?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:libsmb: add a tcon_flags helper variable
[Samba/gebeck_regimport.git] / source3 / libsmb / cliconnect.c
blob2b3252943657fd510df1c74f8cb199df54a72262
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6 Copyright (C) Volker Lendecke 2011
7 Copyright (C) Jeremy Allison 2011
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "libsmb/libsmb.h"
25 #include "auth_info.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../libcli/auth/spnego.h"
28 #include "smb_krb5.h"
29 #include "../auth/ntlmssp/ntlmssp.h"
30 #include "libads/kerberos_proto.h"
31 #include "krb5_env.h"
32 #include "../lib/util/tevent_ntstatus.h"
33 #include "async_smb.h"
34 #include "libsmb/nmblib.h"
35 #include "librpc/ndr/libndr.h"
36 #include "../libcli/smb/smbXcli_base.h"
37 #include "smb2cli.h"
38
39 #define STAR_SMBSERVER "*SMBSERVER"
40
41 /********************************************************
42 Utility function to ensure we always return at least
43 a valid char * pointer to an empty string for the
44 cli->server_os, cli->server_type and cli->server_domain
45 strings.
46 *******************************************************/
47
48 static NTSTATUS smb_bytes_talloc_string(TALLOC_CTX *mem_ctx,
49 const uint8_t *hdr,
50 char **dest,
51 uint8_t *src,
52 size_t srclen,
53 ssize_t *destlen)
54 {
55 *destlen = clistr_pull_talloc(mem_ctx,
56 (const char *)hdr,
57 SVAL(hdr, HDR_FLG2),
58 dest,
59 (char *)src,
60 srclen,
61 STR_TERMINATE);
62 if (*destlen == -1) {
63 return NT_STATUS_NO_MEMORY;
64 }
65
66 if (*dest == NULL) {
67 *dest = talloc_strdup(mem_ctx, "");
68 if (*dest == NULL) {
69 return NT_STATUS_NO_MEMORY;
70 }
71 }
72 return NT_STATUS_OK;
73 }
74
75 /****************************************************************************
76 Do an old lanman2 style session setup.
77 ****************************************************************************/
78
79 struct cli_session_setup_lanman2_state {
80 struct cli_state *cli;
81 uint16_t vwv[10];
82 const char *user;
83 };
84
85 static void cli_session_setup_lanman2_done(struct tevent_req *subreq);
86
87 static struct tevent_req *cli_session_setup_lanman2_send(
88 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
89 struct cli_state *cli, const char *user,
90 const char *pass, size_t passlen,
91 const char *workgroup)
92 {
93 struct tevent_req *req, *subreq;
94 struct cli_session_setup_lanman2_state *state;
95 DATA_BLOB lm_response = data_blob_null;
96 uint16_t *vwv;
97 uint8_t *bytes;
98 char *tmp;
99 uint16_t sec_mode = smb1cli_conn_server_security_mode(cli->conn);
100
101 req = tevent_req_create(mem_ctx, &state,
102 struct cli_session_setup_lanman2_state);
103 if (req == NULL) {
104 return NULL;
105 }
106 state->cli = cli;
107 state->user = user;
108 vwv = state->vwv;
109
110 /*
111 * if in share level security then don't send a password now
112 */
113 if (!(sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
114 passlen = 0;
115 }
116
117 if (passlen > 0
118 && (sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
119 && passlen != 24) {
120 /*
121 * Encrypted mode needed, and non encrypted password
122 * supplied.
123 */
124 lm_response = data_blob(NULL, 24);
125 if (tevent_req_nomem(lm_response.data, req)) {
126 return tevent_req_post(req, ev);
127 }
128
129 if (!SMBencrypt(pass, smb1cli_conn_server_challenge(cli->conn),
130 (uint8_t *)lm_response.data)) {
131 DEBUG(1, ("Password is > 14 chars in length, and is "
132 "therefore incompatible with Lanman "
133 "authentication\n"));
134 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
135 return tevent_req_post(req, ev);
136 }
137 } else if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
138 && passlen == 24) {
139 /*
140 * Encrypted mode needed, and encrypted password
141 * supplied.
142 */
143 lm_response = data_blob(pass, passlen);
144 if (tevent_req_nomem(lm_response.data, req)) {
145 return tevent_req_post(req, ev);
146 }
147 } else if (passlen > 0) {
148 uint8_t *buf;
149 size_t converted_size;
150 /*
151 * Plaintext mode needed, assume plaintext supplied.
152 */
153 buf = talloc_array(talloc_tos(), uint8_t, 0);
154 buf = smb_bytes_push_str(buf, smbXcli_conn_use_unicode(cli->conn), pass, passlen+1,
155 &converted_size);
156 if (tevent_req_nomem(buf, req)) {
157 return tevent_req_post(req, ev);
158 }
159 lm_response = data_blob(pass, passlen);
160 TALLOC_FREE(buf);
161 if (tevent_req_nomem(lm_response.data, req)) {
162 return tevent_req_post(req, ev);
163 }
164 }
165
166 SCVAL(vwv+0, 0, 0xff);
167 SCVAL(vwv+0, 1, 0);
168 SSVAL(vwv+1, 0, 0);
169 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
170 SSVAL(vwv+3, 0, 2);
171 SSVAL(vwv+4, 0, 1);
172 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
173 SSVAL(vwv+7, 0, lm_response.length);
174
175 bytes = talloc_array(state, uint8_t, lm_response.length);
176 if (tevent_req_nomem(bytes, req)) {
177 return tevent_req_post(req, ev);
178 }
179 if (lm_response.length != 0) {
180 memcpy(bytes, lm_response.data, lm_response.length);
181 }
182 data_blob_free(&lm_response);
183
184 tmp = talloc_strdup_upper(talloc_tos(), user);
185 if (tevent_req_nomem(tmp, req)) {
186 return tevent_req_post(req, ev);
187 }
188 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), tmp, strlen(tmp)+1,
189 NULL);
190 TALLOC_FREE(tmp);
191
192 tmp = talloc_strdup_upper(talloc_tos(), workgroup);
193 if (tevent_req_nomem(tmp, req)) {
194 return tevent_req_post(req, ev);
195 }
196 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), tmp, strlen(tmp)+1,
197 NULL);
198 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Unix", 5, NULL);
199 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Samba", 6, NULL);
200
201 if (tevent_req_nomem(bytes, req)) {
202 return tevent_req_post(req, ev);
203 }
204
205 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 10, vwv,
206 talloc_get_size(bytes), bytes);
207 if (tevent_req_nomem(subreq, req)) {
208 return tevent_req_post(req, ev);
209 }
210 tevent_req_set_callback(subreq, cli_session_setup_lanman2_done, req);
211 return req;
212 }
213
214 static void cli_session_setup_lanman2_done(struct tevent_req *subreq)
215 {
216 struct tevent_req *req = tevent_req_callback_data(
217 subreq, struct tevent_req);
218 struct cli_session_setup_lanman2_state *state = tevent_req_data(
219 req, struct cli_session_setup_lanman2_state);
220 struct cli_state *cli = state->cli;
221 uint32_t num_bytes;
222 uint8_t *in;
223 uint8_t *inhdr;
224 uint8_t *bytes;
225 uint8_t *p;
226 NTSTATUS status;
227 ssize_t ret;
228 uint8_t wct;
229 uint16_t *vwv;
230
231 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
232 &num_bytes, &bytes);
233 TALLOC_FREE(subreq);
234 if (!NT_STATUS_IS_OK(status)) {
235 tevent_req_nterror(req, status);
236 return;
237 }
238
239 inhdr = in + NBT_HDR_SIZE;
240 p = bytes;
241
242 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
243 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
244
245 status = smb_bytes_talloc_string(cli,
246 inhdr,
247 &cli->server_os,
248 p,
249 bytes+num_bytes-p,
250 &ret);
251
252 if (!NT_STATUS_IS_OK(status)) {
253 tevent_req_nterror(req, status);
254 return;
255 }
256 p += ret;
257
258 status = smb_bytes_talloc_string(cli,
259 inhdr,
260 &cli->server_type,
261 p,
262 bytes+num_bytes-p,
263 &ret);
264
265 if (!NT_STATUS_IS_OK(status)) {
266 tevent_req_nterror(req, status);
267 return;
268 }
269 p += ret;
270
271 status = smb_bytes_talloc_string(cli,
272 inhdr,
273 &cli->server_domain,
274 p,
275 bytes+num_bytes-p,
276 &ret);
277
278 if (!NT_STATUS_IS_OK(status)) {
279 tevent_req_nterror(req, status);
280 return;
281 }
282 p += ret;
283
284 status = cli_set_username(cli, state->user);
285 if (tevent_req_nterror(req, status)) {
286 return;
287 }
288 tevent_req_done(req);
289 }
290
291 static NTSTATUS cli_session_setup_lanman2_recv(struct tevent_req *req)
292 {
293 return tevent_req_simple_recv_ntstatus(req);
294 }
295
296 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli, const char *user,
297 const char *pass, size_t passlen,
298 const char *workgroup)
299 {
300 TALLOC_CTX *frame = talloc_stackframe();
301 struct event_context *ev;
302 struct tevent_req *req;
303 NTSTATUS status = NT_STATUS_NO_MEMORY;
304
305 if (smbXcli_conn_has_async_calls(cli->conn)) {
306 /*
307 * Can't use sync call while an async call is in flight
308 */
309 status = NT_STATUS_INVALID_PARAMETER;
310 goto fail;
311 }
312 ev = event_context_init(frame);
313 if (ev == NULL) {
314 goto fail;
315 }
316 req = cli_session_setup_lanman2_send(frame, ev, cli, user, pass, passlen,
317 workgroup);
318 if (req == NULL) {
319 goto fail;
320 }
321 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
322 goto fail;
323 }
324 status = cli_session_setup_lanman2_recv(req);
325 fail:
326 TALLOC_FREE(frame);
327 return status;
328 }
329
330 /****************************************************************************
331 Work out suitable capabilities to offer the server.
332 ****************************************************************************/
333
334 static uint32_t cli_session_setup_capabilities(struct cli_state *cli,
335 uint32_t sesssetup_capabilities)
336 {
337 uint32_t client_capabilities = smb1cli_conn_capabilities(cli->conn);
338
339 /*
340 * We only send capabilities based on the mask for:
341 * - client only flags
342 * - flags used in both directions
343 *
344 * We do not echo the server only flags.
345 */
346 client_capabilities &= (SMB_CAP_BOTH_MASK | SMB_CAP_CLIENT_MASK);
347
348 /*
349 * Session Setup specific flags CAP_DYNAMIC_REAUTH
350 * and CAP_EXTENDED_SECURITY are passed by the caller.
351 * We need that in order to do guest logins even if
352 * CAP_EXTENDED_SECURITY is negotiated.
