?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smb2cli: ignore the NBT/Length header in smb2cli_inbuf_parse_compound()
[Samba/gebeck_regimport.git] / source3 / libsmb / cliconnect.c
blobaf6c51b7b5345d72a2fb48191e2009da1931d1c9
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6 Copyright (C) Volker Lendecke 2011
7 Copyright (C) Jeremy Allison 2011
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "libsmb/libsmb.h"
25 #include "popt_common.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../libcli/auth/spnego.h"
28 #include "smb_krb5.h"
29 #include "../auth/ntlmssp/ntlmssp.h"
30 #include "libads/kerberos_proto.h"
31 #include "krb5_env.h"
32 #include "../lib/util/tevent_ntstatus.h"
33 #include "async_smb.h"
34 #include "libsmb/nmblib.h"
35 #include "librpc/ndr/libndr.h"
36
37 static const struct {
38 int prot;
39 const char name[24];
40 } prots[10] = {
41 {PROTOCOL_CORE, "PC NETWORK PROGRAM 1.0"},
42 {PROTOCOL_COREPLUS, "MICROSOFT NETWORKS 1.03"},
43 {PROTOCOL_LANMAN1, "MICROSOFT NETWORKS 3.0"},
44 {PROTOCOL_LANMAN1, "LANMAN1.0"},
45 {PROTOCOL_LANMAN2, "LM1.2X002"},
46 {PROTOCOL_LANMAN2, "DOS LANMAN2.1"},
47 {PROTOCOL_LANMAN2, "LANMAN2.1"},
48 {PROTOCOL_LANMAN2, "Samba"},
49 {PROTOCOL_NT1, "NT LANMAN 1.0"},
50 {PROTOCOL_NT1, "NT LM 0.12"},
51 };
52
53 #define STAR_SMBSERVER "*SMBSERVER"
54
55 /********************************************************
56 Utility function to ensure we always return at least
57 a valid char * pointer to an empty string for the
58 cli->server_os, cli->server_type and cli->server_domain
59 strings.
60 *******************************************************/
61
62 static NTSTATUS smb_bytes_talloc_string(TALLOC_CTX *mem_ctx,
63 char *inbuf,
64 char **dest,
65 uint8_t *src,
66 size_t srclen,
67 ssize_t *destlen)
68 {
69 *destlen = clistr_pull_talloc(mem_ctx,
70 inbuf,
71 SVAL(inbuf, smb_flg2),
72 dest,
73 (char *)src,
74 srclen,
75 STR_TERMINATE);
76 if (*destlen == -1) {
77 return NT_STATUS_NO_MEMORY;
78 }
79
80 if (*dest == NULL) {
81 *dest = talloc_strdup(mem_ctx, "");
82 if (*dest == NULL) {
83 return NT_STATUS_NO_MEMORY;
84 }
85 }
86 return NT_STATUS_OK;
87 }
88
89 /**
90 * Set the user session key for a connection
91 * @param cli The cli structure to add it too
92 * @param session_key The session key used. (A copy of this is taken for the cli struct)
93 *
94 */
95
96 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
97 {
98 cli->user_session_key = data_blob(session_key.data, session_key.length);
99 }
100
101 /****************************************************************************
102 Do an old lanman2 style session setup.
103 ****************************************************************************/
104
105 struct cli_session_setup_lanman2_state {
106 struct cli_state *cli;
107 uint16_t vwv[10];
108 const char *user;
109 };
110
111 static void cli_session_setup_lanman2_done(struct tevent_req *subreq);
112
113 static struct tevent_req *cli_session_setup_lanman2_send(
114 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
115 struct cli_state *cli, const char *user,
116 const char *pass, size_t passlen,
117 const char *workgroup)
118 {
119 struct tevent_req *req, *subreq;
120 struct cli_session_setup_lanman2_state *state;
121 DATA_BLOB lm_response = data_blob_null;
122 uint16_t *vwv;
123 uint8_t *bytes;
124 char *tmp;
125 uint16_t sec_mode = cli_state_security_mode(cli);
126
127 req = tevent_req_create(mem_ctx, &state,
128 struct cli_session_setup_lanman2_state);
129 if (req == NULL) {
130 return NULL;
131 }
132 state->cli = cli;
133 state->user = user;
134 vwv = state->vwv;
135
136 /*
137 * if in share level security then don't send a password now
138 */
139 if (!(sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
140 passlen = 0;
141 }
142
143 if (passlen > 0
144 && (sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
145 && passlen != 24) {
146 /*
147 * Encrypted mode needed, and non encrypted password
148 * supplied.
149 */
150 lm_response = data_blob(NULL, 24);
151 if (tevent_req_nomem(lm_response.data, req)) {
152 return tevent_req_post(req, ev);
153 }
154
155 if (!SMBencrypt(pass, cli_state_server_challenge(cli),
156 (uint8_t *)lm_response.data)) {
157 DEBUG(1, ("Password is > 14 chars in length, and is "
158 "therefore incompatible with Lanman "
159 "authentication\n"));
160 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
161 return tevent_req_post(req, ev);
162 }
163 } else if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
164 && passlen == 24) {
165 /*
166 * Encrypted mode needed, and encrypted password
167 * supplied.
168 */
169 lm_response = data_blob(pass, passlen);
170 if (tevent_req_nomem(lm_response.data, req)) {
171 return tevent_req_post(req, ev);
172 }
173 } else if (passlen > 0) {
174 uint8_t *buf;
175 size_t converted_size;
176 /*
177 * Plaintext mode needed, assume plaintext supplied.
178 */
179 buf = talloc_array(talloc_tos(), uint8_t, 0);
180 buf = smb_bytes_push_str(buf, cli_ucs2(cli), pass, passlen+1,
181 &converted_size);
182 if (tevent_req_nomem(buf, req)) {
183 return tevent_req_post(req, ev);
184 }
185 lm_response = data_blob(pass, passlen);
186 TALLOC_FREE(buf);
187 if (tevent_req_nomem(lm_response.data, req)) {
188 return tevent_req_post(req, ev);
189 }
190 }
191
192 SCVAL(vwv+0, 0, 0xff);
193 SCVAL(vwv+0, 1, 0);
194 SSVAL(vwv+1, 0, 0);
195 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
196 SSVAL(vwv+3, 0, 2);
197 SSVAL(vwv+4, 0, 1);
198 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
199 SSVAL(vwv+7, 0, lm_response.length);
200
201 bytes = talloc_array(state, uint8_t, lm_response.length);
202 if (tevent_req_nomem(bytes, req)) {
203 return tevent_req_post(req, ev);
204 }
205 if (lm_response.length != 0) {
206 memcpy(bytes, lm_response.data, lm_response.length);
207 }
208 data_blob_free(&lm_response);
209
210 tmp = talloc_strdup_upper(talloc_tos(), user);
211 if (tevent_req_nomem(tmp, req)) {
212 return tevent_req_post(req, ev);
213 }
214 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
215 NULL);
216 TALLOC_FREE(tmp);
217
218 tmp = talloc_strdup_upper(talloc_tos(), workgroup);
219 if (tevent_req_nomem(tmp, req)) {
220 return tevent_req_post(req, ev);
221 }
222 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
223 NULL);
224 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
225 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
226
227 if (tevent_req_nomem(bytes, req)) {
228 return tevent_req_post(req, ev);
229 }
230
231 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 10, vwv,
232 talloc_get_size(bytes), bytes);
233 if (tevent_req_nomem(subreq, req)) {
234 return tevent_req_post(req, ev);
235 }
236 tevent_req_set_callback(subreq, cli_session_setup_lanman2_done, req);
237 return req;
238 }
239
240 static void cli_session_setup_lanman2_done(struct tevent_req *subreq)
241 {
242 struct tevent_req *req = tevent_req_callback_data(
243 subreq, struct tevent_req);
244 struct cli_session_setup_lanman2_state *state = tevent_req_data(
245 req, struct cli_session_setup_lanman2_state);
246 struct cli_state *cli = state->cli;
247 uint32_t num_bytes;
248 uint8_t *in;
249 char *inbuf;
250 uint8_t *bytes;
251 uint8_t *p;
252 NTSTATUS status;
253 ssize_t ret;
254 uint8_t wct;
255 uint16_t *vwv;
256
257 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
258 &num_bytes, &bytes);
259 TALLOC_FREE(subreq);
260 if (!NT_STATUS_IS_OK(status)) {
261 tevent_req_nterror(req, status);
262 return;
263 }
264
265 inbuf = (char *)in;
266 p = bytes;
267
268 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
269 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
270
271 status = smb_bytes_talloc_string(cli,
272 inbuf,
273 &cli->server_os,
274 p,
275 bytes+num_bytes-p,
276 &ret);
277
278 if (!NT_STATUS_IS_OK(status)) {
279 tevent_req_nterror(req, status);
280 return;
281 }
282 p += ret;
283
284 status = smb_bytes_talloc_string(cli,
285 inbuf,
286 &cli->server_type,
287 p,
288 bytes+num_bytes-p,
289 &ret);
290
291 if (!NT_STATUS_IS_OK(status)) {
292 tevent_req_nterror(req, status);
293 return;
294 }
295 p += ret;
296
297 status = smb_bytes_talloc_string(cli,
298 inbuf,
299 &cli->server_domain,
300 p,
301 bytes+num_bytes-p,
302 &ret);
303
304 if (!NT_STATUS_IS_OK(status)) {
305 tevent_req_nterror(req, status);
306 return;
307 }
308 p += ret;
309
310 status = cli_set_username(cli, state->user);
311 if (tevent_req_nterror(req, status)) {
312 return;
313 }
314 tevent_req_done(req);
315 }
316
317 static NTSTATUS cli_session_setup_lanman2_recv(struct tevent_req *req)
318 {
319 return tevent_req_simple_recv_ntstatus(req);
320 }
321
322 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli, const char *user,
323 const char *pass, size_t passlen,
324 const char *workgroup)
325 {
326 TALLOC_CTX *frame = talloc_stackframe();
327 struct event_context *ev;
328 struct tevent_req *req;
329 NTSTATUS status = NT_STATUS_NO_MEMORY;
330
331 if (cli_has_async_calls(cli)) {
332 /*
333 * Can't use sync call while an async call is in flight
334 */
335 status = NT_STATUS_INVALID_PARAMETER;
336 goto fail;
337 }
338 ev = event_context_init(frame);
339 if (ev == NULL) {
340 goto fail;
341 }
342 req = cli_session_setup_lanman2_send(frame, ev, cli, user, pass, passlen,
343 workgroup);
344 if (req == NULL) {
345 goto fail;
346 }
347 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
348 goto fail;
349 }
350 status = cli_session_setup_lanman2_recv(req);
351 fail:
352 TALLOC_FREE(frame);
353 return status;
354 }
355
356 /****************************************************************************
357 Work out suitable capabilities to offer the server.
358 ****************************************************************************/
359
360 static uint32_t cli_session_setup_capabilities(struct cli_state *cli,
361 uint32_t sesssetup_capabilities)
362 {
363 uint32_t client_capabilities = cli_state_capabilities(cli);
364
365 /*
366 * We only send capabilities based on the mask for:
367 * - client only flags
368 * - flags used in both directions
369 *
370 * We do not echo the server only flags.
371 */
372 client_capabilities &= (SMB_CAP_BOTH_MASK | SMB_CAP_CLIENT_MASK);
373
374 /*
375 * Session Setup specific flags CAP_DYNAMIC_REAUTH
376 * and CAP_EXTENDED_SECURITY are passed by the caller.
377 * We need that in order to do guest logins even if
378 * CAP_EXTENDED_SECURITY is negotiated.
