?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-drs: EXOP_REPL_SECRETS can be called by RW DC as well
[Samba/gbeck.git] / source3 / libsmb / cliconnect.c
blob9ce013ee6427f5963f80ec1ba1fa074313c5b16f
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6 Copyright (C) Volker Lendecke 2011
7 Copyright (C) Jeremy Allison 2011
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "libsmb/libsmb.h"
25 #include "auth_info.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../libcli/auth/spnego.h"
28 #include "smb_krb5.h"
29 #include "../auth/ntlmssp/ntlmssp.h"
30 #include "libads/kerberos_proto.h"
31 #include "krb5_env.h"
32 #include "../lib/util/tevent_ntstatus.h"
33 #include "async_smb.h"
34 #include "libsmb/nmblib.h"
35 #include "librpc/ndr/libndr.h"
36 #include "../libcli/smb/smbXcli_base.h"
37 #include "smb2cli.h"
38
39 #define STAR_SMBSERVER "*SMBSERVER"
40
41 /********************************************************
42 Utility function to ensure we always return at least
43 a valid char * pointer to an empty string for the
44 cli->server_os, cli->server_type and cli->server_domain
45 strings.
46 *******************************************************/
47
48 static NTSTATUS smb_bytes_talloc_string(TALLOC_CTX *mem_ctx,
49 const uint8_t *hdr,
50 char **dest,
51 uint8_t *src,
52 size_t srclen,
53 ssize_t *destlen)
54 {
55 *destlen = clistr_pull_talloc(mem_ctx,
56 (const char *)hdr,
57 SVAL(hdr, HDR_FLG2),
58 dest,
59 (char *)src,
60 srclen,
61 STR_TERMINATE);
62 if (*destlen == -1) {
63 return NT_STATUS_NO_MEMORY;
64 }
65
66 if (*dest == NULL) {
67 *dest = talloc_strdup(mem_ctx, "");
68 if (*dest == NULL) {
69 return NT_STATUS_NO_MEMORY;
70 }
71 }
72 return NT_STATUS_OK;
73 }
74
75 /****************************************************************************
76 Do an old lanman2 style session setup.
77 ****************************************************************************/
78
79 struct cli_session_setup_lanman2_state {
80 struct cli_state *cli;
81 uint16_t vwv[10];
82 const char *user;
83 };
84
85 static void cli_session_setup_lanman2_done(struct tevent_req *subreq);
86
87 static struct tevent_req *cli_session_setup_lanman2_send(
88 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
89 struct cli_state *cli, const char *user,
90 const char *pass, size_t passlen,
91 const char *workgroup)
92 {
93 struct tevent_req *req, *subreq;
94 struct cli_session_setup_lanman2_state *state;
95 DATA_BLOB lm_response = data_blob_null;
96 uint16_t *vwv;
97 uint8_t *bytes;
98 char *tmp;
99 uint16_t sec_mode = smb1cli_conn_server_security_mode(cli->conn);
100
101 req = tevent_req_create(mem_ctx, &state,
102 struct cli_session_setup_lanman2_state);
103 if (req == NULL) {
104 return NULL;
105 }
106 state->cli = cli;
107 state->user = user;
108 vwv = state->vwv;
109
110 /*
111 * if in share level security then don't send a password now
112 */
113 if (!(sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
114 passlen = 0;
115 }
116
117 if (passlen > 0
118 && (sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
119 && passlen != 24) {
120 /*
121 * Encrypted mode needed, and non encrypted password
122 * supplied.
123 */
124 lm_response = data_blob(NULL, 24);
125 if (tevent_req_nomem(lm_response.data, req)) {
126 return tevent_req_post(req, ev);
127 }
128
129 if (!SMBencrypt(pass, smb1cli_conn_server_challenge(cli->conn),
130 (uint8_t *)lm_response.data)) {
131 DEBUG(1, ("Password is > 14 chars in length, and is "
132 "therefore incompatible with Lanman "
133 "authentication\n"));
134 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
135 return tevent_req_post(req, ev);
136 }
137 } else if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
138 && passlen == 24) {
139 /*
140 * Encrypted mode needed, and encrypted password
141 * supplied.
142 */
143 lm_response = data_blob(pass, passlen);
144 if (tevent_req_nomem(lm_response.data, req)) {
145 return tevent_req_post(req, ev);
146 }
147 } else if (passlen > 0) {
148 uint8_t *buf;
149 size_t converted_size;
150 /*
151 * Plaintext mode needed, assume plaintext supplied.
152 */
153 buf = talloc_array(talloc_tos(), uint8_t, 0);
154 buf = smb_bytes_push_str(buf, smbXcli_conn_use_unicode(cli->conn), pass, passlen+1,
155 &converted_size);
156 if (tevent_req_nomem(buf, req)) {
157 return tevent_req_post(req, ev);
158 }
159 lm_response = data_blob(pass, passlen);
160 TALLOC_FREE(buf);
161 if (tevent_req_nomem(lm_response.data, req)) {
162 return tevent_req_post(req, ev);
163 }
164 }
165
166 SCVAL(vwv+0, 0, 0xff);
167 SCVAL(vwv+0, 1, 0);
168 SSVAL(vwv+1, 0, 0);
169 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
170 SSVAL(vwv+3, 0, 2);
171 SSVAL(vwv+4, 0, 1);
172 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
173 SSVAL(vwv+7, 0, lm_response.length);
174
175 bytes = talloc_array(state, uint8_t, lm_response.length);
176 if (tevent_req_nomem(bytes, req)) {
177 return tevent_req_post(req, ev);
178 }
179 if (lm_response.length != 0) {
180 memcpy(bytes, lm_response.data, lm_response.length);
181 }
182 data_blob_free(&lm_response);
183
184 tmp = talloc_strdup_upper(talloc_tos(), user);
185 if (tevent_req_nomem(tmp, req)) {
186 return tevent_req_post(req, ev);
187 }
188 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), tmp, strlen(tmp)+1,
189 NULL);
190 TALLOC_FREE(tmp);
191
192 tmp = talloc_strdup_upper(talloc_tos(), workgroup);
193 if (tevent_req_nomem(tmp, req)) {
194 return tevent_req_post(req, ev);
195 }
196 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), tmp, strlen(tmp)+1,
197 NULL);
198 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Unix", 5, NULL);
199 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Samba", 6, NULL);
200
201 if (tevent_req_nomem(bytes, req)) {
202 return tevent_req_post(req, ev);
203 }
204
205 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 10, vwv,
206 talloc_get_size(bytes), bytes);
207 if (tevent_req_nomem(subreq, req)) {
208 return tevent_req_post(req, ev);
209 }
210 tevent_req_set_callback(subreq, cli_session_setup_lanman2_done, req);
211 return req;
212 }
213
214 static void cli_session_setup_lanman2_done(struct tevent_req *subreq)
215 {
216 struct tevent_req *req = tevent_req_callback_data(
217 subreq, struct tevent_req);
218 struct cli_session_setup_lanman2_state *state = tevent_req_data(
219 req, struct cli_session_setup_lanman2_state);
220 struct cli_state *cli = state->cli;
221 uint32_t num_bytes;
222 uint8_t *in;
223 uint8_t *inhdr;
224 uint8_t *bytes;
225 uint8_t *p;
226 NTSTATUS status;
227 ssize_t ret;
228 uint8_t wct;
229 uint16_t *vwv;
230
231 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
232 &num_bytes, &bytes);
233 TALLOC_FREE(subreq);
234 if (!NT_STATUS_IS_OK(status)) {
235 tevent_req_nterror(req, status);
236 return;
237 }
238
239 inhdr = in + NBT_HDR_SIZE;
240 p = bytes;
241
242 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
243 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
244
245 status = smb_bytes_talloc_string(cli,
246 inhdr,
247 &cli->server_os,
248 p,
249 bytes+num_bytes-p,
250 &ret);
251
252 if (!NT_STATUS_IS_OK(status)) {
253 tevent_req_nterror(req, status);
254 return;
255 }
256 p += ret;
257
258 status = smb_bytes_talloc_string(cli,
259 inhdr,
260 &cli->server_type,
261 p,
262 bytes+num_bytes-p,
263 &ret);
264
265 if (!NT_STATUS_IS_OK(status)) {
266 tevent_req_nterror(req, status);
267 return;
268 }
269 p += ret;
270
271 status = smb_bytes_talloc_string(cli,
272 inhdr,
273 &cli->server_domain,
274 p,
275 bytes+num_bytes-p,
276 &ret);
277
278 if (!NT_STATUS_IS_OK(status)) {
279 tevent_req_nterror(req, status);
280 return;
281 }
282 p += ret;
283
284 status = cli_set_username(cli, state->user);
285 if (tevent_req_nterror(req, status)) {
286 return;
287 }
288 tevent_req_done(req);
289 }
290
291 static NTSTATUS cli_session_setup_lanman2_recv(struct tevent_req *req)
292 {
293 return tevent_req_simple_recv_ntstatus(req);
294 }
295
296 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli, const char *user,
297 const char *pass, size_t passlen,
298 const char *workgroup)
299 {
300 TALLOC_CTX *frame = talloc_stackframe();
301 struct event_context *ev;
302 struct tevent_req *req;
303 NTSTATUS status = NT_STATUS_NO_MEMORY;
304
305 if (smbXcli_conn_has_async_calls(cli->conn)) {
306 /*
307 * Can't use sync call while an async call is in flight
308 */
309 status = NT_STATUS_INVALID_PARAMETER;
310 goto fail;
311 }
312 ev = event_context_init(frame);
313 if (ev == NULL) {
314 goto fail;
315 }
316 req = cli_session_setup_lanman2_send(frame, ev, cli, user, pass, passlen,
317 workgroup);
318 if (req == NULL) {
319 goto fail;
320 }
321 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
322 goto fail;
323 }
324 status = cli_session_setup_lanman2_recv(req);
325 fail:
326 TALLOC_FREE(frame);
327 return status;
328 }
329
330 /****************************************************************************
331 Work out suitable capabilities to offer the server.
332 ****************************************************************************/
333
334 static uint32_t cli_session_setup_capabilities(struct cli_state *cli,
335 uint32_t sesssetup_capabilities)
336 {
337 uint32_t client_capabilities = smb1cli_conn_capabilities(cli->conn);
338
339 /*
340 * We only send capabilities based on the mask for:
341 * - client only flags
342 * - flags used in both directions
343 *
344 * We do not echo the server only flags.
345 */
346 client_capabilities &= (SMB_CAP_BOTH_MASK | SMB_CAP_CLIENT_MASK);
347
348 /*
349 * Session Setup specific flags CAP_DYNAMIC_REAUTH
350 * and CAP_EXTENDED_SECURITY are passed by the caller.
351 * We need that in order to do guest logins even if
352 * CAP_EXTENDED_SECURITY is negotiated.