353 */
354 client_capabilities &= ~(CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
355 sesssetup_capabilities &= (CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
356 client_capabilities |= sesssetup_capabilities;
357
358 return client_capabilities;
359 }
360
361 /****************************************************************************
362 Do a NT1 guest session setup.
363 ****************************************************************************/
364
365 struct cli_session_setup_guest_state {
366 struct cli_state *cli;
367 uint16_t vwv[13];
368 struct iovec bytes;
369 };
370
371 static void cli_session_setup_guest_done(struct tevent_req *subreq);
372
373 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
374 struct event_context *ev,
375 struct cli_state *cli,
376 struct tevent_req **psmbreq)
377 {
378 struct tevent_req *req, *subreq;
379 struct cli_session_setup_guest_state *state;
380 uint16_t *vwv;
381 uint8_t *bytes;
382
383 req = tevent_req_create(mem_ctx, &state,
384 struct cli_session_setup_guest_state);
385 if (req == NULL) {
386 return NULL;
387 }
388 state->cli = cli;
389 vwv = state->vwv;
390
391 SCVAL(vwv+0, 0, 0xFF);
392 SCVAL(vwv+0, 1, 0);
393 SSVAL(vwv+1, 0, 0);
394 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
395 SSVAL(vwv+3, 0, 2);
396 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
397 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
398 SSVAL(vwv+7, 0, 0);
399 SSVAL(vwv+8, 0, 0);
400 SSVAL(vwv+9, 0, 0);
401 SSVAL(vwv+10, 0, 0);
402 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
403
404 bytes = talloc_array(state, uint8_t, 0);
405
406 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "", 1, /* username */
407 NULL);
408 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "", 1, /* workgroup */
409 NULL);
410 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Unix", 5, NULL);
411 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Samba", 6, NULL);
412
413 if (bytes == NULL) {
414 TALLOC_FREE(req);
415 return NULL;
416 }
417
418 state->bytes.iov_base = (void *)bytes;
419 state->bytes.iov_len = talloc_get_size(bytes);
420
421 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
422 1, &state->bytes);
423 if (subreq == NULL) {
424 TALLOC_FREE(req);
425 return NULL;
426 }
427 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
428 *psmbreq = subreq;
429 return req;
430 }
431
432 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
433 struct event_context *ev,
434 struct cli_state *cli)
435 {
436 struct tevent_req *req, *subreq;
437 NTSTATUS status;
438
439 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
440 if (req == NULL) {
441 return NULL;
442 }
443
444 status = smb1cli_req_chain_submit(&subreq, 1);
445 if (NT_STATUS_IS_OK(status)) {
446 tevent_req_nterror(req, status);
447 return tevent_req_post(req, ev);
448 }
449 return req;
450 }
451
452 static void cli_session_setup_guest_done(struct tevent_req *subreq)
453 {
454 struct tevent_req *req = tevent_req_callback_data(
455 subreq, struct tevent_req);
456 struct cli_session_setup_guest_state *state = tevent_req_data(
457 req, struct cli_session_setup_guest_state);
458 struct cli_state *cli = state->cli;
459 uint32_t num_bytes;
460 uint8_t *in;
461 uint8_t *inhdr;
462 uint8_t *bytes;
463 uint8_t *p;
464 NTSTATUS status;
465 ssize_t ret;
466 uint8_t wct;
467 uint16_t *vwv;
468
469 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
470 &num_bytes, &bytes);
471 TALLOC_FREE(subreq);
472 if (!NT_STATUS_IS_OK(status)) {
473 tevent_req_nterror(req, status);
474 return;
475 }
476
477 inhdr = in + NBT_HDR_SIZE;
478 p = bytes;
479
480 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
481 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
482
483 status = smb_bytes_talloc_string(cli,
484 inhdr,
485 &cli->server_os,
486 p,
487 bytes+num_bytes-p,
488 &ret);
489
490 if (!NT_STATUS_IS_OK(status)) {
491 tevent_req_nterror(req, status);
492 return;
493 }
494 p += ret;
495
496 status = smb_bytes_talloc_string(cli,
497 inhdr,
498 &cli->server_type,
499 p,
500 bytes+num_bytes-p,
501 &ret);
502
503 if (!NT_STATUS_IS_OK(status)) {
504 tevent_req_nterror(req, status);
505 return;
506 }
507 p += ret;
508
509 status = smb_bytes_talloc_string(cli,
510 inhdr,
511 &cli->server_domain,
512 p,
513 bytes+num_bytes-p,
514 &ret);
515
516 if (!NT_STATUS_IS_OK(status)) {
517 tevent_req_nterror(req, status);
518 return;
519 }
520 p += ret;
521
522 status = cli_set_username(cli, "");
523 if (!NT_STATUS_IS_OK(status)) {
524 tevent_req_nterror(req, status);
525 return;
526 }
527 tevent_req_done(req);
528 }
529
530 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
531 {
532 return tevent_req_simple_recv_ntstatus(req);
533 }
534
535 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
536 {
537 TALLOC_CTX *frame = talloc_stackframe();
538 struct event_context *ev;
539 struct tevent_req *req;
540 NTSTATUS status = NT_STATUS_OK;
541
542 if (smbXcli_conn_has_async_calls(cli->conn)) {
543 /*
544 * Can't use sync call while an async call is in flight
545 */
546 status = NT_STATUS_INVALID_PARAMETER;
547 goto fail;
548 }
549
550 ev = event_context_init(frame);
551 if (ev == NULL) {
552 status = NT_STATUS_NO_MEMORY;
553 goto fail;
554 }
555
556 req = cli_session_setup_guest_send(frame, ev, cli);
557 if (req == NULL) {
558 status = NT_STATUS_NO_MEMORY;
559 goto fail;
560 }
561
562 if (!tevent_req_poll(req, ev)) {
563 status = map_nt_error_from_unix(errno);
564 goto fail;
565 }
566
567 status = cli_session_setup_guest_recv(req);
568 fail:
569 TALLOC_FREE(frame);
570 return status;
571 }
572
573 /****************************************************************************
574 Do a NT1 plaintext session setup.
575 ****************************************************************************/
576
577 struct cli_session_setup_plain_state {
578 struct cli_state *cli;
579 uint16_t vwv[13];
580 const char *user;
581 };
582
583 static void cli_session_setup_plain_done(struct tevent_req *subreq);
584
585 static struct tevent_req *cli_session_setup_plain_send(
586 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
587 struct cli_state *cli,
588 const char *user, const char *pass, const char *workgroup)
589 {
590 struct tevent_req *req, *subreq;
591 struct cli_session_setup_plain_state *state;
592 uint16_t *vwv;
593 uint8_t *bytes;
594 size_t passlen;
595 char *version;
596
597 req = tevent_req_create(mem_ctx, &state,
598 struct cli_session_setup_plain_state);
599 if (req == NULL) {
600 return NULL;
601 }
602 state->cli = cli;
603 state->user = user;
604 vwv = state->vwv;
605
606 SCVAL(vwv+0, 0, 0xff);
607 SCVAL(vwv+0, 1, 0);
608 SSVAL(vwv+1, 0, 0);
609 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
610 SSVAL(vwv+3, 0, 2);
611 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
612 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
613 SSVAL(vwv+7, 0, 0);
614 SSVAL(vwv+8, 0, 0);
615 SSVAL(vwv+9, 0, 0);
616 SSVAL(vwv+10, 0, 0);
617 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
618
619 bytes = talloc_array(state, uint8_t, 0);
620 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), pass, strlen(pass)+1,
621 &passlen);
622 if (tevent_req_nomem(bytes, req)) {
623 return tevent_req_post(req, ev);
624 }
625 SSVAL(vwv + (smbXcli_conn_use_unicode(cli->conn) ? 8 : 7), 0, passlen);
626
627 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
628 user, strlen(user)+1, NULL);
629 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
630 workgroup, strlen(workgroup)+1, NULL);
631 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
632 "Unix", 5, NULL);
633
634 version = talloc_asprintf(talloc_tos(), "Samba %s",
635 samba_version_string());
636 if (tevent_req_nomem(version, req)){
637 return tevent_req_post(req, ev);
638 }
639 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
640 version, strlen(version)+1, NULL);
641 TALLOC_FREE(version);
642
643 if (tevent_req_nomem(bytes, req)) {
644 return tevent_req_post(req, ev);
645 }
646
647 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
648 talloc_get_size(bytes), bytes);
649 if (tevent_req_nomem(subreq, req)) {
650 return tevent_req_post(req, ev);
651 }
652 tevent_req_set_callback(subreq, cli_session_setup_plain_done, req);
653 return req;
654 }
655
656 static void cli_session_setup_plain_done(struct tevent_req *subreq)
657 {
658 struct tevent_req *req = tevent_req_callback_data(
659 subreq, struct tevent_req);
660 struct cli_session_setup_plain_state *state = tevent_req_data(
661 req, struct cli_session_setup_plain_state);
662 struct cli_state *cli = state->cli;
663 uint32_t num_bytes;
664 uint8_t *in;
665 uint8_t *inhdr;
666 uint8_t *bytes;
667 uint8_t *p;
668 NTSTATUS status;
669 ssize_t ret;
670 uint8_t wct;
671 uint16_t *vwv;
672
673 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
674 &num_bytes, &bytes);
675 TALLOC_FREE(subreq);
676 if (tevent_req_nterror(req, status)) {
677 return;
678 }
679
680 inhdr = in + NBT_HDR_SIZE;
681 p = bytes;
682
683 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
684 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
685
686 status = smb_bytes_talloc_string(cli,
687 inhdr,
688 &cli->server_os,
689 p,
690 bytes+num_bytes-p,
691 &ret);
692
693 if (!NT_STATUS_IS_OK(status)) {
694 tevent_req_nterror(req, status);
695 return;
696 }
697 p += ret;
698
699 status = smb_bytes_talloc_string(cli,
700 inhdr,
701 &cli->server_type,
702 p,
703 bytes+num_bytes-p,
704 &ret);
705
706 if (!NT_STATUS_IS_OK(status)) {
707 tevent_req_nterror(req, status);
708 return;
709 }
710 p += ret;
711
712 status = smb_bytes_talloc_string(cli,
713 inhdr,
714 &cli->server_domain,
715 p,
716 bytes+num_bytes-p,
717 &ret);
718
719 if (!NT_STATUS_IS_OK(status)) {
720 tevent_req_nterror(req, status);
721 return;
722 }
723 p += ret;
724
725 status = cli_set_username(cli, state->user);
726 if (tevent_req_nterror(req, status)) {
727 return;
728 }
729
730 tevent_req_done(req);
731 }
732
733 static NTSTATUS cli_session_setup_plain_recv(struct tevent_req *req)
734 {
735 return tevent_req_simple_recv_ntstatus(req);
736 }
737
738 static NTSTATUS cli_session_setup_plain(struct cli_state *cli,
739 const char *user, const char *pass,
740 const char *workgroup)
741 {
742 TALLOC_CTX *frame = talloc_stackframe();
743 struct event_context *ev;
744 struct tevent_req *req;
745 NTSTATUS status = NT_STATUS_NO_MEMORY;
746
747 if (smbXcli_conn_has_async_calls(cli->conn)) {
748 /*
749 * Can't use sync call while an async call is in flight
750 */
751 status = NT_STATUS_INVALID_PARAMETER;
752 goto fail;
753 }
754 ev = event_context_init(frame);
755 if (ev == NULL) {
756 goto fail;
757 }
758 req = cli_session_setup_plain_send(frame, ev, cli, user, pass,
759 workgroup);
760 if (req == NULL) {
761 goto fail;
762 }
763 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
764 goto fail;
765 }
766 status = cli_session_setup_plain_recv(req);
767 fail:
768 TALLOC_FREE(frame);
769 return status;
770 }
771
772 /****************************************************************************
773 do a NT1 NTLM/LM encrypted session setup - for when extended security
774 is not negotiated.
775 @param cli client state to create do session setup on
776 @param user username
777 @param pass *either* cleartext password (passlen !=24) or LM response.
778 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
779 @param workgroup The user's domain.
780 ****************************************************************************/
781
782 struct cli_session_setup_nt1_state {
783 struct cli_state *cli;
784 uint16_t vwv[13];
785 DATA_BLOB response;
786 DATA_BLOB session_key;
787 const char *user;
788 };
789
790 static void cli_session_setup_nt1_done(struct tevent_req *subreq);
791
792 static struct tevent_req *cli_session_setup_nt1_send(
793 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
794 struct cli_state *cli, const char *user,
795 const char *pass, size_t passlen,
796 const char *ntpass, size_t ntpasslen,
797 const char *workgroup)
798 {
799 struct tevent_req *req, *subreq;
800 struct cli_session_setup_nt1_state *state;
801 DATA_BLOB lm_response = data_blob_null;
802 DATA_BLOB nt_response = data_blob_null;
803 DATA_BLOB session_key = data_blob_null;
804 uint16_t *vwv;
805 uint8_t *bytes;
806 char *workgroup_upper;
807
808 req = tevent_req_create(mem_ctx, &state,
809 struct cli_session_setup_nt1_state);
810 if (req == NULL) {
811 return NULL;
812 }
813 state->cli = cli;
814 state->user = user;
815 vwv = state->vwv;
816
817 if (passlen == 0) {
818 /* do nothing - guest login */
819 } else if (passlen != 24) {
820 if (lp_client_ntlmv2_auth()) {
821 DATA_BLOB server_chal;
822 DATA_BLOB names_blob;
823
824 server_chal =
825 data_blob_const(smb1cli_conn_server_challenge(cli->conn),
826 8);
827
828 /*
829 * note that the 'workgroup' here is a best
830 * guess - we don't know the server's domain
831 * at this point. Windows clients also don't
832 * use hostname...
