?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix array size of a memmber of struct cli_ulogoff_state
[Samba/gbeck.git] / source3 / libsmb / cliconnect.c
blobebfc98b179539c74682b1a56be7ad7fbeec2944c
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "popt_common.h"
23 #include "../libcli/auth/libcli_auth.h"
24 #include "../libcli/auth/spnego.h"
25 #include "smb_krb5.h"
26 #include "../libcli/auth/ntlmssp.h"
27 #include "libads/kerberos_proto.h"
28 #include "krb5_env.h"
29
30 static const struct {
31 int prot;
32 const char name[24];
33 } prots[10] = {
34 {PROTOCOL_CORE, "PC NETWORK PROGRAM 1.0"},
35 {PROTOCOL_COREPLUS, "MICROSOFT NETWORKS 1.03"},
36 {PROTOCOL_LANMAN1, "MICROSOFT NETWORKS 3.0"},
37 {PROTOCOL_LANMAN1, "LANMAN1.0"},
38 {PROTOCOL_LANMAN2, "LM1.2X002"},
39 {PROTOCOL_LANMAN2, "DOS LANMAN2.1"},
40 {PROTOCOL_LANMAN2, "LANMAN2.1"},
41 {PROTOCOL_LANMAN2, "Samba"},
42 {PROTOCOL_NT1, "NT LANMAN 1.0"},
43 {PROTOCOL_NT1, "NT LM 0.12"},
44 };
45
46 #define STAR_SMBSERVER "*SMBSERVER"
47
48 /**
49 * Set the user session key for a connection
50 * @param cli The cli structure to add it too
51 * @param session_key The session key used. (A copy of this is taken for the cli struct)
52 *
53 */
54
55 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
56 {
57 cli->user_session_key = data_blob(session_key.data, session_key.length);
58 }
59
60 /****************************************************************************
61 Do an old lanman2 style session setup.
62 ****************************************************************************/
63
64 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
65 const char *user,
66 const char *pass, size_t passlen,
67 const char *workgroup)
68 {
69 DATA_BLOB session_key = data_blob_null;
70 DATA_BLOB lm_response = data_blob_null;
71 NTSTATUS status;
72 fstring pword;
73 char *p;
74
75 if (passlen > sizeof(pword)-1) {
76 return NT_STATUS_INVALID_PARAMETER;
77 }
78
79 /* LANMAN servers predate NT status codes and Unicode and ignore those
80 smb flags so we must disable the corresponding default capabilities
81 that would otherwise cause the Unicode and NT Status flags to be
82 set (and even returned by the server) */
83
84 cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
85
86 /* if in share level security then don't send a password now */
87 if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
88 passlen = 0;
89
90 if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
91 /* Encrypted mode needed, and non encrypted password supplied. */
92 lm_response = data_blob(NULL, 24);
93 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
94 DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
95 return NT_STATUS_ACCESS_DENIED;
96 }
97 } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
98 /* Encrypted mode needed, and encrypted password supplied. */
99 lm_response = data_blob(pass, passlen);
100 } else if (passlen > 0) {
101 /* Plaintext mode needed, assume plaintext supplied. */
102 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
103 lm_response = data_blob(pass, passlen);
104 }
105
106 /* send a session setup command */
107 memset(cli->outbuf,'\0',smb_size);
108 cli_set_message(cli->outbuf,10, 0, True);
109 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
110 cli_setup_packet(cli);
111
112 SCVAL(cli->outbuf,smb_vwv0,0xFF);
113 SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
114 SSVAL(cli->outbuf,smb_vwv3,2);
115 SSVAL(cli->outbuf,smb_vwv4,1);
116 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
117 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
118
119 p = smb_buf(cli->outbuf);
120 memcpy(p,lm_response.data,lm_response.length);
121 p += lm_response.length;
122 p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
123 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
124 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
125 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
126 cli_setup_bcc(cli, p);
127
128 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
129 return cli_nt_error(cli);
130 }
131
132 show_msg(cli->inbuf);
133
134 if (cli_is_error(cli)) {
135 return cli_nt_error(cli);
136 }
137
138 /* use the returned vuid from now on */
139 cli->vuid = SVAL(cli->inbuf,smb_uid);
140 status = cli_set_username(cli, user);
141 if (!NT_STATUS_IS_OK(status)) {
142 return status;
143 }
144
145 if (session_key.data) {
146 /* Have plaintext orginal */
147 cli_set_session_key(cli, session_key);
148 }
149
150 return NT_STATUS_OK;
151 }
152
153 /****************************************************************************
154 Work out suitable capabilities to offer the server.
155 ****************************************************************************/
156
157 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
158 {
159 uint32 capabilities = CAP_NT_SMBS;
160
161 if (!cli->force_dos_errors)
162 capabilities |= CAP_STATUS32;
163
164 if (cli->use_level_II_oplocks)
165 capabilities |= CAP_LEVEL_II_OPLOCKS;
166
167 capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
168 return capabilities;
169 }
170
171 /****************************************************************************
172 Do a NT1 guest session setup.
173 ****************************************************************************/
174
175 struct cli_session_setup_guest_state {
176 struct cli_state *cli;
177 uint16_t vwv[16];
178 struct iovec bytes;
179 };
180
181 static void cli_session_setup_guest_done(struct tevent_req *subreq);
182
183 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
184 struct event_context *ev,
185 struct cli_state *cli,
186 struct tevent_req **psmbreq)
187 {
188 struct tevent_req *req, *subreq;
189 struct cli_session_setup_guest_state *state;
190 uint16_t *vwv;
191 uint8_t *bytes;
192
193 req = tevent_req_create(mem_ctx, &state,
194 struct cli_session_setup_guest_state);
195 if (req == NULL) {
196 return NULL;
197 }
198 state->cli = cli;
199 vwv = state->vwv;
200
201 SCVAL(vwv+0, 0, 0xFF);
202 SCVAL(vwv+0, 1, 0);
203 SSVAL(vwv+1, 0, 0);
204 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
205 SSVAL(vwv+3, 0, 2);
206 SSVAL(vwv+4, 0, cli->pid);
207 SIVAL(vwv+5, 0, cli->sesskey);
208 SSVAL(vwv+7, 0, 0);
209 SSVAL(vwv+8, 0, 0);
210 SSVAL(vwv+9, 0, 0);
211 SSVAL(vwv+10, 0, 0);
212 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
213
214 bytes = talloc_array(state, uint8_t, 0);
215
216 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* username */
217 NULL);
218 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
219 NULL);
220 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
221 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
222
223 if (bytes == NULL) {
224 TALLOC_FREE(req);
225 return NULL;
226 }
227
228 state->bytes.iov_base = (void *)bytes;
229 state->bytes.iov_len = talloc_get_size(bytes);
230
231 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
232 1, &state->bytes);
233 if (subreq == NULL) {
234 TALLOC_FREE(req);
235 return NULL;
236 }
237 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
238 *psmbreq = subreq;
239 return req;
240 }
241
242 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
243 struct event_context *ev,
244 struct cli_state *cli)
245 {
246 struct tevent_req *req, *subreq;
247 NTSTATUS status;
248
249 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
250 if (req == NULL) {
251 return NULL;
252 }
253
254 status = cli_smb_req_send(subreq);
255 if (NT_STATUS_IS_OK(status)) {
256 tevent_req_nterror(req, status);
257 return tevent_req_post(req, ev);
258 }
259 return req;
260 }
261
262 static void cli_session_setup_guest_done(struct tevent_req *subreq)
263 {
264 struct tevent_req *req = tevent_req_callback_data(
265 subreq, struct tevent_req);
266 struct cli_session_setup_guest_state *state = tevent_req_data(
267 req, struct cli_session_setup_guest_state);
268 struct cli_state *cli = state->cli;
269 uint32_t num_bytes;
270 uint8_t *in;
271 char *inbuf;
272 uint8_t *bytes;
273 uint8_t *p;
274 NTSTATUS status;
275
276 status = cli_smb_recv(subreq, state, &in, 0, NULL, NULL,
277 &num_bytes, &bytes);
278 TALLOC_FREE(subreq);
279 if (!NT_STATUS_IS_OK(status)) {
280 tevent_req_nterror(req, status);
281 return;
282 }
283
284 inbuf = (char *)in;
285 p = bytes;
286
287 cli->vuid = SVAL(inbuf, smb_uid);
288
289 p += clistr_pull(inbuf, cli->server_os, (char *)p, sizeof(fstring),
290 bytes+num_bytes-p, STR_TERMINATE);
291 p += clistr_pull(inbuf, cli->server_type, (char *)p, sizeof(fstring),
292 bytes+num_bytes-p, STR_TERMINATE);
293 p += clistr_pull(inbuf, cli->server_domain, (char *)p, sizeof(fstring),
294 bytes+num_bytes-p, STR_TERMINATE);
295
296 if (strstr(cli->server_type, "Samba")) {
297 cli->is_samba = True;
298 }
299
300 status = cli_set_username(cli, "");
301 if (!NT_STATUS_IS_OK(status)) {
302 tevent_req_nterror(req, status);
303 return;
304 }
305 tevent_req_done(req);
306 }
307
308 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
309 {
310 return tevent_req_simple_recv_ntstatus(req);
311 }
312
313 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
314 {
315 TALLOC_CTX *frame = talloc_stackframe();
316 struct event_context *ev;
317 struct tevent_req *req;
318 NTSTATUS status = NT_STATUS_OK;
319
320 if (cli_has_async_calls(cli)) {
321 /*
322 * Can't use sync call while an async call is in flight
323 */
324 status = NT_STATUS_INVALID_PARAMETER;
325 goto fail;
326 }
327
328 ev = event_context_init(frame);
329 if (ev == NULL) {
330 status = NT_STATUS_NO_MEMORY;
331 goto fail;
332 }
333
334 req = cli_session_setup_guest_send(frame, ev, cli);
335 if (req == NULL) {
336 status = NT_STATUS_NO_MEMORY;
337 goto fail;
338 }
339
340 if (!tevent_req_poll(req, ev)) {
341 status = map_nt_error_from_unix(errno);
342 goto fail;
343 }
344
345 status = cli_session_setup_guest_recv(req);
346 fail:
347 TALLOC_FREE(frame);
348 if (!NT_STATUS_IS_OK(status)) {
349 cli_set_error(cli, status);
350 }
351 return status;
352 }
353
354 /****************************************************************************
355 Do a NT1 plaintext session setup.
356 ****************************************************************************/
357
358 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
359 const char *user, const char *pass,
360 const char *workgroup)
361 {
362 uint32 capabilities = cli_session_setup_capabilities(cli);
363 char *p;
364 NTSTATUS status;
365 fstring lanman;
366
367 fstr_sprintf( lanman, "Samba %s", samba_version_string());
368
369 memset(cli->outbuf, '\0', smb_size);
370 cli_set_message(cli->outbuf,13,0,True);
371 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
372 cli_setup_packet(cli);
373
374 SCVAL(cli->outbuf,smb_vwv0,0xFF);
375 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
376 SSVAL(cli->outbuf,smb_vwv3,2);
377 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
378 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
379 SSVAL(cli->outbuf,smb_vwv8,0);
380 SIVAL(cli->outbuf,smb_vwv11,capabilities);
381 p = smb_buf(cli->outbuf);
382
383 /* check wether to send the ASCII or UNICODE version of the password */
384
385 if ( (capabilities & CAP_UNICODE) == 0 ) {
386 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
387 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
388 }
389 else {
390 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
391 * the space taken by the unicode password to be one byte too
392 * long (as we're on an odd byte boundary here). Reduce the
393 * count by 1 to cope with this. Fixes smbclient against NetApp
394 * servers which can't cope. Fix from
395 * bryan.kolodziej@allenlund.com in bug #3840.
