source3/libsmb/clifsinfo.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    FS info functions
   4    Copyright (C) Stefan (metze) Metzmacher      2003
   5    Copyright (C) Jeremy Allison 2007
   6    Copyright (C) Andrew Bartlett 2011
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libsmb/libsmb.h"
  24 #include "../libcli/auth/spnego.h"
  25 #include "../auth/ntlmssp/ntlmssp.h"
  26 #include "../lib/util/tevent_ntstatus.h"
  27 #include "async_smb.h"
  28 #include "../libcli/smb/smb_seal.h"
  29 #include "trans2.h"
  30 #include "auth_generic.h"
  31 #include "auth/gensec/gensec.h"
  32 #include "../libcli/smb/smbXcli_base.h"
  33 #include "auth/credentials/credentials.h"
  34
  35 /****************************************************************************
  36  Get UNIX extensions version info.
  37 ****************************************************************************/
  38
  39 struct cli_unix_extensions_version_state {
  40         struct cli_state *cli;
  41         uint16_t setup[1];
  42         uint8_t param[2];
  43         uint16_t major, minor;
  44         uint32_t caplow, caphigh;
  45 };
  46
  47 static void cli_unix_extensions_version_done(struct tevent_req *subreq);
  48
  49 struct tevent_req *cli_unix_extensions_version_send(TALLOC_CTX *mem_ctx,
  50                                                     struct tevent_context *ev,
  51                                                     struct cli_state *cli)
  52 {
  53         struct tevent_req *req, *subreq;
  54         struct cli_unix_extensions_version_state *state;
  55
  56         req = tevent_req_create(mem_ctx, &state,
  57                                 struct cli_unix_extensions_version_state);
  58         if (req == NULL) {
  59                 return NULL;
  60         }
  61         state->cli = cli;
  62         SSVAL(state->setup, 0, TRANSACT2_QFSINFO);
  63         SSVAL(state->param, 0, SMB_QUERY_CIFS_UNIX_INFO);
  64
  65         subreq = cli_trans_send(state, ev, cli, SMBtrans2,
  66                                 NULL, 0, 0, 0,
  67                                 state->setup, 1, 0,
  68                                 state->param, 2, 0,
  69                                 NULL, 0, 560);
  70         if (tevent_req_nomem(subreq, req)) {
  71                 return tevent_req_post(req, ev);
  72         }
  73         tevent_req_set_callback(subreq, cli_unix_extensions_version_done, req);
  74         return req;
  75 }
  76
  77 static void cli_unix_extensions_version_done(struct tevent_req *subreq)
  78 {
  79         struct tevent_req *req = tevent_req_callback_data(
  80                 subreq, struct tevent_req);
  81         struct cli_unix_extensions_version_state *state = tevent_req_data(
  82                 req, struct cli_unix_extensions_version_state);
  83         uint8_t *data;
  84         uint32_t num_data;
  85         NTSTATUS status;
  86
  87         status = cli_trans_recv(subreq, state, NULL, NULL, 0, NULL,
  88                                 NULL, 0, NULL, &data, 12, &num_data);
  89         TALLOC_FREE(subreq);
  90         if (!NT_STATUS_IS_OK(status)) {
  91                 tevent_req_nterror(req, status);
  92                 return;
  93         }
  94
  95         state->major = SVAL(data, 0);
  96         state->minor = SVAL(data, 2);
  97         state->caplow = IVAL(data, 4);
  98         state->caphigh = IVAL(data, 8);
  99         TALLOC_FREE(data);
 100         tevent_req_done(req);
 101 }
 102
 103 NTSTATUS cli_unix_extensions_version_recv(struct tevent_req *req,
 104                                           uint16_t *pmajor, uint16_t *pminor,
 105                                           uint32_t *pcaplow,
 106                                           uint32_t *pcaphigh)
 107 {
 108         struct cli_unix_extensions_version_state *state = tevent_req_data(
 109                 req, struct cli_unix_extensions_version_state);
 110         NTSTATUS status;
 111
 112         if (tevent_req_is_nterror(req, &status)) {
 113                 return status;
 114         }
 115         *pmajor = state->major;
 116         *pminor = state->minor;
 117         *pcaplow = state->caplow;
 118         *pcaphigh = state->caphigh;
 119         state->cli->server_posix_capabilities = *pcaplow;
 120         return NT_STATUS_OK;
 121 }
 122
