?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "s3:smbd: set req->smb2req->compat_chain_fsp in file_fsp()"
[Samba/gebeck_regimport.git] / source3 / libsmb / cliconnect.c
blobf46ce06e4c3ebc96493da6884a01bf2452f63d8f
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6 Copyright (C) Volker Lendecke 2011
7 Copyright (C) Jeremy Allison 2011
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "libsmb/libsmb.h"
25 #include "auth_info.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../libcli/auth/spnego.h"
28 #include "smb_krb5.h"
29 #include "../auth/ntlmssp/ntlmssp.h"
30 #include "libads/kerberos_proto.h"
31 #include "krb5_env.h"
32 #include "../lib/util/tevent_ntstatus.h"
33 #include "async_smb.h"
34 #include "libsmb/nmblib.h"
35 #include "librpc/ndr/libndr.h"
36 #include "../libcli/smb/smbXcli_base.h"
37 #include "smb2cli.h"
38
39 #define STAR_SMBSERVER "*SMBSERVER"
40
41 /********************************************************
42 Utility function to ensure we always return at least
43 a valid char * pointer to an empty string for the
44 cli->server_os, cli->server_type and cli->server_domain
45 strings.
46 *******************************************************/
47
48 static NTSTATUS smb_bytes_talloc_string(TALLOC_CTX *mem_ctx,
49 const uint8_t *hdr,
50 char **dest,
51 uint8_t *src,
52 size_t srclen,
53 ssize_t *destlen)
54 {
55 *destlen = clistr_pull_talloc(mem_ctx,
56 (const char *)hdr,
57 SVAL(hdr, HDR_FLG2),
58 dest,
59 (char *)src,
60 srclen,
61 STR_TERMINATE);
62 if (*destlen == -1) {
63 return NT_STATUS_NO_MEMORY;
64 }
65
66 if (*dest == NULL) {
67 *dest = talloc_strdup(mem_ctx, "");
68 if (*dest == NULL) {
69 return NT_STATUS_NO_MEMORY;
70 }
71 }
72 return NT_STATUS_OK;
73 }
74
75 /**
76 * Set the user session key for a connection
77 * @param cli The cli structure to add it too
78 * @param session_key The session key used. (A copy of this is taken for the cli struct)
79 *
80 */
81
82 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
83 {
84 cli->user_session_key = data_blob(session_key.data, session_key.length);
85 }
86
87 /****************************************************************************
88 Do an old lanman2 style session setup.
89 ****************************************************************************/
90
91 struct cli_session_setup_lanman2_state {
92 struct cli_state *cli;
93 uint16_t vwv[10];
94 const char *user;
95 };
96
97 static void cli_session_setup_lanman2_done(struct tevent_req *subreq);
98
99 static struct tevent_req *cli_session_setup_lanman2_send(
100 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
101 struct cli_state *cli, const char *user,
102 const char *pass, size_t passlen,
103 const char *workgroup)
104 {
105 struct tevent_req *req, *subreq;
106 struct cli_session_setup_lanman2_state *state;
107 DATA_BLOB lm_response = data_blob_null;
108 uint16_t *vwv;
109 uint8_t *bytes;
110 char *tmp;
111 uint16_t sec_mode = smb1cli_conn_server_security_mode(cli->conn);
112
113 req = tevent_req_create(mem_ctx, &state,
114 struct cli_session_setup_lanman2_state);
115 if (req == NULL) {
116 return NULL;
117 }
118 state->cli = cli;
119 state->user = user;
120 vwv = state->vwv;
121
122 /*
123 * if in share level security then don't send a password now
124 */
125 if (!(sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
126 passlen = 0;
127 }
128
129 if (passlen > 0
130 && (sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
131 && passlen != 24) {
132 /*
133 * Encrypted mode needed, and non encrypted password
134 * supplied.
135 */
136 lm_response = data_blob(NULL, 24);
137 if (tevent_req_nomem(lm_response.data, req)) {
138 return tevent_req_post(req, ev);
139 }
140
141 if (!SMBencrypt(pass, smb1cli_conn_server_challenge(cli->conn),
142 (uint8_t *)lm_response.data)) {
143 DEBUG(1, ("Password is > 14 chars in length, and is "
144 "therefore incompatible with Lanman "
145 "authentication\n"));
146 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
147 return tevent_req_post(req, ev);
148 }
149 } else if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
150 && passlen == 24) {
151 /*
152 * Encrypted mode needed, and encrypted password
153 * supplied.
154 */
155 lm_response = data_blob(pass, passlen);
156 if (tevent_req_nomem(lm_response.data, req)) {
157 return tevent_req_post(req, ev);
158 }
159 } else if (passlen > 0) {
160 uint8_t *buf;
161 size_t converted_size;
162 /*
163 * Plaintext mode needed, assume plaintext supplied.
164 */
165 buf = talloc_array(talloc_tos(), uint8_t, 0);
166 buf = smb_bytes_push_str(buf, smbXcli_conn_use_unicode(cli->conn), pass, passlen+1,
167 &converted_size);
168 if (tevent_req_nomem(buf, req)) {
169 return tevent_req_post(req, ev);
170 }
171 lm_response = data_blob(pass, passlen);
172 TALLOC_FREE(buf);
173 if (tevent_req_nomem(lm_response.data, req)) {
174 return tevent_req_post(req, ev);
175 }
176 }
177
178 SCVAL(vwv+0, 0, 0xff);
179 SCVAL(vwv+0, 1, 0);
180 SSVAL(vwv+1, 0, 0);
181 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
182 SSVAL(vwv+3, 0, 2);
183 SSVAL(vwv+4, 0, 1);
184 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
185 SSVAL(vwv+7, 0, lm_response.length);
186
187 bytes = talloc_array(state, uint8_t, lm_response.length);
188 if (tevent_req_nomem(bytes, req)) {
189 return tevent_req_post(req, ev);
190 }
191 if (lm_response.length != 0) {
192 memcpy(bytes, lm_response.data, lm_response.length);
193 }
194 data_blob_free(&lm_response);
195
196 tmp = talloc_strdup_upper(talloc_tos(), user);
197 if (tevent_req_nomem(tmp, req)) {
198 return tevent_req_post(req, ev);
199 }
200 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), tmp, strlen(tmp)+1,
201 NULL);
202 TALLOC_FREE(tmp);
203
204 tmp = talloc_strdup_upper(talloc_tos(), workgroup);
205 if (tevent_req_nomem(tmp, req)) {
206 return tevent_req_post(req, ev);
207 }
208 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), tmp, strlen(tmp)+1,
209 NULL);
210 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Unix", 5, NULL);
211 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Samba", 6, NULL);
212
213 if (tevent_req_nomem(bytes, req)) {
214 return tevent_req_post(req, ev);
215 }
216
217 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 10, vwv,
218 talloc_get_size(bytes), bytes);
219 if (tevent_req_nomem(subreq, req)) {
220 return tevent_req_post(req, ev);
221 }
222 tevent_req_set_callback(subreq, cli_session_setup_lanman2_done, req);
223 return req;
224 }
225
226 static void cli_session_setup_lanman2_done(struct tevent_req *subreq)
227 {
228 struct tevent_req *req = tevent_req_callback_data(
229 subreq, struct tevent_req);
230 struct cli_session_setup_lanman2_state *state = tevent_req_data(
231 req, struct cli_session_setup_lanman2_state);
232 struct cli_state *cli = state->cli;
233 uint32_t num_bytes;
234 uint8_t *in;
235 uint8_t *inhdr;
236 uint8_t *bytes;
237 uint8_t *p;
238 NTSTATUS status;
239 ssize_t ret;
240 uint8_t wct;
241 uint16_t *vwv;
242
243 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
244 &num_bytes, &bytes);
245 TALLOC_FREE(subreq);
246 if (!NT_STATUS_IS_OK(status)) {
247 tevent_req_nterror(req, status);
248 return;
249 }
250
251 inhdr = in + NBT_HDR_SIZE;
252 p = bytes;
253
254 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
255 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
256
257 status = smb_bytes_talloc_string(cli,
258 inhdr,
259 &cli->server_os,
260 p,
261 bytes+num_bytes-p,
262 &ret);
263
264 if (!NT_STATUS_IS_OK(status)) {
265 tevent_req_nterror(req, status);
266 return;
267 }
268 p += ret;
269
270 status = smb_bytes_talloc_string(cli,
271 inhdr,
272 &cli->server_type,
273 p,
274 bytes+num_bytes-p,
275 &ret);
276
277 if (!NT_STATUS_IS_OK(status)) {
278 tevent_req_nterror(req, status);
279 return;
280 }
281 p += ret;
282
283 status = smb_bytes_talloc_string(cli,
284 inhdr,
285 &cli->server_domain,
286 p,
287 bytes+num_bytes-p,
288 &ret);
289
290 if (!NT_STATUS_IS_OK(status)) {
291 tevent_req_nterror(req, status);
292 return;
293 }
294 p += ret;
295
296 status = cli_set_username(cli, state->user);
297 if (tevent_req_nterror(req, status)) {
298 return;
299 }
300 tevent_req_done(req);
301 }
302
303 static NTSTATUS cli_session_setup_lanman2_recv(struct tevent_req *req)
304 {
305 return tevent_req_simple_recv_ntstatus(req);
306 }
307
308 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli, const char *user,
309 const char *pass, size_t passlen,
310 const char *workgroup)
311 {
312 TALLOC_CTX *frame = talloc_stackframe();
313 struct event_context *ev;
314 struct tevent_req *req;
315 NTSTATUS status = NT_STATUS_NO_MEMORY;
316
317 if (smbXcli_conn_has_async_calls(cli->conn)) {
318 /*
319 * Can't use sync call while an async call is in flight
320 */
321 status = NT_STATUS_INVALID_PARAMETER;
322 goto fail;
323 }
324 ev = event_context_init(frame);
325 if (ev == NULL) {
326 goto fail;
327 }
328 req = cli_session_setup_lanman2_send(frame, ev, cli, user, pass, passlen,
329 workgroup);
330 if (req == NULL) {
331 goto fail;
332 }
333 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
334 goto fail;
335 }
336 status = cli_session_setup_lanman2_recv(req);
337 fail:
338 TALLOC_FREE(frame);
339 return status;
340 }
341
342 /****************************************************************************
343 Work out suitable capabilities to offer the server.
344 ****************************************************************************/
345
346 static uint32_t cli_session_setup_capabilities(struct cli_state *cli,
347 uint32_t sesssetup_capabilities)
348 {
349 uint32_t client_capabilities = smb1cli_conn_capabilities(cli->conn);
350
351 /*
352 * We only send capabilities based on the mask for:
353 * - client only flags
354 * - flags used in both directions
355 *
356 * We do not echo the server only flags.
357 */
358 client_capabilities &= (SMB_CAP_BOTH_MASK | SMB_CAP_CLIENT_MASK);
359
360 /*
361 * Session Setup specific flags CAP_DYNAMIC_REAUTH
362 * and CAP_EXTENDED_SECURITY are passed by the caller.
363 * We need that in order to do guest logins even if
364 * CAP_EXTENDED_SECURITY is negotiated.