833 */
834 names_blob = NTLMv2_generate_names_blob(
835 NULL, NULL, workgroup);
836
837 if (tevent_req_nomem(names_blob.data, req)) {
838 return tevent_req_post(req, ev);
839 }
840
841 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass,
842 &server_chal, &names_blob,
843 &lm_response, &nt_response,
844 NULL, &session_key)) {
845 data_blob_free(&names_blob);
846 tevent_req_nterror(
847 req, NT_STATUS_ACCESS_DENIED);
848 return tevent_req_post(req, ev);
849 }
850 data_blob_free(&names_blob);
851
852 } else {
853 uchar nt_hash[16];
854 E_md4hash(pass, nt_hash);
855
856 #ifdef LANMAN_ONLY
857 nt_response = data_blob_null;
858 #else
859 nt_response = data_blob(NULL, 24);
860 if (tevent_req_nomem(nt_response.data, req)) {
861 return tevent_req_post(req, ev);
862 }
863
864 SMBNTencrypt(pass, smb1cli_conn_server_challenge(cli->conn),
865 nt_response.data);
866 #endif
867 /* non encrypted password supplied. Ignore ntpass. */
868 if (lp_client_lanman_auth()) {
869
870 lm_response = data_blob(NULL, 24);
871 if (tevent_req_nomem(lm_response.data, req)) {
872 return tevent_req_post(req, ev);
873 }
874
875 if (!SMBencrypt(pass,
876 smb1cli_conn_server_challenge(cli->conn),
877 lm_response.data)) {
878 /*
879 * Oops, the LM response is
880 * invalid, just put the NT
881 * response there instead
882 */
883 data_blob_free(&lm_response);
884 lm_response = data_blob(
885 nt_response.data,
886 nt_response.length);
887 }
888 } else {
889 /*
890 * LM disabled, place NT# in LM field
891 * instead
892 */
893 lm_response = data_blob(
894 nt_response.data, nt_response.length);
895 }
896
897 if (tevent_req_nomem(lm_response.data, req)) {
898 return tevent_req_post(req, ev);
899 }
900
901 session_key = data_blob(NULL, 16);
902 if (tevent_req_nomem(session_key.data, req)) {
903 return tevent_req_post(req, ev);
904 }
905 #ifdef LANMAN_ONLY
906 E_deshash(pass, session_key.data);
907 memset(&session_key.data[8], '\0', 8);
908 #else
909 SMBsesskeygen_ntv1(nt_hash, session_key.data);
910 #endif
911 }
912 } else {
913 /* pre-encrypted password supplied. Only used for
914 security=server, can't do
915 signing because we don't have original key */
916
917 lm_response = data_blob(pass, passlen);
918 if (tevent_req_nomem(lm_response.data, req)) {
919 return tevent_req_post(req, ev);
920 }
921
922 nt_response = data_blob(ntpass, ntpasslen);
923 if (tevent_req_nomem(nt_response.data, req)) {
924 return tevent_req_post(req, ev);
925 }
926 }
927
928 #ifdef LANMAN_ONLY
929 state->response = data_blob_talloc(
930 state, lm_response.data, lm_response.length);
931 #else
932 state->response = data_blob_talloc(
933 state, nt_response.data, nt_response.length);
934 #endif
935 if (tevent_req_nomem(state->response.data, req)) {
936 return tevent_req_post(req, ev);
937 }
938
939 if (session_key.data) {
940 state->session_key = data_blob_talloc(
941 state, session_key.data, session_key.length);
942 if (tevent_req_nomem(state->session_key.data, req)) {
943 return tevent_req_post(req, ev);
944 }
945 }
946 data_blob_free(&session_key);
947
948 SCVAL(vwv+0, 0, 0xff);
949 SCVAL(vwv+0, 1, 0);
950 SSVAL(vwv+1, 0, 0);
951 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
952 SSVAL(vwv+3, 0, 2);
953 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
954 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
955 SSVAL(vwv+7, 0, lm_response.length);
956 SSVAL(vwv+8, 0, nt_response.length);
957 SSVAL(vwv+9, 0, 0);
958 SSVAL(vwv+10, 0, 0);
959 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
960
961 bytes = talloc_array(state, uint8_t,
962 lm_response.length + nt_response.length);
963 if (tevent_req_nomem(bytes, req)) {
964 return tevent_req_post(req, ev);
965 }
966 if (lm_response.length != 0) {
967 memcpy(bytes, lm_response.data, lm_response.length);
968 }
969 if (nt_response.length != 0) {
970 memcpy(bytes + lm_response.length,
971 nt_response.data, nt_response.length);
972 }
973 data_blob_free(&lm_response);
974 data_blob_free(&nt_response);
975
976 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
977 user, strlen(user)+1, NULL);
978
979 /*
980 * Upper case here might help some NTLMv2 implementations
981 */
982 workgroup_upper = talloc_strdup_upper(talloc_tos(), workgroup);
983 if (tevent_req_nomem(workgroup_upper, req)) {
984 return tevent_req_post(req, ev);
985 }
986 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
987 workgroup_upper, strlen(workgroup_upper)+1,
988 NULL);
989 TALLOC_FREE(workgroup_upper);
990
991 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Unix", 5, NULL);
992 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Samba", 6, NULL);
993 if (tevent_req_nomem(bytes, req)) {
994 return tevent_req_post(req, ev);
995 }
996
997 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
998 talloc_get_size(bytes), bytes);
999 if (tevent_req_nomem(subreq, req)) {
1000 return tevent_req_post(req, ev);
1001 }
1002 tevent_req_set_callback(subreq, cli_session_setup_nt1_done, req);
1003 return req;
1004 }
1005
1006 static void cli_session_setup_nt1_done(struct tevent_req *subreq)
1007 {
1008 struct tevent_req *req = tevent_req_callback_data(
1009 subreq, struct tevent_req);
1010 struct cli_session_setup_nt1_state *state = tevent_req_data(
1011 req, struct cli_session_setup_nt1_state);
1012 struct cli_state *cli = state->cli;
1013 uint32_t num_bytes;
1014 uint8_t *in;
1015 uint8_t *inhdr;
1016 uint8_t *bytes;
1017 uint8_t *p;
1018 NTSTATUS status;
1019 ssize_t ret;
1020 uint8_t wct;
1021 uint16_t *vwv;
1022
1023 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
1024 &num_bytes, &bytes);
1025 TALLOC_FREE(subreq);
1026 if (!NT_STATUS_IS_OK(status)) {
1027 tevent_req_nterror(req, status);
1028 return;
1029 }
1030
1031 inhdr = in + NBT_HDR_SIZE;
1032 p = bytes;
1033
1034 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
1035 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1036
1037 status = smb_bytes_talloc_string(cli,
1038 inhdr,
1039 &cli->server_os,
1040 p,
1041 bytes+num_bytes-p,
1042 &ret);
1043 if (!NT_STATUS_IS_OK(status)) {
1044 tevent_req_nterror(req, status);
1045 return;
1046 }
1047 p += ret;
1048
1049 status = smb_bytes_talloc_string(cli,
1050 inhdr,
1051 &cli->server_type,
1052 p,
1053 bytes+num_bytes-p,
1054 &ret);
1055 if (!NT_STATUS_IS_OK(status)) {
1056 tevent_req_nterror(req, status);
1057 return;
1058 }
1059 p += ret;
1060
1061 status = smb_bytes_talloc_string(cli,
1062 inhdr,
1063 &cli->server_domain,
1064 p,
1065 bytes+num_bytes-p,
1066 &ret);
1067 if (!NT_STATUS_IS_OK(status)) {
1068 tevent_req_nterror(req, status);
1069 return;
1070 }
1071 p += ret;
1072
1073 status = cli_set_username(cli, state->user);
1074 if (tevent_req_nterror(req, status)) {
1075 return;
1076 }
1077 if (smb1cli_conn_activate_signing(cli->conn, state->session_key, state->response)
1078 && !smb1cli_conn_check_signing(cli->conn, (uint8_t *)in, 1)) {
1079 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1080 return;
1081 }
1082 if (state->session_key.data) {
1083 struct smbXcli_session *session = state->cli->smb1.session;
1084
1085 status = smb1cli_session_set_session_key(session,
1086 state->session_key);
1087 if (tevent_req_nterror(req, status)) {
1088 return;
1089 }
1090 }
1091 tevent_req_done(req);
1092 }
1093
1094 static NTSTATUS cli_session_setup_nt1_recv(struct tevent_req *req)
1095 {
1096 return tevent_req_simple_recv_ntstatus(req);
1097 }
1098
1099 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
1100 const char *pass, size_t passlen,
1101 const char *ntpass, size_t ntpasslen,
1102 const char *workgroup)
1103 {
1104 TALLOC_CTX *frame = talloc_stackframe();
1105 struct event_context *ev;
1106 struct tevent_req *req;
1107 NTSTATUS status = NT_STATUS_NO_MEMORY;
1108
1109 if (smbXcli_conn_has_async_calls(cli->conn)) {
1110 /*
1111 * Can't use sync call while an async call is in flight
1112 */
1113 status = NT_STATUS_INVALID_PARAMETER;
1114 goto fail;
1115 }
1116 ev = event_context_init(frame);
1117 if (ev == NULL) {
1118 goto fail;
1119 }
1120 req = cli_session_setup_nt1_send(frame, ev, cli, user, pass, passlen,
1121 ntpass, ntpasslen, workgroup);
1122 if (req == NULL) {
1123 goto fail;
1124 }
1125 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1126 goto fail;
1127 }
1128 status = cli_session_setup_nt1_recv(req);
1129 fail:
1130 TALLOC_FREE(frame);
1131 return status;
1132 }
1133
1134 /* The following is calculated from :
1135 * (smb_size-4) = 35
1136 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
1137 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
1138 * end of packet.