379 */
380 client_capabilities &= ~(CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
381 sesssetup_capabilities &= (CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
382 client_capabilities |= sesssetup_capabilities;
383
384 return client_capabilities;
385 }
386
387 /****************************************************************************
388 Do a NT1 guest session setup.
389 ****************************************************************************/
390
391 struct cli_session_setup_guest_state {
392 struct cli_state *cli;
393 uint16_t vwv[13];
394 struct iovec bytes;
395 };
396
397 static void cli_session_setup_guest_done(struct tevent_req *subreq);
398
399 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
400 struct event_context *ev,
401 struct cli_state *cli,
402 struct tevent_req **psmbreq)
403 {
404 struct tevent_req *req, *subreq;
405 struct cli_session_setup_guest_state *state;
406 uint16_t *vwv;
407 uint8_t *bytes;
408
409 req = tevent_req_create(mem_ctx, &state,
410 struct cli_session_setup_guest_state);
411 if (req == NULL) {
412 return NULL;
413 }
414 state->cli = cli;
415 vwv = state->vwv;
416
417 SCVAL(vwv+0, 0, 0xFF);
418 SCVAL(vwv+0, 1, 0);
419 SSVAL(vwv+1, 0, 0);
420 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
421 SSVAL(vwv+3, 0, 2);
422 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
423 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
424 SSVAL(vwv+7, 0, 0);
425 SSVAL(vwv+8, 0, 0);
426 SSVAL(vwv+9, 0, 0);
427 SSVAL(vwv+10, 0, 0);
428 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
429
430 bytes = talloc_array(state, uint8_t, 0);
431
432 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* username */
433 NULL);
434 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
435 NULL);
436 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
437 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
438
439 if (bytes == NULL) {
440 TALLOC_FREE(req);
441 return NULL;
442 }
443
444 state->bytes.iov_base = (void *)bytes;
445 state->bytes.iov_len = talloc_get_size(bytes);
446
447 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
448 1, &state->bytes);
449 if (subreq == NULL) {
450 TALLOC_FREE(req);
451 return NULL;
452 }
453 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
454 *psmbreq = subreq;
455 return req;
456 }
457
458 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
459 struct event_context *ev,
460 struct cli_state *cli)
461 {
462 struct tevent_req *req, *subreq;
463 NTSTATUS status;
464
465 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
466 if (req == NULL) {
467 return NULL;
468 }
469
470 status = cli_smb_req_send(subreq);
471 if (NT_STATUS_IS_OK(status)) {
472 tevent_req_nterror(req, status);
473 return tevent_req_post(req, ev);
474 }
475 return req;
476 }
477
478 static void cli_session_setup_guest_done(struct tevent_req *subreq)
479 {
480 struct tevent_req *req = tevent_req_callback_data(
481 subreq, struct tevent_req);
482 struct cli_session_setup_guest_state *state = tevent_req_data(
483 req, struct cli_session_setup_guest_state);
484 struct cli_state *cli = state->cli;
485 uint32_t num_bytes;
486 uint8_t *in;
487 char *inbuf;
488 uint8_t *bytes;
489 uint8_t *p;
490 NTSTATUS status;
491 ssize_t ret;
492 uint8_t wct;
493 uint16_t *vwv;
494
495 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
496 &num_bytes, &bytes);
497 TALLOC_FREE(subreq);
498 if (!NT_STATUS_IS_OK(status)) {
499 tevent_req_nterror(req, status);
500 return;
501 }
502
503 inbuf = (char *)in;
504 p = bytes;
505
506 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
507 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
508
509 status = smb_bytes_talloc_string(cli,
510 inbuf,
511 &cli->server_os,
512 p,
513 bytes+num_bytes-p,
514 &ret);
515
516 if (!NT_STATUS_IS_OK(status)) {
517 tevent_req_nterror(req, status);
518 return;
519 }
520 p += ret;
521
522 status = smb_bytes_talloc_string(cli,
523 inbuf,
524 &cli->server_type,
525 p,
526 bytes+num_bytes-p,
527 &ret);
528
529 if (!NT_STATUS_IS_OK(status)) {
530 tevent_req_nterror(req, status);
531 return;
532 }
533 p += ret;
534
535 status = smb_bytes_talloc_string(cli,
536 inbuf,
537 &cli->server_domain,
538 p,
539 bytes+num_bytes-p,
540 &ret);
541
542 if (!NT_STATUS_IS_OK(status)) {
543 tevent_req_nterror(req, status);
544 return;
545 }
546 p += ret;
547
548 status = cli_set_username(cli, "");
549 if (!NT_STATUS_IS_OK(status)) {
550 tevent_req_nterror(req, status);
551 return;
552 }
553 tevent_req_done(req);
554 }
555
556 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
557 {
558 return tevent_req_simple_recv_ntstatus(req);
559 }
560
561 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
562 {
563 TALLOC_CTX *frame = talloc_stackframe();
564 struct event_context *ev;
565 struct tevent_req *req;
566 NTSTATUS status = NT_STATUS_OK;
567
568 if (cli_has_async_calls(cli)) {
569 /*
570 * Can't use sync call while an async call is in flight
571 */
572 status = NT_STATUS_INVALID_PARAMETER;
573 goto fail;
574 }
575
576 ev = event_context_init(frame);
577 if (ev == NULL) {
578 status = NT_STATUS_NO_MEMORY;
579 goto fail;
580 }
581
582 req = cli_session_setup_guest_send(frame, ev, cli);
583 if (req == NULL) {
584 status = NT_STATUS_NO_MEMORY;
585 goto fail;
586 }
587
588 if (!tevent_req_poll(req, ev)) {
589 status = map_nt_error_from_unix(errno);
590 goto fail;
591 }
592
593 status = cli_session_setup_guest_recv(req);
594 fail:
595 TALLOC_FREE(frame);
596 return status;
597 }
598
599 /****************************************************************************
600 Do a NT1 plaintext session setup.
601 ****************************************************************************/
602
603 struct cli_session_setup_plain_state {
604 struct cli_state *cli;
605 uint16_t vwv[13];
606 const char *user;
607 };
608
609 static void cli_session_setup_plain_done(struct tevent_req *subreq);
610
611 static struct tevent_req *cli_session_setup_plain_send(
612 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
613 struct cli_state *cli,
614 const char *user, const char *pass, const char *workgroup)
615 {
616 struct tevent_req *req, *subreq;
617 struct cli_session_setup_plain_state *state;
618 uint16_t *vwv;
619 uint8_t *bytes;
620 size_t passlen;
621 char *version;
622
623 req = tevent_req_create(mem_ctx, &state,
624 struct cli_session_setup_plain_state);
625 if (req == NULL) {
626 return NULL;
627 }
628 state->cli = cli;
629 state->user = user;
630 vwv = state->vwv;
631
632 SCVAL(vwv+0, 0, 0xff);
633 SCVAL(vwv+0, 1, 0);
634 SSVAL(vwv+1, 0, 0);
635 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
636 SSVAL(vwv+3, 0, 2);
637 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
638 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
639 SSVAL(vwv+7, 0, 0);
640 SSVAL(vwv+8, 0, 0);
641 SSVAL(vwv+9, 0, 0);
642 SSVAL(vwv+10, 0, 0);
643 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
644
645 bytes = talloc_array(state, uint8_t, 0);
646 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), pass, strlen(pass)+1,
647 &passlen);
648 if (tevent_req_nomem(bytes, req)) {
649 return tevent_req_post(req, ev);
650 }
651 SSVAL(vwv + (cli_ucs2(cli) ? 8 : 7), 0, passlen);
652
653 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
654 user, strlen(user)+1, NULL);
655 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
656 workgroup, strlen(workgroup)+1, NULL);
657 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
658 "Unix", 5, NULL);
659
660 version = talloc_asprintf(talloc_tos(), "Samba %s",
661 samba_version_string());
662 if (tevent_req_nomem(version, req)){
663 return tevent_req_post(req, ev);
664 }
665 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
666 version, strlen(version)+1, NULL);
667 TALLOC_FREE(version);
668
669 if (tevent_req_nomem(bytes, req)) {
670 return tevent_req_post(req, ev);
671 }
672
673 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
674 talloc_get_size(bytes), bytes);
675 if (tevent_req_nomem(subreq, req)) {
676 return tevent_req_post(req, ev);
677 }
678 tevent_req_set_callback(subreq, cli_session_setup_plain_done, req);
679 return req;
680 }
681
682 static void cli_session_setup_plain_done(struct tevent_req *subreq)
683 {
684 struct tevent_req *req = tevent_req_callback_data(
685 subreq, struct tevent_req);
686 struct cli_session_setup_plain_state *state = tevent_req_data(
687 req, struct cli_session_setup_plain_state);
688 struct cli_state *cli = state->cli;
689 uint32_t num_bytes;
690 uint8_t *in;
691 char *inbuf;
692 uint8_t *bytes;
693 uint8_t *p;
694 NTSTATUS status;
695 ssize_t ret;
696 uint8_t wct;
697 uint16_t *vwv;
698
699 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
700 &num_bytes, &bytes);
701 TALLOC_FREE(subreq);
702 if (tevent_req_nterror(req, status)) {
703 return;
704 }
705
706 inbuf = (char *)in;
707 p = bytes;
708
709 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
710 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
711
712 status = smb_bytes_talloc_string(cli,
713 inbuf,
714 &cli->server_os,
715 p,
716 bytes+num_bytes-p,
717 &ret);
718
719 if (!NT_STATUS_IS_OK(status)) {
720 tevent_req_nterror(req, status);
721 return;
722 }
723 p += ret;
724
725 status = smb_bytes_talloc_string(cli,
726 inbuf,
727 &cli->server_type,
728 p,
729 bytes+num_bytes-p,
730 &ret);
731
732 if (!NT_STATUS_IS_OK(status)) {
733 tevent_req_nterror(req, status);
734 return;
735 }
736 p += ret;
737
738 status = smb_bytes_talloc_string(cli,
739 inbuf,
740 &cli->server_domain,
741 p,
742 bytes+num_bytes-p,
743 &ret);
744
745 if (!NT_STATUS_IS_OK(status)) {
746 tevent_req_nterror(req, status);
747 return;
748 }
749 p += ret;
750
751 status = cli_set_username(cli, state->user);
752 if (tevent_req_nterror(req, status)) {
753 return;
754 }
755
756 tevent_req_done(req);
757 }
758
759 static NTSTATUS cli_session_setup_plain_recv(struct tevent_req *req)
760 {
761 return tevent_req_simple_recv_ntstatus(req);
762 }
763
764 static NTSTATUS cli_session_setup_plain(struct cli_state *cli,
765 const char *user, const char *pass,
766 const char *workgroup)
767 {
768 TALLOC_CTX *frame = talloc_stackframe();
769 struct event_context *ev;
770 struct tevent_req *req;
771 NTSTATUS status = NT_STATUS_NO_MEMORY;
772
773 if (cli_has_async_calls(cli)) {
774 /*
775 * Can't use sync call while an async call is in flight
776 */
777 status = NT_STATUS_INVALID_PARAMETER;
778 goto fail;
779 }
780 ev = event_context_init(frame);
781 if (ev == NULL) {
782 goto fail;
783 }
784 req = cli_session_setup_plain_send(frame, ev, cli, user, pass,
785 workgroup);
786 if (req == NULL) {
787 goto fail;
788 }
789 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
790 goto fail;
791 }
792 status = cli_session_setup_plain_recv(req);
793 fail:
794 TALLOC_FREE(frame);
795 return status;
796 }
797
798 /****************************************************************************
799 do a NT1 NTLM/LM encrypted session setup - for when extended security
800 is not negotiated.
801 @param cli client state to create do session setup on
802 @param user username
803 @param pass *either* cleartext password (passlen !=24) or LM response.
804 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
805 @param workgroup The user's domain.
806 ****************************************************************************/
807
808 struct cli_session_setup_nt1_state {
809 struct cli_state *cli;
810 uint16_t vwv[13];
811 DATA_BLOB response;
812 DATA_BLOB session_key;
813 const char *user;
814 };
815
816 static void cli_session_setup_nt1_done(struct tevent_req *subreq);
817
818 static struct tevent_req *cli_session_setup_nt1_send(
819 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
820 struct cli_state *cli, const char *user,
821 const char *pass, size_t passlen,
822 const char *ntpass, size_t ntpasslen,
823 const char *workgroup)
824 {
825 struct tevent_req *req, *subreq;
826 struct cli_session_setup_nt1_state *state;
827 DATA_BLOB lm_response = data_blob_null;
828 DATA_BLOB nt_response = data_blob_null;
829 DATA_BLOB session_key = data_blob_null;
830 uint16_t *vwv;
831 uint8_t *bytes;
832 char *workgroup_upper;
833
834 req = tevent_req_create(mem_ctx, &state,
835 struct cli_session_setup_nt1_state);
836 if (req == NULL) {
837 return NULL;
838 }
839 state->cli = cli;
840 state->user = user;
841 vwv = state->vwv;
842
843 if (passlen == 0) {
844 /* do nothing - guest login */
845 } else if (passlen != 24) {
846 if (lp_client_ntlmv2_auth()) {
847 DATA_BLOB server_chal;
848 DATA_BLOB names_blob;
849
850 server_chal =
851 data_blob_const(cli_state_server_challenge(cli),
852 8);
853
854 /*
855 * note that the 'workgroup' here is a best
856 * guess - we don't know the server's domain
857 * at this point. Windows clients also don't
858 * use hostname...
