?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:utils change data_blob_dup_talloc() to take a DATA_BLOB by value
[Samba/bb.git] / source3 / libsmb / cliconnect.c
blobbba7b0323abebbc38f70b510d9f59eb53b79c2b9
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6 Copyright (C) Volker Lendecke 2011
7 Copyright (C) Jeremy Allison 2011
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "libsmb/libsmb.h"
25 #include "popt_common.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../libcli/auth/spnego.h"
28 #include "smb_krb5.h"
29 #include "../libcli/auth/ntlmssp.h"
30 #include "libads/kerberos_proto.h"
31 #include "krb5_env.h"
32 #include "../lib/util/tevent_ntstatus.h"
33 #include "async_smb.h"
34 #include "libsmb/nmblib.h"
35 #include "read_smb.h"
36 #include "librpc/ndr/libndr.h"
37
38 static const struct {
39 int prot;
40 const char name[24];
41 } prots[10] = {
42 {PROTOCOL_CORE, "PC NETWORK PROGRAM 1.0"},
43 {PROTOCOL_COREPLUS, "MICROSOFT NETWORKS 1.03"},
44 {PROTOCOL_LANMAN1, "MICROSOFT NETWORKS 3.0"},
45 {PROTOCOL_LANMAN1, "LANMAN1.0"},
46 {PROTOCOL_LANMAN2, "LM1.2X002"},
47 {PROTOCOL_LANMAN2, "DOS LANMAN2.1"},
48 {PROTOCOL_LANMAN2, "LANMAN2.1"},
49 {PROTOCOL_LANMAN2, "Samba"},
50 {PROTOCOL_NT1, "NT LANMAN 1.0"},
51 {PROTOCOL_NT1, "NT LM 0.12"},
52 };
53
54 #define STAR_SMBSERVER "*SMBSERVER"
55
56 /********************************************************
57 Utility function to ensure we always return at least
58 a valid char * pointer to an empty string for the
59 cli->server_os, cli->server_type and cli->server_domain
60 strings.
61 *******************************************************/
62
63 static NTSTATUS smb_bytes_talloc_string(TALLOC_CTX *mem_ctx,
64 char *inbuf,
65 char **dest,
66 uint8_t *src,
67 size_t srclen,
68 ssize_t *destlen)
69 {
70 *destlen = clistr_pull_talloc(mem_ctx,
71 inbuf,
72 SVAL(inbuf, smb_flg2),
73 dest,
74 (char *)src,
75 srclen,
76 STR_TERMINATE);
77 if (*destlen == -1) {
78 return NT_STATUS_NO_MEMORY;
79 }
80
81 if (*dest == NULL) {
82 *dest = talloc_strdup(mem_ctx, "");
83 if (*dest == NULL) {
84 return NT_STATUS_NO_MEMORY;
85 }
86 }
87 return NT_STATUS_OK;
88 }
89
90 /**
91 * Set the user session key for a connection
92 * @param cli The cli structure to add it too
93 * @param session_key The session key used. (A copy of this is taken for the cli struct)
94 *
95 */
96
97 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
98 {
99 cli->user_session_key = data_blob(session_key.data, session_key.length);
100 }
101
102 /****************************************************************************
103 Do an old lanman2 style session setup.
104 ****************************************************************************/
105
106 struct cli_session_setup_lanman2_state {
107 struct cli_state *cli;
108 uint16_t vwv[10];
109 const char *user;
110 };
111
112 static void cli_session_setup_lanman2_done(struct tevent_req *subreq);
113
114 static struct tevent_req *cli_session_setup_lanman2_send(
115 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
116 struct cli_state *cli, const char *user,
117 const char *pass, size_t passlen,
118 const char *workgroup)
119 {
120 struct tevent_req *req, *subreq;
121 struct cli_session_setup_lanman2_state *state;
122 DATA_BLOB lm_response = data_blob_null;
123 uint16_t *vwv;
124 uint8_t *bytes;
125 char *tmp;
126 uint16_t sec_mode = cli_state_security_mode(cli);
127
128 req = tevent_req_create(mem_ctx, &state,
129 struct cli_session_setup_lanman2_state);
130 if (req == NULL) {
131 return NULL;
132 }
133 state->cli = cli;
134 state->user = user;
135 vwv = state->vwv;
136
137 /*
138 * if in share level security then don't send a password now
139 */
140 if (!(sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
141 passlen = 0;
142 }
143
144 if (passlen > 0
145 && (sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
146 && passlen != 24) {
147 /*
148 * Encrypted mode needed, and non encrypted password
149 * supplied.
150 */
151 lm_response = data_blob(NULL, 24);
152 if (tevent_req_nomem(lm_response.data, req)) {
153 return tevent_req_post(req, ev);
154 }
155
156 if (!SMBencrypt(pass, cli_state_server_challenge(cli),
157 (uint8_t *)lm_response.data)) {
158 DEBUG(1, ("Password is > 14 chars in length, and is "
159 "therefore incompatible with Lanman "
160 "authentication\n"));
161 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
162 return tevent_req_post(req, ev);
163 }
164 } else if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
165 && passlen == 24) {
166 /*
167 * Encrypted mode needed, and encrypted password
168 * supplied.
169 */
170 lm_response = data_blob(pass, passlen);
171 if (tevent_req_nomem(lm_response.data, req)) {
172 return tevent_req_post(req, ev);
173 }
174 } else if (passlen > 0) {
175 uint8_t *buf;
176 size_t converted_size;
177 /*
178 * Plaintext mode needed, assume plaintext supplied.
179 */
180 buf = talloc_array(talloc_tos(), uint8_t, 0);
181 buf = smb_bytes_push_str(buf, cli_ucs2(cli), pass, passlen+1,
182 &converted_size);
183 if (tevent_req_nomem(buf, req)) {
184 return tevent_req_post(req, ev);
185 }
186 lm_response = data_blob(pass, passlen);
187 TALLOC_FREE(buf);
188 if (tevent_req_nomem(lm_response.data, req)) {
189 return tevent_req_post(req, ev);
190 }
191 }
192
193 SCVAL(vwv+0, 0, 0xff);
194 SCVAL(vwv+0, 1, 0);
195 SSVAL(vwv+1, 0, 0);
196 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
197 SSVAL(vwv+3, 0, 2);
198 SSVAL(vwv+4, 0, 1);
199 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
200 SSVAL(vwv+7, 0, lm_response.length);
201
202 bytes = talloc_array(state, uint8_t, lm_response.length);
203 if (tevent_req_nomem(bytes, req)) {
204 return tevent_req_post(req, ev);
205 }
206 if (lm_response.length != 0) {
207 memcpy(bytes, lm_response.data, lm_response.length);
208 }
209 data_blob_free(&lm_response);
210
211 tmp = talloc_strdup_upper(talloc_tos(), user);
212 if (tevent_req_nomem(tmp, req)) {
213 return tevent_req_post(req, ev);
214 }
215 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
216 NULL);
217 TALLOC_FREE(tmp);
218
219 tmp = talloc_strdup_upper(talloc_tos(), workgroup);
220 if (tevent_req_nomem(tmp, req)) {
221 return tevent_req_post(req, ev);
222 }
223 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
224 NULL);
225 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
226 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
227
228 if (tevent_req_nomem(bytes, req)) {
229 return tevent_req_post(req, ev);
230 }
231
232 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 10, vwv,
233 talloc_get_size(bytes), bytes);
234 if (tevent_req_nomem(subreq, req)) {
235 return tevent_req_post(req, ev);
236 }
237 tevent_req_set_callback(subreq, cli_session_setup_lanman2_done, req);
238 return req;
239 }
240
241 static void cli_session_setup_lanman2_done(struct tevent_req *subreq)
242 {
243 struct tevent_req *req = tevent_req_callback_data(
244 subreq, struct tevent_req);
245 struct cli_session_setup_lanman2_state *state = tevent_req_data(
246 req, struct cli_session_setup_lanman2_state);
247 struct cli_state *cli = state->cli;
248 uint32_t num_bytes;
249 uint8_t *in;
250 char *inbuf;
251 uint8_t *bytes;
252 uint8_t *p;
253 NTSTATUS status;
254 ssize_t ret;
255 uint8_t wct;
256 uint16_t *vwv;
257
258 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
259 &num_bytes, &bytes);
260 TALLOC_FREE(subreq);
261 if (!NT_STATUS_IS_OK(status)) {
262 tevent_req_nterror(req, status);
263 return;
264 }
265
266 inbuf = (char *)in;
267 p = bytes;
268
269 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
270 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
271
272 status = smb_bytes_talloc_string(cli,
273 inbuf,
274 &cli->server_os,
275 p,
276 bytes+num_bytes-p,
277 &ret);
278
279 if (!NT_STATUS_IS_OK(status)) {
280 tevent_req_nterror(req, status);
281 return;
282 }
283 p += ret;
284
285 status = smb_bytes_talloc_string(cli,
286 inbuf,
287 &cli->server_type,
288 p,
289 bytes+num_bytes-p,
290 &ret);
291
292 if (!NT_STATUS_IS_OK(status)) {
293 tevent_req_nterror(req, status);
294 return;
295 }
296 p += ret;
297
298 status = smb_bytes_talloc_string(cli,
299 inbuf,
300 &cli->server_domain,
301 p,
302 bytes+num_bytes-p,
303 &ret);
304
305 if (!NT_STATUS_IS_OK(status)) {
306 tevent_req_nterror(req, status);
307 return;
308 }
309 p += ret;
310
311 status = cli_set_username(cli, state->user);
312 if (tevent_req_nterror(req, status)) {
313 return;
314 }
315 tevent_req_done(req);
316 }
317
318 static NTSTATUS cli_session_setup_lanman2_recv(struct tevent_req *req)
319 {
320 return tevent_req_simple_recv_ntstatus(req);
321 }
322
323 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli, const char *user,
324 const char *pass, size_t passlen,
325 const char *workgroup)
326 {
327 TALLOC_CTX *frame = talloc_stackframe();
328 struct event_context *ev;
329 struct tevent_req *req;
330 NTSTATUS status = NT_STATUS_NO_MEMORY;
331
332 if (cli_has_async_calls(cli)) {
333 /*
334 * Can't use sync call while an async call is in flight
335 */
336 status = NT_STATUS_INVALID_PARAMETER;
337 goto fail;
338 }
339 ev = event_context_init(frame);
340 if (ev == NULL) {
341 goto fail;
342 }
343 req = cli_session_setup_lanman2_send(frame, ev, cli, user, pass, passlen,
344 workgroup);
345 if (req == NULL) {
346 goto fail;
347 }
348 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
349 goto fail;
350 }
351 status = cli_session_setup_lanman2_recv(req);
352 fail:
353 TALLOC_FREE(frame);
354 return status;
355 }
356
357 /****************************************************************************
358 Work out suitable capabilities to offer the server.
359 ****************************************************************************/
360
361 static uint32_t cli_session_setup_capabilities(struct cli_state *cli,
362 uint32_t sesssetup_capabilities)
363 {
364 uint32_t client_capabilities = cli_state_capabilities(cli);
365
366 /*
367 * We only send capabilities based on the mask for:
368 * - client only flags
369 * - flags used in both directions
370 *
371 * We do not echo the server only flags.
372 */
373 client_capabilities &= (SMB_CAP_BOTH_MASK | SMB_CAP_CLIENT_MASK);
374
375 /*
376 * Session Setup specific flags CAP_DYNAMIC_REAUTH
377 * and CAP_EXTENDED_SECURITY are passed by the caller.
378 * We need that in order to do guest logins even if
379 * CAP_EXTENDED_SECURITY is negotiated.
