?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Use tevent_req_nterror properly in a few places
[Samba.git] / source3 / libsmb / cliconnect.c
blobb8b1f0d2647a0ba385d95fffe5a898d0fed3e01e
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "popt_common.h"
23 #include "../libcli/auth/libcli_auth.h"
24 #include "../libcli/auth/spnego.h"
25 #include "smb_krb5.h"
26 #include "../libcli/auth/ntlmssp.h"
27 #include "libads/kerberos_proto.h"
28 #include "krb5_env.h"
29 #include "async_smb.h"
30 #include "libsmb/nmblib.h"
31
32 static const struct {
33 int prot;
34 const char name[24];
35 } prots[10] = {
36 {PROTOCOL_CORE, "PC NETWORK PROGRAM 1.0"},
37 {PROTOCOL_COREPLUS, "MICROSOFT NETWORKS 1.03"},
38 {PROTOCOL_LANMAN1, "MICROSOFT NETWORKS 3.0"},
39 {PROTOCOL_LANMAN1, "LANMAN1.0"},
40 {PROTOCOL_LANMAN2, "LM1.2X002"},
41 {PROTOCOL_LANMAN2, "DOS LANMAN2.1"},
42 {PROTOCOL_LANMAN2, "LANMAN2.1"},
43 {PROTOCOL_LANMAN2, "Samba"},
44 {PROTOCOL_NT1, "NT LANMAN 1.0"},
45 {PROTOCOL_NT1, "NT LM 0.12"},
46 };
47
48 #define STAR_SMBSERVER "*SMBSERVER"
49
50 /**
51 * Set the user session key for a connection
52 * @param cli The cli structure to add it too
53 * @param session_key The session key used. (A copy of this is taken for the cli struct)
54 *
55 */
56
57 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
58 {
59 cli->user_session_key = data_blob(session_key.data, session_key.length);
60 }
61
62 /****************************************************************************
63 Do an old lanman2 style session setup.
64 ****************************************************************************/
65
66 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
67 const char *user,
68 const char *pass, size_t passlen,
69 const char *workgroup)
70 {
71 DATA_BLOB session_key = data_blob_null;
72 DATA_BLOB lm_response = data_blob_null;
73 NTSTATUS status;
74 fstring pword;
75 char *p;
76
77 if (passlen > sizeof(pword)-1) {
78 return NT_STATUS_INVALID_PARAMETER;
79 }
80
81 /* LANMAN servers predate NT status codes and Unicode and ignore those
82 smb flags so we must disable the corresponding default capabilities
83 that would otherwise cause the Unicode and NT Status flags to be
84 set (and even returned by the server) */
85
86 cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
87
88 /* if in share level security then don't send a password now */
89 if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
90 passlen = 0;
91
92 if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
93 /* Encrypted mode needed, and non encrypted password supplied. */
94 lm_response = data_blob(NULL, 24);
95 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
96 DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
97 return NT_STATUS_ACCESS_DENIED;
98 }
99 } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
100 /* Encrypted mode needed, and encrypted password supplied. */
101 lm_response = data_blob(pass, passlen);
102 } else if (passlen > 0) {
103 /* Plaintext mode needed, assume plaintext supplied. */
104 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
105 lm_response = data_blob(pass, passlen);
106 }
107
108 /* send a session setup command */
109 memset(cli->outbuf,'\0',smb_size);
110 cli_set_message(cli->outbuf,10, 0, True);
111 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
112 cli_setup_packet(cli);
113
114 SCVAL(cli->outbuf,smb_vwv0,0xFF);
115 SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
116 SSVAL(cli->outbuf,smb_vwv3,2);
117 SSVAL(cli->outbuf,smb_vwv4,1);
118 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
119 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
120
121 p = smb_buf(cli->outbuf);
122 memcpy(p,lm_response.data,lm_response.length);
123 p += lm_response.length;
124 p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
125 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
126 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
127 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
128 cli_setup_bcc(cli, p);
129
130 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
131 return cli_nt_error(cli);
132 }
133
134 show_msg(cli->inbuf);
135
136 if (cli_is_error(cli)) {
137 return cli_nt_error(cli);
138 }
139
140 /* use the returned vuid from now on */
141 cli->vuid = SVAL(cli->inbuf,smb_uid);
142 status = cli_set_username(cli, user);
143 if (!NT_STATUS_IS_OK(status)) {
144 return status;
145 }
146
147 if (session_key.data) {
148 /* Have plaintext orginal */
149 cli_set_session_key(cli, session_key);
150 }
151
152 return NT_STATUS_OK;
153 }
154
155 /****************************************************************************
156 Work out suitable capabilities to offer the server.
157 ****************************************************************************/
158
159 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
160 {
161 uint32 capabilities = CAP_NT_SMBS;
162
163 if (!cli->force_dos_errors)
164 capabilities |= CAP_STATUS32;
165
166 if (cli->use_level_II_oplocks)
167 capabilities |= CAP_LEVEL_II_OPLOCKS;
168
169 capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
170 return capabilities;
171 }
172
173 /****************************************************************************
174 Do a NT1 guest session setup.
175 ****************************************************************************/
176
177 struct cli_session_setup_guest_state {
178 struct cli_state *cli;
179 uint16_t vwv[13];
180 struct iovec bytes;
181 };
182
183 static void cli_session_setup_guest_done(struct tevent_req *subreq);
184
185 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
186 struct event_context *ev,
187 struct cli_state *cli,
188 struct tevent_req **psmbreq)
189 {
190 struct tevent_req *req, *subreq;
191 struct cli_session_setup_guest_state *state;
192 uint16_t *vwv;
193 uint8_t *bytes;
194
195 req = tevent_req_create(mem_ctx, &state,
196 struct cli_session_setup_guest_state);
197 if (req == NULL) {
198 return NULL;
199 }
200 state->cli = cli;
201 vwv = state->vwv;
202
203 SCVAL(vwv+0, 0, 0xFF);
204 SCVAL(vwv+0, 1, 0);
205 SSVAL(vwv+1, 0, 0);
206 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
207 SSVAL(vwv+3, 0, 2);
208 SSVAL(vwv+4, 0, cli->pid);
209 SIVAL(vwv+5, 0, cli->sesskey);
210 SSVAL(vwv+7, 0, 0);
211 SSVAL(vwv+8, 0, 0);
212 SSVAL(vwv+9, 0, 0);
213 SSVAL(vwv+10, 0, 0);
214 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
215
216 bytes = talloc_array(state, uint8_t, 0);
217
218 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* username */
219 NULL);
220 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
221 NULL);
222 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
223 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
224
225 if (bytes == NULL) {
226 TALLOC_FREE(req);
227 return NULL;
228 }
229
230 state->bytes.iov_base = (void *)bytes;
231 state->bytes.iov_len = talloc_get_size(bytes);
232
233 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
234 1, &state->bytes);
235 if (subreq == NULL) {
236 TALLOC_FREE(req);
237 return NULL;
238 }
239 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
240 *psmbreq = subreq;
241 return req;
242 }
243
244 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
245 struct event_context *ev,
246 struct cli_state *cli)
247 {
248 struct tevent_req *req, *subreq;
249 NTSTATUS status;
250
251 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
252 if (req == NULL) {
253 return NULL;
254 }
255
256 status = cli_smb_req_send(subreq);
257 if (NT_STATUS_IS_OK(status)) {
258 tevent_req_nterror(req, status);
259 return tevent_req_post(req, ev);
260 }
261 return req;
262 }
263
264 static void cli_session_setup_guest_done(struct tevent_req *subreq)
265 {
266 struct tevent_req *req = tevent_req_callback_data(
267 subreq, struct tevent_req);
268 struct cli_session_setup_guest_state *state = tevent_req_data(
269 req, struct cli_session_setup_guest_state);
270 struct cli_state *cli = state->cli;
271 uint32_t num_bytes;
272 uint8_t *in;
273 char *inbuf;
274 uint8_t *bytes;
275 uint8_t *p;
276 NTSTATUS status;
277
278 status = cli_smb_recv(subreq, state, &in, 0, NULL, NULL,
279 &num_bytes, &bytes);
280 TALLOC_FREE(subreq);
281 if (!NT_STATUS_IS_OK(status)) {
282 tevent_req_nterror(req, status);
283 return;
284 }
285
286 inbuf = (char *)in;
287 p = bytes;
288
289 cli->vuid = SVAL(inbuf, smb_uid);
290
291 p += clistr_pull(inbuf, cli->server_os, (char *)p, sizeof(fstring),
292 bytes+num_bytes-p, STR_TERMINATE);
293 p += clistr_pull(inbuf, cli->server_type, (char *)p, sizeof(fstring),
294 bytes+num_bytes-p, STR_TERMINATE);
295 p += clistr_pull(inbuf, cli->server_domain, (char *)p, sizeof(fstring),
296 bytes+num_bytes-p, STR_TERMINATE);
297
298 if (strstr(cli->server_type, "Samba")) {
299 cli->is_samba = True;
300 }
301
302 status = cli_set_username(cli, "");
303 if (!NT_STATUS_IS_OK(status)) {
304 tevent_req_nterror(req, status);
305 return;
306 }
307 tevent_req_done(req);
308 }
309
310 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
311 {
312 return tevent_req_simple_recv_ntstatus(req);
313 }
314
315 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
316 {
317 TALLOC_CTX *frame = talloc_stackframe();
318 struct event_context *ev;
319 struct tevent_req *req;
320 NTSTATUS status = NT_STATUS_OK;
321
322 if (cli_has_async_calls(cli)) {
323 /*
324 * Can't use sync call while an async call is in flight
325 */
326 status = NT_STATUS_INVALID_PARAMETER;
327 goto fail;
328 }
329
330 ev = event_context_init(frame);
331 if (ev == NULL) {
332 status = NT_STATUS_NO_MEMORY;
333 goto fail;
334 }
335
336 req = cli_session_setup_guest_send(frame, ev, cli);
337 if (req == NULL) {
338 status = NT_STATUS_NO_MEMORY;
339 goto fail;
340 }
341
342 if (!tevent_req_poll(req, ev)) {
343 status = map_nt_error_from_unix(errno);
344 goto fail;
345 }
346
347 status = cli_session_setup_guest_recv(req);
348 fail:
349 TALLOC_FREE(frame);
350 if (!NT_STATUS_IS_OK(status)) {
351 cli_set_error(cli, status);
352 }
353 return status;
354 }
355
356 /****************************************************************************
357 Do a NT1 plaintext session setup.
358 ****************************************************************************/
359
360 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
361 const char *user, const char *pass,
362 const char *workgroup)
363 {
364 uint32 capabilities = cli_session_setup_capabilities(cli);
365 char *p;
366 NTSTATUS status;
367 fstring lanman;
368
369 fstr_sprintf( lanman, "Samba %s", samba_version_string());
370
371 memset(cli->outbuf, '\0', smb_size);
372 cli_set_message(cli->outbuf,13,0,True);
373 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
374 cli_setup_packet(cli);
375
376 SCVAL(cli->outbuf,smb_vwv0,0xFF);
377 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
378 SSVAL(cli->outbuf,smb_vwv3,2);
379 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
380 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
381 SSVAL(cli->outbuf,smb_vwv8,0);
382 SIVAL(cli->outbuf,smb_vwv11,capabilities);
383 p = smb_buf(cli->outbuf);
384
385 /* check wether to send the ASCII or UNICODE version of the password */
386
387 if ( (capabilities & CAP_UNICODE) == 0 ) {
388 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
389 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
390 }
391 else {
392 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
393 * the space taken by the unicode password to be one byte too
394 * long (as we're on an odd byte boundary here). Reduce the
395 * count by 1 to cope with this. Fixes smbclient against NetApp
396 * servers which can't cope. Fix from
397 * bryan.kolodziej@allenlund.com in bug #3840.
