?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix connect to port 139 only -- thanks gd for bugging me :-)
[Samba/gebeck_regimport.git] / source3 / libsmb / cliconnect.c
blob525c361bebfa3334882bbbfada05f637a7c5361b
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 static const struct {
24 int prot;
25 const char name[24];
26 } prots[10] = {
27 {PROTOCOL_CORE, "PC NETWORK PROGRAM 1.0"},
28 {PROTOCOL_COREPLUS, "MICROSOFT NETWORKS 1.03"},
29 {PROTOCOL_LANMAN1, "MICROSOFT NETWORKS 3.0"},
30 {PROTOCOL_LANMAN1, "LANMAN1.0"},
31 {PROTOCOL_LANMAN2, "LM1.2X002"},
32 {PROTOCOL_LANMAN2, "DOS LANMAN2.1"},
33 {PROTOCOL_LANMAN2, "LANMAN2.1"},
34 {PROTOCOL_LANMAN2, "Samba"},
35 {PROTOCOL_NT1, "NT LANMAN 1.0"},
36 {PROTOCOL_NT1, "NT LM 0.12"},
37 };
38
39 #define STAR_SMBSERVER "*SMBSERVER"
40
41 /**
42 * Set the user session key for a connection
43 * @param cli The cli structure to add it too
44 * @param session_key The session key used. (A copy of this is taken for the cli struct)
45 *
46 */
47
48 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
49 {
50 cli->user_session_key = data_blob(session_key.data, session_key.length);
51 }
52
53 /****************************************************************************
54 Do an old lanman2 style session setup.
55 ****************************************************************************/
56
57 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
58 const char *user,
59 const char *pass, size_t passlen,
60 const char *workgroup)
61 {
62 DATA_BLOB session_key = data_blob_null;
63 DATA_BLOB lm_response = data_blob_null;
64 NTSTATUS status;
65 fstring pword;
66 char *p;
67
68 if (passlen > sizeof(pword)-1) {
69 return NT_STATUS_INVALID_PARAMETER;
70 }
71
72 /* LANMAN servers predate NT status codes and Unicode and ignore those
73 smb flags so we must disable the corresponding default capabilities
74 that would otherwise cause the Unicode and NT Status flags to be
75 set (and even returned by the server) */
76
77 cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
78
79 /* if in share level security then don't send a password now */
80 if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
81 passlen = 0;
82
83 if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
84 /* Encrypted mode needed, and non encrypted password supplied. */
85 lm_response = data_blob(NULL, 24);
86 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
87 DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
88 return NT_STATUS_ACCESS_DENIED;
89 }
90 } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
91 /* Encrypted mode needed, and encrypted password supplied. */
92 lm_response = data_blob(pass, passlen);
93 } else if (passlen > 0) {
94 /* Plaintext mode needed, assume plaintext supplied. */
95 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
96 lm_response = data_blob(pass, passlen);
97 }
98
99 /* send a session setup command */
100 memset(cli->outbuf,'\0',smb_size);
101 cli_set_message(cli->outbuf,10, 0, True);
102 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
103 cli_setup_packet(cli);
104
105 SCVAL(cli->outbuf,smb_vwv0,0xFF);
106 SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
107 SSVAL(cli->outbuf,smb_vwv3,2);
108 SSVAL(cli->outbuf,smb_vwv4,1);
109 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
110 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
111
112 p = smb_buf(cli->outbuf);
113 memcpy(p,lm_response.data,lm_response.length);
114 p += lm_response.length;
115 p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
116 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
117 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
118 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
119 cli_setup_bcc(cli, p);
120
121 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
122 return cli_nt_error(cli);
123 }
124
125 show_msg(cli->inbuf);
126
127 if (cli_is_error(cli)) {
128 return cli_nt_error(cli);
129 }
130
131 /* use the returned vuid from now on */
132 cli->vuid = SVAL(cli->inbuf,smb_uid);
133 status = cli_set_username(cli, user);
134 if (!NT_STATUS_IS_OK(status)) {
135 return status;
136 }
137
138 if (session_key.data) {
139 /* Have plaintext orginal */
140 cli_set_session_key(cli, session_key);
141 }
142
143 return NT_STATUS_OK;
144 }
145
146 /****************************************************************************
147 Work out suitable capabilities to offer the server.
148 ****************************************************************************/
149
150 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
151 {
152 uint32 capabilities = CAP_NT_SMBS;
153
154 if (!cli->force_dos_errors)
155 capabilities |= CAP_STATUS32;
156
157 if (cli->use_level_II_oplocks)
158 capabilities |= CAP_LEVEL_II_OPLOCKS;
159
160 capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
161 return capabilities;
162 }
163
164 /****************************************************************************
165 Do a NT1 guest session setup.
166 ****************************************************************************/
167
168 struct async_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
169 struct event_context *ev,
170 struct cli_state *cli)
171 {
172 struct async_req *result;
173 uint16_t vwv[13];
174 uint8_t *bytes;
175
176 SCVAL(vwv+0, 0, 0xFF);
177 SCVAL(vwv+0, 1, 0);
178 SSVAL(vwv+1, 0, 0);
179 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
180 SSVAL(vwv+3, 0, 2);
181 SSVAL(vwv+4, 0, cli->pid);
182 SIVAL(vwv+5, 0, cli->sesskey);
183 SSVAL(vwv+7, 0, 0);
184 SSVAL(vwv+8, 0, 0);
185 SSVAL(vwv+9, 0, 0);
186 SSVAL(vwv+10, 0, 0);
187 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
188
189 bytes = talloc_array(talloc_tos(), uint8_t, 0);
190
191 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* username */
192 NULL);
193 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
194 NULL);
195 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
196 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
197
198 if (bytes == NULL) {
199 return NULL;
200 }
201
202 result = cli_request_send(mem_ctx, ev, cli, SMBsesssetupX, 0,
203 13, vwv, 0, talloc_get_size(bytes), bytes);
204 TALLOC_FREE(bytes);
205 return result;
206 }
207
208 NTSTATUS cli_session_setup_guest_recv(struct async_req *req)
209 {
210 struct cli_request *cli_req = talloc_get_type_abort(
211 req->private_data, struct cli_request);
212 struct cli_state *cli = cli_req->cli;
213 uint8_t wct;
214 uint16_t *vwv;
215 uint16_t num_bytes;
216 uint8_t *bytes;
217 uint8_t *p;
218 NTSTATUS status;
219
220 if (async_req_is_nterror(req, &status)) {
221 return status;
222 }
223
224 status = cli_pull_reply(req, &wct, &vwv, &num_bytes, &bytes);
225 if (!NT_STATUS_IS_OK(status)) {
226 return status;
227 }
228
229 p = bytes;
230
231 cli->vuid = SVAL(cli_req->inbuf, smb_uid);
232
233 p += clistr_pull(cli_req->inbuf, cli->server_os, (char *)p,
234 sizeof(fstring), bytes+num_bytes-p, STR_TERMINATE);
235 p += clistr_pull(cli_req->inbuf, cli->server_type, (char *)p,
236 sizeof(fstring), bytes+num_bytes-p, STR_TERMINATE);
237 p += clistr_pull(cli_req->inbuf, cli->server_domain, (char *)p,
238 sizeof(fstring), bytes+num_bytes-p, STR_TERMINATE);
239
240 if (strstr(cli->server_type, "Samba")) {
241 cli->is_samba = True;
242 }
243
244 status = cli_set_username(cli, "");
245 if (!NT_STATUS_IS_OK(status)) {
246 return status;
247 }
248
249 return NT_STATUS_OK;
250 }
251
252 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
253 {
254 TALLOC_CTX *frame = talloc_stackframe();
255 struct event_context *ev;
256 struct async_req *req;
257 NTSTATUS status;
258
259 if (cli->fd_event != NULL) {
260 /*
261 * Can't use sync call while an async call is in flight
262 */
263 status = NT_STATUS_INVALID_PARAMETER;
264 goto fail;
265 }
266
267 ev = event_context_init(frame);
268 if (ev == NULL) {
269 status = NT_STATUS_NO_MEMORY;
270 goto fail;
271 }
272
273 req = cli_session_setup_guest_send(frame, ev, cli);
274 if (req == NULL) {
275 status = NT_STATUS_NO_MEMORY;
276 goto fail;
277 }
278
279 while (req->state < ASYNC_REQ_DONE) {
280 event_loop_once(ev);
281 }
282
283 status = cli_session_setup_guest_recv(req);
284 fail:
285 TALLOC_FREE(frame);
286 return status;
287 }
288
289 /****************************************************************************
290 Do a NT1 plaintext session setup.
291 ****************************************************************************/
292
293 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
294 const char *user, const char *pass,
295 const char *workgroup)
296 {
297 uint32 capabilities = cli_session_setup_capabilities(cli);
298 char *p;
299 NTSTATUS status;
300 fstring lanman;
301
302 fstr_sprintf( lanman, "Samba %s", samba_version_string());
303
304 memset(cli->outbuf, '\0', smb_size);
305 cli_set_message(cli->outbuf,13,0,True);
306 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
307 cli_setup_packet(cli);
308
309 SCVAL(cli->outbuf,smb_vwv0,0xFF);
310 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
311 SSVAL(cli->outbuf,smb_vwv3,2);
312 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
313 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
314 SSVAL(cli->outbuf,smb_vwv8,0);
315 SIVAL(cli->outbuf,smb_vwv11,capabilities);
316 p = smb_buf(cli->outbuf);
317
318 /* check wether to send the ASCII or UNICODE version of the password */
319
320 if ( (capabilities & CAP_UNICODE) == 0 ) {
321 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
322 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
323 }
324 else {
325 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
326 * the space taken by the unicode password to be one byte too
327 * long (as we're on an odd byte boundary here). Reduce the
328 * count by 1 to cope with this. Fixes smbclient against NetApp
329 * servers which can't cope. Fix from
330 * bryan.kolodziej@allenlund.com in bug #3840.