1139 */
1140
1141 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
1142
1143 struct cli_sesssetup_blob_state {
1144 struct tevent_context *ev;
1145 struct cli_state *cli;
1146 DATA_BLOB blob;
1147 uint16_t max_blob_size;
1148 uint16_t vwv[12];
1149 uint8_t *buf;
1150
1151 DATA_BLOB smb2_blob;
1152 struct iovec *recv_iov;
1153
1154 NTSTATUS status;
1155 uint8_t *inbuf;
1156 DATA_BLOB ret_blob;
1157 };
1158
1159 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1160 struct tevent_req **psubreq);
1161 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
1162
1163 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
1164 struct tevent_context *ev,
1165 struct cli_state *cli,
1166 DATA_BLOB blob)
1167 {
1168 struct tevent_req *req, *subreq;
1169 struct cli_sesssetup_blob_state *state;
1170 uint32_t usable_space;
1171
1172 req = tevent_req_create(mem_ctx, &state,
1173 struct cli_sesssetup_blob_state);
1174 if (req == NULL) {
1175 return NULL;
1176 }
1177 state->ev = ev;
1178 state->blob = blob;
1179 state->cli = cli;
1180
1181 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1182 usable_space = UINT16_MAX;
1183 } else {
1184 usable_space = cli_state_available_size(cli,
1185 BASE_SESSSETUP_BLOB_PACKET_SIZE);
1186 }
1187
1188 if (usable_space == 0) {
1189 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
1190 "(not possible to send %u bytes)\n",
1191 BASE_SESSSETUP_BLOB_PACKET_SIZE + 1));
1192 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1193 return tevent_req_post(req, ev);
1194 }
1195 state->max_blob_size = MIN(usable_space, 0xFFFF);
1196
1197 if (!cli_sesssetup_blob_next(state, &subreq)) {
1198 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1199 return tevent_req_post(req, ev);
1200 }
1201 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1202 return req;
1203 }
1204
1205 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1206 struct tevent_req **psubreq)
1207 {
1208 struct tevent_req *subreq;
1209 uint16_t thistime;
1210
1211 thistime = MIN(state->blob.length, state->max_blob_size);
1212
1213 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1214
1215 state->smb2_blob.data = state->blob.data;
1216 state->smb2_blob.length = thistime;
1217
1218 state->blob.data += thistime;
1219 state->blob.length -= thistime;
1220
1221 subreq = smb2cli_session_setup_send(state, state->ev,
1222 state->cli->conn,
1223 state->cli->timeout,
1224 state->cli->smb2.session,
1225 0, /* in_flags */
1226 SMB2_CAP_DFS, /* in_capabilities */
1227 0, /* in_channel */
1228 0, /* in_previous_session_id */
1229 &state->smb2_blob);
1230 if (subreq == NULL) {
1231 return false;
1232 }
1233 *psubreq = subreq;
1234 return true;
1235 }
1236
1237 SCVAL(state->vwv+0, 0, 0xFF);
1238 SCVAL(state->vwv+0, 1, 0);
1239 SSVAL(state->vwv+1, 0, 0);
1240 SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
1241 SSVAL(state->vwv+3, 0, 2);
1242 SSVAL(state->vwv+4, 0, 1);
1243 SIVAL(state->vwv+5, 0, 0);
1244
1245 SSVAL(state->vwv+7, 0, thistime);
1246
1247 SSVAL(state->vwv+8, 0, 0);
1248 SSVAL(state->vwv+9, 0, 0);
1249 SIVAL(state->vwv+10, 0,
1250 cli_session_setup_capabilities(state->cli, CAP_EXTENDED_SECURITY));
1251
1252 state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
1253 thistime);
1254 if (state->buf == NULL) {
1255 return false;
1256 }
1257 state->blob.data += thistime;
1258 state->blob.length -= thistime;
1259
1260 state->buf = smb_bytes_push_str(state->buf, smbXcli_conn_use_unicode(state->cli->conn),
1261 "Unix", 5, NULL);
1262 state->buf = smb_bytes_push_str(state->buf, smbXcli_conn_use_unicode(state->cli->conn),
1263 "Samba", 6, NULL);
1264 if (state->buf == NULL) {
1265 return false;
1266 }
1267 subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
1268 12, state->vwv,
1269 talloc_get_size(state->buf), state->buf);
1270 if (subreq == NULL) {
1271 return false;
1272 }
1273 *psubreq = subreq;
1274 return true;
1275 }
1276
1277 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
1278 {
1279 struct tevent_req *req = tevent_req_callback_data(
1280 subreq, struct tevent_req);
1281 struct cli_sesssetup_blob_state *state = tevent_req_data(
1282 req, struct cli_sesssetup_blob_state);
1283 struct cli_state *cli = state->cli;
1284 uint8_t wct;
1285 uint16_t *vwv;
1286 uint32_t num_bytes;
1287 uint8_t *bytes;
1288 NTSTATUS status;
1289 uint8_t *p;
1290 uint16_t blob_length;
1291 uint8_t *in;
1292 uint8_t *inhdr;
1293 ssize_t ret;
1294
1295 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1296 status = smb2cli_session_setup_recv(subreq, state,
1297 &state->recv_iov,
1298 &state->ret_blob);
1299 } else {
1300 status = cli_smb_recv(subreq, state, &in, 4, &wct, &vwv,
1301 &num_bytes, &bytes);
1302 TALLOC_FREE(state->buf);
1303 }
1304 TALLOC_FREE(subreq);
1305 if (!NT_STATUS_IS_OK(status)
1306 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1307 tevent_req_nterror(req, status);
1308 return;
1309 }
1310
1311 state->status = status;
1312
1313 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1314 goto next;
1315 }
1316
1317 state->inbuf = in;
1318 inhdr = in + NBT_HDR_SIZE;
1319 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
1320 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1321
1322 blob_length = SVAL(vwv+3, 0);
1323 if (blob_length > num_bytes) {
1324 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1325 return;
1326 }
1327 state->ret_blob = data_blob_const(bytes, blob_length);
1328
1329 p = bytes + blob_length;
1330
1331 status = smb_bytes_talloc_string(cli,
1332 inhdr,
1333 &cli->server_os,
1334 p,
1335 bytes+num_bytes-p,
1336 &ret);
1337
1338 if (!NT_STATUS_IS_OK(status)) {
1339 tevent_req_nterror(req, status);
1340 return;
1341 }
1342 p += ret;
1343
1344 status = smb_bytes_talloc_string(cli,
1345 inhdr,
1346 &cli->server_type,
1347 p,
1348 bytes+num_bytes-p,
1349 &ret);
1350
1351 if (!NT_STATUS_IS_OK(status)) {
1352 tevent_req_nterror(req, status);
1353 return;
1354 }
1355 p += ret;
1356
1357 status = smb_bytes_talloc_string(cli,
1358 inhdr,
1359 &cli->server_domain,
1360 p,
1361 bytes+num_bytes-p,
1362 &ret);
1363
1364 if (!NT_STATUS_IS_OK(status)) {
1365 tevent_req_nterror(req, status);
1366 return;
1367 }
1368 p += ret;
1369
1370 next:
1371 if (state->blob.length != 0) {
1372 /*
1373 * More to send
1374 */
1375 if (!cli_sesssetup_blob_next(state, &subreq)) {
1376 tevent_req_oom(req);
1377 return;
1378 }
1379 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1380 return;
1381 }
1382 tevent_req_done(req);
1383 }
1384
1385 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
1386 TALLOC_CTX *mem_ctx,
1387 DATA_BLOB *pblob,
1388 uint8_t **pinbuf,
1389 struct iovec **precv_iov)
1390 {
1391 struct cli_sesssetup_blob_state *state = tevent_req_data(
1392 req, struct cli_sesssetup_blob_state);
1393 NTSTATUS status;
1394 uint8_t *inbuf;
1395 struct iovec *recv_iov;
1396
1397 if (tevent_req_is_nterror(req, &status)) {
1398 TALLOC_FREE(state->cli->smb2.session);
1399 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1400 return status;
1401 }
1402
1403 inbuf = talloc_move(mem_ctx, &state->inbuf);
1404 recv_iov = talloc_move(mem_ctx, &state->recv_iov);
1405 if (pblob != NULL) {
1406 *pblob = state->ret_blob;
1407 }
1408 if (pinbuf != NULL) {
1409 *pinbuf = inbuf;
1410 }
1411 if (precv_iov != NULL) {
1412 *precv_iov = recv_iov;
1413 }
1414 /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
1415 return state->status;
1416 }
1417
1418 #ifdef HAVE_KRB5
1419
1420 /****************************************************************************
1421 Use in-memory credentials cache
1422 ****************************************************************************/
1423
1424 static void use_in_memory_ccache(void) {
1425 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
1426 }
1427
1428 /****************************************************************************
1429 Do a spnego/kerberos encrypted session setup.
1430 ****************************************************************************/
1431
1432 struct cli_session_setup_kerberos_state {
1433 struct cli_state *cli;
1434 DATA_BLOB negTokenTarg;
1435 DATA_BLOB session_key_krb5;
1436 ADS_STATUS ads_status;
1437 };
1438
1439 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
1440
1441 static struct tevent_req *cli_session_setup_kerberos_send(
1442 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1443 const char *principal)
1444 {
1445 struct tevent_req *req, *subreq;
1446 struct cli_session_setup_kerberos_state *state;
1447 int rc;
1448
1449 DEBUG(2,("Doing kerberos session setup\n"));
1450
1451 req = tevent_req_create(mem_ctx, &state,
1452 struct cli_session_setup_kerberos_state);
1453 if (req == NULL) {
1454 return NULL;
1455 }
1456 state->cli = cli;
1457 state->ads_status = ADS_SUCCESS;
1458
1459 /*
1460 * Ok, this is cheating: spnego_gen_krb5_negTokenInit can block if
1461 * we have to acquire a ticket. To be fixed later :-)
1462 */
1463 rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
1464 &state->session_key_krb5, 0, NULL);
1465 if (rc) {
1466 DEBUG(1, ("cli_session_setup_kerberos: "
1467 "spnego_gen_krb5_negTokenInit failed: %s\n",
1468 error_message(rc)));
1469 state->ads_status = ADS_ERROR_KRB5(rc);
1470 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1471 return tevent_req_post(req, ev);
1472 }
1473
1474 #if 0
1475 file_save("negTokenTarg.dat", state->negTokenTarg.data,
1476 state->negTokenTarg.length);
1477 #endif
1478
1479 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1480 state->cli->smb2.session = smbXcli_session_create(cli,
1481 cli->conn);
1482 if (tevent_req_nomem(state->cli->smb2.session, req)) {
1483 return tevent_req_post(req, ev);
1484 }
1485 }
1486
1487 subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
1488 if (tevent_req_nomem(subreq, req)) {
1489 return tevent_req_post(req, ev);
1490 }
1491 tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
1492 return req;
1493 }
1494
1495 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
1496 {
1497 struct tevent_req *req = tevent_req_callback_data(
1498 subreq, struct tevent_req);
1499 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1500 req, struct cli_session_setup_kerberos_state);
1501 uint8_t *inbuf = NULL;
1502 struct iovec *recv_iov = NULL;
1503 NTSTATUS status;
1504
1505 status = cli_sesssetup_blob_recv(subreq, state,
1506 NULL, &inbuf, &recv_iov);
1507 TALLOC_FREE(subreq);
1508 if (!NT_STATUS_IS_OK(status)) {
1509 tevent_req_nterror(req, status);
1510 return;
1511 }
1512
1513 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1514 struct smbXcli_session *session = state->cli->smb2.session;
1515 status = smb2cli_session_set_session_key(session,
1516 state->session_key_krb5,
1517 recv_iov);
1518 if (tevent_req_nterror(req, status)) {
1519 return;
1520 }
1521 } else {
1522 struct smbXcli_session *session = state->cli->smb1.session;
1523
1524 status = smb1cli_session_set_session_key(session,
1525 state->session_key_krb5);
1526 if (tevent_req_nterror(req, status)) {
1527 return;
1528 }
1529
1530 if (smb1cli_conn_activate_signing(state->cli->conn, state->session_key_krb5,
1531 data_blob_null)
1532 && !smb1cli_conn_check_signing(state->cli->conn, inbuf, 1)) {
1533 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1534 return;
1535 }
1536 }
1537
1538 tevent_req_done(req);
1539 }
1540
1541 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
1542 {
1543 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1544 req, struct cli_session_setup_kerberos_state);
1545 NTSTATUS status;
1546
1547 if (tevent_req_is_nterror(req, &status)) {
1548 return ADS_ERROR_NT(status);
1549 }
1550 return state->ads_status;
1551 }
1552
1553 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
1554 const char *principal)
1555 {
1556 struct tevent_context *ev;
1557 struct tevent_req *req;
1558 ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1559
1560 if (smbXcli_conn_has_async_calls(cli->conn)) {
1561 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1562 }
1563 ev = tevent_context_init(talloc_tos());
1564 if (ev == NULL) {
1565 goto fail;
1566 }
1567 req = cli_session_setup_kerberos_send(ev, ev, cli, principal);
1568 if (req == NULL) {
1569 goto fail;
1570 }
1571 if (!tevent_req_poll(req, ev)) {
1572 status = ADS_ERROR_SYSTEM(errno);
1573 goto fail;
1574 }
1575 status = cli_session_setup_kerberos_recv(req);
1576 fail:
1577 TALLOC_FREE(ev);
1578 return status;
1579 }
1580 #endif /* HAVE_KRB5 */
1581
1582 /****************************************************************************