398 */
399 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
400 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
401 }
402
403 p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
404 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
405 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
406 p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
407 cli_setup_bcc(cli, p);
408
409 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
410 return cli_nt_error(cli);
411 }
412
413 show_msg(cli->inbuf);
414
415 if (cli_is_error(cli)) {
416 return cli_nt_error(cli);
417 }
418
419 cli->vuid = SVAL(cli->inbuf,smb_uid);
420 p = smb_buf(cli->inbuf);
421 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
422 -1, STR_TERMINATE);
423 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
424 -1, STR_TERMINATE);
425 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
426 -1, STR_TERMINATE);
427 status = cli_set_username(cli, user);
428 if (!NT_STATUS_IS_OK(status)) {
429 return status;
430 }
431 if (strstr(cli->server_type, "Samba")) {
432 cli->is_samba = True;
433 }
434
435 return NT_STATUS_OK;
436 }
437
438 /****************************************************************************
439 do a NT1 NTLM/LM encrypted session setup - for when extended security
440 is not negotiated.
441 @param cli client state to create do session setup on
442 @param user username
443 @param pass *either* cleartext password (passlen !=24) or LM response.
444 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
445 @param workgroup The user's domain.
446 ****************************************************************************/
447
448 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
449 const char *pass, size_t passlen,
450 const char *ntpass, size_t ntpasslen,
451 const char *workgroup)
452 {
453 uint32 capabilities = cli_session_setup_capabilities(cli);
454 DATA_BLOB lm_response = data_blob_null;
455 DATA_BLOB nt_response = data_blob_null;
456 DATA_BLOB session_key = data_blob_null;
457 NTSTATUS result;
458 char *p;
459 bool ok;
460
461 if (passlen == 0) {
462 /* do nothing - guest login */
463 } else if (passlen != 24) {
464 if (lp_client_ntlmv2_auth()) {
465 DATA_BLOB server_chal;
466 DATA_BLOB names_blob;
467 server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
468
469 /* note that the 'workgroup' here is a best guess - we don't know
470 the server's domain at this point. The 'server name' is also
471 dodgy...
472 */
473 names_blob = NTLMv2_generate_names_blob(NULL, cli->called.name, workgroup);
474
475 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass, &server_chal,
476 &names_blob,
477 &lm_response, &nt_response, NULL, &session_key)) {
478 data_blob_free(&names_blob);
479 data_blob_free(&server_chal);
480 return NT_STATUS_ACCESS_DENIED;
481 }
482 data_blob_free(&names_blob);
483 data_blob_free(&server_chal);
484
485 } else {
486 uchar nt_hash[16];
487 E_md4hash(pass, nt_hash);
488
489 #ifdef LANMAN_ONLY
490 nt_response = data_blob_null;
491 #else
492 nt_response = data_blob(NULL, 24);
493 SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
494 #endif
495 /* non encrypted password supplied. Ignore ntpass. */
496 if (lp_client_lanman_auth()) {
497 lm_response = data_blob(NULL, 24);
498 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
499 /* Oops, the LM response is invalid, just put
500 the NT response there instead */
501 data_blob_free(&lm_response);
502 lm_response = data_blob(nt_response.data, nt_response.length);
503 }
504 } else {
505 /* LM disabled, place NT# in LM field instead */
506 lm_response = data_blob(nt_response.data, nt_response.length);
507 }
508
509 session_key = data_blob(NULL, 16);
510 #ifdef LANMAN_ONLY
511 E_deshash(pass, session_key.data);
512 memset(&session_key.data[8], '\0', 8);
513 #else
514 SMBsesskeygen_ntv1(nt_hash, session_key.data);
515 #endif
516 }
517 cli_temp_set_signing(cli);
518 } else {
519 /* pre-encrypted password supplied. Only used for
520 security=server, can't do
521 signing because we don't have original key */
522
523 lm_response = data_blob(pass, passlen);
524 nt_response = data_blob(ntpass, ntpasslen);
525 }
526
527 /* send a session setup command */
528 memset(cli->outbuf,'\0',smb_size);
529
530 cli_set_message(cli->outbuf,13,0,True);
531 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
532 cli_setup_packet(cli);
533
534 SCVAL(cli->outbuf,smb_vwv0,0xFF);
535 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
536 SSVAL(cli->outbuf,smb_vwv3,2);
537 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
538 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
539 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
540 SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
541 SIVAL(cli->outbuf,smb_vwv11,capabilities);
542 p = smb_buf(cli->outbuf);
543 if (lm_response.length) {
544 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
545 }
546 if (nt_response.length) {
547 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
548 }
549 p += clistr_push(cli, p, user, -1, STR_TERMINATE);
550
551 /* Upper case here might help some NTLMv2 implementations */
552 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
553 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
554 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
555 cli_setup_bcc(cli, p);
556
557 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
558 result = cli_nt_error(cli);
559 goto end;
560 }
561
562 /* show_msg(cli->inbuf); */
563
564 if (cli_is_error(cli)) {
565 result = cli_nt_error(cli);
566 goto end;
567 }
568
569 #ifdef LANMAN_ONLY
570 ok = cli_simple_set_signing(cli, session_key, lm_response);
571 #else
572 ok = cli_simple_set_signing(cli, session_key, nt_response);
573 #endif
574 if (ok) {
575 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
576 result = NT_STATUS_ACCESS_DENIED;
577 goto end;
578 }
579 }
580
581 /* use the returned vuid from now on */
582 cli->vuid = SVAL(cli->inbuf,smb_uid);
583
584 p = smb_buf(cli->inbuf);
585 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
586 -1, STR_TERMINATE);
587 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
588 -1, STR_TERMINATE);
589 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
590 -1, STR_TERMINATE);
591
592 if (strstr(cli->server_type, "Samba")) {
593 cli->is_samba = True;
594 }
595
596 result = cli_set_username(cli, user);
597 if (!NT_STATUS_IS_OK(result)) {
598 goto end;
599 }
600
601 if (session_key.data) {
602 /* Have plaintext orginal */
603 cli_set_session_key(cli, session_key);
604 }
605
606 result = NT_STATUS_OK;
607 end:
608 data_blob_free(&lm_response);
609 data_blob_free(&nt_response);
610 data_blob_free(&session_key);
611 return result;
612 }
613
614 /* The following is calculated from :
615 * (smb_size-4) = 35
616 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
617 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
618 * end of packet.
619 */
620
621 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
622
623 struct cli_sesssetup_blob_state {
624 struct tevent_context *ev;
625 struct cli_state *cli;
626 DATA_BLOB blob;
627 uint16_t max_blob_size;
628 uint16_t vwv[12];
629 uint8_t *buf;
630
631 NTSTATUS status;
632 char *inbuf;
633 DATA_BLOB ret_blob;
634 };
635
636 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
637 struct tevent_req **psubreq);
638 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
639
640 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
641 struct tevent_context *ev,
642 struct cli_state *cli,
643 DATA_BLOB blob)
644 {
645 struct tevent_req *req, *subreq;
646 struct cli_sesssetup_blob_state *state;
647
648 req = tevent_req_create(mem_ctx, &state,
649 struct cli_sesssetup_blob_state);
650 if (req == NULL) {
651 return NULL;
652 }
653 state->ev = ev;
654 state->blob = blob;
655 state->cli = cli;
656
657 if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
658 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
659 "(was %u, need minimum %u)\n",
660 (unsigned int)cli->max_xmit,
661 BASE_SESSSETUP_BLOB_PACKET_SIZE));
662 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
663 return tevent_req_post(req, ev);
664 }
665 state->max_blob_size =
666 MIN(cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE, 0xFFFF);
667
668 if (!cli_sesssetup_blob_next(state, &subreq)) {
669 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
670 return tevent_req_post(req, ev);
671 }
672 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
673 return req;
674 }
675
676 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
677 struct tevent_req **psubreq)
678 {
679 struct tevent_req *subreq;
680 uint16_t thistime;
681
682 SCVAL(state->vwv+0, 0, 0xFF);
683 SCVAL(state->vwv+0, 1, 0);
684 SSVAL(state->vwv+1, 0, 0);
685 SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
686 SSVAL(state->vwv+3, 0, 2);
687 SSVAL(state->vwv+4, 0, 1);
688 SIVAL(state->vwv+5, 0, 0);
689
690 thistime = MIN(state->blob.length, state->max_blob_size);
691 SSVAL(state->vwv+7, 0, thistime);
692
693 SSVAL(state->vwv+8, 0, 0);
694 SSVAL(state->vwv+9, 0, 0);
695 SIVAL(state->vwv+10, 0,
696 cli_session_setup_capabilities(state->cli)
697 | CAP_EXTENDED_SECURITY);
698
699 state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
700 thistime);
701 if (state->buf == NULL) {
702 return false;
703 }
704 state->blob.data += thistime;
705 state->blob.length -= thistime;
706
707 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
708 "Unix", 5, NULL);
709 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
710 "Samba", 6, NULL);
711 if (state->buf == NULL) {
712 return false;
713 }
714 subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
715 12, state->vwv,
716 talloc_get_size(state->buf), state->buf);
717 if (subreq == NULL) {
718 return false;
719 }
720 *psubreq = subreq;
721 return true;
722 }
723
724 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
725 {
726 struct tevent_req *req = tevent_req_callback_data(
727 subreq, struct tevent_req);
728 struct cli_sesssetup_blob_state *state = tevent_req_data(
729 req, struct cli_sesssetup_blob_state);
730 struct cli_state *cli = state->cli;
731 uint8_t wct;
732 uint16_t *vwv;
733 uint32_t num_bytes;
734 uint8_t *bytes;
735 NTSTATUS status;
736 uint8_t *p;
737 uint16_t blob_length;
738 uint8_t *inbuf;
739
740 status = cli_smb_recv(subreq, state, &inbuf, 1, &wct, &vwv,
741 &num_bytes, &bytes);
742 TALLOC_FREE(subreq);
743 if (!NT_STATUS_IS_OK(status)
744 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
745 tevent_req_nterror(req, status);
746 return;
747 }
748
749 state->status = status;
750 TALLOC_FREE(state->buf);
751
752 state->inbuf = (char *)inbuf;
753 cli->vuid = SVAL(state->inbuf, smb_uid);
754
755 blob_length = SVAL(vwv+3, 0);
756 if (blob_length > num_bytes) {
757 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
758 return;
759 }
760 state->ret_blob = data_blob_const(bytes, blob_length);
761
762 p = bytes + blob_length;
763
764 p += clistr_pull(state->inbuf, cli->server_os,
765 (char *)p, sizeof(fstring),
766 bytes+num_bytes-p, STR_TERMINATE);
767 p += clistr_pull(state->inbuf, cli->server_type,
768 (char *)p, sizeof(fstring),
769 bytes+num_bytes-p, STR_TERMINATE);
770 p += clistr_pull(state->inbuf, cli->server_domain,
771 (char *)p, sizeof(fstring),
772 bytes+num_bytes-p, STR_TERMINATE);
773
774 if (strstr(cli->server_type, "Samba")) {
775 cli->is_samba = True;
776 }
777
778 if (state->blob.length != 0) {
779 /*
780 * More to send
781 */
782 if (!cli_sesssetup_blob_next(state, &subreq)) {
783 tevent_req_nomem(NULL, req);
784 return;
785 }
786 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
787 return;
788 }
789 tevent_req_done(req);
790 }
791
792 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
793 TALLOC_CTX *mem_ctx,
794 DATA_BLOB *pblob,
795 char **pinbuf)
796 {
797 struct cli_sesssetup_blob_state *state = tevent_req_data(
798 req, struct cli_sesssetup_blob_state);
799 NTSTATUS status;
800 char *inbuf;
801
802 if (tevent_req_is_nterror(req, &status)) {
803 state->cli->vuid = 0;
804 return status;
805 }
806
807 inbuf = talloc_move(mem_ctx, &state->inbuf);
808 if (pblob != NULL) {
809 *pblob = state->ret_blob;
810 }
811 if (pinbuf != NULL) {
812 *pinbuf = inbuf;
813 }
814 /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
815 return state->status;
816 }
817
818 #ifdef HAVE_KRB5
819
820 /****************************************************************************
821 Use in-memory credentials cache
822 ****************************************************************************/
823
824 static void use_in_memory_ccache(void) {
825 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
826 }
827
828 /****************************************************************************
