 !NT_STATUS_EQUAL( cli_get_nt_error(cli),
740 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
741 DEBUG(0, ("cli_session_setup_blob: receive failed "
742 "(%s)\n", nt_errstr(cli_get_nt_error(cli))));
743 cli->vuid = 0;
744 return False;
745 }
746 }
747
748 return True;
749 }
750
751 /****************************************************************************
752 Use in-memory credentials cache
753 ****************************************************************************/
754
755 static void use_in_memory_ccache(void) {
756 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
757 }
758
759 /****************************************************************************
760 Do a spnego/kerberos encrypted session setup.
761 ****************************************************************************/
762
763 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup)
764 {
765 DATA_BLOB negTokenTarg;
766 DATA_BLOB session_key_krb5;
767 NTSTATUS nt_status;
768 int rc;
769
770 cli_temp_set_signing(cli);
771
772 DEBUG(2,("Doing kerberos session setup\n"));
773
774 /* generate the encapsulated kerberos5 ticket */
775 rc = spnego_gen_negTokenTarg(principal, 0, &negTokenTarg, &session_key_krb5, 0, NULL);
776
777 if (rc) {
778 DEBUG(1, ("cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: %s\n",
779 error_message(rc)));
780 return ADS_ERROR_KRB5(rc);
781 }
782
783 #if 0
784 file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length);
785 #endif
786
787 if (!cli_session_setup_blob(cli, negTokenTarg)) {
788 nt_status = cli_nt_error(cli);
789 goto nt_error;
790 }
791
792 if (cli_is_error(cli)) {
793 nt_status = cli_nt_error(cli);
794 if (NT_STATUS_IS_OK(nt_status)) {
795 nt_status = NT_STATUS_UNSUCCESSFUL;
796 }
797 goto nt_error;
798 }
799
800 cli_set_session_key(cli, session_key_krb5);
801
802 if (cli_simple_set_signing(
803 cli, session_key_krb5, data_blob_null)) {
804
805 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
806 nt_status = NT_STATUS_ACCESS_DENIED;
807 goto nt_error;
808 }
809 }
810
811 data_blob_free(&negTokenTarg);
812 data_blob_free(&session_key_krb5);
813
814 return ADS_ERROR_NT(NT_STATUS_OK);
815
816 nt_error:
817 data_blob_free(&negTokenTarg);
818 data_blob_free(&session_key_krb5);
819 cli->vuid = 0;
820 return ADS_ERROR_NT(nt_status);
821 }
822 #endif /* HAVE_KRB5 */
823
824
825 /****************************************************************************
826 Do a spnego/NTLMSSP encrypted session setup.
827 ****************************************************************************/
828
829 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
830 const char *pass, const char *domain)
831 {
832 struct ntlmssp_state *ntlmssp_state;
833 NTSTATUS nt_status;
834 int turn = 1;
835 DATA_BLOB msg1;
836 DATA_BLOB blob = data_blob_null;
837 DATA_BLOB blob_in = data_blob_null;
838 DATA_BLOB blob_out = data_blob_null;
839
840 cli_temp_set_signing(cli);
841
842 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
843 return nt_status;
844 }
845 ntlmssp_want_feature(ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
846
847 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
848 return nt_status;
849 }
850 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
851 return nt_status;
852 }
853 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, pass))) {
854 return nt_status;
855 }
856
857 do {
858 nt_status = ntlmssp_update(ntlmssp_state,
859 blob_in, &blob_out);
860 data_blob_free(&blob_in);
861 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(nt_status)) {
862 if (turn == 1) {
863 /* and wrap it in a SPNEGO wrapper */
864 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
865 } else {
866 /* wrap it in SPNEGO */
867 msg1 = spnego_gen_auth(blob_out);
868 }
869
870 /* now send that blob on its way */
871 if (!cli_session_setup_blob_send(cli, msg1)) {
872 DEBUG(3, ("Failed to send NTLMSSP/SPNEGO blob to server!\n"));
873 nt_status = NT_STATUS_UNSUCCESSFUL;
874 } else {
875 blob = cli_session_setup_blob_receive(cli);
876
877 nt_status = cli_nt_error(cli);
878 if (cli_is_error(cli) && NT_STATUS_IS_OK(nt_status)) {
879 if (cli->smb_rw_error == SMB_READ_BAD_SIG) {
880 nt_status = NT_STATUS_ACCESS_DENIED;
881 } else {
882 nt_status = NT_STATUS_UNSUCCESSFUL;
883 }
884 }
885 }
886 data_blob_free(&msg1);
887 }
888
889 if (!blob.length) {
890 if (NT_STATUS_IS_OK(nt_status)) {
891 nt_status = NT_STATUS_UNSUCCESSFUL;
892 }
893 } else if ((turn == 1) &&
894 NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
895 DATA_BLOB tmp_blob = data_blob_null;
896 /* the server might give us back two challenges */
897 if (!spnego_parse_challenge(blob, &blob_in,
898 &tmp_blob)) {
899 DEBUG(3,("Failed to parse challenges\n"));
900 nt_status = NT_STATUS_INVALID_PARAMETER;
901 }
902 data_blob_free(&tmp_blob);
903 } else {
904 if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
905 &blob_in)) {
906 DEBUG(3,("Failed to parse auth response\n"));
907 if (NT_STATUS_IS_OK(nt_status)
908 || NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED))
909 nt_status = NT_STATUS_INVALID_PARAMETER;
910 }
911 }
912 data_blob_free(&blob);
913 data_blob_free(&blob_out);
914 turn++;
915 } while (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED));
916
917 data_blob_free(&blob_in);
918
919 if (NT_STATUS_IS_OK(nt_status)) {
920
921 fstrcpy(cli->server_domain, ntlmssp_state->server_domain);
922 cli_set_session_key(cli, ntlmssp_state->session_key);
923
924 if (cli_simple_set_signing(
925 cli, ntlmssp_state->session_key, data_blob_null)) {
926
927 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
928 nt_status = NT_STATUS_ACCESS_DENIED;
929 }
930 }
931 }
932
933 /* we have a reference conter on ntlmssp_state, if we are signing
934 then the state will be kept by the signing engine */
935
936 ntlmssp_end(&ntlmssp_state);
937
938 if (!NT_STATUS_IS_OK(nt_status)) {
939 cli->vuid = 0;
940 }
941 return nt_status;
942 }
943
944 /****************************************************************************
945 Do a spnego encrypted session setup.
946
947 user_domain: The shortname of the domain the user/machine is a member of.
948 dest_realm: The realm we're connecting to, if NULL we use our default realm.