380 */
381 client_capabilities &= ~(CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
382 sesssetup_capabilities &= (CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
383 client_capabilities |= sesssetup_capabilities;
384
385 return client_capabilities;
386 }
387
388 /****************************************************************************
389 Do a NT1 guest session setup.
390 ****************************************************************************/
391
392 struct cli_session_setup_guest_state {
393 struct cli_state *cli;
394 uint16_t vwv[13];
395 struct iovec bytes;
396 };
397
398 static void cli_session_setup_guest_done(struct tevent_req *subreq);
399
400 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
401 struct event_context *ev,
402 struct cli_state *cli,
403 struct tevent_req **psmbreq)
404 {
405 struct tevent_req *req, *subreq;
406 struct cli_session_setup_guest_state *state;
407 uint16_t *vwv;
408 uint8_t *bytes;
409
410 req = tevent_req_create(mem_ctx, &state,
411 struct cli_session_setup_guest_state);
412 if (req == NULL) {
413 return NULL;
414 }
415 state->cli = cli;
416 vwv = state->vwv;
417
418 SCVAL(vwv+0, 0, 0xFF);
419 SCVAL(vwv+0, 1, 0);
420 SSVAL(vwv+1, 0, 0);
421 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
422 SSVAL(vwv+3, 0, 2);
423 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
424 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
425 SSVAL(vwv+7, 0, 0);
426 SSVAL(vwv+8, 0, 0);
427 SSVAL(vwv+9, 0, 0);
428 SSVAL(vwv+10, 0, 0);
429 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
430
431 bytes = talloc_array(state, uint8_t, 0);
432
433 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* username */
434 NULL);
435 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
436 NULL);
437 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
438 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
439
440 if (bytes == NULL) {
441 TALLOC_FREE(req);
442 return NULL;
443 }
444
445 state->bytes.iov_base = (void *)bytes;
446 state->bytes.iov_len = talloc_get_size(bytes);
447
448 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
449 1, &state->bytes);
450 if (subreq == NULL) {
451 TALLOC_FREE(req);
452 return NULL;
453 }
454 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
455 *psmbreq = subreq;
456 return req;
457 }
458
459 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
460 struct event_context *ev,
461 struct cli_state *cli)
462 {
463 struct tevent_req *req, *subreq;
464 NTSTATUS status;
465
466 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
467 if (req == NULL) {
468 return NULL;
469 }
470
471 status = cli_smb_req_send(subreq);
472 if (NT_STATUS_IS_OK(status)) {
473 tevent_req_nterror(req, status);
474 return tevent_req_post(req, ev);
475 }
476 return req;
477 }
478
479 static void cli_session_setup_guest_done(struct tevent_req *subreq)
480 {
481 struct tevent_req *req = tevent_req_callback_data(
482 subreq, struct tevent_req);
483 struct cli_session_setup_guest_state *state = tevent_req_data(
484 req, struct cli_session_setup_guest_state);
485 struct cli_state *cli = state->cli;
486 uint32_t num_bytes;
487 uint8_t *in;
488 char *inbuf;
489 uint8_t *bytes;
490 uint8_t *p;
491 NTSTATUS status;
492 ssize_t ret;
493 uint8_t wct;
494 uint16_t *vwv;
495
496 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
497 &num_bytes, &bytes);
498 TALLOC_FREE(subreq);
499 if (!NT_STATUS_IS_OK(status)) {
500 tevent_req_nterror(req, status);
501 return;
502 }
503
504 inbuf = (char *)in;
505 p = bytes;
506
507 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
508 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
509
510 status = smb_bytes_talloc_string(cli,
511 inbuf,
512 &cli->server_os,
513 p,
514 bytes+num_bytes-p,
515 &ret);
516
517 if (!NT_STATUS_IS_OK(status)) {
518 tevent_req_nterror(req, status);
519 return;
520 }
521 p += ret;
522
523 status = smb_bytes_talloc_string(cli,
524 inbuf,
525 &cli->server_type,
526 p,
527 bytes+num_bytes-p,
528 &ret);
529
530 if (!NT_STATUS_IS_OK(status)) {
531 tevent_req_nterror(req, status);
532 return;
533 }
534 p += ret;
535
536 status = smb_bytes_talloc_string(cli,
537 inbuf,
538 &cli->server_domain,
539 p,
540 bytes+num_bytes-p,
541 &ret);
542
543 if (!NT_STATUS_IS_OK(status)) {
544 tevent_req_nterror(req, status);
545 return;
546 }
547 p += ret;
548
549 status = cli_set_username(cli, "");
550 if (!NT_STATUS_IS_OK(status)) {
551 tevent_req_nterror(req, status);
552 return;
553 }
554 tevent_req_done(req);
555 }
556
557 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
558 {
559 return tevent_req_simple_recv_ntstatus(req);
560 }
561
562 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
563 {
564 TALLOC_CTX *frame = talloc_stackframe();
565 struct event_context *ev;
566 struct tevent_req *req;
567 NTSTATUS status = NT_STATUS_OK;
568
569 if (cli_has_async_calls(cli)) {
570 /*
571 * Can't use sync call while an async call is in flight
572 */
573 status = NT_STATUS_INVALID_PARAMETER;
574 goto fail;
575 }
576
577 ev = event_context_init(frame);
578 if (ev == NULL) {
579 status = NT_STATUS_NO_MEMORY;
580 goto fail;
581 }
582
583 req = cli_session_setup_guest_send(frame, ev, cli);
584 if (req == NULL) {
585 status = NT_STATUS_NO_MEMORY;
586 goto fail;
587 }
588
589 if (!tevent_req_poll(req, ev)) {
590 status = map_nt_error_from_unix(errno);
591 goto fail;
592 }
593
594 status = cli_session_setup_guest_recv(req);
595 fail:
596 TALLOC_FREE(frame);
597 return status;
598 }
599
600 /****************************************************************************
601 Do a NT1 plaintext session setup.
602 ****************************************************************************/
603
604 struct cli_session_setup_plain_state {
605 struct cli_state *cli;
606 uint16_t vwv[13];
607 const char *user;
608 };
609
610 static void cli_session_setup_plain_done(struct tevent_req *subreq);
611
612 static struct tevent_req *cli_session_setup_plain_send(
613 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
614 struct cli_state *cli,
615 const char *user, const char *pass, const char *workgroup)
616 {
617 struct tevent_req *req, *subreq;
618 struct cli_session_setup_plain_state *state;
619 uint16_t *vwv;
620 uint8_t *bytes;
621 size_t passlen;
622 char *version;
623
624 req = tevent_req_create(mem_ctx, &state,
625 struct cli_session_setup_plain_state);
626 if (req == NULL) {
627 return NULL;
628 }
629 state->cli = cli;
630 state->user = user;
631 vwv = state->vwv;
632
633 SCVAL(vwv+0, 0, 0xff);
634 SCVAL(vwv+0, 1, 0);
635 SSVAL(vwv+1, 0, 0);
636 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
637 SSVAL(vwv+3, 0, 2);
638 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
639 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
640 SSVAL(vwv+7, 0, 0);
641 SSVAL(vwv+8, 0, 0);
642 SSVAL(vwv+9, 0, 0);
643 SSVAL(vwv+10, 0, 0);
644 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
645
646 bytes = talloc_array(state, uint8_t, 0);
647 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), pass, strlen(pass)+1,
648 &passlen);
649 if (tevent_req_nomem(bytes, req)) {
650 return tevent_req_post(req, ev);
651 }
652 SSVAL(vwv + (cli_ucs2(cli) ? 8 : 7), 0, passlen);
653
654 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
655 user, strlen(user)+1, NULL);
656 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
657 workgroup, strlen(workgroup)+1, NULL);
658 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
659 "Unix", 5, NULL);
660
661 version = talloc_asprintf(talloc_tos(), "Samba %s",
662 samba_version_string());
663 if (tevent_req_nomem(version, req)){
664 return tevent_req_post(req, ev);
665 }
666 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
667 version, strlen(version)+1, NULL);
668 TALLOC_FREE(version);
669
670 if (tevent_req_nomem(bytes, req)) {
671 return tevent_req_post(req, ev);
672 }
673
674 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
675 talloc_get_size(bytes), bytes);
676 if (tevent_req_nomem(subreq, req)) {
677 return tevent_req_post(req, ev);
678 }
679 tevent_req_set_callback(subreq, cli_session_setup_plain_done, req);
680 return req;
681 }
682
683 static void cli_session_setup_plain_done(struct tevent_req *subreq)
684 {
685 struct tevent_req *req = tevent_req_callback_data(
686 subreq, struct tevent_req);
687 struct cli_session_setup_plain_state *state = tevent_req_data(
688 req, struct cli_session_setup_plain_state);
689 struct cli_state *cli = state->cli;
690 uint32_t num_bytes;
691 uint8_t *in;
692 char *inbuf;
693 uint8_t *bytes;
694 uint8_t *p;
695 NTSTATUS status;
696 ssize_t ret;
697 uint8_t wct;
698 uint16_t *vwv;
699
700 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
701 &num_bytes, &bytes);
702 TALLOC_FREE(subreq);
703 if (tevent_req_nterror(req, status)) {
704 return;
705 }
706
707 inbuf = (char *)in;
708 p = bytes;
709
710 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
711 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
712
713 status = smb_bytes_talloc_string(cli,
714 inbuf,
715 &cli->server_os,
716 p,
717 bytes+num_bytes-p,
718 &ret);
719
720 if (!NT_STATUS_IS_OK(status)) {
721 tevent_req_nterror(req, status);
722 return;
723 }
724 p += ret;
725
726 status = smb_bytes_talloc_string(cli,
727 inbuf,
728 &cli->server_type,
729 p,
730 bytes+num_bytes-p,
731 &ret);
732
733 if (!NT_STATUS_IS_OK(status)) {
734 tevent_req_nterror(req, status);
735 return;
736 }
737 p += ret;
738
739 status = smb_bytes_talloc_string(cli,
740 inbuf,
741 &cli->server_domain,
742 p,
743 bytes+num_bytes-p,
744 &ret);
745
746 if (!NT_STATUS_IS_OK(status)) {
747 tevent_req_nterror(req, status);
748 return;
749 }
750 p += ret;
751
752 status = cli_set_username(cli, state->user);
753 if (tevent_req_nterror(req, status)) {
754 return;
755 }
756
757 tevent_req_done(req);
758 }
759
760 static NTSTATUS cli_session_setup_plain_recv(struct tevent_req *req)
761 {
762 return tevent_req_simple_recv_ntstatus(req);
763 }
764
765 static NTSTATUS cli_session_setup_plain(struct cli_state *cli,
766 const char *user, const char *pass,
767 const char *workgroup)
768 {
769 TALLOC_CTX *frame = talloc_stackframe();
770 struct event_context *ev;
771 struct tevent_req *req;
772 NTSTATUS status = NT_STATUS_NO_MEMORY;
773
774 if (cli_has_async_calls(cli)) {
775 /*
776 * Can't use sync call while an async call is in flight
777 */
778 status = NT_STATUS_INVALID_PARAMETER;
779 goto fail;
780 }
781 ev = event_context_init(frame);
782 if (ev == NULL) {
783 goto fail;
784 }
785 req = cli_session_setup_plain_send(frame, ev, cli, user, pass,
786 workgroup);
787 if (req == NULL) {
788 goto fail;
789 }
790 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
791 goto fail;
792 }
793 status = cli_session_setup_plain_recv(req);
794 fail:
795 TALLOC_FREE(frame);
796 return status;
797 }
798
799 /****************************************************************************
800 do a NT1 NTLM/LM encrypted session setup - for when extended security
801 is not negotiated.
802 @param cli client state to create do session setup on
803 @param user username
804 @param pass *either* cleartext password (passlen !=24) or LM response.
805 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
806 @param workgroup The user's domain.
807 ****************************************************************************/
808
809 struct cli_session_setup_nt1_state {
810 struct cli_state *cli;
811 uint16_t vwv[13];
812 DATA_BLOB response;
813 DATA_BLOB session_key;
814 const char *user;
815 };
816
817 static void cli_session_setup_nt1_done(struct tevent_req *subreq);
818
819 static struct tevent_req *cli_session_setup_nt1_send(
820 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
821 struct cli_state *cli, const char *user,
822 const char *pass, size_t passlen,
823 const char *ntpass, size_t ntpasslen,
824 const char *workgroup)
825 {
826 struct tevent_req *req, *subreq;
827 struct cli_session_setup_nt1_state *state;
828 DATA_BLOB lm_response = data_blob_null;
829 DATA_BLOB nt_response = data_blob_null;
830 DATA_BLOB session_key = data_blob_null;
831 uint16_t *vwv;
832 uint8_t *bytes;
833 char *workgroup_upper;
834
835 req = tevent_req_create(mem_ctx, &state,
836 struct cli_session_setup_nt1_state);
837 if (req == NULL) {
838 return NULL;
839 }
840 state->cli = cli;
841 state->user = user;
842 vwv = state->vwv;
843
844 if (passlen == 0) {
845 /* do nothing - guest login */
846 } else if (passlen != 24) {
847 if (lp_client_ntlmv2_auth()) {
848 DATA_BLOB server_chal;
849 DATA_BLOB names_blob;
850
851 server_chal =
852 data_blob_const(cli_state_server_challenge(cli),
853 8);
854
855 /*
856 * note that the 'workgroup' here is a best
857 * guess - we don't know the server's domain
858 * at this point. Windows clients also don't
859 * use hostname...