331 */
332 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
333 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
334 }
335
336 p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
337 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
338 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
339 p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
340 cli_setup_bcc(cli, p);
341
342 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
343 return cli_nt_error(cli);
344 }
345
346 show_msg(cli->inbuf);
347
348 if (cli_is_error(cli)) {
349 return cli_nt_error(cli);
350 }
351
352 cli->vuid = SVAL(cli->inbuf,smb_uid);
353 p = smb_buf(cli->inbuf);
354 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
355 -1, STR_TERMINATE);
356 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
357 -1, STR_TERMINATE);
358 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
359 -1, STR_TERMINATE);
360 status = cli_set_username(cli, user);
361 if (!NT_STATUS_IS_OK(status)) {
362 return status;
363 }
364 if (strstr(cli->server_type, "Samba")) {
365 cli->is_samba = True;
366 }
367
368 return NT_STATUS_OK;
369 }
370
371 /****************************************************************************
372 do a NT1 NTLM/LM encrypted session setup - for when extended security
373 is not negotiated.
374 @param cli client state to create do session setup on
375 @param user username
376 @param pass *either* cleartext password (passlen !=24) or LM response.
377 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
378 @param workgroup The user's domain.
379 ****************************************************************************/
380
381 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
382 const char *pass, size_t passlen,
383 const char *ntpass, size_t ntpasslen,
384 const char *workgroup)
385 {
386 uint32 capabilities = cli_session_setup_capabilities(cli);
387 DATA_BLOB lm_response = data_blob_null;
388 DATA_BLOB nt_response = data_blob_null;
389 DATA_BLOB session_key = data_blob_null;
390 NTSTATUS result;
391 char *p;
392 bool ok;
393
394 if (passlen == 0) {
395 /* do nothing - guest login */
396 } else if (passlen != 24) {
397 if (lp_client_ntlmv2_auth()) {
398 DATA_BLOB server_chal;
399 DATA_BLOB names_blob;
400 server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
401
402 /* note that the 'workgroup' here is a best guess - we don't know
403 the server's domain at this point. The 'server name' is also
404 dodgy...
405 */
406 names_blob = NTLMv2_generate_names_blob(cli->called.name, workgroup);
407
408 if (!SMBNTLMv2encrypt(user, workgroup, pass, &server_chal,
409 &names_blob,
410 &lm_response, &nt_response, &session_key)) {
411 data_blob_free(&names_blob);
412 data_blob_free(&server_chal);
413 return NT_STATUS_ACCESS_DENIED;
414 }
415 data_blob_free(&names_blob);
416 data_blob_free(&server_chal);
417
418 } else {
419 uchar nt_hash[16];
420 E_md4hash(pass, nt_hash);
421
422 #ifdef LANMAN_ONLY
423 nt_response = data_blob_null;
424 #else
425 nt_response = data_blob(NULL, 24);
426 SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
427 #endif
428 /* non encrypted password supplied. Ignore ntpass. */
429 if (lp_client_lanman_auth()) {
430 lm_response = data_blob(NULL, 24);
431 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
432 /* Oops, the LM response is invalid, just put
433 the NT response there instead */
434 data_blob_free(&lm_response);
435 lm_response = data_blob(nt_response.data, nt_response.length);
436 }
437 } else {
438 /* LM disabled, place NT# in LM field instead */
439 lm_response = data_blob(nt_response.data, nt_response.length);
440 }
441
442 session_key = data_blob(NULL, 16);
443 #ifdef LANMAN_ONLY
444 E_deshash(pass, session_key.data);
445 memset(&session_key.data[8], '\0', 8);
446 #else
447 SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data);
448 #endif
449 }
450 cli_temp_set_signing(cli);
451 } else {
452 /* pre-encrypted password supplied. Only used for
453 security=server, can't do
454 signing because we don't have original key */
455
456 lm_response = data_blob(pass, passlen);
457 nt_response = data_blob(ntpass, ntpasslen);
458 }
459
460 /* send a session setup command */
461 memset(cli->outbuf,'\0',smb_size);
462
463 cli_set_message(cli->outbuf,13,0,True);
464 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
465 cli_setup_packet(cli);
466
467 SCVAL(cli->outbuf,smb_vwv0,0xFF);
468 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
469 SSVAL(cli->outbuf,smb_vwv3,2);
470 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
471 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
472 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
473 SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
474 SIVAL(cli->outbuf,smb_vwv11,capabilities);
475 p = smb_buf(cli->outbuf);
476 if (lm_response.length) {
477 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
478 }
479 if (nt_response.length) {
480 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
481 }
482 p += clistr_push(cli, p, user, -1, STR_TERMINATE);
483
484 /* Upper case here might help some NTLMv2 implementations */
485 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
486 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
487 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
488 cli_setup_bcc(cli, p);
489
490 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
491 result = cli_nt_error(cli);
492 goto end;
493 }
494
495 /* show_msg(cli->inbuf); */
496
497 if (cli_is_error(cli)) {
498 result = cli_nt_error(cli);
499 goto end;
500 }
501
502 #ifdef LANMAN_ONLY
503 ok = cli_simple_set_signing(cli, session_key, lm_response);
504 #else
505 ok = cli_simple_set_signing(cli, session_key, nt_response);
506 #endif
507 if (ok) {
508 /* 'resign' the last message, so we get the right sequence numbers
509 for checking the first reply from the server */
510 cli_calculate_sign_mac(cli, cli->outbuf);
511
512 if (!cli_check_sign_mac(cli, cli->inbuf)) {
513 result = NT_STATUS_ACCESS_DENIED;
514 goto end;
515 }
516 }
517
518 /* use the returned vuid from now on */
519 cli->vuid = SVAL(cli->inbuf,smb_uid);
520
521 p = smb_buf(cli->inbuf);
522 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
523 -1, STR_TERMINATE);
524 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
525 -1, STR_TERMINATE);
526 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
527 -1, STR_TERMINATE);
528
529 if (strstr(cli->server_type, "Samba")) {
530 cli->is_samba = True;
531 }
532
533 result = cli_set_username(cli, user);
534 if (!NT_STATUS_IS_OK(result)) {
535 goto end;
536 }
537
538 if (session_key.data) {
539 /* Have plaintext orginal */
540 cli_set_session_key(cli, session_key);
541 }
542
543 result = NT_STATUS_OK;
544 end:
545 data_blob_free(&lm_response);
546 data_blob_free(&nt_response);
547 data_blob_free(&session_key);
548 return result;
549 }
550
551 /****************************************************************************
552 Send a extended security session setup blob
553 ****************************************************************************/
554
555 static bool cli_session_setup_blob_send(struct cli_state *cli, DATA_BLOB blob)
556 {
557 uint32 capabilities = cli_session_setup_capabilities(cli);
558 char *p;
559
560 capabilities |= CAP_EXTENDED_SECURITY;
561
562 /* send a session setup command */
563 memset(cli->outbuf,'\0',smb_size);
564
565 cli_set_message(cli->outbuf,12,0,True);
566 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
567
568 cli_setup_packet(cli);
569
570 SCVAL(cli->outbuf,smb_vwv0,0xFF);
571 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
572 SSVAL(cli->outbuf,smb_vwv3,2);
573 SSVAL(cli->outbuf,smb_vwv4,1);
574 SIVAL(cli->outbuf,smb_vwv5,0);
575 SSVAL(cli->outbuf,smb_vwv7,blob.length);
576 SIVAL(cli->outbuf,smb_vwv10,capabilities);
577 p = smb_buf(cli->outbuf);
578 memcpy(p, blob.data, blob.length);
579 p += blob.length;
580 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
581 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
582 cli_setup_bcc(cli, p);
583 return cli_send_smb(cli);
584 }
585
586 /****************************************************************************
587 Send a extended security session setup blob, returning a reply blob.
588 ****************************************************************************/
589
590 static DATA_BLOB cli_session_setup_blob_receive(struct cli_state *cli)
591 {
592 DATA_BLOB blob2 = data_blob_null;
593 char *p;
594 size_t len;
595
596 if (!cli_receive_smb(cli))
597 return blob2;
598
599 show_msg(cli->inbuf);
600
601 if (cli_is_error(cli) && !NT_STATUS_EQUAL(cli_nt_error(cli),
602 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
603 return blob2;
604 }
605
606 /* use the returned vuid from now on */
607 cli->vuid = SVAL(cli->inbuf,smb_uid);
608
609 p = smb_buf(cli->inbuf);
610
611 blob2 = data_blob(p, SVAL(cli->inbuf, smb_vwv3));
612
613 p += blob2.length;
614 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
615 -1, STR_TERMINATE);
616
617 /* w2k with kerberos doesn't properly null terminate this field */
618 len = smb_bufrem(cli->inbuf, p);
619 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
620 len, 0);
621
622 return blob2;
623 }
624
625 #ifdef HAVE_KRB5
626 /****************************************************************************
627 Send a extended security session setup blob, returning a reply blob.
628 ****************************************************************************/
629
630 /* The following is calculated from :
631 * (smb_size-4) = 35
632 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
633 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
634 * end of packet.