396 */
397 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
398 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
399 }
400
401 p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
402 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
403 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
404 p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
405 cli_setup_bcc(cli, p);
406
407 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
408 return cli_nt_error(cli);
409 }
410
411 show_msg(cli->inbuf);
412
413 if (cli_is_error(cli)) {
414 return cli_nt_error(cli);
415 }
416
417 cli->vuid = SVAL(cli->inbuf,smb_uid);
418 p = smb_buf(cli->inbuf);
419 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
420 -1, STR_TERMINATE);
421 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
422 -1, STR_TERMINATE);
423 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
424 -1, STR_TERMINATE);
425 status = cli_set_username(cli, user);
426 if (!NT_STATUS_IS_OK(status)) {
427 return status;
428 }
429 if (strstr(cli->server_type, "Samba")) {
430 cli->is_samba = True;
431 }
432
433 return NT_STATUS_OK;
434 }
435
436 /****************************************************************************
437 do a NT1 NTLM/LM encrypted session setup - for when extended security
438 is not negotiated.
439 @param cli client state to create do session setup on
440 @param user username
441 @param pass *either* cleartext password (passlen !=24) or LM response.
442 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
443 @param workgroup The user's domain.
444 ****************************************************************************/
445
446 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
447 const char *pass, size_t passlen,
448 const char *ntpass, size_t ntpasslen,
449 const char *workgroup)
450 {
451 uint32 capabilities = cli_session_setup_capabilities(cli);
452 DATA_BLOB lm_response = data_blob_null;
453 DATA_BLOB nt_response = data_blob_null;
454 DATA_BLOB session_key = data_blob_null;
455 NTSTATUS result;
456 char *p;
457 bool ok;
458
459 if (passlen == 0) {
460 /* do nothing - guest login */
461 } else if (passlen != 24) {
462 if (lp_client_ntlmv2_auth()) {
463 DATA_BLOB server_chal;
464 DATA_BLOB names_blob;
465 server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
466
467 /* note that the 'workgroup' here is a best guess - we don't know
468 the server's domain at this point. The 'server name' is also
469 dodgy...
470 */
471 names_blob = NTLMv2_generate_names_blob(NULL, cli->called.name, workgroup);
472
473 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass, &server_chal,
474 &names_blob,
475 &lm_response, &nt_response, NULL, &session_key)) {
476 data_blob_free(&names_blob);
477 data_blob_free(&server_chal);
478 return NT_STATUS_ACCESS_DENIED;
479 }
480 data_blob_free(&names_blob);
481 data_blob_free(&server_chal);
482
483 } else {
484 uchar nt_hash[16];
485 E_md4hash(pass, nt_hash);
486
487 #ifdef LANMAN_ONLY
488 nt_response = data_blob_null;
489 #else
490 nt_response = data_blob(NULL, 24);
491 SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
492 #endif
493 /* non encrypted password supplied. Ignore ntpass. */
494 if (lp_client_lanman_auth()) {
495 lm_response = data_blob(NULL, 24);
496 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
497 /* Oops, the LM response is invalid, just put
498 the NT response there instead */
499 data_blob_free(&lm_response);
500 lm_response = data_blob(nt_response.data, nt_response.length);
501 }
502 } else {
503 /* LM disabled, place NT# in LM field instead */
504 lm_response = data_blob(nt_response.data, nt_response.length);
505 }
506
507 session_key = data_blob(NULL, 16);
508 #ifdef LANMAN_ONLY
509 E_deshash(pass, session_key.data);
510 memset(&session_key.data[8], '\0', 8);
511 #else
512 SMBsesskeygen_ntv1(nt_hash, session_key.data);
513 #endif
514 }
515 cli_temp_set_signing(cli);
516 } else {
517 /* pre-encrypted password supplied. Only used for
518 security=server, can't do
519 signing because we don't have original key */
520
521 lm_response = data_blob(pass, passlen);
522 nt_response = data_blob(ntpass, ntpasslen);
523 }
524
525 /* send a session setup command */
526 memset(cli->outbuf,'\0',smb_size);
527
528 cli_set_message(cli->outbuf,13,0,True);
529 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
530 cli_setup_packet(cli);
531
532 SCVAL(cli->outbuf,smb_vwv0,0xFF);
533 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
534 SSVAL(cli->outbuf,smb_vwv3,2);
535 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
536 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
537 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
538 SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
539 SIVAL(cli->outbuf,smb_vwv11,capabilities);
540 p = smb_buf(cli->outbuf);
541 if (lm_response.length) {
542 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
543 }
544 if (nt_response.length) {
545 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
546 }
547 p += clistr_push(cli, p, user, -1, STR_TERMINATE);
548
549 /* Upper case here might help some NTLMv2 implementations */
550 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
551 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
552 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
553 cli_setup_bcc(cli, p);
554
555 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
556 result = cli_nt_error(cli);
557 goto end;
558 }
559
560 /* show_msg(cli->inbuf); */
561
562 if (cli_is_error(cli)) {
563 result = cli_nt_error(cli);
564 goto end;
565 }
566
567 #ifdef LANMAN_ONLY
568 ok = cli_simple_set_signing(cli, session_key, lm_response);
569 #else
570 ok = cli_simple_set_signing(cli, session_key, nt_response);
571 #endif
572 if (ok) {
573 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
574 result = NT_STATUS_ACCESS_DENIED;
575 goto end;
576 }
577 }
578
579 /* use the returned vuid from now on */
580 cli->vuid = SVAL(cli->inbuf,smb_uid);
581
582 p = smb_buf(cli->inbuf);
583 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
584 -1, STR_TERMINATE);
585 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
586 -1, STR_TERMINATE);
587 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
588 -1, STR_TERMINATE);
589
590 if (strstr(cli->server_type, "Samba")) {
591 cli->is_samba = True;
592 }
593
594 result = cli_set_username(cli, user);
595 if (!NT_STATUS_IS_OK(result)) {
596 goto end;
597 }
598
599 if (session_key.data) {
600 /* Have plaintext orginal */
601 cli_set_session_key(cli, session_key);
602 }
603
604 result = NT_STATUS_OK;
605 end:
606 data_blob_free(&lm_response);
607 data_blob_free(&nt_response);
608 data_blob_free(&session_key);
609 return result;
610 }
611
612 /* The following is calculated from :
613 * (smb_size-4) = 35
614 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
615 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
616 * end of packet.
617 */
618
619 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
620
621 struct cli_sesssetup_blob_state {
622 struct tevent_context *ev;
623 struct cli_state *cli;
624 DATA_BLOB blob;
625 uint16_t max_blob_size;
626 uint16_t vwv[12];
627 uint8_t *buf;
628
629 NTSTATUS status;
630 char *inbuf;
631 DATA_BLOB ret_blob;
632 };
633
634 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
635 struct tevent_req **psubreq);
636 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
637
638 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
639 struct tevent_context *ev,
640 struct cli_state *cli,
641 DATA_BLOB blob)
642 {
643 struct tevent_req *req, *subreq;
644 struct cli_sesssetup_blob_state *state;
645
646 req = tevent_req_create(mem_ctx, &state,
647 struct cli_sesssetup_blob_state);
648 if (req == NULL) {
649 return NULL;
650 }
651 state->ev = ev;
652 state->blob = blob;
653 state->cli = cli;
654
655 if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
656 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
657 "(was %u, need minimum %u)\n",
658 (unsigned int)cli->max_xmit,
659 BASE_SESSSETUP_BLOB_PACKET_SIZE));
660 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
661 return tevent_req_post(req, ev);
662 }
663 state->max_blob_size =
664 MIN(cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE, 0xFFFF);
665
666 if (!cli_sesssetup_blob_next(state, &subreq)) {
667 tevent_req_nomem(NULL, req);
668 return tevent_req_post(req, ev);
669 }
670 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
671 return req;
672 }
673
674 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
675 struct tevent_req **psubreq)
676 {
677 struct tevent_req *subreq;
678 uint16_t thistime;
679
680 SCVAL(state->vwv+0, 0, 0xFF);
681 SCVAL(state->vwv+0, 1, 0);
682 SSVAL(state->vwv+1, 0, 0);
683 SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
684 SSVAL(state->vwv+3, 0, 2);
685 SSVAL(state->vwv+4, 0, 1);
686 SIVAL(state->vwv+5, 0, 0);
687
688 thistime = MIN(state->blob.length, state->max_blob_size);
689 SSVAL(state->vwv+7, 0, thistime);
690
691 SSVAL(state->vwv+8, 0, 0);
692 SSVAL(state->vwv+9, 0, 0);
693 SIVAL(state->vwv+10, 0,
694 cli_session_setup_capabilities(state->cli)
695 | CAP_EXTENDED_SECURITY);
696
697 state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
698 thistime);
699 if (state->buf == NULL) {
700 return false;
701 }
702 state->blob.data += thistime;
703 state->blob.length -= thistime;
704
705 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
706 "Unix", 5, NULL);
707 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
708 "Samba", 6, NULL);
709 if (state->buf == NULL) {
710 return false;
711 }
712 subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
713 12, state->vwv,
714 talloc_get_size(state->buf), state->buf);
715 if (subreq == NULL) {
716 return false;
717 }
718 *psubreq = subreq;
719 return true;
720 }
721
722 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
723 {
724 struct tevent_req *req = tevent_req_callback_data(
725 subreq, struct tevent_req);
726 struct cli_sesssetup_blob_state *state = tevent_req_data(
727 req, struct cli_sesssetup_blob_state);
728 struct cli_state *cli = state->cli;
729 uint8_t wct;
730 uint16_t *vwv;
731 uint32_t num_bytes;
732 uint8_t *bytes;
733 NTSTATUS status;
734 uint8_t *p;
735 uint16_t blob_length;
736 uint8_t *inbuf;
737
738 status = cli_smb_recv(subreq, state, &inbuf, 1, &wct, &vwv,
739 &num_bytes, &bytes);
740 TALLOC_FREE(subreq);
741 if (!NT_STATUS_IS_OK(status)
742 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
743 tevent_req_nterror(req, status);
744 return;
745 }
746
747 state->status = status;
748 TALLOC_FREE(state->buf);
749
750 state->inbuf = (char *)inbuf;
751 cli->vuid = SVAL(state->inbuf, smb_uid);
752
753 blob_length = SVAL(vwv+3, 0);
754 if (blob_length > num_bytes) {
755 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
756 return;
757 }
758 state->ret_blob = data_blob_const(bytes, blob_length);
759
760 p = bytes + blob_length;
761
762 p += clistr_pull(state->inbuf, cli->server_os,
763 (char *)p, sizeof(fstring),
764 bytes+num_bytes-p, STR_TERMINATE);
765 p += clistr_pull(state->inbuf, cli->server_type,
766 (char *)p, sizeof(fstring),
767 bytes+num_bytes-p, STR_TERMINATE);
768 p += clistr_pull(state->inbuf, cli->server_domain,
769 (char *)p, sizeof(fstring),
770 bytes+num_bytes-p, STR_TERMINATE);
771
772 if (strstr(cli->server_type, "Samba")) {
773 cli->is_samba = True;
774 }
775
776 if (state->blob.length != 0) {
777 /*
778 * More to send
779 */
780 if (!cli_sesssetup_blob_next(state, &subreq)) {
781 tevent_req_nomem(NULL, req);
782 return;
783 }
784 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
785 return;
786 }
787 tevent_req_done(req);
788 }
789
790 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
791 TALLOC_CTX *mem_ctx,
792 DATA_BLOB *pblob,
793 char **pinbuf)
794 {
795 struct cli_sesssetup_blob_state *state = tevent_req_data(
796 req, struct cli_sesssetup_blob_state);
797 NTSTATUS status;
798 char *inbuf;
799
800 if (tevent_req_is_nterror(req, &status)) {
801 state->cli->vuid = 0;
802 return status;
803 }
804
805 inbuf = talloc_move(mem_ctx, &state->inbuf);
806 if (pblob != NULL) {
807 *pblob = state->ret_blob;
808 }
809 if (pinbuf != NULL) {
810 *pinbuf = inbuf;
811 }
812 /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
813 return state->status;
814 }
815
816 #ifdef HAVE_KRB5
817
818 /****************************************************************************
819 Use in-memory credentials cache
820 ****************************************************************************/
821
822 static void use_in_memory_ccache(void) {
823 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
824 }
825
826 /****************************************************************************
