?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:libsmb: s/Undefined/SMB_SIGNING_DEFAULT/
[Samba/vl.git] / source3 / libsmb / cliconnect.c
blob049763f821f0c5c06c12a14420d38ebcb86e6126
1 /*
2 Unix SMB/CIFS implementation.
3 client connect/disconnect routines
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Andrew Bartlett 2001-2003
6 Copyright (C) Volker Lendecke 2011
7 Copyright (C) Jeremy Allison 2011
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "libsmb/libsmb.h"
25 #include "popt_common.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../libcli/auth/spnego.h"
28 #include "smb_krb5.h"
29 #include "../auth/ntlmssp/ntlmssp.h"
30 #include "libads/kerberos_proto.h"
31 #include "krb5_env.h"
32 #include "../lib/util/tevent_ntstatus.h"
33 #include "async_smb.h"
34 #include "libsmb/nmblib.h"
35 #include "librpc/ndr/libndr.h"
36
37 static const struct {
38 int prot;
39 const char name[24];
40 } prots[10] = {
41 {PROTOCOL_CORE, "PC NETWORK PROGRAM 1.0"},
42 {PROTOCOL_COREPLUS, "MICROSOFT NETWORKS 1.03"},
43 {PROTOCOL_LANMAN1, "MICROSOFT NETWORKS 3.0"},
44 {PROTOCOL_LANMAN1, "LANMAN1.0"},
45 {PROTOCOL_LANMAN2, "LM1.2X002"},
46 {PROTOCOL_LANMAN2, "DOS LANMAN2.1"},
47 {PROTOCOL_LANMAN2, "LANMAN2.1"},
48 {PROTOCOL_LANMAN2, "Samba"},
49 {PROTOCOL_NT1, "NT LANMAN 1.0"},
50 {PROTOCOL_NT1, "NT LM 0.12"},
51 };
52
53 #define STAR_SMBSERVER "*SMBSERVER"
54
55 /********************************************************
56 Utility function to ensure we always return at least
57 a valid char * pointer to an empty string for the
58 cli->server_os, cli->server_type and cli->server_domain
59 strings.
60 *******************************************************/
61
62 static NTSTATUS smb_bytes_talloc_string(TALLOC_CTX *mem_ctx,
63 char *inbuf,
64 char **dest,
65 uint8_t *src,
66 size_t srclen,
67 ssize_t *destlen)
68 {
69 *destlen = clistr_pull_talloc(mem_ctx,
70 inbuf,
71 SVAL(inbuf, smb_flg2),
72 dest,
73 (char *)src,
74 srclen,
75 STR_TERMINATE);
76 if (*destlen == -1) {
77 return NT_STATUS_NO_MEMORY;
78 }
79
80 if (*dest == NULL) {
81 *dest = talloc_strdup(mem_ctx, "");
82 if (*dest == NULL) {
83 return NT_STATUS_NO_MEMORY;
84 }
85 }
86 return NT_STATUS_OK;
87 }
88
89 /**
90 * Set the user session key for a connection
91 * @param cli The cli structure to add it too
92 * @param session_key The session key used. (A copy of this is taken for the cli struct)
93 *
94 */
95
96 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
97 {
98 cli->user_session_key = data_blob(session_key.data, session_key.length);
99 }
100
101 /****************************************************************************
102 Do an old lanman2 style session setup.
103 ****************************************************************************/
104
105 struct cli_session_setup_lanman2_state {
106 struct cli_state *cli;
107 uint16_t vwv[10];
108 const char *user;
109 };
110
111 static void cli_session_setup_lanman2_done(struct tevent_req *subreq);
112
113 static struct tevent_req *cli_session_setup_lanman2_send(
114 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
115 struct cli_state *cli, const char *user,
116 const char *pass, size_t passlen,
117 const char *workgroup)
118 {
119 struct tevent_req *req, *subreq;
120 struct cli_session_setup_lanman2_state *state;
121 DATA_BLOB lm_response = data_blob_null;
122 uint16_t *vwv;
123 uint8_t *bytes;
124 char *tmp;
125 uint16_t sec_mode = cli_state_security_mode(cli);
126
127 req = tevent_req_create(mem_ctx, &state,
128 struct cli_session_setup_lanman2_state);
129 if (req == NULL) {
130 return NULL;
131 }
132 state->cli = cli;
133 state->user = user;
134 vwv = state->vwv;
135
136 /*
137 * if in share level security then don't send a password now
138 */
139 if (!(sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
140 passlen = 0;
141 }
142
143 if (passlen > 0
144 && (sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
145 && passlen != 24) {
146 /*
147 * Encrypted mode needed, and non encrypted password
148 * supplied.
149 */
150 lm_response = data_blob(NULL, 24);
151 if (tevent_req_nomem(lm_response.data, req)) {
152 return tevent_req_post(req, ev);
153 }
154
155 if (!SMBencrypt(pass, cli_state_server_challenge(cli),
156 (uint8_t *)lm_response.data)) {
157 DEBUG(1, ("Password is > 14 chars in length, and is "
158 "therefore incompatible with Lanman "
159 "authentication\n"));
160 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
161 return tevent_req_post(req, ev);
162 }
163 } else if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
164 && passlen == 24) {
165 /*
166 * Encrypted mode needed, and encrypted password
167 * supplied.