635 */
636
637 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
638
639 static bool cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
640 {
641 int32 remaining = blob.length;
642 int32 cur = 0;
643 DATA_BLOB send_blob = data_blob_null;
644 int32 max_blob_size = 0;
645 DATA_BLOB receive_blob = data_blob_null;
646
647 if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
648 DEBUG(0,("cli_session_setup_blob: cli->max_xmit too small "
649 "(was %u, need minimum %u)\n",
650 (unsigned int)cli->max_xmit,
651 BASE_SESSSETUP_BLOB_PACKET_SIZE));
652 cli_set_nt_error(cli, NT_STATUS_INVALID_PARAMETER);
653 return False;
654 }
655
656 max_blob_size = cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE;
657
658 while ( remaining > 0) {
659 if (remaining >= max_blob_size) {
660 send_blob.length = max_blob_size;
661 remaining -= max_blob_size;
662 } else {
663 send_blob.length = remaining;
664 remaining = 0;
665 }
666
667 send_blob.data = &blob.data[cur];
668 cur += send_blob.length;
669
670 DEBUG(10, ("cli_session_setup_blob: Remaining (%u) sending (%u) current (%u)\n",
671 (unsigned int)remaining,
672 (unsigned int)send_blob.length,
673 (unsigned int)cur ));
674
675 if (!cli_session_setup_blob_send(cli, send_blob)) {
676 DEBUG(0, ("cli_session_setup_blob: send failed\n"));
677 return False;
678 }
679
680 receive_blob = cli_session_setup_blob_receive(cli);
681 data_blob_free(&receive_blob);
682
683 if (cli_is_error(cli) &&
684 !NT_STATUS_EQUAL( cli_get_nt_error(cli),
685 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
686 DEBUG(0, ("cli_session_setup_blob: receive failed "
687 "(%s)\n", nt_errstr(cli_get_nt_error(cli))));
688 cli->vuid = 0;
689 return False;
690 }
691 }
692
693 return True;
694 }
695
696 /****************************************************************************
697 Use in-memory credentials cache
698 ****************************************************************************/
699
700 static void use_in_memory_ccache(void) {
701 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
702 }
703
704 /****************************************************************************
705 Do a spnego/kerberos encrypted session setup.
706 ****************************************************************************/
707
708 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup)
709 {
710 DATA_BLOB negTokenTarg;
711 DATA_BLOB session_key_krb5;
712 NTSTATUS nt_status;
713 int rc;
714
715 cli_temp_set_signing(cli);
716
717 DEBUG(2,("Doing kerberos session setup\n"));
718
719 /* generate the encapsulated kerberos5 ticket */
720 rc = spnego_gen_negTokenTarg(principal, 0, &negTokenTarg, &session_key_krb5, 0, NULL);
721
722 if (rc) {
723 DEBUG(1, ("cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: %s\n",
724 error_message(rc)));
725 return ADS_ERROR_KRB5(rc);
726 }
727
728 #if 0
729 file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length);
730 #endif
731
732 if (!cli_session_setup_blob(cli, negTokenTarg)) {
733 nt_status = cli_nt_error(cli);
734 goto nt_error;
735 }
736
737 if (cli_is_error(cli)) {
738 nt_status = cli_nt_error(cli);
739 if (NT_STATUS_IS_OK(nt_status)) {
740 nt_status = NT_STATUS_UNSUCCESSFUL;
741 }
742 goto nt_error;
743 }
744
745 cli_set_session_key(cli, session_key_krb5);
746
747 if (cli_simple_set_signing(
748 cli, session_key_krb5, data_blob_null)) {
749
750 /* 'resign' the last message, so we get the right sequence numbers
751 for checking the first reply from the server */
752 cli_calculate_sign_mac(cli, cli->outbuf);
753
754 if (!cli_check_sign_mac(cli, cli->inbuf)) {
755 nt_status = NT_STATUS_ACCESS_DENIED;
756 goto nt_error;
757 }
758 }
759
760 data_blob_free(&negTokenTarg);
761 data_blob_free(&session_key_krb5);
762
763 return ADS_ERROR_NT(NT_STATUS_OK);
764
765 nt_error:
766 data_blob_free(&negTokenTarg);
767 data_blob_free(&session_key_krb5);
768 cli->vuid = 0;
769 return ADS_ERROR_NT(nt_status);
770 }
771 #endif /* HAVE_KRB5 */
772
773
774 /****************************************************************************
775 Do a spnego/NTLMSSP encrypted session setup.
776 ****************************************************************************/
777
778 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
779 const char *pass, const char *domain)
780 {
781 struct ntlmssp_state *ntlmssp_state;
782 NTSTATUS nt_status;
783 int turn = 1;
784 DATA_BLOB msg1;
785 DATA_BLOB blob = data_blob_null;
786 DATA_BLOB blob_in = data_blob_null;
787 DATA_BLOB blob_out = data_blob_null;
788
789 cli_temp_set_signing(cli);
790
791 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
792 return nt_status;
793 }
794 ntlmssp_want_feature(ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
795
796 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
797 return nt_status;
798 }
799 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
800 return nt_status;
801 }
802 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, pass))) {
803 return nt_status;
804 }
805
806 do {
807 nt_status = ntlmssp_update(ntlmssp_state,
808 blob_in, &blob_out);
809 data_blob_free(&blob_in);
810 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(nt_status)) {
811 if (turn == 1) {
812 /* and wrap it in a SPNEGO wrapper */
813 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
814 } else {
815 /* wrap it in SPNEGO */
816 msg1 = spnego_gen_auth(blob_out);
817 }
818
819 /* now send that blob on its way */
820 if (!cli_session_setup_blob_send(cli, msg1)) {
821 DEBUG(3, ("Failed to send NTLMSSP/SPNEGO blob to server!\n"));
822 nt_status = NT_STATUS_UNSUCCESSFUL;
823 } else {
824 blob = cli_session_setup_blob_receive(cli);
825
826 nt_status = cli_nt_error(cli);
827 if (cli_is_error(cli) && NT_STATUS_IS_OK(nt_status)) {
828 if (cli->smb_rw_error == SMB_READ_BAD_SIG) {
829 nt_status = NT_STATUS_ACCESS_DENIED;
830 } else {
831 nt_status = NT_STATUS_UNSUCCESSFUL;
832 }
833 }
834 }
835 data_blob_free(&msg1);
836 }
837
838 if (!blob.length) {
839 if (NT_STATUS_IS_OK(nt_status)) {
840 nt_status = NT_STATUS_UNSUCCESSFUL;
841 }
842 } else if ((turn == 1) &&
843 NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
844 DATA_BLOB tmp_blob = data_blob_null;
845 /* the server might give us back two challenges */
846 if (!spnego_parse_challenge(blob, &blob_in,
847 &tmp_blob)) {
848 DEBUG(3,("Failed to parse challenges\n"));
849 nt_status = NT_STATUS_INVALID_PARAMETER;
850 }
851 data_blob_free(&tmp_blob);
852 } else {
853 if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
854 &blob_in)) {
855 DEBUG(3,("Failed to parse auth response\n"));
856 if (NT_STATUS_IS_OK(nt_status)
857 || NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED))
858 nt_status = NT_STATUS_INVALID_PARAMETER;
859 }
860 }
861 data_blob_free(&blob);
862 data_blob_free(&blob_out);
863 turn++;
864 } while (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED));
865
866 data_blob_free(&blob_in);
867
868 if (NT_STATUS_IS_OK(nt_status)) {
869
870 fstrcpy(cli->server_domain, ntlmssp_state->server_domain);
871 cli_set_session_key(cli, ntlmssp_state->session_key);
872
873 if (cli_simple_set_signing(
874 cli, ntlmssp_state->session_key, data_blob_null)) {
875
876 /* 'resign' the last message, so we get the right sequence numbers
877 for checking the first reply from the server */
878 cli_calculate_sign_mac(cli, cli->outbuf);
879
880 if (!cli_check_sign_mac(cli, cli->inbuf)) {
881 nt_status = NT_STATUS_ACCESS_DENIED;
882 }
883 }
884 }
885
886 /* we have a reference conter on ntlmssp_state, if we are signing
887 then the state will be kept by the signing engine */
888
889 ntlmssp_end(&ntlmssp_state);
890
891 if (!NT_STATUS_IS_OK(nt_status)) {
892 cli->vuid = 0;
893 }
894 return nt_status;
895 }
896
897 /****************************************************************************
898 Do a spnego encrypted session setup.
899
900 user_domain: The shortname of the domain the user/machine is a member of.
901 dest_realm: The realm we're connecting to, if NULL we use our default realm.