827 Do a spnego/kerberos encrypted session setup.
828 ****************************************************************************/
829
830 struct cli_session_setup_kerberos_state {
831 struct cli_state *cli;
832 DATA_BLOB negTokenTarg;
833 DATA_BLOB session_key_krb5;
834 ADS_STATUS ads_status;
835 };
836
837 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
838
839 static struct tevent_req *cli_session_setup_kerberos_send(
840 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
841 const char *principal, const char *workgroup)
842 {
843 struct tevent_req *req, *subreq;
844 struct cli_session_setup_kerberos_state *state;
845 int rc;
846
847 DEBUG(2,("Doing kerberos session setup\n"));
848
849 req = tevent_req_create(mem_ctx, &state,
850 struct cli_session_setup_kerberos_state);
851 if (req == NULL) {
852 return NULL;
853 }
854 state->cli = cli;
855 state->ads_status = ADS_SUCCESS;
856
857 cli_temp_set_signing(cli);
858
859 /*
860 * Ok, this is cheating: spnego_gen_krb5_negTokenInit can block if
861 * we have to acquire a ticket. To be fixed later :-)
862 */
863 rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
864 &state->session_key_krb5, 0, NULL);
865 if (rc) {
866 DEBUG(1, ("cli_session_setup_kerberos: "
867 "spnego_gen_krb5_negTokenInit failed: %s\n",
868 error_message(rc)));
869 state->ads_status = ADS_ERROR_KRB5(rc);
870 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
871 return tevent_req_post(req, ev);
872 }
873
874 #if 0
875 file_save("negTokenTarg.dat", state->negTokenTarg.data,
876 state->negTokenTarg.length);
877 #endif
878
879 subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
880 if (tevent_req_nomem(subreq, req)) {
881 return tevent_req_post(req, ev);
882 }
883 tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
884 return req;
885 }
886
887 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
888 {
889 struct tevent_req *req = tevent_req_callback_data(
890 subreq, struct tevent_req);
891 struct cli_session_setup_kerberos_state *state = tevent_req_data(
892 req, struct cli_session_setup_kerberos_state);
893 char *inbuf = NULL;
894 NTSTATUS status;
895
896 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), NULL, &inbuf);
897 if (!NT_STATUS_IS_OK(status)) {
898 TALLOC_FREE(subreq);
899 tevent_req_nterror(req, status);
900 return;
901 }
902
903 cli_set_session_key(state->cli, state->session_key_krb5);
904
905 if (cli_simple_set_signing(state->cli, state->session_key_krb5,
906 data_blob_null)
907 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
908 TALLOC_FREE(subreq);
909 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
910 return;
911 }
912 TALLOC_FREE(subreq);
913 tevent_req_done(req);
914 }
915
916 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
917 {
918 struct cli_session_setup_kerberos_state *state = tevent_req_data(
919 req, struct cli_session_setup_kerberos_state);
920 NTSTATUS status;
921
922 if (tevent_req_is_nterror(req, &status)) {
923 return ADS_ERROR_NT(status);
924 }
925 return state->ads_status;
926 }
927
928 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
929 const char *principal,
930 const char *workgroup)
931 {
932 struct tevent_context *ev;
933 struct tevent_req *req;
934 ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
935
936 if (cli_has_async_calls(cli)) {
937 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
938 }
939 ev = tevent_context_init(talloc_tos());
940 if (ev == NULL) {
941 goto fail;
942 }
943 req = cli_session_setup_kerberos_send(ev, ev, cli, principal,
944 workgroup);
945 if (req == NULL) {
946 goto fail;
947 }
948 if (!tevent_req_poll(req, ev)) {
949 status = ADS_ERROR_SYSTEM(errno);
950 goto fail;
951 }
952 status = cli_session_setup_kerberos_recv(req);
953 fail:
954 TALLOC_FREE(ev);
955 return status;
956 }
957 #endif /* HAVE_KRB5 */
958
959 /****************************************************************************
960 Do a spnego/NTLMSSP encrypted session setup.
961 ****************************************************************************/
962
963 struct cli_session_setup_ntlmssp_state {
964 struct tevent_context *ev;
965 struct cli_state *cli;
966 struct ntlmssp_state *ntlmssp_state;
967 int turn;
968 DATA_BLOB blob_out;
969 };
970
971 static int cli_session_setup_ntlmssp_state_destructor(
972 struct cli_session_setup_ntlmssp_state *state)
973 {
974 if (state->ntlmssp_state != NULL) {
975 TALLOC_FREE(state->ntlmssp_state);
976 }
977 return 0;
978 }
979
980 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
981
982 static struct tevent_req *cli_session_setup_ntlmssp_send(
983 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
984 const char *user, const char *pass, const char *domain)
985 {
986 struct tevent_req *req, *subreq;
987 struct cli_session_setup_ntlmssp_state *state;
988 NTSTATUS status;
989 DATA_BLOB blob_out;
990 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
991
992 req = tevent_req_create(mem_ctx, &state,
993 struct cli_session_setup_ntlmssp_state);
994 if (req == NULL) {
995 return NULL;
996 }
997 state->ev = ev;
998 state->cli = cli;
999 state->turn = 1;
1000
1001 state->ntlmssp_state = NULL;
1002 talloc_set_destructor(
1003 state, cli_session_setup_ntlmssp_state_destructor);
1004
1005 cli_temp_set_signing(cli);
1006
1007 status = ntlmssp_client_start(state,
1008 global_myname(),
1009 lp_workgroup(),
1010 lp_client_ntlmv2_auth(),
1011 &state->ntlmssp_state);
1012 if (!NT_STATUS_IS_OK(status)) {
1013 goto fail;
1014 }
1015 ntlmssp_want_feature(state->ntlmssp_state,
1016 NTLMSSP_FEATURE_SESSION_KEY);
1017 if (cli->use_ccache) {
1018 ntlmssp_want_feature(state->ntlmssp_state,
1019 NTLMSSP_FEATURE_CCACHE);
1020 }
1021 status = ntlmssp_set_username(state->ntlmssp_state, user);
1022 if (!NT_STATUS_IS_OK(status)) {
1023 goto fail;
1024 }
1025 status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1026 if (!NT_STATUS_IS_OK(status)) {
1027 goto fail;
1028 }
1029 status = ntlmssp_set_password(state->ntlmssp_state, pass);
1030 if (!NT_STATUS_IS_OK(status)) {
1031 goto fail;
1032 }
1033 status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1034 &blob_out);
1035 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1036 goto fail;
1037 }
1038
1039 state->blob_out = spnego_gen_negTokenInit(state, OIDs_ntlm, &blob_out, NULL);
1040 data_blob_free(&blob_out);
1041
1042 subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1043 if (tevent_req_nomem(subreq, req)) {
1044 return tevent_req_post(req, ev);
1045 }
1046 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1047 return req;
1048 fail:
1049 tevent_req_nterror(req, status);
1050 return tevent_req_post(req, ev);
1051 }
1052
1053 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1054 {
1055 struct tevent_req *req = tevent_req_callback_data(
1056 subreq, struct tevent_req);
1057 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1058 req, struct cli_session_setup_ntlmssp_state);
1059 DATA_BLOB blob_in, msg_in, blob_out;
1060 char *inbuf = NULL;
1061 bool parse_ret;
1062 NTSTATUS status;
1063
1064 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1065 &inbuf);
1066 TALLOC_FREE(subreq);
1067 data_blob_free(&state->blob_out);
1068
1069 if (NT_STATUS_IS_OK(status)) {
1070 if (state->cli->server_domain[0] == '\0') {
1071 fstrcpy(state->cli->server_domain,
1072 state->ntlmssp_state->server.netbios_domain);
1073 }
1074 cli_set_session_key(
1075 state->cli, state->ntlmssp_state->session_key);
1076
1077 if (cli_simple_set_signing(
1078 state->cli, state->ntlmssp_state->session_key,
1079 data_blob_null)
1080 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1081 TALLOC_FREE(subreq);
1082 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1083 return;
1084 }
1085 TALLOC_FREE(subreq);
1086 TALLOC_FREE(state->ntlmssp_state);
1087 tevent_req_done(req);
1088 return;
1089 }
1090 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1091 tevent_req_nterror(req, status);
1092 return;
1093 }
1094
1095 if (blob_in.length == 0) {
1096 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1097 return;
1098 }
1099
1100 if ((state->turn == 1)
1101 && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1102 DATA_BLOB tmp_blob = data_blob_null;
1103 /* the server might give us back two challenges */
1104 parse_ret = spnego_parse_challenge(state, blob_in, &msg_in,
1105 &tmp_blob);
1106 data_blob_free(&tmp_blob);
1107 } else {
1108 parse_ret = spnego_parse_auth_response(state, blob_in, status,
1109 OID_NTLMSSP, &msg_in);
1110 }
1111 state->turn += 1;
1112
1113 if (!parse_ret) {
1114 DEBUG(3,("Failed to parse auth response\n"));
1115 if (NT_STATUS_IS_OK(status)
1116 || NT_STATUS_EQUAL(status,
1117 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1118 tevent_req_nterror(
1119 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1120 return;
1121 }
1122 }
1123
1124 status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1125
1126 if (!NT_STATUS_IS_OK(status)
1127 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1128 TALLOC_FREE(subreq);
1129 TALLOC_FREE(state->ntlmssp_state);
1130 tevent_req_nterror(req, status);
1131 return;
1132 }
1133
1134 state->blob_out = spnego_gen_auth(state, blob_out);
1135 TALLOC_FREE(subreq);
1136 if (tevent_req_nomem(state->blob_out.data, req)) {
1137 return;
1138 }
1139
1140 subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1141 state->blob_out);
1142 if (tevent_req_nomem(subreq, req)) {
1143 return;
1144 }
1145 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1146 }
1147
1148 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1149 {
1150 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1151 req, struct cli_session_setup_ntlmssp_state);
1152 NTSTATUS status;
1153
1154 if (tevent_req_is_nterror(req, &status)) {
1155 state->cli->vuid = 0;
1156 return status;
1157 }
1158 return NT_STATUS_OK;
1159 }
1160
1161 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1162 const char *user,
1163 const char *pass,
1164 const char *domain)
1165 {
1166 struct tevent_context *ev;
1167 struct tevent_req *req;
1168 NTSTATUS status = NT_STATUS_NO_MEMORY;
1169
1170 if (cli_has_async_calls(cli)) {
1171 return NT_STATUS_INVALID_PARAMETER;
1172 }
1173 ev = tevent_context_init(talloc_tos());
1174 if (ev == NULL) {
1175 goto fail;
1176 }
1177 req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1178 if (req == NULL) {
1179 goto fail;
1180 }
1181 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1182 goto fail;
1183 }
1184 status = cli_session_setup_ntlmssp_recv(req);
1185 fail:
1186 TALLOC_FREE(ev);
1187 if (!NT_STATUS_IS_OK(status)) {
1188 cli_set_error(cli, status);
1189 }
1190 return status;
1191 }
1192
1193 /****************************************************************************