168 */
169 lm_response = data_blob(pass, passlen);
170 if (tevent_req_nomem(lm_response.data, req)) {
171 return tevent_req_post(req, ev);
172 }
173 } else if (passlen > 0) {
174 uint8_t *buf;
175 size_t converted_size;
176 /*
177 * Plaintext mode needed, assume plaintext supplied.
178 */
179 buf = talloc_array(talloc_tos(), uint8_t, 0);
180 buf = smb_bytes_push_str(buf, cli_ucs2(cli), pass, passlen+1,
181 &converted_size);
182 if (tevent_req_nomem(buf, req)) {
183 return tevent_req_post(req, ev);
184 }
185 lm_response = data_blob(pass, passlen);
186 TALLOC_FREE(buf);
187 if (tevent_req_nomem(lm_response.data, req)) {
188 return tevent_req_post(req, ev);
189 }
190 }
191
192 SCVAL(vwv+0, 0, 0xff);
193 SCVAL(vwv+0, 1, 0);
194 SSVAL(vwv+1, 0, 0);
195 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
196 SSVAL(vwv+3, 0, 2);
197 SSVAL(vwv+4, 0, 1);
198 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
199 SSVAL(vwv+7, 0, lm_response.length);
200
201 bytes = talloc_array(state, uint8_t, lm_response.length);
202 if (tevent_req_nomem(bytes, req)) {
203 return tevent_req_post(req, ev);
204 }
205 if (lm_response.length != 0) {
206 memcpy(bytes, lm_response.data, lm_response.length);
207 }
208 data_blob_free(&lm_response);
209
210 tmp = talloc_strdup_upper(talloc_tos(), user);
211 if (tevent_req_nomem(tmp, req)) {
212 return tevent_req_post(req, ev);
213 }
214 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
215 NULL);
216 TALLOC_FREE(tmp);
217
218 tmp = talloc_strdup_upper(talloc_tos(), workgroup);
219 if (tevent_req_nomem(tmp, req)) {
220 return tevent_req_post(req, ev);
221 }
222 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
223 NULL);
224 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
225 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
226
227 if (tevent_req_nomem(bytes, req)) {
228 return tevent_req_post(req, ev);
229 }
230
231 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 10, vwv,
232 talloc_get_size(bytes), bytes);
233 if (tevent_req_nomem(subreq, req)) {
234 return tevent_req_post(req, ev);
235 }
236 tevent_req_set_callback(subreq, cli_session_setup_lanman2_done, req);
237 return req;
238 }
239
240 static void cli_session_setup_lanman2_done(struct tevent_req *subreq)
241 {
242 struct tevent_req *req = tevent_req_callback_data(
243 subreq, struct tevent_req);
244 struct cli_session_setup_lanman2_state *state = tevent_req_data(
245 req, struct cli_session_setup_lanman2_state);
246 struct cli_state *cli = state->cli;
247 uint32_t num_bytes;
248 uint8_t *in;
249 char *inbuf;
250 uint8_t *bytes;
251 uint8_t *p;
252 NTSTATUS status;
253 ssize_t ret;
254 uint8_t wct;
255 uint16_t *vwv;
256
257 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
258 &num_bytes, &bytes);
259 TALLOC_FREE(subreq);
260 if (!NT_STATUS_IS_OK(status)) {
261 tevent_req_nterror(req, status);
262 return;
263 }
264
265 inbuf = (char *)in;
266 p = bytes;
267
268 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
269 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
270
271 status = smb_bytes_talloc_string(cli,
272 inbuf,
273 &cli->server_os,
274 p,
275 bytes+num_bytes-p,
276 &ret);
277
278 if (!NT_STATUS_IS_OK(status)) {
279 tevent_req_nterror(req, status);
280 return;
281 }
282 p += ret;
283
284 status = smb_bytes_talloc_string(cli,
285 inbuf,
286 &cli->server_type,
287 p,
288 bytes+num_bytes-p,
289 &ret);
290
291 if (!NT_STATUS_IS_OK(status)) {
292 tevent_req_nterror(req, status);
293 return;
294 }
295 p += ret;
296
297 status = smb_bytes_talloc_string(cli,
298 inbuf,
299 &cli->server_domain,
300 p,
301 bytes+num_bytes-p,
302 &ret);
303
304 if (!NT_STATUS_IS_OK(status)) {
305 tevent_req_nterror(req, status);
306 return;
307 }
308 p += ret;
309
310 status = cli_set_username(cli, state->user);
311 if (tevent_req_nterror(req, status)) {
312 return;
313 }
314 tevent_req_done(req);
315 }
316
317 static NTSTATUS cli_session_setup_lanman2_recv(struct tevent_req *req)
318 {
319 return tevent_req_simple_recv_ntstatus(req);
320 }
321
322 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli, const char *user,
323 const char *pass, size_t passlen,
324 const char *workgroup)
325 {
326 TALLOC_CTX *frame = talloc_stackframe();
327 struct event_context *ev;
328 struct tevent_req *req;
329 NTSTATUS status = NT_STATUS_NO_MEMORY;
330
331 if (cli_has_async_calls(cli)) {
332 /*
333 * Can't use sync call while an async call is in flight
334 */
335 status = NT_STATUS_INVALID_PARAMETER;
336 goto fail;
337 }
338 ev = event_context_init(frame);
339 if (ev == NULL) {
340 goto fail;
341 }
342 req = cli_session_setup_lanman2_send(frame, ev, cli, user, pass, passlen,
343 workgroup);
344 if (req == NULL) {
345 goto fail;
346 }
347 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
348 goto fail;
349 }
350 status = cli_session_setup_lanman2_recv(req);
351 fail:
352 TALLOC_FREE(frame);
353 return status;
354 }
355
356 /****************************************************************************