902 ****************************************************************************/
903
904 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
905 const char *pass, const char *user_domain,
906 const char * dest_realm)
907 {
908 char *principal = NULL;
909 char *OIDs[ASN1_MAX_OIDS];
910 int i;
911 DATA_BLOB blob;
912 const char *p = NULL;
913 char *account = NULL;
914 NTSTATUS status;
915
916 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
917
918 /* the server might not even do spnego */
919 if (cli->secblob.length <= 16) {
920 DEBUG(3,("server didn't supply a full spnego negprot\n"));
921 goto ntlmssp;
922 }
923
924 #if 0
925 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
926 #endif
927
928 /* there is 16 bytes of GUID before the real spnego packet starts */
929 blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
930
931 /* The server sent us the first part of the SPNEGO exchange in the
932 * negprot reply. It is WRONG to depend on the principal sent in the
933 * negprot reply, but right now we do it. If we don't receive one,
934 * we try to best guess, then fall back to NTLM. */
935 if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
936 data_blob_free(&blob);
937 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
938 }
939 data_blob_free(&blob);
940
941 /* make sure the server understands kerberos */
942 for (i=0;OIDs[i];i++) {
943 DEBUG(3,("got OID=%s\n", OIDs[i]));
944 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
945 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
946 cli->got_kerberos_mechanism = True;
947 }
948 talloc_free(OIDs[i]);
949 }
950
951 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
952
953 status = cli_set_username(cli, user);
954 if (!NT_STATUS_IS_OK(status)) {
955 return ADS_ERROR_NT(status);
956 }
957
958 #ifdef HAVE_KRB5
959 /* If password is set we reauthenticate to kerberos server
960 * and do not store results */
961
962 if (cli->got_kerberos_mechanism && cli->use_kerberos) {
963 ADS_STATUS rc;
964
965 if (pass && *pass) {
966 int ret;
967
968 use_in_memory_ccache();
969 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
970
971 if (ret){
972 TALLOC_FREE(principal);
973 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
974 if (cli->fallback_after_kerberos)
975 goto ntlmssp;
976 return ADS_ERROR_KRB5(ret);
977 }
978 }
979
980 /* If we get a bad principal, try to guess it if
981 we have a valid host NetBIOS name.
982 */
983 if (strequal(principal, ADS_IGNORE_PRINCIPAL)) {
984 TALLOC_FREE(principal);
985 }
986
987 if (principal == NULL &&
988 !is_ipaddress(cli->desthost) &&
989 !strequal(STAR_SMBSERVER,
990 cli->desthost)) {
991 char *realm = NULL;
992 char *machine = NULL;
993 char *host = NULL;
994 DEBUG(3,("cli_session_setup_spnego: got a "
995 "bad server principal, trying to guess ...\n"));
996
997 host = strchr_m(cli->desthost, '.');
998 if (host) {
999 machine = SMB_STRNDUP(cli->desthost,
1000 host - cli->desthost);
1001 } else {
1002 machine = SMB_STRDUP(cli->desthost);
1003 }
1004 if (machine == NULL) {
1005 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1006 }
1007
1008 if (dest_realm) {
1009 realm = SMB_STRDUP(dest_realm);
1010 strupper_m(realm);
1011 } else {
1012 realm = kerberos_get_default_realm_from_ccache();
1013 }
1014 if (realm && *realm) {
1015 principal = talloc_asprintf(NULL, "%s$@%s",
1016 machine, realm);
1017 if (!principal) {
1018 SAFE_FREE(machine);
1019 SAFE_FREE(realm);
1020 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1021 }
1022 DEBUG(3,("cli_session_setup_spnego: guessed "
1023 "server principal=%s\n",
1024 principal ? principal : "<null>"));
1025 }
1026 SAFE_FREE(machine);
1027 SAFE_FREE(realm);
1028 }
1029
1030 if (principal) {
1031 rc = cli_session_setup_kerberos(cli, principal,
1032 dest_realm);
1033 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1034 TALLOC_FREE(principal);
1035 return rc;
1036 }
1037 }
1038 }
1039 #endif
1040
1041 TALLOC_FREE(principal);
1042
1043 ntlmssp:
1044
1045 account = talloc_strdup(talloc_tos(), user);
1046 if (!account) {
1047 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1048 }
1049
1050 /* when falling back to ntlmssp while authenticating with a machine
1051 * account strip off the realm - gd */
1052
1053 if ((p = strchr_m(user, '@')) != NULL) {
1054 account[PTR_DIFF(p,user)] = '\0';
1055 }
1056
1057 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1058 }
1059
1060 /****************************************************************************
1061 Send a session setup. The username and workgroup is in UNIX character
1062 format and must be converted to DOS codepage format before sending. If the
1063 password is in plaintext, the same should be done.
1064 ****************************************************************************/
1065
1066 NTSTATUS cli_session_setup(struct cli_state *cli,
1067 const char *user,
1068 const char *pass, int passlen,
1069 const char *ntpass, int ntpasslen,
1070 const char *workgroup)
1071 {
1072 char *p;
1073 fstring user2;
1074
1075 if (user) {
1076 fstrcpy(user2, user);
1077 } else {
1078 user2[0] ='\0';
1079 }
1080
1081 if (!workgroup) {
1082 workgroup = "";
1083 }
1084
1085 /* allow for workgroups as part of the username */
1086 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1087 (p=strchr_m(user2,*lp_winbind_separator()))) {
1088 *p = 0;
1089 user = p+1;
1090 workgroup = user2;
1091 }
1092
1093 if (cli->protocol < PROTOCOL_LANMAN1) {
1094 return NT_STATUS_OK;
1095 }
1096
1097 /* now work out what sort of session setup we are going to
1098 do. I have split this into separate functions to make the
1099 flow a bit easier to understand (tridge) */
1100
1101 /* if its an older server then we have to use the older request format */
1102
1103 if (cli->protocol < PROTOCOL_NT1) {
1104 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1105 DEBUG(1, ("Server requested LM password but 'client lanman auth'"
1106 " is disabled\n"));
1107 return NT_STATUS_ACCESS_DENIED;
1108 }
1109
1110 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1111 !lp_client_plaintext_auth() && (*pass)) {
1112 DEBUG(1, ("Server requested plaintext password but "
1113 "'client plaintext auth' is disabled\n"));
1114 return NT_STATUS_ACCESS_DENIED;
1115 }
1116
1117 return cli_session_setup_lanman2(cli, user, pass, passlen,
1118 workgroup);
1119 }
1120
1121 /* if no user is supplied then we have to do an anonymous connection.
1122 passwords are ignored */
1123
1124 if (!user || !*user)
1125 return cli_session_setup_guest(cli);
1126
1127 /* if the server is share level then send a plaintext null
1128 password at this point. The password is sent in the tree
1129 connect */
1130
1131 if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1132 return cli_session_setup_plaintext(cli, user, "", workgroup);
1133
1134 /* if the server doesn't support encryption then we have to use
1135 plaintext. The second password is ignored */
1136
1137 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1138 if (!lp_client_plaintext_auth() && (*pass)) {
1139 DEBUG(1, ("Server requested plaintext password but "
1140 "'client plaintext auth' is disabled\n"));
1141 return NT_STATUS_ACCESS_DENIED;
1142 }
1143 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1144 }
1145
1146 /* if the server supports extended security then use SPNEGO */
1147
1148 if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1149 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1150 workgroup, NULL);
1151 if (!ADS_ERR_OK(status)) {
1152 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1153 return ads_ntstatus(status);
1154 }
1155 } else {
1156 NTSTATUS status;
1157
1158 /* otherwise do a NT1 style session setup */
1159 status = cli_session_setup_nt1(cli, user, pass, passlen,
1160 ntpass, ntpasslen, workgroup);
1161 if (!NT_STATUS_IS_OK(status)) {
1162 DEBUG(3,("cli_session_setup: NT1 session setup "
1163 "failed: %s\n", nt_errstr(status)));
1164 return status;
1165 }
1166 }
1167
1168 if (strstr(cli->server_type, "Samba")) {
1169 cli->is_samba = True;
1170 }
1171
1172 return NT_STATUS_OK;
1173 }
1174
1175 /****************************************************************************
1176 Send a uloggoff.
1177 *****************************************************************************/
1178
1179 bool cli_ulogoff(struct cli_state *cli)
1180 {
1181 memset(cli->outbuf,'\0',smb_size);
1182 cli_set_message(cli->outbuf,2,0,True);
1183 SCVAL(cli->outbuf,smb_com,SMBulogoffX);
1184 cli_setup_packet(cli);
1185 SSVAL(cli->outbuf,smb_vwv0,0xFF);
1186 SSVAL(cli->outbuf,smb_vwv2,0); /* no additional info */
1187
1188 cli_send_smb(cli);
1189 if (!cli_receive_smb(cli))
1190 return False;
1191
1192 if (cli_is_error(cli)) {
1193 return False;
1194 }
1195
1196 cli->cnum = -1;
1197 return True;
1198 }
1199
1200 /****************************************************************************
1201 Send a tconX.
1202 ****************************************************************************/
1203
1204 struct async_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1205 struct event_context *ev,
1206 struct cli_state *cli,
1207 const char *share, const char *dev,
1208 const char *pass, int passlen)
1209 {
1210 fstring pword;
1211 char *tmp = NULL;
1212 struct async_req *result;
1213 uint16_t vwv[4];
1214 uint8_t *bytes;
1215
1216 fstrcpy(cli->share, share);
1217
1218 /* in user level security don't send a password now */
1219 if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1220 passlen = 1;
1221 pass = "";
1222 } else if (pass == NULL) {
1223 DEBUG(1, ("Server not using user level security and no "
1224 "password supplied.\n"));
1225 goto access_denied;
1226 }
1227
1228 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1229 *pass && passlen != 24) {
1230 if (!lp_client_lanman_auth()) {
1231 DEBUG(1, ("Server requested LANMAN password "
1232 "(share-level security) but "
1233 "'client lanman auth' is disabled\n"));
1234 goto access_denied;
1235 }
1236
1237 /*
1238 * Non-encrypted passwords - convert to DOS codepage before
1239 * encryption.