860 */
861 names_blob = NTLMv2_generate_names_blob(
862 NULL, NULL, workgroup);
863
864 if (tevent_req_nomem(names_blob.data, req)) {
865 return tevent_req_post(req, ev);
866 }
867
868 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass,
869 &server_chal, &names_blob,
870 &lm_response, &nt_response,
871 NULL, &session_key)) {
872 data_blob_free(&names_blob);
873 tevent_req_nterror(
874 req, NT_STATUS_ACCESS_DENIED);
875 return tevent_req_post(req, ev);
876 }
877 data_blob_free(&names_blob);
878
879 } else {
880 uchar nt_hash[16];
881 E_md4hash(pass, nt_hash);
882
883 #ifdef LANMAN_ONLY
884 nt_response = data_blob_null;
885 #else
886 nt_response = data_blob(NULL, 24);
887 if (tevent_req_nomem(nt_response.data, req)) {
888 return tevent_req_post(req, ev);
889 }
890
891 SMBNTencrypt(pass, cli_state_server_challenge(cli),
892 nt_response.data);
893 #endif
894 /* non encrypted password supplied. Ignore ntpass. */
895 if (lp_client_lanman_auth()) {
896
897 lm_response = data_blob(NULL, 24);
898 if (tevent_req_nomem(lm_response.data, req)) {
899 return tevent_req_post(req, ev);
900 }
901
902 if (!SMBencrypt(pass,
903 cli_state_server_challenge(cli),
904 lm_response.data)) {
905 /*
906 * Oops, the LM response is
907 * invalid, just put the NT
908 * response there instead
909 */
910 data_blob_free(&lm_response);
911 lm_response = data_blob(
912 nt_response.data,
913 nt_response.length);
914 }
915 } else {
916 /*
917 * LM disabled, place NT# in LM field
918 * instead
919 */
920 lm_response = data_blob(
921 nt_response.data, nt_response.length);
922 }
923
924 if (tevent_req_nomem(lm_response.data, req)) {
925 return tevent_req_post(req, ev);
926 }
927
928 session_key = data_blob(NULL, 16);
929 if (tevent_req_nomem(session_key.data, req)) {
930 return tevent_req_post(req, ev);
931 }
932 #ifdef LANMAN_ONLY
933 E_deshash(pass, session_key.data);
934 memset(&session_key.data[8], '\0', 8);
935 #else
936 SMBsesskeygen_ntv1(nt_hash, session_key.data);
937 #endif
938 }
939 } else {
940 /* pre-encrypted password supplied. Only used for
941 security=server, can't do
942 signing because we don't have original key */
943
944 lm_response = data_blob(pass, passlen);
945 if (tevent_req_nomem(lm_response.data, req)) {
946 return tevent_req_post(req, ev);
947 }
948
949 nt_response = data_blob(ntpass, ntpasslen);
950 if (tevent_req_nomem(nt_response.data, req)) {
951 return tevent_req_post(req, ev);
952 }
953 }
954
955 #ifdef LANMAN_ONLY
956 state->response = data_blob_talloc(
957 state, lm_response.data, lm_response.length);
958 #else
959 state->response = data_blob_talloc(
960 state, nt_response.data, nt_response.length);
961 #endif
962 if (tevent_req_nomem(state->response.data, req)) {
963 return tevent_req_post(req, ev);
964 }
965
966 if (session_key.data) {
967 state->session_key = data_blob_talloc(
968 state, session_key.data, session_key.length);
969 if (tevent_req_nomem(state->session_key.data, req)) {
970 return tevent_req_post(req, ev);
971 }
972 }
973 data_blob_free(&session_key);
974
975 SCVAL(vwv+0, 0, 0xff);
976 SCVAL(vwv+0, 1, 0);
977 SSVAL(vwv+1, 0, 0);
978 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
979 SSVAL(vwv+3, 0, 2);
980 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
981 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
982 SSVAL(vwv+7, 0, lm_response.length);
983 SSVAL(vwv+8, 0, nt_response.length);
984 SSVAL(vwv+9, 0, 0);
985 SSVAL(vwv+10, 0, 0);
986 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
987
988 bytes = talloc_array(state, uint8_t,
989 lm_response.length + nt_response.length);
990 if (tevent_req_nomem(bytes, req)) {
991 return tevent_req_post(req, ev);
992 }
993 if (lm_response.length != 0) {
994 memcpy(bytes, lm_response.data, lm_response.length);
995 }
996 if (nt_response.length != 0) {
997 memcpy(bytes + lm_response.length,
998 nt_response.data, nt_response.length);
999 }
1000 data_blob_free(&lm_response);
1001 data_blob_free(&nt_response);
1002
1003 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
1004 user, strlen(user)+1, NULL);
1005
1006 /*
1007 * Upper case here might help some NTLMv2 implementations
1008 */
1009 workgroup_upper = talloc_strdup_upper(talloc_tos(), workgroup);
1010 if (tevent_req_nomem(workgroup_upper, req)) {
1011 return tevent_req_post(req, ev);
1012 }
1013 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
1014 workgroup_upper, strlen(workgroup_upper)+1,
1015 NULL);
1016 TALLOC_FREE(workgroup_upper);
1017
1018 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
1019 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
1020 if (tevent_req_nomem(bytes, req)) {
1021 return tevent_req_post(req, ev);
1022 }
1023
1024 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
1025 talloc_get_size(bytes), bytes);
1026 if (tevent_req_nomem(subreq, req)) {
1027 return tevent_req_post(req, ev);
1028 }
1029 tevent_req_set_callback(subreq, cli_session_setup_nt1_done, req);
1030 return req;
1031 }
1032
1033 static void cli_session_setup_nt1_done(struct tevent_req *subreq)
1034 {
1035 struct tevent_req *req = tevent_req_callback_data(
1036 subreq, struct tevent_req);
1037 struct cli_session_setup_nt1_state *state = tevent_req_data(
1038 req, struct cli_session_setup_nt1_state);
1039 struct cli_state *cli = state->cli;
1040 uint32_t num_bytes;
1041 uint8_t *in;
1042 char *inbuf;
1043 uint8_t *bytes;
1044 uint8_t *p;
1045 NTSTATUS status;
1046 ssize_t ret;
1047 uint8_t wct;
1048 uint16_t *vwv;
1049
1050 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
1051 &num_bytes, &bytes);
1052 TALLOC_FREE(subreq);
1053 if (!NT_STATUS_IS_OK(status)) {
1054 tevent_req_nterror(req, status);
1055 return;
1056 }
1057
1058 inbuf = (char *)in;
1059 p = bytes;
1060
1061 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
1062 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1063
1064 status = smb_bytes_talloc_string(cli,
1065 inbuf,
1066 &cli->server_os,
1067 p,
1068 bytes+num_bytes-p,
1069 &ret);
1070 if (!NT_STATUS_IS_OK(status)) {
1071 tevent_req_nterror(req, status);
1072 return;
1073 }
1074 p += ret;
1075
1076 status = smb_bytes_talloc_string(cli,
1077 inbuf,
1078 &cli->server_type,
1079 p,
1080 bytes+num_bytes-p,
1081 &ret);
1082 if (!NT_STATUS_IS_OK(status)) {
1083 tevent_req_nterror(req, status);
1084 return;
1085 }
1086 p += ret;
1087
1088 status = smb_bytes_talloc_string(cli,
1089 inbuf,
1090 &cli->server_domain,
1091 p,
1092 bytes+num_bytes-p,
1093 &ret);
1094 if (!NT_STATUS_IS_OK(status)) {
1095 tevent_req_nterror(req, status);
1096 return;
1097 }
1098 p += ret;
1099
1100 status = cli_set_username(cli, state->user);
1101 if (tevent_req_nterror(req, status)) {
1102 return;
1103 }
1104 if (cli_simple_set_signing(cli, state->session_key, state->response)
1105 && !cli_check_sign_mac(cli, (char *)in, 1)) {
1106 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1107 return;
1108 }
1109 if (state->session_key.data) {
1110 /* Have plaintext orginal */
1111 cli_set_session_key(cli, state->session_key);
1112 }
1113 tevent_req_done(req);
1114 }
1115
1116 static NTSTATUS cli_session_setup_nt1_recv(struct tevent_req *req)
1117 {
1118 return tevent_req_simple_recv_ntstatus(req);
1119 }
1120
1121 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
1122 const char *pass, size_t passlen,
1123 const char *ntpass, size_t ntpasslen,
1124 const char *workgroup)
1125 {
1126 TALLOC_CTX *frame = talloc_stackframe();
1127 struct event_context *ev;
1128 struct tevent_req *req;
1129 NTSTATUS status = NT_STATUS_NO_MEMORY;
1130
1131 if (cli_has_async_calls(cli)) {
1132 /*
1133 * Can't use sync call while an async call is in flight
1134 */
1135 status = NT_STATUS_INVALID_PARAMETER;
1136 goto fail;
1137 }
1138 ev = event_context_init(frame);
1139 if (ev == NULL) {
1140 goto fail;
1141 }
1142 req = cli_session_setup_nt1_send(frame, ev, cli, user, pass, passlen,
1143 ntpass, ntpasslen, workgroup);
1144 if (req == NULL) {
1145 goto fail;
1146 }
1147 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1148 goto fail;
1149 }
1150 status = cli_session_setup_nt1_recv(req);
1151 fail:
1152 TALLOC_FREE(frame);
1153 return status;
1154 }
1155
1156 /* The following is calculated from :
1157 * (smb_size-4) = 35
1158 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
1159 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
1160 * end of packet.
1161 */
1162
1163 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
1164
1165 struct cli_sesssetup_blob_state {
1166 struct tevent_context *ev;
1167 struct cli_state *cli;
1168 DATA_BLOB blob;
1169 uint16_t max_blob_size;
1170 uint16_t vwv[12];
1171 uint8_t *buf;
1172
1173 NTSTATUS status;
1174 char *inbuf;
1175 DATA_BLOB ret_blob;
1176 };
1177
1178 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1179 struct tevent_req **psubreq);
1180 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
1181
1182 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
1183 struct tevent_context *ev,
1184 struct cli_state *cli,
1185 DATA_BLOB blob)
1186 {
1187 struct tevent_req *req, *subreq;
1188 struct cli_sesssetup_blob_state *state;
1189 uint32_t usable_space;
1190
1191 req = tevent_req_create(mem_ctx, &state,
1192 struct cli_sesssetup_blob_state);
1193 if (req == NULL) {
1194 return NULL;
1195 }
1196 state->ev = ev;
1197 state->blob = blob;
1198 state->cli = cli;
1199
1200 usable_space = cli_state_available_size(cli,
1201 BASE_SESSSETUP_BLOB_PACKET_SIZE);
1202
1203 if (usable_space == 0) {
1204 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
1205 "(not possible to send %u bytes)\n",
1206 BASE_SESSSETUP_BLOB_PACKET_SIZE + 1));
1207 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1208 return tevent_req_post(req, ev);
1209 }
1210 state->max_blob_size = MIN(usable_space, 0xFFFF);
1211
1212 if (!cli_sesssetup_blob_next(state, &subreq)) {
1213 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1214 return tevent_req_post(req, ev);
1215 }
1216 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1217 return req;
1218 }
1219
1220 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1221 struct tevent_req **psubreq)
1222 {
1223 struct tevent_req *subreq;
1224 uint16_t thistime;
1225
1226 SCVAL(state->vwv+0, 0, 0xFF);
1227 SCVAL(state->vwv+0, 1, 0);
1228 SSVAL(state->vwv+1, 0, 0);
1229 SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
1230 SSVAL(state->vwv+3, 0, 2);
1231 SSVAL(state->vwv+4, 0, 1);
1232 SIVAL(state->vwv+5, 0, 0);
1233
1234 thistime = MIN(state->blob.length, state->max_blob_size);
1235 SSVAL(state->vwv+7, 0, thistime);
1236
1237 SSVAL(state->vwv+8, 0, 0);
1238 SSVAL(state->vwv+9, 0, 0);
1239 SIVAL(state->vwv+10, 0,
1240 cli_session_setup_capabilities(state->cli, CAP_EXTENDED_SECURITY));
1241
1242 state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
1243 thistime);
1244 if (state->buf == NULL) {
1245 return false;
1246 }
1247 state->blob.data += thistime;
1248 state->blob.length -= thistime;
1249
1250 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
1251 "Unix", 5, NULL);
1252 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
1253 "Samba", 6, NULL);
1254 if (state->buf == NULL) {
1255 return false;
1256 }
1257 subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
1258 12, state->vwv,
1259 talloc_get_size(state->buf), state->buf);
1260 if (subreq == NULL) {
1261 return false;
1262 }
1263 *psubreq = subreq;
1264 return true;
1265 }
1266
1267 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
1268 {
1269 struct tevent_req *req = tevent_req_callback_data(
1270 subreq, struct tevent_req);
1271 struct cli_sesssetup_blob_state *state = tevent_req_data(
1272 req, struct cli_sesssetup_blob_state);
1273 struct cli_state *cli = state->cli;
1274 uint8_t wct;
1275 uint16_t *vwv;
1276 uint32_t num_bytes;
1277 uint8_t *bytes;
1278 NTSTATUS status;
1279 uint8_t *p;
1280 uint16_t blob_length;
1281 uint8_t *inbuf;
1282 ssize_t ret;
1283
1284 status = cli_smb_recv(subreq, state, &inbuf, 4, &wct, &vwv,
1285 &num_bytes, &bytes);
1286 TALLOC_FREE(subreq);
1287 if (!NT_STATUS_IS_OK(status)
1288 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1289 tevent_req_nterror(req, status);
1290 return;
1291 }
1292
1293 state->status = status;
1294 TALLOC_FREE(state->buf);
1295
1296 state->inbuf = (char *)inbuf;
1297 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
1298 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1299
1300 blob_length = SVAL(vwv+3, 0);
1301 if (blob_length > num_bytes) {
1302 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1303 return;
1304 }
1305 state->ret_blob = data_blob_const(bytes, blob_length);
1306
1307 p = bytes + blob_length;
1308
1309 status = smb_bytes_talloc_string(cli,
1310 (char *)inbuf,
1311 &cli->server_os,
1312 p,
1313 bytes+num_bytes-p,
1314 &ret);
1315
1316 if (!NT_STATUS_IS_OK(status)) {
1317 tevent_req_nterror(req, status);
1318 return;
1319 }
1320 p += ret;
1321
1322 status = smb_bytes_talloc_string(cli,
1323 (char *)inbuf,
1324 &cli->server_type,
1325 p,
1326 bytes+num_bytes-p,
1327 &ret);
1328
1329 if (!NT_STATUS_IS_OK(status)) {
1330 tevent_req_nterror(req, status);
1331 return;
1332 }
1333 p += ret;
1334
1335 status = smb_bytes_talloc_string(cli,
1336 (char *)inbuf,
1337 &cli->server_domain,
1338 p,
1339 bytes+num_bytes-p,
1340 &ret);
1341
1342 if (!NT_STATUS_IS_OK(status)) {
1343 tevent_req_nterror(req, status);
1344 return;
1345 }
1346 p += ret;
1347
1348 if (state->blob.length != 0) {
1349 /*
1350 * More to send
1351 */
1352 if (!cli_sesssetup_blob_next(state, &subreq)) {
1353 tevent_req_oom(req);
1354 return;
1355 }
1356 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1357 return;
1358 }
1359 tevent_req_done(req);
1360 }
1361
1362 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
1363 TALLOC_CTX *mem_ctx,
1364 DATA_BLOB *pblob,
1365 char **pinbuf)
1366 {
1367 struct cli_sesssetup_blob_state *state = tevent_req_data(
1368 req, struct cli_sesssetup_blob_state);
1369 NTSTATUS status;
1370 char *inbuf;
1371
1372 if (tevent_req_is_nterror(req, &status)) {
1373 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1374 return status;
1375 }
1376
1377 inbuf = talloc_move(mem_ctx, &state->inbuf);
1378 if (pblob != NULL) {
1379 *pblob = state->ret_blob;
1380 }
1381 if (pinbuf != NULL) {
1382 *pinbuf = inbuf;
1383 }
1384 /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
1385 return state->status;
1386 }
1387
1388 #ifdef HAVE_KRB5
1389
1390 /****************************************************************************
1391 Use in-memory credentials cache
1392 ****************************************************************************/
1393
1394 static void use_in_memory_ccache(void) {
1395 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
1396 }
1397
1398 /****************************************************************************