1583 Do a spnego/NTLMSSP encrypted session setup.
1584 ****************************************************************************/
1585
1586 struct cli_session_setup_ntlmssp_state {
1587 struct tevent_context *ev;
1588 struct cli_state *cli;
1589 struct ntlmssp_state *ntlmssp_state;
1590 int turn;
1591 DATA_BLOB blob_out;
1592 };
1593
1594 static int cli_session_setup_ntlmssp_state_destructor(
1595 struct cli_session_setup_ntlmssp_state *state)
1596 {
1597 if (state->ntlmssp_state != NULL) {
1598 TALLOC_FREE(state->ntlmssp_state);
1599 }
1600 return 0;
1601 }
1602
1603 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
1604
1605 static struct tevent_req *cli_session_setup_ntlmssp_send(
1606 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1607 const char *user, const char *pass, const char *domain)
1608 {
1609 struct tevent_req *req, *subreq;
1610 struct cli_session_setup_ntlmssp_state *state;
1611 NTSTATUS status;
1612 DATA_BLOB blob_out;
1613 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
1614
1615 req = tevent_req_create(mem_ctx, &state,
1616 struct cli_session_setup_ntlmssp_state);
1617 if (req == NULL) {
1618 return NULL;
1619 }
1620 state->ev = ev;
1621 state->cli = cli;
1622 state->turn = 1;
1623
1624 state->ntlmssp_state = NULL;
1625 talloc_set_destructor(
1626 state, cli_session_setup_ntlmssp_state_destructor);
1627
1628 status = ntlmssp_client_start(state,
1629 lp_netbios_name(),
1630 lp_workgroup(),
1631 lp_client_ntlmv2_auth(),
1632 &state->ntlmssp_state);
1633 if (!NT_STATUS_IS_OK(status)) {
1634 goto fail;
1635 }
1636 ntlmssp_want_feature(state->ntlmssp_state,
1637 NTLMSSP_FEATURE_SESSION_KEY);
1638 if (cli->use_ccache) {
1639 ntlmssp_want_feature(state->ntlmssp_state,
1640 NTLMSSP_FEATURE_CCACHE);
1641 }
1642 status = ntlmssp_set_username(state->ntlmssp_state, user);
1643 if (!NT_STATUS_IS_OK(status)) {
1644 goto fail;
1645 }
1646 status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1647 if (!NT_STATUS_IS_OK(status)) {
1648 goto fail;
1649 }
1650 if (cli->pw_nt_hash) {
1651 status = ntlmssp_set_password_hash(state->ntlmssp_state, pass);
1652 } else {
1653 status = ntlmssp_set_password(state->ntlmssp_state, pass);
1654 }
1655 if (!NT_STATUS_IS_OK(status)) {
1656 goto fail;
1657 }
1658 status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1659 &blob_out);
1660 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1661 goto fail;
1662 }
1663
1664 state->blob_out = spnego_gen_negTokenInit(state, OIDs_ntlm, &blob_out, NULL);
1665 data_blob_free(&blob_out);
1666
1667 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1668 state->cli->smb2.session = smbXcli_session_create(cli,
1669 cli->conn);
1670 if (tevent_req_nomem(state->cli->smb2.session, req)) {
1671 return tevent_req_post(req, ev);
1672 }
1673 }
1674
1675 subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1676 if (tevent_req_nomem(subreq, req)) {
1677 return tevent_req_post(req, ev);
1678 }
1679 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1680 return req;
1681 fail:
1682 tevent_req_nterror(req, status);
1683 return tevent_req_post(req, ev);
1684 }
1685
1686 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1687 {
1688 struct tevent_req *req = tevent_req_callback_data(
1689 subreq, struct tevent_req);
1690 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1691 req, struct cli_session_setup_ntlmssp_state);
1692 DATA_BLOB blob_in, msg_in, blob_out;
1693 uint8_t *inbuf = NULL;
1694 struct iovec *recv_iov = NULL;
1695 bool parse_ret;
1696 NTSTATUS status;
1697
1698 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1699 &inbuf, &recv_iov);
1700 TALLOC_FREE(subreq);
1701 data_blob_free(&state->blob_out);
1702
1703 if (NT_STATUS_IS_OK(status)) {
1704 if (state->cli->server_domain[0] == '\0') {
1705 TALLOC_FREE(state->cli->server_domain);
1706 state->cli->server_domain = talloc_strdup(state->cli,
1707 state->ntlmssp_state->server.netbios_domain);
1708 if (state->cli->server_domain == NULL) {
1709 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1710 return;
1711 }
1712 }
1713
1714 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1715 struct smbXcli_session *session = state->cli->smb2.session;
1716
1717 if (ntlmssp_is_anonymous(state->ntlmssp_state)) {
1718 /*
1719 * Windows server does not set the
1720 * SMB2_SESSION_FLAG_IS_GUEST nor
1721 * SMB2_SESSION_FLAG_IS_NULL flag.
1722 *
1723 * This fix makes sure we do not try
1724 * to verify a signature on the final
1725 * session setup response.
1726 */
1727 TALLOC_FREE(state->ntlmssp_state);
1728 tevent_req_done(req);
1729 return;
1730 }
1731
1732 status = smb2cli_session_set_session_key(session,
1733 state->ntlmssp_state->session_key,
1734 recv_iov);
1735 if (tevent_req_nterror(req, status)) {
1736 return;
1737 }
1738 } else {
1739 struct smbXcli_session *session = state->cli->smb1.session;
1740
1741 status = smb1cli_session_set_session_key(session,
1742 state->ntlmssp_state->session_key);
1743 if (tevent_req_nterror(req, status)) {
1744 return;
1745 }
1746
1747 if (smb1cli_conn_activate_signing(
1748 state->cli->conn, state->ntlmssp_state->session_key,
1749 data_blob_null)
1750 && !smb1cli_conn_check_signing(state->cli->conn, inbuf, 1)) {
1751 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1752 return;
1753 }
1754 }
1755 TALLOC_FREE(state->ntlmssp_state);
1756 tevent_req_done(req);
1757 return;
1758 }
1759 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1760 tevent_req_nterror(req, status);
1761 return;
1762 }
1763
1764 if (blob_in.length == 0) {
1765 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1766 return;
1767 }
1768
1769 if ((state->turn == 1)
1770 && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1771 DATA_BLOB tmp_blob = data_blob_null;
1772 /* the server might give us back two challenges */
1773 parse_ret = spnego_parse_challenge(state, blob_in, &msg_in,
1774 &tmp_blob);
1775 data_blob_free(&tmp_blob);
1776 } else {
1777 parse_ret = spnego_parse_auth_response(state, blob_in, status,
1778 OID_NTLMSSP, &msg_in);
1779 }
1780 state->turn += 1;
1781
1782 if (!parse_ret) {
1783 DEBUG(3,("Failed to parse auth response\n"));
1784 if (NT_STATUS_IS_OK(status)
1785 || NT_STATUS_EQUAL(status,
1786 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1787 tevent_req_nterror(
1788 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1789 return;
1790 }
1791 }
1792
1793 status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1794
1795 if (!NT_STATUS_IS_OK(status)
1796 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1797 TALLOC_FREE(state->ntlmssp_state);
1798 tevent_req_nterror(req, status);
1799 return;
1800 }
1801
1802 state->blob_out = spnego_gen_auth(state, blob_out);
1803 if (tevent_req_nomem(state->blob_out.data, req)) {
1804 return;
1805 }
1806
1807 subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1808 state->blob_out);
1809 if (tevent_req_nomem(subreq, req)) {
1810 return;
1811 }
1812 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1813 }
1814
1815 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1816 {
1817 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1818 req, struct cli_session_setup_ntlmssp_state);
1819 NTSTATUS status;
1820
1821 if (tevent_req_is_nterror(req, &status)) {
1822 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1823 return status;
1824 }
1825 return NT_STATUS_OK;
1826 }
1827
1828 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1829 const char *user,
1830 const char *pass,
1831 const char *domain)
1832 {
1833 struct tevent_context *ev;
1834 struct tevent_req *req;
1835 NTSTATUS status = NT_STATUS_NO_MEMORY;
1836
1837 if (smbXcli_conn_has_async_calls(cli->conn)) {
1838 return NT_STATUS_INVALID_PARAMETER;
1839 }
1840 ev = tevent_context_init(talloc_tos());
1841 if (ev == NULL) {
1842 goto fail;
1843 }
1844 req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1845 if (req == NULL) {
1846 goto fail;
1847 }
1848 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1849 goto fail;
1850 }
1851 status = cli_session_setup_ntlmssp_recv(req);
1852 fail:
1853 TALLOC_FREE(ev);
1854 return status;
1855 }
1856
1857 /****************************************************************************
1858 Do a spnego encrypted session setup.
1859
1860 user_domain: The shortname of the domain the user/machine is a member of.
1861 dest_realm: The realm we're connecting to, if NULL we use our default realm.
1862 ****************************************************************************/
1863
1864 static ADS_STATUS cli_session_setup_spnego(struct cli_state *cli,
1865 const char *user,
1866 const char *pass,
1867 const char *user_domain,
1868 const char * dest_realm)
1869 {
1870 char *principal = NULL;
1871 char *OIDs[ASN1_MAX_OIDS];
1872 int i;
1873 const DATA_BLOB *server_blob;
1874 DATA_BLOB blob = data_blob_null;
1875 const char *p = NULL;
1876 char *account = NULL;
1877 NTSTATUS status;
1878
1879 server_blob = smbXcli_conn_server_gss_blob(cli->conn);
1880 if (server_blob) {
1881 blob = data_blob(server_blob->data, server_blob->length);
1882 }
1883
1884 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)blob.length));
1885
1886 /* the server might not even do spnego */
1887 if (blob.length == 0) {
1888 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1889 goto ntlmssp;
1890 }
1891
1892 #if 0
1893 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1894 #endif
1895
1896 /* The server sent us the first part of the SPNEGO exchange in the
1897 * negprot reply. It is WRONG to depend on the principal sent in the
1898 * negprot reply, but right now we do it. If we don't receive one,
1899 * we try to best guess, then fall back to NTLM. */
1900 if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &principal, NULL) ||
1901 OIDs[0] == NULL) {
1902 data_blob_free(&blob);
1903 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1904 }
1905 data_blob_free(&blob);
1906
1907 /* make sure the server understands kerberos */
1908 for (i=0;OIDs[i];i++) {
1909 if (i == 0)
1910 DEBUG(3,("got OID=%s\n", OIDs[i]));
1911 else
1912 DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1913 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1914 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1915 cli->got_kerberos_mechanism = True;
1916 }
1917 talloc_free(OIDs[i]);
1918 }
1919
1920 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1921
1922 status = cli_set_username(cli, user);
1923 if (!NT_STATUS_IS_OK(status)) {
1924 TALLOC_FREE(principal);
1925 return ADS_ERROR_NT(status);
1926 }
1927
1928 #ifdef HAVE_KRB5
1929 /* If password is set we reauthenticate to kerberos server
1930 * and do not store results */
1931
1932 if (user && *user && cli->got_kerberos_mechanism && cli->use_kerberos) {
1933 ADS_STATUS rc;
1934 const char *remote_name = smbXcli_conn_remote_name(cli->conn);
1935
1936 if (pass && *pass) {
1937 int ret;
1938
1939 use_in_memory_ccache();
1940 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1941
1942 if (ret){
1943 TALLOC_FREE(principal);
1944 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1945 if (cli->fallback_after_kerberos)
1946 goto ntlmssp;
1947 return ADS_ERROR_KRB5(ret);
1948 }
1949 }
1950
1951 /* We may not be allowed to use the server-supplied SPNEGO principal, or it may not have been supplied to us
1952 */
1953 if (!lp_client_use_spnego_principal() || strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1954 TALLOC_FREE(principal);
1955 }
1956
1957 if (principal == NULL &&
1958 !is_ipaddress(remote_name) &&
1959 !strequal(STAR_SMBSERVER,
1960 remote_name)) {
1961 DEBUG(3,("cli_session_setup_spnego: using target "
1962 "hostname not SPNEGO principal\n"));
1963
1964 if (dest_realm) {
1965 char *realm = strupper_talloc(talloc_tos(), dest_realm);
1966 if (realm) {
1967 principal = talloc_asprintf(talloc_tos(),
1968 "cifs/%s@%s",
1969 remote_name,
1970 realm);
1971 TALLOC_FREE(realm);
1972 }
1973 } else {
1974 principal = kerberos_get_principal_from_service_hostname(talloc_tos(),
1975 "cifs",
1976 remote_name,
1977 lp_realm());
1978 }
1979
1980 if (!principal) {
1981 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1982 }
1983 DEBUG(3,("cli_session_setup_spnego: guessed "
1984 "server principal=%s\n",
1985 principal ? principal : "<null>"));
1986 }
1987
1988 if (principal) {
1989 rc = cli_session_setup_kerberos(cli, principal);
1990 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1991 TALLOC_FREE(principal);
1992 return rc;
1993 }
1994 }
1995 }
1996 #endif
1997
1998 TALLOC_FREE(principal);
1999
2000 ntlmssp:
2001
2002 account = talloc_strdup(talloc_tos(), user);
2003 if (!account) {
2004 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
2005 }
2006
2007 /* when falling back to ntlmssp while authenticating with a machine
2008 * account strip off the realm - gd */
2009
2010 if ((p = strchr_m(user, '@')) != NULL) {
2011 account[PTR_DIFF(p,user)] = '\0';
2012 }
2013
2014 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
2015 }
2016
2017 /****************************************************************************
2018 Send a session setup. The username and workgroup is in UNIX character
2019 format and must be converted to DOS codepage format before sending. If the
2020 password is in plaintext, the same should be done.