829 Do a spnego/kerberos encrypted session setup.
830 ****************************************************************************/
831
832 struct cli_session_setup_kerberos_state {
833 struct cli_state *cli;
834 DATA_BLOB negTokenTarg;
835 DATA_BLOB session_key_krb5;
836 ADS_STATUS ads_status;
837 };
838
839 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
840
841 static struct tevent_req *cli_session_setup_kerberos_send(
842 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
843 const char *principal, const char *workgroup)
844 {
845 struct tevent_req *req, *subreq;
846 struct cli_session_setup_kerberos_state *state;
847 int rc;
848
849 DEBUG(2,("Doing kerberos session setup\n"));
850
851 req = tevent_req_create(mem_ctx, &state,
852 struct cli_session_setup_kerberos_state);
853 if (req == NULL) {
854 return NULL;
855 }
856 state->cli = cli;
857 state->ads_status = ADS_SUCCESS;
858
859 cli_temp_set_signing(cli);
860
861 /*
862 * Ok, this is cheating: spnego_gen_krb5_negTokenInit can block if
863 * we have to acquire a ticket. To be fixed later :-)
864 */
865 rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
866 &state->session_key_krb5, 0, NULL);
867 if (rc) {
868 DEBUG(1, ("cli_session_setup_kerberos: "
869 "spnego_gen_krb5_negTokenInit failed: %s\n",
870 error_message(rc)));
871 state->ads_status = ADS_ERROR_KRB5(rc);
872 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
873 return tevent_req_post(req, ev);
874 }
875
876 #if 0
877 file_save("negTokenTarg.dat", state->negTokenTarg.data,
878 state->negTokenTarg.length);
879 #endif
880
881 subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
882 if (tevent_req_nomem(subreq, req)) {
883 return tevent_req_post(req, ev);
884 }
885 tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
886 return req;
887 }
888
889 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
890 {
891 struct tevent_req *req = tevent_req_callback_data(
892 subreq, struct tevent_req);
893 struct cli_session_setup_kerberos_state *state = tevent_req_data(
894 req, struct cli_session_setup_kerberos_state);
895 char *inbuf = NULL;
896 NTSTATUS status;
897
898 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), NULL, &inbuf);
899 if (!NT_STATUS_IS_OK(status)) {
900 TALLOC_FREE(subreq);
901 tevent_req_nterror(req, status);
902 return;
903 }
904
905 cli_set_session_key(state->cli, state->session_key_krb5);
906
907 if (cli_simple_set_signing(state->cli, state->session_key_krb5,
908 data_blob_null)
909 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
910 TALLOC_FREE(subreq);
911 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
912 return;
913 }
914 TALLOC_FREE(subreq);
915 tevent_req_done(req);
916 }
917
918 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
919 {
920 struct cli_session_setup_kerberos_state *state = tevent_req_data(
921 req, struct cli_session_setup_kerberos_state);
922 NTSTATUS status;
923
924 if (tevent_req_is_nterror(req, &status)) {
925 return ADS_ERROR_NT(status);
926 }
927 return state->ads_status;
928 }
929
930 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
931 const char *principal,
932 const char *workgroup)
933 {
934 struct tevent_context *ev;
935 struct tevent_req *req;
936 ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
937
938 if (cli_has_async_calls(cli)) {
939 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
940 }
941 ev = tevent_context_init(talloc_tos());
942 if (ev == NULL) {
943 goto fail;
944 }
945 req = cli_session_setup_kerberos_send(ev, ev, cli, principal,
946 workgroup);
947 if (req == NULL) {
948 goto fail;
949 }
950 if (!tevent_req_poll(req, ev)) {
951 status = ADS_ERROR_SYSTEM(errno);
952 goto fail;
953 }
954 status = cli_session_setup_kerberos_recv(req);
955 fail:
956 TALLOC_FREE(ev);
957 return status;
958 }
959 #endif /* HAVE_KRB5 */
960
961 /****************************************************************************
962 Do a spnego/NTLMSSP encrypted session setup.
963 ****************************************************************************/
964
965 struct cli_session_setup_ntlmssp_state {
966 struct tevent_context *ev;
967 struct cli_state *cli;
968 struct ntlmssp_state *ntlmssp_state;
969 int turn;
970 DATA_BLOB blob_out;
971 };
972
973 static int cli_session_setup_ntlmssp_state_destructor(
974 struct cli_session_setup_ntlmssp_state *state)
975 {
976 if (state->ntlmssp_state != NULL) {
977 TALLOC_FREE(state->ntlmssp_state);
978 }
979 return 0;
980 }
981
982 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
983
984 static struct tevent_req *cli_session_setup_ntlmssp_send(
985 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
986 const char *user, const char *pass, const char *domain)
987 {
988 struct tevent_req *req, *subreq;
989 struct cli_session_setup_ntlmssp_state *state;
990 NTSTATUS status;
991 DATA_BLOB blob_out;
992 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
993
994 req = tevent_req_create(mem_ctx, &state,
995 struct cli_session_setup_ntlmssp_state);
996 if (req == NULL) {
997 return NULL;
998 }
999 state->ev = ev;
1000 state->cli = cli;
1001 state->turn = 1;
1002
1003 state->ntlmssp_state = NULL;
1004 talloc_set_destructor(
1005 state, cli_session_setup_ntlmssp_state_destructor);
1006
1007 cli_temp_set_signing(cli);
1008
1009 status = ntlmssp_client_start(state,
1010 global_myname(),
1011 lp_workgroup(),
1012 lp_client_ntlmv2_auth(),
1013 &state->ntlmssp_state);
1014 if (!NT_STATUS_IS_OK(status)) {
1015 goto fail;
1016 }
1017 ntlmssp_want_feature(state->ntlmssp_state,
1018 NTLMSSP_FEATURE_SESSION_KEY);
1019 if (cli->use_ccache) {
1020 ntlmssp_want_feature(state->ntlmssp_state,
1021 NTLMSSP_FEATURE_CCACHE);
1022 }
1023 status = ntlmssp_set_username(state->ntlmssp_state, user);
1024 if (!NT_STATUS_IS_OK(status)) {
1025 goto fail;
1026 }
1027 status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1028 if (!NT_STATUS_IS_OK(status)) {
1029 goto fail;
1030 }
1031 status = ntlmssp_set_password(state->ntlmssp_state, pass);
1032 if (!NT_STATUS_IS_OK(status)) {
1033 goto fail;
1034 }
1035 status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1036 &blob_out);
1037 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1038 goto fail;
1039 }
1040
1041 state->blob_out = spnego_gen_negTokenInit(state, OIDs_ntlm, &blob_out, NULL);
1042 data_blob_free(&blob_out);
1043
1044 subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1045 if (tevent_req_nomem(subreq, req)) {
1046 return tevent_req_post(req, ev);
1047 }
1048 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1049 return req;
1050 fail:
1051 tevent_req_nterror(req, status);
1052 return tevent_req_post(req, ev);
1053 }
1054
1055 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1056 {
1057 struct tevent_req *req = tevent_req_callback_data(
1058 subreq, struct tevent_req);
1059 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1060 req, struct cli_session_setup_ntlmssp_state);
1061 DATA_BLOB blob_in, msg_in, blob_out;
1062 char *inbuf = NULL;
1063 bool parse_ret;
1064 NTSTATUS status;
1065
1066 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1067 &inbuf);
1068 TALLOC_FREE(subreq);
1069 data_blob_free(&state->blob_out);
1070
1071 if (NT_STATUS_IS_OK(status)) {
1072 if (state->cli->server_domain[0] == '\0') {
1073 fstrcpy(state->cli->server_domain,
1074 state->ntlmssp_state->server.netbios_domain);
1075 }
1076 cli_set_session_key(
1077 state->cli, state->ntlmssp_state->session_key);
1078
1079 if (cli_simple_set_signing(
1080 state->cli, state->ntlmssp_state->session_key,
1081 data_blob_null)
1082 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1083 TALLOC_FREE(subreq);
1084 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1085 return;
1086 }
1087 TALLOC_FREE(subreq);
1088 TALLOC_FREE(state->ntlmssp_state);
1089 tevent_req_done(req);
1090 return;
1091 }
1092 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1093 tevent_req_nterror(req, status);
1094 return;
1095 }
1096
1097 if (blob_in.length == 0) {
1098 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1099 return;
1100 }
1101
1102 if ((state->turn == 1)
1103 && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1104 DATA_BLOB tmp_blob = data_blob_null;
1105 /* the server might give us back two challenges */
1106 parse_ret = spnego_parse_challenge(state, blob_in, &msg_in,
1107 &tmp_blob);
1108 data_blob_free(&tmp_blob);
1109 } else {
1110 parse_ret = spnego_parse_auth_response(state, blob_in, status,
1111 OID_NTLMSSP, &msg_in);
1112 }
1113 state->turn += 1;
1114
1115 if (!parse_ret) {
1116 DEBUG(3,("Failed to parse auth response\n"));
1117 if (NT_STATUS_IS_OK(status)
1118 || NT_STATUS_EQUAL(status,
1119 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1120 tevent_req_nterror(
1121 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1122 return;
1123 }
1124 }
1125
1126 status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1127
1128 if (!NT_STATUS_IS_OK(status)
1129 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1130 TALLOC_FREE(subreq);
1131 TALLOC_FREE(state->ntlmssp_state);
1132 tevent_req_nterror(req, status);
1133 return;
1134 }
1135
1136 state->blob_out = spnego_gen_auth(state, blob_out);
1137 TALLOC_FREE(subreq);
1138 if (tevent_req_nomem(state->blob_out.data, req)) {
1139 return;
1140 }
1141
1142 subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1143 state->blob_out);
1144 if (tevent_req_nomem(subreq, req)) {
1145 return;
1146 }
1147 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1148 }
1149
1150 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1151 {
1152 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1153 req, struct cli_session_setup_ntlmssp_state);
1154 NTSTATUS status;
1155
1156 if (tevent_req_is_nterror(req, &status)) {
1157 state->cli->vuid = 0;
1158 return status;
1159 }
1160 return NT_STATUS_OK;
1161 }
1162
1163 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1164 const char *user,
1165 const char *pass,
1166 const char *domain)
1167 {
1168 struct tevent_context *ev;
1169 struct tevent_req *req;
1170 NTSTATUS status = NT_STATUS_NO_MEMORY;
1171
1172 if (cli_has_async_calls(cli)) {
1173 return NT_STATUS_INVALID_PARAMETER;
1174 }
1175 ev = tevent_context_init(talloc_tos());
1176 if (ev == NULL) {
1177 goto fail;
1178 }
1179 req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1180 if (req == NULL) {
1181 goto fail;
1182 }
1183 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1184 goto fail;
1185 }
1186 status = cli_session_setup_ntlmssp_recv(req);
1187 fail:
1188 TALLOC_FREE(ev);
1189 if (!NT_STATUS_IS_OK(status)) {
1190 cli_set_error(cli, status);
1191 }
1192 return status;
1193 }
1194
1195 /****************************************************************************