353 */
354 client_capabilities &= ~(CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
355 sesssetup_capabilities &= (CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
356 client_capabilities |= sesssetup_capabilities;
357
358 return client_capabilities;
359 }
360
361 /****************************************************************************
362 Do a NT1 guest session setup.
363 ****************************************************************************/
364
365 struct cli_session_setup_guest_state {
366 struct cli_state *cli;
367 uint16_t vwv[13];
368 struct iovec bytes;
369 };
370
371 static void cli_session_setup_guest_done(struct tevent_req *subreq);
372
373 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
374 struct event_context *ev,
375 struct cli_state *cli,
376 struct tevent_req **psmbreq)
377 {
378 struct tevent_req *req, *subreq;
379 struct cli_session_setup_guest_state *state;
380 uint16_t *vwv;
381 uint8_t *bytes;
382
383 req = tevent_req_create(mem_ctx, &state,
384 struct cli_session_setup_guest_state);
385 if (req == NULL) {
386 return NULL;
387 }
388 state->cli = cli;
389 vwv = state->vwv;
390
391 SCVAL(vwv+0, 0, 0xFF);
392 SCVAL(vwv+0, 1, 0);
393 SSVAL(vwv+1, 0, 0);
394 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
395 SSVAL(vwv+3, 0, 2);
396 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
397 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
398 SSVAL(vwv+7, 0, 0);
399 SSVAL(vwv+8, 0, 0);
400 SSVAL(vwv+9, 0, 0);
401 SSVAL(vwv+10, 0, 0);
402 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
403
404 bytes = talloc_array(state, uint8_t, 0);
405
406 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "", 1, /* username */
407 NULL);
408 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "", 1, /* workgroup */
409 NULL);
410 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Unix", 5, NULL);
411 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Samba", 6, NULL);
412
413 if (bytes == NULL) {
414 TALLOC_FREE(req);
415 return NULL;
416 }
417
418 state->bytes.iov_base = (void *)bytes;
419 state->bytes.iov_len = talloc_get_size(bytes);
420
421 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
422 1, &state->bytes);
423 if (subreq == NULL) {
424 TALLOC_FREE(req);
425 return NULL;
426 }
427 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
428 *psmbreq = subreq;
429 return req;
430 }
431
432 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
433 struct event_context *ev,
434 struct cli_state *cli)
435 {
436 struct tevent_req *req, *subreq;
437 NTSTATUS status;
438
439 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
440 if (req == NULL) {
441 return NULL;
442 }
443
444 status = smb1cli_req_chain_submit(&subreq, 1);
445 if (NT_STATUS_IS_OK(status)) {
446 tevent_req_nterror(req, status);
447 return tevent_req_post(req, ev);
448 }
449 return req;
450 }
451
452 static void cli_session_setup_guest_done(struct tevent_req *subreq)
453 {
454 struct tevent_req *req = tevent_req_callback_data(
455 subreq, struct tevent_req);
456 struct cli_session_setup_guest_state *state = tevent_req_data(
457 req, struct cli_session_setup_guest_state);
458 struct cli_state *cli = state->cli;
459 uint32_t num_bytes;
460 uint8_t *in;
461 uint8_t *inhdr;
462 uint8_t *bytes;
463 uint8_t *p;
464 NTSTATUS status;
465 ssize_t ret;
466 uint8_t wct;
467 uint16_t *vwv;
468
469 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
470 &num_bytes, &bytes);
471 TALLOC_FREE(subreq);
472 if (!NT_STATUS_IS_OK(status)) {
473 tevent_req_nterror(req, status);
474 return;
475 }
476
477 inhdr = in + NBT_HDR_SIZE;
478 p = bytes;
479
480 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
481 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
482
483 status = smb_bytes_talloc_string(cli,
484 inhdr,
485 &cli->server_os,
486 p,
487 bytes+num_bytes-p,
488 &ret);
489
490 if (!NT_STATUS_IS_OK(status)) {
491 tevent_req_nterror(req, status);
492 return;
493 }
494 p += ret;
495
496 status = smb_bytes_talloc_string(cli,
497 inhdr,
498 &cli->server_type,
499 p,
500 bytes+num_bytes-p,
501 &ret);
502
503 if (!NT_STATUS_IS_OK(status)) {
504 tevent_req_nterror(req, status);
505 return;
506 }
507 p += ret;
508
509 status = smb_bytes_talloc_string(cli,
510 inhdr,
511 &cli->server_domain,
512 p,
513 bytes+num_bytes-p,
514 &ret);
515
516 if (!NT_STATUS_IS_OK(status)) {
517 tevent_req_nterror(req, status);
518 return;
519 }
520 p += ret;
521
522 status = cli_set_username(cli, "");
523 if (!NT_STATUS_IS_OK(status)) {
524 tevent_req_nterror(req, status);
525 return;
526 }
527 tevent_req_done(req);
528 }
529
530 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
531 {
532 return tevent_req_simple_recv_ntstatus(req);
533 }
534
535 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
536 {
537 TALLOC_CTX *frame = talloc_stackframe();
538 struct event_context *ev;
539 struct tevent_req *req;
540 NTSTATUS status = NT_STATUS_OK;
541
542 if (smbXcli_conn_has_async_calls(cli->conn)) {
543 /*
544 * Can't use sync call while an async call is in flight
545 */
546 status = NT_STATUS_INVALID_PARAMETER;
547 goto fail;
548 }
549
550 ev = event_context_init(frame);
551 if (ev == NULL) {
552 status = NT_STATUS_NO_MEMORY;
553 goto fail;
554 }
555
556 req = cli_session_setup_guest_send(frame, ev, cli);
557 if (req == NULL) {
558 status = NT_STATUS_NO_MEMORY;
559 goto fail;
560 }
561
562 if (!tevent_req_poll(req, ev)) {
563 status = map_nt_error_from_unix(errno);
564 goto fail;
565 }
566
567 status = cli_session_setup_guest_recv(req);
568 fail:
569 TALLOC_FREE(frame);
570 return status;
571 }
572
573 /****************************************************************************
574 Do a NT1 plaintext session setup.
575 ****************************************************************************/
576
577 struct cli_session_setup_plain_state {
578 struct cli_state *cli;
579 uint16_t vwv[13];
580 const char *user;
581 };
582
583 static void cli_session_setup_plain_done(struct tevent_req *subreq);
584
585 static struct tevent_req *cli_session_setup_plain_send(
586 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
587 struct cli_state *cli,
588 const char *user, const char *pass, const char *workgroup)
589 {
590 struct tevent_req *req, *subreq;
591 struct cli_session_setup_plain_state *state;
592 uint16_t *vwv;
593 uint8_t *bytes;
594 size_t passlen;
595 char *version;
596
597 req = tevent_req_create(mem_ctx, &state,
598 struct cli_session_setup_plain_state);
599 if (req == NULL) {
600 return NULL;
601 }
602 state->cli = cli;
603 state->user = user;
604 vwv = state->vwv;
605
606 SCVAL(vwv+0, 0, 0xff);
607 SCVAL(vwv+0, 1, 0);
608 SSVAL(vwv+1, 0, 0);
609 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
610 SSVAL(vwv+3, 0, 2);
611 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
612 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
613 SSVAL(vwv+7, 0, 0);
614 SSVAL(vwv+8, 0, 0);
615 SSVAL(vwv+9, 0, 0);
616 SSVAL(vwv+10, 0, 0);
617 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
618
619 bytes = talloc_array(state, uint8_t, 0);
620 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), pass, strlen(pass)+1,
621 &passlen);
622 if (tevent_req_nomem(bytes, req)) {
623 return tevent_req_post(req, ev);
624 }
625 SSVAL(vwv + (smbXcli_conn_use_unicode(cli->conn) ? 8 : 7), 0, passlen);
626
627 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
628 user, strlen(user)+1, NULL);
629 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
630 workgroup, strlen(workgroup)+1, NULL);
631 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
632 "Unix", 5, NULL);
633
634 version = talloc_asprintf(talloc_tos(), "Samba %s",
635 samba_version_string());
636 if (tevent_req_nomem(version, req)){
637 return tevent_req_post(req, ev);
638 }
639 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
640 version, strlen(version)+1, NULL);
641 TALLOC_FREE(version);
642
643 if (tevent_req_nomem(bytes, req)) {
644 return tevent_req_post(req, ev);
645 }
646
647 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
648 talloc_get_size(bytes), bytes);
649 if (tevent_req_nomem(subreq, req)) {
650 return tevent_req_post(req, ev);
651 }
652 tevent_req_set_callback(subreq, cli_session_setup_plain_done, req);
653 return req;
654 }
655
656 static void cli_session_setup_plain_done(struct tevent_req *subreq)
657 {
658 struct tevent_req *req = tevent_req_callback_data(
659 subreq, struct tevent_req);
660 struct cli_session_setup_plain_state *state = tevent_req_data(
661 req, struct cli_session_setup_plain_state);
662 struct cli_state *cli = state->cli;
663 uint32_t num_bytes;
664 uint8_t *in;
665 uint8_t *inhdr;
666 uint8_t *bytes;
667 uint8_t *p;
668 NTSTATUS status;
669 ssize_t ret;
670 uint8_t wct;
671 uint16_t *vwv;
672
673 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
674 &num_bytes, &bytes);
675 TALLOC_FREE(subreq);
676 if (tevent_req_nterror(req, status)) {
677 return;
678 }
679
680 inhdr = in + NBT_HDR_SIZE;
681 p = bytes;
682
683 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
684 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
685
686 status = smb_bytes_talloc_string(cli,
687 inhdr,
688 &cli->server_os,
689 p,
690 bytes+num_bytes-p,
691 &ret);
692
693 if (!NT_STATUS_IS_OK(status)) {
694 tevent_req_nterror(req, status);
695 return;
696 }
697 p += ret;
698
699 status = smb_bytes_talloc_string(cli,
700 inhdr,
701 &cli->server_type,
702 p,
703 bytes+num_bytes-p,
704 &ret);
705
706 if (!NT_STATUS_IS_OK(status)) {
707 tevent_req_nterror(req, status);
708 return;
709 }
710 p += ret;
711
712 status = smb_bytes_talloc_string(cli,
713 inhdr,
714 &cli->server_domain,
715 p,
716 bytes+num_bytes-p,
717 &ret);
718
719 if (!NT_STATUS_IS_OK(status)) {
720 tevent_req_nterror(req, status);
721 return;
722 }
723 p += ret;
724
725 status = cli_set_username(cli, state->user);
726 if (tevent_req_nterror(req, status)) {
727 return;
728 }
729
730 tevent_req_done(req);
731 }
732
733 static NTSTATUS cli_session_setup_plain_recv(struct tevent_req *req)
734 {
735 return tevent_req_simple_recv_ntstatus(req);
736 }
737
738 static NTSTATUS cli_session_setup_plain(struct cli_state *cli,
739 const char *user, const char *pass,
740 const char *workgroup)
741 {
742 TALLOC_CTX *frame = talloc_stackframe();
743 struct event_context *ev;
744 struct tevent_req *req;
745 NTSTATUS status = NT_STATUS_NO_MEMORY;
746
747 if (smbXcli_conn_has_async_calls(cli->conn)) {
748 /*
749 * Can't use sync call while an async call is in flight
750 */
751 status = NT_STATUS_INVALID_PARAMETER;
752 goto fail;
753 }
754 ev = event_context_init(frame);
755 if (ev == NULL) {
756 goto fail;
757 }
758 req = cli_session_setup_plain_send(frame, ev, cli, user, pass,
759 workgroup);
760 if (req == NULL) {
761 goto fail;
762 }
763 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
764 goto fail;
765 }
766 status = cli_session_setup_plain_recv(req);
767 fail:
768 TALLOC_FREE(frame);
769 return status;
770 }
771
772 /****************************************************************************
773 do a NT1 NTLM/LM encrypted session setup - for when extended security
774 is not negotiated.
775 @param cli client state to create do session setup on
776 @param user username
777 @param pass *either* cleartext password (passlen !=24) or LM response.
778 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
779 @param workgroup The user's domain.
780 ****************************************************************************/
781
782 struct cli_session_setup_nt1_state {
783 struct cli_state *cli;
784 uint16_t vwv[13];
785 DATA_BLOB response;
786 DATA_BLOB session_key;
787 const char *user;
788 };
789
790 static void cli_session_setup_nt1_done(struct tevent_req *subreq);
791
792 static struct tevent_req *cli_session_setup_nt1_send(
793 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
794 struct cli_state *cli, const char *user,
795 const char *pass, size_t passlen,
796 const char *ntpass, size_t ntpasslen,
797 const char *workgroup)
798 {
799 struct tevent_req *req, *subreq;
800 struct cli_session_setup_nt1_state *state;
801 DATA_BLOB lm_response = data_blob_null;
802 DATA_BLOB nt_response = data_blob_null;
803 DATA_BLOB session_key = data_blob_null;
804 uint16_t *vwv;
805 uint8_t *bytes;
806 char *workgroup_upper;
807
808 req = tevent_req_create(mem_ctx, &state,
809 struct cli_session_setup_nt1_state);
810 if (req == NULL) {
811 return NULL;
812 }
813 state->cli = cli;
814 state->user = user;
815 vwv = state->vwv;
816
817 if (passlen == 0) {
818 /* do nothing - guest login */
819 } else if (passlen != 24) {
820 if (lp_client_ntlmv2_auth()) {
821 DATA_BLOB server_chal;
822 DATA_BLOB names_blob;
823
824 server_chal =
825 data_blob_const(smb1cli_conn_server_challenge(cli->conn),
826 8);
827
828 /*
829 * note that the 'workgroup' here is a best
830 * guess - we don't know the server's domain
831 * at this point. Windows clients also don't
832 * use hostname...
