?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
mount.cifs: check access of credential files before opening
[Samba/gebeck_regimport.git] / source3 / libsmb / cliconnect.c
blob2535de28474193c722dd82d73e70595c6e750f3f
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../libcli/auth/libcli_auth.h"
23 #include "../libcli/auth/spnego.h"
24
25 static const struct {
26 int prot;
27 const char name[24];
28 } prots[10] = {
29 {PROTOCOL_CORE, "PC NETWORK PROGRAM 1.0"},
30 {PROTOCOL_COREPLUS, "MICROSOFT NETWORKS 1.03"},
31 {PROTOCOL_LANMAN1, "MICROSOFT NETWORKS 3.0"},
32 {PROTOCOL_LANMAN1, "LANMAN1.0"},
33 {PROTOCOL_LANMAN2, "LM1.2X002"},
34 {PROTOCOL_LANMAN2, "DOS LANMAN2.1"},
35 {PROTOCOL_LANMAN2, "LANMAN2.1"},
36 {PROTOCOL_LANMAN2, "Samba"},
37 {PROTOCOL_NT1, "NT LANMAN 1.0"},
38 {PROTOCOL_NT1, "NT LM 0.12"},
39 };
40
41 #define STAR_SMBSERVER "*SMBSERVER"
42
43 /**
44 * Set the user session key for a connection
45 * @param cli The cli structure to add it too
46 * @param session_key The session key used. (A copy of this is taken for the cli struct)
47 *
48 */
49
50 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
51 {
52 cli->user_session_key = data_blob(session_key.data, session_key.length);
53 }
54
55 /****************************************************************************
56 Do an old lanman2 style session setup.
57 ****************************************************************************/
58
59 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
60 const char *user,
61 const char *pass, size_t passlen,
62 const char *workgroup)
63 {
64 DATA_BLOB session_key = data_blob_null;
65 DATA_BLOB lm_response = data_blob_null;
66 NTSTATUS status;
67 fstring pword;
68 char *p;
69
70 if (passlen > sizeof(pword)-1) {
71 return NT_STATUS_INVALID_PARAMETER;
72 }
73
74 /* LANMAN servers predate NT status codes and Unicode and ignore those
75 smb flags so we must disable the corresponding default capabilities
76 that would otherwise cause the Unicode and NT Status flags to be
77 set (and even returned by the server) */
78
79 cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
80
81 /* if in share level security then don't send a password now */
82 if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
83 passlen = 0;
84
85 if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
86 /* Encrypted mode needed, and non encrypted password supplied. */
87 lm_response = data_blob(NULL, 24);
88 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
89 DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
90 return NT_STATUS_ACCESS_DENIED;
91 }
92 } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
93 /* Encrypted mode needed, and encrypted password supplied. */
94 lm_response = data_blob(pass, passlen);
95 } else if (passlen > 0) {
96 /* Plaintext mode needed, assume plaintext supplied. */
97 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
98 lm_response = data_blob(pass, passlen);
99 }
100
101 /* send a session setup command */
102 memset(cli->outbuf,'\0',smb_size);
103 cli_set_message(cli->outbuf,10, 0, True);
104 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
105 cli_setup_packet(cli);
106
107 SCVAL(cli->outbuf,smb_vwv0,0xFF);
108 SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
109 SSVAL(cli->outbuf,smb_vwv3,2);
110 SSVAL(cli->outbuf,smb_vwv4,1);
111 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
112 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
113
114 p = smb_buf(cli->outbuf);
115 memcpy(p,lm_response.data,lm_response.length);
116 p += lm_response.length;
117 p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
118 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
119 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
120 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
121 cli_setup_bcc(cli, p);
122
123 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
124 return cli_nt_error(cli);
125 }
126
127 show_msg(cli->inbuf);
128
129 if (cli_is_error(cli)) {
130 return cli_nt_error(cli);
131 }
132
133 /* use the returned vuid from now on */
134 cli->vuid = SVAL(cli->inbuf,smb_uid);
135 status = cli_set_username(cli, user);
136 if (!NT_STATUS_IS_OK(status)) {
137 return status;
138 }
139
140 if (session_key.data) {
141 /* Have plaintext orginal */
142 cli_set_session_key(cli, session_key);
143 }
144
145 return NT_STATUS_OK;
146 }
147
148 /****************************************************************************
149 Work out suitable capabilities to offer the server.
150 ****************************************************************************/
151
152 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
153 {
154 uint32 capabilities = CAP_NT_SMBS;
155
156 if (!cli->force_dos_errors)
157 capabilities |= CAP_STATUS32;
158
159 if (cli->use_level_II_oplocks)
160 capabilities |= CAP_LEVEL_II_OPLOCKS;
161
162 capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
163 return capabilities;
164 }
165
166 /****************************************************************************
167 Do a NT1 guest session setup.
168 ****************************************************************************/
169
170 struct cli_session_setup_guest_state {
171 struct cli_state *cli;
172 uint16_t vwv[16];
173 struct iovec bytes;
174 };
175
176 static void cli_session_setup_guest_done(struct tevent_req *subreq);
177
178 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
179 struct event_context *ev,
180 struct cli_state *cli,
181 struct tevent_req **psmbreq)
182 {
183 struct tevent_req *req, *subreq;
184 struct cli_session_setup_guest_state *state;
185 uint16_t *vwv;
186 uint8_t *bytes;
187
188 req = tevent_req_create(mem_ctx, &state,
189 struct cli_session_setup_guest_state);
190 if (req == NULL) {
191 return NULL;
192 }
193 state->cli = cli;
194 vwv = state->vwv;
195
196 SCVAL(vwv+0, 0, 0xFF);
197 SCVAL(vwv+0, 1, 0);
198 SSVAL(vwv+1, 0, 0);
199 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
200 SSVAL(vwv+3, 0, 2);
201 SSVAL(vwv+4, 0, cli->pid);
202 SIVAL(vwv+5, 0, cli->sesskey);
203 SSVAL(vwv+7, 0, 0);
204 SSVAL(vwv+8, 0, 0);
205 SSVAL(vwv+9, 0, 0);
206 SSVAL(vwv+10, 0, 0);
207 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
208
209 bytes = talloc_array(state, uint8_t, 0);
210
211 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* username */
212 NULL);
213 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
214 NULL);
215 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
216 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
217
218 if (bytes == NULL) {
219 TALLOC_FREE(req);
220 return NULL;
221 }
222
223 state->bytes.iov_base = (void *)bytes;
224 state->bytes.iov_len = talloc_get_size(bytes);
225
226 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
227 1, &state->bytes);
228 if (subreq == NULL) {
229 TALLOC_FREE(req);
230 return NULL;
231 }
232 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
233 *psmbreq = subreq;
234 return req;
235 }
236
237 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
238 struct event_context *ev,
239 struct cli_state *cli)
240 {
241 struct tevent_req *req, *subreq;
242 NTSTATUS status;
243
244 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
245 if (req == NULL) {
246 return NULL;
247 }
248
249 status = cli_smb_req_send(subreq);
250 if (NT_STATUS_IS_OK(status)) {
251 tevent_req_nterror(req, status);
252 return tevent_req_post(req, ev);
253 }
254 return req;
255 }
256
257 static void cli_session_setup_guest_done(struct tevent_req *subreq)
258 {
259 struct tevent_req *req = tevent_req_callback_data(
260 subreq, struct tevent_req);
261 struct cli_session_setup_guest_state *state = tevent_req_data(
262 req, struct cli_session_setup_guest_state);
263 struct cli_state *cli = state->cli;
264 uint32_t num_bytes;
265 char *inbuf;
266 uint8_t *bytes;
267 uint8_t *p;
268 NTSTATUS status;
269
270 status = cli_smb_recv(subreq, 0, NULL, NULL, &num_bytes, &bytes);
271 if (!NT_STATUS_IS_OK(status)) {
272 TALLOC_FREE(subreq);
273 tevent_req_nterror(req, status);
274 return;
275 }
276
277 inbuf = (char *)cli_smb_inbuf(subreq);
278 p = bytes;
279
280 cli->vuid = SVAL(inbuf, smb_uid);
281
282 p += clistr_pull(inbuf, cli->server_os, (char *)p, sizeof(fstring),
283 bytes+num_bytes-p, STR_TERMINATE);
284 p += clistr_pull(inbuf, cli->server_type, (char *)p, sizeof(fstring),
285 bytes+num_bytes-p, STR_TERMINATE);
286 p += clistr_pull(inbuf, cli->server_domain, (char *)p, sizeof(fstring),
287 bytes+num_bytes-p, STR_TERMINATE);
288
289 if (strstr(cli->server_type, "Samba")) {
290 cli->is_samba = True;
291 }
292
293 TALLOC_FREE(subreq);
294
295 status = cli_set_username(cli, "");
296 if (!NT_STATUS_IS_OK(status)) {
297 tevent_req_nterror(req, status);
298 return;
299 }
300 tevent_req_done(req);
301 }
302
303 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
304 {
305 return tevent_req_simple_recv_ntstatus(req);
306 }
307
308 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
309 {
310 TALLOC_CTX *frame = talloc_stackframe();
311 struct event_context *ev;
312 struct tevent_req *req;
313 NTSTATUS status = NT_STATUS_OK;
314
315 if (cli_has_async_calls(cli)) {
316 /*
317 * Can't use sync call while an async call is in flight
318 */
319 status = NT_STATUS_INVALID_PARAMETER;
320 goto fail;
321 }
322
323 ev = event_context_init(frame);
324 if (ev == NULL) {
325 status = NT_STATUS_NO_MEMORY;
326 goto fail;
327 }
328
329 req = cli_session_setup_guest_send(frame, ev, cli);
330 if (req == NULL) {
331 status = NT_STATUS_NO_MEMORY;
332 goto fail;
333 }
334
335 if (!tevent_req_poll(req, ev)) {
336 status = map_nt_error_from_unix(errno);
337 goto fail;
338 }
339
340 status = cli_session_setup_guest_recv(req);
341 fail:
342 TALLOC_FREE(frame);
343 if (!NT_STATUS_IS_OK(status)) {
344 cli_set_error(cli, status);
345 }
346 return status;
347 }
348
349 /****************************************************************************