 123 NTSTATUS cli_unix_extensions_version(struct cli_state *cli, uint16_t *pmajor,
 124                                      uint16_t *pminor, uint32_t *pcaplow,
 125                                      uint32_t *pcaphigh)
 126 {
 127         TALLOC_CTX *frame = talloc_stackframe();
 128         struct tevent_context *ev;
 129         struct tevent_req *req;
 130         NTSTATUS status = NT_STATUS_OK;
 131
 132         if (smbXcli_conn_has_async_calls(cli->conn)) {
 133                 /*
 134                  * Can't use sync call while an async call is in flight
 135                  */
 136                 status = NT_STATUS_INVALID_PARAMETER;
 137                 goto fail;
 138         }
 139
 140         ev = samba_tevent_context_init(frame);
 141         if (ev == NULL) {
 142                 status = NT_STATUS_NO_MEMORY;
 143                 goto fail;
 144         }
 145
 146         req = cli_unix_extensions_version_send(frame, ev, cli);
 147         if (req == NULL) {
 148                 status = NT_STATUS_NO_MEMORY;
 149                 goto fail;
 150         }
 151
 152         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 153                 goto fail;
 154         }
 155
 156         status = cli_unix_extensions_version_recv(req, pmajor, pminor, pcaplow,
 157                                                   pcaphigh);
 158  fail:
 159         TALLOC_FREE(frame);
 160         return status;
 161 }
 162
 163 /****************************************************************************
 164  Set UNIX extensions capabilities.
 165 ****************************************************************************/
 166
 167 struct cli_set_unix_extensions_capabilities_state {
 168         struct cli_state *cli;
 169         uint16_t setup[1];
 170         uint8_t param[4];
 171         uint8_t data[12];
 172 };
 173
 174 static void cli_set_unix_extensions_capabilities_done(
 175         struct tevent_req *subreq);
 176
 177 struct tevent_req *cli_set_unix_extensions_capabilities_send(
 178         TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
 179         uint16_t major, uint16_t minor, uint32_t caplow, uint32_t caphigh)
 180 {
 181         struct tevent_req *req, *subreq;
 182         struct cli_set_unix_extensions_capabilities_state *state;
 183
 184         req = tevent_req_create(
 185                 mem_ctx, &state,
 186                 struct cli_set_unix_extensions_capabilities_state);
 187         if (req == NULL) {
 188                 return NULL;
 189         }
 190
 191         state->cli = cli;
 192         SSVAL(state->setup+0, 0, TRANSACT2_SETFSINFO);
 193
 194         SSVAL(state->param, 0, 0);
 195         SSVAL(state->param, 2, SMB_SET_CIFS_UNIX_INFO);
 196
 197         SSVAL(state->data, 0, major);
 198         SSVAL(state->data, 2, minor);
 199         SIVAL(state->data, 4, caplow);
 200         SIVAL(state->data, 8, caphigh);
 201
 202         subreq = cli_trans_send(state, ev, cli, SMBtrans2,
 203                                 NULL, 0, 0, 0,
 204                                 state->setup, 1, 0,
 205                                 state->param, 4, 0,
 206                                 state->data, 12, 560);
 207         if (tevent_req_nomem(subreq, req)) {
 208                 return tevent_req_post(req, ev);
 209         }
 210         tevent_req_set_callback(
 211                 subreq, cli_set_unix_extensions_capabilities_done, req);
 212         return req;
 213 }
 214
 215 static void cli_set_unix_extensions_capabilities_done(
 216         struct tevent_req *subreq)
 217 {
 218         struct tevent_req *req = tevent_req_callback_data(
 219                 subreq, struct tevent_req);
 220         struct cli_set_unix_extensions_capabilities_state *state = tevent_req_data(
 221                 req, struct cli_set_unix_extensions_capabilities_state);
 222
 223         NTSTATUS status = cli_trans_recv(subreq, NULL, NULL, NULL, 0, NULL,
 224                                          NULL, 0, NULL, NULL, 0, NULL);
 225         if (NT_STATUS_IS_OK(status)) {
 226                 state->cli->requested_posix_capabilities = IVAL(state->data, 4);
 227         }
 228         tevent_req_simple_finish_ntstatus(subreq, status);
 229 }
 230
 231 NTSTATUS cli_set_unix_extensions_capabilities_recv(struct tevent_req *req)
 232 {
 233         return tevent_req_simple_recv_ntstatus(req);
 234 }
 235