833 */
834 names_blob = NTLMv2_generate_names_blob(
835 NULL, NULL, workgroup);
836
837 if (tevent_req_nomem(names_blob.data, req)) {
838 return tevent_req_post(req, ev);
839 }
840
841 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass,
842 &server_chal, &names_blob,
843 &lm_response, &nt_response,
844 NULL, &session_key)) {
845 data_blob_free(&names_blob);
846 tevent_req_nterror(
847 req, NT_STATUS_ACCESS_DENIED);
848 return tevent_req_post(req, ev);
849 }
850 data_blob_free(&names_blob);
851
852 } else {
853 uchar nt_hash[16];
854 E_md4hash(pass, nt_hash);
855
856 #ifdef LANMAN_ONLY
857 nt_response = data_blob_null;
858 #else
859 nt_response = data_blob(NULL, 24);
860 if (tevent_req_nomem(nt_response.data, req)) {
861 return tevent_req_post(req, ev);
862 }
863
864 SMBNTencrypt(pass, smb1cli_conn_server_challenge(cli->conn),
865 nt_response.data);
866 #endif
867 /* non encrypted password supplied. Ignore ntpass. */
868 if (lp_client_lanman_auth()) {
869
870 lm_response = data_blob(NULL, 24);
871 if (tevent_req_nomem(lm_response.data, req)) {
872 return tevent_req_post(req, ev);
873 }
874
875 if (!SMBencrypt(pass,
876 smb1cli_conn_server_challenge(cli->conn),
877 lm_response.data)) {
878 /*
879 * Oops, the LM response is
880 * invalid, just put the NT
881 * response there instead
882 */
883 data_blob_free(&lm_response);
884 lm_response = data_blob(
885 nt_response.data,
886 nt_response.length);
887 }
888 } else {
889 /*
890 * LM disabled, place NT# in LM field
891 * instead
892 */
893 lm_response = data_blob(
894 nt_response.data, nt_response.length);
895 }
896
897 if (tevent_req_nomem(lm_response.data, req)) {
898 return tevent_req_post(req, ev);
899 }
900
901 session_key = data_blob(NULL, 16);
902 if (tevent_req_nomem(session_key.data, req)) {
903 return tevent_req_post(req, ev);
904 }
905 #ifdef LANMAN_ONLY
906 E_deshash(pass, session_key.data);
907 memset(&session_key.data[8], '\0', 8);
908 #else
909 SMBsesskeygen_ntv1(nt_hash, session_key.data);
910 #endif
911 }
912 } else {
913 /* pre-encrypted password supplied. Only used for
914 security=server, can't do
915 signing because we don't have original key */
916
917 lm_response = data_blob(pass, passlen);
918 if (tevent_req_nomem(lm_response.data, req)) {
919 return tevent_req_post(req, ev);
920 }
921
922 nt_response = data_blob(ntpass, ntpasslen);
923 if (tevent_req_nomem(nt_response.data, req)) {
924 return tevent_req_post(req, ev);
925 }
926 }
927
928 #ifdef LANMAN_ONLY
929 state->response = data_blob_talloc(
930 state, lm_response.data, lm_response.length);
931 #else
932 state->response = data_blob_talloc(
933 state, nt_response.data, nt_response.length);
934 #endif
935 if (tevent_req_nomem(state->response.data, req)) {
936 return tevent_req_post(req, ev);
937 }
938
939 if (session_key.data) {
940 state->session_key = data_blob_talloc(
941 state, session_key.data, session_key.length);
942 if (tevent_req_nomem(state->session_key.data, req)) {
943 return tevent_req_post(req, ev);
944 }
945 }
946 data_blob_free(&session_key);
947
948 SCVAL(vwv+0, 0, 0xff);
949 SCVAL(vwv+0, 1, 0);
950 SSVAL(vwv+1, 0, 0);
951 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
952 SSVAL(vwv+3, 0, 2);
953 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
954 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
955 SSVAL(vwv+7, 0, lm_response.length);
956 SSVAL(vwv+8, 0, nt_response.length);
957 SSVAL(vwv+9, 0, 0);
958 SSVAL(vwv+10, 0, 0);
959 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
960
961 bytes = talloc_array(state, uint8_t,
962 lm_response.length + nt_response.length);
963 if (tevent_req_nomem(bytes, req)) {
964 return tevent_req_post(req, ev);
965 }
966 if (lm_response.length != 0) {
967 memcpy(bytes, lm_response.data, lm_response.length);
968 }
969 if (nt_response.length != 0) {
970 memcpy(bytes + lm_response.length,
971 nt_response.data, nt_response.length);
972 }
973 data_blob_free(&lm_response);
974 data_blob_free(&nt_response);
975
976 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
977 user, strlen(user)+1, NULL);
978
979 /*
980 * Upper case here might help some NTLMv2 implementations
981 */
982 workgroup_upper = talloc_strdup_upper(talloc_tos(), workgroup);
983 if (tevent_req_nomem(workgroup_upper, req)) {
984 return tevent_req_post(req, ev);
985 }
986 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
987 workgroup_upper, strlen(workgroup_upper)+1,
988 NULL);
989 TALLOC_FREE(workgroup_upper);
990
991 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Unix", 5, NULL);
992 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Samba", 6, NULL);
993 if (tevent_req_nomem(bytes, req)) {
994 return tevent_req_post(req, ev);
995 }
996
997 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
998 talloc_get_size(bytes), bytes);
999 if (tevent_req_nomem(subreq, req)) {
1000 return tevent_req_post(req, ev);
1001 }
1002 tevent_req_set_callback(subreq, cli_session_setup_nt1_done, req);
1003 return req;
1004 }
1005
1006 static void cli_session_setup_nt1_done(struct tevent_req *subreq)
1007 {
1008 struct tevent_req *req = tevent_req_callback_data(
1009 subreq, struct tevent_req);
1010 struct cli_session_setup_nt1_state *state = tevent_req_data(
1011 req, struct cli_session_setup_nt1_state);
1012 struct cli_state *cli = state->cli;
1013 uint32_t num_bytes;
1014 uint8_t *in;
1015 uint8_t *inhdr;
1016 uint8_t *bytes;
1017 uint8_t *p;
1018 NTSTATUS status;
1019 ssize_t ret;
1020 uint8_t wct;
1021 uint16_t *vwv;
1022
1023 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
1024 &num_bytes, &bytes);
1025 TALLOC_FREE(subreq);
1026 if (!NT_STATUS_IS_OK(status)) {
1027 tevent_req_nterror(req, status);
1028 return;
1029 }
1030
1031 inhdr = in + NBT_HDR_SIZE;
1032 p = bytes;
1033
1034 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
1035 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1036
1037 status = smb_bytes_talloc_string(cli,
1038 inhdr,
1039 &cli->server_os,
1040 p,
1041 bytes+num_bytes-p,
1042 &ret);
1043 if (!NT_STATUS_IS_OK(status)) {
1044 tevent_req_nterror(req, status);
1045 return;
1046 }
1047 p += ret;
1048
1049 status = smb_bytes_talloc_string(cli,
1050 inhdr,
1051 &cli->server_type,
1052 p,
1053 bytes+num_bytes-p,
1054 &ret);
1055 if (!NT_STATUS_IS_OK(status)) {
1056 tevent_req_nterror(req, status);
1057 return;
1058 }
1059 p += ret;
1060
1061 status = smb_bytes_talloc_string(cli,
1062 inhdr,
1063 &cli->server_domain,
1064 p,
1065 bytes+num_bytes-p,
1066 &ret);
1067 if (!NT_STATUS_IS_OK(status)) {
1068 tevent_req_nterror(req, status);
1069 return;
1070 }
1071 p += ret;
1072
1073 status = cli_set_username(cli, state->user);
1074 if (tevent_req_nterror(req, status)) {
1075 return;
1076 }
1077 if (smb1cli_conn_activate_signing(cli->conn, state->session_key, state->response)
1078 && !smb1cli_conn_check_signing(cli->conn, (uint8_t *)in, 1)) {
1079 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1080 return;
1081 }
1082 if (state->session_key.data) {
1083 struct smbXcli_session *session = state->cli->smb1.session;
1084
1085 status = smb1cli_session_set_session_key(session,
1086 state->session_key);
1087 if (tevent_req_nterror(req, status)) {
1088 return;
1089 }
1090 }
1091 tevent_req_done(req);
1092 }
1093
1094 static NTSTATUS cli_session_setup_nt1_recv(struct tevent_req *req)
1095 {
1096 return tevent_req_simple_recv_ntstatus(req);
1097 }
1098
1099 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
1100 const char *pass, size_t passlen,
1101 const char *ntpass, size_t ntpasslen,
1102 const char *workgroup)
1103 {
1104 TALLOC_CTX *frame = talloc_stackframe();
1105 struct event_context *ev;
1106 struct tevent_req *req;
1107 NTSTATUS status = NT_STATUS_NO_MEMORY;
1108
1109 if (smbXcli_conn_has_async_calls(cli->conn)) {
1110 /*
1111 * Can't use sync call while an async call is in flight
1112 */
1113 status = NT_STATUS_INVALID_PARAMETER;
1114 goto fail;
1115 }
1116 ev = event_context_init(frame);
1117 if (ev == NULL) {
1118 goto fail;
1119 }
1120 req = cli_session_setup_nt1_send(frame, ev, cli, user, pass, passlen,
1121 ntpass, ntpasslen, workgroup);
1122 if (req == NULL) {
1123 goto fail;
1124 }
1125 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1126 goto fail;
1127 }
1128 status = cli_session_setup_nt1_recv(req);
1129 fail:
1130 TALLOC_FREE(frame);
1131 return status;
1132 }
1133
1134 /* The following is calculated from :
1135 * (smb_size-4) = 35
1136 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
1137 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
1138 * end of packet.