859 */
860 names_blob = NTLMv2_generate_names_blob(
861 NULL, NULL, workgroup);
862
863 if (tevent_req_nomem(names_blob.data, req)) {
864 return tevent_req_post(req, ev);
865 }
866
867 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass,
868 &server_chal, &names_blob,
869 &lm_response, &nt_response,
870 NULL, &session_key)) {
871 data_blob_free(&names_blob);
872 tevent_req_nterror(
873 req, NT_STATUS_ACCESS_DENIED);
874 return tevent_req_post(req, ev);
875 }
876 data_blob_free(&names_blob);
877
878 } else {
879 uchar nt_hash[16];
880 E_md4hash(pass, nt_hash);
881
882 #ifdef LANMAN_ONLY
883 nt_response = data_blob_null;
884 #else
885 nt_response = data_blob(NULL, 24);
886 if (tevent_req_nomem(nt_response.data, req)) {
887 return tevent_req_post(req, ev);
888 }
889
890 SMBNTencrypt(pass, cli_state_server_challenge(cli),
891 nt_response.data);
892 #endif
893 /* non encrypted password supplied. Ignore ntpass. */
894 if (lp_client_lanman_auth()) {
895
896 lm_response = data_blob(NULL, 24);
897 if (tevent_req_nomem(lm_response.data, req)) {
898 return tevent_req_post(req, ev);
899 }
900
901 if (!SMBencrypt(pass,
902 cli_state_server_challenge(cli),
903 lm_response.data)) {
904 /*
905 * Oops, the LM response is
906 * invalid, just put the NT
907 * response there instead
908 */
909 data_blob_free(&lm_response);
910 lm_response = data_blob(
911 nt_response.data,
912 nt_response.length);
913 }
914 } else {
915 /*
916 * LM disabled, place NT# in LM field
917 * instead
918 */
919 lm_response = data_blob(
920 nt_response.data, nt_response.length);
921 }
922
923 if (tevent_req_nomem(lm_response.data, req)) {
924 return tevent_req_post(req, ev);
925 }
926
927 session_key = data_blob(NULL, 16);
928 if (tevent_req_nomem(session_key.data, req)) {
929 return tevent_req_post(req, ev);
930 }
931 #ifdef LANMAN_ONLY
932 E_deshash(pass, session_key.data);
933 memset(&session_key.data[8], '\0', 8);
934 #else
935 SMBsesskeygen_ntv1(nt_hash, session_key.data);
936 #endif
937 }
938 } else {
939 /* pre-encrypted password supplied. Only used for
940 security=server, can't do
941 signing because we don't have original key */
942
943 lm_response = data_blob(pass, passlen);
944 if (tevent_req_nomem(lm_response.data, req)) {
945 return tevent_req_post(req, ev);
946 }
947
948 nt_response = data_blob(ntpass, ntpasslen);
949 if (tevent_req_nomem(nt_response.data, req)) {
950 return tevent_req_post(req, ev);
951 }
952 }
953
954 #ifdef LANMAN_ONLY
955 state->response = data_blob_talloc(
956 state, lm_response.data, lm_response.length);
957 #else
958 state->response = data_blob_talloc(
959 state, nt_response.data, nt_response.length);
960 #endif
961 if (tevent_req_nomem(state->response.data, req)) {
962 return tevent_req_post(req, ev);
963 }
964
965 if (session_key.data) {
966 state->session_key = data_blob_talloc(
967 state, session_key.data, session_key.length);
968 if (tevent_req_nomem(state->session_key.data, req)) {
969 return tevent_req_post(req, ev);
970 }
971 }
972 data_blob_free(&session_key);
973
974 SCVAL(vwv+0, 0, 0xff);
975 SCVAL(vwv+0, 1, 0);
976 SSVAL(vwv+1, 0, 0);
977 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
978 SSVAL(vwv+3, 0, 2);
979 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
980 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
981 SSVAL(vwv+7, 0, lm_response.length);
982 SSVAL(vwv+8, 0, nt_response.length);
983 SSVAL(vwv+9, 0, 0);
984 SSVAL(vwv+10, 0, 0);
985 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
986
987 bytes = talloc_array(state, uint8_t,
988 lm_response.length + nt_response.length);
989 if (tevent_req_nomem(bytes, req)) {
990 return tevent_req_post(req, ev);
991 }
992 if (lm_response.length != 0) {
993 memcpy(bytes, lm_response.data, lm_response.length);
994 }
995 if (nt_response.length != 0) {
996 memcpy(bytes + lm_response.length,
997 nt_response.data, nt_response.length);
998 }
999 data_blob_free(&lm_response);
1000 data_blob_free(&nt_response);
1001
1002 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
1003 user, strlen(user)+1, NULL);
1004
1005 /*
1006 * Upper case here might help some NTLMv2 implementations
1007 */
1008 workgroup_upper = talloc_strdup_upper(talloc_tos(), workgroup);
1009 if (tevent_req_nomem(workgroup_upper, req)) {
1010 return tevent_req_post(req, ev);
1011 }
1012 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
1013 workgroup_upper, strlen(workgroup_upper)+1,
1014 NULL);
1015 TALLOC_FREE(workgroup_upper);
1016
1017 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
1018 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
1019 if (tevent_req_nomem(bytes, req)) {
1020 return tevent_req_post(req, ev);
1021 }
1022
1023 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
1024 talloc_get_size(bytes), bytes);
1025 if (tevent_req_nomem(subreq, req)) {
1026 return tevent_req_post(req, ev);
1027 }
1028 tevent_req_set_callback(subreq, cli_session_setup_nt1_done, req);
1029 return req;
1030 }
1031
1032 static void cli_session_setup_nt1_done(struct tevent_req *subreq)
1033 {
1034 struct tevent_req *req = tevent_req_callback_data(
1035 subreq, struct tevent_req);
1036 struct cli_session_setup_nt1_state *state = tevent_req_data(
1037 req, struct cli_session_setup_nt1_state);
1038 struct cli_state *cli = state->cli;
1039 uint32_t num_bytes;
1040 uint8_t *in;
1041 char *inbuf;
1042 uint8_t *bytes;
1043 uint8_t *p;
1044 NTSTATUS status;
1045 ssize_t ret;
1046 uint8_t wct;
1047 uint16_t *vwv;
1048
1049 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
1050 &num_bytes, &bytes);
1051 TALLOC_FREE(subreq);
1052 if (!NT_STATUS_IS_OK(status)) {
1053 tevent_req_nterror(req, status);
1054 return;
1055 }
1056
1057 inbuf = (char *)in;
1058 p = bytes;
1059
1060 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
1061 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1062
1063 status = smb_bytes_talloc_string(cli,
1064 inbuf,
1065 &cli->server_os,
1066 p,
1067 bytes+num_bytes-p,
1068 &ret);
1069 if (!NT_STATUS_IS_OK(status)) {
1070 tevent_req_nterror(req, status);
1071 return;
1072 }
1073 p += ret;
1074
1075 status = smb_bytes_talloc_string(cli,
1076 inbuf,
1077 &cli->server_type,
1078 p,
1079 bytes+num_bytes-p,
1080 &ret);
1081 if (!NT_STATUS_IS_OK(status)) {
1082 tevent_req_nterror(req, status);
1083 return;
1084 }
1085 p += ret;
1086
1087 status = smb_bytes_talloc_string(cli,
1088 inbuf,
1089 &cli->server_domain,
1090 p,
1091 bytes+num_bytes-p,
1092 &ret);
1093 if (!NT_STATUS_IS_OK(status)) {
1094 tevent_req_nterror(req, status);
1095 return;
1096 }
1097 p += ret;
1098
1099 status = cli_set_username(cli, state->user);
1100 if (tevent_req_nterror(req, status)) {
1101 return;
1102 }
1103 if (cli_simple_set_signing(cli, state->session_key, state->response)
1104 && !cli_check_sign_mac(cli, (char *)in, 1)) {
1105 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1106 return;
1107 }
1108 if (state->session_key.data) {
1109 /* Have plaintext orginal */
1110 cli_set_session_key(cli, state->session_key);
1111 }
1112 tevent_req_done(req);
1113 }
1114
1115 static NTSTATUS cli_session_setup_nt1_recv(struct tevent_req *req)
1116 {
1117 return tevent_req_simple_recv_ntstatus(req);
1118 }
1119
1120 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
1121 const char *pass, size_t passlen,
1122 const char *ntpass, size_t ntpasslen,
1123 const char *workgroup)
1124 {
1125 TALLOC_CTX *frame = talloc_stackframe();
1126 struct event_context *ev;
1127 struct tevent_req *req;
1128 NTSTATUS status = NT_STATUS_NO_MEMORY;
1129
1130 if (cli_has_async_calls(cli)) {
1131 /*
1132 * Can't use sync call while an async call is in flight
1133 */
1134 status = NT_STATUS_INVALID_PARAMETER;
1135 goto fail;
1136 }
1137 ev = event_context_init(frame);
1138 if (ev == NULL) {
1139 goto fail;
1140 }
1141 req = cli_session_setup_nt1_send(frame, ev, cli, user, pass, passlen,
1142 ntpass, ntpasslen, workgroup);
1143 if (req == NULL) {
1144 goto fail;
1145 }
1146 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1147 goto fail;
1148 }
1149 status = cli_session_setup_nt1_recv(req);
1150 fail:
1151 TALLOC_FREE(frame);
1152 return status;
1153 }
1154
1155 /* The following is calculated from :
1156 * (smb_size-4) = 35
1157 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
1158 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
1159 * end of packet.
1160 */
1161
1162 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
1163
1164 struct cli_sesssetup_blob_state {
1165 struct tevent_context *ev;
1166 struct cli_state *cli;
1167 DATA_BLOB blob;
1168 uint16_t max_blob_size;
1169 uint16_t vwv[12];
1170 uint8_t *buf;
1171
1172 NTSTATUS status;
1173 char *inbuf;
1174 DATA_BLOB ret_blob;
1175 };
1176
1177 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1178 struct tevent_req **psubreq);
1179 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
1180
1181 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
1182 struct tevent_context *ev,
1183 struct cli_state *cli,
1184 DATA_BLOB blob)
1185 {
1186 struct tevent_req *req, *subreq;
1187 struct cli_sesssetup_blob_state *state;
1188 uint32_t usable_space;
1189
1190 req = tevent_req_create(mem_ctx, &state,
1191 struct cli_sesssetup_blob_state);
1192 if (req == NULL) {
1193 return NULL;
1194 }
1195 state->ev = ev;
1196 state->blob = blob;
1197 state->cli = cli;
1198
1199 usable_space = cli_state_available_size(cli,
1200 BASE_SESSSETUP_BLOB_PACKET_SIZE);
1201
1202 if (usable_space == 0) {
1203 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
1204 "(not possible to send %u bytes)\n",
1205 BASE_SESSSETUP_BLOB_PACKET_SIZE + 1));
1206 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1207 return tevent_req_post(req, ev);
1208 }
1209 state->max_blob_size = MIN(usable_space, 0xFFFF);
1210
1211 if (!cli_sesssetup_blob_next(state, &subreq)) {
1212 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1213 return tevent_req_post(req, ev);
1214 }
1215 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1216 return req;
1217 }
1218
1219 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1220 struct tevent_req **psubreq)
1221 {
1222 struct tevent_req *subreq;
1223 uint16_t thistime;
1224
1225 SCVAL(state->vwv+0, 0, 0xFF);
1226 SCVAL(state->vwv+0, 1, 0);
1227 SSVAL(state->vwv+1, 0, 0);
1228 SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
1229 SSVAL(state->vwv+3, 0, 2);
1230 SSVAL(state->vwv+4, 0, 1);
1231 SIVAL(state->vwv+5, 0, 0);
1232
1233 thistime = MIN(state->blob.length, state->max_blob_size);
1234 SSVAL(state->vwv+7, 0, thistime);
1235
1236 SSVAL(state->vwv+8, 0, 0);
1237 SSVAL(state->vwv+9, 0, 0);
1238 SIVAL(state->vwv+10, 0,
1239 cli_session_setup_capabilities(state->cli, CAP_EXTENDED_SECURITY));
1240
1241 state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
1242 thistime);
1243 if (state->buf == NULL) {
1244 return false;
1245 }
1246 state->blob.data += thistime;
1247 state->blob.length -= thistime;
1248
1249 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
1250 "Unix", 5, NULL);
1251 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
1252 "Samba", 6, NULL);
1253 if (state->buf == NULL) {
1254 return false;
1255 }
1256 subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
1257 12, state->vwv,
1258 talloc_get_size(state->buf), state->buf);
1259 if (subreq == NULL) {
1260 return false;
1261 }
1262 *psubreq = subreq;
1263 return true;
1264 }
1265
1266 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
1267 {
1268 struct tevent_req *req = tevent_req_callback_data(
1269 subreq, struct tevent_req);
1270 struct cli_sesssetup_blob_state *state = tevent_req_data(
1271 req, struct cli_sesssetup_blob_state);
1272 struct cli_state *cli = state->cli;
1273 uint8_t wct;
1274 uint16_t *vwv;
1275 uint32_t num_bytes;
1276 uint8_t *bytes;
1277 NTSTATUS status;
1278 uint8_t *p;
1279 uint16_t blob_length;
1280 uint8_t *inbuf;
1281 ssize_t ret;
1282
1283 status = cli_smb_recv(subreq, state, &inbuf, 4, &wct, &vwv,
1284 &num_bytes, &bytes);
1285 TALLOC_FREE(subreq);
1286 if (!NT_STATUS_IS_OK(status)
1287 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1288 tevent_req_nterror(req, status);
1289 return;
1290 }
1291
1292 state->status = status;
1293 TALLOC_FREE(state->buf);
1294
1295 state->inbuf = (char *)inbuf;
1296 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
1297 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1298
1299 blob_length = SVAL(vwv+3, 0);
1300 if (blob_length > num_bytes) {
1301 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1302 return;
1303 }
1304 state->ret_blob = data_blob_const(bytes, blob_length);
1305
1306 p = bytes + blob_length;
1307
1308 status = smb_bytes_talloc_string(cli,
1309 (char *)inbuf,
1310 &cli->server_os,
1311 p,
1312 bytes+num_bytes-p,
1313 &ret);
1314
1315 if (!NT_STATUS_IS_OK(status)) {
1316 tevent_req_nterror(req, status);
1317 return;
1318 }
1319 p += ret;
1320
1321 status = smb_bytes_talloc_string(cli,
1322 (char *)inbuf,
1323 &cli->server_type,
1324 p,
1325 bytes+num_bytes-p,
1326 &ret);
1327
1328 if (!NT_STATUS_IS_OK(status)) {
1329 tevent_req_nterror(req, status);
1330 return;
1331 }
1332 p += ret;
1333
1334 status = smb_bytes_talloc_string(cli,
1335 (char *)inbuf,
1336 &cli->server_domain,
1337 p,
1338 bytes+num_bytes-p,
1339 &ret);
1340
1341 if (!NT_STATUS_IS_OK(status)) {
1342 tevent_req_nterror(req, status);
1343 return;
1344 }
1345 p += ret;
1346
1347 if (state->blob.length != 0) {
1348 /*
1349 * More to send
1350 */
1351 if (!cli_sesssetup_blob_next(state, &subreq)) {
1352 tevent_req_oom(req);
1353 return;
1354 }
1355 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1356 return;
1357 }
1358 tevent_req_done(req);
1359 }
1360
1361 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
1362 TALLOC_CTX *mem_ctx,
1363 DATA_BLOB *pblob,
1364 char **pinbuf)
1365 {
1366 struct cli_sesssetup_blob_state *state = tevent_req_data(
1367 req, struct cli_sesssetup_blob_state);
1368 NTSTATUS status;
1369 char *inbuf;
1370
1371 if (tevent_req_is_nterror(req, &status)) {
1372 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1373 return status;
1374 }
1375
1376 inbuf = talloc_move(mem_ctx, &state->inbuf);
1377 if (pblob != NULL) {
1378 *pblob = state->ret_blob;
1379 }
1380 if (pinbuf != NULL) {
1381 *pinbuf = inbuf;
1382 }
1383 /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
1384 return state->status;
1385 }
1386
1387 #ifdef HAVE_KRB5
1388
1389 /****************************************************************************
1390 Use in-memory credentials cache
1391 ****************************************************************************/
1392
1393 static void use_in_memory_ccache(void) {
1394 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
1395 }
1396
1397 /****************************************************************************