 236 NTSTATUS cli_set_unix_extensions_capabilities(struct cli_state *cli,
 237                                               uint16_t major, uint16_t minor,
 238                                               uint32_t caplow, uint32_t caphigh)
 239 {
 240         struct tevent_context *ev;
 241         struct tevent_req *req;
 242         NTSTATUS status = NT_STATUS_NO_MEMORY;
 243
 244         if (smbXcli_conn_has_async_calls(cli->conn)) {
 245                 return NT_STATUS_INVALID_PARAMETER;
 246         }
 247         ev = samba_tevent_context_init(talloc_tos());
 248         if (ev == NULL) {
 249                 goto fail;
 250         }
 251         req = cli_set_unix_extensions_capabilities_send(
 252                 ev, ev, cli, major, minor, caplow, caphigh);
 253         if (req == NULL) {
 254                 goto fail;
 255         }
 256         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 257                 goto fail;
 258         }
 259         status = cli_set_unix_extensions_capabilities_recv(req);
 260 fail:
 261         TALLOC_FREE(ev);
 262         return status;
 263 }
 264
 265 struct cli_get_fs_attr_info_state {
 266         uint16_t setup[1];
 267         uint8_t param[2];
 268         uint32_t fs_attr;
 269 };
 270
 271 static void cli_get_fs_attr_info_done(struct tevent_req *subreq);
 272
 273 struct tevent_req *cli_get_fs_attr_info_send(TALLOC_CTX *mem_ctx,
 274                                              struct tevent_context *ev,
 275                                              struct cli_state *cli)
 276 {
 277         struct tevent_req *subreq, *req;
 278         struct cli_get_fs_attr_info_state *state;
 279
 280         req = tevent_req_create(mem_ctx, &state,
 281                                 struct cli_get_fs_attr_info_state);
 282         if (req == NULL) {
 283                 return NULL;
 284         }
 285         SSVAL(state->setup+0, 0, TRANSACT2_QFSINFO);
 286         SSVAL(state->param+0, 0, SMB_QUERY_FS_ATTRIBUTE_INFO);
 287
 288         subreq = cli_trans_send(state, ev, cli, SMBtrans2,
 289                                 NULL, 0, 0, 0,
 290                                 state->setup, 1, 0,
 291                                 state->param, 2, 0,
 292                                 NULL, 0, 560);
 293         if (tevent_req_nomem(subreq, req)) {
 294                 return tevent_req_post(req, ev);
 295         }
 296         tevent_req_set_callback(subreq, cli_get_fs_attr_info_done, req);
 297         return req;
 298 }
 299
 300 static void cli_get_fs_attr_info_done(struct tevent_req *subreq)
 301 {
 302         struct tevent_req *req = tevent_req_callback_data(
 303                 subreq, struct tevent_req);
 304         struct cli_get_fs_attr_info_state *state = tevent_req_data(
 305                 req, struct cli_get_fs_attr_info_state);
 306         uint8_t *data;
 307         uint32_t num_data;
 308         NTSTATUS status;
 309
 310         status = cli_trans_recv(subreq, talloc_tos(), NULL, NULL, 0, NULL,
 311                                 NULL, 0, NULL, &data, 12, &num_data);
 312         TALLOC_FREE(subreq);
 313         if (!NT_STATUS_IS_OK(status)) {
 314                 tevent_req_nterror(req, status);
 315                 return;
 316         }
 317         state->fs_attr = IVAL(data, 0);
 318         TALLOC_FREE(data);
 319         tevent_req_done(req);
 320 }
 321
 322 NTSTATUS cli_get_fs_attr_info_recv(struct tevent_req *req, uint32_t *fs_attr)
 323 {
 324         struct cli_get_fs_attr_info_state *state = tevent_req_data(
 325                 req, struct cli_get_fs_attr_info_state);
 326         NTSTATUS status;
 327
 328         if (tevent_req_is_nterror(req, &status)) {
 329                 return status;
 330         }
 331         *fs_attr = state->fs_attr;
 332         return NT_STATUS_OK;
 333 }
 334
 335 NTSTATUS cli_get_fs_attr_info(struct cli_state *cli, uint32_t *fs_attr)
 336 {
 337         struct tevent_context *ev;
 338         struct tevent_req *req;
 339         NTSTATUS status = NT_STATUS_NO_MEMORY;
 340
 341         if (smbXcli_conn_has_async_calls(cli->conn)) {
 342                 return NT_STATUS_INVALID_PARAMETER;
 343         }
 344         ev = samba_tevent_context_init(talloc_tos());
 345         if (ev == NULL) {
 346                 goto fail;
 347         }
 348         req = cli_get_fs_attr_info_send(ev, ev, cli);