365 */
366 client_capabilities &= ~(CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
367 sesssetup_capabilities &= (CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
368 client_capabilities |= sesssetup_capabilities;
369
370 return client_capabilities;
371 }
372
373 /****************************************************************************
374 Do a NT1 guest session setup.
375 ****************************************************************************/
376
377 struct cli_session_setup_guest_state {
378 struct cli_state *cli;
379 uint16_t vwv[13];
380 struct iovec bytes;
381 };
382
383 static void cli_session_setup_guest_done(struct tevent_req *subreq);
384
385 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
386 struct event_context *ev,
387 struct cli_state *cli,
388 struct tevent_req **psmbreq)
389 {
390 struct tevent_req *req, *subreq;
391 struct cli_session_setup_guest_state *state;
392 uint16_t *vwv;
393 uint8_t *bytes;
394
395 req = tevent_req_create(mem_ctx, &state,
396 struct cli_session_setup_guest_state);
397 if (req == NULL) {
398 return NULL;
399 }
400 state->cli = cli;
401 vwv = state->vwv;
402
403 SCVAL(vwv+0, 0, 0xFF);
404 SCVAL(vwv+0, 1, 0);
405 SSVAL(vwv+1, 0, 0);
406 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
407 SSVAL(vwv+3, 0, 2);
408 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
409 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
410 SSVAL(vwv+7, 0, 0);
411 SSVAL(vwv+8, 0, 0);
412 SSVAL(vwv+9, 0, 0);
413 SSVAL(vwv+10, 0, 0);
414 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
415
416 bytes = talloc_array(state, uint8_t, 0);
417
418 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "", 1, /* username */
419 NULL);
420 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "", 1, /* workgroup */
421 NULL);
422 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Unix", 5, NULL);
423 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Samba", 6, NULL);
424
425 if (bytes == NULL) {
426 TALLOC_FREE(req);
427 return NULL;
428 }
429
430 state->bytes.iov_base = (void *)bytes;
431 state->bytes.iov_len = talloc_get_size(bytes);
432
433 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
434 1, &state->bytes);
435 if (subreq == NULL) {
436 TALLOC_FREE(req);
437 return NULL;
438 }
439 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
440 *psmbreq = subreq;
441 return req;
442 }
443
444 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
445 struct event_context *ev,
446 struct cli_state *cli)
447 {
448 struct tevent_req *req, *subreq;
449 NTSTATUS status;
450
451 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
452 if (req == NULL) {
453 return NULL;
454 }
455
456 status = smb1cli_req_chain_submit(&subreq, 1);
457 if (NT_STATUS_IS_OK(status)) {
458 tevent_req_nterror(req, status);
459 return tevent_req_post(req, ev);
460 }
461 return req;
462 }
463
464 static void cli_session_setup_guest_done(struct tevent_req *subreq)
465 {
466 struct tevent_req *req = tevent_req_callback_data(
467 subreq, struct tevent_req);
468 struct cli_session_setup_guest_state *state = tevent_req_data(
469 req, struct cli_session_setup_guest_state);
470 struct cli_state *cli = state->cli;
471 uint32_t num_bytes;
472 uint8_t *in;
473 uint8_t *inhdr;
474 uint8_t *bytes;
475 uint8_t *p;
476 NTSTATUS status;
477 ssize_t ret;
478 uint8_t wct;
479 uint16_t *vwv;
480
481 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
482 &num_bytes, &bytes);
483 TALLOC_FREE(subreq);
484 if (!NT_STATUS_IS_OK(status)) {
485 tevent_req_nterror(req, status);
486 return;
487 }
488
489 inhdr = in + NBT_HDR_SIZE;
490 p = bytes;
491
492 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
493 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
494
495 status = smb_bytes_talloc_string(cli,
496 inhdr,
497 &cli->server_os,
498 p,
499 bytes+num_bytes-p,
500 &ret);
501
502 if (!NT_STATUS_IS_OK(status)) {
503 tevent_req_nterror(req, status);
504 return;
505 }
506 p += ret;
507
508 status = smb_bytes_talloc_string(cli,
509 inhdr,
510 &cli->server_type,
511 p,
512 bytes+num_bytes-p,
513 &ret);
514
515 if (!NT_STATUS_IS_OK(status)) {
516 tevent_req_nterror(req, status);
517 return;
518 }
519 p += ret;
520
521 status = smb_bytes_talloc_string(cli,
522 inhdr,
523 &cli->server_domain,
524 p,
525 bytes+num_bytes-p,
526 &ret);
527
528 if (!NT_STATUS_IS_OK(status)) {
529 tevent_req_nterror(req, status);
530 return;
531 }
532 p += ret;
533
534 status = cli_set_username(cli, "");
535 if (!NT_STATUS_IS_OK(status)) {
536 tevent_req_nterror(req, status);
537 return;
538 }
539 tevent_req_done(req);
540 }
541
542 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
543 {
544 return tevent_req_simple_recv_ntstatus(req);
545 }
546
547 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
548 {
549 TALLOC_CTX *frame = talloc_stackframe();
550 struct event_context *ev;
551 struct tevent_req *req;
552 NTSTATUS status = NT_STATUS_OK;
553
554 if (smbXcli_conn_has_async_calls(cli->conn)) {
555 /*
556 * Can't use sync call while an async call is in flight
557 */
558 status = NT_STATUS_INVALID_PARAMETER;
559 goto fail;
560 }
561
562 ev = event_context_init(frame);
563 if (ev == NULL) {
564 status = NT_STATUS_NO_MEMORY;
565 goto fail;
566 }
567
568 req = cli_session_setup_guest_send(frame, ev, cli);
569 if (req == NULL) {
570 status = NT_STATUS_NO_MEMORY;
571 goto fail;
572 }
573
574 if (!tevent_req_poll(req, ev)) {
575 status = map_nt_error_from_unix(errno);
576 goto fail;
577 }
578
579 status = cli_session_setup_guest_recv(req);
580 fail:
581 TALLOC_FREE(frame);
582 return status;
583 }
584
585 /****************************************************************************
586 Do a NT1 plaintext session setup.
587 ****************************************************************************/
588
589 struct cli_session_setup_plain_state {
590 struct cli_state *cli;
591 uint16_t vwv[13];
592 const char *user;
593 };
594
595 static void cli_session_setup_plain_done(struct tevent_req *subreq);
596
597 static struct tevent_req *cli_session_setup_plain_send(
598 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
599 struct cli_state *cli,
600 const char *user, const char *pass, const char *workgroup)
601 {
602 struct tevent_req *req, *subreq;
603 struct cli_session_setup_plain_state *state;
604 uint16_t *vwv;
605 uint8_t *bytes;
606 size_t passlen;
607 char *version;
608
609 req = tevent_req_create(mem_ctx, &state,
610 struct cli_session_setup_plain_state);
611 if (req == NULL) {
612 return NULL;
613 }
614 state->cli = cli;
615 state->user = user;
616 vwv = state->vwv;
617
618 SCVAL(vwv+0, 0, 0xff);
619 SCVAL(vwv+0, 1, 0);
620 SSVAL(vwv+1, 0, 0);
621 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
622 SSVAL(vwv+3, 0, 2);
623 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
624 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
625 SSVAL(vwv+7, 0, 0);
626 SSVAL(vwv+8, 0, 0);
627 SSVAL(vwv+9, 0, 0);
628 SSVAL(vwv+10, 0, 0);
629 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
630
631 bytes = talloc_array(state, uint8_t, 0);
632 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), pass, strlen(pass)+1,
633 &passlen);
634 if (tevent_req_nomem(bytes, req)) {
635 return tevent_req_post(req, ev);
636 }
637 SSVAL(vwv + (smbXcli_conn_use_unicode(cli->conn) ? 8 : 7), 0, passlen);
638
639 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
640 user, strlen(user)+1, NULL);
641 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
642 workgroup, strlen(workgroup)+1, NULL);
643 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
644 "Unix", 5, NULL);
645
646 version = talloc_asprintf(talloc_tos(), "Samba %s",
647 samba_version_string());
648 if (tevent_req_nomem(version, req)){
649 return tevent_req_post(req, ev);
650 }
651 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
652 version, strlen(version)+1, NULL);
653 TALLOC_FREE(version);
654
655 if (tevent_req_nomem(bytes, req)) {
656 return tevent_req_post(req, ev);
657 }
658
659 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
660 talloc_get_size(bytes), bytes);
661 if (tevent_req_nomem(subreq, req)) {
662 return tevent_req_post(req, ev);
663 }
664 tevent_req_set_callback(subreq, cli_session_setup_plain_done, req);
665 return req;
666 }
667
668 static void cli_session_setup_plain_done(struct tevent_req *subreq)
669 {
670 struct tevent_req *req = tevent_req_callback_data(
671 subreq, struct tevent_req);
672 struct cli_session_setup_plain_state *state = tevent_req_data(
673 req, struct cli_session_setup_plain_state);
674 struct cli_state *cli = state->cli;
675 uint32_t num_bytes;
676 uint8_t *in;
677 uint8_t *inhdr;
678 uint8_t *bytes;
679 uint8_t *p;
680 NTSTATUS status;
681 ssize_t ret;
682 uint8_t wct;
683 uint16_t *vwv;
684
685 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
686 &num_bytes, &bytes);
687 TALLOC_FREE(subreq);
688 if (tevent_req_nterror(req, status)) {
689 return;
690 }
691
692 inhdr = in + NBT_HDR_SIZE;
693 p = bytes;
694
695 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
696 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
697
698 status = smb_bytes_talloc_string(cli,
699 inhdr,
700 &cli->server_os,
701 p,
702 bytes+num_bytes-p,
703 &ret);
704
705 if (!NT_STATUS_IS_OK(status)) {
706 tevent_req_nterror(req, status);
707 return;
708 }
709 p += ret;
710
711 status = smb_bytes_talloc_string(cli,
712 inhdr,
713 &cli->server_type,
714 p,
715 bytes+num_bytes-p,
716 &ret);
717
718 if (!NT_STATUS_IS_OK(status)) {
719 tevent_req_nterror(req, status);
720 return;
721 }
722 p += ret;
723
724 status = smb_bytes_talloc_string(cli,
725 inhdr,
726 &cli->server_domain,
727 p,
728 bytes+num_bytes-p,
729 &ret);
730
731 if (!NT_STATUS_IS_OK(status)) {
732 tevent_req_nterror(req, status);
733 return;
734 }
735 p += ret;
736
737 status = cli_set_username(cli, state->user);
738 if (tevent_req_nterror(req, status)) {
739 return;
740 }
741
742 tevent_req_done(req);
743 }
744
745 static NTSTATUS cli_session_setup_plain_recv(struct tevent_req *req)
746 {
747 return tevent_req_simple_recv_ntstatus(req);
748 }
749
750 static NTSTATUS cli_session_setup_plain(struct cli_state *cli,
751 const char *user, const char *pass,
752 const char *workgroup)
753 {
754 TALLOC_CTX *frame = talloc_stackframe();
755 struct event_context *ev;
756 struct tevent_req *req;
757 NTSTATUS status = NT_STATUS_NO_MEMORY;
758
759 if (smbXcli_conn_has_async_calls(cli->conn)) {
760 /*
761 * Can't use sync call while an async call is in flight
762 */
763 status = NT_STATUS_INVALID_PARAMETER;
764 goto fail;
765 }
766 ev = event_context_init(frame);
767 if (ev == NULL) {
768 goto fail;
769 }
770 req = cli_session_setup_plain_send(frame, ev, cli, user, pass,
771 workgroup);
772 if (req == NULL) {
773 goto fail;
774 }
775 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
776 goto fail;
777 }
778 status = cli_session_setup_plain_recv(req);
779 fail:
780 TALLOC_FREE(frame);
781 return status;
782 }
783
784 /****************************************************************************
785 do a NT1 NTLM/LM encrypted session setup - for when extended security
786 is not negotiated.
787 @param cli client state to create do session setup on
788 @param user username
789 @param pass *either* cleartext password (passlen !=24) or LM response.
790 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
791 @param workgroup The user's domain.