1139 */
1140
1141 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
1142
1143 struct cli_sesssetup_blob_state {
1144 struct tevent_context *ev;
1145 struct cli_state *cli;
1146 DATA_BLOB blob;
1147 uint16_t max_blob_size;
1148 uint16_t vwv[12];
1149 uint8_t *buf;
1150
1151 DATA_BLOB smb2_blob;
1152 struct iovec *recv_iov;
1153
1154 NTSTATUS status;
1155 uint8_t *inbuf;
1156 DATA_BLOB ret_blob;
1157 };
1158
1159 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1160 struct tevent_req **psubreq);
1161 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
1162
1163 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
1164 struct tevent_context *ev,
1165 struct cli_state *cli,
1166 DATA_BLOB blob)
1167 {
1168 struct tevent_req *req, *subreq;
1169 struct cli_sesssetup_blob_state *state;
1170 uint32_t usable_space;
1171
1172 req = tevent_req_create(mem_ctx, &state,
1173 struct cli_sesssetup_blob_state);
1174 if (req == NULL) {
1175 return NULL;
1176 }
1177 state->ev = ev;
1178 state->blob = blob;
1179 state->cli = cli;
1180
1181 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1182 usable_space = UINT16_MAX;
1183 } else {
1184 usable_space = cli_state_available_size(cli,
1185 BASE_SESSSETUP_BLOB_PACKET_SIZE);
1186 }
1187
1188 if (usable_space == 0) {
1189 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
1190 "(not possible to send %u bytes)\n",
1191 BASE_SESSSETUP_BLOB_PACKET_SIZE + 1));
1192 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1193 return tevent_req_post(req, ev);
1194 }
1195 state->max_blob_size = MIN(usable_space, 0xFFFF);
1196
1197 if (!cli_sesssetup_blob_next(state, &subreq)) {
1198 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1199 return tevent_req_post(req, ev);
1200 }
1201 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1202 return req;
1203 }
1204
1205 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1206 struct tevent_req **psubreq)
1207 {
1208 struct tevent_req *subreq;
1209 uint16_t thistime;
1210
1211 thistime = MIN(state->blob.length, state->max_blob_size);
1212
1213 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1214
1215 state->smb2_blob.data = state->blob.data;
1216 state->smb2_blob.length = thistime;
1217
1218 state->blob.data += thistime;
1219 state->blob.length -= thistime;
1220
1221 subreq = smb2cli_session_setup_send(state, state->ev,
1222 state->cli->conn,
1223 state->cli->timeout,
1224 state->cli->smb2.session,
1225 0, /* in_flags */
1226 SMB2_CAP_DFS, /* in_capabilities */
1227 0, /* in_channel */
1228 0, /* in_previous_session_id */
1229 &state->smb2_blob);
1230 if (subreq == NULL) {
1231 return false;
1232 }
1233 *psubreq = subreq;
1234 return true;
1235 }
1236
1237 SCVAL(state->vwv+0, 0, 0xFF);
1238 SCVAL(state->vwv+0, 1, 0);
1239 SSVAL(state->vwv+1, 0, 0);
1240 SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
1241 SSVAL(state->vwv+3, 0, 2);
1242 SSVAL(state->vwv+4, 0, 1);
1243 SIVAL(state->vwv+5, 0, 0);
1244
1245 SSVAL(state->vwv+7, 0, thistime);
1246
1247 SSVAL(state->vwv+8, 0, 0);
1248 SSVAL(state->vwv+9, 0, 0);
1249 SIVAL(state->vwv+10, 0,
1250 cli_session_setup_capabilities(state->cli, CAP_EXTENDED_SECURITY));
1251
1252 state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
1253 thistime);
1254 if (state->buf == NULL) {
1255 return false;
1256 }
1257 state->blob.data += thistime;
1258 state->blob.length -= thistime;
1259
1260 state->buf = smb_bytes_push_str(state->buf, smbXcli_conn_use_unicode(state->cli->conn),
1261 "Unix", 5, NULL);
1262 state->buf = smb_bytes_push_str(state->buf, smbXcli_conn_use_unicode(state->cli->conn),
1263 "Samba", 6, NULL);
1264 if (state->buf == NULL) {
1265 return false;
1266 }
1267 subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
1268 12, state->vwv,
1269 talloc_get_size(state->buf), state->buf);
1270 if (subreq == NULL) {
1271 return false;
1272 }
1273 *psubreq = subreq;
1274 return true;
1275 }
1276
1277 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
1278 {
1279 struct tevent_req *req = tevent_req_callback_data(
1280 subreq, struct tevent_req);
1281 struct cli_sesssetup_blob_state *state = tevent_req_data(
1282 req, struct cli_sesssetup_blob_state);
1283 struct cli_state *cli = state->cli;
1284 uint8_t wct;
1285 uint16_t *vwv;
1286 uint32_t num_bytes;
1287 uint8_t *bytes;
1288 NTSTATUS status;
1289 uint8_t *p;
1290 uint16_t blob_length;
1291 uint8_t *in;
1292 uint8_t *inhdr;
1293 ssize_t ret;
1294
1295 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1296 status = smb2cli_session_setup_recv(subreq, state,
1297 &state->recv_iov,
1298 &state->ret_blob);
1299 } else {
1300 status = cli_smb_recv(subreq, state, &in, 4, &wct, &vwv,
1301 &num_bytes, &bytes);
1302 TALLOC_FREE(state->buf);
1303 }
1304 TALLOC_FREE(subreq);
1305 if (!NT_STATUS_IS_OK(status)
1306 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1307 tevent_req_nterror(req, status);
1308 return;
1309 }
1310
1311 state->status = status;
1312
1313 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1314 goto next;
1315 }
1316
1317 state->inbuf = in;
1318 inhdr = in + NBT_HDR_SIZE;
1319 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
1320 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1321
1322 blob_length = SVAL(vwv+3, 0);
1323 if (blob_length > num_bytes) {
1324 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1325 return;
1326 }
1327 state->ret_blob = data_blob_const(bytes, blob_length);
1328
1329 p = bytes + blob_length;
1330
1331 status = smb_bytes_talloc_string(cli,
1332 inhdr,
1333 &cli->server_os,
1334 p,
1335 bytes+num_bytes-p,
1336 &ret);
1337
1338 if (!NT_STATUS_IS_OK(status)) {
1339 tevent_req_nterror(req, status);
1340 return;
1341 }
1342 p += ret;
1343
1344 status = smb_bytes_talloc_string(cli,
1345 inhdr,
1346 &cli->server_type,
1347 p,
1348 bytes+num_bytes-p,
1349 &ret);
1350
1351 if (!NT_STATUS_IS_OK(status)) {
1352 tevent_req_nterror(req, status);
1353 return;
1354 }
1355 p += ret;
1356
1357 status = smb_bytes_talloc_string(cli,
1358 inhdr,
1359 &cli->server_domain,
1360 p,
1361 bytes+num_bytes-p,
1362 &ret);
1363
1364 if (!NT_STATUS_IS_OK(status)) {
1365 tevent_req_nterror(req, status);
1366 return;
1367 }
1368 p += ret;
1369
1370 next:
1371 if (state->blob.length != 0) {
1372 /*
1373 * More to send
1374 */
1375 if (!cli_sesssetup_blob_next(state, &subreq)) {
1376 tevent_req_oom(req);
1377 return;
1378 }
1379 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1380 return;
1381 }
1382 tevent_req_done(req);
1383 }
1384
1385 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
1386 TALLOC_CTX *mem_ctx,
1387 DATA_BLOB *pblob,
1388 uint8_t **pinbuf,
1389 struct iovec **precv_iov)
1390 {
1391 struct cli_sesssetup_blob_state *state = tevent_req_data(
1392 req, struct cli_sesssetup_blob_state);
1393 NTSTATUS status;
1394 uint8_t *inbuf;
1395 struct iovec *recv_iov;
1396
1397 if (tevent_req_is_nterror(req, &status)) {
1398 TALLOC_FREE(state->cli->smb2.session);
1399 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1400 return status;
1401 }
1402
1403 inbuf = talloc_move(mem_ctx, &state->inbuf);
1404 recv_iov = talloc_move(mem_ctx, &state->recv_iov);
1405 if (pblob != NULL) {
1406 *pblob = state->ret_blob;
1407 }
1408 if (pinbuf != NULL) {
1409 *pinbuf = inbuf;
1410 }
1411 if (precv_iov != NULL) {
1412 *precv_iov = recv_iov;
1413 }
1414 /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
1415 return state->status;
1416 }
1417
1418 #ifdef HAVE_KRB5
1419
1420 /****************************************************************************
1421 Use in-memory credentials cache
1422 ****************************************************************************/
1423
1424 static void use_in_memory_ccache(void) {
1425 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
1426 }
1427
1428 /****************************************************************************
1429 Do a spnego/kerberos encrypted session setup.
1430 ****************************************************************************/
1431
1432 struct cli_session_setup_kerberos_state {
1433 struct cli_state *cli;
1434 DATA_BLOB negTokenTarg;
1435 DATA_BLOB session_key_krb5;
1436 ADS_STATUS ads_status;
1437 };
1438
1439 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
1440
1441 static struct tevent_req *cli_session_setup_kerberos_send(
1442 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1443 const char *principal)
1444 {
1445 struct tevent_req *req, *subreq;
1446 struct cli_session_setup_kerberos_state *state;
1447 int rc;
1448
1449 DEBUG(2,("Doing kerberos session setup\n"));
1450
1451 req = tevent_req_create(mem_ctx, &state,
1452 struct cli_session_setup_kerberos_state);
1453 if (req == NULL) {
1454 return NULL;
1455 }
1456 state->cli = cli;
1457 state->ads_status = ADS_SUCCESS;
1458
1459 /*
1460 * Ok, this is cheating: spnego_gen_krb5_negTokenInit can block if
1461 * we have to acquire a ticket. To be fixed later :-)
1462 */
1463 rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
1464 &state->session_key_krb5, 0, NULL, NULL);
1465 if (rc) {
1466 DEBUG(1, ("cli_session_setup_kerberos: "
1467 "spnego_gen_krb5_negTokenInit failed: %s\n",
1468 error_message(rc)));
1469 state->ads_status = ADS_ERROR_KRB5(rc);
1470 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1471 return tevent_req_post(req, ev);
1472 }
1473
1474 #if 0
1475 file_save("negTokenTarg.dat", state->negTokenTarg.data,
1476 state->negTokenTarg.length);
1477 #endif
1478
1479 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1480 state->cli->smb2.session = smbXcli_session_create(cli,
1481 cli->conn);
1482 if (tevent_req_nomem(state->cli->smb2.session, req)) {
1483 return tevent_req_post(req, ev);
1484 }
1485 }
1486
1487 subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
1488 if (tevent_req_nomem(subreq, req)) {
1489 return tevent_req_post(req, ev);
1490 }
1491 tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
1492 return req;
1493 }
1494
1495 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
1496 {
1497 struct tevent_req *req = tevent_req_callback_data(
1498 subreq, struct tevent_req);
1499 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1500 req, struct cli_session_setup_kerberos_state);
1501 uint8_t *inbuf = NULL;
1502 struct iovec *recv_iov = NULL;
1503 NTSTATUS status;
1504
1505 status = cli_sesssetup_blob_recv(subreq, state,
1506 NULL, &inbuf, &recv_iov);
1507 TALLOC_FREE(subreq);
1508 if (!NT_STATUS_IS_OK(status)) {
1509 tevent_req_nterror(req, status);
1510 return;
1511 }
1512
1513 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1514 struct smbXcli_session *session = state->cli->smb2.session;
1515 status = smb2cli_session_set_session_key(session,
1516 state->session_key_krb5,
1517 recv_iov);
1518 if (tevent_req_nterror(req, status)) {
1519 return;
1520 }
1521 } else {
1522 struct smbXcli_session *session = state->cli->smb1.session;
1523
1524 status = smb1cli_session_set_session_key(session,
1525 state->session_key_krb5);
1526 if (tevent_req_nterror(req, status)) {
1527 return;
1528 }
1529
1530 if (smb1cli_conn_activate_signing(state->cli->conn, state->session_key_krb5,
1531 data_blob_null)
1532 && !smb1cli_conn_check_signing(state->cli->conn, inbuf, 1)) {
1533 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1534 return;
1535 }
1536 }
1537
1538 tevent_req_done(req);
1539 }
1540
1541 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
1542 {
1543 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1544 req, struct cli_session_setup_kerberos_state);
1545 NTSTATUS status;
1546
1547 if (tevent_req_is_nterror(req, &status)) {
1548 return ADS_ERROR_NT(status);
1549 }
1550 return state->ads_status;
1551 }
1552
1553 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
1554 const char *principal)
1555 {
1556 struct tevent_context *ev;
1557 struct tevent_req *req;
1558 ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1559
1560 if (smbXcli_conn_has_async_calls(cli->conn)) {
1561 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1562 }
1563 ev = tevent_context_init(talloc_tos());
1564 if (ev == NULL) {
1565 goto fail;
1566 }
1567 req = cli_session_setup_kerberos_send(ev, ev, cli, principal);
1568 if (req == NULL) {
1569 goto fail;
1570 }
1571 if (!tevent_req_poll(req, ev)) {
1572 status = ADS_ERROR_SYSTEM(errno);
1573 goto fail;
1574 }
1575 status = cli_session_setup_kerberos_recv(req);
1576 fail:
1577 TALLOC_FREE(ev);
1578 return status;
1579 }
1580 #endif /* HAVE_KRB5 */
1581
1582 /****************************************************************************