1196 Do a spnego encrypted session setup.
1197
1198 user_domain: The shortname of the domain the user/machine is a member of.
1199 dest_realm: The realm we're connecting to, if NULL we use our default realm.
1200 ****************************************************************************/
1201
1202 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
1203 const char *pass, const char *user_domain,
1204 const char * dest_realm)
1205 {
1206 char *principal = NULL;
1207 char *OIDs[ASN1_MAX_OIDS];
1208 int i;
1209 DATA_BLOB blob;
1210 const char *p = NULL;
1211 char *account = NULL;
1212 NTSTATUS status;
1213
1214 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
1215
1216 /* the server might not even do spnego */
1217 if (cli->secblob.length <= 16) {
1218 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1219 goto ntlmssp;
1220 }
1221
1222 #if 0
1223 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1224 #endif
1225
1226 /* there is 16 bytes of GUID before the real spnego packet starts */
1227 blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
1228
1229 /* The server sent us the first part of the SPNEGO exchange in the
1230 * negprot reply. It is WRONG to depend on the principal sent in the
1231 * negprot reply, but right now we do it. If we don't receive one,
1232 * we try to best guess, then fall back to NTLM. */
1233 if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &principal, NULL) ||
1234 OIDs[0] == NULL) {
1235 data_blob_free(&blob);
1236 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1237 }
1238 data_blob_free(&blob);
1239
1240 /* make sure the server understands kerberos */
1241 for (i=0;OIDs[i];i++) {
1242 if (i == 0)
1243 DEBUG(3,("got OID=%s\n", OIDs[i]));
1244 else
1245 DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1246 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1247 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1248 cli->got_kerberos_mechanism = True;
1249 }
1250 talloc_free(OIDs[i]);
1251 }
1252
1253 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1254
1255 status = cli_set_username(cli, user);
1256 if (!NT_STATUS_IS_OK(status)) {
1257 TALLOC_FREE(principal);
1258 return ADS_ERROR_NT(status);
1259 }
1260
1261 #ifdef HAVE_KRB5
1262 /* If password is set we reauthenticate to kerberos server
1263 * and do not store results */
1264
1265 if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1266 ADS_STATUS rc;
1267
1268 if (pass && *pass) {
1269 int ret;
1270
1271 use_in_memory_ccache();
1272 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1273
1274 if (ret){
1275 TALLOC_FREE(principal);
1276 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1277 if (cli->fallback_after_kerberos)
1278 goto ntlmssp;
1279 return ADS_ERROR_KRB5(ret);
1280 }
1281 }
1282
1283 /* We may not be allowed to use the server-supplied SPNEGO principal, or it may not have been supplied to us
1284 */
1285 if (!lp_client_use_spnego_principal() || strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1286 TALLOC_FREE(principal);
1287 }
1288
1289 if (principal == NULL &&
1290 !is_ipaddress(cli->desthost) &&
1291 !strequal(STAR_SMBSERVER,
1292 cli->desthost)) {
1293 char *realm = NULL;
1294 char *host = NULL;
1295 DEBUG(3,("cli_session_setup_spnego: using target "
1296 "hostname not SPNEGO principal\n"));
1297
1298 host = strchr_m(cli->desthost, '.');
1299 if (dest_realm) {
1300 realm = SMB_STRDUP(dest_realm);
1301 strupper_m(realm);
1302 } else {
1303 if (host) {
1304 /* DNS name. */
1305 realm = kerberos_get_realm_from_hostname(cli->desthost);
1306 } else {
1307 /* NetBIOS name - use our realm. */
1308 realm = kerberos_get_default_realm_from_ccache();
1309 }
1310 }
1311
1312 if (realm && *realm) {
1313 principal = talloc_asprintf(talloc_tos(),
1314 "cifs/%s@%s",
1315 cli->desthost,
1316 realm);
1317 if (!principal) {
1318 SAFE_FREE(realm);
1319 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1320 }
1321 DEBUG(3,("cli_session_setup_spnego: guessed "
1322 "server principal=%s\n",
1323 principal ? principal : "<null>"));
1324 }
1325 SAFE_FREE(realm);
1326 }
1327
1328 if (principal) {
1329 rc = cli_session_setup_kerberos(cli, principal,
1330 dest_realm);
1331 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1332 TALLOC_FREE(principal);
1333 return rc;
1334 }
1335 }
1336 }
1337 #endif
1338
1339 TALLOC_FREE(principal);
1340
1341 ntlmssp:
1342
1343 account = talloc_strdup(talloc_tos(), user);
1344 if (!account) {
1345 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1346 }
1347
1348 /* when falling back to ntlmssp while authenticating with a machine
1349 * account strip off the realm - gd */
1350
1351 if ((p = strchr_m(user, '@')) != NULL) {
1352 account[PTR_DIFF(p,user)] = '\0';
1353 }
1354
1355 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1356 }
1357
1358 /****************************************************************************
1359 Send a session setup. The username and workgroup is in UNIX character
1360 format and must be converted to DOS codepage format before sending. If the
1361 password is in plaintext, the same should be done.
1362 ****************************************************************************/
1363
1364 NTSTATUS cli_session_setup(struct cli_state *cli,
1365 const char *user,
1366 const char *pass, int passlen,
1367 const char *ntpass, int ntpasslen,
1368 const char *workgroup)
1369 {
1370 char *p;
1371 fstring user2;
1372
1373 if (user) {
1374 fstrcpy(user2, user);
1375 } else {
1376 user2[0] ='\0';
1377 }
1378
1379 if (!workgroup) {
1380 workgroup = "";
1381 }
1382
1383 /* allow for workgroups as part of the username */
1384 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1385 (p=strchr_m(user2,*lp_winbind_separator()))) {
1386 *p = 0;
1387 user = p+1;
1388 workgroup = user2;
1389 }
1390
1391 if (cli->protocol < PROTOCOL_LANMAN1) {
1392 return NT_STATUS_OK;
1393 }
1394
1395 /* now work out what sort of session setup we are going to
1396 do. I have split this into separate functions to make the
1397 flow a bit easier to understand (tridge) */
1398
1399 /* if its an older server then we have to use the older request format */
1400
1401 if (cli->protocol < PROTOCOL_NT1) {
1402 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1403 DEBUG(1, ("Server requested LM password but 'client lanman auth = no'"
1404 " or 'client ntlmv2 auth = yes'\n"));
1405 return NT_STATUS_ACCESS_DENIED;
1406 }
1407
1408 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1409 !lp_client_plaintext_auth() && (*pass)) {
1410 DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
1411 " or 'client ntlmv2 auth = yes'\n"));
1412 return NT_STATUS_ACCESS_DENIED;
1413 }
1414
1415 return cli_session_setup_lanman2(cli, user, pass, passlen,
1416 workgroup);
1417 }
1418
1419 /* if no user is supplied then we have to do an anonymous connection.
1420 passwords are ignored */
1421
1422 if (!user || !*user)
1423 return cli_session_setup_guest(cli);
1424
1425 /* if the server is share level then send a plaintext null
1426 password at this point. The password is sent in the tree
1427 connect */
1428
1429 if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1430 return cli_session_setup_plaintext(cli, user, "", workgroup);
1431
1432 /* if the server doesn't support encryption then we have to use
1433 plaintext. The second password is ignored */
1434
1435 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1436 if (!lp_client_plaintext_auth() && (*pass)) {
1437 DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
1438 " or 'client ntlmv2 auth = yes'\n"));
1439 return NT_STATUS_ACCESS_DENIED;
1440 }
1441 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1442 }
1443
1444 /* if the server supports extended security then use SPNEGO */
1445
1446 if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1447 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1448 workgroup, NULL);
1449 if (!ADS_ERR_OK(status)) {
1450 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1451 return ads_ntstatus(status);
1452 }
1453 } else {
1454 NTSTATUS status;
1455
1456 /* otherwise do a NT1 style session setup */
1457 status = cli_session_setup_nt1(cli, user, pass, passlen,
1458 ntpass, ntpasslen, workgroup);
1459 if (!NT_STATUS_IS_OK(status)) {
1460 DEBUG(3,("cli_session_setup: NT1 session setup "
1461 "failed: %s\n", nt_errstr(status)));
1462 return status;
1463 }
1464 }
1465
1466 if (strstr(cli->server_type, "Samba")) {
1467 cli->is_samba = True;
1468 }
1469
1470 return NT_STATUS_OK;
1471 }
1472
1473 /****************************************************************************