1398 Do a spnego/kerberos encrypted session setup.
1399 ****************************************************************************/
1400
1401 struct cli_session_setup_kerberos_state {
1402 struct cli_state *cli;
1403 DATA_BLOB negTokenTarg;
1404 DATA_BLOB session_key_krb5;
1405 ADS_STATUS ads_status;
1406 };
1407
1408 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
1409
1410 static struct tevent_req *cli_session_setup_kerberos_send(
1411 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1412 const char *principal)
1413 {
1414 struct tevent_req *req, *subreq;
1415 struct cli_session_setup_kerberos_state *state;
1416 int rc;
1417
1418 DEBUG(2,("Doing kerberos session setup\n"));
1419
1420 req = tevent_req_create(mem_ctx, &state,
1421 struct cli_session_setup_kerberos_state);
1422 if (req == NULL) {
1423 return NULL;
1424 }
1425 state->cli = cli;
1426 state->ads_status = ADS_SUCCESS;
1427
1428 /*
1429 * Ok, this is cheating: spnego_gen_krb5_negTokenInit can block if
1430 * we have to acquire a ticket. To be fixed later :-)
1431 */
1432 rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
1433 &state->session_key_krb5, 0, NULL);
1434 if (rc) {
1435 DEBUG(1, ("cli_session_setup_kerberos: "
1436 "spnego_gen_krb5_negTokenInit failed: %s\n",
1437 error_message(rc)));
1438 state->ads_status = ADS_ERROR_KRB5(rc);
1439 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1440 return tevent_req_post(req, ev);
1441 }
1442
1443 #if 0
1444 file_save("negTokenTarg.dat", state->negTokenTarg.data,
1445 state->negTokenTarg.length);
1446 #endif
1447
1448 subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
1449 if (tevent_req_nomem(subreq, req)) {
1450 return tevent_req_post(req, ev);
1451 }
1452 tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
1453 return req;
1454 }
1455
1456 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
1457 {
1458 struct tevent_req *req = tevent_req_callback_data(
1459 subreq, struct tevent_req);
1460 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1461 req, struct cli_session_setup_kerberos_state);
1462 char *inbuf = NULL;
1463 NTSTATUS status;
1464
1465 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), NULL, &inbuf);
1466 TALLOC_FREE(subreq);
1467 if (!NT_STATUS_IS_OK(status)) {
1468 tevent_req_nterror(req, status);
1469 return;
1470 }
1471
1472 cli_set_session_key(state->cli, state->session_key_krb5);
1473
1474 if (cli_simple_set_signing(state->cli, state->session_key_krb5,
1475 data_blob_null)
1476 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1477 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1478 return;
1479 }
1480
1481 tevent_req_done(req);
1482 }
1483
1484 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
1485 {
1486 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1487 req, struct cli_session_setup_kerberos_state);
1488 NTSTATUS status;
1489
1490 if (tevent_req_is_nterror(req, &status)) {
1491 return ADS_ERROR_NT(status);
1492 }
1493 return state->ads_status;
1494 }
1495
1496 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
1497 const char *principal)
1498 {
1499 struct tevent_context *ev;
1500 struct tevent_req *req;
1501 ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1502
1503 if (cli_has_async_calls(cli)) {
1504 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1505 }
1506 ev = tevent_context_init(talloc_tos());
1507 if (ev == NULL) {
1508 goto fail;
1509 }
1510 req = cli_session_setup_kerberos_send(ev, ev, cli, principal);
1511 if (req == NULL) {
1512 goto fail;
1513 }
1514 if (!tevent_req_poll(req, ev)) {
1515 status = ADS_ERROR_SYSTEM(errno);
1516 goto fail;
1517 }
1518 status = cli_session_setup_kerberos_recv(req);
1519 fail:
1520 TALLOC_FREE(ev);
1521 return status;
1522 }
1523 #endif /* HAVE_KRB5 */
1524
1525 /****************************************************************************
1526 Do a spnego/NTLMSSP encrypted session setup.
1527 ****************************************************************************/
1528
1529 struct cli_session_setup_ntlmssp_state {
1530 struct tevent_context *ev;
1531 struct cli_state *cli;
1532 struct ntlmssp_state *ntlmssp_state;
1533 int turn;
1534 DATA_BLOB blob_out;
1535 };
1536
1537 static int cli_session_setup_ntlmssp_state_destructor(
1538 struct cli_session_setup_ntlmssp_state *state)
1539 {
1540 if (state->ntlmssp_state != NULL) {
1541 TALLOC_FREE(state->ntlmssp_state);
1542 }
1543 return 0;
1544 }
1545
1546 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
1547
1548 static struct tevent_req *cli_session_setup_ntlmssp_send(
1549 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1550 const char *user, const char *pass, const char *domain)
1551 {
1552 struct tevent_req *req, *subreq;
1553 struct cli_session_setup_ntlmssp_state *state;
1554 NTSTATUS status;
1555 DATA_BLOB blob_out;
1556 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
1557
1558 req = tevent_req_create(mem_ctx, &state,
1559 struct cli_session_setup_ntlmssp_state);
1560 if (req == NULL) {
1561 return NULL;
1562 }
1563 state->ev = ev;
1564 state->cli = cli;
1565 state->turn = 1;
1566
1567 state->ntlmssp_state = NULL;
1568 talloc_set_destructor(
1569 state, cli_session_setup_ntlmssp_state_destructor);
1570
1571 status = ntlmssp_client_start(state,
1572 lp_netbios_name(),
1573 lp_workgroup(),
1574 lp_client_ntlmv2_auth(),
1575 &state->ntlmssp_state);
1576 if (!NT_STATUS_IS_OK(status)) {
1577 goto fail;
1578 }
1579 ntlmssp_want_feature(state->ntlmssp_state,
1580 NTLMSSP_FEATURE_SESSION_KEY);
1581 if (cli->use_ccache) {
1582 ntlmssp_want_feature(state->ntlmssp_state,
1583 NTLMSSP_FEATURE_CCACHE);
1584 }
1585 status = ntlmssp_set_username(state->ntlmssp_state, user);
1586 if (!NT_STATUS_IS_OK(status)) {
1587 goto fail;
1588 }
1589 status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1590 if (!NT_STATUS_IS_OK(status)) {
1591 goto fail;
1592 }
1593 status = ntlmssp_set_password(state->ntlmssp_state, pass);
1594 if (!NT_STATUS_IS_OK(status)) {
1595 goto fail;
1596 }
1597 status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1598 &blob_out);
1599 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1600 goto fail;
1601 }
1602
1603 state->blob_out = spnego_gen_negTokenInit(state, OIDs_ntlm, &blob_out, NULL);
1604 data_blob_free(&blob_out);
1605
1606 subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1607 if (tevent_req_nomem(subreq, req)) {
1608 return tevent_req_post(req, ev);
1609 }
1610 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1611 return req;
1612 fail:
1613 tevent_req_nterror(req, status);
1614 return tevent_req_post(req, ev);
1615 }
1616
1617 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1618 {
1619 struct tevent_req *req = tevent_req_callback_data(
1620 subreq, struct tevent_req);
1621 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1622 req, struct cli_session_setup_ntlmssp_state);
1623 DATA_BLOB blob_in, msg_in, blob_out;
1624 char *inbuf = NULL;
1625 bool parse_ret;
1626 NTSTATUS status;
1627
1628 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1629 &inbuf);
1630 TALLOC_FREE(subreq);
1631 data_blob_free(&state->blob_out);
1632
1633 if (NT_STATUS_IS_OK(status)) {
1634 if (state->cli->server_domain[0] == '\0') {
1635 TALLOC_FREE(state->cli->server_domain);
1636 state->cli->server_domain = talloc_strdup(state->cli,
1637 state->ntlmssp_state->server.netbios_domain);
1638 if (state->cli->server_domain == NULL) {
1639 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1640 return;
1641 }
1642 }
1643 cli_set_session_key(
1644 state->cli, state->ntlmssp_state->session_key);
1645
1646 if (cli_simple_set_signing(
1647 state->cli, state->ntlmssp_state->session_key,
1648 data_blob_null)
1649 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1650 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1651 return;
1652 }
1653 TALLOC_FREE(state->ntlmssp_state);
1654 tevent_req_done(req);
1655 return;
1656 }
1657 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1658 tevent_req_nterror(req, status);
1659 return;
1660 }
1661
1662 if (blob_in.length == 0) {
1663 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1664 return;
1665 }
1666
1667 if ((state->turn == 1)
1668 && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1669 DATA_BLOB tmp_blob = data_blob_null;
1670 /* the server might give us back two challenges */
1671 parse_ret = spnego_parse_challenge(state, blob_in, &msg_in,
1672 &tmp_blob);
1673 data_blob_free(&tmp_blob);
1674 } else {
1675 parse_ret = spnego_parse_auth_response(state, blob_in, status,
1676 OID_NTLMSSP, &msg_in);
1677 }
1678 state->turn += 1;
1679
1680 if (!parse_ret) {
1681 DEBUG(3,("Failed to parse auth response\n"));
1682 if (NT_STATUS_IS_OK(status)
1683 || NT_STATUS_EQUAL(status,
1684 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1685 tevent_req_nterror(
1686 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1687 return;
1688 }
1689 }
1690
1691 status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1692
1693 if (!NT_STATUS_IS_OK(status)
1694 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1695 TALLOC_FREE(state->ntlmssp_state);
1696 tevent_req_nterror(req, status);
1697 return;
1698 }
1699
1700 state->blob_out = spnego_gen_auth(state, blob_out);
1701 if (tevent_req_nomem(state->blob_out.data, req)) {
1702 return;
1703 }
1704
1705 subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1706 state->blob_out);
1707 if (tevent_req_nomem(subreq, req)) {
1708 return;
1709 }
1710 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1711 }
1712
1713 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1714 {
1715 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1716 req, struct cli_session_setup_ntlmssp_state);
1717 NTSTATUS status;
1718
1719 if (tevent_req_is_nterror(req, &status)) {
1720 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1721 return status;
1722 }
1723 return NT_STATUS_OK;
1724 }
1725
1726 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1727 const char *user,
1728 const char *pass,
1729 const char *domain)
1730 {
1731 struct tevent_context *ev;
1732 struct tevent_req *req;
1733 NTSTATUS status = NT_STATUS_NO_MEMORY;
1734
1735 if (cli_has_async_calls(cli)) {
1736 return NT_STATUS_INVALID_PARAMETER;
1737 }
1738 ev = tevent_context_init(talloc_tos());
1739 if (ev == NULL) {
1740 goto fail;
1741 }
1742 req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1743 if (req == NULL) {
1744 goto fail;
1745 }
1746 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1747 goto fail;
1748 }
1749 status = cli_session_setup_ntlmssp_recv(req);
1750 fail:
1751 TALLOC_FREE(ev);
1752 return status;
1753 }
1754
1755 /****************************************************************************
1756 Do a spnego encrypted session setup.
1757
1758 user_domain: The shortname of the domain the user/machine is a member of.