1399 Do a spnego/kerberos encrypted session setup.
1400 ****************************************************************************/
1401
1402 struct cli_session_setup_kerberos_state {
1403 struct cli_state *cli;
1404 DATA_BLOB negTokenTarg;
1405 DATA_BLOB session_key_krb5;
1406 ADS_STATUS ads_status;
1407 };
1408
1409 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
1410
1411 static struct tevent_req *cli_session_setup_kerberos_send(
1412 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1413 const char *principal)
1414 {
1415 struct tevent_req *req, *subreq;
1416 struct cli_session_setup_kerberos_state *state;
1417 int rc;
1418
1419 DEBUG(2,("Doing kerberos session setup\n"));
1420
1421 req = tevent_req_create(mem_ctx, &state,
1422 struct cli_session_setup_kerberos_state);
1423 if (req == NULL) {
1424 return NULL;
1425 }
1426 state->cli = cli;
1427 state->ads_status = ADS_SUCCESS;
1428
1429 /*
1430 * Ok, this is cheating: spnego_gen_krb5_negTokenInit can block if
1431 * we have to acquire a ticket. To be fixed later :-)
1432 */
1433 rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
1434 &state->session_key_krb5, 0, NULL);
1435 if (rc) {
1436 DEBUG(1, ("cli_session_setup_kerberos: "
1437 "spnego_gen_krb5_negTokenInit failed: %s\n",
1438 error_message(rc)));
1439 state->ads_status = ADS_ERROR_KRB5(rc);
1440 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1441 return tevent_req_post(req, ev);
1442 }
1443
1444 #if 0
1445 file_save("negTokenTarg.dat", state->negTokenTarg.data,
1446 state->negTokenTarg.length);
1447 #endif
1448
1449 subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
1450 if (tevent_req_nomem(subreq, req)) {
1451 return tevent_req_post(req, ev);
1452 }
1453 tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
1454 return req;
1455 }
1456
1457 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
1458 {
1459 struct tevent_req *req = tevent_req_callback_data(
1460 subreq, struct tevent_req);
1461 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1462 req, struct cli_session_setup_kerberos_state);
1463 char *inbuf = NULL;
1464 NTSTATUS status;
1465
1466 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), NULL, &inbuf);
1467 TALLOC_FREE(subreq);
1468 if (!NT_STATUS_IS_OK(status)) {
1469 tevent_req_nterror(req, status);
1470 return;
1471 }
1472
1473 cli_set_session_key(state->cli, state->session_key_krb5);
1474
1475 if (cli_simple_set_signing(state->cli, state->session_key_krb5,
1476 data_blob_null)
1477 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1478 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1479 return;
1480 }
1481
1482 tevent_req_done(req);
1483 }
1484
1485 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
1486 {
1487 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1488 req, struct cli_session_setup_kerberos_state);
1489 NTSTATUS status;
1490
1491 if (tevent_req_is_nterror(req, &status)) {
1492 return ADS_ERROR_NT(status);
1493 }
1494 return state->ads_status;
1495 }
1496
1497 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
1498 const char *principal)
1499 {
1500 struct tevent_context *ev;
1501 struct tevent_req *req;
1502 ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1503
1504 if (cli_has_async_calls(cli)) {
1505 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1506 }
1507 ev = tevent_context_init(talloc_tos());
1508 if (ev == NULL) {
1509 goto fail;
1510 }
1511 req = cli_session_setup_kerberos_send(ev, ev, cli, principal);
1512 if (req == NULL) {
1513 goto fail;
1514 }
1515 if (!tevent_req_poll(req, ev)) {
1516 status = ADS_ERROR_SYSTEM(errno);
1517 goto fail;
1518 }
1519 status = cli_session_setup_kerberos_recv(req);
1520 fail:
1521 TALLOC_FREE(ev);
1522 return status;
1523 }
1524 #endif /* HAVE_KRB5 */
1525
1526 /****************************************************************************
1527 Do a spnego/NTLMSSP encrypted session setup.
1528 ****************************************************************************/
1529
1530 struct cli_session_setup_ntlmssp_state {
1531 struct tevent_context *ev;
1532 struct cli_state *cli;
1533 struct ntlmssp_state *ntlmssp_state;
1534 int turn;
1535 DATA_BLOB blob_out;
1536 };
1537
1538 static int cli_session_setup_ntlmssp_state_destructor(
1539 struct cli_session_setup_ntlmssp_state *state)
1540 {
1541 if (state->ntlmssp_state != NULL) {
1542 TALLOC_FREE(state->ntlmssp_state);
1543 }
1544 return 0;
1545 }
1546
1547 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
1548
1549 static struct tevent_req *cli_session_setup_ntlmssp_send(
1550 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1551 const char *user, const char *pass, const char *domain)
1552 {
1553 struct tevent_req *req, *subreq;
1554 struct cli_session_setup_ntlmssp_state *state;
1555 NTSTATUS status;
1556 DATA_BLOB blob_out;
1557 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
1558
1559 req = tevent_req_create(mem_ctx, &state,
1560 struct cli_session_setup_ntlmssp_state);
1561 if (req == NULL) {
1562 return NULL;
1563 }
1564 state->ev = ev;
1565 state->cli = cli;
1566 state->turn = 1;
1567
1568 state->ntlmssp_state = NULL;
1569 talloc_set_destructor(
1570 state, cli_session_setup_ntlmssp_state_destructor);
1571
1572 status = ntlmssp_client_start(state,
1573 lp_netbios_name(),
1574 lp_workgroup(),
1575 lp_client_ntlmv2_auth(),
1576 &state->ntlmssp_state);
1577 if (!NT_STATUS_IS_OK(status)) {
1578 goto fail;
1579 }
1580 ntlmssp_want_feature(state->ntlmssp_state,
1581 NTLMSSP_FEATURE_SESSION_KEY);
1582 if (cli->use_ccache) {
1583 ntlmssp_want_feature(state->ntlmssp_state,
1584 NTLMSSP_FEATURE_CCACHE);
1585 }
1586 status = ntlmssp_set_username(state->ntlmssp_state, user);
1587 if (!NT_STATUS_IS_OK(status)) {
1588 goto fail;
1589 }
1590 status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1591 if (!NT_STATUS_IS_OK(status)) {
1592 goto fail;
1593 }
1594 status = ntlmssp_set_password(state->ntlmssp_state, pass);
1595 if (!NT_STATUS_IS_OK(status)) {
1596 goto fail;
1597 }
1598 status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1599 &blob_out);
1600 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1601 goto fail;
1602 }
1603
1604 state->blob_out = spnego_gen_negTokenInit(state, OIDs_ntlm, &blob_out, NULL);
1605 data_blob_free(&blob_out);
1606
1607 subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1608 if (tevent_req_nomem(subreq, req)) {
1609 return tevent_req_post(req, ev);
1610 }
1611 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1612 return req;
1613 fail:
1614 tevent_req_nterror(req, status);
1615 return tevent_req_post(req, ev);
1616 }
1617
1618 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1619 {
1620 struct tevent_req *req = tevent_req_callback_data(
1621 subreq, struct tevent_req);
1622 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1623 req, struct cli_session_setup_ntlmssp_state);
1624 DATA_BLOB blob_in, msg_in, blob_out;
1625 char *inbuf = NULL;
1626 bool parse_ret;
1627 NTSTATUS status;
1628
1629 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1630 &inbuf);
1631 TALLOC_FREE(subreq);
1632 data_blob_free(&state->blob_out);
1633
1634 if (NT_STATUS_IS_OK(status)) {
1635 if (state->cli->server_domain[0] == '\0') {
1636 TALLOC_FREE(state->cli->server_domain);
1637 state->cli->server_domain = talloc_strdup(state->cli,
1638 state->ntlmssp_state->server.netbios_domain);
1639 if (state->cli->server_domain == NULL) {
1640 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1641 return;
1642 }
1643 }
1644 cli_set_session_key(
1645 state->cli, state->ntlmssp_state->session_key);
1646
1647 if (cli_simple_set_signing(
1648 state->cli, state->ntlmssp_state->session_key,
1649 data_blob_null)
1650 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1651 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1652 return;
1653 }
1654 TALLOC_FREE(state->ntlmssp_state);
1655 tevent_req_done(req);
1656 return;
1657 }
1658 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1659 tevent_req_nterror(req, status);
1660 return;
1661 }
1662
1663 if (blob_in.length == 0) {
1664 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1665 return;
1666 }
1667
1668 if ((state->turn == 1)
1669 && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1670 DATA_BLOB tmp_blob = data_blob_null;
1671 /* the server might give us back two challenges */
1672 parse_ret = spnego_parse_challenge(state, blob_in, &msg_in,
1673 &tmp_blob);
1674 data_blob_free(&tmp_blob);
1675 } else {
1676 parse_ret = spnego_parse_auth_response(state, blob_in, status,
1677 OID_NTLMSSP, &msg_in);
1678 }
1679 state->turn += 1;
1680
1681 if (!parse_ret) {
1682 DEBUG(3,("Failed to parse auth response\n"));
1683 if (NT_STATUS_IS_OK(status)
1684 || NT_STATUS_EQUAL(status,
1685 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1686 tevent_req_nterror(
1687 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1688 return;
1689 }
1690 }
1691
1692 status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1693
1694 if (!NT_STATUS_IS_OK(status)
1695 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1696 TALLOC_FREE(state->ntlmssp_state);
1697 tevent_req_nterror(req, status);
1698 return;
1699 }
1700
1701 state->blob_out = spnego_gen_auth(state, blob_out);
1702 if (tevent_req_nomem(state->blob_out.data, req)) {
1703 return;
1704 }
1705
1706 subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1707 state->blob_out);
1708 if (tevent_req_nomem(subreq, req)) {
1709 return;
1710 }
1711 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1712 }
1713
1714 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1715 {
1716 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1717 req, struct cli_session_setup_ntlmssp_state);
1718 NTSTATUS status;
1719
1720 if (tevent_req_is_nterror(req, &status)) {
1721 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1722 return status;
1723 }
1724 return NT_STATUS_OK;
1725 }
1726
1727 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1728 const char *user,
1729 const char *pass,
1730 const char *domain)
1731 {
1732 struct tevent_context *ev;
1733 struct tevent_req *req;
1734 NTSTATUS status = NT_STATUS_NO_MEMORY;
1735
1736 if (cli_has_async_calls(cli)) {
1737 return NT_STATUS_INVALID_PARAMETER;
1738 }
1739 ev = tevent_context_init(talloc_tos());
1740 if (ev == NULL) {
1741 goto fail;
1742 }
1743 req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1744 if (req == NULL) {
1745 goto fail;
1746 }
1747 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1748 goto fail;
1749 }
1750 status = cli_session_setup_ntlmssp_recv(req);
1751 fail:
1752 TALLOC_FREE(ev);
1753 return status;
1754 }
1755
1756 /****************************************************************************
1757 Do a spnego encrypted session setup.
1758
1759 user_domain: The shortname of the domain the user/machine is a member of.