949 ****************************************************************************/
950
951 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
952 const char *pass, const char *user_domain,
953 const char * dest_realm)
954 {
955 char *principal = NULL;
956 char *OIDs[ASN1_MAX_OIDS];
957 int i;
958 DATA_BLOB blob;
959 const char *p = NULL;
960 char *account = NULL;
961 NTSTATUS status;
962
963 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
964
965 /* the server might not even do spnego */
966 if (cli->secblob.length <= 16) {
967 DEBUG(3,("server didn't supply a full spnego negprot\n"));
968 goto ntlmssp;
969 }
970
971 #if 0
972 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
973 #endif
974
975 /* there is 16 bytes of GUID before the real spnego packet starts */
976 blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
977
978 /* The server sent us the first part of the SPNEGO exchange in the
979 * negprot reply. It is WRONG to depend on the principal sent in the
980 * negprot reply, but right now we do it. If we don't receive one,
981 * we try to best guess, then fall back to NTLM. */
982 if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
983 data_blob_free(&blob);
984 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
985 }
986 data_blob_free(&blob);
987
988 /* make sure the server understands kerberos */
989 for (i=0;OIDs[i];i++) {
990 DEBUG(3,("got OID=%s\n", OIDs[i]));
991 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
992 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
993 cli->got_kerberos_mechanism = True;
994 }
995 talloc_free(OIDs[i]);
996 }
997
998 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
999
1000 status = cli_set_username(cli, user);
1001 if (!NT_STATUS_IS_OK(status)) {
1002 return ADS_ERROR_NT(status);
1003 }
1004
1005 #ifdef HAVE_KRB5
1006 /* If password is set we reauthenticate to kerberos server
1007 * and do not store results */
1008
1009 if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1010 ADS_STATUS rc;
1011
1012 if (pass && *pass) {
1013 int ret;
1014
1015 use_in_memory_ccache();
1016 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1017
1018 if (ret){
1019 TALLOC_FREE(principal);
1020 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1021 if (cli->fallback_after_kerberos)
1022 goto ntlmssp;
1023 return ADS_ERROR_KRB5(ret);
1024 }
1025 }
1026
1027 /* If we get a bad principal, try to guess it if
1028 we have a valid host NetBIOS name.
1029 */
1030 if (strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1031 TALLOC_FREE(principal);
1032 }
1033
1034 if (principal == NULL &&
1035 !is_ipaddress(cli->desthost) &&
1036 !strequal(STAR_SMBSERVER,
1037 cli->desthost)) {
1038 char *realm = NULL;
1039 char *machine = NULL;
1040 char *host = NULL;
1041 DEBUG(3,("cli_session_setup_spnego: got a "
1042 "bad server principal, trying to guess ...\n"));
1043
1044 host = strchr_m(cli->desthost, '.');
1045 if (host) {
1046 machine = SMB_STRNDUP(cli->desthost,
1047 host - cli->desthost);
1048 } else {
1049 machine = SMB_STRDUP(cli->desthost);
1050 }
1051 if (machine == NULL) {
1052 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1053 }
1054
1055 if (dest_realm) {
1056 realm = SMB_STRDUP(dest_realm);
1057 strupper_m(realm);
1058 } else {
1059 realm = kerberos_get_default_realm_from_ccache();
1060 }
1061 if (realm && *realm) {
1062 principal = talloc_asprintf(NULL, "%s$@%s",
1063 machine, realm);
1064 if (!principal) {
1065 SAFE_FREE(machine);
1066 SAFE_FREE(realm);
1067 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1068 }
1069 DEBUG(3,("cli_session_setup_spnego: guessed "
1070 "server principal=%s\n",
1071 principal ? principal : "<null>"));
1072 }
1073 SAFE_FREE(machine);
1074 SAFE_FREE(realm);
1075 }
1076
1077 if (principal) {
1078 rc = cli_session_setup_kerberos(cli, principal,
1079 dest_realm);
1080 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1081 TALLOC_FREE(principal);
1082 return rc;
1083 }
1084 }
1085 }
1086 #endif
1087
1088 TALLOC_FREE(principal);
1089
1090 ntlmssp:
1091
1092 account = talloc_strdup(talloc_tos(), user);
1093 if (!account) {
1094 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1095 }
1096
1097 /* when falling back to ntlmssp while authenticating with a machine
1098 * account strip off the realm - gd */
1099
1100 if ((p = strchr_m(user, '@')) != NULL) {
1101 account[PTR_DIFF(p,user)] = '\0';
1102 }
1103
1104 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1105 }
1106
1107 /****************************************************************************
1108 Send a session setup. The username and workgroup is in UNIX character
1109 format and must be converted to DOS codepage format before sending. If the
1110 password is in plaintext, the same should be done.
1111 ****************************************************************************/
1112
1113 NTSTATUS cli_session_setup(struct cli_state *cli,
1114 const char *user,
1115 const char *pass, int passlen,
1116 const char *ntpass, int ntpasslen,
1117 const char *workgroup)
1118 {
1119 char *p;
1120 fstring user2;
1121
1122 if (user) {
1123 fstrcpy(user2, user);
1124 } else {
1125 user2[0] ='\0';
1126 }
1127
1128 if (!workgroup) {
1129 workgroup = "";
1130 }
1131
1132 /* allow for workgroups as part of the username */
1133 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1134 (p=strchr_m(user2,*lp_winbind_separator()))) {
1135 *p = 0;
1136 user = p+1;
1137 workgroup = user2;
1138 }
1139
1140 if (cli->protocol < PROTOCOL_LANMAN1) {
1141 return NT_STATUS_OK;
1142 }
1143
1144 /* now work out what sort of session setup we are going to
1145 do. I have split this into separate functions to make the
1146 flow a bit easier to understand (tridge) */
1147
1148 /* if its an older server then we have to use the older request format */
1149
1150 if (cli->protocol < PROTOCOL_NT1) {
1151 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1152 DEBUG(1, ("Server requested LM password but 'client lanman auth'"
1153 " is disabled\n"));
1154 return NT_STATUS_ACCESS_DENIED;
1155 }
1156
1157 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1158 !lp_client_plaintext_auth() && (*pass)) {
1159 DEBUG(1, ("Server requested plaintext password but "
1160 "'client plaintext auth' is disabled\n"));
1161 return NT_STATUS_ACCESS_DENIED;
1162 }
1163
1164 return cli_session_setup_lanman2(cli, user, pass, passlen,
1165 workgroup);
1166 }
1167
1168 /* if no user is supplied then we have to do an anonymous connection.