1759 dest_realm: The realm we're connecting to, if NULL we use our default realm.
1760 ****************************************************************************/
1761
1762 static ADS_STATUS cli_session_setup_spnego(struct cli_state *cli,
1763 const char *user,
1764 const char *pass,
1765 const char *user_domain,
1766 const char * dest_realm)
1767 {
1768 char *principal = NULL;
1769 char *OIDs[ASN1_MAX_OIDS];
1770 int i;
1771 const DATA_BLOB *server_blob;
1772 DATA_BLOB blob = data_blob_null;
1773 const char *p = NULL;
1774 char *account = NULL;
1775 NTSTATUS status;
1776
1777 server_blob = cli_state_server_gss_blob(cli);
1778 if (server_blob) {
1779 blob = data_blob(server_blob->data, server_blob->length);
1780 }
1781
1782 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)blob.length));
1783
1784 /* the server might not even do spnego */
1785 if (blob.length == 0) {
1786 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1787 goto ntlmssp;
1788 }
1789
1790 #if 0
1791 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1792 #endif
1793
1794 /* The server sent us the first part of the SPNEGO exchange in the
1795 * negprot reply. It is WRONG to depend on the principal sent in the
1796 * negprot reply, but right now we do it. If we don't receive one,
1797 * we try to best guess, then fall back to NTLM. */
1798 if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &principal, NULL) ||
1799 OIDs[0] == NULL) {
1800 data_blob_free(&blob);
1801 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1802 }
1803 data_blob_free(&blob);
1804
1805 /* make sure the server understands kerberos */
1806 for (i=0;OIDs[i];i++) {
1807 if (i == 0)
1808 DEBUG(3,("got OID=%s\n", OIDs[i]));
1809 else
1810 DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1811 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1812 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1813 cli->got_kerberos_mechanism = True;
1814 }
1815 talloc_free(OIDs[i]);
1816 }
1817
1818 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1819
1820 status = cli_set_username(cli, user);
1821 if (!NT_STATUS_IS_OK(status)) {
1822 TALLOC_FREE(principal);
1823 return ADS_ERROR_NT(status);
1824 }
1825
1826 #ifdef HAVE_KRB5
1827 /* If password is set we reauthenticate to kerberos server
1828 * and do not store results */
1829
1830 if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1831 ADS_STATUS rc;
1832 const char *remote_name = cli_state_remote_name(cli);
1833
1834 if (pass && *pass) {
1835 int ret;
1836
1837 use_in_memory_ccache();
1838 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1839
1840 if (ret){
1841 TALLOC_FREE(principal);
1842 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1843 if (cli->fallback_after_kerberos)
1844 goto ntlmssp;
1845 return ADS_ERROR_KRB5(ret);
1846 }
1847 }
1848
1849 /* We may not be allowed to use the server-supplied SPNEGO principal, or it may not have been supplied to us
1850 */
1851 if (!lp_client_use_spnego_principal() || strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1852 TALLOC_FREE(principal);
1853 }
1854
1855 if (principal == NULL &&
1856 !is_ipaddress(remote_name) &&
1857 !strequal(STAR_SMBSERVER,
1858 remote_name)) {
1859 char *realm = NULL;
1860 char *host = NULL;
1861 DEBUG(3,("cli_session_setup_spnego: using target "
1862 "hostname not SPNEGO principal\n"));
1863
1864 host = strchr_m(remote_name, '.');
1865 if (dest_realm) {
1866 realm = SMB_STRDUP(dest_realm);
1867 if (!realm) {
1868 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1869 }
1870 strupper_m(realm);
1871 } else {
1872 if (host) {
1873 /* DNS name. */
1874 realm = kerberos_get_realm_from_hostname(remote_name);
1875 } else {
1876 /* NetBIOS name - use our realm. */
1877 realm = kerberos_get_default_realm_from_ccache();
1878 }
1879 }
1880
1881 if (realm == NULL || *realm == '\0') {
1882 realm = SMB_STRDUP(lp_realm());
1883 if (!realm) {
1884 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1885 }
1886 strupper_m(realm);
1887 DEBUG(3,("cli_session_setup_spnego: cannot "
1888 "get realm from dest_realm %s, "
1889 "desthost %s. Using default "
1890 "smb.conf realm %s\n",
1891 dest_realm ? dest_realm : "<null>",
1892 remote_name,
1893 realm));
1894 }
1895
1896 principal = talloc_asprintf(talloc_tos(),
1897 "cifs/%s@%s",
1898 remote_name,
1899 realm);
1900 if (!principal) {
1901 SAFE_FREE(realm);
1902 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1903 }
1904 DEBUG(3,("cli_session_setup_spnego: guessed "
1905 "server principal=%s\n",
1906 principal ? principal : "<null>"));
1907
1908 SAFE_FREE(realm);
1909 }
1910
1911 if (principal) {
1912 rc = cli_session_setup_kerberos(cli, principal);
1913 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1914 TALLOC_FREE(principal);
1915 return rc;
1916 }
1917 }
1918 }
1919 #endif
1920
1921 TALLOC_FREE(principal);
1922
1923 ntlmssp:
1924
1925 account = talloc_strdup(talloc_tos(), user);
1926 if (!account) {
1927 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1928 }
1929
1930 /* when falling back to ntlmssp while authenticating with a machine
1931 * account strip off the realm - gd */
1932
1933 if ((p = strchr_m(user, '@')) != NULL) {
1934 account[PTR_DIFF(p,user)] = '\0';
1935 }
1936
1937 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1938 }
1939
1940 /****************************************************************************
1941 Send a session setup. The username and workgroup is in UNIX character
1942 format and must be converted to DOS codepage format before sending. If the
1943 password is in plaintext, the same should be done.
1944 ****************************************************************************/
1945
1946 NTSTATUS cli_session_setup(struct cli_state *cli,
1947 const char *user,
1948 const char *pass, int passlen,
1949 const char *ntpass, int ntpasslen,
1950 const char *workgroup)
1951 {
1952 char *p;
1953 char *user2;
1954 uint16_t sec_mode = cli_state_security_mode(cli);
1955
1956 if (user) {
1957 user2 = talloc_strdup(talloc_tos(), user);
1958 } else {
1959 user2 = talloc_strdup(talloc_tos(), "");
1960 }
1961 if (user2 == NULL) {
1962 return NT_STATUS_NO_MEMORY;
1963 }
1964
1965 if (!workgroup) {
1966 workgroup = "";
1967 }
1968
1969 /* allow for workgroups as part of the username */
1970 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1971 (p=strchr_m(user2,*lp_winbind_separator()))) {
1972 *p = 0;
1973 user = p+1;
1974 strupper_m(user2);
1975 workgroup = user2;
1976 }
1977
1978 if (cli_state_protocol(cli) < PROTOCOL_LANMAN1) {
1979 /*
1980 * Ensure cli->server_domain,
1981 * cli->server_os and cli->server_type
1982 * are valid pointers.
1983 */
1984 cli->server_domain = talloc_strdup(cli, "");
1985 cli->server_os = talloc_strdup(cli, "");
1986 cli->server_type = talloc_strdup(cli, "");
1987 if (cli->server_domain == NULL ||
1988 cli->server_os == NULL ||
1989 cli->server_type == NULL) {
1990 return NT_STATUS_NO_MEMORY;
1991 }
1992 return NT_STATUS_OK;
1993 }
1994
1995 /* now work out what sort of session setup we are going to
1996 do. I have split this into separate functions to make the
1997 flow a bit easier to understand (tridge) */
1998
1999 /* if its an older server then we have to use the older request format */
2000
2001 if (cli_state_protocol(cli) < PROTOCOL_NT1) {
2002 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
2003 DEBUG(1, ("Server requested LM password but 'client lanman auth = no'"
2004 " or 'client ntlmv2 auth = yes'\n"));
2005 return NT_STATUS_ACCESS_DENIED;
2006 }
2007
2008 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
2009 !lp_client_plaintext_auth() && (*pass)) {
2010 DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
2011 " or 'client ntlmv2 auth = yes'\n"));
2012 return NT_STATUS_ACCESS_DENIED;
2013 }
2014
2015 return cli_session_setup_lanman2(cli, user, pass, passlen,
2016 workgroup);
2017 }
2018
2019 /* if no user is supplied then we have to do an anonymous connection.
2020 passwords are ignored */
2021
2022 if (!user || !*user)
2023 return cli_session_setup_guest(cli);
2024
2025 /* if the server is share level then send a plaintext null
2026 password at this point. The password is sent in the tree
2027 connect */
2028
2029 if ((sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
2030 return cli_session_setup_plain(cli, user, "", workgroup);
2031
2032 /* if the server doesn't support encryption then we have to use
2033 plaintext. The second password is ignored */
2034
2035 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
2036 if (!lp_client_plaintext_auth() && (*pass)) {
2037 DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
2038 " or 'client ntlmv2 auth = yes'\n"));
2039 return NT_STATUS_ACCESS_DENIED;
2040 }
2041 return cli_session_setup_plain(cli, user, pass, workgroup);
2042 }
2043
2044 /* if the server supports extended security then use SPNEGO */
2045
2046 if (cli_state_capabilities(cli) & CAP_EXTENDED_SECURITY) {
2047 const char *remote_realm = cli_state_remote_realm(cli);
2048 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2049 workgroup,
2050 remote_realm);
2051 if (!ADS_ERR_OK(status)) {
2052 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
2053 return ads_ntstatus(status);
2054 }
2055 } else {
2056 NTSTATUS status;
2057
2058 /* otherwise do a NT1 style session setup */
2059 status = cli_session_setup_nt1(cli, user, pass, passlen,
2060 ntpass, ntpasslen, workgroup);
2061 if (!NT_STATUS_IS_OK(status)) {
2062 DEBUG(3,("cli_session_setup: NT1 session setup "
2063 "failed: %s\n", nt_errstr(status)));
2064 return status;
2065 }
2066 }
2067
2068 return NT_STATUS_OK;
2069 }
2070
2071 /****************************************************************************
2072 Send a uloggoff.
2073 *****************************************************************************/
2074
2075 struct cli_ulogoff_state {
2076 struct cli_state *cli;
2077 uint16_t vwv[3];
2078 };
2079
2080 static void cli_ulogoff_done(struct tevent_req *subreq);
2081
2082 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
2083 struct tevent_context *ev,
2084 struct cli_state *cli)
2085 {
2086 struct tevent_req *req, *subreq;
2087 struct cli_ulogoff_state *state;
2088
2089 req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
2090 if (req == NULL) {
2091 return NULL;
2092 }
2093 state->cli = cli;
2094
2095 SCVAL(state->vwv+0, 0, 0xFF);
2096 SCVAL(state->vwv+1, 0, 0);
2097 SSVAL(state->vwv+2, 0, 0);
2098
2099 subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
2100 0, NULL);
2101 if (tevent_req_nomem(subreq, req)) {
2102 return tevent_req_post(req, ev);
2103 }
2104 tevent_req_set_callback(subreq, cli_ulogoff_done, req);
2105 return req;
2106 }
2107
2108 static void cli_ulogoff_done(struct tevent_req *subreq)
2109 {
2110 struct tevent_req *req = tevent_req_callback_data(
2111 subreq, struct tevent_req);
2112 struct cli_ulogoff_state *state = tevent_req_data(
2113 req, struct cli_ulogoff_state);
2114 NTSTATUS status;
2115
2116 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2117 if (!NT_STATUS_IS_OK(status)) {
2118 tevent_req_nterror(req, status);
2119 return;
2120 }
2121 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
2122 tevent_req_done(req);
2123 }
2124
2125 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
2126 {
2127 return tevent_req_simple_recv_ntstatus(req);
2128 }
2129
2130 NTSTATUS cli_ulogoff(struct cli_state *cli)
2131 {
2132 struct tevent_context *ev;
2133 struct tevent_req *req;
2134 NTSTATUS status = NT_STATUS_NO_MEMORY;
2135
2136 if (cli_has_async_calls(cli)) {
2137 return NT_STATUS_INVALID_PARAMETER;
2138 }
2139 ev = tevent_context_init(talloc_tos());
2140 if (ev == NULL) {
2141 goto fail;
2142 }
2143 req = cli_ulogoff_send(ev, ev, cli);
2144 if (req == NULL) {
2145 goto fail;
2146 }
2147 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2148 goto fail;
2149 }
2150 status = cli_ulogoff_recv(req);
2151 fail:
2152 TALLOC_FREE(ev);
2153 return status;
2154 }
2155
2156 /****************************************************************************
2157 Send a tconX.
2158 ****************************************************************************/
2159
2160 struct cli_tcon_andx_state {
2161 struct cli_state *cli;
2162 uint16_t vwv[4];
2163 struct iovec bytes;
2164 };
2165
2166 static void cli_tcon_andx_done(struct tevent_req *subreq);
2167
2168 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
2169 struct event_context *ev,
2170 struct cli_state *cli,
2171 const char *share, const char *dev,
2172 const char *pass, int passlen,
2173 struct tevent_req **psmbreq)
2174 {
2175 struct tevent_req *req, *subreq;
2176 struct cli_tcon_andx_state *state;
2177 uint8_t p24[24];
2178 uint16_t *vwv;
2179 char *tmp = NULL;
2180 uint8_t *bytes;
2181 uint16_t sec_mode = cli_state_security_mode(cli);
2182
2183 *psmbreq = NULL;
2184
2185 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
2186 if (req == NULL) {
2187 return NULL;
2188 }
2189 state->cli = cli;
2190 vwv = state->vwv;
2191
2192 cli->share = talloc_strdup(cli, share);
2193 if (!cli->share) {
2194 return NULL;
2195 }
2196
2197 /* in user level security don't send a password now */
2198 if (sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
2199 passlen = 1;
2200 pass = "";
2201 } else if (pass == NULL) {
2202 DEBUG(1, ("Server not using user level security and no "
2203 "password supplied.\n"));
2204 goto access_denied;
2205 }
2206
2207 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
2208 *pass && passlen != 24) {
2209 if (!lp_client_lanman_auth()) {
2210 DEBUG(1, ("Server requested LANMAN password "
2211 "(share-level security) but "
2212 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2213 goto access_denied;
2214 }
2215
2216 /*
2217 * Non-encrypted passwords - convert to DOS codepage before
2218 * encryption.