1474 Send a uloggoff.
1475 *****************************************************************************/
1476
1477 struct cli_ulogoff_state {
1478 struct cli_state *cli;
1479 uint16_t vwv[3];
1480 };
1481
1482 static void cli_ulogoff_done(struct tevent_req *subreq);
1483
1484 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
1485 struct tevent_context *ev,
1486 struct cli_state *cli)
1487 {
1488 struct tevent_req *req, *subreq;
1489 struct cli_ulogoff_state *state;
1490
1491 req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
1492 if (req == NULL) {
1493 return NULL;
1494 }
1495 state->cli = cli;
1496
1497 SCVAL(state->vwv+0, 0, 0xFF);
1498 SCVAL(state->vwv+1, 0, 0);
1499 SSVAL(state->vwv+2, 0, 0);
1500
1501 subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
1502 0, NULL);
1503 if (tevent_req_nomem(subreq, req)) {
1504 return tevent_req_post(req, ev);
1505 }
1506 tevent_req_set_callback(subreq, cli_ulogoff_done, req);
1507 return req;
1508 }
1509
1510 static void cli_ulogoff_done(struct tevent_req *subreq)
1511 {
1512 struct tevent_req *req = tevent_req_callback_data(
1513 subreq, struct tevent_req);
1514 struct cli_ulogoff_state *state = tevent_req_data(
1515 req, struct cli_ulogoff_state);
1516 NTSTATUS status;
1517
1518 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
1519 if (!NT_STATUS_IS_OK(status)) {
1520 tevent_req_nterror(req, status);
1521 return;
1522 }
1523 state->cli->vuid = -1;
1524 tevent_req_done(req);
1525 }
1526
1527 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
1528 {
1529 return tevent_req_simple_recv_ntstatus(req);
1530 }
1531
1532 NTSTATUS cli_ulogoff(struct cli_state *cli)
1533 {
1534 struct tevent_context *ev;
1535 struct tevent_req *req;
1536 NTSTATUS status = NT_STATUS_NO_MEMORY;
1537
1538 if (cli_has_async_calls(cli)) {
1539 return NT_STATUS_INVALID_PARAMETER;
1540 }
1541 ev = tevent_context_init(talloc_tos());
1542 if (ev == NULL) {
1543 goto fail;
1544 }
1545 req = cli_ulogoff_send(ev, ev, cli);
1546 if (req == NULL) {
1547 goto fail;
1548 }
1549 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1550 goto fail;
1551 }
1552 status = cli_ulogoff_recv(req);
1553 fail:
1554 TALLOC_FREE(ev);
1555 if (!NT_STATUS_IS_OK(status)) {
1556 cli_set_error(cli, status);
1557 }
1558 return status;
1559 }
1560
1561 /****************************************************************************
1562 Send a tconX.
1563 ****************************************************************************/
1564
1565 struct cli_tcon_andx_state {
1566 struct cli_state *cli;
1567 uint16_t vwv[4];
1568 struct iovec bytes;
1569 };
1570
1571 static void cli_tcon_andx_done(struct tevent_req *subreq);
1572
1573 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
1574 struct event_context *ev,
1575 struct cli_state *cli,
1576 const char *share, const char *dev,
1577 const char *pass, int passlen,
1578 struct tevent_req **psmbreq)
1579 {
1580 struct tevent_req *req, *subreq;
1581 struct cli_tcon_andx_state *state;
1582 fstring pword;
1583 uint16_t *vwv;
1584 char *tmp = NULL;
1585 uint8_t *bytes;
1586
1587 *psmbreq = NULL;
1588
1589 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
1590 if (req == NULL) {
1591 return NULL;
1592 }
1593 state->cli = cli;
1594 vwv = state->vwv;
1595
1596 fstrcpy(cli->share, share);
1597
1598 /* in user level security don't send a password now */
1599 if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1600 passlen = 1;
1601 pass = "";
1602 } else if (pass == NULL) {
1603 DEBUG(1, ("Server not using user level security and no "
1604 "password supplied.\n"));
1605 goto access_denied;
1606 }
1607
1608 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1609 *pass && passlen != 24) {
1610 if (!lp_client_lanman_auth()) {
1611 DEBUG(1, ("Server requested LANMAN password "
1612 "(share-level security) but "
1613 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
1614 goto access_denied;
1615 }
1616
1617 /*
1618 * Non-encrypted passwords - convert to DOS codepage before
1619 * encryption.
1620 */
1621 passlen = 24;
1622 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1623 } else {
1624 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1625 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1626 == 0) {
1627 if (!lp_client_plaintext_auth() && (*pass)) {
1628 DEBUG(1, ("Server requested plaintext "
1629 "password but "
1630 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
1631 goto access_denied;
1632 }
1633
1634 /*
1635 * Non-encrypted passwords - convert to DOS codepage
1636 * before using.
1637 */
1638 passlen = clistr_push(cli, pword, pass, sizeof(pword),
1639 STR_TERMINATE);
1640 if (passlen == -1) {
1641 DEBUG(1, ("clistr_push(pword) failed\n"));
1642 goto access_denied;
1643 }
1644 } else {
1645 if (passlen) {
1646 memcpy(pword, pass, passlen);
1647 }
1648 }
1649 }
1650
1651 SCVAL(vwv+0, 0, 0xFF);
1652 SCVAL(vwv+0, 1, 0);
1653 SSVAL(vwv+1, 0, 0);
1654 SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1655 SSVAL(vwv+3, 0, passlen);
1656
1657 if (passlen) {
1658 bytes = (uint8_t *)talloc_memdup(state, pword, passlen);
1659 } else {
1660 bytes = talloc_array(state, uint8_t, 0);
1661 }
1662
1663 /*
1664 * Add the sharename
1665 */
1666 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1667 cli->desthost, share);
1668 if (tmp == NULL) {
1669 TALLOC_FREE(req);
1670 return NULL;
1671 }
1672 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1673 NULL);
1674 TALLOC_FREE(tmp);
1675
1676 /*
1677 * Add the devicetype
1678 */
1679 tmp = talloc_strdup_upper(talloc_tos(), dev);
1680 if (tmp == NULL) {
1681 TALLOC_FREE(req);
1682 return NULL;
1683 }
1684 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1685 TALLOC_FREE(tmp);
1686
1687 if (bytes == NULL) {
1688 TALLOC_FREE(req);
1689 return NULL;
1690 }
1691
1692 state->bytes.iov_base = (void *)bytes;
1693 state->bytes.iov_len = talloc_get_size(bytes);
1694
1695 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
1696 1, &state->bytes);
1697 if (subreq == NULL) {
1698 TALLOC_FREE(req);
1699 return NULL;
1700 }
1701 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
1702 *psmbreq = subreq;
1703 return req;
1704
1705 access_denied:
1706 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1707 return tevent_req_post(req, ev);
1708 }
1709
1710 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1711 struct event_context *ev,
1712 struct cli_state *cli,
1713 const char *share, const char *dev,
1714 const char *pass, int passlen)
1715 {
1716 struct tevent_req *req, *subreq;
1717 NTSTATUS status;
1718
1719 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
1720 &subreq);
1721 if (req == NULL) {
1722 return NULL;
1723 }
1724 if (subreq == NULL) {
1725 return req;
1726 }
1727 status = cli_smb_req_send(subreq);
1728 if (!NT_STATUS_IS_OK(status)) {
1729 tevent_req_nterror(req, status);
1730 return tevent_req_post(req, ev);
1731 }
1732 return req;
1733 }
1734
1735 static void cli_tcon_andx_done(struct tevent_req *subreq)
1736 {
1737 struct tevent_req *req = tevent_req_callback_data(
1738 subreq, struct tevent_req);
1739 struct cli_tcon_andx_state *state = tevent_req_data(
1740 req, struct cli_tcon_andx_state);
1741 struct cli_state *cli = state->cli;
1742 uint8_t *in;
1743 char *inbuf;
1744 uint8_t wct;
1745 uint16_t *vwv;
1746 uint32_t num_bytes;
1747 uint8_t *bytes;
1748 NTSTATUS status;
1749
1750 status = cli_smb_recv(subreq, state, &in, 0, &wct, &vwv,
1751 &num_bytes, &bytes);
1752 TALLOC_FREE(subreq);
1753 if (!NT_STATUS_IS_OK(status)) {
1754 tevent_req_nterror(req, status);
1755 return;
1756 }
1757
1758 inbuf = (char *)in;
1759
1760 clistr_pull(inbuf, cli->dev, bytes, sizeof(fstring), num_bytes,
1761 STR_TERMINATE|STR_ASCII);
1762
1763 if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1764 /* almost certainly win95 - enable bug fixes */
1765 cli->win95 = True;
1766 }
1767
1768 /*
1769 * Make sure that we have the optional support 16-bit field. WCT > 2.
1770 * Avoids issues when connecting to Win9x boxes sharing files
1771 */
1772
1773 cli->dfsroot = false;
1774
1775 if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1776 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1777 }
1778
1779 cli->cnum = SVAL(inbuf,smb_tid);
1780 tevent_req_done(req);
1781 }
1782
1783 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
1784 {
1785 return tevent_req_simple_recv_ntstatus(req);
1786 }
1787
1788 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1789 const char *dev, const char *pass, int passlen)
1790 {
1791 TALLOC_CTX *frame = talloc_stackframe();
1792 struct event_context *ev;
1793 struct tevent_req *req;
1794 NTSTATUS status = NT_STATUS_OK;
1795
1796 if (cli_has_async_calls(cli)) {
1797 /*
1798 * Can't use sync call while an async call is in flight
1799 */
1800 status = NT_STATUS_INVALID_PARAMETER;
1801 goto fail;
1802 }
1803
1804 ev = event_context_init(frame);
1805 if (ev == NULL) {
1806 status = NT_STATUS_NO_MEMORY;
1807 goto fail;
1808 }
1809
1810 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1811 if (req == NULL) {
1812 status = NT_STATUS_NO_MEMORY;
1813 goto fail;
1814 }
1815
1816 if (!tevent_req_poll(req, ev)) {
1817 status = map_nt_error_from_unix(errno);
1818 goto fail;
1819 }
1820
1821 status = cli_tcon_andx_recv(req);
1822 fail:
1823 TALLOC_FREE(frame);
1824 if (!NT_STATUS_IS_OK(status)) {
1825 cli_set_error(cli, status);
1826 }
1827 return status;
1828 }
1829
1830 /****************************************************************************