357 Work out suitable capabilities to offer the server.
358 ****************************************************************************/
359
360 static uint32_t cli_session_setup_capabilities(struct cli_state *cli,
361 uint32_t sesssetup_capabilities)
362 {
363 uint32_t client_capabilities = cli_state_capabilities(cli);
364
365 /*
366 * We only send capabilities based on the mask for:
367 * - client only flags
368 * - flags used in both directions
369 *
370 * We do not echo the server only flags.
371 */
372 client_capabilities &= (SMB_CAP_BOTH_MASK | SMB_CAP_CLIENT_MASK);
373
374 /*
375 * Session Setup specific flags CAP_DYNAMIC_REAUTH
376 * and CAP_EXTENDED_SECURITY are passed by the caller.
377 * We need that in order to do guest logins even if
378 * CAP_EXTENDED_SECURITY is negotiated.
379 */
380 client_capabilities &= ~(CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
381 sesssetup_capabilities &= (CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
382 client_capabilities |= sesssetup_capabilities;
383
384 return client_capabilities;
385 }
386
387 /****************************************************************************
388 Do a NT1 guest session setup.
389 ****************************************************************************/
390
391 struct cli_session_setup_guest_state {
392 struct cli_state *cli;
393 uint16_t vwv[13];
394 struct iovec bytes;
395 };
396
397 static void cli_session_setup_guest_done(struct tevent_req *subreq);
398
399 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
400 struct event_context *ev,
401 struct cli_state *cli,
402 struct tevent_req **psmbreq)
403 {
404 struct tevent_req *req, *subreq;
405 struct cli_session_setup_guest_state *state;
406 uint16_t *vwv;
407 uint8_t *bytes;
408
409 req = tevent_req_create(mem_ctx, &state,
410 struct cli_session_setup_guest_state);
411 if (req == NULL) {
412 return NULL;
413 }
414 state->cli = cli;
415 vwv = state->vwv;
416
417 SCVAL(vwv+0, 0, 0xFF);
418 SCVAL(vwv+0, 1, 0);
419 SSVAL(vwv+1, 0, 0);
420 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
421 SSVAL(vwv+3, 0, 2);
422 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
423 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
424 SSVAL(vwv+7, 0, 0);
425 SSVAL(vwv+8, 0, 0);
426 SSVAL(vwv+9, 0, 0);
427 SSVAL(vwv+10, 0, 0);
428 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
429
430 bytes = talloc_array(state, uint8_t, 0);
431
432 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* username */
433 NULL);
434 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
435 NULL);
436 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
437 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
438
439 if (bytes == NULL) {
440 TALLOC_FREE(req);
441 return NULL;
442 }
443
444 state->bytes.iov_base = (void *)bytes;
445 state->bytes.iov_len = talloc_get_size(bytes);
446
447 subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
448 1, &state->bytes);
449 if (subreq == NULL) {
450 TALLOC_FREE(req);
451 return NULL;
452 }
453 tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
454 *psmbreq = subreq;
455 return req;
456 }
457
458 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
459 struct event_context *ev,
460 struct cli_state *cli)
461 {
462 struct tevent_req *req, *subreq;
463 NTSTATUS status;
464
465 req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
466 if (req == NULL) {
467 return NULL;
468 }
469
470 status = cli_smb_req_send(subreq);
471 if (NT_STATUS_IS_OK(status)) {
472 tevent_req_nterror(req, status);
473 return tevent_req_post(req, ev);
474 }
475 return req;
476 }
477
478 static void cli_session_setup_guest_done(struct tevent_req *subreq)
479 {
480 struct tevent_req *req = tevent_req_callback_data(
481 subreq, struct tevent_req);
482 struct cli_session_setup_guest_state *state = tevent_req_data(
483 req, struct cli_session_setup_guest_state);
484 struct cli_state *cli = state->cli;
485 uint32_t num_bytes;
486 uint8_t *in;
487 char *inbuf;
488 uint8_t *bytes;
489 uint8_t *p;
490 NTSTATUS status;
491 ssize_t ret;
492 uint8_t wct;
493 uint16_t *vwv;
494
495 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
496 &num_bytes, &bytes);
497 TALLOC_FREE(subreq);
498 if (!NT_STATUS_IS_OK(status)) {
499 tevent_req_nterror(req, status);
500 return;
501 }
502
503 inbuf = (char *)in;
504 p = bytes;
505
506 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
507 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
508
509 status = smb_bytes_talloc_string(cli,
510 inbuf,