350 Do a NT1 plaintext session setup.
351 ****************************************************************************/
352
353 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
354 const char *user, const char *pass,
355 const char *workgroup)
356 {
357 uint32 capabilities = cli_session_setup_capabilities(cli);
358 char *p;
359 NTSTATUS status;
360 fstring lanman;
361
362 fstr_sprintf( lanman, "Samba %s", samba_version_string());
363
364 memset(cli->outbuf, '\0', smb_size);
365 cli_set_message(cli->outbuf,13,0,True);
366 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
367 cli_setup_packet(cli);
368
369 SCVAL(cli->outbuf,smb_vwv0,0xFF);
370 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
371 SSVAL(cli->outbuf,smb_vwv3,2);
372 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
373 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
374 SSVAL(cli->outbuf,smb_vwv8,0);
375 SIVAL(cli->outbuf,smb_vwv11,capabilities);
376 p = smb_buf(cli->outbuf);
377
378 /* check wether to send the ASCII or UNICODE version of the password */
379
380 if ( (capabilities & CAP_UNICODE) == 0 ) {
381 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
382 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
383 }
384 else {
385 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
386 * the space taken by the unicode password to be one byte too
387 * long (as we're on an odd byte boundary here). Reduce the
388 * count by 1 to cope with this. Fixes smbclient against NetApp
389 * servers which can't cope. Fix from
390 * bryan.kolodziej@allenlund.com in bug #3840.
391 */
392 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
393 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
394 }
395
396 p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
397 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
398 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
399 p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
400 cli_setup_bcc(cli, p);
401
402 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
403 return cli_nt_error(cli);
404 }
405
406 show_msg(cli->inbuf);
407
408 if (cli_is_error(cli)) {
409 return cli_nt_error(cli);
410 }
411
412 cli->vuid = SVAL(cli->inbuf,smb_uid);
413 p = smb_buf(cli->inbuf);
414 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
415 -1, STR_TERMINATE);
416 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
417 -1, STR_TERMINATE);
418 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
419 -1, STR_TERMINATE);
420 status = cli_set_username(cli, user);
421 if (!NT_STATUS_IS_OK(status)) {
422 return status;
423 }
424 if (strstr(cli->server_type, "Samba")) {
425 cli->is_samba = True;
426 }
427
428 return NT_STATUS_OK;
429 }
430
431 /****************************************************************************
432 do a NT1 NTLM/LM encrypted session setup - for when extended security
433 is not negotiated.
434 @param cli client state to create do session setup on
435 @param user username
436 @param pass *either* cleartext password (passlen !=24) or LM response.
437 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
438 @param workgroup The user's domain.
439 ****************************************************************************/
440
441 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
442 const char *pass, size_t passlen,
443 const char *ntpass, size_t ntpasslen,
444 const char *workgroup)
445 {
446 uint32 capabilities = cli_session_setup_capabilities(cli);
447 DATA_BLOB lm_response = data_blob_null;
448 DATA_BLOB nt_response = data_blob_null;
449 DATA_BLOB session_key = data_blob_null;
450 NTSTATUS result;
451 char *p;
452 bool ok;
453
454 if (passlen == 0) {
455 /* do nothing - guest login */
456 } else if (passlen != 24) {
457 if (lp_client_ntlmv2_auth()) {
458 DATA_BLOB server_chal;
459 DATA_BLOB names_blob;
460 server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
461
462 /* note that the 'workgroup' here is a best guess - we don't know
463 the server's domain at this point. The 'server name' is also
464 dodgy...
465 */
466 names_blob = NTLMv2_generate_names_blob(NULL, cli->called.name, workgroup);
467
468 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass, &server_chal,
469 &names_blob,
470 &lm_response, &nt_response, NULL, &session_key)) {
471 data_blob_free(&names_blob);
472 data_blob_free(&server_chal);
473 return NT_STATUS_ACCESS_DENIED;
474 }
475 data_blob_free(&names_blob);
476 data_blob_free(&server_chal);
477
478 } else {
479 uchar nt_hash[16];
480 E_md4hash(pass, nt_hash);
481
482 #ifdef LANMAN_ONLY
483 nt_response = data_blob_null;
484 #else
485 nt_response = data_blob(NULL, 24);
486 SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
487 #endif
488 /* non encrypted password supplied. Ignore ntpass. */
489 if (lp_client_lanman_auth()) {
490 lm_response = data_blob(NULL, 24);
491 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
492 /* Oops, the LM response is invalid, just put
493 the NT response there instead */
494 data_blob_free(&lm_response);
495 lm_response = data_blob(nt_response.data, nt_response.length);
496 }
497 } else {
498 /* LM disabled, place NT# in LM field instead */
499 lm_response = data_blob(nt_response.data, nt_response.length);
500 }
501
502 session_key = data_blob(NULL, 16);
503 #ifdef LANMAN_ONLY
504 E_deshash(pass, session_key.data);
505 memset(&session_key.data[8], '\0', 8);
506 #else
507 SMBsesskeygen_ntv1(nt_hash, session_key.data);
508 #endif
509 }
510 cli_temp_set_signing(cli);
511 } else {
512 /* pre-encrypted password supplied. Only used for
513 security=server, can't do
514 signing because we don't have original key */
515
516 lm_response = data_blob(pass, passlen);
517 nt_response = data_blob(ntpass, ntpasslen);
518 }
519
520 /* send a session setup command */
521 memset(cli->outbuf,'\0',smb_size);
522
523 cli_set_message(cli->outbuf,13,0,True);
524 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
525 cli_setup_packet(cli);
526
527 SCVAL(cli->outbuf,smb_vwv0,0xFF);
528 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
529 SSVAL(cli->outbuf,smb_vwv3,2);
530 SSVAL(cli->outbuf,smb_vwv4,cli->pid);
531 SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
532 SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
533 SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
534 SIVAL(cli->outbuf,smb_vwv11,capabilities);
535 p = smb_buf(cli->outbuf);
536 if (lm_response.length) {
537 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
538 }
539 if (nt_response.length) {
540 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
541 }
542 p += clistr_push(cli, p, user, -1, STR_TERMINATE);
543
544 /* Upper case here might help some NTLMv2 implementations */
545 p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
546 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
547 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
548 cli_setup_bcc(cli, p);
549
550 if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
551 result = cli_nt_error(cli);
552 goto end;
553 }
554
555 /* show_msg(cli->inbuf); */
556
557 if (cli_is_error(cli)) {
558 result = cli_nt_error(cli);
559 goto end;
560 }
561
562 #ifdef LANMAN_ONLY
563 ok = cli_simple_set_signing(cli, session_key, lm_response);
564 #else
565 ok = cli_simple_set_signing(cli, session_key, nt_response);
566 #endif
567 if (ok) {
568 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
569 result = NT_STATUS_ACCESS_DENIED;
570 goto end;
571 }
572 }
573
574 /* use the returned vuid from now on */
575 cli->vuid = SVAL(cli->inbuf,smb_uid);
576
577 p = smb_buf(cli->inbuf);
578 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
579 -1, STR_TERMINATE);
580 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
581 -1, STR_TERMINATE);
582 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
583 -1, STR_TERMINATE);
584
585 if (strstr(cli->server_type, "Samba")) {
586 cli->is_samba = True;
587 }
588
589 result = cli_set_username(cli, user);
590 if (!NT_STATUS_IS_OK(result)) {
591 goto end;
592 }
593
594 if (session_key.data) {
595 /* Have plaintext orginal */
596 cli_set_session_key(cli, session_key);
597 }
598
599 result = NT_STATUS_OK;
600 end:
601 data_blob_free(&lm_response);
602 data_blob_free(&nt_response);
603 data_blob_free(&session_key);
604 return result;
605 }
606
607 /****************************************************************************
608 Send a extended security session setup blob
609 ****************************************************************************/
610
611 static bool cli_session_setup_blob_send(struct cli_state *cli, DATA_BLOB blob)
612 {
613 uint32 capabilities = cli_session_setup_capabilities(cli);
614 char *p;
615
616 capabilities |= CAP_EXTENDED_SECURITY;
617
618 /* send a session setup command */
619 memset(cli->outbuf,'\0',smb_size);
620
621 cli_set_message(cli->outbuf,12,0,True);
622 SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
623
624 cli_setup_packet(cli);
625
626 SCVAL(cli->outbuf,smb_vwv0,0xFF);
627 SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
628 SSVAL(cli->outbuf,smb_vwv3,2);
629 SSVAL(cli->outbuf,smb_vwv4,1);
630 SIVAL(cli->outbuf,smb_vwv5,0);
631 SSVAL(cli->outbuf,smb_vwv7,blob.length);
632 SIVAL(cli->outbuf,smb_vwv10,capabilities);
633 p = smb_buf(cli->outbuf);
634 memcpy(p, blob.data, blob.length);
635 p += blob.length;
636 p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
637 p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
638 cli_setup_bcc(cli, p);
639 return cli_send_smb(cli);
640 }
641
642 /****************************************************************************
643 Send a extended security session setup blob, returning a reply blob.
644 ****************************************************************************/
645
646 static DATA_BLOB cli_session_setup_blob_receive(struct cli_state *cli)
647 {
648 DATA_BLOB blob2 = data_blob_null;
649 char *p;
650 size_t len;
651
652 if (!cli_receive_smb(cli))
653 return blob2;
654
655 show_msg(cli->inbuf);
656
657 if (cli_is_error(cli) && !NT_STATUS_EQUAL(cli_nt_error(cli),
658 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
659 return blob2;
660 }
661
662 /* use the returned vuid from now on */
663 cli->vuid = SVAL(cli->inbuf,smb_uid);
664
665 p = smb_buf(cli->inbuf);
666
667 blob2 = data_blob(p, SVAL(cli->inbuf, smb_vwv3));
668
669 p += blob2.length;
670 p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
671 -1, STR_TERMINATE);
672
673 /* w2k with kerberos doesn't properly null terminate this field */
674 len = smb_bufrem(cli->inbuf, p);
675 if (p + len < cli->inbuf + cli->bufsize+SAFETY_MARGIN - 2) {
676 char *end_of_buf = p + len;
677
678 SSVAL(p, len, 0);
679 /* Now it's null terminated. */
680 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
681 -1, STR_TERMINATE);
682 /*
683 * See if there's another string. If so it's the
684 * server domain (part of the 'standard' Samba
685 * server signature).