1831 Send a tree disconnect.
1832 ****************************************************************************/
1833
1834 struct cli_tdis_state {
1835 struct cli_state *cli;
1836 };
1837
1838 static void cli_tdis_done(struct tevent_req *subreq);
1839
1840 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
1841 struct tevent_context *ev,
1842 struct cli_state *cli)
1843 {
1844 struct tevent_req *req, *subreq;
1845 struct cli_tdis_state *state;
1846
1847 req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
1848 if (req == NULL) {
1849 return NULL;
1850 }
1851 state->cli = cli;
1852
1853 subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
1854 if (tevent_req_nomem(subreq, req)) {
1855 return tevent_req_post(req, ev);
1856 }
1857 tevent_req_set_callback(subreq, cli_tdis_done, req);
1858 return req;
1859 }
1860
1861 static void cli_tdis_done(struct tevent_req *subreq)
1862 {
1863 struct tevent_req *req = tevent_req_callback_data(
1864 subreq, struct tevent_req);
1865 struct cli_tdis_state *state = tevent_req_data(
1866 req, struct cli_tdis_state);
1867 NTSTATUS status;
1868
1869 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
1870 TALLOC_FREE(subreq);
1871 if (!NT_STATUS_IS_OK(status)) {
1872 tevent_req_nterror(req, status);
1873 return;
1874 }
1875 state->cli->cnum = -1;
1876 tevent_req_done(req);
1877 }
1878
1879 NTSTATUS cli_tdis_recv(struct tevent_req *req)
1880 {
1881 return tevent_req_simple_recv_ntstatus(req);
1882 }
1883
1884 NTSTATUS cli_tdis(struct cli_state *cli)
1885 {
1886 struct tevent_context *ev;
1887 struct tevent_req *req;
1888 NTSTATUS status = NT_STATUS_NO_MEMORY;
1889
1890 if (cli_has_async_calls(cli)) {
1891 return NT_STATUS_INVALID_PARAMETER;
1892 }
1893 ev = tevent_context_init(talloc_tos());
1894 if (ev == NULL) {
1895 goto fail;
1896 }
1897 req = cli_tdis_send(ev, ev, cli);
1898 if (req == NULL) {
1899 goto fail;
1900 }
1901 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1902 goto fail;
1903 }
1904 status = cli_tdis_recv(req);
1905 fail:
1906 TALLOC_FREE(ev);
1907 if (!NT_STATUS_IS_OK(status)) {
1908 cli_set_error(cli, status);
1909 }
1910 return status;
1911 }
1912
1913 /****************************************************************************
1914 Send a negprot command.
1915 ****************************************************************************/
1916
1917 struct cli_negprot_state {
1918 struct cli_state *cli;
1919 };
1920
1921 static void cli_negprot_done(struct tevent_req *subreq);
1922
1923 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1924 struct event_context *ev,
1925 struct cli_state *cli)
1926 {
1927 struct tevent_req *req, *subreq;
1928 struct cli_negprot_state *state;
1929 uint8_t *bytes = NULL;
1930 int numprots;
1931 uint16_t cnum;
1932
1933 req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
1934 if (req == NULL) {
1935 return NULL;
1936 }
1937 state->cli = cli;
1938
1939 if (cli->protocol < PROTOCOL_NT1)
1940 cli->use_spnego = False;
1941
1942 /* setup the protocol strings */
1943 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1944 uint8_t c = 2;
1945 if (prots[numprots].prot > cli->protocol) {
1946 break;
1947 }
1948 bytes = (uint8_t *)talloc_append_blob(
1949 state, bytes, data_blob_const(&c, sizeof(c)));
1950 if (tevent_req_nomem(bytes, req)) {
1951 return tevent_req_post(req, ev);
1952 }
1953 bytes = smb_bytes_push_str(bytes, false,
1954 prots[numprots].name,
1955 strlen(prots[numprots].name)+1,
1956 NULL);
1957 if (tevent_req_nomem(bytes, req)) {
1958 return tevent_req_post(req, ev);
1959 }
1960 }
1961
1962 cnum = cli->cnum;
1963
1964 cli->cnum = 0;
1965 subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
1966 talloc_get_size(bytes), bytes);
1967 cli->cnum = cnum;
1968
1969 if (tevent_req_nomem(subreq, req)) {
1970 return tevent_req_post(req, ev);
1971 }
1972 tevent_req_set_callback(subreq, cli_negprot_done, req);
1973 return req;
1974 }
1975
1976 static void cli_negprot_done(struct tevent_req *subreq)
1977 {
1978 struct tevent_req *req = tevent_req_callback_data(
1979 subreq, struct tevent_req);
1980 struct cli_negprot_state *state = tevent_req_data(
1981 req, struct cli_negprot_state);
1982 struct cli_state *cli = state->cli;
1983 uint8_t wct;
1984 uint16_t *vwv;
1985 uint32_t num_bytes;
1986 uint8_t *bytes;
1987 NTSTATUS status;
1988 uint16_t protnum;
1989 uint8_t *inbuf;
1990
1991 status = cli_smb_recv(subreq, state, &inbuf, 1, &wct, &vwv,
1992 &num_bytes, &bytes);
1993 TALLOC_FREE(subreq);
1994 if (!NT_STATUS_IS_OK(status)) {
1995 tevent_req_nterror(req, status);
1996 return;
1997 }
1998
1999 protnum = SVAL(vwv, 0);
2000
2001 if ((protnum >= ARRAY_SIZE(prots))
2002 || (prots[protnum].prot > cli->protocol)) {
2003 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2004 return;
2005 }
2006
2007 cli->protocol = prots[protnum].prot;
2008
2009 if ((cli->protocol < PROTOCOL_NT1) &&
2010 client_is_signing_mandatory(cli)) {
2011 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
2012 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2013 return;
2014 }
2015
2016 if (cli->protocol >= PROTOCOL_NT1) {
2017 struct timespec ts;
2018 bool negotiated_smb_signing = false;
2019
2020 /* NT protocol */
2021 cli->sec_mode = CVAL(vwv + 1, 0);
2022 cli->max_mux = SVAL(vwv + 1, 1);
2023 cli->max_xmit = IVAL(vwv + 3, 1);
2024 cli->sesskey = IVAL(vwv + 7, 1);
2025 cli->serverzone = SVALS(vwv + 15, 1);
2026 cli->serverzone *= 60;
2027 /* this time arrives in real GMT */
2028 ts = interpret_long_date(((char *)(vwv+11))+1);
2029 cli->servertime = ts.tv_sec;
2030 cli->secblob = data_blob(bytes, num_bytes);
2031 cli->capabilities = IVAL(vwv + 9, 1);
2032 if (cli->capabilities & CAP_RAW_MODE) {
2033 cli->readbraw_supported = True;
2034 cli->writebraw_supported = True;
2035 }
2036 /* work out if they sent us a workgroup */
2037 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
2038 smb_buflen(cli->inbuf) > 8) {
2039 clistr_pull(cli->inbuf, cli->server_domain,
2040 bytes+8, sizeof(cli->server_domain),
2041 num_bytes-8,
2042 STR_UNICODE|STR_NOALIGN);
2043 }
2044
2045 /*
2046 * As signing is slow we only turn it on if either the client or
2047 * the server require it. JRA.
2048 */
2049
2050 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
2051 /* Fail if server says signing is mandatory and we don't want to support it. */
2052 if (!client_is_signing_allowed(cli)) {
2053 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
2054 tevent_req_nterror(req,
2055 NT_STATUS_ACCESS_DENIED);
2056 return;
2057 }
2058 negotiated_smb_signing = true;
2059 } else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
2060 /* Fail if client says signing is mandatory and the server doesn't support it. */
2061 if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
2062 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
2063 tevent_req_nterror(req,
2064 NT_STATUS_ACCESS_DENIED);
2065 return;
2066 }
2067 negotiated_smb_signing = true;
2068 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
2069 negotiated_smb_signing = true;
2070 }
2071
2072 if (negotiated_smb_signing) {
2073 cli_set_signing_negotiated(cli);
2074 }
2075
2076 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
2077 SAFE_FREE(cli->outbuf);
2078 SAFE_FREE(cli->inbuf);
2079 cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
2080 cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
2081 if (!cli->outbuf || !cli->inbuf) {
2082 tevent_req_nterror(req,
2083 NT_STATUS_NO_MEMORY);
2084 return;
2085 }
2086 cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
2087 }
2088
2089 } else if (cli->protocol >= PROTOCOL_LANMAN1) {
2090 cli->use_spnego = False;
2091 cli->sec_mode = SVAL(vwv + 1, 0);
2092 cli->max_xmit = SVAL(vwv + 2, 0);
2093 cli->max_mux = SVAL(vwv + 3, 0);
2094 cli->sesskey = IVAL(vwv + 6, 0);
2095 cli->serverzone = SVALS(vwv + 10, 0);
2096 cli->serverzone *= 60;
2097 /* this time is converted to GMT by make_unix_date */
2098 cli->servertime = make_unix_date(
2099 (char *)(vwv + 8), cli->serverzone);
2100 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
2101 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
2102 cli->secblob = data_blob(bytes, num_bytes);
2103 } else {
2104 /* the old core protocol */
2105 cli->use_spnego = False;
2106 cli->sec_mode = 0;
2107 cli->serverzone = get_time_zone(time(NULL));
2108 }
2109
2110 cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
2111
2112 /* a way to force ascii SMB */
2113 if (getenv("CLI_FORCE_ASCII"))
2114 cli->capabilities &= ~CAP_UNICODE;
2115
2116 tevent_req_done(req);
2117 }
2118
2119 NTSTATUS cli_negprot_recv(struct tevent_req *req)
2120 {
2121 return tevent_req_simple_recv_ntstatus(req);
2122 }
2123
2124 NTSTATUS cli_negprot(struct cli_state *cli)
2125 {
2126 TALLOC_CTX *frame = talloc_stackframe();
2127 struct event_context *ev;
2128 struct tevent_req *req;
2129 NTSTATUS status = NT_STATUS_OK;
2130
2131 if (cli_has_async_calls(cli)) {
2132 /*
2133 * Can't use sync call while an async call is in flight
2134 */
2135 status = NT_STATUS_INVALID_PARAMETER;
2136 goto fail;
2137 }
2138
2139 ev = event_context_init(frame);
2140 if (ev == NULL) {
2141 status = NT_STATUS_NO_MEMORY;
2142 goto fail;
2143 }
2144
2145 req = cli_negprot_send(frame, ev, cli);
2146 if (req == NULL) {
2147 status = NT_STATUS_NO_MEMORY;
2148 goto fail;
2149 }
2150
2151 if (!tevent_req_poll(req, ev)) {
2152 status = map_nt_error_from_unix(errno);
2153 goto fail;
2154 }
2155
2156 status = cli_negprot_recv(req);
2157 fail:
2158 TALLOC_FREE(frame);
2159 if (!NT_STATUS_IS_OK(status)) {
2160 cli_set_error(cli, status);
2161 }
2162 return status;
2163 }
2164
2165 /****************************************************************************
2166 Send a session request. See rfc1002.txt 4.3 and 4.3.2.
2167 ****************************************************************************/
2168
2169 bool cli_session_request(struct cli_state *cli,
2170 struct nmb_name *calling, struct nmb_name *called)
2171 {
2172 char *p;
2173 int len = 4;
2174 int namelen = 0;
2175 char *tmp;
2176
2177 /* 445 doesn't have session request */
2178 if (cli->port == 445)
2179 return True;
2180
2181 memcpy(&(cli->calling), calling, sizeof(*calling));
2182 memcpy(&(cli->called ), called , sizeof(*called ));
2183
2184 /* put in the destination name */
2185
2186 tmp = name_mangle(talloc_tos(), cli->called.name,
2187 cli->called.name_type);
2188 if (tmp == NULL) {
2189 return false;
2190 }
2191
2192 p = cli->outbuf+len;
2193 namelen = name_len((unsigned char *)tmp, talloc_get_size(tmp));
2194 if (namelen > 0) {
2195 memcpy(p, tmp, namelen);
2196 len += namelen;
2197 }
2198 TALLOC_FREE(tmp);
2199
2200 /* and my name */
2201
2202 tmp = name_mangle(talloc_tos(), cli->calling.name,
2203 cli->calling.name_type);
2204 if (tmp == NULL) {
2205 return false;
2206 }
2207
2208 p = cli->outbuf+len;
2209 namelen = name_len((unsigned char *)tmp, talloc_get_size(tmp));
2210 if (namelen > 0) {
2211 memcpy(p, tmp, namelen);
2212 len += namelen;
2213 }
2214 TALLOC_FREE(tmp);
2215
2216 /* send a session request (RFC 1002) */
2217 /* setup the packet length
2218 * Remove four bytes from the length count, since the length
2219 * field in the NBT Session Service header counts the number
2220 * of bytes which follow. The cli_send_smb() function knows
2221 * about this and accounts for those four bytes.