511 &cli->server_os,
512 p,
513 bytes+num_bytes-p,
514 &ret);
515
516 if (!NT_STATUS_IS_OK(status)) {
517 tevent_req_nterror(req, status);
518 return;
519 }
520 p += ret;
521
522 status = smb_bytes_talloc_string(cli,
523 inbuf,
524 &cli->server_type,
525 p,
526 bytes+num_bytes-p,
527 &ret);
528
529 if (!NT_STATUS_IS_OK(status)) {
530 tevent_req_nterror(req, status);
531 return;
532 }
533 p += ret;
534
535 status = smb_bytes_talloc_string(cli,
536 inbuf,
537 &cli->server_domain,
538 p,
539 bytes+num_bytes-p,
540 &ret);
541
542 if (!NT_STATUS_IS_OK(status)) {
543 tevent_req_nterror(req, status);
544 return;
545 }
546 p += ret;
547
548 status = cli_set_username(cli, "");
549 if (!NT_STATUS_IS_OK(status)) {
550 tevent_req_nterror(req, status);
551 return;
552 }
553 tevent_req_done(req);
554 }
555
556 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
557 {
558 return tevent_req_simple_recv_ntstatus(req);
559 }
560
561 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
562 {
563 TALLOC_CTX *frame = talloc_stackframe();
564 struct event_context *ev;
565 struct tevent_req *req;
566 NTSTATUS status = NT_STATUS_OK;
567
568 if (cli_has_async_calls(cli)) {
569 /*
570 * Can't use sync call while an async call is in flight
571 */
572 status = NT_STATUS_INVALID_PARAMETER;
573 goto fail;
574 }
575
576 ev = event_context_init(frame);
577 if (ev == NULL) {
578 status = NT_STATUS_NO_MEMORY;
579 goto fail;
580 }
581
582 req = cli_session_setup_guest_send(frame, ev, cli);
583 if (req == NULL) {
584 status = NT_STATUS_NO_MEMORY;
585 goto fail;
586 }
587
588 if (!tevent_req_poll(req, ev)) {
589 status = map_nt_error_from_unix(errno);
590 goto fail;
591 }
592
593 status = cli_session_setup_guest_recv(req);
594 fail:
595 TALLOC_FREE(frame);
596 return status;
597 }
598
599 /****************************************************************************
600 Do a NT1 plaintext session setup.
601 ****************************************************************************/
602
603 struct cli_session_setup_plain_state {
604 struct cli_state *cli;
605 uint16_t vwv[13];
606 const char *user;
607 };
608
609 static void cli_session_setup_plain_done(struct tevent_req *subreq);
610
611 static struct tevent_req *cli_session_setup_plain_send(
612 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
613 struct cli_state *cli,
614 const char *user, const char *pass, const char *workgroup)
615 {
616 struct tevent_req *req, *subreq;
617 struct cli_session_setup_plain_state *state;
618 uint16_t *vwv;
619 uint8_t *bytes;
620 size_t passlen;
621 char *version;
622
623 req = tevent_req_create(mem_ctx, &state,
624 struct cli_session_setup_plain_state);
625 if (req == NULL) {
626 return NULL;
627 }
628 state->cli = cli;
629 state->user = user;
630 vwv = state->vwv;
631
632 SCVAL(vwv+0, 0, 0xff);
633 SCVAL(vwv+0, 1, 0);
634 SSVAL(vwv+1, 0, 0);
635 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
636 SSVAL(vwv+3, 0, 2);
637 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
638 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
639 SSVAL(vwv+7, 0, 0);
640 SSVAL(vwv+8, 0, 0);
641 SSVAL(vwv+9, 0, 0);
642 SSVAL(vwv+10, 0, 0);
643 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
644
645 bytes = talloc_array(state, uint8_t, 0);
646 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), pass, strlen(pass)+1,
647 &passlen);
648 if (tevent_req_nomem(bytes, req)) {
649 return tevent_req_post(req, ev);
650 }
651 SSVAL(vwv + (cli_ucs2(cli) ? 8 : 7), 0, passlen);
652
653 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
654 user, strlen(user)+1, NULL);
655 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
656 workgroup, strlen(workgroup)+1, NULL);
657 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
658 "Unix", 5, NULL);
659
660 version = talloc_asprintf(talloc_tos(), "Samba %s",
661 samba_version_string());
662 if (tevent_req_nomem(version, req)){
663 return tevent_req_post(req, ev);
664 }
665 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
666 version, strlen(version)+1, NULL);
667 TALLOC_FREE(version);
668
669 if (tevent_req_nomem(bytes, req)) {
670 return tevent_req_post(req, ev);
671 }
672
673 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
674 talloc_get_size(bytes), bytes);
675 if (tevent_req_nomem(subreq, req)) {
676 return tevent_req_post(req, ev);
677 }
678 tevent_req_set_callback(subreq, cli_session_setup_plain_done, req);
679 return req;
680 }
681
682 static void cli_session_setup_plain_done(struct tevent_req *subreq)
683 {
684 struct tevent_req *req = tevent_req_callback_data(