1583 Do a spnego/NTLMSSP encrypted session setup.
1584 ****************************************************************************/
1585
1586 struct cli_session_setup_ntlmssp_state {
1587 struct tevent_context *ev;
1588 struct cli_state *cli;
1589 struct ntlmssp_state *ntlmssp_state;
1590 int turn;
1591 DATA_BLOB blob_out;
1592 };
1593
1594 static int cli_session_setup_ntlmssp_state_destructor(
1595 struct cli_session_setup_ntlmssp_state *state)
1596 {
1597 if (state->ntlmssp_state != NULL) {
1598 TALLOC_FREE(state->ntlmssp_state);
1599 }
1600 return 0;
1601 }
1602
1603 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
1604
1605 static struct tevent_req *cli_session_setup_ntlmssp_send(
1606 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1607 const char *user, const char *pass, const char *domain)
1608 {
1609 struct tevent_req *req, *subreq;
1610 struct cli_session_setup_ntlmssp_state *state;
1611 NTSTATUS status;
1612 DATA_BLOB blob_out;
1613 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
1614
1615 req = tevent_req_create(mem_ctx, &state,
1616 struct cli_session_setup_ntlmssp_state);
1617 if (req == NULL) {
1618 return NULL;
1619 }
1620 state->ev = ev;
1621 state->cli = cli;
1622 state->turn = 1;
1623
1624 state->ntlmssp_state = NULL;
1625 talloc_set_destructor(
1626 state, cli_session_setup_ntlmssp_state_destructor);
1627
1628 status = ntlmssp_client_start(state,
1629 lp_netbios_name(),
1630 lp_workgroup(),
1631 lp_client_ntlmv2_auth(),
1632 &state->ntlmssp_state);
1633 if (!NT_STATUS_IS_OK(status)) {
1634 goto fail;
1635 }
1636 ntlmssp_want_feature(state->ntlmssp_state,
1637 NTLMSSP_FEATURE_SESSION_KEY);
1638 if (cli->use_ccache) {
1639 ntlmssp_want_feature(state->ntlmssp_state,
1640 NTLMSSP_FEATURE_CCACHE);
1641 }
1642 status = ntlmssp_set_username(state->ntlmssp_state, user);
1643 if (!NT_STATUS_IS_OK(status)) {
1644 goto fail;
1645 }
1646 status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1647 if (!NT_STATUS_IS_OK(status)) {
1648 goto fail;
1649 }
1650 if (cli->pw_nt_hash) {
1651 status = ntlmssp_set_password_hash(state->ntlmssp_state, pass);
1652 } else {
1653 status = ntlmssp_set_password(state->ntlmssp_state, pass);
1654 }
1655 if (!NT_STATUS_IS_OK(status)) {
1656 goto fail;
1657 }
1658 status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1659 &blob_out);
1660 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1661 goto fail;
1662 }
1663
1664 state->blob_out = spnego_gen_negTokenInit(state, OIDs_ntlm, &blob_out, NULL);
1665 data_blob_free(&blob_out);
1666
1667 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1668 state->cli->smb2.session = smbXcli_session_create(cli,
1669 cli->conn);
1670 if (tevent_req_nomem(state->cli->smb2.session, req)) {
1671 return tevent_req_post(req, ev);
1672 }
1673 }
1674
1675 subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1676 if (tevent_req_nomem(subreq, req)) {
1677 return tevent_req_post(req, ev);
1678 }
1679 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1680 return req;
1681 fail:
1682 tevent_req_nterror(req, status);
1683 return tevent_req_post(req, ev);
1684 }
1685
1686 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1687 {
1688 struct tevent_req *req = tevent_req_callback_data(
1689 subreq, struct tevent_req);
1690 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1691 req, struct cli_session_setup_ntlmssp_state);
1692 DATA_BLOB blob_in, msg_in, blob_out;
1693 uint8_t *inbuf = NULL;
1694 struct iovec *recv_iov = NULL;
1695 bool parse_ret;
1696 NTSTATUS status;
1697
1698 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1699 &inbuf, &recv_iov);
1700 TALLOC_FREE(subreq);
1701 data_blob_free(&state->blob_out);
1702
1703 if (NT_STATUS_IS_OK(status)) {
1704 if (state->cli->server_domain[0] == '\0') {
1705 TALLOC_FREE(state->cli->server_domain);
1706 state->cli->server_domain = talloc_strdup(state->cli,
1707 state->ntlmssp_state->server.netbios_domain);
1708 if (state->cli->server_domain == NULL) {
1709 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1710 return;
1711 }
1712 }
1713
1714 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1715 struct smbXcli_session *session = state->cli->smb2.session;
1716
1717 if (ntlmssp_is_anonymous(state->ntlmssp_state)) {
1718 /*
1719 * Windows server does not set the
1720 * SMB2_SESSION_FLAG_IS_GUEST nor
1721 * SMB2_SESSION_FLAG_IS_NULL flag.
1722 *
1723 * This fix makes sure we do not try
1724 * to verify a signature on the final
1725 * session setup response.
1726 */
1727 TALLOC_FREE(state->ntlmssp_state);
1728 tevent_req_done(req);
1729 return;
1730 }
1731
1732 status = smb2cli_session_set_session_key(session,
1733 state->ntlmssp_state->session_key,
1734 recv_iov);
1735 if (tevent_req_nterror(req, status)) {
1736 return;
1737 }
1738 } else {
1739 struct smbXcli_session *session = state->cli->smb1.session;
1740
1741 status = smb1cli_session_set_session_key(session,
1742 state->ntlmssp_state->session_key);
1743 if (tevent_req_nterror(req, status)) {
1744 return;
1745 }
1746
1747 if (smb1cli_conn_activate_signing(
1748 state->cli->conn, state->ntlmssp_state->session_key,
1749 data_blob_null)
1750 && !smb1cli_conn_check_signing(state->cli->conn, inbuf, 1)) {
1751 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1752 return;
1753 }
1754 }
1755 TALLOC_FREE(state->ntlmssp_state);
1756 tevent_req_done(req);
1757 return;
1758 }
1759 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1760 tevent_req_nterror(req, status);
1761 return;
1762 }
1763
1764 if (blob_in.length == 0) {
1765 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1766 return;
1767 }
1768
1769 if ((state->turn == 1)
1770 && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1771 DATA_BLOB tmp_blob = data_blob_null;
1772 /* the server might give us back two challenges */
1773 parse_ret = spnego_parse_challenge(state, blob_in, &msg_in,
1774 &tmp_blob);
1775 data_blob_free(&tmp_blob);
1776 } else {
1777 parse_ret = spnego_parse_auth_response(state, blob_in, status,
1778 OID_NTLMSSP, &msg_in);
1779 }
1780 state->turn += 1;
1781
1782 if (!parse_ret) {
1783 DEBUG(3,("Failed to parse auth response\n"));
1784 if (NT_STATUS_IS_OK(status)
1785 || NT_STATUS_EQUAL(status,
1786 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1787 tevent_req_nterror(
1788 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1789 return;
1790 }
1791 }
1792
1793 status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1794
1795 if (!NT_STATUS_IS_OK(status)
1796 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1797 TALLOC_FREE(state->ntlmssp_state);
1798 tevent_req_nterror(req, status);
1799 return;
1800 }
1801
1802 state->blob_out = spnego_gen_auth(state, blob_out);
1803 if (tevent_req_nomem(state->blob_out.data, req)) {
1804 return;
1805 }
1806
1807 subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1808 state->blob_out);
1809 if (tevent_req_nomem(subreq, req)) {
1810 return;
1811 }
1812 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1813 }
1814
1815 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1816 {
1817 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1818 req, struct cli_session_setup_ntlmssp_state);
1819 NTSTATUS status;
1820
1821 if (tevent_req_is_nterror(req, &status)) {
1822 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1823 return status;
1824 }
1825 return NT_STATUS_OK;
1826 }
1827
1828 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1829 const char *user,
1830 const char *pass,
1831 const char *domain)
1832 {
1833 struct tevent_context *ev;
1834 struct tevent_req *req;
1835 NTSTATUS status = NT_STATUS_NO_MEMORY;
1836
1837 if (smbXcli_conn_has_async_calls(cli->conn)) {
1838 return NT_STATUS_INVALID_PARAMETER;
1839 }
1840 ev = tevent_context_init(talloc_tos());
1841 if (ev == NULL) {
1842 goto fail;
1843 }
1844 req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1845 if (req == NULL) {
1846 goto fail;
1847 }
1848 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1849 goto fail;
1850 }
1851 status = cli_session_setup_ntlmssp_recv(req);
1852 fail:
1853 TALLOC_FREE(ev);
1854 return status;
1855 }
1856
1857 /****************************************************************************
1858 Do a spnego encrypted session setup.
1859
1860 user_domain: The shortname of the domain the user/machine is a member of.
1861 dest_realm: The realm we're connecting to, if NULL we use our default realm.
1862 ****************************************************************************/
1863
1864 static ADS_STATUS cli_session_setup_spnego(struct cli_state *cli,
1865 const char *user,
1866 const char *pass,
1867 const char *user_domain,
1868 const char * dest_realm)
1869 {
1870 char *principal = NULL;
1871 char *OIDs[ASN1_MAX_OIDS];
1872 int i;
1873 const DATA_BLOB *server_blob;
1874 DATA_BLOB blob = data_blob_null;
1875 const char *p = NULL;
1876 char *account = NULL;
1877 NTSTATUS status;
1878
1879 server_blob = smbXcli_conn_server_gss_blob(cli->conn);
1880 if (server_blob) {
1881 blob = data_blob(server_blob->data, server_blob->length);
1882 }
1883
1884 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)blob.length));
1885
1886 /* the server might not even do spnego */
1887 if (blob.length == 0) {
1888 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1889 goto ntlmssp;
1890 }
1891
1892 #if 0
1893 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1894 #endif
1895
1896 /* The server sent us the first part of the SPNEGO exchange in the
1897 * negprot reply. It is WRONG to depend on the principal sent in the
1898 * negprot reply, but right now we do it. If we don't receive one,
1899 * we try to best guess, then fall back to NTLM. */
1900 if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &principal, NULL) ||
1901 OIDs[0] == NULL) {
1902 data_blob_free(&blob);
1903 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1904 }
1905 data_blob_free(&blob);
1906
1907 /* make sure the server understands kerberos */
1908 for (i=0;OIDs[i];i++) {
1909 if (i == 0)
1910 DEBUG(3,("got OID=%s\n", OIDs[i]));
1911 else
1912 DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1913 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1914 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1915 cli->got_kerberos_mechanism = True;
1916 }
1917 talloc_free(OIDs[i]);
1918 }
1919
1920 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1921
1922 status = cli_set_username(cli, user);
1923 if (!NT_STATUS_IS_OK(status)) {
1924 TALLOC_FREE(principal);
1925 return ADS_ERROR_NT(status);
1926 }
1927
1928 #ifdef HAVE_KRB5
1929 /* If password is set we reauthenticate to kerberos server
1930 * and do not store results */
1931
1932 if (user && *user && cli->got_kerberos_mechanism && cli->use_kerberos) {
1933 ADS_STATUS rc;
1934 const char *remote_name = smbXcli_conn_remote_name(cli->conn);
1935
1936 if (pass && *pass) {
1937 int ret;
1938
1939 use_in_memory_ccache();
1940 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1941
1942 if (ret){
1943 TALLOC_FREE(principal);
1944 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1945 if (cli->fallback_after_kerberos)
1946 goto ntlmssp;
1947 return ADS_ERROR_KRB5(ret);
1948 }
1949 }
1950
1951 /* We may not be allowed to use the server-supplied SPNEGO principal, or it may not have been supplied to us
1952 */
1953 if (!lp_client_use_spnego_principal() || strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1954 TALLOC_FREE(principal);
1955 }
1956
1957 if (principal == NULL &&
1958 !is_ipaddress(remote_name) &&
1959 !strequal(STAR_SMBSERVER,
1960 remote_name)) {
1961 DEBUG(3,("cli_session_setup_spnego: using target "
1962 "hostname not SPNEGO principal\n"));
1963
1964 if (dest_realm) {
1965 char *realm = strupper_talloc(talloc_tos(), dest_realm);
1966 if (realm) {
1967 principal = talloc_asprintf(talloc_tos(),
1968 "cifs/%s@%s",
1969 remote_name,
1970 realm);
1971 TALLOC_FREE(realm);
1972 }
1973 } else {
1974 principal = kerberos_get_principal_from_service_hostname(talloc_tos(),
1975 "cifs",
1976 remote_name,
1977 lp_realm());
1978 }
1979
1980 if (!principal) {
1981 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1982 }
1983 DEBUG(3,("cli_session_setup_spnego: guessed "
1984 "server principal=%s\n",
1985 principal ? principal : "<null>"));
1986 }
1987
1988 if (principal) {
1989 rc = cli_session_setup_kerberos(cli, principal);
1990 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1991 TALLOC_FREE(principal);
1992 return rc;
1993 }
1994 }
1995 }
1996 #endif
1997
1998 TALLOC_FREE(principal);
1999
2000 ntlmssp:
2001
2002 account = talloc_strdup(talloc_tos(), user);
2003 if (!account) {
2004 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
2005 }
2006
2007 /* when falling back to ntlmssp while authenticating with a machine
2008 * account strip off the realm - gd */
2009
2010 if ((p = strchr_m(user, '@')) != NULL) {
2011 account[PTR_DIFF(p,user)] = '\0';
2012 }
2013
2014 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
2015 }
2016
2017 /****************************************************************************
2018 Send a session setup. The username and workgroup is in UNIX character
2019 format and must be converted to DOS codepage format before sending. If the
2020 password is in plaintext, the same should be done.