1240 */
1241 passlen = 24;
1242 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1243 } else {
1244 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1245 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1246 == 0) {
1247 if (!lp_client_plaintext_auth() && (*pass)) {
1248 DEBUG(1, ("Server requested plaintext "
1249 "password but 'client plaintext "
1250 "auth' is disabled\n"));
1251 goto access_denied;
1252 }
1253
1254 /*
1255 * Non-encrypted passwords - convert to DOS codepage
1256 * before using.
1257 */
1258 passlen = clistr_push(cli, pword, pass, sizeof(pword),
1259 STR_TERMINATE);
1260 if (passlen == -1) {
1261 DEBUG(1, ("clistr_push(pword) failed\n"));
1262 goto access_denied;
1263 }
1264 } else {
1265 if (passlen) {
1266 memcpy(pword, pass, passlen);
1267 }
1268 }
1269 }
1270
1271 SCVAL(vwv+0, 0, 0xFF);
1272 SCVAL(vwv+0, 1, 0);
1273 SSVAL(vwv+1, 0, 0);
1274 SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1275 SSVAL(vwv+3, 0, passlen);
1276
1277 if (passlen) {
1278 bytes = (uint8_t *)talloc_memdup(talloc_tos(), pword, passlen);
1279 } else {
1280 bytes = talloc_array(talloc_tos(), uint8_t, 0);
1281 }
1282
1283 /*
1284 * Add the sharename
1285 */
1286 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1287 cli->desthost, share);
1288 if (tmp == NULL) {
1289 TALLOC_FREE(bytes);
1290 return NULL;
1291 }
1292 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1293 NULL);
1294 TALLOC_FREE(tmp);
1295
1296 /*
1297 * Add the devicetype
1298 */
1299 tmp = talloc_strdup_upper(talloc_tos(), dev);
1300 if (tmp == NULL) {
1301 TALLOC_FREE(bytes);
1302 return NULL;
1303 }
1304 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1305 TALLOC_FREE(tmp);
1306
1307 if (bytes == NULL) {
1308 return NULL;
1309 }
1310
1311 result = cli_request_send(mem_ctx, ev, cli, SMBtconX, 0,
1312 4, vwv, 0, talloc_get_size(bytes), bytes);
1313 TALLOC_FREE(bytes);
1314 return result;
1315
1316 access_denied:
1317 {
1318 struct cli_request *state;
1319 if (!async_req_setup(mem_ctx, &result, &state,
1320 struct cli_request)) {
1321 goto fail;
1322 }
1323 if (async_post_ntstatus(result, ev, NT_STATUS_ACCESS_DENIED)) {
1324 return result;
1325 }
1326 }
1327 fail:
1328 TALLOC_FREE(result);
1329 return NULL;
1330 }
1331
1332 NTSTATUS cli_tcon_andx_recv(struct async_req *req)
1333 {
1334 struct cli_request *cli_req = talloc_get_type_abort(
1335 req->private_data, struct cli_request);
1336 struct cli_state *cli = cli_req->cli;
1337 uint8_t wct;
1338 uint16_t *vwv;
1339 uint16_t num_bytes;
1340 uint8_t *bytes;
1341 NTSTATUS status;
1342
1343 if (async_req_is_nterror(req, &status)) {
1344 return status;
1345 }
1346
1347 status = cli_pull_reply(req, &wct, &vwv, &num_bytes, &bytes);
1348 if (!NT_STATUS_IS_OK(status)) {
1349 return status;
1350 }
1351
1352 clistr_pull(cli_req->inbuf, cli->dev, bytes, sizeof(fstring),
1353 num_bytes, STR_TERMINATE|STR_ASCII);
1354
1355 if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1356 /* almost certainly win95 - enable bug fixes */
1357 cli->win95 = True;
1358 }
1359
1360 /*
1361 * Make sure that we have the optional support 16-bit field. WCT > 2.
1362 * Avoids issues when connecting to Win9x boxes sharing files
1363 */
1364
1365 cli->dfsroot = false;
1366
1367 if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1368 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1369 }
1370
1371 cli->cnum = SVAL(cli_req->inbuf,smb_tid);
1372 return NT_STATUS_OK;
1373 }
1374
1375 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1376 const char *dev, const char *pass, int passlen)
1377 {
1378 TALLOC_CTX *frame = talloc_stackframe();
1379 struct event_context *ev;
1380 struct async_req *req;
1381 NTSTATUS status;
1382
1383 if (cli->fd_event != NULL) {
1384 /*
1385 * Can't use sync call while an async call is in flight
1386 */
1387 status = NT_STATUS_INVALID_PARAMETER;
1388 goto fail;
1389 }
1390
1391 ev = event_context_init(frame);
1392 if (ev == NULL) {
1393 status = NT_STATUS_NO_MEMORY;
1394 goto fail;
1395 }
1396
1397 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1398 if (req == NULL) {
1399 status = NT_STATUS_NO_MEMORY;
1400 goto fail;
1401 }
1402
1403 while (req->state < ASYNC_REQ_DONE) {
1404 event_loop_once(ev);
1405 }
1406
1407 status = cli_tcon_andx_recv(req);
1408 fail:
1409 TALLOC_FREE(frame);
1410 return status;
1411 }
1412
1413 /****************************************************************************
1414 Send a tree disconnect.
1415 ****************************************************************************/
1416
1417 bool cli_tdis(struct cli_state *cli)
1418 {
1419 memset(cli->outbuf,'\0',smb_size);
1420 cli_set_message(cli->outbuf,0,0,True);
1421 SCVAL(cli->outbuf,smb_com,SMBtdis);
1422 SSVAL(cli->outbuf,smb_tid,cli->cnum);
1423 cli_setup_packet(cli);
1424
1425 cli_send_smb(cli);
1426 if (!cli_receive_smb(cli))
1427 return False;
1428
1429 if (cli_is_error(cli)) {
1430 return False;
1431 }
1432
1433 cli->cnum = -1;
1434 return True;
1435 }
1436
1437 /****************************************************************************
1438 Send a negprot command.
1439 ****************************************************************************/
1440
1441 void cli_negprot_sendsync(struct cli_state *cli)
1442 {
1443 char *p;
1444 int numprots;
1445
1446 if (cli->protocol < PROTOCOL_NT1)
1447 cli->use_spnego = False;
1448
1449 memset(cli->outbuf,'\0',smb_size);
1450
1451 /* setup the protocol strings */
1452 cli_set_message(cli->outbuf,0,0,True);
1453
1454 p = smb_buf(cli->outbuf);
1455 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1456 if (prots[numprots].prot > cli->protocol) {
1457 break;
1458 }
1459 *p++ = 2;
1460 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1461 }
1462
1463 SCVAL(cli->outbuf,smb_com,SMBnegprot);
1464 cli_setup_bcc(cli, p);
1465 cli_setup_packet(cli);
1466
1467 SCVAL(smb_buf(cli->outbuf),0,2);
1468
1469 cli_send_smb(cli);
1470 }
1471
1472 /****************************************************************************