686 */
687 if (p < end_of_buf) {
688 p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
689 -1, STR_TERMINATE);
690 }
691 } else {
692 /*
693 * No room to null terminate so we can't see if there
694 * is another string (server_domain) afterwards.
695 */
696 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
697 len, 0);
698 }
699 return blob2;
700 }
701
702 #ifdef HAVE_KRB5
703 /****************************************************************************
704 Send a extended security session setup blob, returning a reply blob.
705 ****************************************************************************/
706
707 /* The following is calculated from :
708 * (smb_size-4) = 35
709 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
710 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
711 * end of packet.
712 */
713
714 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
715
716 static bool cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
717 {
718 int32 remaining = blob.length;
719 int32 cur = 0;
720 DATA_BLOB send_blob = data_blob_null;
721 int32 max_blob_size = 0;
722 DATA_BLOB receive_blob = data_blob_null;
723
724 if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
725 DEBUG(0,("cli_session_setup_blob: cli->max_xmit too small "
726 "(was %u, need minimum %u)\n",
727 (unsigned int)cli->max_xmit,
728 BASE_SESSSETUP_BLOB_PACKET_SIZE));
729 cli_set_nt_error(cli, NT_STATUS_INVALID_PARAMETER);
730 return False;
731 }
732
733 max_blob_size = cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE;
734
735 while ( remaining > 0) {
736 if (remaining >= max_blob_size) {
737 send_blob.length = max_blob_size;
738 remaining -= max_blob_size;
739 } else {
740 send_blob.length = remaining;
741 remaining = 0;
742 }
743
744 send_blob.data = &blob.data[cur];
745 cur += send_blob.length;
746
747 DEBUG(10, ("cli_session_setup_blob: Remaining (%u) sending (%u) current (%u)\n",
748 (unsigned int)remaining,
749 (unsigned int)send_blob.length,
750 (unsigned int)cur ));
751
752 if (!cli_session_setup_blob_send(cli, send_blob)) {
753 DEBUG(0, ("cli_session_setup_blob: send failed\n"));
754 return False;
755 }
756
757 receive_blob = cli_session_setup_blob_receive(cli);
758 data_blob_free(&receive_blob);
759
760 if (cli_is_error(cli) &&
761 !NT_STATUS_EQUAL( cli_get_nt_error(cli),
762 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
763 DEBUG(0, ("cli_session_setup_blob: receive failed "
764 "(%s)\n", nt_errstr(cli_get_nt_error(cli))));
765 cli->vuid = 0;
766 return False;
767 }
768 }
769
770 return True;
771 }
772
773 /****************************************************************************
774 Use in-memory credentials cache
775 ****************************************************************************/
776
777 static void use_in_memory_ccache(void) {
778 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
779 }
780
781 /****************************************************************************
782 Do a spnego/kerberos encrypted session setup.
783 ****************************************************************************/
784
785 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup)
786 {
787 DATA_BLOB negTokenTarg;
788 DATA_BLOB session_key_krb5;
789 NTSTATUS nt_status;
790 int rc;
791
792 cli_temp_set_signing(cli);
793
794 DEBUG(2,("Doing kerberos session setup\n"));
795
796 /* generate the encapsulated kerberos5 ticket */
797 rc = spnego_gen_negTokenTarg(principal, 0, &negTokenTarg, &session_key_krb5, 0, NULL);
798
799 if (rc) {
800 DEBUG(1, ("cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: %s\n",
801 error_message(rc)));
802 return ADS_ERROR_KRB5(rc);
803 }
804
805 #if 0
806 file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length);
807 #endif
808
809 if (!cli_session_setup_blob(cli, negTokenTarg)) {
810 nt_status = cli_nt_error(cli);
811 goto nt_error;
812 }
813
814 if (cli_is_error(cli)) {
815 nt_status = cli_nt_error(cli);
816 if (NT_STATUS_IS_OK(nt_status)) {
817 nt_status = NT_STATUS_UNSUCCESSFUL;
818 }
819 goto nt_error;
820 }
821
822 cli_set_session_key(cli, session_key_krb5);
823
824 if (cli_simple_set_signing(
825 cli, session_key_krb5, data_blob_null)) {
826
827 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
828 nt_status = NT_STATUS_ACCESS_DENIED;
829 goto nt_error;
830 }
831 }
832
833 data_blob_free(&negTokenTarg);
834 data_blob_free(&session_key_krb5);
835
836 return ADS_ERROR_NT(NT_STATUS_OK);
837
838 nt_error:
839 data_blob_free(&negTokenTarg);
840 data_blob_free(&session_key_krb5);
841 cli->vuid = 0;
842 return ADS_ERROR_NT(nt_status);
843 }
844 #endif /* HAVE_KRB5 */
845
846
847 /****************************************************************************
848 Do a spnego/NTLMSSP encrypted session setup.
849 ****************************************************************************/
850
851 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
852 const char *pass, const char *domain)
853 {
854 struct ntlmssp_state *ntlmssp_state;
855 NTSTATUS nt_status;
856 int turn = 1;
857 DATA_BLOB msg1;
858 DATA_BLOB blob = data_blob_null;
859 DATA_BLOB blob_in = data_blob_null;
860 DATA_BLOB blob_out = data_blob_null;
861
862 cli_temp_set_signing(cli);
863
864 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
865 return nt_status;
866 }
867 ntlmssp_want_feature(ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
868
869 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
870 return nt_status;
871 }
872 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
873 return nt_status;
874 }
875 if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, pass))) {
876 return nt_status;
877 }
878
879 do {
880 nt_status = ntlmssp_update(ntlmssp_state,
881 blob_in, &blob_out);
882 data_blob_free(&blob_in);
883 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(nt_status)) {
884 if (turn == 1) {
885 /* and wrap it in a SPNEGO wrapper */
886 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
887 } else {
888 /* wrap it in SPNEGO */
889 msg1 = spnego_gen_auth(blob_out);
890 }
891
892 /* now send that blob on its way */
893 if (!cli_session_setup_blob_send(cli, msg1)) {
894 DEBUG(3, ("Failed to send NTLMSSP/SPNEGO blob to server!\n"));
895 nt_status = NT_STATUS_UNSUCCESSFUL;
896 } else {
897 blob = cli_session_setup_blob_receive(cli);
898
899 nt_status = cli_nt_error(cli);
900 if (cli_is_error(cli) && NT_STATUS_IS_OK(nt_status)) {
901 if (cli->smb_rw_error == SMB_READ_BAD_SIG) {
902 nt_status = NT_STATUS_ACCESS_DENIED;
903 } else {
904 nt_status = NT_STATUS_UNSUCCESSFUL;
905 }
906 }
907 }
908 data_blob_free(&msg1);
909 }
910
911 if (!blob.length) {
912 if (NT_STATUS_IS_OK(nt_status)) {
913 nt_status = NT_STATUS_UNSUCCESSFUL;
914 }
915 } else if ((turn == 1) &&
916 NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
917 DATA_BLOB tmp_blob = data_blob_null;
918 /* the server might give us back two challenges */
919 if (!spnego_parse_challenge(blob, &blob_in,
920 &tmp_blob)) {
921 DEBUG(3,("Failed to parse challenges\n"));
922 nt_status = NT_STATUS_INVALID_PARAMETER;
923 }
924 data_blob_free(&tmp_blob);
925 } else {
926 if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
927 &blob_in)) {
928 DEBUG(3,("Failed to parse auth response\n"));
929 if (NT_STATUS_IS_OK(nt_status)
930 || NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED))
931 nt_status = NT_STATUS_INVALID_PARAMETER;
932 }
933 }
934 data_blob_free(&blob);
935 data_blob_free(&blob_out);
936 turn++;
937 } while (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED));
938
939 data_blob_free(&blob_in);
940
941 if (NT_STATUS_IS_OK(nt_status)) {
942
943 if (cli->server_domain[0] == '\0') {
944 fstrcpy(cli->server_domain, ntlmssp_state->server_domain);
945 }
946 cli_set_session_key(cli, ntlmssp_state->session_key);
947
948 if (cli_simple_set_signing(
949 cli, ntlmssp_state->session_key, data_blob_null)) {
950
951 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
952 nt_status = NT_STATUS_ACCESS_DENIED;
953 }
954 }
955 }
956
957 /* we have a reference conter on ntlmssp_state, if we are signing
958 then the state will be kept by the signing engine */
959
960 ntlmssp_end(&ntlmssp_state);
961
962 if (!NT_STATUS_IS_OK(nt_status)) {
963 cli->vuid = 0;
964 }
965 return nt_status;
966 }
967
968 /****************************************************************************
969 Do a spnego encrypted session setup.
970
971 user_domain: The shortname of the domain the user/machine is a member of.
972 dest_realm: The realm we're connecting to, if NULL we use our default realm.