685 subreq, struct tevent_req);
686 struct cli_session_setup_plain_state *state = tevent_req_data(
687 req, struct cli_session_setup_plain_state);
688 struct cli_state *cli = state->cli;
689 uint32_t num_bytes;
690 uint8_t *in;
691 char *inbuf;
692 uint8_t *bytes;
693 uint8_t *p;
694 NTSTATUS status;
695 ssize_t ret;
696 uint8_t wct;
697 uint16_t *vwv;
698
699 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
700 &num_bytes, &bytes);
701 TALLOC_FREE(subreq);
702 if (tevent_req_nterror(req, status)) {
703 return;
704 }
705
706 inbuf = (char *)in;
707 p = bytes;
708
709 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
710 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
711
712 status = smb_bytes_talloc_string(cli,
713 inbuf,
714 &cli->server_os,
715 p,
716 bytes+num_bytes-p,
717 &ret);
718
719 if (!NT_STATUS_IS_OK(status)) {
720 tevent_req_nterror(req, status);
721 return;
722 }
723 p += ret;
724
725 status = smb_bytes_talloc_string(cli,
726 inbuf,
727 &cli->server_type,
728 p,
729 bytes+num_bytes-p,
730 &ret);
731
732 if (!NT_STATUS_IS_OK(status)) {
733 tevent_req_nterror(req, status);
734 return;
735 }
736 p += ret;
737
738 status = smb_bytes_talloc_string(cli,
739 inbuf,
740 &cli->server_domain,
741 p,
742 bytes+num_bytes-p,
743 &ret);
744
745 if (!NT_STATUS_IS_OK(status)) {
746 tevent_req_nterror(req, status);
747 return;
748 }
749 p += ret;
750
751 status = cli_set_username(cli, state->user);
752 if (tevent_req_nterror(req, status)) {
753 return;
754 }
755
756 tevent_req_done(req);
757 }
758
759 static NTSTATUS cli_session_setup_plain_recv(struct tevent_req *req)
760 {
761 return tevent_req_simple_recv_ntstatus(req);
762 }
763
764 static NTSTATUS cli_session_setup_plain(struct cli_state *cli,
765 const char *user, const char *pass,
766 const char *workgroup)
767 {
768 TALLOC_CTX *frame = talloc_stackframe();
769 struct event_context *ev;
770 struct tevent_req *req;
771 NTSTATUS status = NT_STATUS_NO_MEMORY;
772
773 if (cli_has_async_calls(cli)) {
774 /*
775 * Can't use sync call while an async call is in flight
776 */
777 status = NT_STATUS_INVALID_PARAMETER;
778 goto fail;
779 }
780 ev = event_context_init(frame);
781 if (ev == NULL) {
782 goto fail;
783 }
784 req = cli_session_setup_plain_send(frame, ev, cli, user, pass,
785 workgroup);
786 if (req == NULL) {
787 goto fail;
788 }
789 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
790 goto fail;
791 }
792 status = cli_session_setup_plain_recv(req);
793 fail:
794 TALLOC_FREE(frame);
795 return status;
796 }
797
798 /****************************************************************************
799 do a NT1 NTLM/LM encrypted session setup - for when extended security
800 is not negotiated.
801 @param cli client state to create do session setup on
802 @param user username
803 @param pass *either* cleartext password (passlen !=24) or LM response.
804 @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
805 @param workgroup The user's domain.
806 ****************************************************************************/
807
808 struct cli_session_setup_nt1_state {
809 struct cli_state *cli;
810 uint16_t vwv[13];
811 DATA_BLOB response;
812 DATA_BLOB session_key;
813 const char *user;
814 };
815
816 static void cli_session_setup_nt1_done(struct tevent_req *subreq);
817
818 static struct tevent_req *cli_session_setup_nt1_send(
819 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
820 struct cli_state *cli, const char *user,
821 const char *pass, size_t passlen,
822 const char *ntpass, size_t ntpasslen,
823 const char *workgroup)
824 {
825 struct tevent_req *req, *subreq;
826 struct cli_session_setup_nt1_state *state;
827 DATA_BLOB lm_response = data_blob_null;
828 DATA_BLOB nt_response = data_blob_null;
829 DATA_BLOB session_key = data_blob_null;
830 uint16_t *vwv;
831 uint8_t *bytes;
832 char *workgroup_upper;
833
834 req = tevent_req_create(mem_ctx, &state,
835 struct cli_session_setup_nt1_state);
836 if (req == NULL) {
837 return NULL;
838 }
839 state->cli = cli;
840 state->user = user;
841 vwv = state->vwv;
842
843 if (passlen == 0) {
844 /* do nothing - guest login */
845 } else if (passlen != 24) {
846 if (lp_client_ntlmv2_auth()) {
847 DATA_BLOB server_chal;
848 DATA_BLOB names_blob;
849
850 server_chal =
851 data_blob_const(cli_state_server_challenge(cli),
852 8);
853
854 /*
855 * note that the 'workgroup' here is a best
856 * guess - we don't know the server's domain
857 * at this point. Windows clients also don't
858 * use hostname...