1473 Send a negprot command.
1474 ****************************************************************************/
1475
1476 struct async_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1477 struct event_context *ev,
1478 struct cli_state *cli)
1479 {
1480 struct async_req *result;
1481 uint8_t *bytes = NULL;
1482 int numprots;
1483
1484 if (cli->protocol < PROTOCOL_NT1)
1485 cli->use_spnego = False;
1486
1487 /* setup the protocol strings */
1488 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1489 uint8_t c = 2;
1490 if (prots[numprots].prot > cli->protocol) {
1491 break;
1492 }
1493 bytes = (uint8_t *)talloc_append_blob(
1494 talloc_tos(), bytes, data_blob_const(&c, sizeof(c)));
1495 if (bytes == NULL) {
1496 return NULL;
1497 }
1498 bytes = smb_bytes_push_str(bytes, false,
1499 prots[numprots].name,
1500 strlen(prots[numprots].name)+1,
1501 NULL);
1502 if (bytes == NULL) {
1503 return NULL;
1504 }
1505 }
1506
1507 result = cli_request_send(mem_ctx, ev, cli, SMBnegprot, 0, 0, NULL, 0,
1508 talloc_get_size(bytes), bytes);
1509 TALLOC_FREE(bytes);
1510 return result;
1511 }
1512
1513 NTSTATUS cli_negprot_recv(struct async_req *req)
1514 {
1515 struct cli_request *cli_req = talloc_get_type_abort(
1516 req->private_data, struct cli_request);
1517 struct cli_state *cli = cli_req->cli;
1518 uint8_t wct;
1519 uint16_t *vwv;
1520 uint16_t num_bytes;
1521 uint8_t *bytes;
1522 NTSTATUS status;
1523 uint16_t protnum;
1524
1525 if (async_req_is_nterror(req, &status)) {
1526 return status;
1527 }
1528
1529 status = cli_pull_reply(req, &wct, &vwv, &num_bytes, &bytes);
1530 if (!NT_STATUS_IS_OK(status)) {
1531 return status;
1532 }
1533
1534 protnum = SVAL(vwv, 0);
1535
1536 if ((protnum >= ARRAY_SIZE(prots))
1537 || (prots[protnum].prot > cli_req->cli->protocol)) {
1538 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1539 }
1540
1541 cli->protocol = prots[protnum].prot;
1542
1543 if ((cli->protocol < PROTOCOL_NT1) && cli->sign_info.mandatory_signing) {
1544 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
1545 return NT_STATUS_ACCESS_DENIED;
1546 }
1547
1548 if (cli->protocol >= PROTOCOL_NT1) {
1549 struct timespec ts;
1550 /* NT protocol */
1551 cli->sec_mode = CVAL(vwv + 1, 0);
1552 cli->max_mux = SVAL(vwv + 1, 1);
1553 cli->max_xmit = IVAL(vwv + 3, 1);
1554 cli->sesskey = IVAL(vwv + 7, 1);
1555 cli->serverzone = SVALS(vwv + 15, 1);
1556 cli->serverzone *= 60;
1557 /* this time arrives in real GMT */
1558 ts = interpret_long_date(((char *)(vwv+11))+1);
1559 cli->servertime = ts.tv_sec;
1560 cli->secblob = data_blob(bytes, num_bytes);
1561 cli->capabilities = IVAL(vwv + 9, 1);
1562 if (cli->capabilities & CAP_RAW_MODE) {
1563 cli->readbraw_supported = True;
1564 cli->writebraw_supported = True;
1565 }
1566 /* work out if they sent us a workgroup */
1567 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
1568 smb_buflen(cli->inbuf) > 8) {
1569 clistr_pull(cli->inbuf, cli->server_domain,
1570 bytes+8, sizeof(cli->server_domain),
1571 num_bytes-8,
1572 STR_UNICODE|STR_NOALIGN);
1573 }
1574
1575 /*
1576 * As signing is slow we only turn it on if either the client or
1577 * the server require it. JRA.
1578 */
1579
1580 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
1581 /* Fail if server says signing is mandatory and we don't want to support it. */
1582 if (!cli->sign_info.allow_smb_signing) {
1583 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
1584 return NT_STATUS_ACCESS_DENIED;
1585 }
1586 cli->sign_info.negotiated_smb_signing = True;
1587 cli->sign_info.mandatory_signing = True;
1588 } else if (cli->sign_info.mandatory_signing && cli->sign_info.allow_smb_signing) {
1589 /* Fail if client says signing is mandatory and the server doesn't support it. */
1590 if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
1591 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
1592 return NT_STATUS_ACCESS_DENIED;
1593 }
1594 cli->sign_info.negotiated_smb_signing = True;
1595 cli->sign_info.mandatory_signing = True;
1596 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
1597 cli->sign_info.negotiated_smb_signing = True;
1598 }
1599
1600 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
1601 SAFE_FREE(cli->outbuf);
1602 SAFE_FREE(cli->inbuf);
1603 cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1604 cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1605 cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
1606 }
1607
1608 } else if (cli->protocol >= PROTOCOL_LANMAN1) {
1609 cli->use_spnego = False;
1610 cli->sec_mode = SVAL(vwv + 1, 0);
1611 cli->max_xmit = SVAL(vwv + 2, 0);
1612 cli->max_mux = SVAL(vwv + 3, 0);
1613 cli->sesskey = IVAL(vwv + 6, 0);
1614 cli->serverzone = SVALS(vwv + 10, 0);
1615 cli->serverzone *= 60;
1616 /* this time is converted to GMT by make_unix_date */
1617 cli->servertime = cli_make_unix_date(
1618 cli, (char *)(vwv + 8));
1619 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
1620 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
1621 cli->secblob = data_blob(bytes, num_bytes);
1622 } else {
1623 /* the old core protocol */
1624 cli->use_spnego = False;
1625 cli->sec_mode = 0;
1626 cli->serverzone = get_time_zone(time(NULL));
1627 }
1628
1629 cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
1630
1631 /* a way to force ascii SMB */
1632 if (getenv("CLI_FORCE_ASCII"))
1633 cli->capabilities &= ~CAP_UNICODE;
1634
1635 return NT_STATUS_OK;
1636 }
1637
1638 NTSTATUS cli_negprot(struct cli_state *cli)
1639 {
1640 TALLOC_CTX *frame = talloc_stackframe();
1641 struct event_context *ev;
1642 struct async_req *req;
1643 NTSTATUS status = NT_STATUS_NO_MEMORY;
1644
1645 if (cli->fd_event != NULL) {
1646 /*
1647 * Can't use sync call while an async call is in flight
1648 */
1649 cli_set_error(cli, NT_STATUS_INVALID_PARAMETER);
1650 goto fail;
1651 }
1652
1653 ev = event_context_init(frame);
1654 if (ev == NULL) {
1655 goto fail;
1656 }
1657
1658 req = cli_negprot_send(frame, ev, cli);
1659 if (req == NULL) {
1660 goto fail;
1661 }
1662
1663 while (req->state < ASYNC_REQ_DONE) {
1664 event_loop_once(ev);
1665 }
1666
1667 status = cli_negprot_recv(req);
1668 fail:
1669 TALLOC_FREE(frame);
1670 return status;
1671 }
1672
1673 /****************************************************************************
1674 Send a session request. See rfc1002.txt 4.3 and 4.3.2.
1675 ****************************************************************************/
1676
1677 bool cli_session_request(struct cli_state *cli,
1678 struct nmb_name *calling, struct nmb_name *called)
1679 {
1680 char *p;
1681 int len = 4;
1682 char *tmp;
1683
1684 /* 445 doesn't have session request */
1685 if (cli->port == 445)
1686 return True;
1687
1688 memcpy(&(cli->calling), calling, sizeof(*calling));
1689 memcpy(&(cli->called ), called , sizeof(*called ));
1690
1691 /* put in the destination name */
1692
1693 tmp = name_mangle(talloc_tos(), cli->called.name,
1694 cli->called.name_type);
1695 if (tmp == NULL) {
1696 return false;
1697 }
1698
1699 p = cli->outbuf+len;
1700 memcpy(p, tmp, name_len(tmp));
1701 len += name_len(tmp);
1702 TALLOC_FREE(tmp);
1703
1704 /* and my name */
1705
1706 tmp = name_mangle(talloc_tos(), cli->calling.name,
1707 cli->calling.name_type);
1708 if (tmp == NULL) {
1709 return false;
1710 }
1711
1712 p = cli->outbuf+len;
1713 memcpy(p, tmp, name_len(tmp));
1714 len += name_len(tmp);
1715 TALLOC_FREE(tmp);
1716
1717 /* send a session request (RFC 1002) */
1718 /* setup the packet length
1719 * Remove four bytes from the length count, since the length
1720 * field in the NBT Session Service header counts the number
1721 * of bytes which follow. The cli_send_smb() function knows
1722 * about this and accounts for those four bytes.
1723 * CRH.
1724 */
1725 len -= 4;
1726 _smb_setlen(cli->outbuf,len);
1727 SCVAL(cli->outbuf,0,0x81);
1728
1729 cli_send_smb(cli);
1730 DEBUG(5,("Sent session request\n"));
1731
1732 if (!cli_receive_smb(cli))
1733 return False;
1734
1735 if (CVAL(cli->inbuf,0) == 0x84) {
1736 /* C. Hoch 9/14/95 Start */
1737 /* For information, here is the response structure.
1738 * We do the byte-twiddling to for portability.