973 ****************************************************************************/
974
975 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
976 const char *pass, const char *user_domain,
977 const char * dest_realm)
978 {
979 char *principal = NULL;
980 char *OIDs[ASN1_MAX_OIDS];
981 int i;
982 DATA_BLOB blob;
983 const char *p = NULL;
984 char *account = NULL;
985 NTSTATUS status;
986
987 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
988
989 /* the server might not even do spnego */
990 if (cli->secblob.length <= 16) {
991 DEBUG(3,("server didn't supply a full spnego negprot\n"));
992 goto ntlmssp;
993 }
994
995 #if 0
996 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
997 #endif
998
999 /* there is 16 bytes of GUID before the real spnego packet starts */
1000 blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
1001
1002 /* The server sent us the first part of the SPNEGO exchange in the
1003 * negprot reply. It is WRONG to depend on the principal sent in the
1004 * negprot reply, but right now we do it. If we don't receive one,
1005 * we try to best guess, then fall back to NTLM. */
1006 if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
1007 data_blob_free(&blob);
1008 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1009 }
1010 data_blob_free(&blob);
1011
1012 /* make sure the server understands kerberos */
1013 for (i=0;OIDs[i];i++) {
1014 if (i == 0)
1015 DEBUG(3,("got OID=%s\n", OIDs[i]));
1016 else
1017 DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1018 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1019 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1020 cli->got_kerberos_mechanism = True;
1021 }
1022 talloc_free(OIDs[i]);
1023 }
1024
1025 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1026
1027 status = cli_set_username(cli, user);
1028 if (!NT_STATUS_IS_OK(status)) {
1029 return ADS_ERROR_NT(status);
1030 }
1031
1032 #ifdef HAVE_KRB5
1033 /* If password is set we reauthenticate to kerberos server
1034 * and do not store results */
1035
1036 if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1037 ADS_STATUS rc;
1038
1039 if (pass && *pass) {
1040 int ret;
1041
1042 use_in_memory_ccache();
1043 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1044
1045 if (ret){
1046 TALLOC_FREE(principal);
1047 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1048 if (cli->fallback_after_kerberos)
1049 goto ntlmssp;
1050 return ADS_ERROR_KRB5(ret);
1051 }
1052 }
1053
1054 /* If we get a bad principal, try to guess it if
1055 we have a valid host NetBIOS name.
1056 */
1057 if (strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1058 TALLOC_FREE(principal);
1059 }
1060
1061 if (principal == NULL &&
1062 !is_ipaddress(cli->desthost) &&
1063 !strequal(STAR_SMBSERVER,
1064 cli->desthost)) {
1065 char *realm = NULL;
1066 char *machine = NULL;
1067 char *host = NULL;
1068 DEBUG(3,("cli_session_setup_spnego: got a "
1069 "bad server principal, trying to guess ...\n"));
1070
1071 host = strchr_m(cli->desthost, '.');
1072 if (host) {
1073 machine = SMB_STRNDUP(cli->desthost,
1074 host - cli->desthost);
1075 } else {
1076 machine = SMB_STRDUP(cli->desthost);
1077 }
1078 if (machine == NULL) {
1079 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1080 }
1081
1082 if (dest_realm) {
1083 realm = SMB_STRDUP(dest_realm);
1084 strupper_m(realm);
1085 } else {
1086 realm = kerberos_get_default_realm_from_ccache();
1087 }
1088 if (realm && *realm) {
1089 principal = talloc_asprintf(NULL, "%s$@%s",
1090 machine, realm);
1091 if (!principal) {
1092 SAFE_FREE(machine);
1093 SAFE_FREE(realm);
1094 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1095 }
1096 DEBUG(3,("cli_session_setup_spnego: guessed "
1097 "server principal=%s\n",
1098 principal ? principal : "<null>"));
1099 }
1100 SAFE_FREE(machine);
1101 SAFE_FREE(realm);
1102 }
1103
1104 if (principal) {
1105 rc = cli_session_setup_kerberos(cli, principal,
1106 dest_realm);
1107 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1108 TALLOC_FREE(principal);
1109 return rc;
1110 }
1111 }
1112 }
1113 #endif
1114
1115 TALLOC_FREE(principal);
1116
1117 ntlmssp:
1118
1119 account = talloc_strdup(talloc_tos(), user);
1120 if (!account) {
1121 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1122 }
1123
1124 /* when falling back to ntlmssp while authenticating with a machine
1125 * account strip off the realm - gd */
1126
1127 if ((p = strchr_m(user, '@')) != NULL) {
1128 account[PTR_DIFF(p,user)] = '\0';
1129 }
1130
1131 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1132 }
1133
1134 /****************************************************************************
1135 Send a session setup. The username and workgroup is in UNIX character
1136 format and must be converted to DOS codepage format before sending. If the
1137 password is in plaintext, the same should be done.
1138 ****************************************************************************/
1139
1140 NTSTATUS cli_session_setup(struct cli_state *cli,
1141 const char *user,
1142 const char *pass, int passlen,
1143 const char *ntpass, int ntpasslen,
1144 const char *workgroup)
1145 {
1146 char *p;
1147 fstring user2;
1148
1149 if (user) {
1150 fstrcpy(user2, user);
1151 } else {
1152 user2[0] ='\0';
1153 }
1154
1155 if (!workgroup) {
1156 workgroup = "";
1157 }
1158
1159 /* allow for workgroups as part of the username */
1160 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1161 (p=strchr_m(user2,*lp_winbind_separator()))) {
1162 *p = 0;
1163 user = p+1;
1164 workgroup = user2;
1165 }
1166
1167 if (cli->protocol < PROTOCOL_LANMAN1) {
1168 return NT_STATUS_OK;
1169 }
1170
1171 /* now work out what sort of session setup we are going to
1172 do. I have split this into separate functions to make the
1173 flow a bit easier to understand (tridge) */
1174
1175 /* if its an older server then we have to use the older request format */
1176
1177 if (cli->protocol < PROTOCOL_NT1) {
1178 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1179 DEBUG(1, ("Server requested LM password but 'client lanman auth'"
1180 " is disabled\n"));
1181 return NT_STATUS_ACCESS_DENIED;
1182 }
1183
1184 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1185 !lp_client_plaintext_auth() && (*pass)) {
1186 DEBUG(1, ("Server requested plaintext password but "
1187 "'client plaintext auth' is disabled\n"));
1188 return NT_STATUS_ACCESS_DENIED;
1189 }
1190
1191 return cli_session_setup_lanman2(cli, user, pass, passlen,
1192 workgroup);
1193 }
1194
1195 /* if no user is supplied then we have to do an anonymous connection.
1196 passwords are ignored */
1197
1198 if (!user || !*user)
1199 return cli_session_setup_guest(cli);
1200
1201 /* if the server is share level then send a plaintext null
1202 password at this point. The password is sent in the tree
1203 connect */
1204
1205 if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1206 return cli_session_setup_plaintext(cli, user, "", workgroup);
1207
1208 /* if the server doesn't support encryption then we have to use
1209 plaintext. The second password is ignored */
1210
1211 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1212 if (!lp_client_plaintext_auth() && (*pass)) {
1213 DEBUG(1, ("Server requested plaintext password but "
1214 "'client plaintext auth' is disabled\n"));
1215 return NT_STATUS_ACCESS_DENIED;
1216 }
1217 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1218 }
1219
1220 /* if the server supports extended security then use SPNEGO */
1221
1222 if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1223 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1224 workgroup, NULL);
1225 if (!ADS_ERR_OK(status)) {
1226 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1227 return ads_ntstatus(status);
1228 }
1229 } else {
1230 NTSTATUS status;
1231
1232 /* otherwise do a NT1 style session setup */
1233 status = cli_session_setup_nt1(cli, user, pass, passlen,
1234 ntpass, ntpasslen, workgroup);
1235 if (!NT_STATUS_IS_OK(status)) {
1236 DEBUG(3,("cli_session_setup: NT1 session setup "
1237 "failed: %s\n", nt_errstr(status)));
1238 return status;
1239 }
1240 }
1241
1242 if (strstr(cli->server_type, "Samba")) {
1243 cli->is_samba = True;
1244 }
1245
1246 return NT_STATUS_OK;
1247 }
1248
1249 /****************************************************************************
1250 Send a uloggoff.
1251 *****************************************************************************/
1252
1253 bool cli_ulogoff(struct cli_state *cli)
1254 {
1255 memset(cli->outbuf,'\0',smb_size);
1256 cli_set_message(cli->outbuf,2,0,True);
1257 SCVAL(cli->outbuf,smb_com,SMBulogoffX);
1258 cli_setup_packet(cli);
1259 SSVAL(cli->outbuf,smb_vwv0,0xFF);
1260 SSVAL(cli->outbuf,smb_vwv2,0); /* no additional info */
1261
1262 cli_send_smb(cli);
1263 if (!cli_receive_smb(cli))
1264 return False;
1265
1266 if (cli_is_error(cli)) {
1267 return False;
1268 }
1269
1270 cli->vuid = -1;
1271 return True;
1272 }
1273
1274 /****************************************************************************
1275 Send a tconX.
1276 ****************************************************************************/
1277
1278 struct cli_tcon_andx_state {
1279 struct cli_state *cli;
1280 uint16_t vwv[4];
1281 struct iovec bytes;
1282 };
1283
1284 static void cli_tcon_andx_done(struct tevent_req *subreq);
1285
1286 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
1287 struct event_context *ev,
1288 struct cli_state *cli,
1289 const char *share, const char *dev,
1290 const char *pass, int passlen,
1291 struct tevent_req **psmbreq)
1292 {
1293 struct tevent_req *req, *subreq;
1294 struct cli_tcon_andx_state *state;
1295 fstring pword;
1296 uint16_t *vwv;
1297 char *tmp = NULL;
1298 uint8_t *bytes;
1299
1300 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
1301 if (req == NULL) {
1302 return NULL;
1303 }
1304 state->cli = cli;
1305 vwv = state->vwv;
1306
1307 fstrcpy(cli->share, share);
1308
1309 /* in user level security don't send a password now */
1310 if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1311 passlen = 1;
1312 pass = "";
1313 } else if (pass == NULL) {
1314 DEBUG(1, ("Server not using user level security and no "
1315 "password supplied.\n"));
1316 goto access_denied;
1317 }
1318
1319 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1320 *pass && passlen != 24) {
1321 if (!lp_client_lanman_auth()) {
1322 DEBUG(1, ("Server requested LANMAN password "
1323 "(share-level security) but "
1324 "'client lanman auth' is disabled\n"));
1325 goto access_denied;
1326 }
1327
1328 /*
1329 * Non-encrypted passwords - convert to DOS codepage before
1330 * encryption.