1194 Do a spnego encrypted session setup.
1195
1196 user_domain: The shortname of the domain the user/machine is a member of.
1197 dest_realm: The realm we're connecting to, if NULL we use our default realm.
1198 ****************************************************************************/
1199
1200 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
1201 const char *pass, const char *user_domain,
1202 const char * dest_realm)
1203 {
1204 char *principal = NULL;
1205 char *OIDs[ASN1_MAX_OIDS];
1206 int i;
1207 DATA_BLOB blob;
1208 const char *p = NULL;
1209 char *account = NULL;
1210 NTSTATUS status;
1211
1212 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
1213
1214 /* the server might not even do spnego */
1215 if (cli->secblob.length <= 16) {
1216 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1217 goto ntlmssp;
1218 }
1219
1220 #if 0
1221 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1222 #endif
1223
1224 /* there is 16 bytes of GUID before the real spnego packet starts */
1225 blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
1226
1227 /* The server sent us the first part of the SPNEGO exchange in the
1228 * negprot reply. It is WRONG to depend on the principal sent in the
1229 * negprot reply, but right now we do it. If we don't receive one,
1230 * we try to best guess, then fall back to NTLM. */
1231 if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &principal, NULL)) {
1232 data_blob_free(&blob);
1233 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1234 }
1235 data_blob_free(&blob);
1236
1237 /* make sure the server understands kerberos */
1238 for (i=0;OIDs[i];i++) {
1239 if (i == 0)
1240 DEBUG(3,("got OID=%s\n", OIDs[i]));
1241 else
1242 DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1243 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1244 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1245 cli->got_kerberos_mechanism = True;
1246 }
1247 talloc_free(OIDs[i]);
1248 }
1249
1250 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1251
1252 status = cli_set_username(cli, user);
1253 if (!NT_STATUS_IS_OK(status)) {
1254 TALLOC_FREE(principal);
1255 return ADS_ERROR_NT(status);
1256 }
1257
1258 #ifdef HAVE_KRB5
1259 /* If password is set we reauthenticate to kerberos server
1260 * and do not store results */
1261
1262 if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1263 ADS_STATUS rc;
1264
1265 if (pass && *pass) {
1266 int ret;
1267
1268 use_in_memory_ccache();
1269 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1270
1271 if (ret){
1272 TALLOC_FREE(principal);
1273 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1274 if (cli->fallback_after_kerberos)
1275 goto ntlmssp;
1276 return ADS_ERROR_KRB5(ret);
1277 }
1278 }
1279
1280 /* If we get a bad principal, try to guess it if
1281 we have a valid host NetBIOS name.
1282 */
1283 if (strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1284 TALLOC_FREE(principal);
1285 }
1286
1287 if (principal == NULL &&
1288 !is_ipaddress(cli->desthost) &&
1289 !strequal(STAR_SMBSERVER,
1290 cli->desthost)) {
1291 char *realm = NULL;
1292 char *machine = NULL;
1293 char *host = NULL;
1294 DEBUG(3,("cli_session_setup_spnego: got a "
1295 "bad server principal, trying to guess ...\n"));
1296
1297 host = strchr_m(cli->desthost, '.');
1298 if (host) {
1299 /* We had a '.' in the name. */
1300 machine = SMB_STRNDUP(cli->desthost,
1301 host - cli->desthost);
1302 } else {
1303 machine = SMB_STRDUP(cli->desthost);
1304 }
1305 if (machine == NULL) {
1306 TALLOC_FREE(principal);
1307 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1308 }
1309
1310 if (dest_realm) {
1311 realm = SMB_STRDUP(dest_realm);
1312 strupper_m(realm);
1313 } else {
1314 if (host) {
1315 /* DNS name. */
1316 realm = kerberos_get_realm_from_hostname(cli->desthost);
1317 } else {
1318 /* NetBIOS name - use our realm. */
1319 realm = kerberos_get_default_realm_from_ccache();
1320 }
1321 }
1322
1323 if (realm && *realm) {
1324 if (host) {
1325 /* DNS name. */
1326 principal = talloc_asprintf(talloc_tos(),
1327 "cifs/%s@%s",
1328 cli->desthost,
1329 realm);
1330 } else {
1331 /* NetBIOS name, use machine account. */
1332 principal = talloc_asprintf(talloc_tos(),
1333 "%s$@%s",
1334 machine,
1335 realm);
1336 }
1337 if (!principal) {
1338 SAFE_FREE(machine);
1339 SAFE_FREE(realm);
1340 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1341 }
1342 DEBUG(3,("cli_session_setup_spnego: guessed "
1343 "server principal=%s\n",
1344 principal ? principal : "<null>"));
1345 }
1346 SAFE_FREE(machine);
1347 SAFE_FREE(realm);
1348 }
1349
1350 if (principal) {
1351 rc = cli_session_setup_kerberos(cli, principal,
1352 dest_realm);
1353 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1354 TALLOC_FREE(principal);
1355 return rc;
1356 }
1357 }
1358 }
1359 #endif
1360
1361 TALLOC_FREE(principal);
1362
1363 ntlmssp:
1364
1365 account = talloc_strdup(talloc_tos(), user);
1366 if (!account) {
1367 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1368 }
1369
1370 /* when falling back to ntlmssp while authenticating with a machine
1371 * account strip off the realm - gd */
1372
1373 if ((p = strchr_m(user, '@')) != NULL) {
1374 account[PTR_DIFF(p,user)] = '\0';
1375 }
1376
1377 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1378 }
1379
1380 /****************************************************************************
1381 Send a session setup. The username and workgroup is in UNIX character
1382 format and must be converted to DOS codepage format before sending. If the
1383 password is in plaintext, the same should be done.
1384 ****************************************************************************/
1385
1386 NTSTATUS cli_session_setup(struct cli_state *cli,
1387 const char *user,
1388 const char *pass, int passlen,
1389 const char *ntpass, int ntpasslen,
1390 const char *workgroup)
1391 {
1392 char *p;
1393 fstring user2;
1394
1395 if (user) {
1396 fstrcpy(user2, user);
1397 } else {
1398 user2[0] ='\0';
1399 }
1400
1401 if (!workgroup) {
1402 workgroup = "";
1403 }
1404
1405 /* allow for workgroups as part of the username */
1406 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1407 (p=strchr_m(user2,*lp_winbind_separator()))) {
1408 *p = 0;
1409 user = p+1;
1410 workgroup = user2;
1411 }
1412
1413 if (cli->protocol < PROTOCOL_LANMAN1) {
1414 return NT_STATUS_OK;
1415 }
1416
1417 /* now work out what sort of session setup we are going to
1418 do. I have split this into separate functions to make the
1419 flow a bit easier to understand (tridge) */
1420
1421 /* if its an older server then we have to use the older request format */
1422
1423 if (cli->protocol < PROTOCOL_NT1) {
1424 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1425 DEBUG(1, ("Server requested LM password but 'client lanman auth'"
1426 " is disabled\n"));
1427 return NT_STATUS_ACCESS_DENIED;
1428 }
1429
1430 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1431 !lp_client_plaintext_auth() && (*pass)) {
1432 DEBUG(1, ("Server requested plaintext password but "
1433 "'client plaintext auth' is disabled\n"));
1434 return NT_STATUS_ACCESS_DENIED;
1435 }
1436
1437 return cli_session_setup_lanman2(cli, user, pass, passlen,
1438 workgroup);
1439 }
1440
1441 /* if no user is supplied then we have to do an anonymous connection.
1442 passwords are ignored */
1443
1444 if (!user || !*user)
1445 return cli_session_setup_guest(cli);
1446
1447 /* if the server is share level then send a plaintext null
1448 password at this point. The password is sent in the tree
1449 connect */
1450
1451 if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1452 return cli_session_setup_plaintext(cli, user, "", workgroup);
1453
1454 /* if the server doesn't support encryption then we have to use
1455 plaintext. The second password is ignored */
1456
1457 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1458 if (!lp_client_plaintext_auth() && (*pass)) {
1459 DEBUG(1, ("Server requested plaintext password but "
1460 "'client plaintext auth' is disabled\n"));
1461 return NT_STATUS_ACCESS_DENIED;
1462 }
1463 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1464 }
1465
1466 /* if the server supports extended security then use SPNEGO */
1467
1468 if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1469 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1470 workgroup, NULL);
1471 if (!ADS_ERR_OK(status)) {
1472 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1473 return ads_ntstatus(status);
1474 }
1475 } else {
1476 NTSTATUS status;
1477
1478 /* otherwise do a NT1 style session setup */
1479 status = cli_session_setup_nt1(cli, user, pass, passlen,
1480 ntpass, ntpasslen, workgroup);
1481 if (!NT_STATUS_IS_OK(status)) {
1482 DEBUG(3,("cli_session_setup: NT1 session setup "
1483 "failed: %s\n", nt_errstr(status)));
1484 return status;
1485 }
1486 }
1487
1488 if (strstr(cli->server_type, "Samba")) {
1489 cli->is_samba = True;
1490 }
1491
1492 return NT_STATUS_OK;
1493 }
1494
1495 /****************************************************************************