2021 ****************************************************************************/
2022
2023 NTSTATUS cli_session_setup(struct cli_state *cli,
2024 const char *user,
2025 const char *pass, int passlen,
2026 const char *ntpass, int ntpasslen,
2027 const char *workgroup)
2028 {
2029 char *p;
2030 char *user2;
2031 uint16_t sec_mode = smb1cli_conn_server_security_mode(cli->conn);
2032
2033 if (user) {
2034 user2 = talloc_strdup(talloc_tos(), user);
2035 } else {
2036 user2 = talloc_strdup(talloc_tos(), "");
2037 }
2038 if (user2 == NULL) {
2039 return NT_STATUS_NO_MEMORY;
2040 }
2041
2042 if (!workgroup) {
2043 workgroup = "";
2044 }
2045
2046 /* allow for workgroups as part of the username */
2047 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
2048 (p=strchr_m(user2,*lp_winbind_separator()))) {
2049 *p = 0;
2050 user = p+1;
2051 strupper_m(user2);
2052 workgroup = user2;
2053 }
2054
2055 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_LANMAN1) {
2056 return NT_STATUS_OK;
2057 }
2058
2059 /* now work out what sort of session setup we are going to
2060 do. I have split this into separate functions to make the
2061 flow a bit easier to understand (tridge) */
2062
2063 /* if its an older server then we have to use the older request format */
2064
2065 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_NT1) {
2066 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
2067 DEBUG(1, ("Server requested LM password but 'client lanman auth = no'"
2068 " or 'client ntlmv2 auth = yes'\n"));
2069 return NT_STATUS_ACCESS_DENIED;
2070 }
2071
2072 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
2073 !lp_client_plaintext_auth() && (*pass)) {
2074 DEBUG(1, ("Server requested PLAINTEXT password but 'client plaintext auth = no'"
2075 " or 'client ntlmv2 auth = yes'\n"));
2076 return NT_STATUS_ACCESS_DENIED;
2077 }
2078
2079 return cli_session_setup_lanman2(cli, user, pass, passlen,
2080 workgroup);
2081 }
2082
2083 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2084 const char *remote_realm = cli_state_remote_realm(cli);
2085 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2086 workgroup,
2087 remote_realm);
2088 if (!ADS_ERR_OK(status)) {
2089 DEBUG(3, ("SMB2-SPNEGO login failed: %s\n", ads_errstr(status)));
2090 return ads_ntstatus(status);
2091 }
2092 return NT_STATUS_OK;
2093 }
2094
2095 /* if no user is supplied then we have to do an anonymous connection.
2096 passwords are ignored */
2097
2098 if (!user || !*user)
2099 return cli_session_setup_guest(cli);
2100
2101 /* if the server is share level then send a plaintext null
2102 password at this point. The password is sent in the tree
2103 connect */
2104
2105 if ((sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
2106 return cli_session_setup_plain(cli, user, "", workgroup);
2107
2108 /* if the server doesn't support encryption then we have to use
2109 plaintext. The second password is ignored */
2110
2111 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
2112 if (!lp_client_plaintext_auth() && (*pass)) {
2113 DEBUG(1, ("Server requested PLAINTEXT password but 'client plaintext auth = no'"
2114 " or 'client ntlmv2 auth = yes'\n"));
2115 return NT_STATUS_ACCESS_DENIED;
2116 }
2117 return cli_session_setup_plain(cli, user, pass, workgroup);
2118 }
2119
2120 /* if the server supports extended security then use SPNEGO */
2121
2122 if (smb1cli_conn_capabilities(cli->conn) & CAP_EXTENDED_SECURITY) {
2123 const char *remote_realm = cli_state_remote_realm(cli);
2124 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2125 workgroup,
2126 remote_realm);
2127 if (!ADS_ERR_OK(status)) {
2128 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
2129 return ads_ntstatus(status);
2130 }
2131 } else {
2132 NTSTATUS status;
2133
2134 /* otherwise do a NT1 style session setup */
2135 status = cli_session_setup_nt1(cli, user, pass, passlen,
2136 ntpass, ntpasslen, workgroup);
2137 if (!NT_STATUS_IS_OK(status)) {
2138 DEBUG(3,("cli_session_setup: NT1 session setup "
2139 "failed: %s\n", nt_errstr(status)));
2140 return status;
2141 }
2142 }
2143
2144 return NT_STATUS_OK;
2145 }
2146
2147 /****************************************************************************
2148 Send a uloggoff.
2149 *****************************************************************************/
2150
2151 struct cli_ulogoff_state {
2152 struct cli_state *cli;
2153 uint16_t vwv[3];
2154 };
2155
2156 static void cli_ulogoff_done(struct tevent_req *subreq);
2157
2158 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
2159 struct tevent_context *ev,
2160 struct cli_state *cli)
2161 {
2162 struct tevent_req *req, *subreq;
2163 struct cli_ulogoff_state *state;
2164
2165 req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
2166 if (req == NULL) {
2167 return NULL;
2168 }
2169 state->cli = cli;
2170
2171 SCVAL(state->vwv+0, 0, 0xFF);
2172 SCVAL(state->vwv+1, 0, 0);
2173 SSVAL(state->vwv+2, 0, 0);
2174
2175 subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
2176 0, NULL);
2177 if (tevent_req_nomem(subreq, req)) {
2178 return tevent_req_post(req, ev);
2179 }
2180 tevent_req_set_callback(subreq, cli_ulogoff_done, req);
2181 return req;
2182 }
2183
2184 static void cli_ulogoff_done(struct tevent_req *subreq)
2185 {
2186 struct tevent_req *req = tevent_req_callback_data(
2187 subreq, struct tevent_req);
2188 struct cli_ulogoff_state *state = tevent_req_data(
2189 req, struct cli_ulogoff_state);
2190 NTSTATUS status;
2191
2192 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2193 if (!NT_STATUS_IS_OK(status)) {
2194 tevent_req_nterror(req, status);
2195 return;
2196 }
2197 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
2198 tevent_req_done(req);
2199 }
2200
2201 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
2202 {
2203 return tevent_req_simple_recv_ntstatus(req);
2204 }
2205
2206 NTSTATUS cli_ulogoff(struct cli_state *cli)
2207 {
2208 struct tevent_context *ev;
2209 struct tevent_req *req;
2210 NTSTATUS status = NT_STATUS_NO_MEMORY;
2211
2212 if (smbXcli_conn_has_async_calls(cli->conn)) {
2213 return NT_STATUS_INVALID_PARAMETER;
2214 }
2215 ev = tevent_context_init(talloc_tos());
2216 if (ev == NULL) {
2217 goto fail;
2218 }
2219 req = cli_ulogoff_send(ev, ev, cli);
2220 if (req == NULL) {
2221 goto fail;
2222 }
2223 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2224 goto fail;
2225 }
2226 status = cli_ulogoff_recv(req);
2227 fail:
2228 TALLOC_FREE(ev);
2229 return status;
2230 }
2231
2232 /****************************************************************************
2233 Send a tconX.
2234 ****************************************************************************/
2235
2236 struct cli_tcon_andx_state {
2237 struct cli_state *cli;
2238 uint16_t vwv[4];
2239 struct iovec bytes;
2240 };
2241
2242 static void cli_tcon_andx_done(struct tevent_req *subreq);
2243
2244 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
2245 struct event_context *ev,
2246 struct cli_state *cli,
2247 const char *share, const char *dev,
2248 const char *pass, int passlen,
2249 struct tevent_req **psmbreq)
2250 {
2251 struct tevent_req *req, *subreq;
2252 struct cli_tcon_andx_state *state;
2253 uint8_t p24[24];
2254 uint16_t *vwv;
2255 char *tmp = NULL;
2256 uint8_t *bytes;
2257 uint16_t sec_mode = smb1cli_conn_server_security_mode(cli->conn);
2258 uint16_t tcon_flags = 0;
2259
2260 *psmbreq = NULL;
2261
2262 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
2263 if (req == NULL) {
2264 return NULL;
2265 }
2266 state->cli = cli;
2267 vwv = state->vwv;
2268
2269 cli->share = talloc_strdup(cli, share);
2270 if (!cli->share) {
2271 return NULL;
2272 }
2273
2274 /* in user level security don't send a password now */
2275 if (sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
2276 passlen = 1;
2277 pass = "";
2278 } else if (pass == NULL) {
2279 DEBUG(1, ("Server not using user level security and no "
2280 "password supplied.\n"));
2281 goto access_denied;
2282 }
2283
2284 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
2285 *pass && passlen != 24) {
2286 if (!lp_client_lanman_auth()) {
2287 DEBUG(1, ("Server requested LANMAN password "
2288 "(share-level security) but "
2289 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2290 goto access_denied;
2291 }
2292
2293 /*
2294 * Non-encrypted passwords - convert to DOS codepage before
2295 * encryption.
2296 */
2297 SMBencrypt(pass, smb1cli_conn_server_challenge(cli->conn), p24);
2298 passlen = 24;
2299 pass = (const char *)p24;
2300 } else {
2301 if((sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
2302 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
2303 == 0) {
2304 uint8_t *tmp_pass;
2305
2306 if (!lp_client_plaintext_auth() && (*pass)) {
2307 DEBUG(1, ("Server requested PLAINTEXT "
2308 "password but "
2309 "'client plaintext auth = no' or 'client ntlmv2 auth = yes'\n"));
2310 goto access_denied;
2311 }
2312
2313 /*
2314 * Non-encrypted passwords - convert to DOS codepage
2315 * before using.