859 */
860 names_blob = NTLMv2_generate_names_blob(
861 NULL, NULL, workgroup);
862
863 if (tevent_req_nomem(names_blob.data, req)) {
864 return tevent_req_post(req, ev);
865 }
866
867 if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass,
868 &server_chal, &names_blob,
869 &lm_response, &nt_response,
870 NULL, &session_key)) {
871 data_blob_free(&names_blob);
872 tevent_req_nterror(
873 req, NT_STATUS_ACCESS_DENIED);
874 return tevent_req_post(req, ev);
875 }
876 data_blob_free(&names_blob);
877
878 } else {
879 uchar nt_hash[16];
880 E_md4hash(pass, nt_hash);
881
882 #ifdef LANMAN_ONLY
883 nt_response = data_blob_null;
884 #else
885 nt_response = data_blob(NULL, 24);
886 if (tevent_req_nomem(nt_response.data, req)) {
887 return tevent_req_post(req, ev);
888 }
889
890 SMBNTencrypt(pass, cli_state_server_challenge(cli),
891 nt_response.data);
892 #endif
893 /* non encrypted password supplied. Ignore ntpass. */
894 if (lp_client_lanman_auth()) {
895
896 lm_response = data_blob(NULL, 24);
897 if (tevent_req_nomem(lm_response.data, req)) {
898 return tevent_req_post(req, ev);
899 }
900
901 if (!SMBencrypt(pass,
902 cli_state_server_challenge(cli),
903 lm_response.data)) {
904 /*
905 * Oops, the LM response is
906 * invalid, just put the NT
907 * response there instead
908 */
909 data_blob_free(&lm_response);
910 lm_response = data_blob(
911 nt_response.data,
912 nt_response.length);
913 }
914 } else {
915 /*
916 * LM disabled, place NT# in LM field
917 * instead
918 */
919 lm_response = data_blob(
920 nt_response.data, nt_response.length);
921 }
922
923 if (tevent_req_nomem(lm_response.data, req)) {
924 return tevent_req_post(req, ev);
925 }
926
927 session_key = data_blob(NULL, 16);
928 if (tevent_req_nomem(session_key.data, req)) {
929 return tevent_req_post(req, ev);
930 }
931 #ifdef LANMAN_ONLY
932 E_deshash(pass, session_key.data);
933 memset(&session_key.data[8], '\0', 8);
934 #else
935 SMBsesskeygen_ntv1(nt_hash, session_key.data);
936 #endif
937 }
938 } else {
939 /* pre-encrypted password supplied. Only used for
940 security=server, can't do
941 signing because we don't have original key */
942
943 lm_response = data_blob(pass, passlen);
944 if (tevent_req_nomem(lm_response.data, req)) {
945 return tevent_req_post(req, ev);
946 }
947
948 nt_response = data_blob(ntpass, ntpasslen);
949 if (tevent_req_nomem(nt_response.data, req)) {
950 return tevent_req_post(req, ev);
951 }
952 }
953
954 #ifdef LANMAN_ONLY
955 state->response = data_blob_talloc(
956 state, lm_response.data, lm_response.length);
957 #else
958 state->response = data_blob_talloc(
959 state, nt_response.data, nt_response.length);
960 #endif
961 if (tevent_req_nomem(state->response.data, req)) {
962 return tevent_req_post(req, ev);
963 }
964
965 if (session_key.data) {
966 state->session_key = data_blob_talloc(
967 state, session_key.data, session_key.length);
968 if (tevent_req_nomem(state->session_key.data, req)) {
969 return tevent_req_post(req, ev);
970 }
971 }
972 data_blob_free(&session_key);
973
974 SCVAL(vwv+0, 0, 0xff);
975 SCVAL(vwv+0, 1, 0);
976 SSVAL(vwv+1, 0, 0);
977 SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
978 SSVAL(vwv+3, 0, 2);
979 SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
980 SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
981 SSVAL(vwv+7, 0, lm_response.length);
982 SSVAL(vwv+8, 0, nt_response.length);
983 SSVAL(vwv+9, 0, 0);
984 SSVAL(vwv+10, 0, 0);
985 SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
986
987 bytes = talloc_array(state, uint8_t,
988 lm_response.length + nt_response.length);
989 if (tevent_req_nomem(bytes, req)) {
990 return tevent_req_post(req, ev);
991 }
992 if (lm_response.length != 0) {
993 memcpy(bytes, lm_response.data, lm_response.length);
994 }
995 if (nt_response.length != 0) {
996 memcpy(bytes + lm_response.length,
997 nt_response.data, nt_response.length);
998 }
999 data_blob_free(&lm_response);
1000 data_blob_free(&nt_response);
1001
1002 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
1003 user, strlen(user)+1, NULL);
1004
1005 /*
1006 * Upper case here might help some NTLMv2 implementations
1007 */