1331 */
1332 passlen = 24;
1333 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1334 } else {
1335 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1336 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1337 == 0) {
1338 if (!lp_client_plaintext_auth() && (*pass)) {
1339 DEBUG(1, ("Server requested plaintext "
1340 "password but 'client plaintext "
1341 "auth' is disabled\n"));
1342 goto access_denied;
1343 }
1344
1345 /*
1346 * Non-encrypted passwords - convert to DOS codepage
1347 * before using.
1348 */
1349 passlen = clistr_push(cli, pword, pass, sizeof(pword),
1350 STR_TERMINATE);
1351 if (passlen == -1) {
1352 DEBUG(1, ("clistr_push(pword) failed\n"));
1353 goto access_denied;
1354 }
1355 } else {
1356 if (passlen) {
1357 memcpy(pword, pass, passlen);
1358 }
1359 }
1360 }
1361
1362 SCVAL(vwv+0, 0, 0xFF);
1363 SCVAL(vwv+0, 1, 0);
1364 SSVAL(vwv+1, 0, 0);
1365 SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1366 SSVAL(vwv+3, 0, passlen);
1367
1368 if (passlen) {
1369 bytes = (uint8_t *)talloc_memdup(state, pword, passlen);
1370 } else {
1371 bytes = talloc_array(state, uint8_t, 0);
1372 }
1373
1374 /*
1375 * Add the sharename
1376 */
1377 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1378 cli->desthost, share);
1379 if (tmp == NULL) {
1380 TALLOC_FREE(req);
1381 return NULL;
1382 }
1383 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1384 NULL);
1385 TALLOC_FREE(tmp);
1386
1387 /*
1388 * Add the devicetype
1389 */
1390 tmp = talloc_strdup_upper(talloc_tos(), dev);
1391 if (tmp == NULL) {
1392 TALLOC_FREE(req);
1393 return NULL;
1394 }
1395 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1396 TALLOC_FREE(tmp);
1397
1398 if (bytes == NULL) {
1399 TALLOC_FREE(req);
1400 return NULL;
1401 }
1402
1403 state->bytes.iov_base = (void *)bytes;
1404 state->bytes.iov_len = talloc_get_size(bytes);
1405
1406 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
1407 1, &state->bytes);
1408 if (subreq == NULL) {
1409 TALLOC_FREE(req);
1410 return NULL;
1411 }
1412 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
1413 *psmbreq = subreq;
1414 return req;
1415
1416 access_denied:
1417 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1418 return tevent_req_post(req, ev);
1419 }
1420
1421 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1422 struct event_context *ev,
1423 struct cli_state *cli,
1424 const char *share, const char *dev,
1425 const char *pass, int passlen)
1426 {
1427 struct tevent_req *req, *subreq;
1428 NTSTATUS status;
1429
1430 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
1431 &subreq);
1432 if (req == NULL) {
1433 return NULL;
1434 }
1435 status = cli_smb_req_send(subreq);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 tevent_req_nterror(req, status);
1438 return tevent_req_post(req, ev);
1439 }
1440 return req;
1441 }
1442
1443 static void cli_tcon_andx_done(struct tevent_req *subreq)
1444 {
1445 struct tevent_req *req = tevent_req_callback_data(
1446 subreq, struct tevent_req);
1447 struct cli_tcon_andx_state *state = tevent_req_data(
1448 req, struct cli_tcon_andx_state);
1449 struct cli_state *cli = state->cli;
1450 char *inbuf = (char *)cli_smb_inbuf(subreq);
1451 uint8_t wct;
1452 uint16_t *vwv;
1453 uint32_t num_bytes;
1454 uint8_t *bytes;
1455 NTSTATUS status;
1456
1457 status = cli_smb_recv(subreq, 0, &wct, &vwv, &num_bytes, &bytes);
1458 if (!NT_STATUS_IS_OK(status)) {
1459 TALLOC_FREE(subreq);
1460 tevent_req_nterror(req, status);
1461 return;
1462 }
1463
1464 clistr_pull(inbuf, cli->dev, bytes, sizeof(fstring), num_bytes,
1465 STR_TERMINATE|STR_ASCII);
1466
1467 if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1468 /* almost certainly win95 - enable bug fixes */
1469 cli->win95 = True;
1470 }
1471
1472 /*
1473 * Make sure that we have the optional support 16-bit field. WCT > 2.
1474 * Avoids issues when connecting to Win9x boxes sharing files
1475 */
1476
1477 cli->dfsroot = false;
1478
1479 if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1480 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1481 }
1482
1483 cli->cnum = SVAL(inbuf,smb_tid);
1484 tevent_req_done(req);
1485 }
1486
1487 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
1488 {
1489 return tevent_req_simple_recv_ntstatus(req);
1490 }
1491
1492 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1493 const char *dev, const char *pass, int passlen)
1494 {
1495 TALLOC_CTX *frame = talloc_stackframe();
1496 struct event_context *ev;
1497 struct tevent_req *req;
1498 NTSTATUS status = NT_STATUS_OK;
1499
1500 if (cli_has_async_calls(cli)) {
1501 /*
1502 * Can't use sync call while an async call is in flight
1503 */
1504 status = NT_STATUS_INVALID_PARAMETER;
1505 goto fail;
1506 }
1507
1508 ev = event_context_init(frame);
1509 if (ev == NULL) {
1510 status = NT_STATUS_NO_MEMORY;
1511 goto fail;
1512 }
1513
1514 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1515 if (req == NULL) {
1516 status = NT_STATUS_NO_MEMORY;
1517 goto fail;
1518 }
1519
1520 if (!tevent_req_poll(req, ev)) {
1521 status = map_nt_error_from_unix(errno);
1522 goto fail;
1523 }
1524
1525 status = cli_tcon_andx_recv(req);
1526 fail:
1527 TALLOC_FREE(frame);
1528 if (!NT_STATUS_IS_OK(status)) {
1529 cli_set_error(cli, status);
1530 }
1531 return status;
1532 }
1533
1534 /****************************************************************************
1535 Send a tree disconnect.
1536 ****************************************************************************/
1537
1538 bool cli_tdis(struct cli_state *cli)
1539 {
1540 memset(cli->outbuf,'\0',smb_size);
1541 cli_set_message(cli->outbuf,0,0,True);
1542 SCVAL(cli->outbuf,smb_com,SMBtdis);
1543 SSVAL(cli->outbuf,smb_tid,cli->cnum);
1544 cli_setup_packet(cli);
1545
1546 cli_send_smb(cli);
1547 if (!cli_receive_smb(cli))
1548 return False;
1549
1550 if (cli_is_error(cli)) {
1551 return False;
1552 }
1553
1554 cli->cnum = -1;
1555 return True;
1556 }
1557
1558 /****************************************************************************
1559 Send a negprot command.
1560 ****************************************************************************/
1561
1562 void cli_negprot_sendsync(struct cli_state *cli)
1563 {
1564 char *p;
1565 int numprots;
1566
1567 if (cli->protocol < PROTOCOL_NT1)
1568 cli->use_spnego = False;
1569
1570 memset(cli->outbuf,'\0',smb_size);
1571
1572 /* setup the protocol strings */
1573 cli_set_message(cli->outbuf,0,0,True);
1574
1575 p = smb_buf(cli->outbuf);
1576 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1577 if (prots[numprots].prot > cli->protocol) {
1578 break;
1579 }
1580 *p++ = 2;
1581 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1582 }
1583
1584 SCVAL(cli->outbuf,smb_com,SMBnegprot);
1585 cli_setup_bcc(cli, p);
1586 cli_setup_packet(cli);
1587
1588 SCVAL(smb_buf(cli->outbuf),0,2);
1589
1590 cli_send_smb(cli);
1591 }
1592
1593 /****************************************************************************