2316 */
2317 tmp_pass = talloc_array(talloc_tos(), uint8, 0);
2318 if (tevent_req_nomem(tmp_pass, req)) {
2319 return tevent_req_post(req, ev);
2320 }
2321 tmp_pass = trans2_bytes_push_str(tmp_pass,
2322 false, /* always DOS */
2323 pass,
2324 passlen,
2325 NULL);
2326 if (tevent_req_nomem(tmp_pass, req)) {
2327 return tevent_req_post(req, ev);
2328 }
2329 pass = (const char *)tmp_pass;
2330 passlen = talloc_get_size(tmp_pass);
2331 }
2332 }
2333
2334 tcon_flags |= TCONX_FLAG_EXTENDED_RESPONSE;
2335
2336 SCVAL(vwv+0, 0, 0xFF);
2337 SCVAL(vwv+0, 1, 0);
2338 SSVAL(vwv+1, 0, 0);
2339 SSVAL(vwv+2, 0, tcon_flags);
2340 SSVAL(vwv+3, 0, passlen);
2341
2342 if (passlen && pass) {
2343 bytes = (uint8_t *)talloc_memdup(state, pass, passlen);
2344 } else {
2345 bytes = talloc_array(state, uint8_t, 0);
2346 }
2347
2348 /*
2349 * Add the sharename
2350 */
2351 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
2352 smbXcli_conn_remote_name(cli->conn), share);
2353 if (tmp == NULL) {
2354 TALLOC_FREE(req);
2355 return NULL;
2356 }
2357 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), tmp, strlen(tmp)+1,
2358 NULL);
2359 TALLOC_FREE(tmp);
2360
2361 /*
2362 * Add the devicetype
2363 */
2364 tmp = talloc_strdup_upper(talloc_tos(), dev);
2365 if (tmp == NULL) {
2366 TALLOC_FREE(req);
2367 return NULL;
2368 }
2369 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
2370 TALLOC_FREE(tmp);
2371
2372 if (bytes == NULL) {
2373 TALLOC_FREE(req);
2374 return NULL;
2375 }
2376
2377 state->bytes.iov_base = (void *)bytes;
2378 state->bytes.iov_len = talloc_get_size(bytes);
2379
2380 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
2381 1, &state->bytes);
2382 if (subreq == NULL) {
2383 TALLOC_FREE(req);
2384 return NULL;
2385 }
2386 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
2387 *psmbreq = subreq;
2388 return req;
2389
2390 access_denied:
2391 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2392 return tevent_req_post(req, ev);
2393 }
2394
2395 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
2396 struct event_context *ev,
2397 struct cli_state *cli,
2398 const char *share, const char *dev,
2399 const char *pass, int passlen)
2400 {
2401 struct tevent_req *req, *subreq;
2402 NTSTATUS status;
2403
2404 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
2405 &subreq);
2406 if (req == NULL) {
2407 return NULL;
2408 }
2409 if (subreq == NULL) {
2410 return req;
2411 }
2412 status = smb1cli_req_chain_submit(&subreq, 1);
2413 if (!NT_STATUS_IS_OK(status)) {
2414 tevent_req_nterror(req, status);
2415 return tevent_req_post(req, ev);
2416 }
2417 return req;
2418 }
2419
2420 static void cli_tcon_andx_done(struct tevent_req *subreq)
2421 {
2422 struct tevent_req *req = tevent_req_callback_data(
2423 subreq, struct tevent_req);
2424 struct cli_tcon_andx_state *state = tevent_req_data(
2425 req, struct cli_tcon_andx_state);
2426 struct cli_state *cli = state->cli;
2427 uint8_t *in;
2428 uint8_t *inhdr;
2429 uint8_t wct;
2430 uint16_t *vwv;
2431 uint32_t num_bytes;
2432 uint8_t *bytes;
2433 NTSTATUS status;
2434
2435 status = cli_smb_recv(subreq, state, &in, 0, &wct, &vwv,
2436 &num_bytes, &bytes);
2437 TALLOC_FREE(subreq);
2438 if (!NT_STATUS_IS_OK(status)) {
2439 tevent_req_nterror(req, status);
2440 return;
2441 }
2442
2443 inhdr = in + NBT_HDR_SIZE;
2444
2445 if (num_bytes) {
2446 if (clistr_pull_talloc(cli,
2447 (const char *)inhdr,
2448 SVAL(inhdr, HDR_FLG2),
2449 &cli->dev,
2450 bytes,
2451 num_bytes,
2452 STR_TERMINATE|STR_ASCII) == -1) {
2453 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2454 return;
2455 }
2456 } else {
2457 cli->dev = talloc_strdup(cli, "");
2458 if (cli->dev == NULL) {
2459 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2460 return;
2461 }
2462 }
2463
2464 if ((smbXcli_conn_protocol(cli->conn) >= PROTOCOL_NT1) && (num_bytes == 3)) {
2465 /* almost certainly win95 - enable bug fixes */
2466 cli->win95 = True;
2467 }
2468
2469 /*
2470 * Make sure that we have the optional support 16-bit field. WCT > 2.
2471 * Avoids issues when connecting to Win9x boxes sharing files
2472 */
2473
2474 cli->dfsroot = false;
2475
2476 if ((wct > 2) && (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_LANMAN2)) {
2477 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
2478 }
2479
2480 cli_state_set_tid(cli, SVAL(inhdr, HDR_TID));
2481 tevent_req_done(req);
2482 }
2483
2484 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
2485 {
2486 return tevent_req_simple_recv_ntstatus(req);
2487 }
2488
2489 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
2490 const char *dev, const char *pass, int passlen)
2491 {
2492 TALLOC_CTX *frame = talloc_stackframe();
2493 struct event_context *ev;
2494 struct tevent_req *req;
2495 NTSTATUS status = NT_STATUS_OK;
2496
2497 if (smbXcli_conn_has_async_calls(cli->conn)) {
2498 /*
2499 * Can't use sync call while an async call is in flight
2500 */
2501 status = NT_STATUS_INVALID_PARAMETER;
2502 goto fail;
2503 }
2504
2505 ev = event_context_init(frame);
2506 if (ev == NULL) {
2507 status = NT_STATUS_NO_MEMORY;
2508 goto fail;
2509 }
2510
2511 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
2512 if (req == NULL) {
2513 status = NT_STATUS_NO_MEMORY;
2514 goto fail;
2515 }
2516
2517 if (!tevent_req_poll(req, ev)) {
2518 status = map_nt_error_from_unix(errno);
2519 goto fail;
2520 }
2521
2522 status = cli_tcon_andx_recv(req);
2523 fail:
2524 TALLOC_FREE(frame);
2525 return status;
2526 }
2527
2528 NTSTATUS cli_tree_connect(struct cli_state *cli, const char *share,
2529 const char *dev, const char *pass, int passlen)
2530 {
2531 NTSTATUS status;
2532 uint16_t max_xmit = 0;
2533 uint16_t tid = 0;
2534
2535 cli->share = talloc_strdup(cli, share);
2536 if (!cli->share) {
2537 return NT_STATUS_NO_MEMORY;
2538 }
2539
2540 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2541 return smb2cli_tcon(cli, share);
2542 }
2543
2544 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_LANMAN1) {
2545 return cli_tcon_andx(cli, share, dev, pass, passlen);
2546 }
2547
2548 status = cli_raw_tcon(cli, share, pass, dev, &max_xmit, &tid);
2549 if (!NT_STATUS_IS_OK(status)) {
2550 return status;
2551 }
2552
2553 cli_state_set_tid(cli, tid);
2554
2555 return NT_STATUS_OK;
2556 }
2557
2558 /****************************************************************************
2559 Send a tree disconnect.
2560 ****************************************************************************/
2561
2562 struct cli_tdis_state {
2563 struct cli_state *cli;
2564 };
2565
2566 static void cli_tdis_done(struct tevent_req *subreq);
2567
2568 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
2569 struct tevent_context *ev,
2570 struct cli_state *cli)
2571 {
2572 struct tevent_req *req, *subreq;
2573 struct cli_tdis_state *state;
2574
2575 req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
2576 if (req == NULL) {
2577 return NULL;
2578 }
2579 state->cli = cli;
2580
2581 subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
2582 if (tevent_req_nomem(subreq, req)) {
2583 return tevent_req_post(req, ev);
2584 }
2585 tevent_req_set_callback(subreq, cli_tdis_done, req);
2586 return req;
2587 }
2588
2589 static void cli_tdis_done(struct tevent_req *subreq)
2590 {
2591 struct tevent_req *req = tevent_req_callback_data(
2592 subreq, struct tevent_req);
2593 struct cli_tdis_state *state = tevent_req_data(
2594 req, struct cli_tdis_state);
2595 NTSTATUS status;
2596
2597 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2598 TALLOC_FREE(subreq);
2599 if (!NT_STATUS_IS_OK(status)) {
2600 tevent_req_nterror(req, status);
2601 return;
2602 }
2603 cli_state_set_tid(state->cli, UINT16_MAX);
2604 tevent_req_done(req);
2605 }
2606
2607 NTSTATUS cli_tdis_recv(struct tevent_req *req)
2608 {
2609 return tevent_req_simple_recv_ntstatus(req);
2610 }
2611
2612 NTSTATUS cli_tdis(struct cli_state *cli)
2613 {
2614 struct tevent_context *ev;
2615 struct tevent_req *req;
2616 NTSTATUS status = NT_STATUS_NO_MEMORY;
2617
2618 if (smbXcli_conn_has_async_calls(cli->conn)) {
2619 return NT_STATUS_INVALID_PARAMETER;
2620 }
2621 ev = tevent_context_init(talloc_tos());
2622 if (ev == NULL) {
2623 goto fail;
2624 }
2625 req = cli_tdis_send(ev, ev, cli);
2626 if (req == NULL) {
2627 goto fail;
2628 }
2629 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2630 goto fail;
2631 }
2632 status = cli_tdis_recv(req);
2633 fail:
2634 TALLOC_FREE(ev);
2635 return status;
2636 }
2637
2638 static NTSTATUS cli_connect_sock(const char *host, int name_type,
2639 const struct sockaddr_storage *pss,
2640 const char *myname, uint16_t port,
2641 int sec_timeout, int *pfd, uint16_t *pport)
2642 {
2643 TALLOC_CTX *frame = talloc_stackframe();
2644 const char *prog;
2645 unsigned int i, num_addrs;
2646 const char **called_names;
2647 const char **calling_names;
2648 int *called_types;
2649 NTSTATUS status;
2650 int fd;
2651
2652 prog = getenv("LIBSMB_PROG");
2653 if (prog != NULL) {
2654 fd = sock_exec(prog);
2655 if (fd == -1) {
2656 return map_nt_error_from_unix(errno);
2657 }
2658 port = 0;
2659 goto done;
2660 }
2661
2662 if ((pss == NULL) || is_zero_addr(pss)) {
2663 struct sockaddr_storage *addrs;
2664 status = resolve_name_list(talloc_tos(), host, name_type,
2665 &addrs, &num_addrs);
2666 if (!NT_STATUS_IS_OK(status)) {
2667 goto fail;
2668 }
2669 pss = addrs;
2670 } else {
2671 num_addrs = 1;
2672 }
2673
2674 called_names = talloc_array(talloc_tos(), const char *, num_addrs);
2675 if (called_names == NULL) {
2676 status = NT_STATUS_NO_MEMORY;
2677 goto fail;
2678 }
2679 called_types = talloc_array(talloc_tos(), int, num_addrs);
2680 if (called_types == NULL) {
2681 status = NT_STATUS_NO_MEMORY;
2682 goto fail;
2683 }
2684 calling_names = talloc_array(talloc_tos(), const char *, num_addrs);
2685 if (calling_names == NULL) {
2686 status = NT_STATUS_NO_MEMORY;
2687 goto fail;
2688 }
2689 for (i=0; i<num_addrs; i++) {
2690 called_names[i] = host;
2691 called_types[i] = name_type;
2692 calling_names[i] = myname;
2693 }
2694 status = smbsock_any_connect(pss, called_names, called_types,
2695 calling_names, NULL, num_addrs, port,
2696 sec_timeout, &fd, NULL, &port);
2697 if (!NT_STATUS_IS_OK(status)) {
2698 goto fail;
2699 }
2700 set_socket_options(fd, lp_socket_options());
2701 done:
2702 *pfd = fd;
2703 *pport = port;
2704 status = NT_STATUS_OK;
2705 fail:
2706 TALLOC_FREE(frame);
2707 return status;
2708 }
2709
2710 NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss,
2711 uint16_t port, int name_type, const char *myname,
2712 int signing_state, int flags, struct cli_state **pcli)
2713 {
2714 TALLOC_CTX *frame = talloc_stackframe();
2715 struct cli_state *cli;
2716 NTSTATUS status = NT_STATUS_NO_MEMORY;
2717 int fd = -1;
2718 char *desthost;
2719 char *p;
2720
2721 desthost = talloc_strdup(talloc_tos(), host);
2722 if (desthost == NULL) {
2723 goto fail;
2724 }
2725
2726 p = strchr(host, '#');
2727 if (p != NULL) {
2728 name_type = strtol(p+1, NULL, 16);
2729 host = talloc_strndup(talloc_tos(), host, p - host);
2730 if (host == NULL) {
2731 goto fail;
2732 }
2733 }
2734
2735 status = cli_connect_sock(host, name_type, dest_ss, myname, port,
2736 20, &fd, &port);
2737 if (!NT_STATUS_IS_OK(status)) {
2738 goto fail;
2739 }
2740
2741 cli = cli_state_create(NULL, fd, desthost, NULL, signing_state, flags);
2742 if (cli == NULL) {
2743 close(fd);
2744 fd = -1;
2745 goto fail;
2746 }
2747
2748 *pcli = cli;
2749 status = NT_STATUS_OK;
2750 fail:
2751 TALLOC_FREE(frame);
2752 return status;
2753 }
2754
2755 /**
2756 establishes a connection to after the negprot.