1169 passwords are ignored */
1170
1171 if (!user || !*user)
1172 return cli_session_setup_guest(cli);
1173
1174 /* if the server is share level then send a plaintext null
1175 password at this point. The password is sent in the tree
1176 connect */
1177
1178 if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1179 return cli_session_setup_plaintext(cli, user, "", workgroup);
1180
1181 /* if the server doesn't support encryption then we have to use
1182 plaintext. The second password is ignored */
1183
1184 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1185 if (!lp_client_plaintext_auth() && (*pass)) {
1186 DEBUG(1, ("Server requested plaintext password but "
1187 "'client plaintext auth' is disabled\n"));
1188 return NT_STATUS_ACCESS_DENIED;
1189 }
1190 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1191 }
1192
1193 /* if the server supports extended security then use SPNEGO */
1194
1195 if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1196 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1197 workgroup, NULL);
1198 if (!ADS_ERR_OK(status)) {
1199 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1200 return ads_ntstatus(status);
1201 }
1202 } else {
1203 NTSTATUS status;
1204
1205 /* otherwise do a NT1 style session setup */
1206 status = cli_session_setup_nt1(cli, user, pass, passlen,
1207 ntpass, ntpasslen, workgroup);
1208 if (!NT_STATUS_IS_OK(status)) {
1209 DEBUG(3,("cli_session_setup: NT1 session setup "
1210 "failed: %s\n", nt_errstr(status)));
1211 return status;
1212 }
1213 }
1214
1215 if (strstr(cli->server_type, "Samba")) {
1216 cli->is_samba = True;
1217 }
1218
1219 return NT_STATUS_OK;
1220 }
1221
1222 /****************************************************************************
1223 Send a uloggoff.
1224 *****************************************************************************/
1225
1226 bool cli_ulogoff(struct cli_state *cli)
1227 {
1228 memset(cli->outbuf,'\0',smb_size);
1229 cli_set_message(cli->outbuf,2,0,True);
1230 SCVAL(cli->outbuf,smb_com,SMBulogoffX);
1231 cli_setup_packet(cli);
1232 SSVAL(cli->outbuf,smb_vwv0,0xFF);
1233 SSVAL(cli->outbuf,smb_vwv2,0); /* no additional info */
1234
1235 cli_send_smb(cli);
1236 if (!cli_receive_smb(cli))
1237 return False;
1238
1239 if (cli_is_error(cli)) {
1240 return False;
1241 }
1242
1243 cli->vuid = -1;
1244 return True;
1245 }
1246
1247 /****************************************************************************
1248 Send a tconX.
1249 ****************************************************************************/
1250
1251 struct cli_tcon_andx_state {
1252 struct cli_state *cli;
1253 uint16_t vwv[4];
1254 struct iovec bytes;
1255 };
1256
1257 static void cli_tcon_andx_done(struct tevent_req *subreq);
1258
1259 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
1260 struct event_context *ev,
1261 struct cli_state *cli,
1262 const char *share, const char *dev,
1263 const char *pass, int passlen,
1264 struct tevent_req **psmbreq)
1265 {
1266 struct tevent_req *req, *subreq;
1267 struct cli_tcon_andx_state *state;
1268 fstring pword;
1269 uint16_t *vwv;
1270 char *tmp = NULL;
1271 uint8_t *bytes;
1272
1273 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
1274 if (req == NULL) {
1275 return NULL;
1276 }
1277 state->cli = cli;
1278 vwv = state->vwv;
1279
1280 fstrcpy(cli->share, share);
1281
1282 /* in user level security don't send a password now */
1283 if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1284 passlen = 1;
1285 pass = "";
1286 } else if (pass == NULL) {
1287 DEBUG(1, ("Server not using user level security and no "
1288 "password supplied.\n"));
1289 goto access_denied;
1290 }
1291
1292 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1293 *pass && passlen != 24) {
1294 if (!lp_client_lanman_auth()) {
1295 DEBUG(1, ("Server requested LANMAN password "
1296 "(share-level security) but "
1297 "'client lanman auth' is disabled\n"));
1298 goto access_denied;
1299 }
1300
1301 /*
1302 * Non-encrypted passwords - convert to DOS codepage before
1303 * encryption.
1304 */
1305 passlen = 24;
1306 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1307 } else {
1308 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1309 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1310 == 0) {
1311 if (!lp_client_plaintext_auth() && (*pass)) {
1312 DEBUG(1, ("Server requested plaintext "
1313 "password but 'client plaintext "
1314 "auth' is disabled\n"));
1315 goto access_denied;
1316 }
1317
1318 /*
1319 * Non-encrypted passwords - convert to DOS codepage
1320 * before using.
1321 */
1322 passlen = clistr_push(cli, pword, pass, sizeof(pword),
1323 STR_TERMINATE);
1324 if (passlen == -1) {
1325 DEBUG(1, ("clistr_push(pword) failed\n"));
1326 goto access_denied;
1327 }
1328 } else {
1329 if (passlen) {
1330 memcpy(pword, pass, passlen);
1331 }
1332 }
1333 }
1334
1335 SCVAL(vwv+0, 0, 0xFF);
1336 SCVAL(vwv+0, 1, 0);
1337 SSVAL(vwv+1, 0, 0);
1338 SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1339 SSVAL(vwv+3, 0, passlen);
1340
1341 if (passlen) {
1342 bytes = (uint8_t *)talloc_memdup(state, pword, passlen);
1343 } else {
1344 bytes = talloc_array(state, uint8_t, 0);
1345 }
1346
1347 /*
1348 * Add the sharename
1349 */
1350 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1351 cli->desthost, share);
1352 if (tmp == NULL) {
1353 TALLOC_FREE(req);
1354 return NULL;
1355 }
1356 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1357 NULL);
1358 TALLOC_FREE(tmp);
1359
1360 /*
1361 * Add the devicetype
1362 */
1363 tmp = talloc_strdup_upper(talloc_tos(), dev);
1364 if (tmp == NULL) {
1365 TALLOC_FREE(req);
1366 return NULL;
1367 }
1368 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1369 TALLOC_FREE(tmp);
1370
1371 if (bytes == NULL) {
1372 TALLOC_FREE(req);
1373 return NULL;
1374 }
1375
1376 state->bytes.iov_base = (void *)bytes;
1377 state->bytes.iov_len = talloc_get_size(bytes);
1378
1379 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
1380 1, &state->bytes);
1381 if (subreq == NULL) {
1382 TALLOC_FREE(req);
1383 return NULL;
1384 }
1385 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
1386 *psmbreq = subreq;
1387 return req;
1388
1389 access_denied:
1390 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1391 return tevent_req_post(req, ev);
1392 }
1393
1394 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1395 struct event_context *ev,
1396 struct cli_state *cli,
1397 const char *share, const char *dev,
1398 const char *pass, int passlen)
1399 {
1400 struct tevent_req *req, *subreq;
1401 NTSTATUS status;
1402
1403 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
1404 &subreq);
1405 if (req == NULL) {
1406 return NULL;
1407 }
1408 status = cli_smb_req_send(subreq);
1409 if (!NT_STATUS_IS_OK(status)) {
1410 tevent_req_nterror(req, status);
1411 return tevent_req_post(req, ev);
1412 }
1413 return req;
1414 }
1415
1416 static void cli_tcon_andx_done(struct tevent_req *subreq)
1417 {
1418 struct tevent_req *req = tevent_req_callback_data(
1419 subreq, struct tevent_req);
1420 struct cli_tcon_andx_state *state = tevent_req_data(
1421 req, struct cli_tcon_andx_state);
1422 struct cli_state *cli = state->cli;
1423 char *inbuf = (char *)cli_smb_inbuf(subreq);
1424 uint8_t wct;
1425 uint16_t *vwv;
1426 uint32_t num_bytes;
1427 uint8_t *bytes;
1428 NTSTATUS status;
1429
1430 status = cli_smb_recv(subreq, 0, &wct, &vwv, &num_bytes, &bytes);
1431 if (!NT_STATUS_IS_OK(status)) {
1432 TALLOC_FREE(subreq);
1433 tevent_req_nterror(req, status);
1434 return;
1435 }
1436
1437 clistr_pull(inbuf, cli->dev, bytes, sizeof(fstring), num_bytes,
1438 STR_TERMINATE|STR_ASCII);
1439
1440 if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1441 /* almost certainly win95 - enable bug fixes */
1442 cli->win95 = True;
1443 }
1444
1445 /*
1446 * Make sure that we have the optional support 16-bit field. WCT > 2.