2219 */
2220 SMBencrypt(pass, cli_state_server_challenge(cli), p24);
2221 passlen = 24;
2222 pass = (const char *)p24;
2223 } else {
2224 if((sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
2225 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
2226 == 0) {
2227 uint8_t *tmp_pass;
2228
2229 if (!lp_client_plaintext_auth() && (*pass)) {
2230 DEBUG(1, ("Server requested plaintext "
2231 "password but "
2232 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2233 goto access_denied;
2234 }
2235
2236 /*
2237 * Non-encrypted passwords - convert to DOS codepage
2238 * before using.
2239 */
2240 tmp_pass = talloc_array(talloc_tos(), uint8, 0);
2241 if (tevent_req_nomem(tmp_pass, req)) {
2242 return tevent_req_post(req, ev);
2243 }
2244 tmp_pass = trans2_bytes_push_str(tmp_pass,
2245 false, /* always DOS */
2246 pass,
2247 passlen,
2248 NULL);
2249 if (tevent_req_nomem(tmp_pass, req)) {
2250 return tevent_req_post(req, ev);
2251 }
2252 pass = (const char *)tmp_pass;
2253 passlen = talloc_get_size(tmp_pass);
2254 }
2255 }
2256
2257 SCVAL(vwv+0, 0, 0xFF);
2258 SCVAL(vwv+0, 1, 0);
2259 SSVAL(vwv+1, 0, 0);
2260 SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
2261 SSVAL(vwv+3, 0, passlen);
2262
2263 if (passlen && pass) {
2264 bytes = (uint8_t *)talloc_memdup(state, pass, passlen);
2265 } else {
2266 bytes = talloc_array(state, uint8_t, 0);
2267 }
2268
2269 /*
2270 * Add the sharename
2271 */
2272 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
2273 cli_state_remote_name(cli), share);
2274 if (tmp == NULL) {
2275 TALLOC_FREE(req);
2276 return NULL;
2277 }
2278 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
2279 NULL);
2280 TALLOC_FREE(tmp);
2281
2282 /*
2283 * Add the devicetype
2284 */
2285 tmp = talloc_strdup_upper(talloc_tos(), dev);
2286 if (tmp == NULL) {
2287 TALLOC_FREE(req);
2288 return NULL;
2289 }
2290 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
2291 TALLOC_FREE(tmp);
2292
2293 if (bytes == NULL) {
2294 TALLOC_FREE(req);
2295 return NULL;
2296 }
2297
2298 state->bytes.iov_base = (void *)bytes;
2299 state->bytes.iov_len = talloc_get_size(bytes);
2300
2301 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
2302 1, &state->bytes);
2303 if (subreq == NULL) {
2304 TALLOC_FREE(req);
2305 return NULL;
2306 }
2307 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
2308 *psmbreq = subreq;
2309 return req;
2310
2311 access_denied:
2312 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2313 return tevent_req_post(req, ev);
2314 }
2315
2316 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
2317 struct event_context *ev,
2318 struct cli_state *cli,
2319 const char *share, const char *dev,
2320 const char *pass, int passlen)
2321 {
2322 struct tevent_req *req, *subreq;
2323 NTSTATUS status;
2324
2325 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
2326 &subreq);
2327 if (req == NULL) {
2328 return NULL;
2329 }
2330 if (subreq == NULL) {
2331 return req;
2332 }
2333 status = cli_smb_req_send(subreq);
2334 if (!NT_STATUS_IS_OK(status)) {
2335 tevent_req_nterror(req, status);
2336 return tevent_req_post(req, ev);
2337 }
2338 return req;
2339 }
2340
2341 static void cli_tcon_andx_done(struct tevent_req *subreq)
2342 {
2343 struct tevent_req *req = tevent_req_callback_data(
2344 subreq, struct tevent_req);
2345 struct cli_tcon_andx_state *state = tevent_req_data(
2346 req, struct cli_tcon_andx_state);
2347 struct cli_state *cli = state->cli;
2348 uint8_t *in;
2349 char *inbuf;
2350 uint8_t wct;
2351 uint16_t *vwv;
2352 uint32_t num_bytes;
2353 uint8_t *bytes;
2354 NTSTATUS status;
2355
2356 status = cli_smb_recv(subreq, state, &in, 0, &wct, &vwv,
2357 &num_bytes, &bytes);
2358 TALLOC_FREE(subreq);
2359 if (!NT_STATUS_IS_OK(status)) {
2360 tevent_req_nterror(req, status);
2361 return;
2362 }
2363
2364 inbuf = (char *)in;
2365
2366 if (num_bytes) {
2367 if (clistr_pull_talloc(cli,
2368 inbuf,
2369 SVAL(inbuf, smb_flg2),
2370 &cli->dev,
2371 bytes,
2372 num_bytes,
2373 STR_TERMINATE|STR_ASCII) == -1) {
2374 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2375 return;
2376 }
2377 } else {
2378 cli->dev = talloc_strdup(cli, "");
2379 if (cli->dev == NULL) {
2380 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2381 return;
2382 }
2383 }
2384
2385 if ((cli_state_protocol(cli) >= PROTOCOL_NT1) && (num_bytes == 3)) {
2386 /* almost certainly win95 - enable bug fixes */
2387 cli->win95 = True;
2388 }
2389
2390 /*
2391 * Make sure that we have the optional support 16-bit field. WCT > 2.
2392 * Avoids issues when connecting to Win9x boxes sharing files
2393 */
2394
2395 cli->dfsroot = false;
2396
2397 if ((wct > 2) && (cli_state_protocol(cli) >= PROTOCOL_LANMAN2)) {
2398 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
2399 }
2400
2401 cli->smb1.tid = SVAL(inbuf,smb_tid);
2402 tevent_req_done(req);
2403 }
2404
2405 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
2406 {
2407 return tevent_req_simple_recv_ntstatus(req);
2408 }
2409
2410 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
2411 const char *dev, const char *pass, int passlen)
2412 {
2413 TALLOC_CTX *frame = talloc_stackframe();
2414 struct event_context *ev;
2415 struct tevent_req *req;
2416 NTSTATUS status = NT_STATUS_OK;
2417
2418 if (cli_has_async_calls(cli)) {
2419 /*
2420 * Can't use sync call while an async call is in flight
2421 */
2422 status = NT_STATUS_INVALID_PARAMETER;
2423 goto fail;
2424 }
2425
2426 ev = event_context_init(frame);
2427 if (ev == NULL) {
2428 status = NT_STATUS_NO_MEMORY;
2429 goto fail;
2430 }
2431
2432 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
2433 if (req == NULL) {
2434 status = NT_STATUS_NO_MEMORY;
2435 goto fail;
2436 }
2437
2438 if (!tevent_req_poll(req, ev)) {
2439 status = map_nt_error_from_unix(errno);
2440 goto fail;
2441 }
2442
2443 status = cli_tcon_andx_recv(req);
2444 fail:
2445 TALLOC_FREE(frame);
2446 return status;
2447 }
2448
2449 /****************************************************************************
2450 Send a tree disconnect.
2451 ****************************************************************************/
2452
2453 struct cli_tdis_state {
2454 struct cli_state *cli;
2455 };
2456
2457 static void cli_tdis_done(struct tevent_req *subreq);
2458
2459 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
2460 struct tevent_context *ev,
2461 struct cli_state *cli)
2462 {
2463 struct tevent_req *req, *subreq;
2464 struct cli_tdis_state *state;
2465
2466 req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
2467 if (req == NULL) {
2468 return NULL;
2469 }
2470 state->cli = cli;
2471
2472 subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
2473 if (tevent_req_nomem(subreq, req)) {
2474 return tevent_req_post(req, ev);
2475 }
2476 tevent_req_set_callback(subreq, cli_tdis_done, req);
2477 return req;
2478 }
2479
2480 static void cli_tdis_done(struct tevent_req *subreq)
2481 {
2482 struct tevent_req *req = tevent_req_callback_data(
2483 subreq, struct tevent_req);
2484 struct cli_tdis_state *state = tevent_req_data(
2485 req, struct cli_tdis_state);
2486 NTSTATUS status;
2487
2488 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2489 TALLOC_FREE(subreq);
2490 if (!NT_STATUS_IS_OK(status)) {
2491 tevent_req_nterror(req, status);
2492 return;
2493 }
2494 state->cli->smb1.tid = UINT16_MAX;
2495 tevent_req_done(req);
2496 }
2497
2498 NTSTATUS cli_tdis_recv(struct tevent_req *req)
2499 {
2500 return tevent_req_simple_recv_ntstatus(req);
2501 }
2502
2503 NTSTATUS cli_tdis(struct cli_state *cli)
2504 {
2505 struct tevent_context *ev;
2506 struct tevent_req *req;
2507 NTSTATUS status = NT_STATUS_NO_MEMORY;
2508
2509 if (cli_has_async_calls(cli)) {
2510 return NT_STATUS_INVALID_PARAMETER;
2511 }
2512 ev = tevent_context_init(talloc_tos());
2513 if (ev == NULL) {
2514 goto fail;
2515 }
2516 req = cli_tdis_send(ev, ev, cli);
2517 if (req == NULL) {
2518 goto fail;
2519 }
2520 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2521 goto fail;
2522 }
2523 status = cli_tdis_recv(req);
2524 fail:
2525 TALLOC_FREE(ev);
2526 return status;
2527 }
2528
2529 /****************************************************************************