792 ****************************************************************************/
793
794 struct cli_session_setup_nt1_state {
795 struct cli_state *cli;
796 uint16_t vwv[13];
797 DATA_BLOB response;
798 DATA_BLOB session_key;
799 const char *user;
800 };
801
802 static void cli_session_setup_nt1_done(struct tevent_req *subreq);
803
804 static struct tevent_req *cli_session_setup_nt1_send(
805 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
806 struct cli_state *cli, const char *user,
807 const char *pass, size_t passlen,
808 const char *ntpass, size_t ntpasslen,
809 const char *workgroup)
810 {
811 struct tevent_req *req, *subreq;
812 struct cli_session_setup_nt1_state *state;
813 DATA_BLOB lm_response = data_blob_null;
814 DATA_BLOB nt_response = data_blob_null;
815 DATA_BLOB session_key = data_blob_null;
816 uint16_t *vwv;
817 uint8_t *bytes;
818 char *workgroup_upper;
819
820 req = tevent_req_create(mem_ctx, &state,
821 struct cli_session_setup_nt1_state);
822 if (req == NULL) {
823 return NULL;
824 }
825 state->cli = cli;
826 state->user = user;
827 vwv = state->vwv;
828
829 if (passlen == 0) {
830 /* do nothing - guest login */
831 } else if (passlen != 24) {
832 if (lp_client_ntlmv2_auth()) {
833 DATA_BLOB server_chal;
834 DATA_BLOB names_blob;
835
836 server_chal =
837 data_blob_const(smb1cli_conn_server_challenge(cli->conn),
838 8);
839
840 /*
841 * note that the 'workgroup' here is a best
842 * guess - we don't know the server's domain
843 * at this point. Windows clients also don't
844 * use hostname...
845 */
846 names_blob = NTLMv2_generate_names_blob(
847 NULL, NULL, workgroup);
848
849 if (tevent_req_nomem(names_blob.data, req)) {
850 return tevent_req_post(req, ev);
851 }
852
853 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass,
854 &server_chal, &names_blob,
855 &lm_response, &nt_response,
856 NULL, &session_key)) {
857 data_blob_free(&names_blob);
858 tevent_req_nterror(
859 req, NT_STATUS_ACCESS_DENIED);
860 return tevent_req_post(req, ev);
861 }
862 data_blob_free(&names_blob);
863
864 } else {
865 uchar nt_hash[16];
866 E_md4hash(pass, nt_hash);
867
868 #ifdef LANMAN_ONLY
869 nt_response = data_blob_null;
870 #else
871 nt_response = data_blob(NULL, 24);
872 if (tevent_req_nomem(nt_response.data, req)) {
873 return tevent_req_post(req, ev);
874 }
875
876 SMBNTencrypt(pass, smb1cli_conn_server_challenge(cli->conn),
877 nt_response.data);
878 #endif
879 /* non encrypted password supplied. Ignore ntpass. */
880 if (lp_client_lanman_auth()) {
881
882 lm_response = data_blob(NULL, 24);
883 if (tevent_req_nomem(lm_response.data, req)) {
884 return tevent_req_post(req, ev);
885 }
886
887 if (!SMBencrypt(pass,
888 smb1cli_conn_server_challenge(cli->conn),
889 lm_response.data)) {
890 /*
891 * Oops, the LM response is
892 * invalid, just put the NT
893 * response there instead
894 */
895 data_blob_free(&lm_response);
896 lm_response = data_blob(
897 nt_response.data,
898 nt_response.length);
899 }
900 } else {
901 /*
902 * LM disabled, place NT# in LM field
903 * instead
904 */
905 lm_response = data_blob(
906 nt_response.data, nt_response.length);
907 }
908
909 if (tevent_req_nomem(lm_response.data, req)) {
910 return tevent_req_post(req, ev);
911 }
912
913 session_key = data_blob(NULL, 16);
914 if (tevent_req_nomem(session_key.data, req)) {
915 return tevent_req_post(req, ev);
916 }
917 #ifdef LANMAN_ONLY
918 E_deshash(pass, session_key.data);
919 memset(&session_key.data[8], '\0', 8);
920 #else
921 SMBsesskeygen_ntv1(nt_hash, session_key.data);
922 #endif
923 }
924 } else {
925 /* pre-encrypted password supplied. Only used for
926 security=server, can't do
927 signing because we don't have original key */
928
929 lm_response = data_blob(pass, passlen);
930 if (tevent_req_nomem(lm_response.data, req)) {
931 return tevent_req_post(req, ev);
932 }
933
934 nt_response = data_blob(ntpass, ntpasslen);
935 if (tevent_req_nomem(nt_response.data, req)) {
936 return tevent_req_post(req, ev);
937 }
938 }
939
940 #ifdef LANMAN_ONLY
941 state->response = data_blob_talloc(
942 state, lm_response.data, lm_response.length);
943 #else
944 state->response = data_blob_talloc(
945 state, nt_response.data, nt_response.length);
946 #endif
947 if (tevent_req_nomem(state->response.data, req)) {
948 return tevent_req_post(req, ev);
949 }
950
951 if (session_key.data) {
952 state->session_key = data_blob_talloc(
953 state, session_key.data, session_key.length);
954 if (tevent_req_nomem(state->session_key.data, req)) {
955 return tevent_req_post(req, ev);
956 }
957 }
958 data_blob_free(&session_key);
959
960 SCVAL(vwv+0, 0, 0xff);
961 SCVAL(vwv+0, 1, 0);
962 SSVAL(vwv+1, 0, 0);
963 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
964 SSVAL(vwv+3, 0, 2);
965 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
966 SIVAL(vwv+5, 0, smb1cli_conn_server_session_key(cli->conn));
967 SSVAL(vwv+7, 0, lm_response.length);
968 SSVAL(vwv+8, 0, nt_response.length);
969 SSVAL(vwv+9, 0, 0);
970 SSVAL(vwv+10, 0, 0);
971 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
972
973 bytes = talloc_array(state, uint8_t,
974 lm_response.length + nt_response.length);
975 if (tevent_req_nomem(bytes, req)) {
976 return tevent_req_post(req, ev);
977 }
978 if (lm_response.length != 0) {
979 memcpy(bytes, lm_response.data, lm_response.length);
980 }
981 if (nt_response.length != 0) {
982 memcpy(bytes + lm_response.length,
983 nt_response.data, nt_response.length);
984 }
985 data_blob_free(&lm_response);
986 data_blob_free(&nt_response);
987
988 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
989 user, strlen(user)+1, NULL);
990
991 /*
992 * Upper case here might help some NTLMv2 implementations
993 */
994 workgroup_upper = talloc_strdup_upper(talloc_tos(), workgroup);
995 if (tevent_req_nomem(workgroup_upper, req)) {
996 return tevent_req_post(req, ev);
997 }
998 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
999 workgroup_upper, strlen(workgroup_upper)+1,
1000 NULL);
1001 TALLOC_FREE(workgroup_upper);
1002
1003 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Unix", 5, NULL);
1004 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), "Samba", 6, NULL);
1005 if (tevent_req_nomem(bytes, req)) {
1006 return tevent_req_post(req, ev);
1007 }
1008
1009 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
1010 talloc_get_size(bytes), bytes);
1011 if (tevent_req_nomem(subreq, req)) {
1012 return tevent_req_post(req, ev);
1013 }
1014 tevent_req_set_callback(subreq, cli_session_setup_nt1_done, req);
1015 return req;
1016 }
1017
1018 static void cli_session_setup_nt1_done(struct tevent_req *subreq)
1019 {
1020 struct tevent_req *req = tevent_req_callback_data(
1021 subreq, struct tevent_req);
1022 struct cli_session_setup_nt1_state *state = tevent_req_data(
1023 req, struct cli_session_setup_nt1_state);
1024 struct cli_state *cli = state->cli;
1025 uint32_t num_bytes;
1026 uint8_t *in;
1027 uint8_t *inhdr;
1028 uint8_t *bytes;
1029 uint8_t *p;
1030 NTSTATUS status;
1031 ssize_t ret;
1032 uint8_t wct;
1033 uint16_t *vwv;
1034
1035 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
1036 &num_bytes, &bytes);
1037 TALLOC_FREE(subreq);
1038 if (!NT_STATUS_IS_OK(status)) {
1039 tevent_req_nterror(req, status);
1040 return;
1041 }
1042
1043 inhdr = in + NBT_HDR_SIZE;
1044 p = bytes;
1045
1046 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
1047 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1048
1049 status = smb_bytes_talloc_string(cli,
1050 inhdr,
1051 &cli->server_os,
1052 p,
1053 bytes+num_bytes-p,
1054 &ret);
1055 if (!NT_STATUS_IS_OK(status)) {
1056 tevent_req_nterror(req, status);
1057 return;
1058 }
1059 p += ret;
1060
1061 status = smb_bytes_talloc_string(cli,
1062 inhdr,
1063 &cli->server_type,
1064 p,
1065 bytes+num_bytes-p,
1066 &ret);
1067 if (!NT_STATUS_IS_OK(status)) {
1068 tevent_req_nterror(req, status);
1069 return;
1070 }
1071 p += ret;
1072
1073 status = smb_bytes_talloc_string(cli,
1074 inhdr,
1075 &cli->server_domain,
1076 p,
1077 bytes+num_bytes-p,
1078 &ret);
1079 if (!NT_STATUS_IS_OK(status)) {
1080 tevent_req_nterror(req, status);
1081 return;
1082 }
1083 p += ret;
1084
1085 status = cli_set_username(cli, state->user);
1086 if (tevent_req_nterror(req, status)) {
1087 return;
1088 }
1089 if (smb1cli_conn_activate_signing(cli->conn, state->session_key, state->response)
1090 && !smb1cli_conn_check_signing(cli->conn, (uint8_t *)in, 1)) {
1091 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1092 return;
1093 }
1094 if (state->session_key.data) {
1095 /* Have plaintext orginal */
1096 cli_set_session_key(cli, state->session_key);
1097 }
1098 tevent_req_done(req);
1099 }
1100
1101 static NTSTATUS cli_session_setup_nt1_recv(struct tevent_req *req)
1102 {
1103 return tevent_req_simple_recv_ntstatus(req);
1104 }
1105
1106 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
1107 const char *pass, size_t passlen,
1108 const char *ntpass, size_t ntpasslen,
1109 const char *workgroup)
1110 {
1111 TALLOC_CTX *frame = talloc_stackframe();
1112 struct event_context *ev;
1113 struct tevent_req *req;
1114 NTSTATUS status = NT_STATUS_NO_MEMORY;
1115
1116 if (smbXcli_conn_has_async_calls(cli->conn)) {
1117 /*
1118 * Can't use sync call while an async call is in flight
1119 */
1120 status = NT_STATUS_INVALID_PARAMETER;
1121 goto fail;
1122 }
1123 ev = event_context_init(frame);
1124 if (ev == NULL) {
1125 goto fail;
1126 }
1127 req = cli_session_setup_nt1_send(frame, ev, cli, user, pass, passlen,
1128 ntpass, ntpasslen, workgroup);
1129 if (req == NULL) {
1130 goto fail;
1131 }
1132 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1133 goto fail;
1134 }
1135 status = cli_session_setup_nt1_recv(req);
1136 fail:
1137 TALLOC_FREE(frame);
1138 return status;
1139 }
1140
1141 /* The following is calculated from :
1142 * (smb_size-4) = 35
1143 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
1144 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
1145 * end of packet.