1447 * Avoids issues when connecting to Win9x boxes sharing files
1448 */
1449
1450 cli->dfsroot = false;
1451
1452 if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1453 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1454 }
1455
1456 cli->cnum = SVAL(inbuf,smb_tid);
1457 tevent_req_done(req);
1458 }
1459
1460 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
1461 {
1462 return tevent_req_simple_recv_ntstatus(req);
1463 }
1464
1465 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1466 const char *dev, const char *pass, int passlen)
1467 {
1468 TALLOC_CTX *frame = talloc_stackframe();
1469 struct event_context *ev;
1470 struct tevent_req *req;
1471 NTSTATUS status = NT_STATUS_OK;
1472
1473 if (cli_has_async_calls(cli)) {
1474 /*
1475 * Can't use sync call while an async call is in flight
1476 */
1477 status = NT_STATUS_INVALID_PARAMETER;
1478 goto fail;
1479 }
1480
1481 ev = event_context_init(frame);
1482 if (ev == NULL) {
1483 status = NT_STATUS_NO_MEMORY;
1484 goto fail;
1485 }
1486
1487 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1488 if (req == NULL) {
1489 status = NT_STATUS_NO_MEMORY;
1490 goto fail;
1491 }
1492
1493 if (!tevent_req_poll(req, ev)) {
1494 status = map_nt_error_from_unix(errno);
1495 goto fail;
1496 }
1497
1498 status = cli_tcon_andx_recv(req);
1499 fail:
1500 TALLOC_FREE(frame);
1501 if (!NT_STATUS_IS_OK(status)) {
1502 cli_set_error(cli, status);
1503 }
1504 return status;
1505 }
1506
1507 /****************************************************************************
1508 Send a tree disconnect.
1509 ****************************************************************************/
1510
1511 bool cli_tdis(struct cli_state *cli)
1512 {
1513 memset(cli->outbuf,'\0',smb_size);
1514 cli_set_message(cli->outbuf,0,0,True);
1515 SCVAL(cli->outbuf,smb_com,SMBtdis);
1516 SSVAL(cli->outbuf,smb_tid,cli->cnum);
1517 cli_setup_packet(cli);
1518
1519 cli_send_smb(cli);
1520 if (!cli_receive_smb(cli))
1521 return False;
1522
1523 if (cli_is_error(cli)) {
1524 return False;
1525 }
1526
1527 cli->cnum = -1;
1528 return True;
1529 }
1530
1531 /****************************************************************************
1532 Send a negprot command.
1533 ****************************************************************************/
1534
1535 void cli_negprot_sendsync(struct cli_state *cli)
1536 {
1537 char *p;
1538 int numprots;
1539
1540 if (cli->protocol < PROTOCOL_NT1)
1541 cli->use_spnego = False;
1542
1543 memset(cli->outbuf,'\0',smb_size);
1544
1545 /* setup the protocol strings */
1546 cli_set_message(cli->outbuf,0,0,True);
1547
1548 p = smb_buf(cli->outbuf);
1549 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1550 if (prots[numprots].prot > cli->protocol) {
1551 break;
1552 }
1553 *p++ = 2;
1554 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1555 }
1556
1557 SCVAL(cli->outbuf,smb_com,SMBnegprot);
1558 cli_setup_bcc(cli, p);
1559 cli_setup_packet(cli);
1560
1561 SCVAL(smb_buf(cli->outbuf),0,2);
1562
1563 cli_send_smb(cli);
1564 }
1565
1566 /****************************************************************************
1567 Send a negprot command.
1568 ****************************************************************************/
1569
1570 struct cli_negprot_state {
1571 struct cli_state *cli;
1572 };
1573
1574 static void cli_negprot_done(struct tevent_req *subreq);
1575
1576 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1577 struct event_context *ev,
1578 struct cli_state *cli)
1579 {
1580 struct tevent_req *req, *subreq;
1581 struct cli_negprot_state *state;
1582 uint8_t *bytes = NULL;
1583 int numprots;
1584
1585 req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
1586 if (req == NULL) {
1587 return NULL;
1588 }
1589 state->cli = cli;
1590
1591 if (cli->protocol < PROTOCOL_NT1)
1592 cli->use_spnego = False;
1593
1594 /* setup the protocol strings */
1595 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1596 uint8_t c = 2;
1597 if (prots[numprots].prot > cli->protocol) {
1598 break;
1599 }
1600 bytes = (uint8_t *)talloc_append_blob(
1601 state, bytes, data_blob_const(&c, sizeof(c)));
1602 if (tevent_req_nomem(bytes, req)) {
1603 return tevent_req_post(req, ev);
1604 }
1605 bytes = smb_bytes_push_str(bytes, false,
1606 prots[numprots].name,
1607 strlen(prots[numprots].name)+1,
1608 NULL);
1609 if (tevent_req_nomem(bytes, req)) {
1610 return tevent_req_post(req, ev);
1611 }
1612 }
1613
1614 subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
1615 talloc_get_size(bytes), bytes);
1616 if (tevent_req_nomem(subreq, req)) {
1617 return tevent_req_post(req, ev);
1618 }
1619 tevent_req_set_callback(subreq, cli_negprot_done, req);
1620 return req;
1621 }
1622
1623 static void cli_negprot_done(struct tevent_req *subreq)
1624 {
1625 struct tevent_req *req = tevent_req_callback_data(
1626 subreq, struct tevent_req);
1627 struct cli_negprot_state *state = tevent_req_data(
1628 req, struct cli_negprot_state);
1629 struct cli_state *cli = state->cli;
1630 uint8_t wct;
1631 uint16_t *vwv;
1632 uint32_t num_bytes;
1633 uint8_t *bytes;
1634 NTSTATUS status;
1635 uint16_t protnum;
1636
1637 status = cli_smb_recv(subreq, 1, &wct, &vwv, &num_bytes, &bytes);
1638 if (!NT_STATUS_IS_OK(status)) {
1639 TALLOC_FREE(subreq);
1640 return;
1641 }
1642
1643 protnum = SVAL(vwv, 0);
1644
1645 if ((protnum >= ARRAY_SIZE(prots))
1646 || (prots[protnum].prot > cli->protocol)) {
1647 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1648 return;
1649 }
1650
1651 cli->protocol = prots[protnum].prot;
1652
1653 if ((cli->protocol < PROTOCOL_NT1) &&
1654 client_is_signing_mandatory(cli)) {
1655 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
1656 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1657 return;
1658 }
1659
1660 if (cli->protocol >= PROTOCOL_NT1) {
1661 struct timespec ts;
1662 bool negotiated_smb_signing = false;
1663
1664 /* NT protocol */
1665 cli->sec_mode = CVAL(vwv + 1, 0);
1666 cli->max_mux = SVAL(vwv + 1, 1);
1667 cli->max_xmit = IVAL(vwv + 3, 1);
1668 cli->sesskey = IVAL(vwv + 7, 1);
1669 cli->serverzone = SVALS(vwv + 15, 1);
1670 cli->serverzone *= 60;
1671 /* this time arrives in real GMT */
1672 ts = interpret_long_date(((char *)(vwv+11))+1);
1673 cli->servertime = ts.tv_sec;
1674 cli->secblob = data_blob(bytes, num_bytes);
1675 cli->capabilities = IVAL(vwv + 9, 1);
1676 if (cli->capabilities & CAP_RAW_MODE) {
1677 cli->readbraw_supported = True;
1678 cli->writebraw_supported = True;
1679 }
1680 /* work out if they sent us a workgroup */
1681 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
1682 smb_buflen(cli->inbuf) > 8) {
1683 clistr_pull(cli->inbuf, cli->server_domain,
1684 bytes+8, sizeof(cli->server_domain),
1685 num_bytes-8,
1686 STR_UNICODE|STR_NOALIGN);
1687 }
1688
1689 /*
1690 * As signing is slow we only turn it on if either the client or
1691 * the server require it. JRA.