 349         if (req == NULL) {
 350                 goto fail;
 351         }
 352         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 353                 goto fail;
 354         }
 355         status = cli_get_fs_attr_info_recv(req, fs_attr);
 356 fail:
 357         TALLOC_FREE(ev);
 358         return status;
 359 }
 360
 361 NTSTATUS cli_get_fs_volume_info(struct cli_state *cli,
 362                                 TALLOC_CTX *mem_ctx,
 363                                 char **_volume_name,
 364                                 uint32_t *pserial_number,
 365                                 time_t *pdate)
 366 {
 367         NTSTATUS status;
 368         uint16_t recv_flags2;
 369         uint16_t setup[1];
 370         uint8_t param[2];
 371         uint8_t *rdata;
 372         uint32_t rdata_count;
 373         unsigned int nlen;
 374         char *volume_name = NULL;
 375
 376         SSVAL(setup, 0, TRANSACT2_QFSINFO);
 377         SSVAL(param,0,SMB_QUERY_FS_VOLUME_INFO);
 378
 379         status = cli_trans(talloc_tos(), cli, SMBtrans2,
 380                            NULL, 0, 0, 0,
 381                            setup, 1, 0,
 382                            param, 2, 0,
 383                            NULL, 0, 560,
 384                            &recv_flags2,
 385                            NULL, 0, NULL,
 386                            NULL, 0, NULL,
 387                            &rdata, 18, &rdata_count);
 388         if (!NT_STATUS_IS_OK(status)) {
 389                 return status;
 390         }
 391
 392         if (pdate) {
 393                 struct timespec ts;
 394                 ts = interpret_long_date((char *)rdata);
 395                 *pdate = ts.tv_sec;
 396         }
 397         if (pserial_number) {
 398                 *pserial_number = IVAL(rdata,8);
 399         }
 400         nlen = IVAL(rdata,12);
 401         if (nlen > (rdata_count - 18)) {
 402                 TALLOC_FREE(rdata);
 403                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 404         }
 405
 406         clistr_pull_talloc(mem_ctx,
 407                            (const char *)rdata,
 408                            recv_flags2,
 409                            &volume_name,
 410                            rdata + 18,
 411                            nlen, STR_UNICODE);
 412         if (volume_name == NULL) {
 413                 status = map_nt_error_from_unix(errno);
 414                 TALLOC_FREE(rdata);
 415                 return status;
 416         }
 417
 418         /* todo: but not yet needed
 419          *       return the other stuff
 420          */
 421
 422         *_volume_name = volume_name;
 423         TALLOC_FREE(rdata);
 424         return NT_STATUS_OK;
 425 }
 426
 427 NTSTATUS cli_get_fs_full_size_info(struct cli_state *cli,
 428                                    uint64_t *total_allocation_units,
 429                                    uint64_t *caller_allocation_units,
 430                                    uint64_t *actual_allocation_units,
 431                                    uint64_t *sectors_per_allocation_unit,
 432                                    uint64_t *bytes_per_sector)
 433 {
 434         uint16_t setup[1];
 435         uint8_t param[2];
 436         uint8_t *rdata = NULL;
 437         uint32_t rdata_count;
 438         NTSTATUS status;
 439
 440         SSVAL(setup, 0, TRANSACT2_QFSINFO);
 441         SSVAL(param, 0, SMB_FS_FULL_SIZE_INFORMATION);
 442
 443         status = cli_trans(talloc_tos(), cli, SMBtrans2,
 444                            NULL, 0, 0, 0,
 445                            setup, 1, 0, /* setup */
 446                            param, 2, 0,  /* param */
 447                            NULL, 0, 560, /* data */
 448                            NULL,
 449                            NULL, 0, NULL, /* rsetup */
 450                            NULL, 0, NULL, /* rparam */
 451                            &rdata, 32, &rdata_count);  /* rdata */
 452         if (!NT_STATUS_IS_OK(status)) {
 453                 goto fail;
 454         }
 455
 456         if (total_allocation_units) {
 457                 *total_allocation_units = BIG_UINT(rdata, 0);
 458         }
 459         if (caller_allocation_units) {
 460                 *caller_allocation_units = BIG_UINT(rdata,8);
 461         }
 462         if (actual_allocation_units) {