1146 */
1147
1148 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
1149
1150 struct cli_sesssetup_blob_state {
1151 struct tevent_context *ev;
1152 struct cli_state *cli;
1153 DATA_BLOB blob;
1154 uint16_t max_blob_size;
1155 uint16_t vwv[12];
1156 uint8_t *buf;
1157
1158 DATA_BLOB smb2_blob;
1159 struct iovec *recv_iov;
1160
1161 NTSTATUS status;
1162 uint8_t *inbuf;
1163 DATA_BLOB ret_blob;
1164 };
1165
1166 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1167 struct tevent_req **psubreq);
1168 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
1169
1170 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
1171 struct tevent_context *ev,
1172 struct cli_state *cli,
1173 DATA_BLOB blob)
1174 {
1175 struct tevent_req *req, *subreq;
1176 struct cli_sesssetup_blob_state *state;
1177 uint32_t usable_space;
1178
1179 req = tevent_req_create(mem_ctx, &state,
1180 struct cli_sesssetup_blob_state);
1181 if (req == NULL) {
1182 return NULL;
1183 }
1184 state->ev = ev;
1185 state->blob = blob;
1186 state->cli = cli;
1187
1188 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1189 usable_space = UINT16_MAX;
1190 } else {
1191 usable_space = cli_state_available_size(cli,
1192 BASE_SESSSETUP_BLOB_PACKET_SIZE);
1193 }
1194
1195 if (usable_space == 0) {
1196 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
1197 "(not possible to send %u bytes)\n",
1198 BASE_SESSSETUP_BLOB_PACKET_SIZE + 1));
1199 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1200 return tevent_req_post(req, ev);
1201 }
1202 state->max_blob_size = MIN(usable_space, 0xFFFF);
1203
1204 if (!cli_sesssetup_blob_next(state, &subreq)) {
1205 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1206 return tevent_req_post(req, ev);
1207 }
1208 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1209 return req;
1210 }
1211
1212 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1213 struct tevent_req **psubreq)
1214 {
1215 struct tevent_req *subreq;
1216 uint16_t thistime;
1217
1218 thistime = MIN(state->blob.length, state->max_blob_size);
1219
1220 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1221
1222 state->smb2_blob.data = state->blob.data;
1223 state->smb2_blob.length = thistime;
1224
1225 state->blob.data += thistime;
1226 state->blob.length -= thistime;
1227
1228 subreq = smb2cli_session_setup_send(state, state->ev,
1229 state->cli->conn,
1230 state->cli->timeout,
1231 state->cli->smb2.session,
1232 0, /* in_flags */
1233 SMB2_CAP_DFS, /* in_capabilities */
1234 0, /* in_channel */
1235 0, /* in_previous_session_id */
1236 &state->smb2_blob);
1237 if (subreq == NULL) {
1238 return false;
1239 }
1240 *psubreq = subreq;
1241 return true;
1242 }
1243
1244 SCVAL(state->vwv+0, 0, 0xFF);
1245 SCVAL(state->vwv+0, 1, 0);
1246 SSVAL(state->vwv+1, 0, 0);
1247 SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
1248 SSVAL(state->vwv+3, 0, 2);
1249 SSVAL(state->vwv+4, 0, 1);
1250 SIVAL(state->vwv+5, 0, 0);
1251
1252 SSVAL(state->vwv+7, 0, thistime);
1253
1254 SSVAL(state->vwv+8, 0, 0);
1255 SSVAL(state->vwv+9, 0, 0);
1256 SIVAL(state->vwv+10, 0,
1257 cli_session_setup_capabilities(state->cli, CAP_EXTENDED_SECURITY));
1258
1259 state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
1260 thistime);
1261 if (state->buf == NULL) {
1262 return false;
1263 }
1264 state->blob.data += thistime;
1265 state->blob.length -= thistime;
1266
1267 state->buf = smb_bytes_push_str(state->buf, smbXcli_conn_use_unicode(state->cli->conn),
1268 "Unix", 5, NULL);
1269 state->buf = smb_bytes_push_str(state->buf, smbXcli_conn_use_unicode(state->cli->conn),
1270 "Samba", 6, NULL);
1271 if (state->buf == NULL) {
1272 return false;
1273 }
1274 subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
1275 12, state->vwv,
1276 talloc_get_size(state->buf), state->buf);
1277 if (subreq == NULL) {
1278 return false;
1279 }
1280 *psubreq = subreq;
1281 return true;
1282 }
1283
1284 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
1285 {
1286 struct tevent_req *req = tevent_req_callback_data(
1287 subreq, struct tevent_req);
1288 struct cli_sesssetup_blob_state *state = tevent_req_data(
1289 req, struct cli_sesssetup_blob_state);
1290 struct cli_state *cli = state->cli;
1291 uint8_t wct;
1292 uint16_t *vwv;
1293 uint32_t num_bytes;
1294 uint8_t *bytes;
1295 NTSTATUS status;
1296 uint8_t *p;
1297 uint16_t blob_length;
1298 uint8_t *in;
1299 uint8_t *inhdr;
1300 ssize_t ret;
1301
1302 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1303 status = smb2cli_session_setup_recv(subreq, state,
1304 &state->recv_iov,
1305 &state->ret_blob);
1306 } else {
1307 status = cli_smb_recv(subreq, state, &in, 4, &wct, &vwv,
1308 &num_bytes, &bytes);
1309 TALLOC_FREE(state->buf);
1310 }
1311 TALLOC_FREE(subreq);
1312 if (!NT_STATUS_IS_OK(status)
1313 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1314 tevent_req_nterror(req, status);
1315 return;
1316 }
1317
1318 state->status = status;
1319
1320 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1321 goto next;
1322 }
1323
1324 state->inbuf = in;
1325 inhdr = in + NBT_HDR_SIZE;
1326 cli_state_set_uid(state->cli, SVAL(inhdr, HDR_UID));
1327 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1328
1329 blob_length = SVAL(vwv+3, 0);
1330 if (blob_length > num_bytes) {
1331 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1332 return;
1333 }
1334 state->ret_blob = data_blob_const(bytes, blob_length);
1335
1336 p = bytes + blob_length;
1337
1338 status = smb_bytes_talloc_string(cli,
1339 inhdr,
1340 &cli->server_os,
1341 p,
1342 bytes+num_bytes-p,
1343 &ret);
1344
1345 if (!NT_STATUS_IS_OK(status)) {
1346 tevent_req_nterror(req, status);
1347 return;
1348 }
1349 p += ret;
1350
1351 status = smb_bytes_talloc_string(cli,
1352 inhdr,
1353 &cli->server_type,
1354 p,
1355 bytes+num_bytes-p,
1356 &ret);
1357
1358 if (!NT_STATUS_IS_OK(status)) {
1359 tevent_req_nterror(req, status);
1360 return;
1361 }
1362 p += ret;
1363
1364 status = smb_bytes_talloc_string(cli,
1365 inhdr,
1366 &cli->server_domain,
1367 p,
1368 bytes+num_bytes-p,
1369 &ret);
1370
1371 if (!NT_STATUS_IS_OK(status)) {
1372 tevent_req_nterror(req, status);
1373 return;
1374 }
1375 p += ret;
1376
1377 next:
1378 if (state->blob.length != 0) {
1379 /*
1380 * More to send
1381 */
1382 if (!cli_sesssetup_blob_next(state, &subreq)) {
1383 tevent_req_oom(req);
1384 return;
1385 }
1386 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1387 return;
1388 }
1389 tevent_req_done(req);
1390 }
1391
1392 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
1393 TALLOC_CTX *mem_ctx,
1394 DATA_BLOB *pblob,
1395 uint8_t **pinbuf,
1396 struct iovec **precv_iov)
1397 {
1398 struct cli_sesssetup_blob_state *state = tevent_req_data(
1399 req, struct cli_sesssetup_blob_state);
1400 NTSTATUS status;
1401 uint8_t *inbuf;
1402 struct iovec *recv_iov;
1403
1404 if (tevent_req_is_nterror(req, &status)) {
1405 TALLOC_FREE(state->cli->smb2.session);
1406 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1407 return status;
1408 }
1409
1410 inbuf = talloc_move(mem_ctx, &state->inbuf);
1411 recv_iov = talloc_move(mem_ctx, &state->recv_iov);
1412 if (pblob != NULL) {
1413 *pblob = state->ret_blob;
1414 }
1415 if (pinbuf != NULL) {
1416 *pinbuf = inbuf;
1417 }
1418 if (precv_iov != NULL) {
1419 *precv_iov = recv_iov;
1420 }
1421 /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
1422 return state->status;
1423 }
1424
1425 #ifdef HAVE_KRB5
1426
1427 /****************************************************************************
1428 Use in-memory credentials cache
1429 ****************************************************************************/
1430
1431 static void use_in_memory_ccache(void) {
1432 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
1433 }
1434
1435 /****************************************************************************
1436 Do a spnego/kerberos encrypted session setup.
1437 ****************************************************************************/
1438
1439 struct cli_session_setup_kerberos_state {
1440 struct cli_state *cli;
1441 DATA_BLOB negTokenTarg;
1442 DATA_BLOB session_key_krb5;
1443 ADS_STATUS ads_status;
1444 };
1445
1446 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
1447
1448 static struct tevent_req *cli_session_setup_kerberos_send(
1449 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1450 const char *principal)
1451 {
1452 struct tevent_req *req, *subreq;
1453 struct cli_session_setup_kerberos_state *state;
1454 int rc;
1455
1456 DEBUG(2,("Doing kerberos session setup\n"));
1457
1458 req = tevent_req_create(mem_ctx, &state,
1459 struct cli_session_setup_kerberos_state);
1460 if (req == NULL) {
1461 return NULL;
1462 }
1463 state->cli = cli;
1464 state->ads_status = ADS_SUCCESS;
1465
1466 /*
1467 * Ok, this is cheating: spnego_gen_krb5_negTokenInit can block if
1468 * we have to acquire a ticket. To be fixed later :-)
1469 */
1470 rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
1471 &state->session_key_krb5, 0, NULL);
1472 if (rc) {
1473 DEBUG(1, ("cli_session_setup_kerberos: "
1474 "spnego_gen_krb5_negTokenInit failed: %s\n",
1475 error_message(rc)));
1476 state->ads_status = ADS_ERROR_KRB5(rc);
1477 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1478 return tevent_req_post(req, ev);
1479 }
1480
1481 #if 0
1482 file_save("negTokenTarg.dat", state->negTokenTarg.data,
1483 state->negTokenTarg.length);
1484 #endif
1485
1486 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1487 state->cli->smb2.session = smbXcli_session_create(cli,
1488 cli->conn);
1489 if (tevent_req_nomem(state->cli->smb2.session, req)) {
1490 return tevent_req_post(req, ev);
1491 }
1492 }
1493
1494 subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
1495 if (tevent_req_nomem(subreq, req)) {
1496 return tevent_req_post(req, ev);
1497 }
1498 tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
1499 return req;
1500 }
1501
1502 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
1503 {
1504 struct tevent_req *req = tevent_req_callback_data(
1505 subreq, struct tevent_req);
1506 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1507 req, struct cli_session_setup_kerberos_state);
1508 uint8_t *inbuf = NULL;
1509 struct iovec *recv_iov = NULL;
1510 NTSTATUS status;
1511
1512 status = cli_sesssetup_blob_recv(subreq, state,
1513 NULL, &inbuf, &recv_iov);
1514 TALLOC_FREE(subreq);
1515 if (!NT_STATUS_IS_OK(status)) {
1516 tevent_req_nterror(req, status);
1517 return;
1518 }
1519
1520 cli_set_session_key(state->cli, state->session_key_krb5);
1521
1522 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1523 struct smbXcli_session *session = state->cli->smb2.session;
1524 status = smb2cli_session_set_session_key(session,
1525 state->session_key_krb5,
1526 recv_iov);
1527 if (tevent_req_nterror(req, status)) {
1528 return;
1529 }
1530 } else {
1531 if (smb1cli_conn_activate_signing(state->cli->conn, state->session_key_krb5,
1532 data_blob_null)
1533 && !smb1cli_conn_check_signing(state->cli->conn, inbuf, 1)) {
1534 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1535 return;
1536 }
1537 }
1538
1539 tevent_req_done(req);
1540 }
1541
1542 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
1543 {
1544 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1545 req, struct cli_session_setup_kerberos_state);
1546 NTSTATUS status;
1547
1548 if (tevent_req_is_nterror(req, &status)) {
1549 return ADS_ERROR_NT(status);
1550 }
1551 return state->ads_status;
1552 }
1553
1554 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
1555 const char *principal)
1556 {
1557 struct tevent_context *ev;
1558 struct tevent_req *req;
1559 ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1560
1561 if (smbXcli_conn_has_async_calls(cli->conn)) {
1562 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1563 }
1564 ev = tevent_context_init(talloc_tos());
1565 if (ev == NULL) {
1566 goto fail;
1567 }
1568 req = cli_session_setup_kerberos_send(ev, ev, cli, principal);
1569 if (req == NULL) {
1570 goto fail;
1571 }
1572 if (!tevent_req_poll(req, ev)) {
1573 status = ADS_ERROR_SYSTEM(errno);
1574 goto fail;
1575 }
1576 status = cli_session_setup_kerberos_recv(req);
1577 fail:
1578 TALLOC_FREE(ev);
1579 return status;
1580 }
1581 #endif /* HAVE_KRB5 */
1582
1583 /****************************************************************************