1739 struct RetargetResponse{
1740 unsigned char type;
1741 unsigned char flags;
1742 int16 length;
1743 int32 ip_addr;
1744 int16 port;
1745 };
1746 */
1747 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
1748 struct in_addr dest_ip;
1749 NTSTATUS status;
1750
1751 /* SESSION RETARGET */
1752 putip((char *)&dest_ip,cli->inbuf+4);
1753 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
1754
1755 status = open_socket_out(&cli->dest_ss, port,
1756 LONG_CONNECT_TIMEOUT, &cli->fd);
1757 if (!NT_STATUS_IS_OK(status)) {
1758 return False;
1759 }
1760
1761 DEBUG(3,("Retargeted\n"));
1762
1763 set_socket_options(cli->fd, lp_socket_options());
1764
1765 /* Try again */
1766 {
1767 static int depth;
1768 bool ret;
1769 if (depth > 4) {
1770 DEBUG(0,("Retarget recursion - failing\n"));
1771 return False;
1772 }
1773 depth++;
1774 ret = cli_session_request(cli, calling, called);
1775 depth--;
1776 return ret;
1777 }
1778 } /* C. Hoch 9/14/95 End */
1779
1780 if (CVAL(cli->inbuf,0) != 0x82) {
1781 /* This is the wrong place to put the error... JRA. */
1782 cli->rap_error = CVAL(cli->inbuf,4);
1783 return False;
1784 }
1785 return(True);
1786 }
1787
1788 struct fd_struct {
1789 int fd;
1790 };
1791
1792 static void smb_sock_connected(struct tevent_req *req)
1793 {
1794 struct fd_struct *pfd = tevent_req_callback_data(
1795 req, struct fd_struct);
1796 int fd;
1797 NTSTATUS status;
1798
1799 status = open_socket_out_defer_recv(req, &fd);
1800 if (NT_STATUS_IS_OK(status)) {
1801 pfd->fd = fd;
1802 }
1803 }
1804
1805 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
1806 uint16_t *port, int timeout, int *pfd)
1807 {
1808 struct event_context *ev;
1809 struct tevent_req *r139, *r445;
1810 struct fd_struct *fd139, *fd445;
1811 NTSTATUS status = NT_STATUS_NO_MEMORY;
1812
1813 if (*port != 0) {
1814 return open_socket_out(pss, *port, timeout, pfd);
1815 }
1816
1817 ev = event_context_init(talloc_tos());
1818 if (ev == NULL) {
1819 return NT_STATUS_NO_MEMORY;
1820 }
1821
1822 fd139 = talloc(ev, struct fd_struct);
1823 if (fd139 == NULL) {
1824 goto done;
1825 }
1826 fd139->fd = -1;
1827
1828 fd445 = talloc(ev, struct fd_struct);
1829 if (fd445 == NULL) {
1830 goto done;
1831 }
1832 fd445->fd = -1;
1833
1834 r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
1835 pss, 445, timeout);
1836 r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
1837 pss, 139, timeout);
1838 if ((r445 == NULL) || (r139 == NULL)) {
1839 goto done;
1840 }
1841 tevent_req_set_callback(r445, smb_sock_connected, fd445);
1842 tevent_req_set_callback(r139, smb_sock_connected, fd139);
1843
1844 while ((fd445->fd == -1) && (fd139->fd == -1)
1845 && (tevent_req_is_in_progress(r139)
1846 || tevent_req_is_in_progress(r445))) {
1847 event_loop_once(ev);
1848 }
1849
1850 if ((fd139->fd != -1) && (fd445->fd != -1)) {
1851 close(fd139->fd);
1852 fd139->fd = -1;
1853 }
1854
1855 if (fd445->fd != -1) {
1856 *port = 445;
1857 *pfd = fd445->fd;
1858 status = NT_STATUS_OK;
1859 goto done;
1860 }
1861 if (fd139->fd != -1) {
1862 *port = 139;
1863 *pfd = fd139->fd;
1864 status = NT_STATUS_OK;
1865 goto done;
1866 }
1867
1868 status = open_socket_out_defer_recv(r445, &fd445->fd);
1869 done:
1870 TALLOC_FREE(ev);
1871 return status;
1872 }
1873
1874 /****************************************************************************
1875 Open the client sockets.
1876 ****************************************************************************/
1877
1878 NTSTATUS cli_connect(struct cli_state *cli,
1879 const char *host,
1880 struct sockaddr_storage *dest_ss)
1881
1882 {
1883 int name_type = 0x20;
1884 TALLOC_CTX *frame = talloc_stackframe();
1885 unsigned int num_addrs = 0;
1886 unsigned int i = 0;
1887 struct sockaddr_storage *ss_arr = NULL;
1888 char *p = NULL;
1889
1890 /* reasonable default hostname */
1891 if (!host) {
1892 host = STAR_SMBSERVER;
1893 }
1894
1895 fstrcpy(cli->desthost, host);
1896
1897 /* allow hostnames of the form NAME#xx and do a netbios lookup */
1898 if ((p = strchr(cli->desthost, '#'))) {
1899 name_type = strtol(p+1, NULL, 16);
1900 *p = 0;
1901 }
1902
1903 if (!dest_ss || is_zero_addr((struct sockaddr *)dest_ss)) {
1904 NTSTATUS status =resolve_name_list(frame,
1905 cli->desthost,
1906 name_type,
1907 &ss_arr,
1908 &num_addrs);
1909 if (!NT_STATUS_IS_OK(status)) {
1910 TALLOC_FREE(frame);
1911 return NT_STATUS_BAD_NETWORK_NAME;
1912 }
1913 } else {
1914 num_addrs = 1;
1915 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
1916 if (!ss_arr) {
1917 TALLOC_FREE(frame);
1918 return NT_STATUS_NO_MEMORY;
1919 }
1920 *ss_arr = *dest_ss;
1921 }
1922
1923 for (i = 0; i < num_addrs; i++) {
1924 cli->dest_ss = ss_arr[i];
1925 if (getenv("LIBSMB_PROG")) {
1926 cli->fd = sock_exec(getenv("LIBSMB_PROG"));
1927 } else {
1928 uint16_t port = cli->port;
1929 NTSTATUS status;
1930 status = open_smb_socket(&cli->dest_ss, &port,
1931 cli->timeout, &cli->fd);
1932 if (NT_STATUS_IS_OK(status)) {
1933 cli->port = port;
1934 }
1935 }
1936 if (cli->fd == -1) {
1937 char addr[INET6_ADDRSTRLEN];
1938 print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
1939 DEBUG(2,("Error connecting to %s (%s)\n",
1940 dest_ss?addr:host,strerror(errno)));
1941 } else {
1942 /* Exit from loop on first connection. */
1943 break;
1944 }
1945 }
1946
1947 if (cli->fd == -1) {
1948 TALLOC_FREE(frame);
1949 return map_nt_error_from_unix(errno);
1950 }
1951
1952 if (dest_ss) {
1953 *dest_ss = cli->dest_ss;
1954 }
1955
1956 set_socket_options(cli->fd, lp_socket_options());
1957
1958 TALLOC_FREE(frame);
1959 return NT_STATUS_OK;
1960 }
1961
1962 /**
1963 establishes a connection to after the negprot.
1964 @param output_cli A fully initialised cli structure, non-null only on success
1965 @param dest_host The netbios name of the remote host
1966 @param dest_ss (optional) The the destination IP, NULL for name based lookup
1967 @param port (optional) The destination port (0 for default)
1968 @param retry bool. Did this connection fail with a retryable error ?
1969
1970 */
1971 NTSTATUS cli_start_connection(struct cli_state **output_cli,
1972 const char *my_name,
1973 const char *dest_host,
1974 struct sockaddr_storage *dest_ss, int port,
1975 int signing_state, int flags,
1976 bool *retry)
1977 {
1978 NTSTATUS nt_status;
1979 struct nmb_name calling;
1980 struct nmb_name called;
1981 struct cli_state *cli;
1982 struct sockaddr_storage ss;
1983
1984 if (retry)
1985 *retry = False;
1986
1987 if (!my_name)
1988 my_name = global_myname();
1989
1990 if (!(cli = cli_initialise_ex(signing_state))) {
1991 return NT_STATUS_NO_MEMORY;
1992 }
1993
1994 make_nmb_name(&calling, my_name, 0x0);
1995 make_nmb_name(&called , dest_host, 0x20);
1996
1997 cli_set_port(cli, port);
1998 cli_set_timeout(cli, 10000); /* 10 seconds. */
1999
2000 if (dest_ss) {
2001 ss = *dest_ss;
2002 } else {
2003 zero_sockaddr(&ss);
2004 }
2005
2006 again:
2007
2008 DEBUG(3,("Connecting to host=%s\n", dest_host));
2009
2010 nt_status = cli_connect(cli, dest_host, &ss);
2011 if (!NT_STATUS_IS_OK(nt_status)) {
2012 char addr[INET6_ADDRSTRLEN];
2013 print_sockaddr(addr, sizeof(addr), &ss);
2014 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2015 nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2016 cli_shutdown(cli);
2017 return nt_status;
2018 }
2019
2020 if (retry)
2021 *retry = True;
2022
2023 if (!cli_session_request(cli, &calling, &called)) {
2024 char *p;
2025 DEBUG(1,("session request to %s failed (%s)\n",
2026 called.name, cli_errstr(cli)));
2027 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2028 *p = 0;
2029 goto again;
2030 }
2031 if (strcmp(called.name, STAR_SMBSERVER)) {
2032 make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2033 goto again;
2034 }
2035 return NT_STATUS_BAD_NETWORK_NAME;
2036 }
2037
2038 if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2039 cli->use_spnego = False;
2040 else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2041 cli->use_kerberos = True;
2042
2043 if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2044 cli->use_kerberos) {
2045 cli->fallback_after_kerberos = true;
2046 }
2047
2048 nt_status = cli_negprot(cli);
2049 if (!NT_STATUS_IS_OK(nt_status)) {
2050 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2051 cli_shutdown(cli);
2052 return nt_status;
2053 }
2054
2055 *output_cli = cli;
2056 return NT_STATUS_OK;
2057 }
2058
2059
2060 /**
2061 establishes a connection right up to doing tconX, password specified.
2062 @param output_cli A fully initialised cli structure, non-null only on success
2063 @param dest_host The netbios name of the remote host
2064 @param dest_ip (optional) The the destination IP, NULL for name based lookup
2065 @param port (optional) The destination port (0 for default)
2066 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
2067 @param service_type The 'type' of serivice.
2068 @param user Username, unix string
2069 @param domain User's domain
2070 @param password User's password, unencrypted unix string.
2071 @param retry bool. Did this connection fail with a retryable error ?