1496 Send a uloggoff.
1497 *****************************************************************************/
1498
1499 struct cli_ulogoff_state {
1500 struct cli_state *cli;
1501 uint16_t vwv[3];
1502 };
1503
1504 static void cli_ulogoff_done(struct tevent_req *subreq);
1505
1506 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
1507 struct tevent_context *ev,
1508 struct cli_state *cli)
1509 {
1510 struct tevent_req *req, *subreq;
1511 struct cli_ulogoff_state *state;
1512
1513 req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
1514 if (req == NULL) {
1515 return NULL;
1516 }
1517 state->cli = cli;
1518
1519 SCVAL(state->vwv+0, 0, 0xFF);
1520 SCVAL(state->vwv+1, 0, 0);
1521 SSVAL(state->vwv+2, 0, 0);
1522
1523 subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
1524 0, NULL);
1525 if (tevent_req_nomem(subreq, req)) {
1526 return tevent_req_post(req, ev);
1527 }
1528 tevent_req_set_callback(subreq, cli_ulogoff_done, req);
1529 return req;
1530 }
1531
1532 static void cli_ulogoff_done(struct tevent_req *subreq)
1533 {
1534 struct tevent_req *req = tevent_req_callback_data(
1535 subreq, struct tevent_req);
1536 struct cli_ulogoff_state *state = tevent_req_data(
1537 req, struct cli_ulogoff_state);
1538 NTSTATUS status;
1539
1540 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
1541 if (!NT_STATUS_IS_OK(status)) {
1542 tevent_req_nterror(req, status);
1543 return;
1544 }
1545 state->cli->vuid = -1;
1546 tevent_req_done(req);
1547 }
1548
1549 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
1550 {
1551 return tevent_req_simple_recv_ntstatus(req);
1552 }
1553
1554 NTSTATUS cli_ulogoff(struct cli_state *cli)
1555 {
1556 struct tevent_context *ev;
1557 struct tevent_req *req;
1558 NTSTATUS status = NT_STATUS_NO_MEMORY;
1559
1560 if (cli_has_async_calls(cli)) {
1561 return NT_STATUS_INVALID_PARAMETER;
1562 }
1563 ev = tevent_context_init(talloc_tos());
1564 if (ev == NULL) {
1565 goto fail;
1566 }
1567 req = cli_ulogoff_send(ev, ev, cli);
1568 if (req == NULL) {
1569 goto fail;
1570 }
1571 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1572 goto fail;
1573 }
1574 status = cli_ulogoff_recv(req);
1575 fail:
1576 TALLOC_FREE(ev);
1577 if (!NT_STATUS_IS_OK(status)) {
1578 cli_set_error(cli, status);
1579 }
1580 return status;
1581 }
1582
1583 /****************************************************************************
1584 Send a tconX.
1585 ****************************************************************************/
1586
1587 struct cli_tcon_andx_state {
1588 struct cli_state *cli;
1589 uint16_t vwv[4];
1590 struct iovec bytes;
1591 };
1592
1593 static void cli_tcon_andx_done(struct tevent_req *subreq);
1594
1595 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
1596 struct event_context *ev,
1597 struct cli_state *cli,
1598 const char *share, const char *dev,
1599 const char *pass, int passlen,
1600 struct tevent_req **psmbreq)
1601 {
1602 struct tevent_req *req, *subreq;
1603 struct cli_tcon_andx_state *state;
1604 fstring pword;
1605 uint16_t *vwv;
1606 char *tmp = NULL;
1607 uint8_t *bytes;
1608
1609 *psmbreq = NULL;
1610
1611 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
1612 if (req == NULL) {
1613 return NULL;
1614 }
1615 state->cli = cli;
1616 vwv = state->vwv;
1617
1618 fstrcpy(cli->share, share);
1619
1620 /* in user level security don't send a password now */
1621 if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1622 passlen = 1;
1623 pass = "";
1624 } else if (pass == NULL) {
1625 DEBUG(1, ("Server not using user level security and no "
1626 "password supplied.\n"));
1627 goto access_denied;
1628 }
1629
1630 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1631 *pass && passlen != 24) {
1632 if (!lp_client_lanman_auth()) {
1633 DEBUG(1, ("Server requested LANMAN password "
1634 "(share-level security) but "
1635 "'client lanman auth' is disabled\n"));
1636 goto access_denied;
1637 }
1638
1639 /*
1640 * Non-encrypted passwords - convert to DOS codepage before
1641 * encryption.
1642 */
1643 passlen = 24;
1644 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1645 } else {
1646 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1647 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1648 == 0) {
1649 if (!lp_client_plaintext_auth() && (*pass)) {
1650 DEBUG(1, ("Server requested plaintext "
1651 "password but 'client plaintext "
1652 "auth' is disabled\n"));
1653 goto access_denied;
1654 }
1655
1656 /*
1657 * Non-encrypted passwords - convert to DOS codepage
1658 * before using.
1659 */
1660 passlen = clistr_push(cli, pword, pass, sizeof(pword),
1661 STR_TERMINATE);
1662 if (passlen == -1) {
1663 DEBUG(1, ("clistr_push(pword) failed\n"));
1664 goto access_denied;
1665 }
1666 } else {
1667 if (passlen) {
1668 memcpy(pword, pass, passlen);
1669 }
1670 }
1671 }
1672
1673 SCVAL(vwv+0, 0, 0xFF);
1674 SCVAL(vwv+0, 1, 0);
1675 SSVAL(vwv+1, 0, 0);
1676 SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1677 SSVAL(vwv+3, 0, passlen);
1678
1679 if (passlen) {
1680 bytes = (uint8_t *)talloc_memdup(state, pword, passlen);
1681 } else {
1682 bytes = talloc_array(state, uint8_t, 0);
1683 }
1684
1685 /*
1686 * Add the sharename
1687 */
1688 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1689 cli->desthost, share);
1690 if (tmp == NULL) {
1691 TALLOC_FREE(req);
1692 return NULL;
1693 }
1694 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1695 NULL);
1696 TALLOC_FREE(tmp);
1697
1698 /*
1699 * Add the devicetype
1700 */
1701 tmp = talloc_strdup_upper(talloc_tos(), dev);
1702 if (tmp == NULL) {
1703 TALLOC_FREE(req);
1704 return NULL;
1705 }
1706 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1707 TALLOC_FREE(tmp);
1708
1709 if (bytes == NULL) {
1710 TALLOC_FREE(req);
1711 return NULL;
1712 }
1713
1714 state->bytes.iov_base = (void *)bytes;
1715 state->bytes.iov_len = talloc_get_size(bytes);
1716
1717 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
1718 1, &state->bytes);
1719 if (subreq == NULL) {
1720 TALLOC_FREE(req);
1721 return NULL;
1722 }
1723 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
1724 *psmbreq = subreq;
1725 return req;
1726
1727 access_denied:
1728 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1729 return tevent_req_post(req, ev);
1730 }
1731
1732 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1733 struct event_context *ev,
1734 struct cli_state *cli,
1735 const char *share, const char *dev,
1736 const char *pass, int passlen)
1737 {
1738 struct tevent_req *req, *subreq;
1739 NTSTATUS status;
1740
1741 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
1742 &subreq);
1743 if (req == NULL) {
1744 return NULL;
1745 }
1746 if (subreq == NULL) {
1747 return req;
1748 }
1749 status = cli_smb_req_send(subreq);
1750 if (!NT_STATUS_IS_OK(status)) {
1751 tevent_req_nterror(req, status);
1752 return tevent_req_post(req, ev);
1753 }
1754 return req;
1755 }
1756
1757 static void cli_tcon_andx_done(struct tevent_req *subreq)
1758 {
1759 struct tevent_req *req = tevent_req_callback_data(
1760 subreq, struct tevent_req);
1761 struct cli_tcon_andx_state *state = tevent_req_data(
1762 req, struct cli_tcon_andx_state);
1763 struct cli_state *cli = state->cli;
1764 uint8_t *in;
1765 char *inbuf;
1766 uint8_t wct;
1767 uint16_t *vwv;
1768 uint32_t num_bytes;
1769 uint8_t *bytes;
1770 NTSTATUS status;
1771
1772 status = cli_smb_recv(subreq, state, &in, 0, &wct, &vwv,
1773 &num_bytes, &bytes);
1774 TALLOC_FREE(subreq);
1775 if (!NT_STATUS_IS_OK(status)) {
1776 tevent_req_nterror(req, status);
1777 return;
1778 }
1779
1780 inbuf = (char *)in;
1781
1782 clistr_pull(inbuf, cli->dev, bytes, sizeof(fstring), num_bytes,
1783 STR_TERMINATE|STR_ASCII);
1784
1785 if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1786 /* almost certainly win95 - enable bug fixes */
1787 cli->win95 = True;
1788 }
1789
1790 /*
1791 * Make sure that we have the optional support 16-bit field. WCT > 2.
1792 * Avoids issues when connecting to Win9x boxes sharing files
1793 */
1794
1795 cli->dfsroot = false;
1796
1797 if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1798 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1799 }
1800
1801 cli->cnum = SVAL(inbuf,smb_tid);
1802 tevent_req_done(req);
1803 }
1804
1805 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
1806 {
1807 return tevent_req_simple_recv_ntstatus(req);
1808 }
1809
1810 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1811 const char *dev, const char *pass, int passlen)
1812 {
1813 TALLOC_CTX *frame = talloc_stackframe();
1814 struct event_context *ev;
1815 struct tevent_req *req;
1816 NTSTATUS status = NT_STATUS_OK;
1817
1818 if (cli_has_async_calls(cli)) {
1819 /*
1820 * Can't use sync call while an async call is in flight
1821 */
1822 status = NT_STATUS_INVALID_PARAMETER;
1823 goto fail;
1824 }
1825
1826 ev = event_context_init(frame);
1827 if (ev == NULL) {
1828 status = NT_STATUS_NO_MEMORY;
1829 goto fail;
1830 }
1831
1832 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1833 if (req == NULL) {
1834 status = NT_STATUS_NO_MEMORY;
1835 goto fail;
1836 }
1837
1838 if (!tevent_req_poll(req, ev)) {
1839 status = map_nt_error_from_unix(errno);
1840 goto fail;
1841 }
1842
1843 status = cli_tcon_andx_recv(req);
1844 fail:
1845 TALLOC_FREE(frame);
1846 if (!NT_STATUS_IS_OK(status)) {
1847 cli_set_error(cli, status);
1848 }
1849 return status;
1850 }
1851
1852 /****************************************************************************