1760 dest_realm: The realm we're connecting to, if NULL we use our default realm.
1761 ****************************************************************************/
1762
1763 static ADS_STATUS cli_session_setup_spnego(struct cli_state *cli,
1764 const char *user,
1765 const char *pass,
1766 const char *user_domain,
1767 const char * dest_realm)
1768 {
1769 char *principal = NULL;
1770 char *OIDs[ASN1_MAX_OIDS];
1771 int i;
1772 DATA_BLOB *server_blob;
1773 DATA_BLOB blob = data_blob_null;
1774 const char *p = NULL;
1775 char *account = NULL;
1776 NTSTATUS status;
1777
1778 server_blob = cli_state_server_gss_blob(cli);
1779 if (server_blob) {
1780 blob = data_blob(server_blob->data, server_blob->length);
1781 }
1782
1783 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)blob.length));
1784
1785 /* the server might not even do spnego */
1786 if (blob.length == 0) {
1787 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1788 goto ntlmssp;
1789 }
1790
1791 #if 0
1792 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1793 #endif
1794
1795 /* The server sent us the first part of the SPNEGO exchange in the
1796 * negprot reply. It is WRONG to depend on the principal sent in the
1797 * negprot reply, but right now we do it. If we don't receive one,
1798 * we try to best guess, then fall back to NTLM. */
1799 if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &principal, NULL) ||
1800 OIDs[0] == NULL) {
1801 data_blob_free(&blob);
1802 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1803 }
1804 data_blob_free(&blob);
1805
1806 /* make sure the server understands kerberos */
1807 for (i=0;OIDs[i];i++) {
1808 if (i == 0)
1809 DEBUG(3,("got OID=%s\n", OIDs[i]));
1810 else
1811 DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1812 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1813 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1814 cli->got_kerberos_mechanism = True;
1815 }
1816 talloc_free(OIDs[i]);
1817 }
1818
1819 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1820
1821 status = cli_set_username(cli, user);
1822 if (!NT_STATUS_IS_OK(status)) {
1823 TALLOC_FREE(principal);
1824 return ADS_ERROR_NT(status);
1825 }
1826
1827 #ifdef HAVE_KRB5
1828 /* If password is set we reauthenticate to kerberos server
1829 * and do not store results */
1830
1831 if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1832 ADS_STATUS rc;
1833 const char *remote_name = cli_state_remote_name(cli);
1834
1835 if (pass && *pass) {
1836 int ret;
1837
1838 use_in_memory_ccache();
1839 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1840
1841 if (ret){
1842 TALLOC_FREE(principal);
1843 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1844 if (cli->fallback_after_kerberos)
1845 goto ntlmssp;
1846 return ADS_ERROR_KRB5(ret);
1847 }
1848 }
1849
1850 /* We may not be allowed to use the server-supplied SPNEGO principal, or it may not have been supplied to us
1851 */
1852 if (!lp_client_use_spnego_principal() || strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1853 TALLOC_FREE(principal);
1854 }
1855
1856 if (principal == NULL &&
1857 !is_ipaddress(remote_name) &&
1858 !strequal(STAR_SMBSERVER,
1859 remote_name)) {
1860 char *realm = NULL;
1861 char *host = NULL;
1862 DEBUG(3,("cli_session_setup_spnego: using target "
1863 "hostname not SPNEGO principal\n"));
1864
1865 host = strchr_m(remote_name, '.');
1866 if (dest_realm) {
1867 realm = SMB_STRDUP(dest_realm);
1868 if (!realm) {
1869 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1870 }
1871 strupper_m(realm);
1872 } else {
1873 if (host) {
1874 /* DNS name. */
1875 realm = kerberos_get_realm_from_hostname(remote_name);
1876 } else {
1877 /* NetBIOS name - use our realm. */
1878 realm = kerberos_get_default_realm_from_ccache();
1879 }
1880 }
1881
1882 if (realm == NULL || *realm == '\0') {
1883 realm = SMB_STRDUP(lp_realm());
1884 if (!realm) {
1885 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1886 }
1887 strupper_m(realm);
1888 DEBUG(3,("cli_session_setup_spnego: cannot "
1889 "get realm from dest_realm %s, "
1890 "desthost %s. Using default "
1891 "smb.conf realm %s\n",
1892 dest_realm ? dest_realm : "<null>",
1893 remote_name,
1894 realm));
1895 }
1896
1897 principal = talloc_asprintf(talloc_tos(),
1898 "cifs/%s@%s",
1899 remote_name,
1900 realm);
1901 if (!principal) {
1902 SAFE_FREE(realm);
1903 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1904 }
1905 DEBUG(3,("cli_session_setup_spnego: guessed "
1906 "server principal=%s\n",
1907 principal ? principal : "<null>"));
1908
1909 SAFE_FREE(realm);
1910 }
1911
1912 if (principal) {
1913 rc = cli_session_setup_kerberos(cli, principal);
1914 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1915 TALLOC_FREE(principal);
1916 return rc;
1917 }
1918 }
1919 }
1920 #endif
1921
1922 TALLOC_FREE(principal);
1923
1924 ntlmssp:
1925
1926 account = talloc_strdup(talloc_tos(), user);
1927 if (!account) {
1928 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1929 }
1930
1931 /* when falling back to ntlmssp while authenticating with a machine
1932 * account strip off the realm - gd */
1933
1934 if ((p = strchr_m(user, '@')) != NULL) {
1935 account[PTR_DIFF(p,user)] = '\0';
1936 }
1937
1938 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1939 }
1940
1941 /****************************************************************************
1942 Send a session setup. The username and workgroup is in UNIX character
1943 format and must be converted to DOS codepage format before sending. If the
1944 password is in plaintext, the same should be done.
1945 ****************************************************************************/
1946
1947 NTSTATUS cli_session_setup(struct cli_state *cli,
1948 const char *user,
1949 const char *pass, int passlen,
1950 const char *ntpass, int ntpasslen,
1951 const char *workgroup)
1952 {
1953 char *p;
1954 char *user2;
1955 uint16_t sec_mode = cli_state_security_mode(cli);
1956
1957 if (user) {
1958 user2 = talloc_strdup(talloc_tos(), user);
1959 } else {
1960 user2 = talloc_strdup(talloc_tos(), "");
1961 }
1962 if (user2 == NULL) {
1963 return NT_STATUS_NO_MEMORY;
1964 }
1965
1966 if (!workgroup) {
1967 workgroup = "";
1968 }
1969
1970 /* allow for workgroups as part of the username */
1971 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1972 (p=strchr_m(user2,*lp_winbind_separator()))) {
1973 *p = 0;
1974 user = p+1;
1975 strupper_m(user2);
1976 workgroup = user2;
1977 }
1978
1979 if (cli_state_protocol(cli) < PROTOCOL_LANMAN1) {
1980 /*
1981 * Ensure cli->server_domain,
1982 * cli->server_os and cli->server_type
1983 * are valid pointers.
1984 */
1985 cli->server_domain = talloc_strdup(cli, "");
1986 cli->server_os = talloc_strdup(cli, "");
1987 cli->server_type = talloc_strdup(cli, "");
1988 if (cli->server_domain == NULL ||
1989 cli->server_os == NULL ||
1990 cli->server_type == NULL) {
1991 return NT_STATUS_NO_MEMORY;
1992 }
1993 return NT_STATUS_OK;
1994 }
1995
1996 /* now work out what sort of session setup we are going to
1997 do. I have split this into separate functions to make the
1998 flow a bit easier to understand (tridge) */
1999
2000 /* if its an older server then we have to use the older request format */
2001
2002 if (cli_state_protocol(cli) < PROTOCOL_NT1) {
2003 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
2004 DEBUG(1, ("Server requested LM password but 'client lanman auth = no'"
2005 " or 'client ntlmv2 auth = yes'\n"));
2006 return NT_STATUS_ACCESS_DENIED;
2007 }
2008
2009 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
2010 !lp_client_plaintext_auth() && (*pass)) {
2011 DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
2012 " or 'client ntlmv2 auth = yes'\n"));
2013 return NT_STATUS_ACCESS_DENIED;
2014 }
2015
2016 return cli_session_setup_lanman2(cli, user, pass, passlen,
2017 workgroup);
2018 }
2019
2020 /* if no user is supplied then we have to do an anonymous connection.
2021 passwords are ignored */
2022
2023 if (!user || !*user)
2024 return cli_session_setup_guest(cli);
2025
2026 /* if the server is share level then send a plaintext null
2027 password at this point. The password is sent in the tree
2028 connect */
2029
2030 if ((sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
2031 return cli_session_setup_plain(cli, user, "", workgroup);
2032
2033 /* if the server doesn't support encryption then we have to use
2034 plaintext. The second password is ignored */
2035
2036 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
2037 if (!lp_client_plaintext_auth() && (*pass)) {
2038 DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
2039 " or 'client ntlmv2 auth = yes'\n"));
2040 return NT_STATUS_ACCESS_DENIED;
2041 }
2042 return cli_session_setup_plain(cli, user, pass, workgroup);
2043 }
2044
2045 /* if the server supports extended security then use SPNEGO */
2046
2047 if (cli_state_capabilities(cli) & CAP_EXTENDED_SECURITY) {
2048 const char *remote_realm = cli_state_remote_realm(cli);
2049 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2050 workgroup,
2051 remote_realm);
2052 if (!ADS_ERR_OK(status)) {
2053 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
2054 return ads_ntstatus(status);
2055 }
2056 } else {
2057 NTSTATUS status;
2058
2059 /* otherwise do a NT1 style session setup */
2060 status = cli_session_setup_nt1(cli, user, pass, passlen,
2061 ntpass, ntpasslen, workgroup);
2062 if (!NT_STATUS_IS_OK(status)) {
2063 DEBUG(3,("cli_session_setup: NT1 session setup "
2064 "failed: %s\n", nt_errstr(status)));
2065 return status;
2066 }
2067 }
2068
2069 return NT_STATUS_OK;
2070 }
2071
2072 /****************************************************************************
2073 Send a uloggoff.
2074 *****************************************************************************/
2075
2076 struct cli_ulogoff_state {
2077 struct cli_state *cli;
2078 uint16_t vwv[3];
2079 };
2080
2081 static void cli_ulogoff_done(struct tevent_req *subreq);
2082
2083 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
2084 struct tevent_context *ev,
2085 struct cli_state *cli)
2086 {
2087 struct tevent_req *req, *subreq;
2088 struct cli_ulogoff_state *state;
2089
2090 req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
2091 if (req == NULL) {
2092 return NULL;
2093 }
2094 state->cli = cli;
2095
2096 SCVAL(state->vwv+0, 0, 0xFF);
2097 SCVAL(state->vwv+1, 0, 0);
2098 SSVAL(state->vwv+2, 0, 0);
2099
2100 subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
2101 0, NULL);
2102 if (tevent_req_nomem(subreq, req)) {
2103 return tevent_req_post(req, ev);
2104 }
2105 tevent_req_set_callback(subreq, cli_ulogoff_done, req);
2106 return req;
2107 }
2108
2109 static void cli_ulogoff_done(struct tevent_req *subreq)
2110 {
2111 struct tevent_req *req = tevent_req_callback_data(
2112 subreq, struct tevent_req);
2113 struct cli_ulogoff_state *state = tevent_req_data(
2114 req, struct cli_ulogoff_state);
2115 NTSTATUS status;
2116
2117 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2118 if (!NT_STATUS_IS_OK(status)) {
2119 tevent_req_nterror(req, status);
2120 return;
2121 }
2122 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
2123 tevent_req_done(req);
2124 }
2125
2126 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
2127 {
2128 return tevent_req_simple_recv_ntstatus(req);
2129 }
2130
2131 NTSTATUS cli_ulogoff(struct cli_state *cli)
2132 {
2133 struct tevent_context *ev;
2134 struct tevent_req *req;
2135 NTSTATUS status = NT_STATUS_NO_MEMORY;
2136
2137 if (cli_has_async_calls(cli)) {
2138 return NT_STATUS_INVALID_PARAMETER;
2139 }
2140 ev = tevent_context_init(talloc_tos());
2141 if (ev == NULL) {
2142 goto fail;
2143 }
2144 req = cli_ulogoff_send(ev, ev, cli);
2145 if (req == NULL) {
2146 goto fail;
2147 }
2148 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2149 goto fail;
2150 }
2151 status = cli_ulogoff_recv(req);
2152 fail:
2153 TALLOC_FREE(ev);
2154 return status;
2155 }
2156
2157 /****************************************************************************