2072 */
2073
2074 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2075 const char *my_name,
2076 const char *dest_host,
2077 struct sockaddr_storage *dest_ss, int port,
2078 const char *service, const char *service_type,
2079 const char *user, const char *domain,
2080 const char *password, int flags,
2081 int signing_state,
2082 bool *retry)
2083 {
2084 NTSTATUS nt_status;
2085 struct cli_state *cli = NULL;
2086 int pw_len = password ? strlen(password)+1 : 0;
2087
2088 *output_cli = NULL;
2089
2090 if (password == NULL) {
2091 password = "";
2092 }
2093
2094 nt_status = cli_start_connection(&cli, my_name, dest_host,
2095 dest_ss, port, signing_state,
2096 flags, retry);
2097
2098 if (!NT_STATUS_IS_OK(nt_status)) {
2099 return nt_status;
2100 }
2101
2102 nt_status = cli_session_setup(cli, user, password, pw_len, password,
2103 pw_len, domain);
2104 if (!NT_STATUS_IS_OK(nt_status)) {
2105
2106 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2107 DEBUG(1,("failed session setup with %s\n",
2108 nt_errstr(nt_status)));
2109 cli_shutdown(cli);
2110 return nt_status;
2111 }
2112
2113 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2114 if (!NT_STATUS_IS_OK(nt_status)) {
2115 DEBUG(1,("anonymous failed session setup with %s\n",
2116 nt_errstr(nt_status)));
2117 cli_shutdown(cli);
2118 return nt_status;
2119 }
2120 }
2121
2122 if (service) {
2123 nt_status = cli_tcon_andx(cli, service, service_type, password,
2124 pw_len);
2125 if (!NT_STATUS_IS_OK(nt_status)) {
2126 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2127 cli_shutdown(cli);
2128 if (NT_STATUS_IS_OK(nt_status)) {
2129 nt_status = NT_STATUS_UNSUCCESSFUL;
2130 }
2131 return nt_status;
2132 }
2133 }
2134
2135 nt_status = cli_init_creds(cli, user, domain, password);
2136 if (!NT_STATUS_IS_OK(nt_status)) {
2137 cli_shutdown(cli);
2138 return nt_status;
2139 }
2140
2141 *output_cli = cli;
2142 return NT_STATUS_OK;
2143 }
2144
2145 /****************************************************************************
2146 Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2147 ****************************************************************************/
2148
2149 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2150 struct sockaddr_storage *pdest_ss)
2151 {
2152 struct nmb_name calling, called;
2153
2154 make_nmb_name(&calling, srchost, 0x0);
2155
2156 /*
2157 * If the called name is an IP address
2158 * then use *SMBSERVER immediately.
2159 */
2160
2161 if(is_ipaddress(desthost)) {
2162 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2163 } else {
2164 make_nmb_name(&called, desthost, 0x20);
2165 }
2166
2167 if (!cli_session_request(*ppcli, &calling, &called)) {
2168 NTSTATUS status;
2169 struct nmb_name smbservername;
2170
2171 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2172
2173 /*
2174 * If the name wasn't *SMBSERVER then
2175 * try with *SMBSERVER if the first name fails.
2176 */
2177
2178 if (nmb_name_equal(&called, &smbservername)) {
2179
2180 /*
2181 * The name used was *SMBSERVER, don't bother with another name.
2182 */
2183
2184 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2185 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2186 return False;
2187 }
2188
2189 /* Try again... */
2190 cli_shutdown(*ppcli);
2191
2192 *ppcli = cli_initialise();
2193 if (!*ppcli) {
2194 /* Out of memory... */
2195 return False;
2196 }
2197
2198 status = cli_connect(*ppcli, desthost, pdest_ss);
2199 if (!NT_STATUS_IS_OK(status) ||
2200 !cli_session_request(*ppcli, &calling, &smbservername)) {
2201 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2202 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2203 return False;
2204 }
2205 }
2206
2207 return True;
2208 }
2209
2210 /****************************************************************************
2211 Send an old style tcon.
2212 ****************************************************************************/
2213 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2214 const char *service, const char *pass, const char *dev,
2215 uint16 *max_xmit, uint16 *tid)
2216 {
2217 char *p;
2218
2219 if (!lp_client_plaintext_auth() && (*pass)) {
2220 DEBUG(1, ("Server requested plaintext password but 'client "
2221 "plaintext auth' is disabled\n"));
2222 return NT_STATUS_ACCESS_DENIED;
2223 }
2224
2225 memset(cli->outbuf,'\0',smb_size);
2226 memset(cli->inbuf,'\0',smb_size);
2227
2228 cli_set_message(cli->outbuf, 0, 0, True);
2229 SCVAL(cli->outbuf,smb_com,SMBtcon);
2230 cli_setup_packet(cli);
2231
2232 p = smb_buf(cli->outbuf);
2233 *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
2234 *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
2235 *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
2236
2237 cli_setup_bcc(cli, p);
2238
2239 cli_send_smb(cli);
2240 if (!cli_receive_smb(cli)) {
2241 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2242 }
2243
2244 if (cli_is_error(cli)) {
2245 return cli_nt_error(cli);
2246 }
2247
2248 *max_xmit = SVAL(cli->inbuf, smb_vwv0);
2249 *tid = SVAL(cli->inbuf, smb_vwv1);
2250
2251 return NT_STATUS_OK;
2252 }
2253
2254 /* Return a cli_state pointing at the IPC$ share for the given server */
2255
2256 struct cli_state *get_ipc_connect(char *server,
2257 struct sockaddr_storage *server_ss,
2258 const struct user_auth_info *user_info)
2259 {
2260 struct cli_state *cli;
2261 NTSTATUS nt_status;
2262 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2263
2264 if (user_info->use_kerberos) {
2265 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2266 }
2267
2268 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2269 user_info->username ? user_info->username : "",
2270 lp_workgroup(),
2271 user_info->password ? user_info->password : "",
2272 flags,
2273 Undefined, NULL);
2274
2275 if (NT_STATUS_IS_OK(nt_status)) {
2276 return cli;
2277 } else if (is_ipaddress(server)) {
2278 /* windows 9* needs a correct NMB name for connections */
2279 fstring remote_name;
2280
2281 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2282 cli = get_ipc_connect(remote_name, server_ss, user_info);
2283 if (cli)
2284 return cli;
2285 }
2286 }
2287 return NULL;
2288 }
2289
2290 /*
2291 * Given the IP address of a master browser on the network, return its
2292 * workgroup and connect to it.
2293 *
2294 * This function is provided to allow additional processing beyond what
2295 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2296 * browsers and obtain each master browsers' list of domains (in case the
2297 * first master browser is recently on the network and has not yet
2298 * synchronized with other master browsers and therefore does not yet have the
2299 * entire network browse list)
2300 */
2301
2302 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2303 struct ip_service *mb_ip,
2304 const struct user_auth_info *user_info,
2305 char **pp_workgroup_out)
2306 {
2307 char addr[INET6_ADDRSTRLEN];
2308 fstring name;
2309 struct cli_state *cli;
2310 struct sockaddr_storage server_ss;
2311
2312 *pp_workgroup_out = NULL;
2313
2314 print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2315 DEBUG(99, ("Looking up name of master browser %s\n",
2316 addr));
2317
2318 /*
2319 * Do a name status query to find out the name of the master browser.
2320 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2321 * master browser will not respond to a wildcard query (or, at least,
2322 * an NT4 server acting as the domain master browser will not).
2323 *
2324 * We might be able to use ONLY the query on MSBROWSE, but that's not
2325 * yet been tested with all Windows versions, so until it is, leave
2326 * the original wildcard query as the first choice and fall back to
2327 * MSBROWSE if the wildcard query fails.
2328 */
2329 if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2330 !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2331
2332 DEBUG(99, ("Could not retrieve name status for %s\n",
2333 addr));
2334 return NULL;
2335 }
2336
2337 if (!find_master_ip(name, &server_ss)) {
2338 DEBUG(99, ("Could not find master ip for %s\n", name));
2339 return NULL;
2340 }
2341
2342 *pp_workgroup_out = talloc_strdup(ctx, name);
2343
2344 DEBUG(4, ("found master browser %s, %s\n", name, addr));
2345
2346 print_sockaddr(addr, sizeof(addr), &server_ss);
2347 cli = get_ipc_connect(addr, &server_ss, user_info);
2348
2349 return cli;
2350 }
2351
2352 /*
2353 * Return the IP address and workgroup of a master browser on the network, and
2354 * connect to it.
2355 */
2356
2357 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2358 const struct user_auth_info *user_info,
2359 char **pp_workgroup_out)
2360 {
2361 struct ip_service *ip_list;
2362 struct cli_state *cli;
2363 int i, count;
2364
2365 *pp_workgroup_out = NULL;
2366
2367 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2368
2369 /* Go looking for workgroups by broadcasting on the local network */
2370
2371 if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2372 &count))) {
2373 DEBUG(99, ("No master browsers responded\n"));
2374 return False;
2375 }
2376
2377 for (i = 0; i < count; i++) {
2378 char addr[INET6_ADDRSTRLEN];
2379 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2380 DEBUG(99, ("Found master browser %s\n", addr));
2381
2382 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2383 user_info, pp_workgroup_out);
2384 if (cli)
2385 return(cli);
2386 }
2387
2388 return NULL;
2389 }
reg import