2021 ****************************************************************************/
2022
2023 NTSTATUS cli_session_setup(struct cli_state *cli,
2024 const char *user,
2025 const char *pass, int passlen,
2026 const char *ntpass, int ntpasslen,
2027 const char *workgroup)
2028 {
2029 char *p;
2030 char *user2;
2031 uint16_t sec_mode = smb1cli_conn_server_security_mode(cli->conn);
2032
2033 if (user) {
2034 user2 = talloc_strdup(talloc_tos(), user);
2035 } else {
2036 user2 = talloc_strdup(talloc_tos(), "");
2037 }
2038 if (user2 == NULL) {
2039 return NT_STATUS_NO_MEMORY;
2040 }
2041
2042 if (!workgroup) {
2043 workgroup = "";
2044 }
2045
2046 /* allow for workgroups as part of the username */
2047 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
2048 (p=strchr_m(user2,*lp_winbind_separator()))) {
2049 *p = 0;
2050 user = p+1;
2051 if (!strupper_m(user2)) {
2052 return NT_STATUS_INVALID_PARAMETER;
2053 }
2054 workgroup = user2;
2055 }
2056
2057 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_LANMAN1) {
2058 return NT_STATUS_OK;
2059 }
2060
2061 /* now work out what sort of session setup we are going to
2062 do. I have split this into separate functions to make the
2063 flow a bit easier to understand (tridge) */
2064
2065 /* if its an older server then we have to use the older request format */
2066
2067 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_NT1) {
2068 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
2069 DEBUG(1, ("Server requested LM password but 'client lanman auth = no'"
2070 " or 'client ntlmv2 auth = yes'\n"));
2071 return NT_STATUS_ACCESS_DENIED;
2072 }
2073
2074 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
2075 !lp_client_plaintext_auth() && (*pass)) {
2076 DEBUG(1, ("Server requested PLAINTEXT password but 'client plaintext auth = no'"
2077 " or 'client ntlmv2 auth = yes'\n"));
2078 return NT_STATUS_ACCESS_DENIED;
2079 }
2080
2081 return cli_session_setup_lanman2(cli, user, pass, passlen,
2082 workgroup);
2083 }
2084
2085 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2086 const char *remote_realm = cli_state_remote_realm(cli);
2087 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2088 workgroup,
2089 remote_realm);
2090 if (!ADS_ERR_OK(status)) {
2091 DEBUG(3, ("SMB2-SPNEGO login failed: %s\n", ads_errstr(status)));
2092 return ads_ntstatus(status);
2093 }
2094 return NT_STATUS_OK;
2095 }
2096
2097 /* if no user is supplied then we have to do an anonymous connection.
2098 passwords are ignored */
2099
2100 if (!user || !*user)
2101 return cli_session_setup_guest(cli);
2102
2103 /* if the server is share level then send a plaintext null
2104 password at this point. The password is sent in the tree
2105 connect */
2106
2107 if ((sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
2108 return cli_session_setup_plain(cli, user, "", workgroup);
2109
2110 /* if the server doesn't support encryption then we have to use
2111 plaintext. The second password is ignored */
2112
2113 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
2114 if (!lp_client_plaintext_auth() && (*pass)) {
2115 DEBUG(1, ("Server requested PLAINTEXT password but 'client plaintext auth = no'"
2116 " or 'client ntlmv2 auth = yes'\n"));
2117 return NT_STATUS_ACCESS_DENIED;
2118 }
2119 return cli_session_setup_plain(cli, user, pass, workgroup);
2120 }
2121
2122 /* if the server supports extended security then use SPNEGO */
2123
2124 if (smb1cli_conn_capabilities(cli->conn) & CAP_EXTENDED_SECURITY) {
2125 const char *remote_realm = cli_state_remote_realm(cli);
2126 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2127 workgroup,
2128 remote_realm);
2129 if (!ADS_ERR_OK(status)) {
2130 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
2131 return ads_ntstatus(status);
2132 }
2133 } else {
2134 NTSTATUS status;
2135
2136 /* otherwise do a NT1 style session setup */
2137 status = cli_session_setup_nt1(cli, user, pass, passlen,
2138 ntpass, ntpasslen, workgroup);
2139 if (!NT_STATUS_IS_OK(status)) {
2140 DEBUG(3,("cli_session_setup: NT1 session setup "
2141 "failed: %s\n", nt_errstr(status)));
2142 return status;
2143 }
2144 }
2145
2146 return NT_STATUS_OK;
2147 }
2148
2149 /****************************************************************************
2150 Send a uloggoff.
2151 *****************************************************************************/
2152
2153 struct cli_ulogoff_state {
2154 struct cli_state *cli;
2155 uint16_t vwv[3];
2156 };
2157
2158 static void cli_ulogoff_done(struct tevent_req *subreq);
2159
2160 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
2161 struct tevent_context *ev,
2162 struct cli_state *cli)
2163 {
2164 struct tevent_req *req, *subreq;
2165 struct cli_ulogoff_state *state;
2166
2167 req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
2168 if (req == NULL) {
2169 return NULL;
2170 }
2171 state->cli = cli;
2172
2173 SCVAL(state->vwv+0, 0, 0xFF);
2174 SCVAL(state->vwv+1, 0, 0);
2175 SSVAL(state->vwv+2, 0, 0);
2176
2177 subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
2178 0, NULL);
2179 if (tevent_req_nomem(subreq, req)) {
2180 return tevent_req_post(req, ev);
2181 }
2182 tevent_req_set_callback(subreq, cli_ulogoff_done, req);
2183 return req;
2184 }
2185
2186 static void cli_ulogoff_done(struct tevent_req *subreq)
2187 {
2188 struct tevent_req *req = tevent_req_callback_data(
2189 subreq, struct tevent_req);
2190 struct cli_ulogoff_state *state = tevent_req_data(
2191 req, struct cli_ulogoff_state);
2192 NTSTATUS status;
2193
2194 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2195 if (!NT_STATUS_IS_OK(status)) {
2196 tevent_req_nterror(req, status);
2197 return;
2198 }
2199 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
2200 tevent_req_done(req);
2201 }
2202
2203 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
2204 {
2205 return tevent_req_simple_recv_ntstatus(req);
2206 }
2207
2208 NTSTATUS cli_ulogoff(struct cli_state *cli)
2209 {
2210 struct tevent_context *ev;
2211 struct tevent_req *req;
2212 NTSTATUS status = NT_STATUS_NO_MEMORY;
2213
2214 if (smbXcli_conn_has_async_calls(cli->conn)) {
2215 return NT_STATUS_INVALID_PARAMETER;
2216 }
2217 ev = tevent_context_init(talloc_tos());
2218 if (ev == NULL) {
2219 goto fail;
2220 }
2221 req = cli_ulogoff_send(ev, ev, cli);
2222 if (req == NULL) {
2223 goto fail;
2224 }
2225 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2226 goto fail;
2227 }
2228 status = cli_ulogoff_recv(req);
2229 fail:
2230 TALLOC_FREE(ev);
2231 return status;
2232 }
2233
2234 /****************************************************************************
2235 Send a tconX.
2236 ****************************************************************************/
2237
2238 struct cli_tcon_andx_state {
2239 struct cli_state *cli;
2240 uint16_t vwv[4];
2241 struct iovec bytes;
2242 };
2243
2244 static void cli_tcon_andx_done(struct tevent_req *subreq);
2245
2246 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
2247 struct event_context *ev,
2248 struct cli_state *cli,
2249 const char *share, const char *dev,
2250 const char *pass, int passlen,
2251 struct tevent_req **psmbreq)
2252 {
2253 struct tevent_req *req, *subreq;
2254 struct cli_tcon_andx_state *state;
2255 uint8_t p24[24];
2256 uint16_t *vwv;
2257 char *tmp = NULL;
2258 uint8_t *bytes;
2259 uint16_t sec_mode = smb1cli_conn_server_security_mode(cli->conn);
2260 uint16_t tcon_flags = 0;
2261
2262 *psmbreq = NULL;
2263
2264 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
2265 if (req == NULL) {
2266 return NULL;
2267 }
2268 state->cli = cli;
2269 vwv = state->vwv;
2270
2271 cli->share = talloc_strdup(cli, share);
2272 if (!cli->share) {
2273 return NULL;
2274 }
2275
2276 /* in user level security don't send a password now */
2277 if (sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
2278 passlen = 1;
2279 pass = "";
2280 } else if (pass == NULL) {
2281 DEBUG(1, ("Server not using user level security and no "
2282 "password supplied.\n"));
2283 goto access_denied;
2284 }
2285
2286 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
2287 *pass && passlen != 24) {
2288 if (!lp_client_lanman_auth()) {
2289 DEBUG(1, ("Server requested LANMAN password "
2290 "(share-level security) but "
2291 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2292 goto access_denied;
2293 }
2294
2295 /*
2296 * Non-encrypted passwords - convert to DOS codepage before
2297 * encryption.
2298 */
2299 SMBencrypt(pass, smb1cli_conn_server_challenge(cli->conn), p24);
2300 passlen = 24;
2301 pass = (const char *)p24;
2302 } else {
2303 if((sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
2304 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
2305 == 0) {
2306 uint8_t *tmp_pass;
2307
2308 if (!lp_client_plaintext_auth() && (*pass)) {
2309 DEBUG(1, ("Server requested PLAINTEXT "
2310 "password but "
2311 "'client plaintext auth = no' or 'client ntlmv2 auth = yes'\n"));
2312 goto access_denied;
2313 }
2314
2315 /*
2316 * Non-encrypted passwords - convert to DOS codepage
2317 * before using.