1584 Do a spnego/NTLMSSP encrypted session setup.
1585 ****************************************************************************/
1586
1587 struct cli_session_setup_ntlmssp_state {
1588 struct tevent_context *ev;
1589 struct cli_state *cli;
1590 struct ntlmssp_state *ntlmssp_state;
1591 int turn;
1592 DATA_BLOB blob_out;
1593 };
1594
1595 static int cli_session_setup_ntlmssp_state_destructor(
1596 struct cli_session_setup_ntlmssp_state *state)
1597 {
1598 if (state->ntlmssp_state != NULL) {
1599 TALLOC_FREE(state->ntlmssp_state);
1600 }
1601 return 0;
1602 }
1603
1604 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
1605
1606 static struct tevent_req *cli_session_setup_ntlmssp_send(
1607 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1608 const char *user, const char *pass, const char *domain)
1609 {
1610 struct tevent_req *req, *subreq;
1611 struct cli_session_setup_ntlmssp_state *state;
1612 NTSTATUS status;
1613 DATA_BLOB blob_out;
1614 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
1615
1616 req = tevent_req_create(mem_ctx, &state,
1617 struct cli_session_setup_ntlmssp_state);
1618 if (req == NULL) {
1619 return NULL;
1620 }
1621 state->ev = ev;
1622 state->cli = cli;
1623 state->turn = 1;
1624
1625 state->ntlmssp_state = NULL;
1626 talloc_set_destructor(
1627 state, cli_session_setup_ntlmssp_state_destructor);
1628
1629 status = ntlmssp_client_start(state,
1630 lp_netbios_name(),
1631 lp_workgroup(),
1632 lp_client_ntlmv2_auth(),
1633 &state->ntlmssp_state);
1634 if (!NT_STATUS_IS_OK(status)) {
1635 goto fail;
1636 }
1637 ntlmssp_want_feature(state->ntlmssp_state,
1638 NTLMSSP_FEATURE_SESSION_KEY);
1639 if (cli->use_ccache) {
1640 ntlmssp_want_feature(state->ntlmssp_state,
1641 NTLMSSP_FEATURE_CCACHE);
1642 }
1643 status = ntlmssp_set_username(state->ntlmssp_state, user);
1644 if (!NT_STATUS_IS_OK(status)) {
1645 goto fail;
1646 }
1647 status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1648 if (!NT_STATUS_IS_OK(status)) {
1649 goto fail;
1650 }
1651 status = ntlmssp_set_password(state->ntlmssp_state, pass);
1652 if (!NT_STATUS_IS_OK(status)) {
1653 goto fail;
1654 }
1655 status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1656 &blob_out);
1657 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1658 goto fail;
1659 }
1660
1661 state->blob_out = spnego_gen_negTokenInit(state, OIDs_ntlm, &blob_out, NULL);
1662 data_blob_free(&blob_out);
1663
1664 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1665 state->cli->smb2.session = smbXcli_session_create(cli,
1666 cli->conn);
1667 if (tevent_req_nomem(state->cli->smb2.session, req)) {
1668 return tevent_req_post(req, ev);
1669 }
1670 }
1671
1672 subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1673 if (tevent_req_nomem(subreq, req)) {
1674 return tevent_req_post(req, ev);
1675 }
1676 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1677 return req;
1678 fail:
1679 tevent_req_nterror(req, status);
1680 return tevent_req_post(req, ev);
1681 }
1682
1683 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1684 {
1685 struct tevent_req *req = tevent_req_callback_data(
1686 subreq, struct tevent_req);
1687 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1688 req, struct cli_session_setup_ntlmssp_state);
1689 DATA_BLOB blob_in, msg_in, blob_out;
1690 uint8_t *inbuf = NULL;
1691 struct iovec *recv_iov = NULL;
1692 bool parse_ret;
1693 NTSTATUS status;
1694
1695 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1696 &inbuf, &recv_iov);
1697 TALLOC_FREE(subreq);
1698 data_blob_free(&state->blob_out);
1699
1700 if (NT_STATUS_IS_OK(status)) {
1701 if (state->cli->server_domain[0] == '\0') {
1702 TALLOC_FREE(state->cli->server_domain);
1703 state->cli->server_domain = talloc_strdup(state->cli,
1704 state->ntlmssp_state->server.netbios_domain);
1705 if (state->cli->server_domain == NULL) {
1706 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1707 return;
1708 }
1709 }
1710 cli_set_session_key(
1711 state->cli, state->ntlmssp_state->session_key);
1712
1713 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1714 struct smbXcli_session *session = state->cli->smb2.session;
1715
1716 if (ntlmssp_is_anonymous(state->ntlmssp_state)) {
1717 /*
1718 * Windows server does not set the
1719 * SMB2_SESSION_FLAG_IS_GUEST nor
1720 * SMB2_SESSION_FLAG_IS_NULL flag.
1721 *
1722 * This fix makes sure we do not try
1723 * to verify a signature on the final
1724 * session setup response.
1725 */
1726 TALLOC_FREE(state->ntlmssp_state);
1727 tevent_req_done(req);
1728 return;
1729 }
1730
1731 status = smb2cli_session_set_session_key(session,
1732 state->ntlmssp_state->session_key,
1733 recv_iov);
1734 if (tevent_req_nterror(req, status)) {
1735 return;
1736 }
1737 } else {
1738 if (smb1cli_conn_activate_signing(
1739 state->cli->conn, state->ntlmssp_state->session_key,
1740 data_blob_null)
1741 && !smb1cli_conn_check_signing(state->cli->conn, inbuf, 1)) {
1742 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1743 return;
1744 }
1745 }
1746 TALLOC_FREE(state->ntlmssp_state);
1747 tevent_req_done(req);
1748 return;
1749 }
1750 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1751 tevent_req_nterror(req, status);
1752 return;
1753 }
1754
1755 if (blob_in.length == 0) {
1756 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1757 return;
1758 }
1759
1760 if ((state->turn == 1)
1761 && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1762 DATA_BLOB tmp_blob = data_blob_null;
1763 /* the server might give us back two challenges */
1764 parse_ret = spnego_parse_challenge(state, blob_in, &msg_in,
1765 &tmp_blob);
1766 data_blob_free(&tmp_blob);
1767 } else {
1768 parse_ret = spnego_parse_auth_response(state, blob_in, status,
1769 OID_NTLMSSP, &msg_in);
1770 }
1771 state->turn += 1;
1772
1773 if (!parse_ret) {
1774 DEBUG(3,("Failed to parse auth response\n"));
1775 if (NT_STATUS_IS_OK(status)
1776 || NT_STATUS_EQUAL(status,
1777 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1778 tevent_req_nterror(
1779 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1780 return;
1781 }
1782 }
1783
1784 status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1785
1786 if (!NT_STATUS_IS_OK(status)
1787 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1788 TALLOC_FREE(state->ntlmssp_state);
1789 tevent_req_nterror(req, status);
1790 return;
1791 }
1792
1793 state->blob_out = spnego_gen_auth(state, blob_out);
1794 if (tevent_req_nomem(state->blob_out.data, req)) {
1795 return;
1796 }
1797
1798 subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1799 state->blob_out);
1800 if (tevent_req_nomem(subreq, req)) {
1801 return;
1802 }
1803 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1804 }
1805
1806 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1807 {
1808 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1809 req, struct cli_session_setup_ntlmssp_state);
1810 NTSTATUS status;
1811
1812 if (tevent_req_is_nterror(req, &status)) {
1813 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1814 return status;
1815 }
1816 return NT_STATUS_OK;
1817 }
1818
1819 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1820 const char *user,
1821 const char *pass,
1822 const char *domain)
1823 {
1824 struct tevent_context *ev;
1825 struct tevent_req *req;
1826 NTSTATUS status = NT_STATUS_NO_MEMORY;
1827
1828 if (smbXcli_conn_has_async_calls(cli->conn)) {
1829 return NT_STATUS_INVALID_PARAMETER;
1830 }
1831 ev = tevent_context_init(talloc_tos());
1832 if (ev == NULL) {
1833 goto fail;
1834 }
1835 req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1836 if (req == NULL) {
1837 goto fail;
1838 }
1839 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1840 goto fail;
1841 }
1842 status = cli_session_setup_ntlmssp_recv(req);
1843 fail:
1844 TALLOC_FREE(ev);
1845 return status;
1846 }
1847
1848 /****************************************************************************
1849 Do a spnego encrypted session setup.
1850
1851 user_domain: The shortname of the domain the user/machine is a member of.
1852 dest_realm: The realm we're connecting to, if NULL we use our default realm.
1853 ****************************************************************************/
1854
1855 static ADS_STATUS cli_session_setup_spnego(struct cli_state *cli,
1856 const char *user,
1857 const char *pass,
1858 const char *user_domain,
1859 const char * dest_realm)
1860 {
1861 char *principal = NULL;
1862 char *OIDs[ASN1_MAX_OIDS];
1863 int i;
1864 const DATA_BLOB *server_blob;
1865 DATA_BLOB blob = data_blob_null;
1866 const char *p = NULL;
1867 char *account = NULL;
1868 NTSTATUS status;
1869
1870 server_blob = smbXcli_conn_server_gss_blob(cli->conn);
1871 if (server_blob) {
1872 blob = data_blob(server_blob->data, server_blob->length);
1873 }
1874
1875 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)blob.length));
1876
1877 /* the server might not even do spnego */
1878 if (blob.length == 0) {
1879 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1880 goto ntlmssp;
1881 }
1882
1883 #if 0
1884 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1885 #endif
1886
1887 /* The server sent us the first part of the SPNEGO exchange in the
1888 * negprot reply. It is WRONG to depend on the principal sent in the
1889 * negprot reply, but right now we do it. If we don't receive one,
1890 * we try to best guess, then fall back to NTLM. */
1891 if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &principal, NULL) ||
1892 OIDs[0] == NULL) {
1893 data_blob_free(&blob);
1894 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1895 }
1896 data_blob_free(&blob);
1897
1898 /* make sure the server understands kerberos */
1899 for (i=0;OIDs[i];i++) {
1900 if (i == 0)
1901 DEBUG(3,("got OID=%s\n", OIDs[i]));
1902 else
1903 DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1904 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1905 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1906 cli->got_kerberos_mechanism = True;
1907 }
1908 talloc_free(OIDs[i]);
1909 }
1910
1911 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1912
1913 status = cli_set_username(cli, user);
1914 if (!NT_STATUS_IS_OK(status)) {
1915 TALLOC_FREE(principal);
1916 return ADS_ERROR_NT(status);
1917 }
1918
1919 #ifdef HAVE_KRB5
1920 /* If password is set we reauthenticate to kerberos server
1921 * and do not store results */
1922
1923 if (user && *user && cli->got_kerberos_mechanism && cli->use_kerberos) {
1924 ADS_STATUS rc;
1925 const char *remote_name = smbXcli_conn_remote_name(cli->conn);
1926
1927 if (pass && *pass) {
1928 int ret;
1929
1930 use_in_memory_ccache();
1931 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1932
1933 if (ret){
1934 TALLOC_FREE(principal);
1935 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1936 if (cli->fallback_after_kerberos)
1937 goto ntlmssp;
1938 return ADS_ERROR_KRB5(ret);
1939 }
1940 }
1941
1942 /* We may not be allowed to use the server-supplied SPNEGO principal, or it may not have been supplied to us
1943 */
1944 if (!lp_client_use_spnego_principal() || strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1945 TALLOC_FREE(principal);
1946 }
1947
1948 if (principal == NULL &&
1949 !is_ipaddress(remote_name) &&
1950 !strequal(STAR_SMBSERVER,
1951 remote_name)) {
1952 DEBUG(3,("cli_session_setup_spnego: using target "
1953 "hostname not SPNEGO principal\n"));
1954
1955 if (dest_realm) {
1956 char *realm = strupper_talloc(talloc_tos(), dest_realm);
1957 if (realm) {
1958 principal = talloc_asprintf(talloc_tos(),
1959 "cifs/%s@%s",
1960 remote_name,
1961 realm);
1962 TALLOC_FREE(realm);
1963 }
1964 } else {
1965 principal = kerberos_get_principal_from_service_hostname(talloc_tos(),
1966 "cifs",
1967 remote_name,
1968 lp_realm());
1969 }
1970
1971 if (!principal) {
1972 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1973 }
1974 DEBUG(3,("cli_session_setup_spnego: guessed "
1975 "server principal=%s\n",
1976 principal ? principal : "<null>"));
1977 }
1978
1979 if (principal) {
1980 rc = cli_session_setup_kerberos(cli, principal);
1981 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1982 TALLOC_FREE(principal);
1983 return rc;
1984 }
1985 }
1986 }
1987 #endif
1988
1989 TALLOC_FREE(principal);
1990
1991 ntlmssp:
1992
1993 account = talloc_strdup(talloc_tos(), user);
1994 if (!account) {
1995 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1996 }
1997
1998 /* when falling back to ntlmssp while authenticating with a machine
1999 * account strip off the realm - gd */
2000
2001 if ((p = strchr_m(user, '@')) != NULL) {
2002 account[PTR_DIFF(p,user)] = '\0';
2003 }
2004
2005 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
2006 }
2007
2008 /****************************************************************************
2009 Send a session setup. The username and workgroup is in UNIX character
2010 format and must be converted to DOS codepage format before sending. If the
2011 password is in plaintext, the same should be done.