2158 Send a tconX.
2159 ****************************************************************************/
2160
2161 struct cli_tcon_andx_state {
2162 struct cli_state *cli;
2163 uint16_t vwv[4];
2164 struct iovec bytes;
2165 };
2166
2167 static void cli_tcon_andx_done(struct tevent_req *subreq);
2168
2169 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
2170 struct event_context *ev,
2171 struct cli_state *cli,
2172 const char *share, const char *dev,
2173 const char *pass, int passlen,
2174 struct tevent_req **psmbreq)
2175 {
2176 struct tevent_req *req, *subreq;
2177 struct cli_tcon_andx_state *state;
2178 uint8_t p24[24];
2179 uint16_t *vwv;
2180 char *tmp = NULL;
2181 uint8_t *bytes;
2182 uint16_t sec_mode = cli_state_security_mode(cli);
2183
2184 *psmbreq = NULL;
2185
2186 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
2187 if (req == NULL) {
2188 return NULL;
2189 }
2190 state->cli = cli;
2191 vwv = state->vwv;
2192
2193 cli->share = talloc_strdup(cli, share);
2194 if (!cli->share) {
2195 return NULL;
2196 }
2197
2198 /* in user level security don't send a password now */
2199 if (sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
2200 passlen = 1;
2201 pass = "";
2202 } else if (pass == NULL) {
2203 DEBUG(1, ("Server not using user level security and no "
2204 "password supplied.\n"));
2205 goto access_denied;
2206 }
2207
2208 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
2209 *pass && passlen != 24) {
2210 if (!lp_client_lanman_auth()) {
2211 DEBUG(1, ("Server requested LANMAN password "
2212 "(share-level security) but "
2213 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2214 goto access_denied;
2215 }
2216
2217 /*
2218 * Non-encrypted passwords - convert to DOS codepage before
2219 * encryption.
2220 */
2221 SMBencrypt(pass, cli_state_server_challenge(cli), p24);
2222 passlen = 24;
2223 pass = (const char *)p24;
2224 } else {
2225 if((sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
2226 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
2227 == 0) {
2228 uint8_t *tmp_pass;
2229
2230 if (!lp_client_plaintext_auth() && (*pass)) {
2231 DEBUG(1, ("Server requested plaintext "
2232 "password but "
2233 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2234 goto access_denied;
2235 }
2236
2237 /*
2238 * Non-encrypted passwords - convert to DOS codepage
2239 * before using.
2240 */
2241 tmp_pass = talloc_array(talloc_tos(), uint8, 0);
2242 if (tevent_req_nomem(tmp_pass, req)) {
2243 return tevent_req_post(req, ev);
2244 }
2245 tmp_pass = trans2_bytes_push_str(tmp_pass,
2246 false, /* always DOS */
2247 pass,
2248 passlen,
2249 NULL);
2250 if (tevent_req_nomem(tmp_pass, req)) {
2251 return tevent_req_post(req, ev);
2252 }
2253 pass = (const char *)tmp_pass;
2254 passlen = talloc_get_size(tmp_pass);
2255 }
2256 }
2257
2258 SCVAL(vwv+0, 0, 0xFF);
2259 SCVAL(vwv+0, 1, 0);
2260 SSVAL(vwv+1, 0, 0);
2261 SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
2262 SSVAL(vwv+3, 0, passlen);
2263
2264 if (passlen && pass) {
2265 bytes = (uint8_t *)talloc_memdup(state, pass, passlen);
2266 } else {
2267 bytes = talloc_array(state, uint8_t, 0);
2268 }
2269
2270 /*
2271 * Add the sharename
2272 */
2273 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
2274 cli_state_remote_name(cli), share);
2275 if (tmp == NULL) {
2276 TALLOC_FREE(req);
2277 return NULL;
2278 }
2279 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
2280 NULL);
2281 TALLOC_FREE(tmp);
2282
2283 /*
2284 * Add the devicetype
2285 */
2286 tmp = talloc_strdup_upper(talloc_tos(), dev);
2287 if (tmp == NULL) {
2288 TALLOC_FREE(req);
2289 return NULL;
2290 }
2291 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
2292 TALLOC_FREE(tmp);
2293
2294 if (bytes == NULL) {
2295 TALLOC_FREE(req);
2296 return NULL;
2297 }
2298
2299 state->bytes.iov_base = (void *)bytes;
2300 state->bytes.iov_len = talloc_get_size(bytes);
2301
2302 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
2303 1, &state->bytes);
2304 if (subreq == NULL) {
2305 TALLOC_FREE(req);
2306 return NULL;
2307 }
2308 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
2309 *psmbreq = subreq;
2310 return req;
2311
2312 access_denied:
2313 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2314 return tevent_req_post(req, ev);
2315 }
2316
2317 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
2318 struct event_context *ev,
2319 struct cli_state *cli,
2320 const char *share, const char *dev,
2321 const char *pass, int passlen)
2322 {
2323 struct tevent_req *req, *subreq;
2324 NTSTATUS status;
2325
2326 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
2327 &subreq);
2328 if (req == NULL) {
2329 return NULL;
2330 }
2331 if (subreq == NULL) {
2332 return req;
2333 }
2334 status = cli_smb_req_send(subreq);
2335 if (!NT_STATUS_IS_OK(status)) {
2336 tevent_req_nterror(req, status);
2337 return tevent_req_post(req, ev);
2338 }
2339 return req;
2340 }
2341
2342 static void cli_tcon_andx_done(struct tevent_req *subreq)
2343 {
2344 struct tevent_req *req = tevent_req_callback_data(
2345 subreq, struct tevent_req);
2346 struct cli_tcon_andx_state *state = tevent_req_data(
2347 req, struct cli_tcon_andx_state);
2348 struct cli_state *cli = state->cli;
2349 uint8_t *in;
2350 char *inbuf;
2351 uint8_t wct;
2352 uint16_t *vwv;
2353 uint32_t num_bytes;
2354 uint8_t *bytes;
2355 NTSTATUS status;
2356
2357 status = cli_smb_recv(subreq, state, &in, 0, &wct, &vwv,
2358 &num_bytes, &bytes);
2359 TALLOC_FREE(subreq);
2360 if (!NT_STATUS_IS_OK(status)) {
2361 tevent_req_nterror(req, status);
2362 return;
2363 }
2364
2365 inbuf = (char *)in;
2366
2367 if (num_bytes) {
2368 if (clistr_pull_talloc(cli,
2369 inbuf,
2370 SVAL(inbuf, smb_flg2),
2371 &cli->dev,
2372 bytes,
2373 num_bytes,
2374 STR_TERMINATE|STR_ASCII) == -1) {
2375 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2376 return;
2377 }
2378 } else {
2379 cli->dev = talloc_strdup(cli, "");
2380 if (cli->dev == NULL) {
2381 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2382 return;
2383 }
2384 }
2385
2386 if ((cli_state_protocol(cli) >= PROTOCOL_NT1) && (num_bytes == 3)) {
2387 /* almost certainly win95 - enable bug fixes */
2388 cli->win95 = True;
2389 }
2390
2391 /*
2392 * Make sure that we have the optional support 16-bit field. WCT > 2.
2393 * Avoids issues when connecting to Win9x boxes sharing files
2394 */
2395
2396 cli->dfsroot = false;
2397
2398 if ((wct > 2) && (cli_state_protocol(cli) >= PROTOCOL_LANMAN2)) {
2399 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
2400 }
2401
2402 cli->smb1.tid = SVAL(inbuf,smb_tid);
2403 tevent_req_done(req);
2404 }
2405
2406 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
2407 {
2408 return tevent_req_simple_recv_ntstatus(req);
2409 }
2410
2411 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
2412 const char *dev, const char *pass, int passlen)
2413 {
2414 TALLOC_CTX *frame = talloc_stackframe();
2415 struct event_context *ev;
2416 struct tevent_req *req;
2417 NTSTATUS status = NT_STATUS_OK;
2418
2419 if (cli_has_async_calls(cli)) {
2420 /*
2421 * Can't use sync call while an async call is in flight
2422 */
2423 status = NT_STATUS_INVALID_PARAMETER;
2424 goto fail;
2425 }
2426
2427 ev = event_context_init(frame);
2428 if (ev == NULL) {
2429 status = NT_STATUS_NO_MEMORY;
2430 goto fail;
2431 }
2432
2433 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
2434 if (req == NULL) {
2435 status = NT_STATUS_NO_MEMORY;
2436 goto fail;
2437 }
2438
2439 if (!tevent_req_poll(req, ev)) {
2440 status = map_nt_error_from_unix(errno);
2441 goto fail;
2442 }
2443
2444 status = cli_tcon_andx_recv(req);
2445 fail:
2446 TALLOC_FREE(frame);
2447 return status;
2448 }
2449
2450 /****************************************************************************
2451 Send a tree disconnect.
2452 ****************************************************************************/
2453
2454 struct cli_tdis_state {
2455 struct cli_state *cli;
2456 };
2457
2458 static void cli_tdis_done(struct tevent_req *subreq);
2459
2460 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
2461 struct tevent_context *ev,
2462 struct cli_state *cli)
2463 {
2464 struct tevent_req *req, *subreq;
2465 struct cli_tdis_state *state;
2466
2467 req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
2468 if (req == NULL) {
2469 return NULL;
2470 }
2471 state->cli = cli;
2472
2473 subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
2474 if (tevent_req_nomem(subreq, req)) {
2475 return tevent_req_post(req, ev);
2476 }
2477 tevent_req_set_callback(subreq, cli_tdis_done, req);
2478 return req;
2479 }
2480
2481 static void cli_tdis_done(struct tevent_req *subreq)
2482 {
2483 struct tevent_req *req = tevent_req_callback_data(
2484 subreq, struct tevent_req);
2485 struct cli_tdis_state *state = tevent_req_data(
2486 req, struct cli_tdis_state);
2487 NTSTATUS status;
2488
2489 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2490 TALLOC_FREE(subreq);
2491 if (!NT_STATUS_IS_OK(status)) {
2492 tevent_req_nterror(req, status);
2493 return;
2494 }
2495 state->cli->smb1.tid = UINT16_MAX;
2496 tevent_req_done(req);
2497 }
2498
2499 NTSTATUS cli_tdis_recv(struct tevent_req *req)
2500 {
2501 return tevent_req_simple_recv_ntstatus(req);
2502 }
2503
2504 NTSTATUS cli_tdis(struct cli_state *cli)
2505 {
2506 struct tevent_context *ev;
2507 struct tevent_req *req;
2508 NTSTATUS status = NT_STATUS_NO_MEMORY;
2509
2510 if (cli_has_async_calls(cli)) {
2511 return NT_STATUS_INVALID_PARAMETER;
2512 }
2513 ev = tevent_context_init(talloc_tos());
2514 if (ev == NULL) {
2515 goto fail;
2516 }
2517 req = cli_tdis_send(ev, ev, cli);
2518 if (req == NULL) {
2519 goto fail;
2520 }
2521 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2522 goto fail;
2523 }
2524 status = cli_tdis_recv(req);
2525 fail:
2526 TALLOC_FREE(ev);
2527 return status;
2528 }
2529
2530 /****************************************************************************