1008 workgroup_upper = talloc_strdup_upper(talloc_tos(), workgroup);
1009 if (tevent_req_nomem(workgroup_upper, req)) {
1010 return tevent_req_post(req, ev);
1011 }
1012 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
1013 workgroup_upper, strlen(workgroup_upper)+1,
1014 NULL);
1015 TALLOC_FREE(workgroup_upper);
1016
1017 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
1018 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
1019 if (tevent_req_nomem(bytes, req)) {
1020 return tevent_req_post(req, ev);
1021 }
1022
1023 subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
1024 talloc_get_size(bytes), bytes);
1025 if (tevent_req_nomem(subreq, req)) {
1026 return tevent_req_post(req, ev);
1027 }
1028 tevent_req_set_callback(subreq, cli_session_setup_nt1_done, req);
1029 return req;
1030 }
1031
1032 static void cli_session_setup_nt1_done(struct tevent_req *subreq)
1033 {
1034 struct tevent_req *req = tevent_req_callback_data(
1035 subreq, struct tevent_req);
1036 struct cli_session_setup_nt1_state *state = tevent_req_data(
1037 req, struct cli_session_setup_nt1_state);
1038 struct cli_state *cli = state->cli;
1039 uint32_t num_bytes;
1040 uint8_t *in;
1041 char *inbuf;
1042 uint8_t *bytes;
1043 uint8_t *p;
1044 NTSTATUS status;
1045 ssize_t ret;
1046 uint8_t wct;
1047 uint16_t *vwv;
1048
1049 status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
1050 &num_bytes, &bytes);
1051 TALLOC_FREE(subreq);
1052 if (!NT_STATUS_IS_OK(status)) {
1053 tevent_req_nterror(req, status);
1054 return;
1055 }
1056
1057 inbuf = (char *)in;
1058 p = bytes;
1059
1060 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
1061 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1062
1063 status = smb_bytes_talloc_string(cli,
1064 inbuf,
1065 &cli->server_os,
1066 p,
1067 bytes+num_bytes-p,
1068 &ret);
1069 if (!NT_STATUS_IS_OK(status)) {
1070 tevent_req_nterror(req, status);
1071 return;
1072 }
1073 p += ret;
1074
1075 status = smb_bytes_talloc_string(cli,
1076 inbuf,
1077 &cli->server_type,
1078 p,
1079 bytes+num_bytes-p,
1080 &ret);
1081 if (!NT_STATUS_IS_OK(status)) {
1082 tevent_req_nterror(req, status);
1083 return;
1084 }
1085 p += ret;
1086
1087 status = smb_bytes_talloc_string(cli,
1088 inbuf,
1089 &cli->server_domain,
1090 p,
1091 bytes+num_bytes-p,
1092 &ret);
1093 if (!NT_STATUS_IS_OK(status)) {
1094 tevent_req_nterror(req, status);
1095 return;
1096 }
1097 p += ret;
1098
1099 status = cli_set_username(cli, state->user);
1100 if (tevent_req_nterror(req, status)) {
1101 return;
1102 }
1103 if (cli_simple_set_signing(cli, state->session_key, state->response)
1104 && !cli_check_sign_mac(cli, (char *)in, 1)) {
1105 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1106 return;
1107 }
1108 if (state->session_key.data) {
1109 /* Have plaintext orginal */
1110 cli_set_session_key(cli, state->session_key);
1111 }
1112 tevent_req_done(req);
1113 }
1114
1115 static NTSTATUS cli_session_setup_nt1_recv(struct tevent_req *req)
1116 {
1117 return tevent_req_simple_recv_ntstatus(req);
1118 }
1119
1120 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
1121 const char *pass, size_t passlen,
1122 const char *ntpass, size_t ntpasslen,
1123 const char *workgroup)
1124 {
1125 TALLOC_CTX *frame = talloc_stackframe();
1126 struct event_context *ev;
1127 struct tevent_req *req;
1128 NTSTATUS status = NT_STATUS_NO_MEMORY;
1129
1130 if (cli_has_async_calls(cli)) {
1131 /*
1132 * Can't use sync call while an async call is in flight
1133 */
1134 status = NT_STATUS_INVALID_PARAMETER;
1135 goto fail;
1136 }
1137 ev = event_context_init(frame);
1138 if (ev == NULL) {
1139 goto fail;
1140 }
1141 req = cli_session_setup_nt1_send(frame, ev, cli, user, pass, passlen,
1142 ntpass, ntpasslen, workgroup);
1143 if (req == NULL) {
1144 goto fail;
1145 }
1146 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1147 goto fail;
1148 }
1149 status = cli_session_setup_nt1_recv(req);
1150 fail:
1151 TALLOC_FREE(frame);
1152 return status;
1153 }
1154
1155 /* The following is calculated from :
1156 * (smb_size-4) = 35
1157 * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
1158 * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
1159 * end of packet.