 463                 *actual_allocation_units = BIG_UINT(rdata,16);
 464         }
 465         if (sectors_per_allocation_unit) {
 466                 *sectors_per_allocation_unit = IVAL(rdata,24);
 467         }
 468         if (bytes_per_sector) {
 469                 *bytes_per_sector = IVAL(rdata,28);
 470         }
 471
 472 fail:
 473         TALLOC_FREE(rdata);
 474         return status;
 475 }
 476
 477 NTSTATUS cli_get_posix_fs_info(struct cli_state *cli,
 478                                uint32_t *optimal_transfer_size,
 479                                uint32_t *block_size,
 480                                uint64_t *total_blocks,
 481                                uint64_t *blocks_available,
 482                                uint64_t *user_blocks_available,
 483                                uint64_t *total_file_nodes,
 484                                uint64_t *free_file_nodes,
 485                                uint64_t *fs_identifier)
 486 {
 487         uint16_t setup[1];
 488         uint8_t param[2];
 489         uint8_t *rdata = NULL;
 490         uint32_t rdata_count;
 491         NTSTATUS status;
 492
 493         SSVAL(setup, 0, TRANSACT2_QFSINFO);
 494         SSVAL(param,0,SMB_QUERY_POSIX_FS_INFO);
 495
 496         status = cli_trans(talloc_tos(), cli, SMBtrans2, NULL, 0, 0, 0,
 497                            setup, 1, 0,
 498                            param, 2, 0,
 499                            NULL, 0, 560,
 500                            NULL,
 501                            NULL, 0, NULL, /* rsetup */
 502                            NULL, 0, NULL, /* rparam */
 503                            &rdata, 56, &rdata_count);
 504         if (!NT_STATUS_IS_OK(status)) {
 505                 return status;
 506         }
 507
 508         if (optimal_transfer_size) {
 509                 *optimal_transfer_size = IVAL(rdata, 0);
 510         }
 511         if (block_size) {
 512                 *block_size = IVAL(rdata,4);
 513         }
 514         if (total_blocks) {
 515                 *total_blocks = BIG_UINT(rdata,8);
 516         }
 517         if (blocks_available) {
 518                 *blocks_available = BIG_UINT(rdata,16);
 519         }
 520         if (user_blocks_available) {
 521                 *user_blocks_available = BIG_UINT(rdata,24);
 522         }
 523         if (total_file_nodes) {
 524                 *total_file_nodes = BIG_UINT(rdata,32);
 525         }
 526         if (free_file_nodes) {
 527                 *free_file_nodes = BIG_UINT(rdata,40);
 528         }
 529         if (fs_identifier) {
 530                 *fs_identifier = BIG_UINT(rdata,48);
 531         }
 532         return NT_STATUS_OK;
 533 }
 534
 535
 536 /******************************************************************************
 537  Send/receive the request encryption blob.
 538 ******************************************************************************/
 539
 540 static NTSTATUS enc_blob_send_receive(struct cli_state *cli, DATA_BLOB *in, DATA_BLOB *out, DATA_BLOB *param_out)
 541 {
 542         uint16_t setup[1];
 543         uint8_t param[4];
 544         uint8_t *rparam=NULL, *rdata=NULL;
 545         uint32_t num_rparam, num_rdata;
 546         NTSTATUS status;
 547
 548         SSVAL(setup+0, 0, TRANSACT2_SETFSINFO);
 549         SSVAL(param,0,0);
 550         SSVAL(param,2,SMB_REQUEST_TRANSPORT_ENCRYPTION);
 551
 552         status = cli_trans(talloc_tos(), cli, SMBtrans2, NULL, 0, 0, 0,
 553                            setup, 1, 0,
 554                            param, 4, 2,
 555                            (uint8_t *)in->data, in->length, CLI_BUFFER_SIZE,
 556                            NULL,          /* recv_flags */
 557                            NULL, 0, NULL, /* rsetup */
 558                            &rparam, 0, &num_rparam,
 559                            &rdata, 0, &num_rdata);
 560
 561         if (!NT_STATUS_IS_OK(status) &&
 562             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 563                 return status;
 564         }
 565
 566         *out = data_blob(rdata, num_rdata);
 567         *param_out = data_blob(rparam, num_rparam);
 568
 569         TALLOC_FREE(rparam);
 570         TALLOC_FREE(rdata);
 571         return status;
 572 }
 573
 574 /******************************************************************************
