source4/libcli/smb2/session.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    SMB2 client session handling
   5
   6    Copyright (C) Andrew Tridgell 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "system/network.h"
  24 #include <tevent.h>
  25 #include "lib/util/tevent_ntstatus.h"
  26 #include "libcli/raw/libcliraw.h"
  27 #include "libcli/smb2/smb2.h"
  28 #include "libcli/smb2/smb2_calls.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "../libcli/smb/smbXcli_base.h"
  31 #include "../source3/libsmb/smb2cli.h"
  32
  33 /**
  34   initialise a smb2_session structure
  35  */
  36 struct smb2_session *smb2_session_init(struct smb2_transport *transport,
  37                                        struct gensec_settings *settings,
  38                                        TALLOC_CTX *parent_ctx, bool primary)
  39 {
  40         struct smb2_session *session;
  41         NTSTATUS status;
  42
  43         session = talloc_zero(parent_ctx, struct smb2_session);
  44         if (!session) {
  45                 return NULL;
  46         }
  47         if (primary) {
  48                 session->transport = talloc_steal(session, transport);
  49         } else {
  50                 session->transport = talloc_reference(session, transport);
  51         }
  52
  53         session->pid = getpid();
  54
  55         session->smbXcli = smbXcli_session_create(session, transport->conn);
  56         if (session->smbXcli == NULL) {
  57                 talloc_free(session);
  58                 return NULL;
  59         }
  60
  61         /* prepare a gensec context for later use */
  62         status = gensec_client_start(session, &session->gensec,
  63                                      settings);
  64         if (!NT_STATUS_IS_OK(status)) {
  65                 talloc_free(session);
  66                 return NULL;
  67         }
  68
  69         gensec_want_feature(session->gensec, GENSEC_FEATURE_SESSION_KEY);
  70
  71         return session;
  72 }
  73
  74 struct smb2_session_setup_spnego_state {
  75         struct tevent_context *ev;
  76         struct smb2_session *session;
  77         struct cli_credentials *credentials;
  78         NTSTATUS gensec_status;
  79         DATA_BLOB in_secblob;
  80         DATA_BLOB out_secblob;
  81 };
  82
  83 static void smb2_session_setup_spnego_done(struct tevent_req *subreq);
  84
  85 /*
  86   a composite function that does a full SPNEGO session setup
  87  */
  88 struct tevent_req *smb2_session_setup_spnego_send(TALLOC_CTX *mem_ctx,
  89                                                   struct tevent_context *ev,
  90                                                   struct smb2_session *session,
  91                                                   struct cli_credentials *credentials)
  92 {
  93         struct tevent_req *req;
  94         struct smb2_session_setup_spnego_state *state;
  95         const char *chosen_oid;
  96         struct tevent_req *subreq;
  97         NTSTATUS status;
  98         const DATA_BLOB *server_gss_blob;
  99         DATA_BLOB negprot_secblob = data_blob_null;
 100         uint32_t timeout_msec;
 101
 102         timeout_msec = session->transport->options.request_timeout * 1000;
 103
 104         req = tevent_req_create(mem_ctx, &state,
 105                                 struct smb2_session_setup_spnego_state);
 106         if (req == NULL) {
 107                 return NULL;
 108         }
 109         state->ev = ev;
 110         state->session = session;
 111         state->credentials = credentials;
 112
 113         server_gss_blob = smbXcli_conn_server_gss_blob(session->transport->conn);
 114         if (server_gss_blob) {
 115                 negprot_secblob = *server_gss_blob;
 116         }
 117
 118         status = gensec_set_credentials(session->gensec, credentials);
 119         if (tevent_req_nterror(req, status)) {
 120                 return tevent_req_post(req, ev);
 121         }
 122
 123         status = gensec_set_target_hostname(session->gensec,
 124                                             smbXcli_conn_remote_name(session->transport->conn));
 125         if (tevent_req_nterror(req, status)) {
 126                 return tevent_req_post(req, ev);
 127         }
 128
 129         status = gensec_set_target_service(session->gensec, "cifs");
 130         if (tevent_req_nterror(req, status)) {
 131                 return tevent_req_post(req, ev);
 132         }
 133
 134         if (negprot_secblob.length > 0) {
 135                 chosen_oid = GENSEC_OID_SPNEGO;
 136         } else {
 137                 chosen_oid = GENSEC_OID_NTLMSSP;
 138         }
 139
 140         status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
 141         if (tevent_req_nterror(req, status)) {
 142                 return tevent_req_post(req, ev);
 143         }
 144
 145         status = gensec_update(session->gensec, state,
 146                                state->ev,
 147                                negprot_secblob,
 148                                &state->in_secblob);
 149         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 150                 tevent_req_nterror(req, status);
 151                 return tevent_req_post(req, ev);
 152         }
 153         state->gensec_status = status;
 154
 155         subreq = smb2cli_session_setup_send(state, state->ev,
 156                                             session->transport->conn,
 157                                             timeout_msec,
 158                                             session->smbXcli,