2222 * CRH.
2223 */
2224 len -= 4;
2225 _smb_setlen(cli->outbuf,len);
2226 SCVAL(cli->outbuf,0,0x81);
2227
2228 cli_send_smb(cli);
2229 DEBUG(5,("Sent session request\n"));
2230
2231 if (!cli_receive_smb(cli))
2232 return False;
2233
2234 if (CVAL(cli->inbuf,0) == 0x84) {
2235 /* C. Hoch 9/14/95 Start */
2236 /* For information, here is the response structure.
2237 * We do the byte-twiddling to for portability.
2238 struct RetargetResponse{
2239 unsigned char type;
2240 unsigned char flags;
2241 int16 length;
2242 int32 ip_addr;
2243 int16 port;
2244 };
2245 */
2246 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
2247 struct in_addr dest_ip;
2248 NTSTATUS status;
2249
2250 /* SESSION RETARGET */
2251 putip((char *)&dest_ip,cli->inbuf+4);
2252 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
2253
2254 status = open_socket_out(&cli->dest_ss, port,
2255 LONG_CONNECT_TIMEOUT, &cli->fd);
2256 if (!NT_STATUS_IS_OK(status)) {
2257 return False;
2258 }
2259
2260 DEBUG(3,("Retargeted\n"));
2261
2262 set_socket_options(cli->fd, lp_socket_options());
2263
2264 /* Try again */
2265 {
2266 static int depth;
2267 bool ret;
2268 if (depth > 4) {
2269 DEBUG(0,("Retarget recursion - failing\n"));
2270 return False;
2271 }
2272 depth++;
2273 ret = cli_session_request(cli, calling, called);
2274 depth--;
2275 return ret;
2276 }
2277 } /* C. Hoch 9/14/95 End */
2278
2279 if (CVAL(cli->inbuf,0) != 0x82) {
2280 /* This is the wrong place to put the error... JRA. */
2281 cli->rap_error = CVAL(cli->inbuf,4);
2282 return False;
2283 }
2284 return(True);
2285 }
2286
2287 struct fd_struct {
2288 int fd;
2289 };
2290
2291 static void smb_sock_connected(struct tevent_req *req)
2292 {
2293 struct fd_struct *pfd = tevent_req_callback_data(
2294 req, struct fd_struct);
2295 int fd;
2296 NTSTATUS status;
2297
2298 status = open_socket_out_defer_recv(req, &fd);
2299 if (NT_STATUS_IS_OK(status)) {
2300 pfd->fd = fd;
2301 }
2302 }
2303
2304 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
2305 uint16_t *port, int timeout, int *pfd)
2306 {
2307 struct event_context *ev;
2308 struct tevent_req *r139, *r445;
2309 struct fd_struct *fd139, *fd445;
2310 NTSTATUS status = NT_STATUS_NO_MEMORY;
2311
2312 if (*port != 0) {
2313 return open_socket_out(pss, *port, timeout, pfd);
2314 }
2315
2316 ev = event_context_init(talloc_tos());
2317 if (ev == NULL) {
2318 return NT_STATUS_NO_MEMORY;
2319 }
2320
2321 fd139 = talloc(ev, struct fd_struct);
2322 if (fd139 == NULL) {
2323 goto done;
2324 }
2325 fd139->fd = -1;
2326
2327 fd445 = talloc(ev, struct fd_struct);
2328 if (fd445 == NULL) {
2329 goto done;
2330 }
2331 fd445->fd = -1;
2332
2333 r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
2334 pss, 445, timeout);
2335 r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
2336 pss, 139, timeout);
2337 if ((r445 == NULL) || (r139 == NULL)) {
2338 goto done;
2339 }
2340 tevent_req_set_callback(r445, smb_sock_connected, fd445);
2341 tevent_req_set_callback(r139, smb_sock_connected, fd139);
2342
2343 while ((fd445->fd == -1) && (fd139->fd == -1)
2344 && (tevent_req_is_in_progress(r139)
2345 || tevent_req_is_in_progress(r445))) {
2346 event_loop_once(ev);
2347 }
2348
2349 if ((fd139->fd != -1) && (fd445->fd != -1)) {
2350 close(fd139->fd);
2351 fd139->fd = -1;
2352 }
2353
2354 if (fd445->fd != -1) {
2355 *port = 445;
2356 *pfd = fd445->fd;
2357 status = NT_STATUS_OK;
2358 goto done;
2359 }
2360 if (fd139->fd != -1) {
2361 *port = 139;
2362 *pfd = fd139->fd;
2363 status = NT_STATUS_OK;
2364 goto done;
2365 }
2366
2367 status = open_socket_out_defer_recv(r445, &fd445->fd);
2368 done:
2369 TALLOC_FREE(ev);
2370 return status;
2371 }
2372
2373 /****************************************************************************
2374 Open the client sockets.
2375 ****************************************************************************/
2376
2377 NTSTATUS cli_connect(struct cli_state *cli,
2378 const char *host,
2379 struct sockaddr_storage *dest_ss)
2380
2381 {
2382 int name_type = 0x20;
2383 TALLOC_CTX *frame = talloc_stackframe();
2384 unsigned int num_addrs = 0;
2385 unsigned int i = 0;
2386 struct sockaddr_storage *ss_arr = NULL;
2387 char *p = NULL;
2388
2389 /* reasonable default hostname */
2390 if (!host) {
2391 host = STAR_SMBSERVER;
2392 }
2393
2394 fstrcpy(cli->desthost, host);
2395
2396 /* allow hostnames of the form NAME#xx and do a netbios lookup */
2397 if ((p = strchr(cli->desthost, '#'))) {
2398 name_type = strtol(p+1, NULL, 16);
2399 *p = 0;
2400 }
2401
2402 if (!dest_ss || is_zero_addr(dest_ss)) {
2403 NTSTATUS status =resolve_name_list(frame,
2404 cli->desthost,
2405 name_type,
2406 &ss_arr,
2407 &num_addrs);
2408 if (!NT_STATUS_IS_OK(status)) {
2409 TALLOC_FREE(frame);
2410 return NT_STATUS_BAD_NETWORK_NAME;
2411 }
2412 } else {
2413 num_addrs = 1;
2414 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
2415 if (!ss_arr) {
2416 TALLOC_FREE(frame);
2417 return NT_STATUS_NO_MEMORY;
2418 }
2419 *ss_arr = *dest_ss;
2420 }
2421
2422 for (i = 0; i < num_addrs; i++) {
2423 cli->dest_ss = ss_arr[i];
2424 if (getenv("LIBSMB_PROG")) {
2425 cli->fd = sock_exec(getenv("LIBSMB_PROG"));
2426 } else {
2427 uint16_t port = cli->port;
2428 NTSTATUS status;
2429 status = open_smb_socket(&cli->dest_ss, &port,
2430 cli->timeout, &cli->fd);
2431 if (NT_STATUS_IS_OK(status)) {
2432 cli->port = port;
2433 }
2434 }
2435 if (cli->fd == -1) {
2436 char addr[INET6_ADDRSTRLEN];
2437 print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
2438 DEBUG(2,("Error connecting to %s (%s)\n",
2439 dest_ss?addr:host,strerror(errno)));
2440 } else {
2441 /* Exit from loop on first connection. */
2442 break;
2443 }
2444 }
2445
2446 if (cli->fd == -1) {
2447 TALLOC_FREE(frame);
2448 return map_nt_error_from_unix(errno);
2449 }
2450
2451 if (dest_ss) {
2452 *dest_ss = cli->dest_ss;
2453 }
2454
2455 set_socket_options(cli->fd, lp_socket_options());
2456
2457 TALLOC_FREE(frame);
2458 return NT_STATUS_OK;
2459 }
2460
2461 /**
2462 establishes a connection to after the negprot.
2463 @param output_cli A fully initialised cli structure, non-null only on success
2464 @param dest_host The netbios name of the remote host
2465 @param dest_ss (optional) The the destination IP, NULL for name based lookup
2466 @param port (optional) The destination port (0 for default)
2467 */
2468 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2469 const char *my_name,
2470 const char *dest_host,
2471 struct sockaddr_storage *dest_ss, int port,
2472 int signing_state, int flags)
2473 {
2474 NTSTATUS nt_status;
2475 struct nmb_name calling;
2476 struct nmb_name called;
2477 struct cli_state *cli;
2478 struct sockaddr_storage ss;
2479
2480 if (!my_name)
2481 my_name = global_myname();
2482
2483 if (!(cli = cli_initialise_ex(signing_state))) {
2484 return NT_STATUS_NO_MEMORY;
2485 }
2486
2487 make_nmb_name(&calling, my_name, 0x0);
2488 make_nmb_name(&called , dest_host, 0x20);
2489
2490 cli_set_port(cli, port);
2491 cli_set_timeout(cli, 10000); /* 10 seconds. */
2492
2493 if (dest_ss) {
2494 ss = *dest_ss;
2495 } else {
2496 zero_sockaddr(&ss);
2497 }
2498
2499 again:
2500
2501 DEBUG(3,("Connecting to host=%s\n", dest_host));
2502
2503 nt_status = cli_connect(cli, dest_host, &ss);
2504 if (!NT_STATUS_IS_OK(nt_status)) {
2505 char addr[INET6_ADDRSTRLEN];
2506 print_sockaddr(addr, sizeof(addr), &ss);
2507 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2508 nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2509 cli_shutdown(cli);
2510 return nt_status;
2511 }
2512
2513 if (!cli_session_request(cli, &calling, &called)) {
2514 char *p;
2515 DEBUG(1,("session request to %s failed (%s)\n",
2516 called.name, cli_errstr(cli)));
2517 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2518 *p = 0;
2519 goto again;
2520 }
2521 if (strcmp(called.name, STAR_SMBSERVER)) {
2522 make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2523 goto again;
2524 }
2525 return NT_STATUS_BAD_NETWORK_NAME;
2526 }
2527
2528 if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2529 cli->use_spnego = False;
2530 else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2531 cli->use_kerberos = True;
2532
2533 if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2534 cli->use_kerberos) {
2535 cli->fallback_after_kerberos = true;
2536 }
2537 if (flags & CLI_FULL_CONNECTION_USE_CCACHE) {
2538 cli->use_ccache = true;
2539 }
2540
2541 nt_status = cli_negprot(cli);
2542 if (!NT_STATUS_IS_OK(nt_status)) {
2543 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2544 cli_shutdown(cli);
2545 return nt_status;
2546 }
2547
2548 *output_cli = cli;
2549 return NT_STATUS_OK;
2550 }
2551
2552
2553 /**
2554 establishes a connection right up to doing tconX, password specified.