1594 Send a negprot command.
1595 ****************************************************************************/
1596
1597 struct cli_negprot_state {
1598 struct cli_state *cli;
1599 };
1600
1601 static void cli_negprot_done(struct tevent_req *subreq);
1602
1603 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1604 struct event_context *ev,
1605 struct cli_state *cli)
1606 {
1607 struct tevent_req *req, *subreq;
1608 struct cli_negprot_state *state;
1609 uint8_t *bytes = NULL;
1610 int numprots;
1611 uint16_t cnum;
1612
1613 req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
1614 if (req == NULL) {
1615 return NULL;
1616 }
1617 state->cli = cli;
1618
1619 if (cli->protocol < PROTOCOL_NT1)
1620 cli->use_spnego = False;
1621
1622 /* setup the protocol strings */
1623 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1624 uint8_t c = 2;
1625 if (prots[numprots].prot > cli->protocol) {
1626 break;
1627 }
1628 bytes = (uint8_t *)talloc_append_blob(
1629 state, bytes, data_blob_const(&c, sizeof(c)));
1630 if (tevent_req_nomem(bytes, req)) {
1631 return tevent_req_post(req, ev);
1632 }
1633 bytes = smb_bytes_push_str(bytes, false,
1634 prots[numprots].name,
1635 strlen(prots[numprots].name)+1,
1636 NULL);
1637 if (tevent_req_nomem(bytes, req)) {
1638 return tevent_req_post(req, ev);
1639 }
1640 }
1641
1642 cnum = cli->cnum;
1643
1644 cli->cnum = 0;
1645 subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
1646 talloc_get_size(bytes), bytes);
1647 cli->cnum = cnum;
1648
1649 if (tevent_req_nomem(subreq, req)) {
1650 return tevent_req_post(req, ev);
1651 }
1652 tevent_req_set_callback(subreq, cli_negprot_done, req);
1653 return req;
1654 }
1655
1656 static void cli_negprot_done(struct tevent_req *subreq)
1657 {
1658 struct tevent_req *req = tevent_req_callback_data(
1659 subreq, struct tevent_req);
1660 struct cli_negprot_state *state = tevent_req_data(
1661 req, struct cli_negprot_state);
1662 struct cli_state *cli = state->cli;
1663 uint8_t wct;
1664 uint16_t *vwv;
1665 uint32_t num_bytes;
1666 uint8_t *bytes;
1667 NTSTATUS status;
1668 uint16_t protnum;
1669
1670 status = cli_smb_recv(subreq, 1, &wct, &vwv, &num_bytes, &bytes);
1671 if (!NT_STATUS_IS_OK(status)) {
1672 TALLOC_FREE(subreq);
1673 return;
1674 }
1675
1676 protnum = SVAL(vwv, 0);
1677
1678 if ((protnum >= ARRAY_SIZE(prots))
1679 || (prots[protnum].prot > cli->protocol)) {
1680 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1681 return;
1682 }
1683
1684 cli->protocol = prots[protnum].prot;
1685
1686 if ((cli->protocol < PROTOCOL_NT1) &&
1687 client_is_signing_mandatory(cli)) {
1688 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
1689 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1690 return;
1691 }
1692
1693 if (cli->protocol >= PROTOCOL_NT1) {
1694 struct timespec ts;
1695 bool negotiated_smb_signing = false;
1696
1697 /* NT protocol */
1698 cli->sec_mode = CVAL(vwv + 1, 0);
1699 cli->max_mux = SVAL(vwv + 1, 1);
1700 cli->max_xmit = IVAL(vwv + 3, 1);
1701 cli->sesskey = IVAL(vwv + 7, 1);
1702 cli->serverzone = SVALS(vwv + 15, 1);
1703 cli->serverzone *= 60;
1704 /* this time arrives in real GMT */
1705 ts = interpret_long_date(((char *)(vwv+11))+1);
1706 cli->servertime = ts.tv_sec;
1707 cli->secblob = data_blob(bytes, num_bytes);
1708 cli->capabilities = IVAL(vwv + 9, 1);
1709 if (cli->capabilities & CAP_RAW_MODE) {
1710 cli->readbraw_supported = True;
1711 cli->writebraw_supported = True;
1712 }
1713 /* work out if they sent us a workgroup */
1714 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
1715 smb_buflen(cli->inbuf) > 8) {
1716 clistr_pull(cli->inbuf, cli->server_domain,
1717 bytes+8, sizeof(cli->server_domain),
1718 num_bytes-8,
1719 STR_UNICODE|STR_NOALIGN);
1720 }
1721
1722 /*
1723 * As signing is slow we only turn it on if either the client or
1724 * the server require it. JRA.
1725 */
1726
1727 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
1728 /* Fail if server says signing is mandatory and we don't want to support it. */
1729 if (!client_is_signing_allowed(cli)) {
1730 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
1731 tevent_req_nterror(req,
1732 NT_STATUS_ACCESS_DENIED);
1733 return;
1734 }
1735 negotiated_smb_signing = true;
1736 } else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
1737 /* Fail if client says signing is mandatory and the server doesn't support it. */
1738 if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
1739 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
1740 tevent_req_nterror(req,
1741 NT_STATUS_ACCESS_DENIED);
1742 return;
1743 }
1744 negotiated_smb_signing = true;
1745 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
1746 negotiated_smb_signing = true;
1747 }
1748
1749 if (negotiated_smb_signing) {
1750 cli_set_signing_negotiated(cli);
1751 }
1752
1753 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
1754 SAFE_FREE(cli->outbuf);
1755 SAFE_FREE(cli->inbuf);
1756 cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1757 cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1758 cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
1759 }
1760
1761 } else if (cli->protocol >= PROTOCOL_LANMAN1) {
1762 cli->use_spnego = False;
1763 cli->sec_mode = SVAL(vwv + 1, 0);
1764 cli->max_xmit = SVAL(vwv + 2, 0);
1765 cli->max_mux = SVAL(vwv + 3, 0);
1766 cli->sesskey = IVAL(vwv + 6, 0);
1767 cli->serverzone = SVALS(vwv + 10, 0);
1768 cli->serverzone *= 60;
1769 /* this time is converted to GMT by make_unix_date */
1770 cli->servertime = cli_make_unix_date(
1771 cli, (char *)(vwv + 8));
1772 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
1773 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
1774 cli->secblob = data_blob(bytes, num_bytes);
1775 } else {
1776 /* the old core protocol */
1777 cli->use_spnego = False;
1778 cli->sec_mode = 0;
1779 cli->serverzone = get_time_zone(time(NULL));
1780 }
1781
1782 cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
1783
1784 /* a way to force ascii SMB */
1785 if (getenv("CLI_FORCE_ASCII"))
1786 cli->capabilities &= ~CAP_UNICODE;
1787
1788 tevent_req_done(req);
1789 }
1790
1791 NTSTATUS cli_negprot_recv(struct tevent_req *req)
1792 {
1793 return tevent_req_simple_recv_ntstatus(req);
1794 }
1795
1796 NTSTATUS cli_negprot(struct cli_state *cli)
1797 {
1798 TALLOC_CTX *frame = talloc_stackframe();
1799 struct event_context *ev;
1800 struct tevent_req *req;
1801 NTSTATUS status = NT_STATUS_OK;
1802
1803 if (cli_has_async_calls(cli)) {
1804 /*
1805 * Can't use sync call while an async call is in flight
1806 */
1807 status = NT_STATUS_INVALID_PARAMETER;
1808 goto fail;
1809 }
1810
1811 ev = event_context_init(frame);
1812 if (ev == NULL) {
1813 status = NT_STATUS_NO_MEMORY;
1814 goto fail;
1815 }
1816
1817 req = cli_negprot_send(frame, ev, cli);
1818 if (req == NULL) {
1819 status = NT_STATUS_NO_MEMORY;
1820 goto fail;
1821 }
1822
1823 if (!tevent_req_poll(req, ev)) {
1824 status = map_nt_error_from_unix(errno);
1825 goto fail;
1826 }
1827
1828 status = cli_negprot_recv(req);
1829 fail:
1830 TALLOC_FREE(frame);
1831 if (!NT_STATUS_IS_OK(status)) {
1832 cli_set_error(cli, status);
1833 }
1834 return status;
1835 }
1836
1837 /****************************************************************************
1838 Send a session request. See rfc1002.txt 4.3 and 4.3.2.
1839 ****************************************************************************/
1840
1841 bool cli_session_request(struct cli_state *cli,
1842 struct nmb_name *calling, struct nmb_name *called)
1843 {
1844 char *p;
1845 int len = 4;
1846 char *tmp;
1847
1848 /* 445 doesn't have session request */
1849 if (cli->port == 445)
1850 return True;
1851
1852 memcpy(&(cli->calling), calling, sizeof(*calling));
1853 memcpy(&(cli->called ), called , sizeof(*called ));
1854
1855 /* put in the destination name */
1856
1857 tmp = name_mangle(talloc_tos(), cli->called.name,
1858 cli->called.name_type);
1859 if (tmp == NULL) {
1860 return false;
1861 }
1862
1863 p = cli->outbuf+len;
1864 memcpy(p, tmp, name_len(tmp));
1865 len += name_len(tmp);
1866 TALLOC_FREE(tmp);
1867
1868 /* and my name */
1869
1870 tmp = name_mangle(talloc_tos(), cli->calling.name,
1871 cli->calling.name_type);
1872 if (tmp == NULL) {
1873 return false;
1874 }
1875
1876 p = cli->outbuf+len;
1877 memcpy(p, tmp, name_len(tmp));
1878 len += name_len(tmp);
1879 TALLOC_FREE(tmp);
1880
1881 /* send a session request (RFC 1002) */
1882 /* setup the packet length
1883 * Remove four bytes from the length count, since the length
1884 * field in the NBT Session Service header counts the number
1885 * of bytes which follow. The cli_send_smb() function knows
1886 * about this and accounts for those four bytes.
1887 * CRH.
1888 */
1889 len -= 4;
1890 _smb_setlen(cli->outbuf,len);
1891 SCVAL(cli->outbuf,0,0x81);
1892
1893 cli_send_smb(cli);
1894 DEBUG(5,("Sent session request\n"));
1895
1896 if (!cli_receive_smb(cli))
1897 return False;
1898
1899 if (CVAL(cli->inbuf,0) == 0x84) {
1900 /* C. Hoch 9/14/95 Start */
1901 /* For information, here is the response structure.
1902 * We do the byte-twiddling to for portability.