1692 */
1693
1694 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
1695 /* Fail if server says signing is mandatory and we don't want to support it. */
1696 if (!client_is_signing_allowed(cli)) {
1697 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
1698 tevent_req_nterror(req,
1699 NT_STATUS_ACCESS_DENIED);
1700 return;
1701 }
1702 negotiated_smb_signing = true;
1703 } else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
1704 /* Fail if client says signing is mandatory and the server doesn't support it. */
1705 if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
1706 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
1707 tevent_req_nterror(req,
1708 NT_STATUS_ACCESS_DENIED);
1709 return;
1710 }
1711 negotiated_smb_signing = true;
1712 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
1713 negotiated_smb_signing = true;
1714 }
1715
1716 if (negotiated_smb_signing) {
1717 cli_set_signing_negotiated(cli);
1718 }
1719
1720 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
1721 SAFE_FREE(cli->outbuf);
1722 SAFE_FREE(cli->inbuf);
1723 cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1724 cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1725 cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
1726 }
1727
1728 } else if (cli->protocol >= PROTOCOL_LANMAN1) {
1729 cli->use_spnego = False;
1730 cli->sec_mode = SVAL(vwv + 1, 0);
1731 cli->max_xmit = SVAL(vwv + 2, 0);
1732 cli->max_mux = SVAL(vwv + 3, 0);
1733 cli->sesskey = IVAL(vwv + 6, 0);
1734 cli->serverzone = SVALS(vwv + 10, 0);
1735 cli->serverzone *= 60;
1736 /* this time is converted to GMT by make_unix_date */
1737 cli->servertime = cli_make_unix_date(
1738 cli, (char *)(vwv + 8));
1739 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
1740 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
1741 cli->secblob = data_blob(bytes, num_bytes);
1742 } else {
1743 /* the old core protocol */
1744 cli->use_spnego = False;
1745 cli->sec_mode = 0;
1746 cli->serverzone = get_time_zone(time(NULL));
1747 }
1748
1749 cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
1750
1751 /* a way to force ascii SMB */
1752 if (getenv("CLI_FORCE_ASCII"))
1753 cli->capabilities &= ~CAP_UNICODE;
1754
1755 tevent_req_done(req);
1756 }
1757
1758 NTSTATUS cli_negprot_recv(struct tevent_req *req)
1759 {
1760 return tevent_req_simple_recv_ntstatus(req);
1761 }
1762
1763 NTSTATUS cli_negprot(struct cli_state *cli)
1764 {
1765 TALLOC_CTX *frame = talloc_stackframe();
1766 struct event_context *ev;
1767 struct tevent_req *req;
1768 NTSTATUS status = NT_STATUS_OK;
1769
1770 if (cli_has_async_calls(cli)) {
1771 /*
1772 * Can't use sync call while an async call is in flight
1773 */
1774 status = NT_STATUS_INVALID_PARAMETER;
1775 goto fail;
1776 }
1777
1778 ev = event_context_init(frame);
1779 if (ev == NULL) {
1780 status = NT_STATUS_NO_MEMORY;
1781 goto fail;
1782 }
1783
1784 req = cli_negprot_send(frame, ev, cli);
1785 if (req == NULL) {
1786 status = NT_STATUS_NO_MEMORY;
1787 goto fail;
1788 }
1789
1790 if (!tevent_req_poll(req, ev)) {
1791 status = map_nt_error_from_unix(errno);
1792 goto fail;
1793 }
1794
1795 status = cli_negprot_recv(req);
1796 fail:
1797 TALLOC_FREE(frame);
1798 if (!NT_STATUS_IS_OK(status)) {
1799 cli_set_error(cli, status);
1800 }
1801 return status;
1802 }
1803
1804 /****************************************************************************
1805 Send a session request. See rfc1002.txt 4.3 and 4.3.2.
1806 ****************************************************************************/
1807
1808 bool cli_session_request(struct cli_state *cli,
1809 struct nmb_name *calling, struct nmb_name *called)
1810 {
1811 char *p;
1812 int len = 4;
1813 char *tmp;
1814
1815 /* 445 doesn't have session request */
1816 if (cli->port == 445)
1817 return True;
1818
1819 memcpy(&(cli->calling), calling, sizeof(*calling));
1820 memcpy(&(cli->called ), called , sizeof(*called ));
1821
1822 /* put in the destination name */
1823
1824 tmp = name_mangle(talloc_tos(), cli->called.name,
1825 cli->called.name_type);
1826 if (tmp == NULL) {
1827 return false;
1828 }
1829
1830 p = cli->outbuf+len;
1831 memcpy(p, tmp, name_len(tmp));
1832 len += name_len(tmp);
1833 TALLOC_FREE(tmp);
1834
1835 /* and my name */
1836
1837 tmp = name_mangle(talloc_tos(), cli->calling.name,
1838 cli->calling.name_type);
1839 if (tmp == NULL) {
1840 return false;
1841 }
1842
1843 p = cli->outbuf+len;
1844 memcpy(p, tmp, name_len(tmp));
1845 len += name_len(tmp);
1846 TALLOC_FREE(tmp);
1847
1848 /* send a session request (RFC 1002) */
1849 /* setup the packet length
1850 * Remove four bytes from the length count, since the length
1851 * field in the NBT Session Service header counts the number
1852 * of bytes which follow. The cli_send_smb() function knows
1853 * about this and accounts for those four bytes.