 575  Start a raw ntlmssp encryption.
 576 ******************************************************************************/
 577
 578 NTSTATUS cli_raw_ntlm_smb_encryption_start(struct cli_state *cli,
 579                                 const char *user,
 580                                 const char *pass,
 581                                 const char *domain)
 582 {
 583         DATA_BLOB blob_in = data_blob_null;
 584         DATA_BLOB blob_out = data_blob_null;
 585         DATA_BLOB param_out = data_blob_null;
 586         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 587         struct auth_generic_state *auth_generic_state;
 588         struct smb_trans_enc_state *es = talloc_zero(NULL, struct smb_trans_enc_state);
 589         if (!es) {
 590                 return NT_STATUS_NO_MEMORY;
 591         }
 592         status = auth_generic_client_prepare(es,
 593                                              &auth_generic_state);
 594         if (!NT_STATUS_IS_OK(status)) {
 595                 goto fail;
 596         }
 597
 598         gensec_want_feature(auth_generic_state->gensec_security, GENSEC_FEATURE_SESSION_KEY);
 599         gensec_want_feature(auth_generic_state->gensec_security, GENSEC_FEATURE_SEAL);
 600
 601         if (!NT_STATUS_IS_OK(status = auth_generic_set_username(auth_generic_state, user))) {
 602                 goto fail;
 603         }
 604         if (!NT_STATUS_IS_OK(status = auth_generic_set_domain(auth_generic_state, domain))) {
 605                 goto fail;
 606         }
 607         if (!NT_STATUS_IS_OK(status = auth_generic_set_password(auth_generic_state, pass))) {
 608                 goto fail;
 609         }
 610
 611         if (!NT_STATUS_IS_OK(status = auth_generic_client_start(auth_generic_state, GENSEC_OID_NTLMSSP))) {
 612                 goto fail;
 613         }
 614
 615         do {
 616                 status = gensec_update(auth_generic_state->gensec_security, auth_generic_state,
 617                                        blob_in, &blob_out);
 618                 data_blob_free(&blob_in);
 619                 data_blob_free(&param_out);
 620                 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(status)) {
 621                         NTSTATUS trans_status = enc_blob_send_receive(cli,
 622                                                                         &blob_out,
 623                                                                         &blob_in,
 624                                                                         &param_out);
 625                         if (!NT_STATUS_EQUAL(trans_status,
 626                                         NT_STATUS_MORE_PROCESSING_REQUIRED) &&
 627                                         !NT_STATUS_IS_OK(trans_status)) {
 628                                 status = trans_status;
 629                         } else {
 630                                 if (param_out.length == 2) {
 631                                         es->enc_ctx_num = SVAL(param_out.data, 0);
 632                                 }
 633                         }
 634                 }
 635                 data_blob_free(&blob_out);
 636         } while (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED));
 637
 638         data_blob_free(&blob_in);
 639
 640         if (NT_STATUS_IS_OK(status)) {
 641                 es->enc_on = true;
 642                 /* Replace the old state, if any. */
 643                 /* We only need the gensec_security part from here.
 644                  * es is a malloc()ed pointer, so we cannot make
 645                  * gensec_security a talloc child */
 646                 es->gensec_security = talloc_move(NULL,
 647                                                   &auth_generic_state->gensec_security);
 648                 smb1cli_conn_set_encryption(cli->conn, es);
 649                 es = NULL;
 650         }
 651
 652   fail:
 653         TALLOC_FREE(es);
 654         return status;
 655 }
 656
 657 /******************************************************************************