2012 ****************************************************************************/
2013
2014 NTSTATUS cli_session_setup(struct cli_state *cli,
2015 const char *user,
2016 const char *pass, int passlen,
2017 const char *ntpass, int ntpasslen,
2018 const char *workgroup)
2019 {
2020 char *p;
2021 char *user2;
2022 uint16_t sec_mode = smb1cli_conn_server_security_mode(cli->conn);
2023
2024 if (user) {
2025 user2 = talloc_strdup(talloc_tos(), user);
2026 } else {
2027 user2 = talloc_strdup(talloc_tos(), "");
2028 }
2029 if (user2 == NULL) {
2030 return NT_STATUS_NO_MEMORY;
2031 }
2032
2033 if (!workgroup) {
2034 workgroup = "";
2035 }
2036
2037 /* allow for workgroups as part of the username */
2038 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
2039 (p=strchr_m(user2,*lp_winbind_separator()))) {
2040 *p = 0;
2041 user = p+1;
2042 strupper_m(user2);
2043 workgroup = user2;
2044 }
2045
2046 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_LANMAN1) {
2047 return NT_STATUS_OK;
2048 }
2049
2050 /* now work out what sort of session setup we are going to
2051 do. I have split this into separate functions to make the
2052 flow a bit easier to understand (tridge) */
2053
2054 /* if its an older server then we have to use the older request format */
2055
2056 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_NT1) {
2057 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
2058 DEBUG(1, ("Server requested LM password but 'client lanman auth = no'"
2059 " or 'client ntlmv2 auth = yes'\n"));
2060 return NT_STATUS_ACCESS_DENIED;
2061 }
2062
2063 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
2064 !lp_client_plaintext_auth() && (*pass)) {
2065 DEBUG(1, ("Server requested PLAINTEXT password but 'client plaintext auth = no'"
2066 " or 'client ntlmv2 auth = yes'\n"));
2067 return NT_STATUS_ACCESS_DENIED;
2068 }
2069
2070 return cli_session_setup_lanman2(cli, user, pass, passlen,
2071 workgroup);
2072 }
2073
2074 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2075 const char *remote_realm = cli_state_remote_realm(cli);
2076 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2077 workgroup,
2078 remote_realm);
2079 if (!ADS_ERR_OK(status)) {
2080 DEBUG(3, ("SMB2-SPNEGO login failed: %s\n", ads_errstr(status)));
2081 return ads_ntstatus(status);
2082 }
2083 return NT_STATUS_OK;
2084 }
2085
2086 /* if no user is supplied then we have to do an anonymous connection.
2087 passwords are ignored */
2088
2089 if (!user || !*user)
2090 return cli_session_setup_guest(cli);
2091
2092 /* if the server is share level then send a plaintext null
2093 password at this point. The password is sent in the tree
2094 connect */
2095
2096 if ((sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
2097 return cli_session_setup_plain(cli, user, "", workgroup);
2098
2099 /* if the server doesn't support encryption then we have to use
2100 plaintext. The second password is ignored */
2101
2102 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
2103 if (!lp_client_plaintext_auth() && (*pass)) {
2104 DEBUG(1, ("Server requested PLAINTEXT password but 'client plaintext auth = no'"
2105 " or 'client ntlmv2 auth = yes'\n"));
2106 return NT_STATUS_ACCESS_DENIED;
2107 }
2108 return cli_session_setup_plain(cli, user, pass, workgroup);
2109 }
2110
2111 /* if the server supports extended security then use SPNEGO */
2112
2113 if (smb1cli_conn_capabilities(cli->conn) & CAP_EXTENDED_SECURITY) {
2114 const char *remote_realm = cli_state_remote_realm(cli);
2115 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2116 workgroup,
2117 remote_realm);
2118 if (!ADS_ERR_OK(status)) {
2119 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
2120 return ads_ntstatus(status);
2121 }
2122 } else {
2123 NTSTATUS status;
2124
2125 /* otherwise do a NT1 style session setup */
2126 status = cli_session_setup_nt1(cli, user, pass, passlen,
2127 ntpass, ntpasslen, workgroup);
2128 if (!NT_STATUS_IS_OK(status)) {
2129 DEBUG(3,("cli_session_setup: NT1 session setup "
2130 "failed: %s\n", nt_errstr(status)));
2131 return status;
2132 }
2133 }
2134
2135 return NT_STATUS_OK;
2136 }
2137
2138 /****************************************************************************
2139 Send a uloggoff.
2140 *****************************************************************************/
2141
2142 struct cli_ulogoff_state {
2143 struct cli_state *cli;
2144 uint16_t vwv[3];
2145 };
2146
2147 static void cli_ulogoff_done(struct tevent_req *subreq);
2148
2149 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
2150 struct tevent_context *ev,
2151 struct cli_state *cli)
2152 {
2153 struct tevent_req *req, *subreq;
2154 struct cli_ulogoff_state *state;
2155
2156 req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
2157 if (req == NULL) {
2158 return NULL;
2159 }
2160 state->cli = cli;
2161
2162 SCVAL(state->vwv+0, 0, 0xFF);
2163 SCVAL(state->vwv+1, 0, 0);
2164 SSVAL(state->vwv+2, 0, 0);
2165
2166 subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
2167 0, NULL);
2168 if (tevent_req_nomem(subreq, req)) {
2169 return tevent_req_post(req, ev);
2170 }
2171 tevent_req_set_callback(subreq, cli_ulogoff_done, req);
2172 return req;
2173 }
2174
2175 static void cli_ulogoff_done(struct tevent_req *subreq)
2176 {
2177 struct tevent_req *req = tevent_req_callback_data(
2178 subreq, struct tevent_req);
2179 struct cli_ulogoff_state *state = tevent_req_data(
2180 req, struct cli_ulogoff_state);
2181 NTSTATUS status;
2182
2183 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2184 if (!NT_STATUS_IS_OK(status)) {
2185 tevent_req_nterror(req, status);
2186 return;
2187 }
2188 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
2189 tevent_req_done(req);
2190 }
2191
2192 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
2193 {
2194 return tevent_req_simple_recv_ntstatus(req);
2195 }
2196
2197 NTSTATUS cli_ulogoff(struct cli_state *cli)
2198 {
2199 struct tevent_context *ev;
2200 struct tevent_req *req;
2201 NTSTATUS status = NT_STATUS_NO_MEMORY;
2202
2203 if (smbXcli_conn_has_async_calls(cli->conn)) {
2204 return NT_STATUS_INVALID_PARAMETER;
2205 }
2206 ev = tevent_context_init(talloc_tos());
2207 if (ev == NULL) {
2208 goto fail;
2209 }
2210 req = cli_ulogoff_send(ev, ev, cli);
2211 if (req == NULL) {
2212 goto fail;
2213 }
2214 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2215 goto fail;
2216 }
2217 status = cli_ulogoff_recv(req);
2218 fail:
2219 TALLOC_FREE(ev);
2220 return status;
2221 }
2222
2223 /****************************************************************************
2224 Send a tconX.
2225 ****************************************************************************/
2226
2227 struct cli_tcon_andx_state {
2228 struct cli_state *cli;
2229 uint16_t vwv[4];
2230 struct iovec bytes;
2231 };
2232
2233 static void cli_tcon_andx_done(struct tevent_req *subreq);
2234
2235 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
2236 struct event_context *ev,
2237 struct cli_state *cli,
2238 const char *share, const char *dev,
2239 const char *pass, int passlen,
2240 struct tevent_req **psmbreq)
2241 {
2242 struct tevent_req *req, *subreq;
2243 struct cli_tcon_andx_state *state;
2244 uint8_t p24[24];
2245 uint16_t *vwv;
2246 char *tmp = NULL;
2247 uint8_t *bytes;
2248 uint16_t sec_mode = smb1cli_conn_server_security_mode(cli->conn);
2249
2250 *psmbreq = NULL;
2251
2252 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
2253 if (req == NULL) {
2254 return NULL;
2255 }
2256 state->cli = cli;
2257 vwv = state->vwv;
2258
2259 cli->share = talloc_strdup(cli, share);
2260 if (!cli->share) {
2261 return NULL;
2262 }
2263
2264 /* in user level security don't send a password now */
2265 if (sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
2266 passlen = 1;
2267 pass = "";
2268 } else if (pass == NULL) {
2269 DEBUG(1, ("Server not using user level security and no "
2270 "password supplied.\n"));
2271 goto access_denied;
2272 }
2273
2274 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
2275 *pass && passlen != 24) {
2276 if (!lp_client_lanman_auth()) {
2277 DEBUG(1, ("Server requested LANMAN password "
2278 "(share-level security) but "
2279 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2280 goto access_denied;
2281 }
2282
2283 /*
2284 * Non-encrypted passwords - convert to DOS codepage before
2285 * encryption.
2286 */
2287 SMBencrypt(pass, smb1cli_conn_server_challenge(cli->conn), p24);
2288 passlen = 24;
2289 pass = (const char *)p24;
2290 } else {
2291 if((sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
2292 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
2293 == 0) {
2294 uint8_t *tmp_pass;
2295
2296 if (!lp_client_plaintext_auth() && (*pass)) {
2297 DEBUG(1, ("Server requested PLAINTEXT "
2298 "password but "
2299 "'client plaintext auth = no' or 'client ntlmv2 auth = yes'\n"));
2300 goto access_denied;
2301 }
2302
2303 /*
2304 * Non-encrypted passwords - convert to DOS codepage
2305 * before using.