1854 * CRH.
1855 */
1856 len -= 4;
1857 _smb_setlen(cli->outbuf,len);
1858 SCVAL(cli->outbuf,0,0x81);
1859
1860 cli_send_smb(cli);
1861 DEBUG(5,("Sent session request\n"));
1862
1863 if (!cli_receive_smb(cli))
1864 return False;
1865
1866 if (CVAL(cli->inbuf,0) == 0x84) {
1867 /* C. Hoch 9/14/95 Start */
1868 /* For information, here is the response structure.
1869 * We do the byte-twiddling to for portability.
1870 struct RetargetResponse{
1871 unsigned char type;
1872 unsigned char flags;
1873 int16 length;
1874 int32 ip_addr;
1875 int16 port;
1876 };
1877 */
1878 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
1879 struct in_addr dest_ip;
1880 NTSTATUS status;
1881
1882 /* SESSION RETARGET */
1883 putip((char *)&dest_ip,cli->inbuf+4);
1884 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
1885
1886 status = open_socket_out(&cli->dest_ss, port,
1887 LONG_CONNECT_TIMEOUT, &cli->fd);
1888 if (!NT_STATUS_IS_OK(status)) {
1889 return False;
1890 }
1891
1892 DEBUG(3,("Retargeted\n"));
1893
1894 set_socket_options(cli->fd, lp_socket_options());
1895
1896 /* Try again */
1897 {
1898 static int depth;
1899 bool ret;
1900 if (depth > 4) {
1901 DEBUG(0,("Retarget recursion - failing\n"));
1902 return False;
1903 }
1904 depth++;
1905 ret = cli_session_request(cli, calling, called);
1906 depth--;
1907 return ret;
1908 }
1909 } /* C. Hoch 9/14/95 End */
1910
1911 if (CVAL(cli->inbuf,0) != 0x82) {
1912 /* This is the wrong place to put the error... JRA. */
1913 cli->rap_error = CVAL(cli->inbuf,4);
1914 return False;
1915 }
1916 return(True);
1917 }
1918
1919 struct fd_struct {
1920 int fd;
1921 };
1922
1923 static void smb_sock_connected(struct tevent_req *req)
1924 {
1925 struct fd_struct *pfd = tevent_req_callback_data(
1926 req, struct fd_struct);
1927 int fd;
1928 NTSTATUS status;
1929
1930 status = open_socket_out_defer_recv(req, &fd);
1931 if (NT_STATUS_IS_OK(status)) {
1932 pfd->fd = fd;
1933 }
1934 }
1935
1936 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
1937 uint16_t *port, int timeout, int *pfd)
1938 {
1939 struct event_context *ev;
1940 struct tevent_req *r139, *r445;
1941 struct fd_struct *fd139, *fd445;
1942 NTSTATUS status = NT_STATUS_NO_MEMORY;
1943
1944 if (*port != 0) {
1945 return open_socket_out(pss, *port, timeout, pfd);
1946 }
1947
1948 ev = event_context_init(talloc_tos());
1949 if (ev == NULL) {
1950 return NT_STATUS_NO_MEMORY;
1951 }
1952
1953 fd139 = talloc(ev, struct fd_struct);
1954 if (fd139 == NULL) {
1955 goto done;
1956 }
1957 fd139->fd = -1;
1958
1959 fd445 = talloc(ev, struct fd_struct);
1960 if (fd445 == NULL) {
1961 goto done;
1962 }
1963 fd445->fd = -1;
1964
1965 r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
1966 pss, 445, timeout);
1967 r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
1968 pss, 139, timeout);
1969 if ((r445 == NULL) || (r139 == NULL)) {
1970 goto done;
1971 }
1972 tevent_req_set_callback(r445, smb_sock_connected, fd445);
1973 tevent_req_set_callback(r139, smb_sock_connected, fd139);
1974
1975 while ((fd445->fd == -1) && (fd139->fd == -1)
1976 && (tevent_req_is_in_progress(r139)
1977 || tevent_req_is_in_progress(r445))) {
1978 event_loop_once(ev);
1979 }
1980
1981 if ((fd139->fd != -1) && (fd445->fd != -1)) {
1982 close(fd139->fd);
1983 fd139->fd = -1;
1984 }
1985
1986 if (fd445->fd != -1) {
1987 *port = 445;
1988 *pfd = fd445->fd;
1989 status = NT_STATUS_OK;
1990 goto done;
1991 }
1992 if (fd139->fd != -1) {
1993 *port = 139;
1994 *pfd = fd139->fd;
1995 status = NT_STATUS_OK;
1996 goto done;
1997 }
1998
1999 status = open_socket_out_defer_recv(r445, &fd445->fd);
2000 done:
2001 TALLOC_FREE(ev);
2002 return status;
2003 }
2004
2005 /****************************************************************************
2006 Open the client sockets.
2007 ****************************************************************************/
2008
2009 NTSTATUS cli_connect(struct cli_state *cli,
2010 const char *host,
2011 struct sockaddr_storage *dest_ss)
2012
2013 {
2014 int name_type = 0x20;
2015 TALLOC_CTX *frame = talloc_stackframe();
2016 unsigned int num_addrs = 0;
2017 unsigned int i = 0;
2018 struct sockaddr_storage *ss_arr = NULL;
2019 char *p = NULL;
2020
2021 /* reasonable default hostname */
2022 if (!host) {
2023 host = STAR_SMBSERVER;
2024 }
2025
2026 fstrcpy(cli->desthost, host);
2027
2028 /* allow hostnames of the form NAME#xx and do a netbios lookup */
2029 if ((p = strchr(cli->desthost, '#'))) {
2030 name_type = strtol(p+1, NULL, 16);
2031 *p = 0;
2032 }
2033
2034 if (!dest_ss || is_zero_addr((struct sockaddr *)dest_ss)) {
2035 NTSTATUS status =resolve_name_list(frame,
2036 cli->desthost,
2037 name_type,
2038 &ss_arr,
2039 &num_addrs);
2040 if (!NT_STATUS_IS_OK(status)) {
2041 TALLOC_FREE(frame);
2042 return NT_STATUS_BAD_NETWORK_NAME;
2043 }
2044 } else {
2045 num_addrs = 1;
2046 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
2047 if (!ss_arr) {
2048 TALLOC_FREE(frame);
2049 return NT_STATUS_NO_MEMORY;
2050 }
2051 *ss_arr = *dest_ss;
2052 }
2053
2054 for (i = 0; i < num_addrs; i++) {
2055 cli->dest_ss = ss_arr[i];
2056 if (getenv("LIBSMB_PROG")) {
2057 cli->fd = sock_exec(getenv("LIBSMB_PROG"));
2058 } else {
2059 uint16_t port = cli->port;
2060 NTSTATUS status;
2061 status = open_smb_socket(&cli->dest_ss, &port,
2062 cli->timeout, &cli->fd);
2063 if (NT_STATUS_IS_OK(status)) {
2064 cli->port = port;
2065 }
2066 }
2067 if (cli->fd == -1) {
2068 char addr[INET6_ADDRSTRLEN];
2069 print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
2070 DEBUG(2,("Error connecting to %s (%s)\n",
2071 dest_ss?addr:host,strerror(errno)));
2072 } else {
2073 /* Exit from loop on first connection. */
2074 break;
2075 }
2076 }
2077
2078 if (cli->fd == -1) {
2079 TALLOC_FREE(frame);
2080 return map_nt_error_from_unix(errno);
2081 }
2082
2083 if (dest_ss) {
2084 *dest_ss = cli->dest_ss;
2085 }
2086
2087 set_socket_options(cli->fd, lp_socket_options());
2088
2089 TALLOC_FREE(frame);
2090 return NT_STATUS_OK;
2091 }
2092
2093 /**
2094 establishes a connection to after the negprot.