2530 Send a negprot command.
2531 ****************************************************************************/
2532
2533 struct cli_negprot_state {
2534 struct cli_state *cli;
2535 enum protocol_types max_protocol;
2536 };
2537
2538 static void cli_negprot_done(struct tevent_req *subreq);
2539
2540 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
2541 struct event_context *ev,
2542 struct cli_state *cli,
2543 enum protocol_types max_protocol)
2544 {
2545 struct tevent_req *req, *subreq;
2546 struct cli_negprot_state *state;
2547 uint8_t *bytes = NULL;
2548 int numprots;
2549 enum protocol_types tmp_protocol;
2550
2551 req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
2552 if (req == NULL) {
2553 return NULL;
2554 }
2555 state->cli = cli;
2556 state->max_protocol = max_protocol;
2557
2558 /* setup the protocol strings */
2559 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
2560 uint8_t c = 2;
2561 if (prots[numprots].prot > state->max_protocol) {
2562 break;
2563 }
2564 bytes = (uint8_t *)talloc_append_blob(
2565 state, bytes, data_blob_const(&c, sizeof(c)));
2566 if (tevent_req_nomem(bytes, req)) {
2567 return tevent_req_post(req, ev);
2568 }
2569 bytes = smb_bytes_push_str(bytes, false,
2570 prots[numprots].name,
2571 strlen(prots[numprots].name)+1,
2572 NULL);
2573 if (tevent_req_nomem(bytes, req)) {
2574 return tevent_req_post(req, ev);
2575 }
2576 }
2577
2578 tmp_protocol = cli->conn.protocol;
2579 cli->conn.protocol = state->max_protocol;
2580 subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
2581 talloc_get_size(bytes), bytes);
2582 cli->conn.protocol = tmp_protocol;
2583 if (tevent_req_nomem(subreq, req)) {
2584 return tevent_req_post(req, ev);
2585 }
2586 tevent_req_set_callback(subreq, cli_negprot_done, req);
2587 return req;
2588 }
2589
2590 static void cli_negprot_done(struct tevent_req *subreq)
2591 {
2592 struct tevent_req *req = tevent_req_callback_data(
2593 subreq, struct tevent_req);
2594 struct cli_negprot_state *state = tevent_req_data(
2595 req, struct cli_negprot_state);
2596 struct cli_state *cli = state->cli;
2597 uint8_t flags;
2598 uint8_t wct;
2599 uint16_t *vwv;
2600 uint32_t num_bytes;
2601 uint8_t *bytes;
2602 NTSTATUS status;
2603 uint16_t protnum;
2604 uint8_t *inbuf;
2605 uint32_t client_capabilities = cli->conn.smb1.client.capabilities;
2606 uint32_t both_capabilities;
2607 uint32_t server_capabilities = 0;
2608 uint32_t capabilities;
2609 uint32_t client_max_xmit = cli->conn.smb1.client.max_xmit;
2610 uint32_t server_max_xmit = 0;
2611 uint32_t max_xmit;
2612 uint32_t server_max_mux = 0;
2613 uint16_t server_security_mode = 0;
2614 uint32_t server_session_key = 0;
2615 bool server_readbraw = false;
2616 bool server_writebraw = false;
2617 bool server_lockread = false;
2618 bool server_writeunlock = false;
2619 struct GUID server_guid = GUID_zero();
2620 DATA_BLOB server_gss_blob = data_blob_null;
2621 uint8_t server_challenge[8];
2622 char *server_workgroup = NULL;
2623 char *server_name = NULL;
2624 int server_time_zone = 0;
2625 time_t server_system_time = 0;
2626 enum protocol_types protocol;
2627
2628 ZERO_STRUCT(server_challenge);
2629
2630 status = cli_smb_recv(subreq, state, &inbuf, 1, &wct, &vwv,
2631 &num_bytes, &bytes);
2632 TALLOC_FREE(subreq);
2633 if (!NT_STATUS_IS_OK(status)) {
2634 tevent_req_nterror(req, status);
2635 return;
2636 }
2637
2638 flags = CVAL(inbuf, smb_flg);
2639
2640 protnum = SVAL(vwv, 0);
2641
2642 if ((protnum >= ARRAY_SIZE(prots))
2643 || (prots[protnum].prot > state->max_protocol)) {
2644 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2645 return;
2646 }
2647
2648 protocol = prots[protnum].prot;
2649
2650 if ((protocol < PROTOCOL_NT1) &&
2651 client_is_signing_mandatory(cli)) {
2652 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
2653 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2654 return;
2655 }
2656
2657 if (flags & FLAG_SUPPORT_LOCKREAD) {
2658 server_lockread = true;
2659 server_writeunlock = true;
2660 }
2661
2662 if (protocol >= PROTOCOL_NT1) {
2663 struct timespec ts;
2664 const char *client_signing = NULL;
2665 bool server_mandatory;
2666 bool server_allowed;
2667 const char *server_signing = NULL;
2668 bool ok;
2669 uint16_t key_len;
2670
2671 if (wct != 0x11) {
2672 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2673 return;
2674 }
2675
2676 /* NT protocol */
2677 server_security_mode = CVAL(vwv + 1, 0);
2678 server_max_mux = SVAL(vwv + 1, 1);
2679 server_max_xmit = IVAL(vwv + 3, 1);
2680 server_session_key = IVAL(vwv + 7, 1);
2681 server_time_zone = SVALS(vwv + 15, 1);
2682 server_time_zone *= 60;
2683 /* this time arrives in real GMT */
2684 ts = interpret_long_date(((char *)(vwv+11))+1);
2685 server_system_time = ts.tv_sec;
2686 server_capabilities = IVAL(vwv + 9, 1);
2687
2688 key_len = CVAL(vwv + 16, 1);
2689
2690 if (server_capabilities & CAP_RAW_MODE) {
2691 server_readbraw = true;
2692 server_writebraw = true;
2693 }
2694 if (server_capabilities & CAP_LOCK_AND_READ) {
2695 server_lockread = true;
2696 }
2697
2698 if (server_capabilities & CAP_EXTENDED_SECURITY) {
2699 DATA_BLOB blob1, blob2;
2700
2701 if (num_bytes < 16) {
2702 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2703 return;
2704 }
2705
2706 blob1 = data_blob_const(bytes, 16);
2707 GUID_from_data_blob(&blob1, &server_guid);
2708
2709 blob1 = data_blob_const(bytes+16, num_bytes-16);
2710 blob2 = data_blob_dup_talloc(state, blob1);
2711 if (blob1.length > 0 &&
2712 tevent_req_nomem(blob2.data, req)) {
2713 return;
2714 }
2715 server_gss_blob = blob2;
2716 } else {
2717 DATA_BLOB blob1, blob2;
2718 ssize_t ret = 0;
2719
2720 if (num_bytes < key_len) {
2721 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2722 return;
2723 }
2724
2725 if (key_len != 0 && key_len != 8) {
2726 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2727 return;
2728 }
2729
2730 if (key_len == 8) {
2731 memcpy(server_challenge, bytes, 8);
2732 }
2733
2734 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
2735 blob2 = data_blob_const(bytes+key_len, num_bytes-key_len);
2736 if (blob1.length > 0) {
2737 ret = pull_string_talloc(state,
2738 (char *)inbuf,
2739 SVAL(inbuf, smb_flg2),
2740 &server_workgroup,
2741 blob1.data,
2742 blob1.length,
2743 STR_TERMINATE|
2744 STR_UNICODE|
2745 STR_NOALIGN);
2746 if (ret == -1) {
2747 tevent_req_oom(req);
2748 return;
2749 }
2750 }
2751
2752 blob2.data += ret;
2753 blob2.length -= ret;
2754 if (blob2.length > 0) {
2755 ret = pull_string_talloc(state,
2756 (char *)inbuf,
2757 SVAL(inbuf, smb_flg2),
2758 &server_name,
2759 blob2.data,
2760 blob2.length,
2761 STR_TERMINATE|
2762 STR_UNICODE|
2763 STR_NOALIGN);
2764 if (ret == -1) {
2765 tevent_req_oom(req);
2766 return;
2767 }
2768 }
2769 }
2770
2771 client_signing = "disabled";
2772 if (client_is_signing_allowed(cli)) {
2773 client_signing = "allowed";
2774 }
2775 if (client_is_signing_mandatory(cli)) {
2776 client_signing = "required";
2777 }
2778
2779 server_signing = "not supported";
2780
2781 server_allowed = false;
2782 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
2783 server_signing = "supported";
2784 server_allowed = true;
2785 }
2786
2787 server_mandatory = false;
2788 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
2789 server_signing = "required";
2790 server_mandatory = true;
2791 }
2792
2793 ok = cli_set_signing_negotiated(cli,
2794 server_allowed,
2795 server_mandatory);
2796 if (!ok) {
2797 DEBUG(1,("cli_negprot: SMB signing is required, "
2798 "but client[%s] and server[%s] mismatch\n",
2799 client_signing, server_signing));
2800 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2801 return;
2802 }
2803
2804 } else if (protocol >= PROTOCOL_LANMAN1) {
2805 if (wct != 0x0D) {
2806 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2807 return;
2808 }
2809
2810 server_security_mode = SVAL(vwv + 1, 0);
2811 server_max_xmit = SVAL(vwv + 2, 0);
2812 server_max_mux = SVAL(vwv + 3, 0);
2813 server_session_key = IVAL(vwv + 6, 0);
2814 server_time_zone = SVALS(vwv + 10, 0);
2815 server_time_zone *= 60;
2816 /* this time is converted to GMT by make_unix_date */
2817 server_system_time = make_unix_date(
2818 (char *)(vwv + 8), server_time_zone);
2819 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
2820 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
2821
2822 if (num_bytes != 0 && num_bytes != 8) {
2823 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2824 return;
2825 }
2826
2827 if (num_bytes == 8) {
2828 memcpy(server_challenge, bytes, 8);
2829 }
2830 } else {
2831 /* the old core protocol */
2832 server_time_zone = get_time_zone(time(NULL));
2833 server_system_time = 0;
2834 server_max_xmit = 1024;
2835 server_max_mux = 1;
2836 server_security_mode = 0;
2837 }
2838
2839 if (server_max_xmit < 1024) {
2840 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2841 return;
2842 }
2843
2844 if (server_max_mux < 1) {
2845 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2846 return;
2847 }
2848
2849 /*
2850 * Now calculate the negotiated capabilities
2851 * based on the mask for:
2852 * - client only flags
2853 * - flags used in both directions
2854 * - server only flags
2855 */
2856 both_capabilities = client_capabilities & server_capabilities;
2857 capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
2858 capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
2859 capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
2860
2861 max_xmit = MIN(client_max_xmit, server_max_xmit);
2862
2863 if (server_workgroup) {
2864 cli->server_domain = talloc_strdup(cli, server_workgroup);
2865 if (tevent_req_nomem(cli->server_domain, req)) {
2866 return;
2867 }
2868 }
2869
2870 cli->conn.protocol = protocol;
2871
2872 cli->conn.smb1.server.capabilities = server_capabilities;
2873 cli->conn.smb1.capabilities = capabilities;
2874
2875 cli->conn.smb1.server.max_xmit = server_max_xmit;
2876 cli->conn.smb1.max_xmit = max_xmit;
2877
2878 cli->conn.smb1.server.max_mux = server_max_mux;
2879
2880 cli->conn.smb1.server.security_mode = server_security_mode;
2881
2882 cli->conn.smb1.server.readbraw = server_readbraw;
2883 cli->conn.smb1.server.writebraw = server_writebraw;
2884 cli->conn.smb1.server.lockread = server_lockread;
2885 cli->conn.smb1.server.writeunlock = server_writeunlock;
2886
2887 cli->conn.smb1.server.session_key = server_session_key;
2888
2889 talloc_steal(cli, server_gss_blob.data);
2890 cli->conn.smb1.server.gss_blob = server_gss_blob;
2891 cli->conn.smb1.server.guid = server_guid;
2892 memcpy(cli->conn.smb1.server.challenge, server_challenge, 8);
2893 cli->conn.smb1.server.workgroup = talloc_move(cli, &server_workgroup);
2894 cli->conn.smb1.server.name = talloc_move(cli, &server_name);
2895
2896 cli->conn.smb1.server.time_zone = server_time_zone;
2897 cli->conn.smb1.server.system_time = server_system_time;
2898
2899 tevent_req_done(req);
2900 }
2901
2902 NTSTATUS cli_negprot_recv(struct tevent_req *req)
2903 {
2904 return tevent_req_simple_recv_ntstatus(req);
2905 }
2906
2907 NTSTATUS cli_negprot(struct cli_state *cli, enum protocol_types max_protocol)
2908 {
2909 TALLOC_CTX *frame = talloc_stackframe();
2910 struct event_context *ev;
2911 struct tevent_req *req;
2912 NTSTATUS status = NT_STATUS_OK;
2913
2914 if (cli_has_async_calls(cli)) {
2915 /*
2916 * Can't use sync call while an async call is in flight
2917 */
2918 status = NT_STATUS_INVALID_PARAMETER;
2919 goto fail;
2920 }
2921
2922 ev = event_context_init(frame);
2923 if (ev == NULL) {
2924 status = NT_STATUS_NO_MEMORY;
2925 goto fail;
2926 }
2927
2928 req = cli_negprot_send(frame, ev, cli, max_protocol);
2929 if (req == NULL) {
2930 status = NT_STATUS_NO_MEMORY;
2931 goto fail;
2932 }
2933
2934 if (!tevent_req_poll(req, ev)) {
2935 status = map_nt_error_from_unix(errno);
2936 goto fail;
2937 }
2938
2939 status = cli_negprot_recv(req);
2940 fail:
2941 TALLOC_FREE(frame);
2942 return status;
2943 }
2944
2945 static NTSTATUS cli_connect_sock(const char *host, int name_type,
2946 const struct sockaddr_storage *pss,
2947 const char *myname, uint16_t port,
2948 int sec_timeout, int *pfd, uint16_t *pport)
2949 {
2950 TALLOC_CTX *frame = talloc_stackframe();
2951 const char *prog;
2952 unsigned int i, num_addrs;
2953 const char **called_names;
2954 const char **calling_names;
2955 int *called_types;
2956 NTSTATUS status;
2957 int fd;
2958
2959 prog = getenv("LIBSMB_PROG");
2960 if (prog != NULL) {
2961 fd = sock_exec(prog);
2962 if (fd == -1) {
2963 return map_nt_error_from_unix(errno);
2964 }
2965 port = 0;
2966 goto done;
2967 }
2968
2969 if ((pss == NULL) || is_zero_addr(pss)) {
2970 struct sockaddr_storage *addrs;
2971 status = resolve_name_list(talloc_tos(), host, name_type,
2972 &addrs, &num_addrs);
2973 if (!NT_STATUS_IS_OK(status)) {
2974 goto fail;
2975 }
2976 pss = addrs;
2977 } else {
2978 num_addrs = 1;
2979 }
2980
2981 called_names = talloc_array(talloc_tos(), const char *, num_addrs);
2982 if (called_names == NULL) {
2983 status = NT_STATUS_NO_MEMORY;
2984 goto fail;
2985 }
2986 called_types = talloc_array(talloc_tos(), int, num_addrs);
2987 if (called_types == NULL) {
2988 status = NT_STATUS_NO_MEMORY;
2989 goto fail;
2990 }
2991 calling_names = talloc_array(talloc_tos(), const char *, num_addrs);
2992 if (calling_names == NULL) {
2993 status = NT_STATUS_NO_MEMORY;
2994 goto fail;
2995 }
2996 for (i=0; i<num_addrs; i++) {
2997 called_names[i] = host;
2998 called_types[i] = name_type;
2999 calling_names[i] = myname;
3000 }
3001 status = smbsock_any_connect(pss, called_names, called_types,
3002 calling_names, NULL, num_addrs, port,
3003 sec_timeout, &fd, NULL, &port);
3004 if (!NT_STATUS_IS_OK(status)) {
3005 goto fail;
3006 }
3007 set_socket_options(fd, lp_socket_options());
3008 done:
3009 *pfd = fd;
3010 *pport = port;
3011 status = NT_STATUS_OK;
3012 fail:
3013 TALLOC_FREE(frame);
3014 return status;
3015 }
3016
3017 NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss,
3018 uint16_t port, int name_type, const char *myname,
3019 int signing_state, int flags, struct cli_state **pcli)
3020 {
3021 TALLOC_CTX *frame = talloc_stackframe();
3022 struct cli_state *cli;
3023 NTSTATUS status = NT_STATUS_NO_MEMORY;
3024 int fd = -1;
3025 char *desthost;
3026 char *p;
3027
3028 desthost = talloc_strdup(talloc_tos(), host);
3029 if (desthost == NULL) {
3030 goto fail;
3031 }
3032
3033 p = strchr(host, '#');
3034 if (p != NULL) {
3035 name_type = strtol(p+1, NULL, 16);
3036 host = talloc_strndup(talloc_tos(), host, p - host);
3037 if (host == NULL) {
3038 goto fail;
3039 }
3040 }
3041
3042 status = cli_connect_sock(host, name_type, dest_ss, myname, port,
3043 20, &fd, &port);
3044 if (!NT_STATUS_IS_OK(status)) {
3045 goto fail;
3046 }
3047
3048 cli = cli_state_create(NULL, fd, desthost, NULL, signing_state, flags);
3049 if (cli == NULL) {
3050 goto fail;
3051 }
3052
3053 *pcli = cli;
3054 status = NT_STATUS_OK;
3055 fail:
3056 TALLOC_FREE(frame);
3057 return status;
3058 }
3059
3060 /**
3061 establishes a connection to after the negprot.