2555 @param output_cli A fully initialised cli structure, non-null only on success
2556 @param dest_host The netbios name of the remote host
2557 @param dest_ip (optional) The the destination IP, NULL for name based lookup
2558 @param port (optional) The destination port (0 for default)
2559 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
2560 @param service_type The 'type' of serivice.
2561 @param user Username, unix string
2562 @param domain User's domain
2563 @param password User's password, unencrypted unix string.
2564 */
2565
2566 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2567 const char *my_name,
2568 const char *dest_host,
2569 struct sockaddr_storage *dest_ss, int port,
2570 const char *service, const char *service_type,
2571 const char *user, const char *domain,
2572 const char *password, int flags,
2573 int signing_state)
2574 {
2575 NTSTATUS nt_status;
2576 struct cli_state *cli = NULL;
2577 int pw_len = password ? strlen(password)+1 : 0;
2578
2579 *output_cli = NULL;
2580
2581 if (password == NULL) {
2582 password = "";
2583 }
2584
2585 nt_status = cli_start_connection(&cli, my_name, dest_host,
2586 dest_ss, port, signing_state,
2587 flags);
2588
2589 if (!NT_STATUS_IS_OK(nt_status)) {
2590 return nt_status;
2591 }
2592
2593 cli->use_oplocks = ((flags & CLI_FULL_CONNECTION_OPLOCKS) != 0);
2594 cli->use_level_II_oplocks =
2595 ((flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) != 0);
2596
2597 nt_status = cli_session_setup(cli, user, password, pw_len, password,
2598 pw_len, domain);
2599 if (!NT_STATUS_IS_OK(nt_status)) {
2600
2601 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2602 DEBUG(1,("failed session setup with %s\n",
2603 nt_errstr(nt_status)));
2604 cli_shutdown(cli);
2605 return nt_status;
2606 }
2607
2608 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2609 if (!NT_STATUS_IS_OK(nt_status)) {
2610 DEBUG(1,("anonymous failed session setup with %s\n",
2611 nt_errstr(nt_status)));
2612 cli_shutdown(cli);
2613 return nt_status;
2614 }
2615 }
2616
2617 if (service) {
2618 nt_status = cli_tcon_andx(cli, service, service_type, password,
2619 pw_len);
2620 if (!NT_STATUS_IS_OK(nt_status)) {
2621 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2622 cli_shutdown(cli);
2623 if (NT_STATUS_IS_OK(nt_status)) {
2624 nt_status = NT_STATUS_UNSUCCESSFUL;
2625 }
2626 return nt_status;
2627 }
2628 }
2629
2630 nt_status = cli_init_creds(cli, user, domain, password);
2631 if (!NT_STATUS_IS_OK(nt_status)) {
2632 cli_shutdown(cli);
2633 return nt_status;
2634 }
2635
2636 *output_cli = cli;
2637 return NT_STATUS_OK;
2638 }
2639
2640 /****************************************************************************
2641 Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2642 ****************************************************************************/
2643
2644 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2645 struct sockaddr_storage *pdest_ss)
2646 {
2647 struct nmb_name calling, called;
2648
2649 make_nmb_name(&calling, srchost, 0x0);
2650
2651 /*
2652 * If the called name is an IP address
2653 * then use *SMBSERVER immediately.
2654 */
2655
2656 if(is_ipaddress(desthost)) {
2657 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2658 } else {
2659 make_nmb_name(&called, desthost, 0x20);
2660 }
2661
2662 if (!cli_session_request(*ppcli, &calling, &called)) {
2663 NTSTATUS status;
2664 struct nmb_name smbservername;
2665
2666 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2667
2668 /*
2669 * If the name wasn't *SMBSERVER then
2670 * try with *SMBSERVER if the first name fails.
2671 */
2672
2673 if (nmb_name_equal(&called, &smbservername)) {
2674
2675 /*
2676 * The name used was *SMBSERVER, don't bother with another name.
2677 */
2678
2679 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2680 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2681 return False;
2682 }
2683
2684 /* Try again... */
2685 cli_shutdown(*ppcli);
2686
2687 *ppcli = cli_initialise();
2688 if (!*ppcli) {
2689 /* Out of memory... */
2690 return False;
2691 }
2692
2693 status = cli_connect(*ppcli, desthost, pdest_ss);
2694 if (!NT_STATUS_IS_OK(status) ||
2695 !cli_session_request(*ppcli, &calling, &smbservername)) {
2696 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2697 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2698 return False;
2699 }
2700 }
2701
2702 return True;
2703 }
2704
2705 /****************************************************************************
2706 Send an old style tcon.
2707 ****************************************************************************/
2708 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2709 const char *service, const char *pass, const char *dev,
2710 uint16 *max_xmit, uint16 *tid)
2711 {
2712 struct tevent_req *req;
2713 uint16_t *ret_vwv;
2714 uint8_t *bytes;
2715 NTSTATUS status;
2716
2717 if (!lp_client_plaintext_auth() && (*pass)) {
2718 DEBUG(1, ("Server requested plaintext password but 'client "
2719 "plaintext auth' is disabled\n"));
2720 return NT_STATUS_ACCESS_DENIED;
2721 }
2722
2723 bytes = talloc_array(talloc_tos(), uint8_t, 0);
2724 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2725 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
2726 service, strlen(service)+1, NULL);
2727 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2728 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
2729 pass, strlen(pass)+1, NULL);
2730 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2731 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
2732 dev, strlen(dev)+1, NULL);
2733
2734 status = cli_smb(talloc_tos(), cli, SMBtcon, 0, 0, NULL,
2735 talloc_get_size(bytes), bytes, &req,
2736 2, NULL, &ret_vwv, NULL, NULL);
2737 if (!NT_STATUS_IS_OK(status)) {
2738 return status;
2739 }
2740
2741 *max_xmit = SVAL(ret_vwv + 0, 0);
2742 *tid = SVAL(ret_vwv + 1, 0);
2743
2744 return NT_STATUS_OK;
2745 }
2746
2747 /* Return a cli_state pointing at the IPC$ share for the given server */
2748
2749 struct cli_state *get_ipc_connect(char *server,
2750 struct sockaddr_storage *server_ss,
2751 const struct user_auth_info *user_info)
2752 {
2753 struct cli_state *cli;
2754 NTSTATUS nt_status;
2755 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2756
2757 if (user_info->use_kerberos) {
2758 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2759 }
2760
2761 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2762 user_info->username ? user_info->username : "",
2763 lp_workgroup(),
2764 user_info->password ? user_info->password : "",
2765 flags,
2766 Undefined);
2767
2768 if (NT_STATUS_IS_OK(nt_status)) {
2769 return cli;
2770 } else if (is_ipaddress(server)) {
2771 /* windows 9* needs a correct NMB name for connections */
2772 fstring remote_name;
2773
2774 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2775 cli = get_ipc_connect(remote_name, server_ss, user_info);
2776 if (cli)
2777 return cli;
2778 }
2779 }
2780 return NULL;
2781 }
2782
2783 /*
2784 * Given the IP address of a master browser on the network, return its
2785 * workgroup and connect to it.
2786 *
2787 * This function is provided to allow additional processing beyond what
2788 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2789 * browsers and obtain each master browsers' list of domains (in case the
2790 * first master browser is recently on the network and has not yet
2791 * synchronized with other master browsers and therefore does not yet have the
2792 * entire network browse list)
2793 */
2794
2795 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2796 struct ip_service *mb_ip,
2797 const struct user_auth_info *user_info,
2798 char **pp_workgroup_out)
2799 {
2800 char addr[INET6_ADDRSTRLEN];
2801 fstring name;
2802 struct cli_state *cli;
2803 struct sockaddr_storage server_ss;
2804
2805 *pp_workgroup_out = NULL;
2806
2807 print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2808 DEBUG(99, ("Looking up name of master browser %s\n",
2809 addr));
2810
2811 /*
2812 * Do a name status query to find out the name of the master browser.
2813 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2814 * master browser will not respond to a wildcard query (or, at least,
2815 * an NT4 server acting as the domain master browser will not).
2816 *
2817 * We might be able to use ONLY the query on MSBROWSE, but that's not
2818 * yet been tested with all Windows versions, so until it is, leave
2819 * the original wildcard query as the first choice and fall back to
2820 * MSBROWSE if the wildcard query fails.
2821 */
2822 if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2823 !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2824
2825 DEBUG(99, ("Could not retrieve name status for %s\n",
2826 addr));
2827 return NULL;
2828 }
2829
2830 if (!find_master_ip(name, &server_ss)) {
2831 DEBUG(99, ("Could not find master ip for %s\n", name));
2832 return NULL;
2833 }
2834
2835 *pp_workgroup_out = talloc_strdup(ctx, name);
2836
2837 DEBUG(4, ("found master browser %s, %s\n", name, addr));
2838
2839 print_sockaddr(addr, sizeof(addr), &server_ss);
2840 cli = get_ipc_connect(addr, &server_ss, user_info);
2841
2842 return cli;
2843 }
2844
2845 /*
2846 * Return the IP address and workgroup of a master browser on the network, and
2847 * connect to it.
2848 */
2849
2850 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2851 const struct user_auth_info *user_info,
2852 char **pp_workgroup_out)
2853 {
2854 struct ip_service *ip_list;
2855 struct cli_state *cli;
2856 int i, count;
2857
2858 *pp_workgroup_out = NULL;
2859
2860 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2861
2862 /* Go looking for workgroups by broadcasting on the local network */
2863
2864 if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2865 &count))) {
2866 DEBUG(99, ("No master browsers responded\n"));
2867 return False;
2868 }
2869
2870 for (i = 0; i < count; i++) {
2871 char addr[INET6_ADDRSTRLEN];
2872 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2873 DEBUG(99, ("Found master browser %s\n", addr));
2874
2875 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2876 user_info, pp_workgroup_out);
2877 if (cli)
2878 return(cli);
2879 }
2880
2881 return NULL;
2882 }
Samba GIT mirror