1903 struct RetargetResponse{
1904 unsigned char type;
1905 unsigned char flags;
1906 int16 length;
1907 int32 ip_addr;
1908 int16 port;
1909 };
1910 */
1911 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
1912 struct in_addr dest_ip;
1913 NTSTATUS status;
1914
1915 /* SESSION RETARGET */
1916 putip((char *)&dest_ip,cli->inbuf+4);
1917 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
1918
1919 status = open_socket_out(&cli->dest_ss, port,
1920 LONG_CONNECT_TIMEOUT, &cli->fd);
1921 if (!NT_STATUS_IS_OK(status)) {
1922 return False;
1923 }
1924
1925 DEBUG(3,("Retargeted\n"));
1926
1927 set_socket_options(cli->fd, lp_socket_options());
1928
1929 /* Try again */
1930 {
1931 static int depth;
1932 bool ret;
1933 if (depth > 4) {
1934 DEBUG(0,("Retarget recursion - failing\n"));
1935 return False;
1936 }
1937 depth++;
1938 ret = cli_session_request(cli, calling, called);
1939 depth--;
1940 return ret;
1941 }
1942 } /* C. Hoch 9/14/95 End */
1943
1944 if (CVAL(cli->inbuf,0) != 0x82) {
1945 /* This is the wrong place to put the error... JRA. */
1946 cli->rap_error = CVAL(cli->inbuf,4);
1947 return False;
1948 }
1949 return(True);
1950 }
1951
1952 struct fd_struct {
1953 int fd;
1954 };
1955
1956 static void smb_sock_connected(struct tevent_req *req)
1957 {
1958 struct fd_struct *pfd = tevent_req_callback_data(
1959 req, struct fd_struct);
1960 int fd;
1961 NTSTATUS status;
1962
1963 status = open_socket_out_defer_recv(req, &fd);
1964 if (NT_STATUS_IS_OK(status)) {
1965 pfd->fd = fd;
1966 }
1967 }
1968
1969 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
1970 uint16_t *port, int timeout, int *pfd)
1971 {
1972 struct event_context *ev;
1973 struct tevent_req *r139, *r445;
1974 struct fd_struct *fd139, *fd445;
1975 NTSTATUS status = NT_STATUS_NO_MEMORY;
1976
1977 if (*port != 0) {
1978 return open_socket_out(pss, *port, timeout, pfd);
1979 }
1980
1981 ev = event_context_init(talloc_tos());
1982 if (ev == NULL) {
1983 return NT_STATUS_NO_MEMORY;
1984 }
1985
1986 fd139 = talloc(ev, struct fd_struct);
1987 if (fd139 == NULL) {
1988 goto done;
1989 }
1990 fd139->fd = -1;
1991
1992 fd445 = talloc(ev, struct fd_struct);
1993 if (fd445 == NULL) {
1994 goto done;
1995 }
1996 fd445->fd = -1;
1997
1998 r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
1999 pss, 445, timeout);
2000 r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
2001 pss, 139, timeout);
2002 if ((r445 == NULL) || (r139 == NULL)) {
2003 goto done;
2004 }
2005 tevent_req_set_callback(r445, smb_sock_connected, fd445);
2006 tevent_req_set_callback(r139, smb_sock_connected, fd139);
2007
2008 while ((fd445->fd == -1) && (fd139->fd == -1)
2009 && (tevent_req_is_in_progress(r139)
2010 || tevent_req_is_in_progress(r445))) {
2011 event_loop_once(ev);
2012 }
2013
2014 if ((fd139->fd != -1) && (fd445->fd != -1)) {
2015 close(fd139->fd);
2016 fd139->fd = -1;
2017 }
2018
2019 if (fd445->fd != -1) {
2020 *port = 445;
2021 *pfd = fd445->fd;
2022 status = NT_STATUS_OK;
2023 goto done;
2024 }
2025 if (fd139->fd != -1) {
2026 *port = 139;
2027 *pfd = fd139->fd;
2028 status = NT_STATUS_OK;
2029 goto done;
2030 }
2031
2032 status = open_socket_out_defer_recv(r445, &fd445->fd);
2033 done:
2034 TALLOC_FREE(ev);
2035 return status;
2036 }
2037
2038 /****************************************************************************
2039 Open the client sockets.
2040 ****************************************************************************/
2041
2042 NTSTATUS cli_connect(struct cli_state *cli,
2043 const char *host,
2044 struct sockaddr_storage *dest_ss)
2045
2046 {
2047 int name_type = 0x20;
2048 TALLOC_CTX *frame = talloc_stackframe();
2049 unsigned int num_addrs = 0;
2050 unsigned int i = 0;
2051 struct sockaddr_storage *ss_arr = NULL;
2052 char *p = NULL;
2053
2054 /* reasonable default hostname */
2055 if (!host) {
2056 host = STAR_SMBSERVER;
2057 }
2058
2059 fstrcpy(cli->desthost, host);
2060
2061 /* allow hostnames of the form NAME#xx and do a netbios lookup */
2062 if ((p = strchr(cli->desthost, '#'))) {
2063 name_type = strtol(p+1, NULL, 16);
2064 *p = 0;
2065 }
2066
2067 if (!dest_ss || is_zero_addr((struct sockaddr *)dest_ss)) {
2068 NTSTATUS status =resolve_name_list(frame,
2069 cli->desthost,
2070 name_type,
2071 &ss_arr,
2072 &num_addrs);
2073 if (!NT_STATUS_IS_OK(status)) {
2074 TALLOC_FREE(frame);
2075 return NT_STATUS_BAD_NETWORK_NAME;
2076 }
2077 } else {
2078 num_addrs = 1;
2079 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
2080 if (!ss_arr) {
2081 TALLOC_FREE(frame);
2082 return NT_STATUS_NO_MEMORY;
2083 }
2084 *ss_arr = *dest_ss;
2085 }
2086
2087 for (i = 0; i < num_addrs; i++) {
2088 cli->dest_ss = ss_arr[i];
2089 if (getenv("LIBSMB_PROG")) {
2090 cli->fd = sock_exec(getenv("LIBSMB_PROG"));
2091 } else {
2092 uint16_t port = cli->port;
2093 NTSTATUS status;
2094 status = open_smb_socket(&cli->dest_ss, &port,
2095 cli->timeout, &cli->fd);
2096 if (NT_STATUS_IS_OK(status)) {
2097 cli->port = port;
2098 }
2099 }
2100 if (cli->fd == -1) {
2101 char addr[INET6_ADDRSTRLEN];
2102 print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
2103 DEBUG(2,("Error connecting to %s (%s)\n",
2104 dest_ss?addr:host,strerror(errno)));
2105 } else {
2106 /* Exit from loop on first connection. */
2107 break;
2108 }
2109 }
2110
2111 if (cli->fd == -1) {
2112 TALLOC_FREE(frame);
2113 return map_nt_error_from_unix(errno);
2114 }
2115
2116 if (dest_ss) {
2117 *dest_ss = cli->dest_ss;
2118 }
2119
2120 set_socket_options(cli->fd, lp_socket_options());
2121
2122 TALLOC_FREE(frame);
2123 return NT_STATUS_OK;
2124 }
2125
2126 /**
2127 establishes a connection to after the negprot.
2128 @param output_cli A fully initialised cli structure, non-null only on success
2129 @param dest_host The netbios name of the remote host
2130 @param dest_ss (optional) The the destination IP, NULL for name based lookup
2131 @param port (optional) The destination port (0 for default)
2132 @param retry bool. Did this connection fail with a retryable error ?
2133
2134 */
2135 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2136 const char *my_name,
2137 const char *dest_host,
2138 struct sockaddr_storage *dest_ss, int port,
2139 int signing_state, int flags,
2140 bool *retry)
2141 {
2142 NTSTATUS nt_status;
2143 struct nmb_name calling;
2144 struct nmb_name called;
2145 struct cli_state *cli;
2146 struct sockaddr_storage ss;
2147
2148 if (retry)
2149 *retry = False;
2150
2151 if (!my_name)
2152 my_name = global_myname();
2153
2154 if (!(cli = cli_initialise_ex(signing_state))) {
2155 return NT_STATUS_NO_MEMORY;
2156 }
2157
2158 make_nmb_name(&calling, my_name, 0x0);
2159 make_nmb_name(&called , dest_host, 0x20);
2160
2161 cli_set_port(cli, port);
2162 cli_set_timeout(cli, 10000); /* 10 seconds. */
2163
2164 if (dest_ss) {
2165 ss = *dest_ss;
2166 } else {
2167 zero_sockaddr(&ss);
2168 }
2169
2170 again:
2171
2172 DEBUG(3,("Connecting to host=%s\n", dest_host));
2173
2174 nt_status = cli_connect(cli, dest_host, &ss);
2175 if (!NT_STATUS_IS_OK(nt_status)) {
2176 char addr[INET6_ADDRSTRLEN];
2177 print_sockaddr(addr, sizeof(addr), &ss);
2178 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2179 nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2180 cli_shutdown(cli);
2181 return nt_status;
2182 }
2183
2184 if (retry)
2185 *retry = True;
2186
2187 if (!cli_session_request(cli, &calling, &called)) {
2188 char *p;
2189 DEBUG(1,("session request to %s failed (%s)\n",
2190 called.name, cli_errstr(cli)));
2191 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2192 *p = 0;
2193 goto again;
2194 }
2195 if (strcmp(called.name, STAR_SMBSERVER)) {
2196 make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2197 goto again;
2198 }
2199 return NT_STATUS_BAD_NETWORK_NAME;
2200 }
2201
2202 if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2203 cli->use_spnego = False;
2204 else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2205 cli->use_kerberos = True;
2206
2207 if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2208 cli->use_kerberos) {
2209 cli->fallback_after_kerberos = true;
2210 }
2211
2212 nt_status = cli_negprot(cli);
2213 if (!NT_STATUS_IS_OK(nt_status)) {
2214 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2215 cli_shutdown(cli);
2216 return nt_status;
2217 }
2218
2219 *output_cli = cli;
2220 return NT_STATUS_OK;
2221 }
2222
2223
2224 /**
2225 establishes a connection right up to doing tconX, password specified.
2226 @param output_cli A fully initialised cli structure, non-null only on success
2227 @param dest_host The netbios name of the remote host
2228 @param dest_ip (optional) The the destination IP, NULL for name based lookup
2229 @param port (optional) The destination port (0 for default)
2230 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
2231 @param service_type The 'type' of serivice.