2531 Send a negprot command.
2532 ****************************************************************************/
2533
2534 struct cli_negprot_state {
2535 struct cli_state *cli;
2536 enum protocol_types max_protocol;
2537 };
2538
2539 static void cli_negprot_done(struct tevent_req *subreq);
2540
2541 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
2542 struct event_context *ev,
2543 struct cli_state *cli,
2544 enum protocol_types max_protocol)
2545 {
2546 struct tevent_req *req, *subreq;
2547 struct cli_negprot_state *state;
2548 uint8_t *bytes = NULL;
2549 int numprots;
2550 enum protocol_types tmp_protocol;
2551
2552 req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
2553 if (req == NULL) {
2554 return NULL;
2555 }
2556 state->cli = cli;
2557 state->max_protocol = max_protocol;
2558
2559 /* setup the protocol strings */
2560 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
2561 uint8_t c = 2;
2562 if (prots[numprots].prot > state->max_protocol) {
2563 break;
2564 }
2565 bytes = (uint8_t *)talloc_append_blob(
2566 state, bytes, data_blob_const(&c, sizeof(c)));
2567 if (tevent_req_nomem(bytes, req)) {
2568 return tevent_req_post(req, ev);
2569 }
2570 bytes = smb_bytes_push_str(bytes, false,
2571 prots[numprots].name,
2572 strlen(prots[numprots].name)+1,
2573 NULL);
2574 if (tevent_req_nomem(bytes, req)) {
2575 return tevent_req_post(req, ev);
2576 }
2577 }
2578
2579 tmp_protocol = cli->conn.protocol;
2580 cli->conn.protocol = state->max_protocol;
2581 subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
2582 talloc_get_size(bytes), bytes);
2583 cli->conn.protocol = tmp_protocol;
2584 if (tevent_req_nomem(subreq, req)) {
2585 return tevent_req_post(req, ev);
2586 }
2587 tevent_req_set_callback(subreq, cli_negprot_done, req);
2588 return req;
2589 }
2590
2591 static void cli_negprot_done(struct tevent_req *subreq)
2592 {
2593 struct tevent_req *req = tevent_req_callback_data(
2594 subreq, struct tevent_req);
2595 struct cli_negprot_state *state = tevent_req_data(
2596 req, struct cli_negprot_state);
2597 struct cli_state *cli = state->cli;
2598 uint8_t flags;
2599 uint8_t wct;
2600 uint16_t *vwv;
2601 uint32_t num_bytes;
2602 uint8_t *bytes;
2603 NTSTATUS status;
2604 uint16_t protnum;
2605 uint8_t *inbuf;
2606 uint32_t client_capabilities = cli->conn.smb1.client.capabilities;
2607 uint32_t both_capabilities;
2608 uint32_t server_capabilities = 0;
2609 uint32_t capabilities;
2610 uint32_t client_max_xmit = cli->conn.smb1.client.max_xmit;
2611 uint32_t server_max_xmit = 0;
2612 uint32_t max_xmit;
2613 uint32_t server_max_mux = 0;
2614 uint16_t server_security_mode = 0;
2615 uint32_t server_session_key = 0;
2616 bool server_readbraw = false;
2617 bool server_writebraw = false;
2618 bool server_lockread = false;
2619 bool server_writeunlock = false;
2620 struct GUID server_guid = GUID_zero();
2621 DATA_BLOB server_gss_blob = data_blob_null;
2622 uint8_t server_challenge[8];
2623 char *server_workgroup = NULL;
2624 int server_time_zone = 0;
2625 time_t server_system_time = 0;
2626 enum protocol_types protocol;
2627
2628 ZERO_STRUCT(server_challenge);
2629
2630 status = cli_smb_recv(subreq, state, &inbuf, 1, &wct, &vwv,
2631 &num_bytes, &bytes);
2632 TALLOC_FREE(subreq);
2633 if (!NT_STATUS_IS_OK(status)) {
2634 tevent_req_nterror(req, status);
2635 return;
2636 }
2637
2638 flags = CVAL(inbuf, smb_flg);
2639
2640 protnum = SVAL(vwv, 0);
2641
2642 if ((protnum >= ARRAY_SIZE(prots))
2643 || (prots[protnum].prot > state->max_protocol)) {
2644 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2645 return;
2646 }
2647
2648 protocol = prots[protnum].prot;
2649
2650 if ((protocol < PROTOCOL_NT1) &&
2651 client_is_signing_mandatory(cli)) {
2652 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
2653 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2654 return;
2655 }
2656
2657 if (flags & FLAG_SUPPORT_LOCKREAD) {
2658 server_lockread = true;
2659 server_writeunlock = true;
2660 }
2661
2662 if (protocol >= PROTOCOL_NT1) {
2663 struct timespec ts;
2664 const char *client_signing = NULL;
2665 bool server_mandatory;
2666 bool server_allowed;
2667 const char *server_signing = NULL;
2668 bool ok;
2669 uint16_t key_len;
2670
2671 if (wct != 0x11) {
2672 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2673 return;
2674 }
2675
2676 /* NT protocol */
2677 server_security_mode = CVAL(vwv + 1, 0);
2678 server_max_mux = SVAL(vwv + 1, 1);
2679 server_max_xmit = IVAL(vwv + 3, 1);
2680 server_session_key = IVAL(vwv + 7, 1);
2681 server_time_zone = SVALS(vwv + 15, 1);
2682 server_time_zone *= 60;
2683 /* this time arrives in real GMT */
2684 ts = interpret_long_date(((char *)(vwv+11))+1);
2685 server_system_time = ts.tv_sec;
2686 server_capabilities = IVAL(vwv + 9, 1);
2687
2688 key_len = CVAL(vwv + 16, 1);
2689
2690 if (server_capabilities & CAP_RAW_MODE) {
2691 server_readbraw = true;
2692 server_writebraw = true;
2693 }
2694 if (server_capabilities & CAP_LOCK_AND_READ) {
2695 server_lockread = true;
2696 }
2697
2698 if (server_capabilities & CAP_EXTENDED_SECURITY) {
2699 DATA_BLOB blob1, blob2;
2700
2701 if (num_bytes < 16) {
2702 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2703 return;
2704 }
2705
2706 blob1 = data_blob_const(bytes, 16);
2707 GUID_from_data_blob(&blob1, &server_guid);
2708
2709 blob1 = data_blob_const(bytes+16, num_bytes-16);
2710 blob2 = data_blob_dup_talloc(state, blob1);
2711 if (blob1.length > 0 &&
2712 tevent_req_nomem(blob2.data, req)) {
2713 return;
2714 }
2715 server_gss_blob = blob2;
2716 } else {
2717 DATA_BLOB blob1;
2718 ssize_t ret;
2719
2720 if (num_bytes < key_len) {
2721 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2722 return;
2723 }
2724
2725 if (key_len != 0 && key_len != 8) {
2726 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2727 return;
2728 }
2729
2730 if (key_len == 8) {
2731 memcpy(server_challenge, bytes, 8);
2732 }
2733
2734 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
2735 if (blob1.length > 0) {
2736 ret = pull_string_talloc(state,
2737 (char *)inbuf,
2738 SVAL(inbuf, smb_flg2),
2739 &server_workgroup,
2740 blob1.data, blob1.length,
2741 STR_TERMINATE);
2742 if (ret == -1) {
2743 tevent_req_oom(req);
2744 return;
2745 }
2746 }
2747 }
2748
2749 client_signing = "disabled";
2750 if (client_is_signing_allowed(cli)) {
2751 client_signing = "allowed";
2752 }
2753 if (client_is_signing_mandatory(cli)) {
2754 client_signing = "required";
2755 }
2756
2757 server_signing = "not supported";
2758
2759 server_allowed = false;
2760 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
2761 server_signing = "supported";
2762 server_allowed = true;
2763 }
2764
2765 server_mandatory = false;
2766 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
2767 server_signing = "required";
2768 server_mandatory = true;
2769 }
2770
2771 ok = cli_set_signing_negotiated(cli,
2772 server_allowed,
2773 server_mandatory);
2774 if (!ok) {
2775 DEBUG(1,("cli_negprot: SMB signing is required, "
2776 "but client[%s] and server[%s] mismatch\n",
2777 client_signing, server_signing));
2778 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2779 return;
2780 }
2781
2782 } else if (protocol >= PROTOCOL_LANMAN1) {
2783 if (wct != 0x0D) {
2784 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2785 return;
2786 }
2787
2788 server_security_mode = SVAL(vwv + 1, 0);
2789 server_max_xmit = SVAL(vwv + 2, 0);
2790 server_max_mux = SVAL(vwv + 3, 0);
2791 server_session_key = IVAL(vwv + 6, 0);
2792 server_time_zone = SVALS(vwv + 10, 0);
2793 server_time_zone *= 60;
2794 /* this time is converted to GMT by make_unix_date */
2795 server_system_time = make_unix_date(
2796 (char *)(vwv + 8), server_time_zone);
2797 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
2798 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
2799
2800 if (num_bytes != 0 && num_bytes != 8) {
2801 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2802 return;
2803 }
2804
2805 if (num_bytes == 8) {
2806 memcpy(server_challenge, bytes, 8);
2807 }
2808 } else {
2809 /* the old core protocol */
2810 server_time_zone = get_time_zone(time(NULL));
2811 server_system_time = 0;
2812 server_max_xmit = 1024;
2813 server_max_mux = 1;
2814 server_security_mode = 0;
2815 }
2816
2817 if (server_max_xmit < 1024) {
2818 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2819 return;
2820 }
2821
2822 if (server_max_mux < 1) {
2823 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2824 return;
2825 }
2826
2827 /*
2828 * Now calculate the negotiated capabilities
2829 * based on the mask for:
2830 * - client only flags
2831 * - flags used in both directions
2832 * - server only flags
2833 */
2834 both_capabilities = client_capabilities & server_capabilities;
2835 capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
2836 capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
2837 capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
2838
2839 max_xmit = MIN(client_max_xmit, server_max_xmit);
2840
2841 if (server_workgroup) {
2842 cli->server_domain = talloc_strdup(cli, server_workgroup);
2843 if (tevent_req_nomem(cli->server_domain, req)) {
2844 return;
2845 }
2846 }
2847
2848 cli->conn.protocol = protocol;
2849
2850 cli->conn.smb1.server.capabilities = server_capabilities;
2851 cli->conn.smb1.capabilities = capabilities;
2852
2853 cli->conn.smb1.server.max_xmit = server_max_xmit;
2854 cli->conn.smb1.max_xmit = max_xmit;
2855
2856 cli->conn.smb1.server.max_mux = server_max_mux;
2857
2858 cli->conn.smb1.server.security_mode = server_security_mode;
2859
2860 cli->conn.smb1.server.readbraw = server_readbraw;
2861 cli->conn.smb1.server.writebraw = server_writebraw;
2862 cli->conn.smb1.server.lockread = server_lockread;
2863 cli->conn.smb1.server.writeunlock = server_writeunlock;
2864
2865 cli->conn.smb1.server.session_key = server_session_key;
2866
2867 talloc_steal(cli, server_gss_blob.data);
2868 cli->conn.smb1.server.gss_blob = server_gss_blob;
2869 cli->conn.smb1.server.guid = server_guid;
2870 memcpy(cli->conn.smb1.server.challenge, server_challenge, 8);
2871 cli->conn.smb1.server.workgroup = talloc_move(cli, &server_workgroup);
2872
2873 cli->conn.smb1.server.time_zone = server_time_zone;
2874 cli->conn.smb1.server.system_time = server_system_time;
2875
2876 tevent_req_done(req);
2877 }
2878
2879 NTSTATUS cli_negprot_recv(struct tevent_req *req)
2880 {
2881 return tevent_req_simple_recv_ntstatus(req);
2882 }
2883
2884 NTSTATUS cli_negprot(struct cli_state *cli, enum protocol_types max_protocol)
2885 {
2886 TALLOC_CTX *frame = talloc_stackframe();
2887 struct event_context *ev;
2888 struct tevent_req *req;
2889 NTSTATUS status = NT_STATUS_OK;
2890
2891 if (cli_has_async_calls(cli)) {
2892 /*
2893 * Can't use sync call while an async call is in flight
2894 */
2895 status = NT_STATUS_INVALID_PARAMETER;
2896 goto fail;
2897 }
2898
2899 ev = event_context_init(frame);
2900 if (ev == NULL) {
2901 status = NT_STATUS_NO_MEMORY;
2902 goto fail;
2903 }
2904
2905 req = cli_negprot_send(frame, ev, cli, max_protocol);
2906 if (req == NULL) {
2907 status = NT_STATUS_NO_MEMORY;
2908 goto fail;
2909 }
2910
2911 if (!tevent_req_poll(req, ev)) {
2912 status = map_nt_error_from_unix(errno);
2913 goto fail;
2914 }
2915
2916 status = cli_negprot_recv(req);
2917 fail:
2918 TALLOC_FREE(frame);
2919 return status;
2920 }
2921
2922 static NTSTATUS cli_connect_sock(const char *host, int name_type,
2923 const struct sockaddr_storage *pss,
2924 const char *myname, uint16_t port,
2925 int sec_timeout, int *pfd, uint16_t *pport)
2926 {
2927 TALLOC_CTX *frame = talloc_stackframe();
2928 const char *prog;
2929 unsigned int i, num_addrs;
2930 const char **called_names;
2931 const char **calling_names;
2932 int *called_types;
2933 NTSTATUS status;
2934 int fd;
2935
2936 prog = getenv("LIBSMB_PROG");
2937 if (prog != NULL) {
2938 fd = sock_exec(prog);
2939 if (fd == -1) {
2940 return map_nt_error_from_unix(errno);
2941 }
2942 port = 0;
2943 goto done;
2944 }
2945
2946 if ((pss == NULL) || is_zero_addr(pss)) {
2947 struct sockaddr_storage *addrs;
2948 status = resolve_name_list(talloc_tos(), host, name_type,
2949 &addrs, &num_addrs);
2950 if (!NT_STATUS_IS_OK(status)) {
2951 goto fail;
2952 }
2953 pss = addrs;
2954 } else {
2955 num_addrs = 1;
2956 }
2957
2958 called_names = talloc_array(talloc_tos(), const char *, num_addrs);
2959 if (called_names == NULL) {
2960 status = NT_STATUS_NO_MEMORY;
2961 goto fail;
2962 }
2963 called_types = talloc_array(talloc_tos(), int, num_addrs);
2964 if (called_types == NULL) {
2965 status = NT_STATUS_NO_MEMORY;
2966 goto fail;
2967 }
2968 calling_names = talloc_array(talloc_tos(), const char *, num_addrs);
2969 if (calling_names == NULL) {
2970 status = NT_STATUS_NO_MEMORY;
2971 goto fail;
2972 }
2973 for (i=0; i<num_addrs; i++) {
2974 called_names[i] = host;
2975 called_types[i] = name_type;
2976 calling_names[i] = myname;
2977 }
2978 status = smbsock_any_connect(pss, called_names, called_types,
2979 calling_names, NULL, num_addrs, port,
2980 sec_timeout, &fd, NULL, &port);
2981 if (!NT_STATUS_IS_OK(status)) {
2982 goto fail;
2983 }
2984 set_socket_options(fd, lp_socket_options());
2985 done:
2986 *pfd = fd;
2987 *pport = port;
2988 status = NT_STATUS_OK;
2989 fail:
2990 TALLOC_FREE(frame);
2991 return status;
2992 }
2993
2994 NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss,
2995 uint16_t port, int name_type, const char *myname,
2996 int signing_state, int flags, struct cli_state **pcli)
2997 {
2998 TALLOC_CTX *frame = talloc_stackframe();
2999 struct cli_state *cli;
3000 NTSTATUS status = NT_STATUS_NO_MEMORY;
3001 int fd = -1;
3002 char *desthost;
3003 char *p;
3004
3005 desthost = talloc_strdup(talloc_tos(), host);
3006 if (desthost == NULL) {
3007 goto fail;
3008 }
3009
3010 p = strchr(host, '#');
3011 if (p != NULL) {
3012 name_type = strtol(p+1, NULL, 16);
3013 host = talloc_strndup(talloc_tos(), host, p - host);
3014 if (host == NULL) {
3015 goto fail;
3016 }
3017 }
3018
3019 status = cli_connect_sock(host, name_type, dest_ss, myname, port,
3020 20, &fd, &port);
3021 if (!NT_STATUS_IS_OK(status)) {
3022 goto fail;
3023 }
3024
3025 cli = cli_state_create(NULL, fd, desthost, NULL, signing_state, flags);
3026 if (cli == NULL) {
3027 goto fail;
3028 }
3029
3030 *pcli = cli;
3031 status = NT_STATUS_OK;
3032 fail:
3033 TALLOC_FREE(frame);
3034 return status;
3035 }
3036
3037 /**
3038 establishes a connection to after the negprot.