 658  Start a SPNEGO gssapi encryption context.
 659 ******************************************************************************/
 660
 661 NTSTATUS cli_gss_smb_encryption_start(struct cli_state *cli)
 662 {
 663         DATA_BLOB blob_recv = data_blob_null;
 664         DATA_BLOB blob_send = data_blob_null;
 665         DATA_BLOB param_out = data_blob_null;
 666         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 667         struct auth_generic_state *auth_generic_state;
 668         struct smb_trans_enc_state *es = talloc_zero(NULL, struct smb_trans_enc_state);
 669
 670         if (!es) {
 671                 return NT_STATUS_NO_MEMORY;
 672         }
 673
 674         status = auth_generic_client_prepare(es,
 675                                              &auth_generic_state);
 676         if (!NT_STATUS_IS_OK(status)) {
 677                 goto fail;
 678         }
 679
 680         gensec_want_feature(auth_generic_state->gensec_security, GENSEC_FEATURE_SESSION_KEY);
 681         gensec_want_feature(auth_generic_state->gensec_security, GENSEC_FEATURE_SEAL);
 682
 683         cli_credentials_set_kerberos_state(auth_generic_state->credentials,
 684                                            CRED_MUST_USE_KERBEROS);
 685
 686         status = gensec_set_target_service(auth_generic_state->gensec_security, "cifs");
 687         if (!NT_STATUS_IS_OK(status)) {
 688                 goto fail;
 689         }
 690
 691         status = gensec_set_target_hostname(auth_generic_state->gensec_security,
 692                                             smbXcli_conn_remote_name(cli->conn));
 693         if (!NT_STATUS_IS_OK(status)) {
 694                 goto fail;
 695         }
 696
 697         if (!NT_STATUS_IS_OK(status = auth_generic_client_start(auth_generic_state, GENSEC_OID_SPNEGO))) {
 698                 goto fail;
 699         }
 700
 701         status = gensec_update(auth_generic_state->gensec_security, talloc_tos(),
 702                                blob_recv, &blob_send);
 703
 704         do {
 705                 data_blob_free(&blob_recv);
 706                 status = enc_blob_send_receive(cli, &blob_send, &blob_recv, &param_out);
 707                 if (param_out.length == 2) {
 708                         es->enc_ctx_num = SVAL(param_out.data, 0);
 709                 }
 710                 data_blob_free(&blob_send);
 711                 status = gensec_update(auth_generic_state->gensec_security, talloc_tos(),
 712                                        blob_recv, &blob_send);
 713         } while (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED));
 714         data_blob_free(&blob_recv);
 715
 716         if (NT_STATUS_IS_OK(status)) {
 717                 if (!gensec_have_feature(auth_generic_state->gensec_security,
 718                                          GENSEC_FEATURE_SIGN) ||
 719                     !gensec_have_feature(auth_generic_state->gensec_security,
 720                                          GENSEC_FEATURE_SEAL)) {
 721                         status = NT_STATUS_ACCESS_DENIED;
 722                 }
 723         }
 724
 725         if (NT_STATUS_IS_OK(status)) {
 726                 es->enc_on = true;
 727                 /* Replace the old state, if any. */
 728                 /* We only need the gensec_security part from here.
 729                  * es is a malloc()ed pointer, so we cannot make
 730                  * gensec_security a talloc child */
 731                 es->gensec_security = talloc_move(es,
 732                                                   &auth_generic_state->gensec_security);
 733                 smb1cli_conn_set_encryption(cli->conn, es);
 734                 es = NULL;
 735         }
 736 fail:
 737         TALLOC_FREE(es);
 738         return status;
 739 }
 740
 741 /********************************************************************
 742  Ensure a connection is encrypted.
 743 ********************************************************************/
 744
 745 NTSTATUS cli_force_encryption(struct cli_state *c,
 746                         const char *username,
 747                         const char *password,
 748                         const char *domain)
 749 {
 750         uint16_t major, minor;
 751         uint32_t caplow, caphigh;
 752         NTSTATUS status;
 753
 754         if (!SERVER_HAS_UNIX_CIFS(c)) {
 755                 return NT_STATUS_NOT_SUPPORTED;
 756         }
 757
 758         status = cli_unix_extensions_version(c, &major, &minor, &caplow,
 759                                              &caphigh);
 760         if (!NT_STATUS_IS_OK(status)) {
 761                 DEBUG(10, ("cli_force_encryption: cli_unix_extensions_version "
 762                            "returned %s\n", nt_errstr(status)));
 763                 return NT_STATUS_UNKNOWN_REVISION;
 764         }
 765
 766         if (!(caplow & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)) {
 767                 return NT_STATUS_UNSUPPORTED_COMPRESSION;
 768         }
 769
 770         if (c->use_kerberos) {
 771                 return cli_gss_smb_encryption_start(c);
 772         }
 773         return cli_raw_ntlm_smb_encryption_start(c,
 774                                         username,
 775                                         password,
 776                                         domain);
 777 }