 159                                             0, /* in_flags */
 160                                             0, /* in_capabilities */
 161                                             0, /* in_channel */
 162                                             NULL, /* in_previous_session */
 163                                             &state->in_secblob);
 164         if (tevent_req_nomem(subreq, req)) {
 165                 return tevent_req_post(req, ev);
 166         }
 167         tevent_req_set_callback(subreq, smb2_session_setup_spnego_done, req);
 168
 169         return req;
 170 }
 171
 172 /*
 173   handle continuations of the spnego session setup
 174 */
 175 static void smb2_session_setup_spnego_done(struct tevent_req *subreq)
 176 {
 177         struct tevent_req *req =
 178                 tevent_req_callback_data(subreq,
 179                 struct tevent_req);
 180         struct smb2_session_setup_spnego_state *state =
 181                 tevent_req_data(req,
 182                 struct smb2_session_setup_spnego_state);
 183         struct smb2_session *session = state->session;
 184         NTSTATUS peer_status;
 185         NTSTATUS status;
 186         struct iovec *recv_iov;
 187         uint32_t timeout_msec;
 188
 189         timeout_msec = session->transport->options.request_timeout * 1000;
 190
 191         status = smb2cli_session_setup_recv(subreq, state,
 192                                             &recv_iov,
 193                                             &state->out_secblob);
 194         if (!NT_STATUS_IS_OK(status) &&
 195             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 196                 tevent_req_nterror(req, status);
 197                 return;
 198         }
 199         peer_status = status;
 200
 201         if (NT_STATUS_EQUAL(state->gensec_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 202                 status = gensec_update(session->gensec, state,
 203                                        state->ev,
 204                                        state->out_secblob,
 205                                        &state->in_secblob);
 206                 state->gensec_status = status;
 207         }
 208
 209         if (!NT_STATUS_IS_OK(status) &&
 210             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 211                 tevent_req_nterror(req, status);
 212                 return;
 213         }
 214
 215         if (NT_STATUS_IS_OK(peer_status) && NT_STATUS_IS_OK(state->gensec_status)) {
 216                 status = gensec_session_key(session->gensec, session,
 217                                             &session->session_key);
 218                 if (tevent_req_nterror(req, status)) {
 219                         return;
 220                 }
 221
 222                 status = smb2cli_session_update_session_key(session->smbXcli,
 223                                                             session->session_key,
 224                                                             recv_iov);
 225                 if (tevent_req_nterror(req, status)) {
 226                         return;
 227                 }
 228
 229                 tevent_req_done(req);
 230                 return;
 231         }
 232
 233         subreq = smb2cli_session_setup_send(state, state->ev,
 234                                             session->transport->conn,
 235                                             timeout_msec,
 236                                             session->smbXcli,
 237                                             0, /* in_flags */
 238                                             0, /* in_capabilities */
 239                                             0, /* in_channel */
 240                                             NULL, /* in_previous_session */
 241                                             &state->in_secblob);
 242         if (tevent_req_nomem(subreq, req)) {
 243                 return;
 244         }
 245         tevent_req_set_callback(subreq, smb2_session_setup_spnego_done, req);
 246 }
 247
 248 /*
 249   receive a composite session setup reply
 250 */
 251 NTSTATUS smb2_session_setup_spnego_recv(struct tevent_req *req)
 252 {
 253         return tevent_req_simple_recv_ntstatus(req);
 254 }
 255
 256 /*
 257   sync version of smb2_session_setup_spnego
 258 */
 259 NTSTATUS smb2_session_setup_spnego(struct smb2_session *session,
 260                                    struct cli_credentials *credentials)
 261 {
 262         struct tevent_req *subreq;
 263         NTSTATUS status;
 264         bool ok;
 265         TALLOC_CTX *frame = talloc_stackframe();
 266         struct tevent_context *ev = session->transport->ev;
 267
 268         if (frame == NULL) {
 269                 return NT_STATUS_NO_MEMORY;
 270         }
 271
 272         subreq = smb2_session_setup_spnego_send(frame, ev,
 273                                                 session, credentials);
 274         if (subreq == NULL) {
 275                 TALLOC_FREE(frame);
 276                 return NT_STATUS_NO_MEMORY;
 277         }
 278
 279         ok = tevent_req_poll(subreq, ev);
 280         if (!ok) {
 281                 status = map_nt_error_from_unix_common(errno);
 282                 TALLOC_FREE(frame);
 283                 return status;
 284         }
 285
 286         status = smb2_session_setup_spnego_recv(subreq);
 287         TALLOC_FREE(subreq);
 288         if (!NT_STATUS_IS_OK(status)) {
 289                 TALLOC_FREE(frame);
 290                 return status;
 291         }
 292
 293         TALLOC_FREE(frame);
 294         return NT_STATUS_OK;
 295 }