3039 @param output_cli A fully initialised cli structure, non-null only on success
3040 @param dest_host The netbios name of the remote host
3041 @param dest_ss (optional) The the destination IP, NULL for name based lookup
3042 @param port (optional) The destination port (0 for default)
3043 */
3044 NTSTATUS cli_start_connection(struct cli_state **output_cli,
3045 const char *my_name,
3046 const char *dest_host,
3047 const struct sockaddr_storage *dest_ss, int port,
3048 int signing_state, int flags)
3049 {
3050 NTSTATUS nt_status;
3051 struct cli_state *cli;
3052
3053 nt_status = cli_connect_nb(dest_host, dest_ss, port, 0x20, my_name,
3054 signing_state, flags, &cli);
3055 if (!NT_STATUS_IS_OK(nt_status)) {
3056 DEBUG(10, ("cli_connect_nb failed: %s\n",
3057 nt_errstr(nt_status)));
3058 return nt_status;
3059 }
3060
3061 nt_status = cli_negprot(cli, PROTOCOL_NT1);
3062 if (!NT_STATUS_IS_OK(nt_status)) {
3063 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
3064 cli_shutdown(cli);
3065 return nt_status;
3066 }
3067
3068 *output_cli = cli;
3069 return NT_STATUS_OK;
3070 }
3071
3072
3073 /**
3074 establishes a connection right up to doing tconX, password specified.
3075 @param output_cli A fully initialised cli structure, non-null only on success
3076 @param dest_host The netbios name of the remote host
3077 @param dest_ip (optional) The the destination IP, NULL for name based lookup
3078 @param port (optional) The destination port (0 for default)
3079 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
3080 @param service_type The 'type' of serivice.
3081 @param user Username, unix string
3082 @param domain User's domain
3083 @param password User's password, unencrypted unix string.
3084 */
3085
3086 NTSTATUS cli_full_connection(struct cli_state **output_cli,
3087 const char *my_name,
3088 const char *dest_host,
3089 const struct sockaddr_storage *dest_ss, int port,
3090 const char *service, const char *service_type,
3091 const char *user, const char *domain,
3092 const char *password, int flags,
3093 int signing_state)
3094 {
3095 NTSTATUS nt_status;
3096 struct cli_state *cli = NULL;
3097 int pw_len = password ? strlen(password)+1 : 0;
3098
3099 *output_cli = NULL;
3100
3101 if (password == NULL) {
3102 password = "";
3103 }
3104
3105 nt_status = cli_start_connection(&cli, my_name, dest_host,
3106 dest_ss, port, signing_state,
3107 flags);
3108
3109 if (!NT_STATUS_IS_OK(nt_status)) {
3110 return nt_status;
3111 }
3112
3113 nt_status = cli_session_setup(cli, user, password, pw_len, password,
3114 pw_len, domain);
3115 if (!NT_STATUS_IS_OK(nt_status)) {
3116
3117 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
3118 DEBUG(1,("failed session setup with %s\n",
3119 nt_errstr(nt_status)));
3120 cli_shutdown(cli);
3121 return nt_status;
3122 }
3123
3124 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
3125 if (!NT_STATUS_IS_OK(nt_status)) {
3126 DEBUG(1,("anonymous failed session setup with %s\n",
3127 nt_errstr(nt_status)));
3128 cli_shutdown(cli);
3129 return nt_status;
3130 }
3131 }
3132
3133 if (service) {
3134 nt_status = cli_tcon_andx(cli, service, service_type, password,
3135 pw_len);
3136 if (!NT_STATUS_IS_OK(nt_status)) {
3137 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
3138 cli_shutdown(cli);
3139 if (NT_STATUS_IS_OK(nt_status)) {
3140 nt_status = NT_STATUS_UNSUCCESSFUL;
3141 }
3142 return nt_status;
3143 }
3144 }
3145
3146 nt_status = cli_init_creds(cli, user, domain, password);
3147 if (!NT_STATUS_IS_OK(nt_status)) {
3148 cli_shutdown(cli);
3149 return nt_status;
3150 }
3151
3152 *output_cli = cli;
3153 return NT_STATUS_OK;
3154 }
3155
3156 /****************************************************************************
3157 Send an old style tcon.
3158 ****************************************************************************/
3159 NTSTATUS cli_raw_tcon(struct cli_state *cli,
3160 const char *service, const char *pass, const char *dev,
3161 uint16 *max_xmit, uint16 *tid)
3162 {
3163 struct tevent_req *req;
3164 uint16_t *ret_vwv;
3165 uint8_t *bytes;
3166 NTSTATUS status;
3167
3168 if (!lp_client_plaintext_auth() && (*pass)) {
3169 DEBUG(1, ("Server requested plaintext password but 'client "
3170 "plaintext auth' is disabled\n"));
3171 return NT_STATUS_ACCESS_DENIED;
3172 }
3173
3174 bytes = talloc_array(talloc_tos(), uint8_t, 0);
3175 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
3176 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
3177 service, strlen(service)+1, NULL);
3178 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
3179 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
3180 pass, strlen(pass)+1, NULL);
3181 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
3182 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
3183 dev, strlen(dev)+1, NULL);
3184
3185 status = cli_smb(talloc_tos(), cli, SMBtcon, 0, 0, NULL,
3186 talloc_get_size(bytes), bytes, &req,
3187 2, NULL, &ret_vwv, NULL, NULL);
3188 if (!NT_STATUS_IS_OK(status)) {
3189 return status;
3190 }
3191
3192 *max_xmit = SVAL(ret_vwv + 0, 0);
3193 *tid = SVAL(ret_vwv + 1, 0);
3194
3195 return NT_STATUS_OK;
3196 }
3197
3198 /* Return a cli_state pointing at the IPC$ share for the given server */
3199
3200 struct cli_state *get_ipc_connect(char *server,
3201 struct sockaddr_storage *server_ss,
3202 const struct user_auth_info *user_info)
3203 {
3204 struct cli_state *cli;
3205 NTSTATUS nt_status;
3206 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
3207
3208 if (user_info->use_kerberos) {
3209 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
3210 }
3211
3212 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
3213 user_info->username ? user_info->username : "",
3214 lp_workgroup(),
3215 user_info->password ? user_info->password : "",
3216 flags,
3217 Undefined);
3218
3219 if (NT_STATUS_IS_OK(nt_status)) {
3220 return cli;
3221 } else if (is_ipaddress(server)) {
3222 /* windows 9* needs a correct NMB name for connections */
3223 fstring remote_name;
3224
3225 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
3226 cli = get_ipc_connect(remote_name, server_ss, user_info);
3227 if (cli)
3228 return cli;
3229 }
3230 }
3231 return NULL;
3232 }
3233
3234 /*
3235 * Given the IP address of a master browser on the network, return its
3236 * workgroup and connect to it.
3237 *
3238 * This function is provided to allow additional processing beyond what
3239 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
3240 * browsers and obtain each master browsers' list of domains (in case the
3241 * first master browser is recently on the network and has not yet
3242 * synchronized with other master browsers and therefore does not yet have the
3243 * entire network browse list)
3244 */
3245
3246 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
3247 struct sockaddr_storage *mb_ip,
3248 const struct user_auth_info *user_info,
3249 char **pp_workgroup_out)
3250 {
3251 char addr[INET6_ADDRSTRLEN];
3252 fstring name;
3253 struct cli_state *cli;
3254 struct sockaddr_storage server_ss;
3255
3256 *pp_workgroup_out = NULL;
3257
3258 print_sockaddr(addr, sizeof(addr), mb_ip);
3259 DEBUG(99, ("Looking up name of master browser %s\n",
3260 addr));
3261
3262 /*
3263 * Do a name status query to find out the name of the master browser.
3264 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
3265 * master browser will not respond to a wildcard query (or, at least,
3266 * an NT4 server acting as the domain master browser will not).
3267 *
3268 * We might be able to use ONLY the query on MSBROWSE, but that's not
3269 * yet been tested with all Windows versions, so until it is, leave
3270 * the original wildcard query as the first choice and fall back to
3271 * MSBROWSE if the wildcard query fails.
3272 */
3273 if (!name_status_find("*", 0, 0x1d, mb_ip, name) &&
3274 !name_status_find(MSBROWSE, 1, 0x1d, mb_ip, name)) {
3275
3276 DEBUG(99, ("Could not retrieve name status for %s\n",
3277 addr));
3278 return NULL;
3279 }
3280
3281 if (!find_master_ip(name, &server_ss)) {
3282 DEBUG(99, ("Could not find master ip for %s\n", name));
3283 return NULL;
3284 }
3285
3286 *pp_workgroup_out = talloc_strdup(ctx, name);
3287
3288 DEBUG(4, ("found master browser %s, %s\n", name, addr));
3289
3290 print_sockaddr(addr, sizeof(addr), &server_ss);
3291 cli = get_ipc_connect(addr, &server_ss, user_info);
3292
3293 return cli;
3294 }
3295
3296 /*
3297 * Return the IP address and workgroup of a master browser on the network, and
3298 * connect to it.
3299 */
3300
3301 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
3302 const struct user_auth_info *user_info,
3303 char **pp_workgroup_out)
3304 {
3305 struct sockaddr_storage *ip_list;
3306 struct cli_state *cli;
3307 int i, count;
3308 NTSTATUS status;
3309
3310 *pp_workgroup_out = NULL;
3311
3312 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
3313
3314 /* Go looking for workgroups by broadcasting on the local network */
3315
3316 status = name_resolve_bcast(MSBROWSE, 1, talloc_tos(),
3317 &ip_list, &count);
3318 if (!NT_STATUS_IS_OK(status)) {
3319 DEBUG(99, ("No master browsers responded: %s\n",
3320 nt_errstr(status)));
3321 return False;
3322 }
3323
3324 for (i = 0; i < count; i++) {
3325 char addr[INET6_ADDRSTRLEN];
3326 print_sockaddr(addr, sizeof(addr), &ip_list[i]);
3327 DEBUG(99, ("Found master browser %s\n", addr));
3328
3329 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
3330 user_info, pp_workgroup_out);
3331 if (cli)
3332 return(cli);
3333 }
3334
3335 return NULL;
3336 }