2232 @param user Username, unix string
2233 @param domain User's domain
2234 @param password User's password, unencrypted unix string.
2235 @param retry bool. Did this connection fail with a retryable error ?
2236 */
2237
2238 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2239 const char *my_name,
2240 const char *dest_host,
2241 struct sockaddr_storage *dest_ss, int port,
2242 const char *service, const char *service_type,
2243 const char *user, const char *domain,
2244 const char *password, int flags,
2245 int signing_state,
2246 bool *retry)
2247 {
2248 NTSTATUS nt_status;
2249 struct cli_state *cli = NULL;
2250 int pw_len = password ? strlen(password)+1 : 0;
2251
2252 *output_cli = NULL;
2253
2254 if (password == NULL) {
2255 password = "";
2256 }
2257
2258 nt_status = cli_start_connection(&cli, my_name, dest_host,
2259 dest_ss, port, signing_state,
2260 flags, retry);
2261
2262 if (!NT_STATUS_IS_OK(nt_status)) {
2263 return nt_status;
2264 }
2265
2266 cli->use_oplocks = ((flags & CLI_FULL_CONNECTION_OPLOCKS) != 0);
2267 cli->use_level_II_oplocks =
2268 ((flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) != 0);
2269
2270 nt_status = cli_session_setup(cli, user, password, pw_len, password,
2271 pw_len, domain);
2272 if (!NT_STATUS_IS_OK(nt_status)) {
2273
2274 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2275 DEBUG(1,("failed session setup with %s\n",
2276 nt_errstr(nt_status)));
2277 cli_shutdown(cli);
2278 return nt_status;
2279 }
2280
2281 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2282 if (!NT_STATUS_IS_OK(nt_status)) {
2283 DEBUG(1,("anonymous failed session setup with %s\n",
2284 nt_errstr(nt_status)));
2285 cli_shutdown(cli);
2286 return nt_status;
2287 }
2288 }
2289
2290 if (service) {
2291 nt_status = cli_tcon_andx(cli, service, service_type, password,
2292 pw_len);
2293 if (!NT_STATUS_IS_OK(nt_status)) {
2294 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2295 cli_shutdown(cli);
2296 if (NT_STATUS_IS_OK(nt_status)) {
2297 nt_status = NT_STATUS_UNSUCCESSFUL;
2298 }
2299 return nt_status;
2300 }
2301 }
2302
2303 nt_status = cli_init_creds(cli, user, domain, password);
2304 if (!NT_STATUS_IS_OK(nt_status)) {
2305 cli_shutdown(cli);
2306 return nt_status;
2307 }
2308
2309 *output_cli = cli;
2310 return NT_STATUS_OK;
2311 }
2312
2313 /****************************************************************************
2314 Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2315 ****************************************************************************/
2316
2317 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2318 struct sockaddr_storage *pdest_ss)
2319 {
2320 struct nmb_name calling, called;
2321
2322 make_nmb_name(&calling, srchost, 0x0);
2323
2324 /*
2325 * If the called name is an IP address
2326 * then use *SMBSERVER immediately.
2327 */
2328
2329 if(is_ipaddress(desthost)) {
2330 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2331 } else {
2332 make_nmb_name(&called, desthost, 0x20);
2333 }
2334
2335 if (!cli_session_request(*ppcli, &calling, &called)) {
2336 NTSTATUS status;
2337 struct nmb_name smbservername;
2338
2339 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2340
2341 /*
2342 * If the name wasn't *SMBSERVER then
2343 * try with *SMBSERVER if the first name fails.
2344 */
2345
2346 if (nmb_name_equal(&called, &smbservername)) {
2347
2348 /*
2349 * The name used was *SMBSERVER, don't bother with another name.
2350 */
2351
2352 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2353 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2354 return False;
2355 }
2356
2357 /* Try again... */
2358 cli_shutdown(*ppcli);
2359
2360 *ppcli = cli_initialise();
2361 if (!*ppcli) {
2362 /* Out of memory... */
2363 return False;
2364 }
2365
2366 status = cli_connect(*ppcli, desthost, pdest_ss);
2367 if (!NT_STATUS_IS_OK(status) ||
2368 !cli_session_request(*ppcli, &calling, &smbservername)) {
2369 DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2370 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2371 return False;
2372 }
2373 }
2374
2375 return True;
2376 }
2377
2378 /****************************************************************************
2379 Send an old style tcon.
2380 ****************************************************************************/
2381 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2382 const char *service, const char *pass, const char *dev,
2383 uint16 *max_xmit, uint16 *tid)
2384 {
2385 char *p;
2386
2387 if (!lp_client_plaintext_auth() && (*pass)) {
2388 DEBUG(1, ("Server requested plaintext password but 'client "
2389 "plaintext auth' is disabled\n"));
2390 return NT_STATUS_ACCESS_DENIED;
2391 }
2392
2393 memset(cli->outbuf,'\0',smb_size);
2394 memset(cli->inbuf,'\0',smb_size);
2395
2396 cli_set_message(cli->outbuf, 0, 0, True);
2397 SCVAL(cli->outbuf,smb_com,SMBtcon);
2398 cli_setup_packet(cli);
2399
2400 p = smb_buf(cli->outbuf);
2401 *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
2402 *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
2403 *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
2404
2405 cli_setup_bcc(cli, p);
2406
2407 cli_send_smb(cli);
2408 if (!cli_receive_smb(cli)) {
2409 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2410 }
2411
2412 if (cli_is_error(cli)) {
2413 return cli_nt_error(cli);
2414 }
2415
2416 *max_xmit = SVAL(cli->inbuf, smb_vwv0);
2417 *tid = SVAL(cli->inbuf, smb_vwv1);
2418
2419 return NT_STATUS_OK;
2420 }
2421
2422 /* Return a cli_state pointing at the IPC$ share for the given server */
2423
2424 struct cli_state *get_ipc_connect(char *server,
2425 struct sockaddr_storage *server_ss,
2426 const struct user_auth_info *user_info)
2427 {
2428 struct cli_state *cli;
2429 NTSTATUS nt_status;
2430 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2431
2432 if (user_info->use_kerberos) {
2433 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2434 }
2435
2436 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2437 user_info->username ? user_info->username : "",
2438 lp_workgroup(),
2439 user_info->password ? user_info->password : "",
2440 flags,
2441 Undefined, NULL);
2442
2443 if (NT_STATUS_IS_OK(nt_status)) {
2444 return cli;
2445 } else if (is_ipaddress(server)) {
2446 /* windows 9* needs a correct NMB name for connections */
2447 fstring remote_name;
2448
2449 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2450 cli = get_ipc_connect(remote_name, server_ss, user_info);
2451 if (cli)
2452 return cli;
2453 }
2454 }
2455 return NULL;
2456 }
2457
2458 /*
2459 * Given the IP address of a master browser on the network, return its
2460 * workgroup and connect to it.
2461 *
2462 * This function is provided to allow additional processing beyond what
2463 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2464 * browsers and obtain each master browsers' list of domains (in case the
2465 * first master browser is recently on the network and has not yet
2466 * synchronized with other master browsers and therefore does not yet have the
2467 * entire network browse list)
2468 */
2469
2470 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2471 struct ip_service *mb_ip,
2472 const struct user_auth_info *user_info,
2473 char **pp_workgroup_out)
2474 {
2475 char addr[INET6_ADDRSTRLEN];
2476 fstring name;
2477 struct cli_state *cli;
2478 struct sockaddr_storage server_ss;
2479
2480 *pp_workgroup_out = NULL;
2481
2482 print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2483 DEBUG(99, ("Looking up name of master browser %s\n",
2484 addr));
2485
2486 /*
2487 * Do a name status query to find out the name of the master browser.
2488 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2489 * master browser will not respond to a wildcard query (or, at least,
2490 * an NT4 server acting as the domain master browser will not).
2491 *
2492 * We might be able to use ONLY the query on MSBROWSE, but that's not
2493 * yet been tested with all Windows versions, so until it is, leave
2494 * the original wildcard query as the first choice and fall back to
2495 * MSBROWSE if the wildcard query fails.
2496 */
2497 if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2498 !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2499
2500 DEBUG(99, ("Could not retrieve name status for %s\n",
2501 addr));
2502 return NULL;
2503 }
2504
2505 if (!find_master_ip(name, &server_ss)) {
2506 DEBUG(99, ("Could not find master ip for %s\n", name));
2507 return NULL;
2508 }
2509
2510 *pp_workgroup_out = talloc_strdup(ctx, name);
2511
2512 DEBUG(4, ("found master browser %s, %s\n", name, addr));
2513
2514 print_sockaddr(addr, sizeof(addr), &server_ss);
2515 cli = get_ipc_connect(addr, &server_ss, user_info);
2516
2517 return cli;
2518 }
2519
2520 /*
2521 * Return the IP address and workgroup of a master browser on the network, and
2522 * connect to it.
2523 */
2524
2525 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2526 const struct user_auth_info *user_info,
2527 char **pp_workgroup_out)
2528 {
2529 struct ip_service *ip_list;
2530 struct cli_state *cli;
2531 int i, count;
2532
2533 *pp_workgroup_out = NULL;
2534
2535 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2536
2537 /* Go looking for workgroups by broadcasting on the local network */
2538
2539 if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2540 &count))) {
2541 DEBUG(99, ("No master browsers responded\n"));
2542 return False;
2543 }
2544
2545 for (i = 0; i < count; i++) {
2546 char addr[INET6_ADDRSTRLEN];
2547 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2548 DEBUG(99, ("Found master browser %s\n", addr));
2549
2550 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2551 user_info, pp_workgroup_out);
2552 if (cli)
2553 return(cli);
2554 }
2555
2556 return NULL;
2557 }
reg import