1853 Send a tree disconnect.
1854 ****************************************************************************/
1855
1856 struct cli_tdis_state {
1857 struct cli_state *cli;
1858 };
1859
1860 static void cli_tdis_done(struct tevent_req *subreq);
1861
1862 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
1863 struct tevent_context *ev,
1864 struct cli_state *cli)
1865 {
1866 struct tevent_req *req, *subreq;
1867 struct cli_tdis_state *state;
1868
1869 req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
1870 if (req == NULL) {
1871 return NULL;
1872 }
1873 state->cli = cli;
1874
1875 subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
1876 if (tevent_req_nomem(subreq, req)) {
1877 return tevent_req_post(req, ev);
1878 }
1879 tevent_req_set_callback(subreq, cli_tdis_done, req);
1880 return req;
1881 }
1882
1883 static void cli_tdis_done(struct tevent_req *subreq)
1884 {
1885 struct tevent_req *req = tevent_req_callback_data(
1886 subreq, struct tevent_req);
1887 struct cli_tdis_state *state = tevent_req_data(
1888 req, struct cli_tdis_state);
1889 NTSTATUS status;
1890
1891 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
1892 TALLOC_FREE(subreq);
1893 if (!NT_STATUS_IS_OK(status)) {
1894 tevent_req_nterror(req, status);
1895 return;
1896 }
1897 state->cli->cnum = -1;
1898 tevent_req_done(req);
1899 }
1900
1901 NTSTATUS cli_tdis_recv(struct tevent_req *req)
1902 {
1903 return tevent_req_simple_recv_ntstatus(req);
1904 }
1905
1906 NTSTATUS cli_tdis(struct cli_state *cli)
1907 {
1908 struct tevent_context *ev;
1909 struct tevent_req *req;
1910 NTSTATUS status = NT_STATUS_NO_MEMORY;
1911
1912 if (cli_has_async_calls(cli)) {
1913 return NT_STATUS_INVALID_PARAMETER;
1914 }
1915 ev = tevent_context_init(talloc_tos());
1916 if (ev == NULL) {
1917 goto fail;
1918 }
1919 req = cli_tdis_send(ev, ev, cli);
1920 if (req == NULL) {
1921 goto fail;
1922 }
1923 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1924 goto fail;
1925 }
1926 status = cli_tdis_recv(req);
1927 fail:
1928 TALLOC_FREE(ev);
1929 if (!NT_STATUS_IS_OK(status)) {
1930 cli_set_error(cli, status);
1931 }
1932 return status;
1933 }
1934
1935 /****************************************************************************
1936 Send a negprot command.
1937 ****************************************************************************/
1938
1939 void cli_negprot_sendsync(struct cli_state *cli)
1940 {
1941 char *p;
1942 int numprots;
1943
1944 if (cli->protocol < PROTOCOL_NT1)
1945 cli->use_spnego = False;
1946
1947 memset(cli->outbuf,'\0',smb_size);
1948
1949 /* setup the protocol strings */
1950 cli_set_message(cli->outbuf,0,0,True);
1951
1952 p = smb_buf(cli->outbuf);
1953 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1954 if (prots[numprots].prot > cli->protocol) {
1955 break;
1956 }
1957 *p++ = 2;
1958 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1959 }
1960
1961 SCVAL(cli->outbuf,smb_com,SMBnegprot);
1962 cli_setup_bcc(cli, p);
1963 cli_setup_packet(cli);
1964
1965 SCVAL(smb_buf(cli->outbuf),0,2);
1966
1967 cli_send_smb(cli);
1968 }
1969
1970 /****************************************************************************
1971 Send a negprot command.
1972 ****************************************************************************/
1973
1974 struct cli_negprot_state {
1975 struct cli_state *cli;
1976 };
1977
1978 static void cli_negprot_done(struct tevent_req *subreq);
1979
1980 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1981 struct event_context *ev,
1982 struct cli_state *cli)
1983 {
1984 struct tevent_req *req, *subreq;
1985 struct cli_negprot_state *state;
1986 uint8_t *bytes = NULL;
1987 int numprots;
1988 uint16_t cnum;
1989
1990 req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
1991 if (req == NULL) {
1992 return NULL;
1993 }
1994 state->cli = cli;
1995
1996 if (cli->protocol < PROTOCOL_NT1)
1997 cli->use_spnego = False;
1998
1999 /* setup the protocol strings */
2000 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
2001 uint8_t c = 2;
2002 if (prots[numprots].prot > cli->protocol) {
2003 break;
2004 }
2005 bytes = (uint8_t *)talloc_append_blob(
2006 state, bytes, data_blob_const(&c, sizeof(c)));
2007 if (tevent_req_nomem(bytes, req)) {
2008 return tevent_req_post(req, ev);
2009 }
2010 bytes = smb_bytes_push_str(bytes, false,
2011 prots[numprots].name,
2012 strlen(prots[numprots].name)+1,
2013 NULL);
2014 if (tevent_req_nomem(bytes, req)) {
2015 return tevent_req_post(req, ev);
2016 }
2017 }
2018
2019 cnum = cli->cnum;
2020
2021 cli->cnum = 0;
2022 subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
2023 talloc_get_size(bytes), bytes);
2024 cli->cnum = cnum;
2025
2026 if (tevent_req_nomem(subreq, req)) {
2027 return tevent_req_post(req, ev);
2028 }
2029 tevent_req_set_callback(subreq, cli_negprot_done, req);
2030 return req;
2031 }
2032
2033 static void cli_negprot_done(struct tevent_req *subreq)
2034 {
2035 struct tevent_req *req = tevent_req_callback_data(
2036 subreq, struct tevent_req);
2037 struct cli_negprot_state *state = tevent_req_data(
2038 req, struct cli_negprot_state);
2039 struct cli_state *cli = state->cli;
2040 uint8_t wct;
2041 uint16_t *vwv;
2042 uint32_t num_bytes;
2043 uint8_t *bytes;
2044 NTSTATUS status;
2045 uint16_t protnum;
2046 uint8_t *inbuf;
2047
2048 status = cli_smb_recv(subreq, state, &inbuf, 1, &wct, &vwv,
2049 &num_bytes, &bytes);
2050 TALLOC_FREE(subreq);
2051 if (!NT_STATUS_IS_OK(status)) {
2052 tevent_req_nterror(req, status);
2053 return;
2054 }
2055
2056 protnum = SVAL(vwv, 0);
2057
2058 if ((protnum >= ARRAY_SIZE(prots))
2059 || (prots[protnum].prot > cli->protocol)) {
2060 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2061 return;
2062 }
2063
2064 cli->protocol = prots[protnum].prot;
2065
2066 if ((cli->protocol < PROTOCOL_NT1) &&
2067 client_is_signing_mandatory(cli)) {
2068 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
2069 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2070 return;
2071 }
2072
2073 if (cli->protocol >= PROTOCOL_NT1) {
2074 struct timespec ts;
2075 bool negotiated_smb_signing = false;
2076
2077 /* NT protocol */
2078 cli->sec_mode = CVAL(vwv + 1, 0);
2079 cli->max_mux = SVAL(vwv + 1, 1);
2080 cli->max_xmit = IVAL(vwv + 3, 1);
2081 cli->sesskey = IVAL(vwv + 7, 1);
2082 cli->serverzone = SVALS(vwv + 15, 1);
2083 cli->serverzone *= 60;
2084 /* this time arrives in real GMT */
2085 ts = interpret_long_date(((char *)(vwv+11))+1);
2086 cli->servertime = ts.tv_sec;
2087 cli->secblob = data_blob(bytes, num_bytes);
2088 cli->capabilities = IVAL(vwv + 9, 1);
2089 if (cli->capabilities & CAP_RAW_MODE) {
2090 cli->readbraw_supported = True;
2091 cli->writebraw_supported = True;
2092 }
2093 /* work out if they sent us a workgroup */
2094 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
2095 smb_buflen(cli->inbuf) > 8) {
2096 clistr_pull(cli->inbuf, cli->server_domain,
2097 bytes+8, sizeof(cli->server_domain),
2098 num_bytes-8,
2099 STR_UNICODE|STR_NOALIGN);
2100 }
2101
2102 /*
2103 * As signing is slow we only turn it on if either the client or
2104 * the server require it. JRA.
2105 */
2106
2107 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
2108 /* Fail if server says signing is mandatory and we don't want to support it. */
2109 if (!client_is_signing_allowed(cli)) {
2110 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
2111 tevent_req_nterror(req,
2112 NT_STATUS_ACCESS_DENIED);
2113 return;
2114 }
2115 negotiated_smb_signing = true;
2116 } else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
2117 /* Fail if client says signing is mandatory and the server doesn't support it. */
2118 if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
2119 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
2120 tevent_req_nterror(req,
2121 NT_STATUS_ACCESS_DENIED);
2122 return;
2123 }
2124 negotiated_smb_signing = true;
2125 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
2126 negotiated_smb_signing = true;
2127 }
2128
2129 if (negotiated_smb_signing) {
2130 cli_set_signing_negotiated(cli);
2131 }
2132
2133 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
2134 SAFE_FREE(cli->outbuf);
2135 SAFE_FREE(cli->inbuf);
2136 cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
2137 cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
2138 if (!cli->outbuf || !cli->inbuf) {
2139 tevent_req_nterror(req,
2140 NT_STATUS_NO_MEMORY);
2141 return;
2142 }
2143 cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
2144 }
2145
2146 } else if (cli->protocol >= PROTOCOL_LANMAN1) {
2147 cli->use_spnego = False;
2148 cli->sec_mode = SVAL(vwv + 1, 0);
2149 cli->max_xmit = SVAL(vwv + 2, 0);
2150 cli->max_mux = SVAL(vwv + 3, 0);
2151 cli->sesskey = IVAL(vwv + 6, 0);
2152 cli->serverzone = SVALS(vwv + 10, 0);
2153 cli->serverzone *= 60;
2154 /* this time is converted to GMT by make_unix_date */
2155 cli->servertime = make_unix_date(
2156 (char *)(vwv + 8), cli->serverzone);
2157 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
2158 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
2159 cli->secblob = data_blob(bytes, num_bytes);
2160 } else {
2161 /* the old core protocol */
2162 cli->use_spnego = False;
2163 cli->sec_mode = 0;
2164 cli->serverzone = get_time_zone(time(NULL));
2165 }
2166
2167 cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
2168
2169 /* a way to force ascii SMB */
2170 if (getenv("CLI_FORCE_ASCII"))
2171 cli->capabilities &= ~CAP_UNICODE;
2172
2173 tevent_req_done(req);
2174 }
2175
2176 NTSTATUS cli_negprot_recv(struct tevent_req *req)
2177 {
2178 return tevent_req_simple_recv_ntstatus(req);
2179 }
2180
2181 NTSTATUS cli_negprot(struct cli_state *cli)
2182 {
2183 TALLOC_CTX *frame = talloc_stackframe();
2184 struct event_context *ev;
2185 struct tevent_req *req;
2186 NTSTATUS status = NT_STATUS_OK;
2187
2188 if (cli_has_async_calls(cli)) {
2189 /*
2190 * Can't use sync call while an async call is in flight
2191 */
2192 status = NT_STATUS_INVALID_PARAMETER;
2193 goto fail;
2194 }
2195
2196 ev = event_context_init(frame);
2197 if (ev == NULL) {
2198 status = NT_STATUS_NO_MEMORY;
2199 goto fail;
2200 }
2201
2202 req = cli_negprot_send(frame, ev, cli);
2203 if (req == NULL) {
2204 status = NT_STATUS_NO_MEMORY;
2205 goto fail;
2206 }
2207
2208 if (!tevent_req_poll(req, ev)) {
2209 status = map_nt_error_from_unix(errno);
2210 goto fail;
2211 }
2212
2213 status = cli_negprot_recv(req);
2214 fail:
2215 TALLOC_FREE(frame);
2216 if (!NT_STATUS_IS_OK(status)) {
2217 cli_set_error(cli, status);
2218 }
2219 return status;
2220 }
2221
2222 /****************************************************************************
2223 Send a session request. See rfc1002.txt 4.3 and 4.3.2.
2224 ****************************************************************************/
2225
2226 bool cli_session_request(struct cli_state *cli,
2227 struct nmb_name *calling, struct nmb_name *called)
2228 {
2229 char *p;
2230 int len = 4;
2231 char *tmp;
2232
2233 /* 445 doesn't have session request */
2234 if (cli->port == 445)
2235 return True;
2236
2237 memcpy(&(cli->calling), calling, sizeof(*calling));
2238 memcpy(&(cli->called ), called , sizeof(*called ));
2239
2240 /* put in the destination name */
2241
2242 tmp = name_mangle(talloc_tos(), cli->called.name,
2243 cli->called.name_type);
2244 if (tmp == NULL) {
2245 return false;
2246 }
2247
2248 p = cli->outbuf+len;
2249 memcpy(p, tmp, name_len(tmp));
2250 len += name_len(tmp);
2251 TALLOC_FREE(tmp);
2252
2253 /* and my name */
2254
2255 tmp = name_mangle(talloc_tos(), cli->calling.name,
2256 cli->calling.name_type);
2257 if (tmp == NULL) {
2258 return false;
2259 }
2260
2261 p = cli->outbuf+len;
2262 memcpy(p, tmp, name_len(tmp));
2263 len += name_len(tmp);
2264 TALLOC_FREE(tmp);
2265
2266 /* send a session request (RFC 1002) */
2267 /* setup the packet length
2268 * Remove four bytes from the length count, since the length
2269 * field in the NBT Session Service header counts the number
2270 * of bytes which follow. The cli_send_smb() function knows
2271 * about this and accounts for those four bytes.