2306 */
2307 tmp_pass = talloc_array(talloc_tos(), uint8, 0);
2308 if (tevent_req_nomem(tmp_pass, req)) {
2309 return tevent_req_post(req, ev);
2310 }
2311 tmp_pass = trans2_bytes_push_str(tmp_pass,
2312 false, /* always DOS */
2313 pass,
2314 passlen,
2315 NULL);
2316 if (tevent_req_nomem(tmp_pass, req)) {
2317 return tevent_req_post(req, ev);
2318 }
2319 pass = (const char *)tmp_pass;
2320 passlen = talloc_get_size(tmp_pass);
2321 }
2322 }
2323
2324 SCVAL(vwv+0, 0, 0xFF);
2325 SCVAL(vwv+0, 1, 0);
2326 SSVAL(vwv+1, 0, 0);
2327 SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
2328 SSVAL(vwv+3, 0, passlen);
2329
2330 if (passlen && pass) {
2331 bytes = (uint8_t *)talloc_memdup(state, pass, passlen);
2332 } else {
2333 bytes = talloc_array(state, uint8_t, 0);
2334 }
2335
2336 /*
2337 * Add the sharename
2338 */
2339 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
2340 smbXcli_conn_remote_name(cli->conn), share);
2341 if (tmp == NULL) {
2342 TALLOC_FREE(req);
2343 return NULL;
2344 }
2345 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn), tmp, strlen(tmp)+1,
2346 NULL);
2347 TALLOC_FREE(tmp);
2348
2349 /*
2350 * Add the devicetype
2351 */
2352 tmp = talloc_strdup_upper(talloc_tos(), dev);
2353 if (tmp == NULL) {
2354 TALLOC_FREE(req);
2355 return NULL;
2356 }
2357 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
2358 TALLOC_FREE(tmp);
2359
2360 if (bytes == NULL) {
2361 TALLOC_FREE(req);
2362 return NULL;
2363 }
2364
2365 state->bytes.iov_base = (void *)bytes;
2366 state->bytes.iov_len = talloc_get_size(bytes);
2367
2368 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
2369 1, &state->bytes);
2370 if (subreq == NULL) {
2371 TALLOC_FREE(req);
2372 return NULL;
2373 }
2374 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
2375 *psmbreq = subreq;
2376 return req;
2377
2378 access_denied:
2379 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2380 return tevent_req_post(req, ev);
2381 }
2382
2383 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
2384 struct event_context *ev,
2385 struct cli_state *cli,
2386 const char *share, const char *dev,
2387 const char *pass, int passlen)
2388 {
2389 struct tevent_req *req, *subreq;
2390 NTSTATUS status;
2391
2392 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
2393 &subreq);
2394 if (req == NULL) {
2395 return NULL;
2396 }
2397 if (subreq == NULL) {
2398 return req;
2399 }
2400 status = smb1cli_req_chain_submit(&subreq, 1);
2401 if (!NT_STATUS_IS_OK(status)) {
2402 tevent_req_nterror(req, status);
2403 return tevent_req_post(req, ev);
2404 }
2405 return req;
2406 }
2407
2408 static void cli_tcon_andx_done(struct tevent_req *subreq)
2409 {
2410 struct tevent_req *req = tevent_req_callback_data(
2411 subreq, struct tevent_req);
2412 struct cli_tcon_andx_state *state = tevent_req_data(
2413 req, struct cli_tcon_andx_state);
2414 struct cli_state *cli = state->cli;
2415 uint8_t *in;
2416 uint8_t *inhdr;
2417 uint8_t wct;
2418 uint16_t *vwv;
2419 uint32_t num_bytes;
2420 uint8_t *bytes;
2421 NTSTATUS status;
2422
2423 status = cli_smb_recv(subreq, state, &in, 0, &wct, &vwv,
2424 &num_bytes, &bytes);
2425 TALLOC_FREE(subreq);
2426 if (!NT_STATUS_IS_OK(status)) {
2427 tevent_req_nterror(req, status);
2428 return;
2429 }
2430
2431 inhdr = in + NBT_HDR_SIZE;
2432
2433 if (num_bytes) {
2434 if (clistr_pull_talloc(cli,
2435 (const char *)inhdr,
2436 SVAL(inhdr, HDR_FLG2),
2437 &cli->dev,
2438 bytes,
2439 num_bytes,
2440 STR_TERMINATE|STR_ASCII) == -1) {
2441 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2442 return;
2443 }
2444 } else {
2445 cli->dev = talloc_strdup(cli, "");
2446 if (cli->dev == NULL) {
2447 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2448 return;
2449 }
2450 }
2451
2452 if ((smbXcli_conn_protocol(cli->conn) >= PROTOCOL_NT1) && (num_bytes == 3)) {
2453 /* almost certainly win95 - enable bug fixes */
2454 cli->win95 = True;
2455 }
2456
2457 /*
2458 * Make sure that we have the optional support 16-bit field. WCT > 2.
2459 * Avoids issues when connecting to Win9x boxes sharing files
2460 */
2461
2462 cli->dfsroot = false;
2463
2464 if ((wct > 2) && (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_LANMAN2)) {
2465 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
2466 }
2467
2468 cli->smb1.tid = SVAL(inhdr, HDR_TID);
2469 tevent_req_done(req);
2470 }
2471
2472 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
2473 {
2474 return tevent_req_simple_recv_ntstatus(req);
2475 }
2476
2477 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
2478 const char *dev, const char *pass, int passlen)
2479 {
2480 TALLOC_CTX *frame = talloc_stackframe();
2481 struct event_context *ev;
2482 struct tevent_req *req;
2483 NTSTATUS status = NT_STATUS_OK;
2484
2485 if (smbXcli_conn_has_async_calls(cli->conn)) {
2486 /*
2487 * Can't use sync call while an async call is in flight
2488 */
2489 status = NT_STATUS_INVALID_PARAMETER;
2490 goto fail;
2491 }
2492
2493 ev = event_context_init(frame);
2494 if (ev == NULL) {
2495 status = NT_STATUS_NO_MEMORY;
2496 goto fail;
2497 }
2498
2499 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
2500 if (req == NULL) {
2501 status = NT_STATUS_NO_MEMORY;
2502 goto fail;
2503 }
2504
2505 if (!tevent_req_poll(req, ev)) {
2506 status = map_nt_error_from_unix(errno);
2507 goto fail;
2508 }
2509
2510 status = cli_tcon_andx_recv(req);
2511 fail:
2512 TALLOC_FREE(frame);
2513 return status;
2514 }
2515
2516 NTSTATUS cli_tree_connect(struct cli_state *cli, const char *share,
2517 const char *dev, const char *pass, int passlen)
2518 {
2519 NTSTATUS status;
2520 uint16_t max_xmit = 0;
2521 uint16_t tid = 0;
2522
2523 cli->share = talloc_strdup(cli, share);
2524 if (!cli->share) {
2525 return NT_STATUS_NO_MEMORY;
2526 }
2527
2528 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2529 return smb2cli_tcon(cli, share);
2530 }
2531
2532 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_LANMAN1) {
2533 return cli_tcon_andx(cli, share, dev, pass, passlen);
2534 }
2535
2536 status = cli_raw_tcon(cli, share, pass, dev, &max_xmit, &tid);
2537 if (!NT_STATUS_IS_OK(status)) {
2538 return status;
2539 }
2540 cli->smb1.tid = tid;
2541
2542 return NT_STATUS_OK;
2543 }
2544
2545 /****************************************************************************
2546 Send a tree disconnect.
2547 ****************************************************************************/
2548
2549 struct cli_tdis_state {
2550 struct cli_state *cli;
2551 };
2552
2553 static void cli_tdis_done(struct tevent_req *subreq);
2554
2555 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
2556 struct tevent_context *ev,
2557 struct cli_state *cli)
2558 {
2559 struct tevent_req *req, *subreq;
2560 struct cli_tdis_state *state;
2561
2562 req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
2563 if (req == NULL) {
2564 return NULL;
2565 }
2566 state->cli = cli;
2567
2568 subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
2569 if (tevent_req_nomem(subreq, req)) {
2570 return tevent_req_post(req, ev);
2571 }
2572 tevent_req_set_callback(subreq, cli_tdis_done, req);
2573 return req;
2574 }
2575
2576 static void cli_tdis_done(struct tevent_req *subreq)
2577 {
2578 struct tevent_req *req = tevent_req_callback_data(
2579 subreq, struct tevent_req);
2580 struct cli_tdis_state *state = tevent_req_data(
2581 req, struct cli_tdis_state);
2582 NTSTATUS status;
2583
2584 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2585 TALLOC_FREE(subreq);
2586 if (!NT_STATUS_IS_OK(status)) {
2587 tevent_req_nterror(req, status);
2588 return;
2589 }
2590 state->cli->smb1.tid = UINT16_MAX;
2591 tevent_req_done(req);
2592 }
2593
2594 NTSTATUS cli_tdis_recv(struct tevent_req *req)
2595 {
2596 return tevent_req_simple_recv_ntstatus(req);
2597 }
2598
2599 NTSTATUS cli_tdis(struct cli_state *cli)
2600 {
2601 struct tevent_context *ev;
2602 struct tevent_req *req;
2603 NTSTATUS status = NT_STATUS_NO_MEMORY;
2604
2605 if (smbXcli_conn_has_async_calls(cli->conn)) {
2606 return NT_STATUS_INVALID_PARAMETER;
2607 }
2608 ev = tevent_context_init(talloc_tos());
2609 if (ev == NULL) {
2610 goto fail;
2611 }
2612 req = cli_tdis_send(ev, ev, cli);
2613 if (req == NULL) {
2614 goto fail;
2615 }
2616 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2617 goto fail;
2618 }
2619 status = cli_tdis_recv(req);
2620 fail:
2621 TALLOC_FREE(ev);
2622 return status;
2623 }
2624
2625 static NTSTATUS cli_connect_sock(const char *host, int name_type,
2626 const struct sockaddr_storage *pss,
2627 const char *myname, uint16_t port,
2628 int sec_timeout, int *pfd, uint16_t *pport)
2629 {
2630 TALLOC_CTX *frame = talloc_stackframe();
2631 const char *prog;
2632 unsigned int i, num_addrs;
2633 const char **called_names;
2634 const char **calling_names;
2635 int *called_types;
2636 NTSTATUS status;
2637 int fd;
2638
2639 prog = getenv("LIBSMB_PROG");
2640 if (prog != NULL) {
2641 fd = sock_exec(prog);
2642 if (fd == -1) {
2643 return map_nt_error_from_unix(errno);
2644 }
2645 port = 0;
2646 goto done;
2647 }
2648
2649 if ((pss == NULL) || is_zero_addr(pss)) {
2650 struct sockaddr_storage *addrs;
2651 status = resolve_name_list(talloc_tos(), host, name_type,
2652 &addrs, &num_addrs);
2653 if (!NT_STATUS_IS_OK(status)) {
2654 goto fail;
2655 }
2656 pss = addrs;
2657 } else {
2658 num_addrs = 1;
2659 }
2660
2661 called_names = talloc_array(talloc_tos(), const char *, num_addrs);
2662 if (called_names == NULL) {
2663 status = NT_STATUS_NO_MEMORY;
2664 goto fail;
2665 }
2666 called_types = talloc_array(talloc_tos(), int, num_addrs);
2667 if (called_types == NULL) {
2668 status = NT_STATUS_NO_MEMORY;
2669 goto fail;
2670 }
2671 calling_names = talloc_array(talloc_tos(), const char *, num_addrs);
2672 if (calling_names == NULL) {
2673 status = NT_STATUS_NO_MEMORY;
2674 goto fail;
2675 }
2676 for (i=0; i<num_addrs; i++) {
2677 called_names[i] = host;
2678 called_types[i] = name_type;
2679 calling_names[i] = myname;
2680 }
2681 status = smbsock_any_connect(pss, called_names, called_types,
2682 calling_names, NULL, num_addrs, port,
2683 sec_timeout, &fd, NULL, &port);
2684 if (!NT_STATUS_IS_OK(status)) {
2685 goto fail;
2686 }
2687 set_socket_options(fd, lp_socket_options());
2688 done:
2689 *pfd = fd;
2690 *pport = port;
2691 status = NT_STATUS_OK;
2692 fail:
2693 TALLOC_FREE(frame);
2694 return status;
2695 }
2696
2697 NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss,
2698 uint16_t port, int name_type, const char *myname,
2699 int signing_state, int flags, struct cli_state **pcli)
2700 {
2701 TALLOC_CTX *frame = talloc_stackframe();
2702 struct cli_state *cli;
2703 NTSTATUS status = NT_STATUS_NO_MEMORY;
2704 int fd = -1;
2705 char *desthost;
2706 char *p;
2707
2708 desthost = talloc_strdup(talloc_tos(), host);
2709 if (desthost == NULL) {
2710 goto fail;
2711 }
2712
2713 p = strchr(host, '#');
2714 if (p != NULL) {
2715 name_type = strtol(p+1, NULL, 16);
2716 host = talloc_strndup(talloc_tos(), host, p - host);
2717 if (host == NULL) {
2718 goto fail;
2719 }
2720 }
2721
2722 status = cli_connect_sock(host, name_type, dest_ss, myname, port,
2723 20, &fd, &port);
2724 if (!NT_STATUS_IS_OK(status)) {
2725 goto fail;
2726 }
2727
2728 cli = cli_state_create(NULL, fd, desthost, NULL, signing_state, flags);
2729 if (cli == NULL) {
2730 close(fd);
2731 fd = -1;
2732 goto fail;
2733 }
2734
2735 *pcli = cli;
2736 status = NT_STATUS_OK;
2737 fail:
2738 TALLOC_FREE(frame);
2739 return status;
2740 }
2741
2742 /**
2743 establishes a connection to after the negprot.