2095 @param output_cli A fully initialised cli structure, non-null only on success
2096 @param dest_host The netbios name of the remote host
2097 @param dest_ss (optional) The the destination IP, NULL for name based lookup
2098 @param port (optional) The destination port (0 for default)
2099 @param retry bool. Did this connection fail with a retryable error ?
2100
2101 */
2102 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2103 const char *my_name,
2104 const char *dest_host,
2105 struct sockaddr_storage *dest_ss, int port,
2106 int signing_state, int flags,
2107 bool *retry)
2108 {
2109 NTSTATUS nt_status;
2110 struct nmb_name calling;
2111 struct nmb_name called;
2112 struct cli_state *cli;
2113 struct sockaddr_storage ss;
2114
2115 if (retry)
2116 *retry = False;
2117
2118 if (!my_name)
2119 my_name = global_myname();
2120
2121 if (!(cli = cli_initialise_ex(signing_state))) {
2122 return NT_STATUS_NO_MEMORY;
2123 }
2124
2125 make_nmb_name(&calling, my_name, 0x0);
2126 make_nmb_name(&called , dest_host, 0x20);
2127
2128 cli_set_port(cli, port);
2129 cli_set_timeout(cli, 10000); /* 10 seconds. */
2130
2131 if (dest_ss) {
2132 ss = *dest_ss;
2133 } else {
2134 zero_sockaddr(&ss);
2135 }
2136
2137 again:
2138
2139 DEBUG(3,("Connecting to host=%s\n", dest_host));
2140
2141 nt_status = cli_connect(cli, dest_host, &ss);
2142 if (!NT_STATUS_IS_OK(nt_status)) {
2143 char addr[INET6_ADDRSTRLEN];
2144 print_sockaddr(addr, sizeof(addr), &ss);
2145 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2146 nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2147 cli_shutdown(cli);
2148 return nt_status;
2149 }
2150
2151 if (retry)
2152 *retry = True;
2153
2154 if (!cli_session_request(cli, &calling, &called)) {
2155 char *p;
2156 DEBUG(1,("session request to %s failed (%s)\n",
2157 called.name, cli_errstr(cli)));
2158 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2159 *p = 0;
2160 goto again;
2161 }
2162 if (strcmp(called.name, STAR_SMBSERVER)) {
2163 make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2164 goto again;
2165 }
2166 return NT_STATUS_BAD_NETWORK_NAME;
2167 }
2168
2169 if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2170 cli->use_spnego = False;
2171 else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2172 cli->use_kerberos = True;
2173
2174 if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2175 cli->use_kerberos) {
2176 cli->fallback_after_kerberos = true;
2177 }
2178
2179 nt_status = cli_negprot(cli);
2180 if (!NT_STATUS_IS_OK(nt_status)) {
2181 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2182 cli_shutdown(cli);
2183 return nt_status;
2184 }
2185
2186 *output_cli = cli;
2187 return NT_STATUS_OK;
2188 }
2189
2190
2191 /**
2192 establishes a connection right up to doing tconX, password specified.
2193 @param output_cli A fully initialised cli structure, non-null only on success
2194 @param dest_host The netbios name of the remote host
2195 @param dest_ip (optional) The the destination IP, NULL for name based lookup
2196 @param port (optional) The destination port (0 for default)
2197 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
2198 @param service_type The 'type' of serivice.
2199 @param user Username, unix string
2200 @param domain User's domain
2201 @param password User's password, unencrypted unix string.
2202 @param retry bool. Did this connection fail with a retryable error ?
2203 */
2204
2205 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2206 const char *my_name,
2207 const char *dest_host,
2208 struct sockaddr_storage *dest_ss, int port,
2209 const char *service, const char *service_type,
2210 const char *user, const char *domain,
2211 const char *password, int flags,
2212 int signing_state,
2213 bool *retry)
2214 {
2215 NTSTATUS nt_status;
2216 struct cli_state *cli = NULL;
2217 int pw_len = password ? strlen(password)+1 : 0;
2218
2219 *output_cli = NULL;
2220
2221 if (password == NULL) {
2222 password = "";
2223 }
2224
2225 nt_status = cli_start_connection(&cli, my_name, dest_host,
2226 dest_ss, port, signing_state,
2227 flags, retry);
2228
2229 if (!NT_STATUS_IS_OK(nt_status)) {
2230 return nt_status;
2231 }
2232
2233 cli->use_oplocks = ((flags & CLI_FULL_CONNECTION_OPLOCKS) != 0);
2234 cli->use_level_II_oplocks =
2235 ((flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) != 0);
2236
2237 nt_status = cli_session_setup(cli, user, password, pw_len, password,
2238 pw_len, domain);
2239 if (!NT_STATUS_IS_OK(nt_status)) {
2240
2241 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2242 DEBUG(1,("failed session setup with %s\n",
2243 nt_errstr(nt_status)));
2244 cli_shutdown(cli);
2245 return nt_status;
2246 }
2247
2248 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2249 if (!NT_STATUS_IS_OK(nt_status)) {
2250 DEBUG(1,("anonymous failed session setup with %s\n",
2251 nt_errstr(nt_status)));
2252 cli_shutdown(cli);
2253 return nt_status;
2254 }
2255 }
2256
2257 if (service) {
2258 nt_status = cli_tcon_andx(cli, service, service_type, password,
2259 pw_len);
2260 if (!NT_STATUS_IS_OK(nt_status)) {
2261 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2262 cli_shutdown(cli);
2263 if (NT_STATUS_IS_OK(nt_status)) {
2264 nt_status = NT_STATUS_UNSUCCESSFUL;
2265 }
2266 return nt_status;
2267 }
2268 }
2269
2270 nt_status = cli_init_creds(cli, user, domain, password);
2271 if (!NT_STATUS_IS_OK(nt_status)) {
2272 cli_shutdown(cli);
2273 return nt_status;
2274 }
2275
2276 *output_cli = cli;
2277 return NT_STATUS_OK;
2278 }
2279
2280 /****************************************************************************
2281 Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2282 ****************************************************************************/
2283
2284 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2285 struct sockaddr_storage *pdest_ss)
2286 {
2287 struct nmb_name calling, called;
2288
2289 make_nmb_name(&calling, srchost, 0x0);
2290
2291 /*
2292 * If the called name is an IP address
2293 * then use *SMBSERVER immediately.