2272 * CRH.
2273 */
2274 len -= 4;
2275 _smb_setlen(cli->outbuf,len);
2276 SCVAL(cli->outbuf,0,0x81);
2277
2278 cli_send_smb(cli);
2279 DEBUG(5,("Sent session request\n"));
2280
2281 if (!cli_receive_smb(cli))
2282 return False;
2283
2284 if (CVAL(cli->inbuf,0) == 0x84) {
2285 /* C. Hoch 9/14/95 Start */
2286 /* For information, here is the response structure.
2287 * We do the byte-twiddling to for portability.
2288 struct RetargetResponse{
2289 unsigned char type;
2290 unsigned char flags;
2291 int16 length;
2292 int32 ip_addr;
2293 int16 port;
2294 };
2295 */
2296 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
2297 struct in_addr dest_ip;
2298 NTSTATUS status;
2299
2300 /* SESSION RETARGET */
2301 putip((char *)&dest_ip,cli->inbuf+4);
2302 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
2303
2304 status = open_socket_out(&cli->dest_ss, port,
2305 LONG_CONNECT_TIMEOUT, &cli->fd);
2306 if (!NT_STATUS_IS_OK(status)) {
2307 return False;
2308 }
2309
2310 DEBUG(3,("Retargeted\n"));
2311
2312 set_socket_options(cli->fd, lp_socket_options());
2313
2314 /* Try again */
2315 {
2316 static int depth;
2317 bool ret;
2318 if (depth > 4) {
2319 DEBUG(0,("Retarget recursion - failing\n"));
2320 return False;
2321 }
2322 depth++;
2323 ret = cli_session_request(cli, calling, called);
2324 depth--;
2325 return ret;
2326 }
2327 } /* C. Hoch 9/14/95 End */
2328
2329 if (CVAL(cli->inbuf,0) != 0x82) {
2330 /* This is the wrong place to put the error... JRA. */
2331 cli->rap_error = CVAL(cli->inbuf,4);
2332 return False;
2333 }
2334 return(True);
2335 }
2336
2337 struct fd_struct {
2338 int fd;
2339 };
2340
2341 static void smb_sock_connected(struct tevent_req *req)
2342 {
2343 struct fd_struct *pfd = tevent_req_callback_data(
2344 req, struct fd_struct);
2345 int fd;
2346 NTSTATUS status;
2347
2348 status = open_socket_out_defer_recv(req, &fd);
2349 if (NT_STATUS_IS_OK(status)) {
2350 pfd->fd = fd;
2351 }
2352 }
2353
2354 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
2355 uint16_t *port, int timeout, int *pfd)
2356 {
2357 struct event_context *ev;
2358 struct tevent_req *r139, *r445;
2359 struct fd_struct *fd139, *fd445;
2360 NTSTATUS status = NT_STATUS_NO_MEMORY;
2361
2362 if (*port != 0) {
2363 return open_socket_out(pss, *port, timeout, pfd);
2364 }
2365
2366 ev = event_context_init(talloc_tos());
2367 if (ev == NULL) {
2368 return NT_STATUS_NO_MEMORY;
2369 }
2370
2371 fd139 = talloc(ev, struct fd_struct);
2372 if (fd139 == NULL) {
2373 goto done;
2374 }
2375 fd139->fd = -1;
2376
2377 fd445 = talloc(ev, struct fd_struct);
2378 if (fd445 == NULL) {
2379 goto done;
2380 }
2381 fd445->fd = -1;
2382
2383 r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
2384 pss, 445, timeout);
2385 r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
2386 pss, 139, timeout);
2387 if ((r445 == NULL) || (r139 == NULL)) {
2388 goto done;
2389 }
2390 tevent_req_set_callback(r445, smb_sock_connected, fd445);
2391 tevent_req_set_callback(r139, smb_sock_connected, fd139);
2392
2393 while ((fd445->fd == -1) && (fd139->fd == -1)
2394 && (tevent_req_is_in_progress(r139)
2395 || tevent_req_is_in_progress(r445))) {
2396 event_loop_once(ev);
2397 }
2398
2399 if ((fd139->fd != -1) && (fd445->fd != -1)) {
2400 close(fd139->fd);
2401 fd139->fd = -1;
2402 }
2403
2404 if (fd445->fd != -1) {
2405 *port = 445;
2406 *pfd = fd445->fd;
2407 status = NT_STATUS_OK;
2408 goto done;
2409 }
2410 if (fd139->fd != -1) {
2411 *port = 139;
2412 *pfd = fd139->fd;
2413 status = NT_STATUS_OK;
2414 goto done;
2415 }
2416
2417 status = open_socket_out_defer_recv(r445, &fd445->fd);
2418 done:
2419 TALLOC_FREE(ev);
2420 return status;
2421 }
2422
2423 /****************************************************************************
2424 Open the client sockets.
2425 ****************************************************************************/
2426
2427 NTSTATUS cli_connect(struct cli_state *cli,
2428 const char *host,
2429 struct sockaddr_storage *dest_ss)
2430
2431 {
2432 int name_type = 0x20;
2433 TALLOC_CTX *frame = talloc_stackframe();
2434 unsigned int num_addrs = 0;
2435 unsigned int i = 0;
2436 struct sockaddr_storage *ss_arr = NULL;
2437 char *p = NULL;
2438
2439 /* reasonable default hostname */
2440 if (!host) {
2441 host = STAR_SMBSERVER;
2442 }
2443
2444 fstrcpy(cli->desthost, host);
2445
2446 /* allow hostnames of the form NAME#xx and do a netbios lookup */
2447 if ((p = strchr(cli->desthost, '#'))) {
2448 name_type = strtol(p+1, NULL, 16);
2449 *p = 0;
2450 }
2451
2452 if (!dest_ss || is_zero_addr((struct sockaddr *)dest_ss)) {
2453 NTSTATUS status =resolve_name_list(frame,
2454 cli->desthost,
2455 name_type,
2456 &ss_arr,
2457 &num_addrs);
2458 if (!NT_STATUS_IS_OK(status)) {
2459 TALLOC_FREE(frame);
2460 return NT_STATUS_BAD_NETWORK_NAME;
2461 }
2462 } else {
2463 num_addrs = 1;
2464 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
2465 if (!ss_arr) {
2466 TALLOC_FREE(frame);
2467 return NT_STATUS_NO_MEMORY;
2468 }
2469 *ss_arr = *dest_ss;
2470 }
2471
2472 for (i = 0; i < num_addrs; i++) {
2473 cli->dest_ss = ss_arr[i];
2474 if (getenv("LIBSMB_PROG")) {
2475 cli->fd = sock_exec(getenv("LIBSMB_PROG"));
2476 } else {
2477 uint16_t port = cli->port;
2478 NTSTATUS status;
2479 status = open_smb_socket(&cli->dest_ss, &port,
2480 cli->timeout, &cli->fd);
2481 if (NT_STATUS_IS_OK(status)) {
2482 cli->port = port;
2483 }
2484 }
2485 if (cli->fd == -1) {
2486 char addr[INET6_ADDRSTRLEN];
2487 print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
2488 DEBUG(2,("Error connecting to %s (%s)\n",
2489 dest_ss?addr:host,strerror(errno)));
2490 } else {
2491 /* Exit from loop on first connection. */
2492 break;
2493 }
2494 }
2495
2496 if (cli->fd == -1) {
2497 TALLOC_FREE(frame);
2498 return map_nt_error_from_unix(errno);
2499 }
2500
2501 if (dest_ss) {
2502 *dest_ss = cli->dest_ss;
2503 }
2504
2505 set_socket_options(cli->fd, lp_socket_options());
2506
2507 TALLOC_FREE(frame);
2508 return NT_STATUS_OK;
2509 }
2510
2511 /**
2512 establishes a connection to after the negprot.
2513 @param output_cli A fully initialised cli structure, non-null only on success
2514 @param dest_host The netbios name of the remote host
2515 @param dest_ss (optional) The the destination IP, NULL for name based lookup
2516 @param port (optional) The destination port (0 for default)
2517 @param retry bool. Did this connection fail with a retryable error ?
2518
2519 */
2520 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2521 const char *my_name,
2522 const char *dest_host,
2523 struct sockaddr_storage *dest_ss, int port,
2524 int signing_state, int flags,
2525 bool *retry)
2526 {
2527 NTSTATUS nt_status;
2528 struct nmb_name calling;
2529 struct nmb_name called;
2530 struct cli_state *cli;
2531 struct sockaddr_storage ss;
2532
2533 if (retry)
2534 *retry = False;
2535
2536 if (!my_name)
2537 my_name = global_myname();
2538
2539 if (!(cli = cli_initialise_ex(signing_state))) {
2540 return NT_STATUS_NO_MEMORY;
2541 }
2542
2543 make_nmb_name(&calling, my_name, 0x0);
2544 make_nmb_name(&called , dest_host, 0x20);
2545
2546 cli_set_port(cli, port);
2547 cli_set_timeout(cli, 10000); /* 10 seconds. */
2548
2549 if (dest_ss) {
2550 ss = *dest_ss;
2551 } else {
2552 zero_sockaddr(&ss);
2553 }
2554
2555 again:
2556
2557 DEBUG(3,("Connecting to host=%s\n", dest_host));
2558
2559 nt_status = cli_connect(cli, dest_host, &ss);
2560 if (!NT_STATUS_IS_OK(nt_status)) {
2561 char addr[INET6_ADDRSTRLEN];
2562 print_sockaddr(addr, sizeof(addr), &ss);
2563 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2564 nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2565 cli_shutdown(cli);
2566 return nt_status;
2567 }
2568
2569 if (retry)
2570 *retry = True;
2571
2572 if (!cli_session_request(cli, &calling, &called)) {
2573 char *p;
2574 DEBUG(1,("session request to %s failed (%s)\n",
2575 called.name, cli_errstr(cli)));
2576 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2577 *p = 0;
2578 goto again;
2579 }
2580 if (strcmp(called.name, STAR_SMBSERVER)) {
2581 make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2582 goto again;
2583 }
2584 return NT_STATUS_BAD_NETWORK_NAME;
2585 }
2586
2587 if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2588 cli->use_spnego = False;
2589 else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2590 cli->use_kerberos = True;
2591
2592 if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2593 cli->use_kerberos) {
2594 cli->fallback_after_kerberos = true;
2595 }
2596 if (flags & CLI_FULL_CONNECTION_USE_CCACHE) {
2597 cli->use_ccache = true;
2598 }
2599
2600 nt_status = cli_negprot(cli);
2601 if (!NT_STATUS_IS_OK(nt_status)) {
2602 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2603 cli_shutdown(cli);
2604 return nt_status;
2605 }
2606
2607 *output_cli = cli;
2608 return NT_STATUS_OK;
2609 }
2610
2611
2612 /**
2613 establishes a connection right up to doing tconX, password specified.