2744 @param output_cli A fully initialised cli structure, non-null only on success
2745 @param dest_host The netbios name of the remote host
2746 @param dest_ss (optional) The the destination IP, NULL for name based lookup
2747 @param port (optional) The destination port (0 for default)
2748 */
2749 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2750 const char *my_name,
2751 const char *dest_host,
2752 const struct sockaddr_storage *dest_ss, int port,
2753 int signing_state, int flags)
2754 {
2755 NTSTATUS nt_status;
2756 struct cli_state *cli;
2757
2758 nt_status = cli_connect_nb(dest_host, dest_ss, port, 0x20, my_name,
2759 signing_state, flags, &cli);
2760 if (!NT_STATUS_IS_OK(nt_status)) {
2761 DEBUG(10, ("cli_connect_nb failed: %s\n",
2762 nt_errstr(nt_status)));
2763 return nt_status;
2764 }
2765
2766 nt_status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
2767 PROTOCOL_NT1);
2768 if (!NT_STATUS_IS_OK(nt_status)) {
2769 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2770 cli_shutdown(cli);
2771 return nt_status;
2772 }
2773
2774 *output_cli = cli;
2775 return NT_STATUS_OK;
2776 }
2777
2778
2779 /**
2780 establishes a connection right up to doing tconX, password specified.
2781 @param output_cli A fully initialised cli structure, non-null only on success
2782 @param dest_host The netbios name of the remote host
2783 @param dest_ip (optional) The the destination IP, NULL for name based lookup
2784 @param port (optional) The destination port (0 for default)
2785 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
2786 @param service_type The 'type' of serivice.
2787 @param user Username, unix string
2788 @param domain User's domain
2789 @param password User's password, unencrypted unix string.
2790 */
2791
2792 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2793 const char *my_name,
2794 const char *dest_host,
2795 const struct sockaddr_storage *dest_ss, int port,
2796 const char *service, const char *service_type,
2797 const char *user, const char *domain,
2798 const char *password, int flags,
2799 int signing_state)
2800 {
2801 NTSTATUS nt_status;
2802 struct cli_state *cli = NULL;
2803 int pw_len = password ? strlen(password)+1 : 0;
2804
2805 *output_cli = NULL;
2806
2807 if (password == NULL) {
2808 password = "";
2809 }
2810
2811 nt_status = cli_start_connection(&cli, my_name, dest_host,
2812 dest_ss, port, signing_state,
2813 flags);
2814
2815 if (!NT_STATUS_IS_OK(nt_status)) {
2816 return nt_status;
2817 }
2818
2819 nt_status = cli_session_setup(cli, user, password, pw_len, password,
2820 pw_len, domain);
2821 if (!NT_STATUS_IS_OK(nt_status)) {
2822
2823 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2824 DEBUG(1,("failed session setup with %s\n",
2825 nt_errstr(nt_status)));
2826 cli_shutdown(cli);
2827 return nt_status;
2828 }
2829
2830 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2831 if (!NT_STATUS_IS_OK(nt_status)) {
2832 DEBUG(1,("anonymous failed session setup with %s\n",
2833 nt_errstr(nt_status)));
2834 cli_shutdown(cli);
2835 return nt_status;
2836 }
2837 }
2838
2839 if (service) {
2840 nt_status = cli_tree_connect(cli, service, service_type,
2841 password, pw_len);
2842 if (!NT_STATUS_IS_OK(nt_status)) {
2843 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2844 cli_shutdown(cli);
2845 if (NT_STATUS_IS_OK(nt_status)) {
2846 nt_status = NT_STATUS_UNSUCCESSFUL;
2847 }
2848 return nt_status;
2849 }
2850 }
2851
2852 nt_status = cli_init_creds(cli, user, domain, password);
2853 if (!NT_STATUS_IS_OK(nt_status)) {
2854 cli_shutdown(cli);
2855 return nt_status;
2856 }
2857
2858 *output_cli = cli;
2859 return NT_STATUS_OK;
2860 }
2861
2862 /****************************************************************************
2863 Send an old style tcon.
2864 ****************************************************************************/
2865 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2866 const char *service, const char *pass, const char *dev,
2867 uint16 *max_xmit, uint16 *tid)
2868 {
2869 struct tevent_req *req;
2870 uint16_t *ret_vwv;
2871 uint8_t *bytes;
2872 NTSTATUS status;
2873
2874 if (!lp_client_plaintext_auth() && (*pass)) {
2875 DEBUG(1, ("Server requested PLAINTEXT password but 'client plaintext auth = no'"
2876 " or 'client ntlmv2 auth = yes'\n"));
2877 return NT_STATUS_ACCESS_DENIED;
2878 }
2879
2880 bytes = talloc_array(talloc_tos(), uint8_t, 0);
2881 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2882 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
2883 service, strlen(service)+1, NULL);
2884 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2885 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
2886 pass, strlen(pass)+1, NULL);
2887 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2888 bytes = smb_bytes_push_str(bytes, smbXcli_conn_use_unicode(cli->conn),
2889 dev, strlen(dev)+1, NULL);
2890
2891 status = cli_smb(talloc_tos(), cli, SMBtcon, 0, 0, NULL,
2892 talloc_get_size(bytes), bytes, &req,
2893 2, NULL, &ret_vwv, NULL, NULL);
2894 if (!NT_STATUS_IS_OK(status)) {
2895 return status;
2896 }
2897
2898 *max_xmit = SVAL(ret_vwv + 0, 0);
2899 *tid = SVAL(ret_vwv + 1, 0);
2900
2901 return NT_STATUS_OK;
2902 }
2903
2904 /* Return a cli_state pointing at the IPC$ share for the given server */
2905
2906 struct cli_state *get_ipc_connect(char *server,
2907 struct sockaddr_storage *server_ss,
2908 const struct user_auth_info *user_info)
2909 {
2910 struct cli_state *cli;
2911 NTSTATUS nt_status;
2912 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2913
2914 if (user_info->use_kerberos) {
2915 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2916 }
2917
2918 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2919 user_info->username ? user_info->username : "",
2920 lp_workgroup(),
2921 user_info->password ? user_info->password : "",
2922 flags,
2923 SMB_SIGNING_DEFAULT);
2924
2925 if (NT_STATUS_IS_OK(nt_status)) {
2926 return cli;
2927 } else if (is_ipaddress(server)) {
2928 /* windows 9* needs a correct NMB name for connections */
2929 fstring remote_name;
2930
2931 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2932 cli = get_ipc_connect(remote_name, server_ss, user_info);
2933 if (cli)
2934 return cli;
2935 }
2936 }
2937 return NULL;
2938 }
2939
2940 /*
2941 * Given the IP address of a master browser on the network, return its
2942 * workgroup and connect to it.
2943 *
2944 * This function is provided to allow additional processing beyond what
2945 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2946 * browsers and obtain each master browsers' list of domains (in case the
2947 * first master browser is recently on the network and has not yet
2948 * synchronized with other master browsers and therefore does not yet have the
2949 * entire network browse list)
2950 */
2951
2952 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2953 struct sockaddr_storage *mb_ip,
2954 const struct user_auth_info *user_info,
2955 char **pp_workgroup_out)
2956 {
2957 char addr[INET6_ADDRSTRLEN];
2958 fstring name;
2959 struct cli_state *cli;
2960 struct sockaddr_storage server_ss;
2961
2962 *pp_workgroup_out = NULL;
2963
2964 print_sockaddr(addr, sizeof(addr), mb_ip);
2965 DEBUG(99, ("Looking up name of master browser %s\n",
2966 addr));
2967
2968 /*
2969 * Do a name status query to find out the name of the master browser.
2970 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2971 * master browser will not respond to a wildcard query (or, at least,
2972 * an NT4 server acting as the domain master browser will not).
2973 *
2974 * We might be able to use ONLY the query on MSBROWSE, but that's not
2975 * yet been tested with all Windows versions, so until it is, leave
2976 * the original wildcard query as the first choice and fall back to
2977 * MSBROWSE if the wildcard query fails.
2978 */
2979 if (!name_status_find("*", 0, 0x1d, mb_ip, name) &&
2980 !name_status_find(MSBROWSE, 1, 0x1d, mb_ip, name)) {
2981
2982 DEBUG(99, ("Could not retrieve name status for %s\n",
2983 addr));
2984 return NULL;
2985 }
2986
2987 if (!find_master_ip(name, &server_ss)) {
2988 DEBUG(99, ("Could not find master ip for %s\n", name));
2989 return NULL;
2990 }
2991
2992 *pp_workgroup_out = talloc_strdup(ctx, name);
2993
2994 DEBUG(4, ("found master browser %s, %s\n", name, addr));
2995
2996 print_sockaddr(addr, sizeof(addr), &server_ss);
2997 cli = get_ipc_connect(addr, &server_ss, user_info);
2998
2999 return cli;
3000 }
3001
3002 /*
3003 * Return the IP address and workgroup of a master browser on the network, and
3004 * connect to it.
3005 */
3006
3007 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
3008 const struct user_auth_info *user_info,
3009 char **pp_workgroup_out)
3010 {
3011 struct sockaddr_storage *ip_list;
3012 struct cli_state *cli;
3013 int i, count;
3014 NTSTATUS status;
3015
3016 *pp_workgroup_out = NULL;
3017
3018 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
3019
3020 /* Go looking for workgroups by broadcasting on the local network */
3021
3022 status = name_resolve_bcast(MSBROWSE, 1, talloc_tos(),
3023 &ip_list, &count);
3024 if (!NT_STATUS_IS_OK(status)) {
3025 DEBUG(99, ("No master browsers responded: %s\n",
3026 nt_errstr(status)));
3027 return NULL;
3028 }
3029
3030 for (i = 0; i < count; i++) {
3031 char addr[INET6_ADDRSTRLEN];
3032 print_sockaddr(addr, sizeof(addr), &ip_list[i]);
3033 DEBUG(99, ("Found master browser %s\n", addr));
3034
3035 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
3036 user_info, pp_workgroup_out);
3037 if (cli)
3038 return(cli);
3039 }
3040
3041 return NULL;
3042 }
reg import