3062 @param output_cli A fully initialised cli structure, non-null only on success
3063 @param dest_host The netbios name of the remote host
3064 @param dest_ss (optional) The the destination IP, NULL for name based lookup
3065 @param port (optional) The destination port (0 for default)
3066 */
3067 NTSTATUS cli_start_connection(struct cli_state **output_cli,
3068 const char *my_name,
3069 const char *dest_host,
3070 const struct sockaddr_storage *dest_ss, int port,
3071 int signing_state, int flags)
3072 {
3073 NTSTATUS nt_status;
3074 struct cli_state *cli;
3075
3076 nt_status = cli_connect_nb(dest_host, dest_ss, port, 0x20, my_name,
3077 signing_state, flags, &cli);
3078 if (!NT_STATUS_IS_OK(nt_status)) {
3079 DEBUG(10, ("cli_connect_nb failed: %s\n",
3080 nt_errstr(nt_status)));
3081 return nt_status;
3082 }
3083
3084 nt_status = cli_negprot(cli, PROTOCOL_NT1);
3085 if (!NT_STATUS_IS_OK(nt_status)) {
3086 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
3087 cli_shutdown(cli);
3088 return nt_status;
3089 }
3090
3091 *output_cli = cli;
3092 return NT_STATUS_OK;
3093 }
3094
3095
3096 /**
3097 establishes a connection right up to doing tconX, password specified.
3098 @param output_cli A fully initialised cli structure, non-null only on success
3099 @param dest_host The netbios name of the remote host
3100 @param dest_ip (optional) The the destination IP, NULL for name based lookup
3101 @param port (optional) The destination port (0 for default)
3102 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
3103 @param service_type The 'type' of serivice.
3104 @param user Username, unix string
3105 @param domain User's domain
3106 @param password User's password, unencrypted unix string.
3107 */
3108
3109 NTSTATUS cli_full_connection(struct cli_state **output_cli,
3110 const char *my_name,
3111 const char *dest_host,
3112 const struct sockaddr_storage *dest_ss, int port,
3113 const char *service, const char *service_type,
3114 const char *user, const char *domain,
3115 const char *password, int flags,
3116 int signing_state)
3117 {
3118 NTSTATUS nt_status;
3119 struct cli_state *cli = NULL;
3120 int pw_len = password ? strlen(password)+1 : 0;
3121
3122 *output_cli = NULL;
3123
3124 if (password == NULL) {
3125 password = "";
3126 }
3127
3128 nt_status = cli_start_connection(&cli, my_name, dest_host,
3129 dest_ss, port, signing_state,
3130 flags);
3131
3132 if (!NT_STATUS_IS_OK(nt_status)) {
3133 return nt_status;
3134 }
3135
3136 nt_status = cli_session_setup(cli, user, password, pw_len, password,
3137 pw_len, domain);
3138 if (!NT_STATUS_IS_OK(nt_status)) {
3139
3140 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
3141 DEBUG(1,("failed session setup with %s\n",
3142 nt_errstr(nt_status)));
3143 cli_shutdown(cli);
3144 return nt_status;
3145 }
3146
3147 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
3148 if (!NT_STATUS_IS_OK(nt_status)) {
3149 DEBUG(1,("anonymous failed session setup with %s\n",
3150 nt_errstr(nt_status)));
3151 cli_shutdown(cli);
3152 return nt_status;
3153 }
3154 }
3155
3156 if (service) {
3157 nt_status = cli_tcon_andx(cli, service, service_type, password,
3158 pw_len);
3159 if (!NT_STATUS_IS_OK(nt_status)) {
3160 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
3161 cli_shutdown(cli);
3162 if (NT_STATUS_IS_OK(nt_status)) {
3163 nt_status = NT_STATUS_UNSUCCESSFUL;
3164 }
3165 return nt_status;
3166 }
3167 }
3168
3169 nt_status = cli_init_creds(cli, user, domain, password);
3170 if (!NT_STATUS_IS_OK(nt_status)) {
3171 cli_shutdown(cli);
3172 return nt_status;
3173 }
3174
3175 *output_cli = cli;
3176 return NT_STATUS_OK;
3177 }
3178
3179 /****************************************************************************
3180 Send an old style tcon.
3181 ****************************************************************************/
3182 NTSTATUS cli_raw_tcon(struct cli_state *cli,
3183 const char *service, const char *pass, const char *dev,
3184 uint16 *max_xmit, uint16 *tid)
3185 {
3186 struct tevent_req *req;
3187 uint16_t *ret_vwv;
3188 uint8_t *bytes;
3189 NTSTATUS status;
3190
3191 if (!lp_client_plaintext_auth() && (*pass)) {
3192 DEBUG(1, ("Server requested plaintext password but 'client "
3193 "plaintext auth' is disabled\n"));
3194 return NT_STATUS_ACCESS_DENIED;
3195 }
3196
3197 bytes = talloc_array(talloc_tos(), uint8_t, 0);
3198 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
3199 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
3200 service, strlen(service)+1, NULL);
3201 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
3202 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
3203 pass, strlen(pass)+1, NULL);
3204 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
3205 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
3206 dev, strlen(dev)+1, NULL);
3207
3208 status = cli_smb(talloc_tos(), cli, SMBtcon, 0, 0, NULL,
3209 talloc_get_size(bytes), bytes, &req,
3210 2, NULL, &ret_vwv, NULL, NULL);
3211 if (!NT_STATUS_IS_OK(status)) {
3212 return status;
3213 }
3214
3215 *max_xmit = SVAL(ret_vwv + 0, 0);
3216 *tid = SVAL(ret_vwv + 1, 0);
3217
3218 return NT_STATUS_OK;
3219 }
3220
3221 /* Return a cli_state pointing at the IPC$ share for the given server */
3222
3223 struct cli_state *get_ipc_connect(char *server,
3224 struct sockaddr_storage *server_ss,
3225 const struct user_auth_info *user_info)
3226 {
3227 struct cli_state *cli;
3228 NTSTATUS nt_status;
3229 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
3230
3231 if (user_info->use_kerberos) {
3232 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
3233 }
3234
3235 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
3236 user_info->username ? user_info->username : "",
3237 lp_workgroup(),
3238 user_info->password ? user_info->password : "",
3239 flags,
3240 SMB_SIGNING_DEFAULT);
3241
3242 if (NT_STATUS_IS_OK(nt_status)) {
3243 return cli;
3244 } else if (is_ipaddress(server)) {
3245 /* windows 9* needs a correct NMB name for connections */
3246 fstring remote_name;
3247
3248 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
3249 cli = get_ipc_connect(remote_name, server_ss, user_info);
3250 if (cli)
3251 return cli;
3252 }
3253 }
3254 return NULL;
3255 }
3256
3257 /*
3258 * Given the IP address of a master browser on the network, return its
3259 * workgroup and connect to it.
3260 *
3261 * This function is provided to allow additional processing beyond what
3262 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
3263 * browsers and obtain each master browsers' list of domains (in case the
3264 * first master browser is recently on the network and has not yet
3265 * synchronized with other master browsers and therefore does not yet have the
3266 * entire network browse list)
3267 */
3268
3269 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
3270 struct sockaddr_storage *mb_ip,
3271 const struct user_auth_info *user_info,
3272 char **pp_workgroup_out)
3273 {
3274 char addr[INET6_ADDRSTRLEN];
3275 fstring name;
3276 struct cli_state *cli;
3277 struct sockaddr_storage server_ss;
3278
3279 *pp_workgroup_out = NULL;
3280
3281 print_sockaddr(addr, sizeof(addr), mb_ip);
3282 DEBUG(99, ("Looking up name of master browser %s\n",
3283 addr));
3284
3285 /*
3286 * Do a name status query to find out the name of the master browser.
3287 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
3288 * master browser will not respond to a wildcard query (or, at least,
3289 * an NT4 server acting as the domain master browser will not).
3290 *
3291 * We might be able to use ONLY the query on MSBROWSE, but that's not
3292 * yet been tested with all Windows versions, so until it is, leave
3293 * the original wildcard query as the first choice and fall back to
3294 * MSBROWSE if the wildcard query fails.
3295 */
3296 if (!name_status_find("*", 0, 0x1d, mb_ip, name) &&
3297 !name_status_find(MSBROWSE, 1, 0x1d, mb_ip, name)) {
3298
3299 DEBUG(99, ("Could not retrieve name status for %s\n",
3300 addr));
3301 return NULL;
3302 }
3303
3304 if (!find_master_ip(name, &server_ss)) {
3305 DEBUG(99, ("Could not find master ip for %s\n", name));
3306 return NULL;
3307 }
3308
3309 *pp_workgroup_out = talloc_strdup(ctx, name);
3310
3311 DEBUG(4, ("found master browser %s, %s\n", name, addr));
3312
3313 print_sockaddr(addr, sizeof(addr), &server_ss);
3314 cli = get_ipc_connect(addr, &server_ss, user_info);
3315
3316 return cli;
3317 }
3318
3319 /*
3320 * Return the IP address and workgroup of a master browser on the network, and
3321 * connect to it.
3322 */
3323
3324 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
3325 const struct user_auth_info *user_info,
3326 char **pp_workgroup_out)
3327 {
3328 struct sockaddr_storage *ip_list;
3329 struct cli_state *cli;
3330 int i, count;
3331 NTSTATUS status;
3332
3333 *pp_workgroup_out = NULL;
3334
3335 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
3336
3337 /* Go looking for workgroups by broadcasting on the local network */
3338
3339 status = name_resolve_bcast(MSBROWSE, 1, talloc_tos(),
3340 &ip_list, &count);
3341 if (!NT_STATUS_IS_OK(status)) {
3342 DEBUG(99, ("No master browsers responded: %s\n",
3343 nt_errstr(status)));
3344 return False;
3345 }
3346
3347 for (i = 0; i < count; i++) {
3348 char addr[INET6_ADDRSTRLEN];
3349 print_sockaddr(addr, sizeof(addr), &ip_list[i]);
3350 DEBUG(99, ("Found master browser %s\n", addr));
3351
3352 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
3353 user_info, pp_workgroup_out);
3354 if (cli)
3355 return(cli);
3356 }
3357
3358 return NULL;
3359 }
reg import