2294 */
2295
2296 if(is_ipaddress(desthost)) {
2297 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2298 } else {
2299 make_nmb_name(&called, desthost, 0x20);
2300 }
2301
2302 if (!cli_session_request(*ppcli, &calling, &called)) {
2303 NTSTATUS status;
2304 struct nmb_name smbservername;
2305
2306 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2307
2308 /*
2309 * If the name wasn't *SMBSERVER then
2310 * try with *SMBSERVER if the first name fails.
2311 */
2312
2313 if (nmb_name_equal(&called, &smbservername)) {
2314
2315 /*
2316 * The name used was *SMBSERVER, don't bother with another name.
2317 */
2318
2319 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2320 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2321 return False;
2322 }
2323
2324 /* Try again... */
2325 cli_shutdown(*ppcli);
2326
2327 *ppcli = cli_initialise();
2328 if (!*ppcli) {
2329 /* Out of memory... */
2330 return False;
2331 }
2332
2333 status = cli_connect(*ppcli, desthost, pdest_ss);
2334 if (!NT_STATUS_IS_OK(status) ||
2335 !cli_session_request(*ppcli, &calling, &smbservername)) {
2336 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2337 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2338 return False;
2339 }
2340 }
2341
2342 return True;
2343 }
2344
2345 /****************************************************************************
2346 Send an old style tcon.
2347 ****************************************************************************/
2348 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2349 const char *service, const char *pass, const char *dev,
2350 uint16 *max_xmit, uint16 *tid)
2351 {
2352 char *p;
2353
2354 if (!lp_client_plaintext_auth() && (*pass)) {
2355 DEBUG(1, ("Server requested plaintext password but 'client "
2356 "plaintext auth' is disabled\n"));
2357 return NT_STATUS_ACCESS_DENIED;
2358 }
2359
2360 memset(cli->outbuf,'\0',smb_size);
2361 memset(cli->inbuf,'\0',smb_size);
2362
2363 cli_set_message(cli->outbuf, 0, 0, True);
2364 SCVAL(cli->outbuf,smb_com,SMBtcon);
2365 cli_setup_packet(cli);
2366
2367 p = smb_buf(cli->outbuf);
2368 *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
2369 *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
2370 *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
2371
2372 cli_setup_bcc(cli, p);
2373
2374 cli_send_smb(cli);
2375 if (!cli_receive_smb(cli)) {
2376 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2377 }
2378
2379 if (cli_is_error(cli)) {
2380 return cli_nt_error(cli);
2381 }
2382
2383 *max_xmit = SVAL(cli->inbuf, smb_vwv0);
2384 *tid = SVAL(cli->inbuf, smb_vwv1);
2385
2386 return NT_STATUS_OK;
2387 }
2388
2389 /* Return a cli_state pointing at the IPC$ share for the given server */
2390
2391 struct cli_state *get_ipc_connect(char *server,
2392 struct sockaddr_storage *server_ss,
2393 const struct user_auth_info *user_info)
2394 {
2395 struct cli_state *cli;
2396 NTSTATUS nt_status;
2397 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2398
2399 if (user_info->use_kerberos) {
2400 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2401 }
2402
2403 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2404 user_info->username ? user_info->username : "",
2405 lp_workgroup(),
2406 user_info->password ? user_info->password : "",
2407 flags,
2408 Undefined, NULL);
2409
2410 if (NT_STATUS_IS_OK(nt_status)) {
2411 return cli;
2412 } else if (is_ipaddress(server)) {
2413 /* windows 9* needs a correct NMB name for connections */
2414 fstring remote_name;
2415
2416 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2417 cli = get_ipc_connect(remote_name, server_ss, user_info);
2418 if (cli)
2419 return cli;
2420 }
2421 }
2422 return NULL;
2423 }
2424
2425 /*
2426 * Given the IP address of a master browser on the network, return its
2427 * workgroup and connect to it.
2428 *
2429 * This function is provided to allow additional processing beyond what
2430 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2431 * browsers and obtain each master browsers' list of domains (in case the
2432 * first master browser is recently on the network and has not yet
2433 * synchronized with other master browsers and therefore does not yet have the
2434 * entire network browse list)
2435 */
2436
2437 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2438 struct ip_service *mb_ip,
2439 const struct user_auth_info *user_info,
2440 char **pp_workgroup_out)
2441 {
2442 char addr[INET6_ADDRSTRLEN];
2443 fstring name;
2444 struct cli_state *cli;
2445 struct sockaddr_storage server_ss;
2446
2447 *pp_workgroup_out = NULL;
2448
2449 print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2450 DEBUG(99, ("Looking up name of master browser %s\n",
2451 addr));
2452
2453 /*
2454 * Do a name status query to find out the name of the master browser.
2455 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2456 * master browser will not respond to a wildcard query (or, at least,
2457 * an NT4 server acting as the domain master browser will not).
2458 *
2459 * We might be able to use ONLY the query on MSBROWSE, but that's not
2460 * yet been tested with all Windows versions, so until it is, leave
2461 * the original wildcard query as the first choice and fall back to
2462 * MSBROWSE if the wildcard query fails.
2463 */
2464 if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2465 !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2466
2467 DEBUG(99, ("Could not retrieve name status for %s\n",
2468 addr));
2469 return NULL;
2470 }
2471
2472 if (!find_master_ip(name, &server_ss)) {
2473 DEBUG(99, ("Could not find master ip for %s\n", name));
2474 return NULL;
2475 }
2476
2477 *pp_workgroup_out = talloc_strdup(ctx, name);
2478
2479 DEBUG(4, ("found master browser %s, %s\n", name, addr));
2480
2481 print_sockaddr(addr, sizeof(addr), &server_ss);
2482 cli = get_ipc_connect(addr, &server_ss, user_info);
2483
2484 return cli;
2485 }
2486
2487 /*
2488 * Return the IP address and workgroup of a master browser on the network, and
2489 * connect to it.
2490 */
2491
2492 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2493 const struct user_auth_info *user_info,
2494 char **pp_workgroup_out)
2495 {
2496 struct ip_service *ip_list;
2497 struct cli_state *cli;
2498 int i, count;
2499
2500 *pp_workgroup_out = NULL;
2501
2502 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2503
2504 /* Go looking for workgroups by broadcasting on the local network */
2505
2506 if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2507 &count))) {
2508 DEBUG(99, ("No master browsers responded\n"));
2509 return False;
2510 }
2511
2512 for (i = 0; i < count; i++) {
2513 char addr[INET6_ADDRSTRLEN];
2514 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2515 DEBUG(99, ("Found master browser %s\n", addr));
2516
2517 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2518 user_info, pp_workgroup_out);
2519 if (cli)
2520 return(cli);
2521 }
2522
2523 return NULL;
2524 }
Samba GIT mirror