2318 */
2319 tmp_pass = talloc_array(talloc_tos(), uint8, 0);
2320 if (tevent_req_nomem(tmp_pass, req)) {
2321 return tevent_req_post(req, ev);
2322 }
2323 tmp_pass = trans2_bytes_push_str(tmp_pass,
2324 false, /* always DOS */
2325 pass,
2326 passlen,
2327 NULL);
2328 if (tevent_req_nomem(tmp_pass, req)) {
2329 return tevent_req_post(req, ev);
2330 }
2331 pass = (const char *)tmp_pass;
2332 passlen = talloc_get_size(tmp_pass);
2333 }
2334 }
2335
2336 tcon_flags |= TCONX_FLAG_EXTENDED_RESPONSE;
2337 tcon_flags |= TCONX_FLAG_EXTENDED_SIGNATURES;
2338
2339 SCVAL(vwv+0, 0, 0xFF);
2340 SCVAL(vwv+0, 1, 0);
2341 SSVAL(vwv+1, 0, 0);
2342 SSVAL(vwv+2, 0, tcon_flags);
2343 SSVAL(vwv+3, 0, passlen);
2344
2345 if (passlen && pass) {
2346 bytes = (uint8_t *)talloc_memdup(state, pass, passlen);
2347 } else {
2348 bytes = talloc_array(state, uint8_t, 0);
2349 }
2350
2351 /*
2352 * Add the sharename
2353 */
2354 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
2355 smbXcli_conn_remote_name(cli->conn), share);
2356 if (tmp == NULL) {
2357 TALLOC_FREE(req);
2358 return NULL;
2359 }
2360 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), tmp, strlen(tmp)+1,
2361 NULL);
2362 TALLOC_FREE(tmp);
2363
2364 /*
2365 * Add the devicetype
2366 */
2367 tmp = talloc_strdup_upper(talloc_tos(), dev);
2368 if (tmp == NULL) {
2369 TALLOC_FREE(req);
2370 return NULL;
2371 }
2372 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
2373 TALLOC_FREE(tmp);
2374
2375 if (bytes == NULL) {
2376 TALLOC_FREE(req);
2377 return NULL;
2378 }
2379
2380 state->bytes.iov_base = (void *)bytes;
2381 state->bytes.iov_len = talloc_get_size(bytes);
2382
2383 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
2384 1, &state->bytes);
2385 if (subreq == NULL) {
2386 TALLOC_FREE(req);
2387 return NULL;
2388 }
2389 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
2390 *psmbreq = subreq;
2391 return req;
2392
2393 access_denied:
2394 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2395 return tevent_req_post(req, ev);
2396 }
2397
2398 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
2399 struct event_context *ev,
2400 struct cli_state *cli,
2401 const char *share, const char *dev,
2402 const char *pass, int passlen)
2403 {
2404 struct tevent_req *req, *subreq;
2405 NTSTATUS status;
2406
2407 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
2408 &subreq);
2409 if (req == NULL) {
2410 return NULL;
2411 }
2412 if (subreq == NULL) {
2413 return req;
2414 }
2415 status = smb1cli_req_chain_submit(&subreq, 1);
2416 if (!NT_STATUS_IS_OK(status)) {
2417 tevent_req_nterror(req, status);
2418 return tevent_req_post(req, ev);
2419 }
2420 return req;
2421 }
2422
2423 static void cli_tcon_andx_done(struct tevent_req *subreq)
2424 {
2425 struct tevent_req *req = tevent_req_callback_data(
2426 subreq, struct tevent_req);
2427 struct cli_tcon_andx_state *state = tevent_req_data(
2428 req, struct cli_tcon_andx_state);
2429 struct cli_state *cli = state->cli;
2430 uint8_t *in;
2431 uint8_t *inhdr;
2432 uint8_t wct;
2433 uint16_t *vwv;
2434 uint32_t num_bytes;
2435 uint8_t *bytes;
2436 NTSTATUS status;
2437 uint16_t optional_support = 0;
2438
2439 status = cli_smb_recv(subreq, state, &in, 0, &wct, &vwv,
2440 &num_bytes, &bytes);
2441 TALLOC_FREE(subreq);
2442 if (!NT_STATUS_IS_OK(status)) {
2443 tevent_req_nterror(req, status);
2444 return;
2445 }
2446
2447 inhdr = in + NBT_HDR_SIZE;
2448
2449 if (num_bytes) {
2450 if (clistr_pull_talloc(cli,
2451 (const char *)inhdr,
2452 SVAL(inhdr, HDR_FLG2),
2453 &cli->dev,
2454 bytes,
2455 num_bytes,
2456 STR_TERMINATE|STR_ASCII) == -1) {
2457 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2458 return;
2459 }
2460 } else {
2461 cli->dev = talloc_strdup(cli, "");
2462 if (cli->dev == NULL) {
2463 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2464 return;
2465 }
2466 }
2467
2468 if ((smbXcli_conn_protocol(cli->conn) >= PROTOCOL_NT1) && (num_bytes == 3)) {
2469 /* almost certainly win95 - enable bug fixes */
2470 cli->win95 = True;
2471 }
2472
2473 /*
2474 * Make sure that we have the optional support 16-bit field. WCT > 2.
2475 * Avoids issues when connecting to Win9x boxes sharing files
2476 */
2477
2478 cli->dfsroot = false;
2479
2480 if ((wct > 2) && (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_LANMAN2)) {
2481 optional_support = SVAL(vwv+2, 0);
2482 }
2483
2484 if (optional_support & SMB_SHARE_IN_DFS) {
2485 cli->dfsroot = true;
2486 }
2487
2488 if (optional_support & SMB_EXTENDED_SIGNATURES) {
2489 smb1cli_session_protect_session_key(cli->smb1.session);
2490 }
2491
2492 cli_state_set_tid(cli, SVAL(inhdr, HDR_TID));
2493 tevent_req_done(req);
2494 }
2495
2496 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
2497 {
2498 return tevent_req_simple_recv_ntstatus(req);
2499 }
2500
2501 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
2502 const char *dev, const char *pass, int passlen)
2503 {
2504 TALLOC_CTX *frame = talloc_stackframe();
2505 struct event_context *ev;
2506 struct tevent_req *req;
2507 NTSTATUS status = NT_STATUS_OK;
2508
2509 if (smbXcli_conn_has_async_calls(cli->conn)) {
2510 /*
2511 * Can't use sync call while an async call is in flight
2512 */
2513 status = NT_STATUS_INVALID_PARAMETER;
2514 goto fail;
2515 }
2516
2517 ev = event_context_init(frame);
2518 if (ev == NULL) {
2519 status = NT_STATUS_NO_MEMORY;
2520 goto fail;
2521 }
2522
2523 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
2524 if (req == NULL) {
2525 status = NT_STATUS_NO_MEMORY;
2526 goto fail;
2527 }
2528
2529 if (!tevent_req_poll(req, ev)) {
2530 status = map_nt_error_from_unix(errno);
2531 goto fail;
2532 }
2533
2534 status = cli_tcon_andx_recv(req);
2535 fail:
2536 TALLOC_FREE(frame);
2537 return status;
2538 }
2539
2540 NTSTATUS cli_tree_connect(struct cli_state *cli, const char *share,
2541 const char *dev, const char *pass, int passlen)
2542 {
2543 NTSTATUS status;
2544 uint16_t max_xmit = 0;
2545 uint16_t tid = 0;
2546
2547 cli->share = talloc_strdup(cli, share);
2548 if (!cli->share) {
2549 return NT_STATUS_NO_MEMORY;
2550 }
2551
2552 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2553 return smb2cli_tcon(cli, share);
2554 }
2555
2556 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_LANMAN1) {
2557 return cli_tcon_andx(cli, share, dev, pass, passlen);
2558 }
2559
2560 status = cli_raw_tcon(cli, share, pass, dev, &max_xmit, &tid);
2561 if (!NT_STATUS_IS_OK(status)) {
2562 return status;
2563 }
2564
2565 cli_state_set_tid(cli, tid);
2566
2567 return NT_STATUS_OK;
2568 }
2569
2570 /****************************************************************************
2571 Send a tree disconnect.
2572 ****************************************************************************/
2573
2574 struct cli_tdis_state {
2575 struct cli_state *cli;
2576 };
2577
2578 static void cli_tdis_done(struct tevent_req *subreq);
2579
2580 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
2581 struct tevent_context *ev,
2582 struct cli_state *cli)
2583 {
2584 struct tevent_req *req, *subreq;
2585 struct cli_tdis_state *state;
2586
2587 req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
2588 if (req == NULL) {
2589 return NULL;
2590 }
2591 state->cli = cli;
2592
2593 subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
2594 if (tevent_req_nomem(subreq, req)) {
2595 return tevent_req_post(req, ev);
2596 }
2597 tevent_req_set_callback(subreq, cli_tdis_done, req);
2598 return req;
2599 }
2600
2601 static void cli_tdis_done(struct tevent_req *subreq)
2602 {
2603 struct tevent_req *req = tevent_req_callback_data(
2604 subreq, struct tevent_req);
2605 struct cli_tdis_state *state = tevent_req_data(
2606 req, struct cli_tdis_state);
2607 NTSTATUS status;
2608
2609 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2610 TALLOC_FREE(subreq);
2611 if (!NT_STATUS_IS_OK(status)) {
2612 tevent_req_nterror(req, status);
2613 return;
2614 }
2615 cli_state_set_tid(state->cli, UINT16_MAX);
2616 tevent_req_done(req);
2617 }
2618
2619 NTSTATUS cli_tdis_recv(struct tevent_req *req)
2620 {
2621 return tevent_req_simple_recv_ntstatus(req);
2622 }
2623
2624 NTSTATUS cli_tdis(struct cli_state *cli)
2625 {
2626 struct tevent_context *ev;
2627 struct tevent_req *req;
2628 NTSTATUS status = NT_STATUS_NO_MEMORY;
2629
2630 if (smbXcli_conn_has_async_calls(cli->conn)) {
2631 return NT_STATUS_INVALID_PARAMETER;
2632 }
2633 ev = tevent_context_init(talloc_tos());
2634 if (ev == NULL) {
2635 goto fail;
2636 }
2637 req = cli_tdis_send(ev, ev, cli);
2638 if (req == NULL) {
2639 goto fail;
2640 }
2641 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2642 goto fail;
2643 }
2644 status = cli_tdis_recv(req);
2645 fail:
2646 TALLOC_FREE(ev);
2647 return status;
2648 }
2649
2650 static NTSTATUS cli_connect_sock(const char *host, int name_type,
2651 const struct sockaddr_storage *pss,
2652 const char *myname, uint16_t port,
2653 int sec_timeout, int *pfd, uint16_t *pport)
2654 {
2655 TALLOC_CTX *frame = talloc_stackframe();
2656 const char *prog;
2657 unsigned int i, num_addrs;
2658 const char **called_names;
2659 const char **calling_names;
2660 int *called_types;
2661 NTSTATUS status;
2662 int fd;
2663
2664 prog = getenv("LIBSMB_PROG");
2665 if (prog != NULL) {
2666 fd = sock_exec(prog);
2667 if (fd == -1) {
2668 return map_nt_error_from_unix(errno);
2669 }
2670 port = 0;
2671 goto done;
2672 }
2673
2674 if ((pss == NULL) || is_zero_addr(pss)) {
2675 struct sockaddr_storage *addrs;
2676 status = resolve_name_list(talloc_tos(), host, name_type,
2677 &addrs, &num_addrs);
2678 if (!NT_STATUS_IS_OK(status)) {
2679 goto fail;
2680 }
2681 pss = addrs;
2682 } else {
2683 num_addrs = 1;
2684 }
2685
2686 called_names = talloc_array(talloc_tos(), const char *, num_addrs);
2687 if (called_names == NULL) {
2688 status = NT_STATUS_NO_MEMORY;
2689 goto fail;
2690 }
2691 called_types = talloc_array(talloc_tos(), int, num_addrs);
2692 if (called_types == NULL) {
2693 status = NT_STATUS_NO_MEMORY;
2694 goto fail;
2695 }
2696 calling_names = talloc_array(talloc_tos(), const char *, num_addrs);
2697 if (calling_names == NULL) {
2698 status = NT_STATUS_NO_MEMORY;
2699 goto fail;
2700 }
2701 for (i=0; i<num_addrs; i++) {
2702 called_names[i] = host;
2703 called_types[i] = name_type;
2704 calling_names[i] = myname;
2705 }
2706 status = smbsock_any_connect(pss, called_names, called_types,
2707 calling_names, NULL, num_addrs, port,
2708 sec_timeout, &fd, NULL, &port);
2709 if (!NT_STATUS_IS_OK(status)) {
2710 goto fail;
2711 }
2712 set_socket_options(fd, lp_socket_options());
2713 done:
2714 *pfd = fd;
2715 *pport = port;
2716 status = NT_STATUS_OK;
2717 fail:
2718 TALLOC_FREE(frame);
2719 return status;
2720 }
2721
2722 NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss,
2723 uint16_t port, int name_type, const char *myname,
2724 int signing_state, int flags, struct cli_state **pcli)
2725 {
2726 TALLOC_CTX *frame = talloc_stackframe();
2727 struct cli_state *cli;
2728 NTSTATUS status = NT_STATUS_NO_MEMORY;
2729 int fd = -1;
2730 char *desthost;
2731 char *p;
2732
2733 desthost = talloc_strdup(talloc_tos(), host);
2734 if (desthost == NULL) {
2735 goto fail;
2736 }
2737
2738 p = strchr(host, '#');
2739 if (p != NULL) {
2740 name_type = strtol(p+1, NULL, 16);
2741 host = talloc_strndup(talloc_tos(), host, p - host);
2742 if (host == NULL) {
2743 goto fail;
2744 }
2745 }
2746
2747 status = cli_connect_sock(host, name_type, dest_ss, myname, port,
2748 20, &fd, &port);
2749 if (!NT_STATUS_IS_OK(status)) {
2750 goto fail;
2751 }
2752
2753 cli = cli_state_create(NULL, fd, desthost, NULL, signing_state, flags);
2754 if (cli == NULL) {
2755 close(fd);
2756 fd = -1;
2757 goto fail;
2758 }
2759
2760 *pcli = cli;
2761 status = NT_STATUS_OK;
2762 fail:
2763 TALLOC_FREE(frame);
2764 return status;
2765 }
2766
2767 /**
2768 establishes a connection to after the negprot.