2614 @param output_cli A fully initialised cli structure, non-null only on success
2615 @param dest_host The netbios name of the remote host
2616 @param dest_ip (optional) The the destination IP, NULL for name based lookup
2617 @param port (optional) The destination port (0 for default)
2618 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
2619 @param service_type The 'type' of serivice.
2620 @param user Username, unix string
2621 @param domain User's domain
2622 @param password User's password, unencrypted unix string.
2623 @param retry bool. Did this connection fail with a retryable error ?
2624 */
2625
2626 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2627 const char *my_name,
2628 const char *dest_host,
2629 struct sockaddr_storage *dest_ss, int port,
2630 const char *service, const char *service_type,
2631 const char *user, const char *domain,
2632 const char *password, int flags,
2633 int signing_state,
2634 bool *retry)
2635 {
2636 NTSTATUS nt_status;
2637 struct cli_state *cli = NULL;
2638 int pw_len = password ? strlen(password)+1 : 0;
2639
2640 *output_cli = NULL;
2641
2642 if (password == NULL) {
2643 password = "";
2644 }
2645
2646 nt_status = cli_start_connection(&cli, my_name, dest_host,
2647 dest_ss, port, signing_state,
2648 flags, retry);
2649
2650 if (!NT_STATUS_IS_OK(nt_status)) {
2651 return nt_status;
2652 }
2653
2654 cli->use_oplocks = ((flags & CLI_FULL_CONNECTION_OPLOCKS) != 0);
2655 cli->use_level_II_oplocks =
2656 ((flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) != 0);
2657
2658 nt_status = cli_session_setup(cli, user, password, pw_len, password,
2659 pw_len, domain);
2660 if (!NT_STATUS_IS_OK(nt_status)) {
2661
2662 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2663 DEBUG(1,("failed session setup with %s\n",
2664 nt_errstr(nt_status)));
2665 cli_shutdown(cli);
2666 return nt_status;
2667 }
2668
2669 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2670 if (!NT_STATUS_IS_OK(nt_status)) {
2671 DEBUG(1,("anonymous failed session setup with %s\n",
2672 nt_errstr(nt_status)));
2673 cli_shutdown(cli);
2674 return nt_status;
2675 }
2676 }
2677
2678 if (service) {
2679 nt_status = cli_tcon_andx(cli, service, service_type, password,
2680 pw_len);
2681 if (!NT_STATUS_IS_OK(nt_status)) {
2682 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2683 cli_shutdown(cli);
2684 if (NT_STATUS_IS_OK(nt_status)) {
2685 nt_status = NT_STATUS_UNSUCCESSFUL;
2686 }
2687 return nt_status;
2688 }
2689 }
2690
2691 nt_status = cli_init_creds(cli, user, domain, password);
2692 if (!NT_STATUS_IS_OK(nt_status)) {
2693 cli_shutdown(cli);
2694 return nt_status;
2695 }
2696
2697 *output_cli = cli;
2698 return NT_STATUS_OK;
2699 }
2700
2701 /****************************************************************************
2702 Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2703 ****************************************************************************/
2704
2705 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2706 struct sockaddr_storage *pdest_ss)
2707 {
2708 struct nmb_name calling, called;
2709
2710 make_nmb_name(&calling, srchost, 0x0);
2711
2712 /*
2713 * If the called name is an IP address
2714 * then use *SMBSERVER immediately.
2715 */
2716
2717 if(is_ipaddress(desthost)) {
2718 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2719 } else {
2720 make_nmb_name(&called, desthost, 0x20);
2721 }
2722
2723 if (!cli_session_request(*ppcli, &calling, &called)) {
2724 NTSTATUS status;
2725 struct nmb_name smbservername;
2726
2727 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2728
2729 /*
2730 * If the name wasn't *SMBSERVER then
2731 * try with *SMBSERVER if the first name fails.
2732 */
2733
2734 if (nmb_name_equal(&called, &smbservername)) {
2735
2736 /*
2737 * The name used was *SMBSERVER, don't bother with another name.
2738 */
2739
2740 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2741 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2742 return False;
2743 }
2744
2745 /* Try again... */
2746 cli_shutdown(*ppcli);
2747
2748 *ppcli = cli_initialise();
2749 if (!*ppcli) {
2750 /* Out of memory... */
2751 return False;
2752 }
2753
2754 status = cli_connect(*ppcli, desthost, pdest_ss);
2755 if (!NT_STATUS_IS_OK(status) ||
2756 !cli_session_request(*ppcli, &calling, &smbservername)) {
2757 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2758 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2759 return False;
2760 }
2761 }
2762
2763 return True;
2764 }
2765
2766 /****************************************************************************
2767 Send an old style tcon.
2768 ****************************************************************************/
2769 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2770 const char *service, const char *pass, const char *dev,
2771 uint16 *max_xmit, uint16 *tid)
2772 {
2773 char *p;
2774
2775 if (!lp_client_plaintext_auth() && (*pass)) {
2776 DEBUG(1, ("Server requested plaintext password but 'client "
2777 "plaintext auth' is disabled\n"));
2778 return NT_STATUS_ACCESS_DENIED;
2779 }
2780
2781 memset(cli->outbuf,'\0',smb_size);
2782 memset(cli->inbuf,'\0',smb_size);
2783
2784 cli_set_message(cli->outbuf, 0, 0, True);
2785 SCVAL(cli->outbuf,smb_com,SMBtcon);
2786 cli_setup_packet(cli);
2787
2788 p = smb_buf(cli->outbuf);
2789 *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
2790 *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
2791 *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
2792
2793 cli_setup_bcc(cli, p);
2794
2795 cli_send_smb(cli);
2796 if (!cli_receive_smb(cli)) {
2797 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2798 }
2799
2800 if (cli_is_error(cli)) {
2801 return cli_nt_error(cli);
2802 }
2803
2804 *max_xmit = SVAL(cli->inbuf, smb_vwv0);
2805 *tid = SVAL(cli->inbuf, smb_vwv1);
2806
2807 return NT_STATUS_OK;
2808 }
2809
2810 /* Return a cli_state pointing at the IPC$ share for the given server */
2811
2812 struct cli_state *get_ipc_connect(char *server,
2813 struct sockaddr_storage *server_ss,
2814 const struct user_auth_info *user_info)
2815 {
2816 struct cli_state *cli;
2817 NTSTATUS nt_status;
2818 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2819
2820 if (user_info->use_kerberos) {
2821 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2822 }
2823
2824 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2825 user_info->username ? user_info->username : "",
2826 lp_workgroup(),
2827 user_info->password ? user_info->password : "",
2828 flags,
2829 Undefined, NULL);
2830
2831 if (NT_STATUS_IS_OK(nt_status)) {
2832 return cli;
2833 } else if (is_ipaddress(server)) {
2834 /* windows 9* needs a correct NMB name for connections */
2835 fstring remote_name;
2836
2837 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2838 cli = get_ipc_connect(remote_name, server_ss, user_info);
2839 if (cli)
2840 return cli;
2841 }
2842 }
2843 return NULL;
2844 }
2845
2846 /*
2847 * Given the IP address of a master browser on the network, return its
2848 * workgroup and connect to it.
2849 *
2850 * This function is provided to allow additional processing beyond what
2851 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2852 * browsers and obtain each master browsers' list of domains (in case the
2853 * first master browser is recently on the network and has not yet
2854 * synchronized with other master browsers and therefore does not yet have the
2855 * entire network browse list)
2856 */
2857
2858 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2859 struct ip_service *mb_ip,
2860 const struct user_auth_info *user_info,
2861 char **pp_workgroup_out)
2862 {
2863 char addr[INET6_ADDRSTRLEN];
2864 fstring name;
2865 struct cli_state *cli;
2866 struct sockaddr_storage server_ss;
2867
2868 *pp_workgroup_out = NULL;
2869
2870 print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2871 DEBUG(99, ("Looking up name of master browser %s\n",
2872 addr));
2873
2874 /*
2875 * Do a name status query to find out the name of the master browser.
2876 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2877 * master browser will not respond to a wildcard query (or, at least,
2878 * an NT4 server acting as the domain master browser will not).
2879 *
2880 * We might be able to use ONLY the query on MSBROWSE, but that's not
2881 * yet been tested with all Windows versions, so until it is, leave
2882 * the original wildcard query as the first choice and fall back to
2883 * MSBROWSE if the wildcard query fails.
2884 */
2885 if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2886 !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2887
2888 DEBUG(99, ("Could not retrieve name status for %s\n",
2889 addr));
2890 return NULL;
2891 }
2892
2893 if (!find_master_ip(name, &server_ss)) {
2894 DEBUG(99, ("Could not find master ip for %s\n", name));
2895 return NULL;
2896 }
2897
2898 *pp_workgroup_out = talloc_strdup(ctx, name);
2899
2900 DEBUG(4, ("found master browser %s, %s\n", name, addr));
2901
2902 print_sockaddr(addr, sizeof(addr), &server_ss);
2903 cli = get_ipc_connect(addr, &server_ss, user_info);
2904
2905 return cli;
2906 }
2907
2908 /*
2909 * Return the IP address and workgroup of a master browser on the network, and
2910 * connect to it.
2911 */
2912
2913 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2914 const struct user_auth_info *user_info,
2915 char **pp_workgroup_out)
2916 {
2917 struct ip_service *ip_list;
2918 struct cli_state *cli;
2919 int i, count;
2920
2921 *pp_workgroup_out = NULL;
2922
2923 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2924
2925 /* Go looking for workgroups by broadcasting on the local network */
2926
2927 if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2928 &count))) {
2929 DEBUG(99, ("No master browsers responded\n"));
2930 return False;
2931 }
2932
2933 for (i = 0; i < count; i++) {
2934 char addr[INET6_ADDRSTRLEN];
2935 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2936 DEBUG(99, ("Found master browser %s\n", addr));
2937
2938 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2939 user_info, pp_workgroup_out);
2940 if (cli)
2941 return(cli);
2942 }
2943
2944 return NULL;
2945 }
WIP