2757 @param output_cli A fully initialised cli structure, non-null only on success
2758 @param dest_host The netbios name of the remote host
2759 @param dest_ss (optional) The the destination IP, NULL for name based lookup
2760 @param port (optional) The destination port (0 for default)
2761 */
2762 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2763 const char *my_name,
2764 const char *dest_host,
2765 const struct sockaddr_storage *dest_ss, int port,
2766 int signing_state, int flags)
2767 {
2768 NTSTATUS nt_status;
2769 struct cli_state *cli;
2770
2771 nt_status = cli_connect_nb(dest_host, dest_ss, port, 0x20, my_name,
2772 signing_state, flags, &cli);
2773 if (!NT_STATUS_IS_OK(nt_status)) {
2774 DEBUG(10, ("cli_connect_nb failed: %s\n",
2775 nt_errstr(nt_status)));
2776 return nt_status;
2777 }
2778
2779 nt_status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
2780 PROTOCOL_NT1);
2781 if (!NT_STATUS_IS_OK(nt_status)) {
2782 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2783 cli_shutdown(cli);
2784 return nt_status;
2785 }
2786
2787 *output_cli = cli;
2788 return NT_STATUS_OK;
2789 }
2790
2791
2792 /**
2793 establishes a connection right up to doing tconX, password specified.
2794 @param output_cli A fully initialised cli structure, non-null only on success
2795 @param dest_host The netbios name of the remote host
2796 @param dest_ip (optional) The the destination IP, NULL for name based lookup
2797 @param port (optional) The destination port (0 for default)
2798 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
2799 @param service_type The 'type' of serivice.
2800 @param user Username, unix string
2801 @param domain User's domain
2802 @param password User's password, unencrypted unix string.
2803 */
2804
2805 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2806 const char *my_name,
2807 const char *dest_host,
2808 const struct sockaddr_storage *dest_ss, int port,
2809 const char *service, const char *service_type,
2810 const char *user, const char *domain,
2811 const char *password, int flags,
2812 int signing_state)
2813 {
2814 NTSTATUS nt_status;
2815 struct cli_state *cli = NULL;
2816 int pw_len = password ? strlen(password)+1 : 0;
2817
2818 *output_cli = NULL;
2819
2820 if (password == NULL) {
2821 password = "";
2822 }
2823
2824 nt_status = cli_start_connection(&cli, my_name, dest_host,
2825 dest_ss, port, signing_state,
2826 flags);
2827
2828 if (!NT_STATUS_IS_OK(nt_status)) {
2829 return nt_status;
2830 }
2831
2832 nt_status = cli_session_setup(cli, user, password, pw_len, password,
2833 pw_len, domain);
2834 if (!NT_STATUS_IS_OK(nt_status)) {
2835
2836 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2837 DEBUG(1,("failed session setup with %s\n",
2838 nt_errstr(nt_status)));
2839 cli_shutdown(cli);
2840 return nt_status;
2841 }
2842
2843 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2844 if (!NT_STATUS_IS_OK(nt_status)) {
2845 DEBUG(1,("anonymous failed session setup with %s\n",
2846 nt_errstr(nt_status)));
2847 cli_shutdown(cli);
2848 return nt_status;
2849 }
2850 }
2851
2852 if (service) {
2853 nt_status = cli_tree_connect(cli, service, service_type,
2854 password, pw_len);
2855 if (!NT_STATUS_IS_OK(nt_status)) {
2856 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2857 cli_shutdown(cli);
2858 if (NT_STATUS_IS_OK(nt_status)) {
2859 nt_status = NT_STATUS_UNSUCCESSFUL;
2860 }
2861 return nt_status;
2862 }
2863 }
2864
2865 nt_status = cli_init_creds(cli, user, domain, password);
2866 if (!NT_STATUS_IS_OK(nt_status)) {
2867 cli_shutdown(cli);
2868 return nt_status;
2869 }
2870
2871 *output_cli = cli;
2872 return NT_STATUS_OK;
2873 }
2874
2875 /****************************************************************************
2876 Send an old style tcon.
2877 ****************************************************************************/
2878 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2879 const char *service, const char *pass, const char *dev,
2880 uint16 *max_xmit, uint16 *tid)
2881 {
2882 struct tevent_req *req;
2883 uint16_t *ret_vwv;
2884 uint8_t *bytes;
2885 NTSTATUS status;
2886
2887 if (!lp_client_plaintext_auth() && (*pass)) {
2888 DEBUG(1, ("Server requested PLAINTEXT password but 'client plaintext auth = no'"
2889 " or 'client ntlmv2 auth = yes'\n"));
2890 return NT_STATUS_ACCESS_DENIED;
2891 }
2892
2893 bytes = talloc_array(talloc_tos(), uint8_t, 0);
2894 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2895 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
2896 service, strlen(service)+1, NULL);
2897 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2898 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
2899 pass, strlen(pass)+1, NULL);
2900 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2901 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
2902 dev, strlen(dev)+1, NULL);
2903
2904 status = cli_smb(talloc_tos(), cli, SMBtcon, 0, 0, NULL,
2905 talloc_get_size(bytes), bytes, &req,
2906 2, NULL, &ret_vwv, NULL, NULL);
2907 if (!NT_STATUS_IS_OK(status)) {
2908 return status;
2909 }
2910
2911 *max_xmit = SVAL(ret_vwv + 0, 0);
2912 *tid = SVAL(ret_vwv + 1, 0);
2913
2914 return NT_STATUS_OK;
2915 }
2916
2917 /* Return a cli_state pointing at the IPC$ share for the given server */
2918
2919 struct cli_state *get_ipc_connect(char *server,
2920 struct sockaddr_storage *server_ss,
2921 const struct user_auth_info *user_info)
2922 {
2923 struct cli_state *cli;
2924 NTSTATUS nt_status;
2925 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2926
2927 if (user_info->use_kerberos) {
2928 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2929 }
2930
2931 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2932 user_info->username ? user_info->username : "",
2933 lp_workgroup(),
2934 user_info->password ? user_info->password : "",
2935 flags,
2936 SMB_SIGNING_DEFAULT);
2937
2938 if (NT_STATUS_IS_OK(nt_status)) {
2939 return cli;
2940 } else if (is_ipaddress(server)) {
2941 /* windows 9* needs a correct NMB name for connections */
2942 fstring remote_name;
2943
2944 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2945 cli = get_ipc_connect(remote_name, server_ss, user_info);
2946 if (cli)
2947 return cli;
2948 }
2949 }
2950 return NULL;
2951 }
2952
2953 /*
2954 * Given the IP address of a master browser on the network, return its
2955 * workgroup and connect to it.
2956 *
2957 * This function is provided to allow additional processing beyond what
2958 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2959 * browsers and obtain each master browsers' list of domains (in case the
2960 * first master browser is recently on the network and has not yet
2961 * synchronized with other master browsers and therefore does not yet have the
2962 * entire network browse list)
2963 */
2964
2965 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2966 struct sockaddr_storage *mb_ip,
2967 const struct user_auth_info *user_info,
2968 char **pp_workgroup_out)
2969 {
2970 char addr[INET6_ADDRSTRLEN];
2971 fstring name;
2972 struct cli_state *cli;
2973 struct sockaddr_storage server_ss;
2974
2975 *pp_workgroup_out = NULL;
2976
2977 print_sockaddr(addr, sizeof(addr), mb_ip);
2978 DEBUG(99, ("Looking up name of master browser %s\n",
2979 addr));
2980
2981 /*
2982 * Do a name status query to find out the name of the master browser.
2983 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2984 * master browser will not respond to a wildcard query (or, at least,
2985 * an NT4 server acting as the domain master browser will not).
2986 *
2987 * We might be able to use ONLY the query on MSBROWSE, but that's not
2988 * yet been tested with all Windows versions, so until it is, leave
2989 * the original wildcard query as the first choice and fall back to
2990 * MSBROWSE if the wildcard query fails.
2991 */
2992 if (!name_status_find("*", 0, 0x1d, mb_ip, name) &&
2993 !name_status_find(MSBROWSE, 1, 0x1d, mb_ip, name)) {
2994
2995 DEBUG(99, ("Could not retrieve name status for %s\n",
2996 addr));
2997 return NULL;
2998 }
2999
3000 if (!find_master_ip(name, &server_ss)) {
3001 DEBUG(99, ("Could not find master ip for %s\n", name));
3002 return NULL;
3003 }
3004
3005 *pp_workgroup_out = talloc_strdup(ctx, name);
3006
3007 DEBUG(4, ("found master browser %s, %s\n", name, addr));
3008
3009 print_sockaddr(addr, sizeof(addr), &server_ss);
3010 cli = get_ipc_connect(addr, &server_ss, user_info);
3011
3012 return cli;
3013 }
3014
3015 /*
3016 * Return the IP address and workgroup of a master browser on the network, and
3017 * connect to it.
3018 */
3019
3020 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
3021 const struct user_auth_info *user_info,
3022 char **pp_workgroup_out)
3023 {
3024 struct sockaddr_storage *ip_list;
3025 struct cli_state *cli;
3026 int i, count;
3027 NTSTATUS status;
3028
3029 *pp_workgroup_out = NULL;
3030
3031 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
3032
3033 /* Go looking for workgroups by broadcasting on the local network */
3034
3035 status = name_resolve_bcast(MSBROWSE, 1, talloc_tos(),
3036 &ip_list, &count);
3037 if (!NT_STATUS_IS_OK(status)) {
3038 DEBUG(99, ("No master browsers responded: %s\n",
3039 nt_errstr(status)));
3040 return NULL;
3041 }
3042
3043 for (i = 0; i < count; i++) {
3044 char addr[INET6_ADDRSTRLEN];
3045 print_sockaddr(addr, sizeof(addr), &ip_list[i]);
3046 DEBUG(99, ("Found master browser %s\n", addr));
3047
3048 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
3049 user_info, pp_workgroup_out);
3050 if (cli)
3051 return(cli);
3052 }
3053
3054 return NULL;
3055 }
reg import