2769 @param output_cli A fully initialised cli structure, non-null only on success
2770 @param dest_host The netbios name of the remote host
2771 @param dest_ss (optional) The the destination IP, NULL for name based lookup
2772 @param port (optional) The destination port (0 for default)
2773 */
2774 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2775 const char *my_name,
2776 const char *dest_host,
2777 const struct sockaddr_storage *dest_ss, int port,
2778 int signing_state, int flags)
2779 {
2780 NTSTATUS nt_status;
2781 struct cli_state *cli;
2782
2783 nt_status = cli_connect_nb(dest_host, dest_ss, port, 0x20, my_name,
2784 signing_state, flags, &cli);
2785 if (!NT_STATUS_IS_OK(nt_status)) {
2786 DEBUG(10, ("cli_connect_nb failed: %s\n",
2787 nt_errstr(nt_status)));
2788 return nt_status;
2789 }
2790
2791 nt_status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
2792 PROTOCOL_NT1);
2793 if (!NT_STATUS_IS_OK(nt_status)) {
2794 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2795 cli_shutdown(cli);
2796 return nt_status;
2797 }
2798
2799 *output_cli = cli;
2800 return NT_STATUS_OK;
2801 }
2802
2803
2804 /**
2805 establishes a connection right up to doing tconX, password specified.
2806 @param output_cli A fully initialised cli structure, non-null only on success
2807 @param dest_host The netbios name of the remote host
2808 @param dest_ip (optional) The the destination IP, NULL for name based lookup
2809 @param port (optional) The destination port (0 for default)
2810 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
2811 @param service_type The 'type' of serivice.
2812 @param user Username, unix string
2813 @param domain User's domain
2814 @param password User's password, unencrypted unix string.
2815 */
2816
2817 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2818 const char *my_name,
2819 const char *dest_host,
2820 const struct sockaddr_storage *dest_ss, int port,
2821 const char *service, const char *service_type,
2822 const char *user, const char *domain,
2823 const char *password, int flags,
2824 int signing_state)
2825 {
2826 NTSTATUS nt_status;
2827 struct cli_state *cli = NULL;
2828 int pw_len = password ? strlen(password)+1 : 0;
2829
2830 *output_cli = NULL;
2831
2832 if (password == NULL) {
2833 password = "";
2834 }
2835
2836 nt_status = cli_start_connection(&cli, my_name, dest_host,
2837 dest_ss, port, signing_state,
2838 flags);
2839
2840 if (!NT_STATUS_IS_OK(nt_status)) {
2841 return nt_status;
2842 }
2843
2844 nt_status = cli_session_setup(cli, user, password, pw_len, password,
2845 pw_len, domain);
2846 if (!NT_STATUS_IS_OK(nt_status)) {
2847
2848 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2849 DEBUG(1,("failed session setup with %s\n",
2850 nt_errstr(nt_status)));
2851 cli_shutdown(cli);
2852 return nt_status;
2853 }
2854
2855 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2856 if (!NT_STATUS_IS_OK(nt_status)) {
2857 DEBUG(1,("anonymous failed session setup with %s\n",
2858 nt_errstr(nt_status)));
2859 cli_shutdown(cli);
2860 return nt_status;
2861 }
2862 }
2863
2864 if (service) {
2865 nt_status = cli_tree_connect(cli, service, service_type,
2866 password, pw_len);
2867 if (!NT_STATUS_IS_OK(nt_status)) {
2868 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2869 cli_shutdown(cli);
2870 if (NT_STATUS_IS_OK(nt_status)) {
2871 nt_status = NT_STATUS_UNSUCCESSFUL;
2872 }
2873 return nt_status;
2874 }
2875 }
2876
2877 nt_status = cli_init_creds(cli, user, domain, password);
2878 if (!NT_STATUS_IS_OK(nt_status)) {
2879 cli_shutdown(cli);
2880 return nt_status;
2881 }
2882
2883 *output_cli = cli;
2884 return NT_STATUS_OK;
2885 }
2886
2887 /****************************************************************************
2888 Send an old style tcon.
2889 ****************************************************************************/
2890 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2891 const char *service, const char *pass, const char *dev,
2892 uint16 *max_xmit, uint16 *tid)
2893 {
2894 struct tevent_req *req;
2895 uint16_t *ret_vwv;
2896 uint8_t *bytes;
2897 NTSTATUS status;
2898
2899 if (!lp_client_plaintext_auth() && (*pass)) {
2900 DEBUG(1, ("Server requested PLAINTEXT password but 'client plaintext auth = no'"
2901 " or 'client ntlmv2 auth = yes'\n"));
2902 return NT_STATUS_ACCESS_DENIED;
2903 }
2904
2905 bytes = talloc_array(talloc_tos(), uint8_t, 0);
2906 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2907 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
2908 service, strlen(service)+1, NULL);
2909 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2910 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
2911 pass, strlen(pass)+1, NULL);
2912 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2913 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
2914 dev, strlen(dev)+1, NULL);
2915
2916 status = cli_smb(talloc_tos(), cli, SMBtcon, 0, 0, NULL,
2917 talloc_get_size(bytes), bytes, &req,
2918 2, NULL, &ret_vwv, NULL, NULL);
2919 if (!NT_STATUS_IS_OK(status)) {
2920 return status;
2921 }
2922
2923 *max_xmit = SVAL(ret_vwv + 0, 0);
2924 *tid = SVAL(ret_vwv + 1, 0);
2925
2926 return NT_STATUS_OK;
2927 }
2928
2929 /* Return a cli_state pointing at the IPC$ share for the given server */
2930
2931 struct cli_state *get_ipc_connect(char *server,
2932 struct sockaddr_storage *server_ss,
2933 const struct user_auth_info *user_info)
2934 {
2935 struct cli_state *cli;
2936 NTSTATUS nt_status;
2937 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2938
2939 if (user_info->use_kerberos) {
2940 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2941 }
2942
2943 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2944 user_info->username ? user_info->username : "",
2945 lp_workgroup(),
2946 user_info->password ? user_info->password : "",
2947 flags,
2948 SMB_SIGNING_DEFAULT);
2949
2950 if (NT_STATUS_IS_OK(nt_status)) {
2951 return cli;
2952 } else if (is_ipaddress(server)) {
2953 /* windows 9* needs a correct NMB name for connections */
2954 fstring remote_name;
2955
2956 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2957 cli = get_ipc_connect(remote_name, server_ss, user_info);
2958 if (cli)
2959 return cli;
2960 }
2961 }
2962 return NULL;
2963 }
2964
2965 /*
2966 * Given the IP address of a master browser on the network, return its
2967 * workgroup and connect to it.
2968 *
2969 * This function is provided to allow additional processing beyond what
2970 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2971 * browsers and obtain each master browsers' list of domains (in case the
2972 * first master browser is recently on the network and has not yet
2973 * synchronized with other master browsers and therefore does not yet have the
2974 * entire network browse list)
2975 */
2976
2977 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2978 struct sockaddr_storage *mb_ip,
2979 const struct user_auth_info *user_info,
2980 char **pp_workgroup_out)
2981 {
2982 char addr[INET6_ADDRSTRLEN];
2983 fstring name;
2984 struct cli_state *cli;
2985 struct sockaddr_storage server_ss;
2986
2987 *pp_workgroup_out = NULL;
2988
2989 print_sockaddr(addr, sizeof(addr), mb_ip);
2990 DEBUG(99, ("Looking up name of master browser %s\n",
2991 addr));
2992
2993 /*
2994 * Do a name status query to find out the name of the master browser.
2995 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2996 * master browser will not respond to a wildcard query (or, at least,
2997 * an NT4 server acting as the domain master browser will not).
2998 *
2999 * We might be able to use ONLY the query on MSBROWSE, but that's not
3000 * yet been tested with all Windows versions, so until it is, leave
3001 * the original wildcard query as the first choice and fall back to
3002 * MSBROWSE if the wildcard query fails.
3003 */
3004 if (!name_status_find("*", 0, 0x1d, mb_ip, name) &&
3005 !name_status_find(MSBROWSE, 1, 0x1d, mb_ip, name)) {
3006
3007 DEBUG(99, ("Could not retrieve name status for %s\n",
3008 addr));
3009 return NULL;
3010 }
3011
3012 if (!find_master_ip(name, &server_ss)) {
3013 DEBUG(99, ("Could not find master ip for %s\n", name));
3014 return NULL;
3015 }
3016
3017 *pp_workgroup_out = talloc_strdup(ctx, name);
3018
3019 DEBUG(4, ("found master browser %s, %s\n", name, addr));
3020
3021 print_sockaddr(addr, sizeof(addr), &server_ss);
3022 cli = get_ipc_connect(addr, &server_ss, user_info);
3023
3024 return cli;
3025 }
3026
3027 /*
3028 * Return the IP address and workgroup of a master browser on the network, and
3029 * connect to it.
3030 */
3031
3032 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
3033 const struct user_auth_info *user_info,
3034 char **pp_workgroup_out)
3035 {
3036 struct sockaddr_storage *ip_list;
3037 struct cli_state *cli;
3038 int i, count;
3039 NTSTATUS status;
3040
3041 *pp_workgroup_out = NULL;
3042
3043 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
3044
3045 /* Go looking for workgroups by broadcasting on the local network */
3046
3047 status = name_resolve_bcast(MSBROWSE, 1, talloc_tos(),
3048 &ip_list, &count);
3049 if (!NT_STATUS_IS_OK(status)) {
3050 DEBUG(99, ("No master browsers responded: %s\n",
3051 nt_errstr(status)));
3052 return NULL;
3053 }
3054
3055 for (i = 0; i < count; i++) {
3056 char addr[INET6_ADDRSTRLEN];
3057 print_sockaddr(addr, sizeof(addr), &ip_list[i]);
3058 DEBUG(99, ("Found master browser %s\n", addr));
3059
3060 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
3061 user_info, pp_workgroup_out);
3062 if (cli)
3063 return(cli);
3064 }
3065
3066 return NULL;
3067 }
WIP