1160 */
1161
1162 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
1163
1164 struct cli_sesssetup_blob_state {
1165 struct tevent_context *ev;
1166 struct cli_state *cli;
1167 DATA_BLOB blob;
1168 uint16_t max_blob_size;
1169 uint16_t vwv[12];
1170 uint8_t *buf;
1171
1172 NTSTATUS status;
1173 char *inbuf;
1174 DATA_BLOB ret_blob;
1175 };
1176
1177 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1178 struct tevent_req **psubreq);
1179 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
1180
1181 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
1182 struct tevent_context *ev,
1183 struct cli_state *cli,
1184 DATA_BLOB blob)
1185 {
1186 struct tevent_req *req, *subreq;
1187 struct cli_sesssetup_blob_state *state;
1188 uint32_t usable_space;
1189
1190 req = tevent_req_create(mem_ctx, &state,
1191 struct cli_sesssetup_blob_state);
1192 if (req == NULL) {
1193 return NULL;
1194 }
1195 state->ev = ev;
1196 state->blob = blob;
1197 state->cli = cli;
1198
1199 usable_space = cli_state_available_size(cli,
1200 BASE_SESSSETUP_BLOB_PACKET_SIZE);
1201
1202 if (usable_space == 0) {
1203 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
1204 "(not possible to send %u bytes)\n",
1205 BASE_SESSSETUP_BLOB_PACKET_SIZE + 1));
1206 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1207 return tevent_req_post(req, ev);
1208 }
1209 state->max_blob_size = MIN(usable_space, 0xFFFF);
1210
1211 if (!cli_sesssetup_blob_next(state, &subreq)) {
1212 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1213 return tevent_req_post(req, ev);
1214 }
1215 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1216 return req;
1217 }
1218
1219 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1220 struct tevent_req **psubreq)
1221 {
1222 struct tevent_req *subreq;
1223 uint16_t thistime;
1224
1225 SCVAL(state->vwv+0, 0, 0xFF);
1226 SCVAL(state->vwv+0, 1, 0);
1227 SSVAL(state->vwv+1, 0, 0);
1228 SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
1229 SSVAL(state->vwv+3, 0, 2);
1230 SSVAL(state->vwv+4, 0, 1);
1231 SIVAL(state->vwv+5, 0, 0);
1232
1233 thistime = MIN(state->blob.length, state->max_blob_size);
1234 SSVAL(state->vwv+7, 0, thistime);
1235
1236 SSVAL(state->vwv+8, 0, 0);
1237 SSVAL(state->vwv+9, 0, 0);
1238 SIVAL(state->vwv+10, 0,
1239 cli_session_setup_capabilities(state->cli, CAP_EXTENDED_SECURITY));
1240
1241 state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
1242 thistime);
1243 if (state->buf == NULL) {
1244 return false;
1245 }
1246 state->blob.data += thistime;
1247 state->blob.length -= thistime;
1248
1249 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
1250 "Unix", 5, NULL);
1251 state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
1252 "Samba", 6, NULL);
1253 if (state->buf == NULL) {
1254 return false;
1255 }
1256 subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
1257 12, state->vwv,
1258 talloc_get_size(state->buf), state->buf);
1259 if (subreq == NULL) {
1260 return false;
1261 }
1262 *psubreq = subreq;
1263 return true;
1264 }
1265
1266 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
1267 {
1268 struct tevent_req *req = tevent_req_callback_data(
1269 subreq, struct tevent_req);
1270 struct cli_sesssetup_blob_state *state = tevent_req_data(
1271 req, struct cli_sesssetup_blob_state);
1272 struct cli_state *cli = state->cli;
1273 uint8_t wct;
1274 uint16_t *vwv;
1275 uint32_t num_bytes;
1276 uint8_t *bytes;
1277 NTSTATUS status;
1278 uint8_t *p;
1279 uint16_t blob_length;
1280 uint8_t *inbuf;
1281 ssize_t ret;
1282
1283 status = cli_smb_recv(subreq, state, &inbuf, 4, &wct, &vwv,
1284 &num_bytes, &bytes);
1285 TALLOC_FREE(subreq);
1286 if (!NT_STATUS_IS_OK(status)
1287 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1288 tevent_req_nterror(req, status);
1289 return;
1290 }
1291
1292 state->status = status;
1293 TALLOC_FREE(state->buf);
1294
1295 state->inbuf = (char *)inbuf;
1296 cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
1297 cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1298
1299 blob_length = SVAL(vwv+3, 0);
1300 if (blob_length > num_bytes) {
1301 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1302 return;
1303 }
1304 state->ret_blob = data_blob_const(bytes, blob_length);
1305
1306 p = bytes + blob_length;
1307
1308 status = smb_bytes_talloc_string(cli,
1309 (char *)inbuf,
1310 &cli->server_os,
1311 p,
1312 bytes+num_bytes-p,
1313 &ret);
1314
1315 if (!NT_STATUS_IS_OK(status)) {
1316 tevent_req_nterror(req, status);
1317 return;
1318 }
1319 p += ret;
1320
1321 status = smb_bytes_talloc_string(cli,
1322 (char *)inbuf,
1323 &cli->server_type,
1324 p,
1325 bytes+num_bytes-p,
1326 &ret);
1327
1328 if (!NT_STATUS_IS_OK(status)) {
1329 tevent_req_nterror(req, status);
1330 return;
1331 }
1332 p += ret;
1333
1334 status = smb_bytes_talloc_string(cli,
1335 (char *)inbuf,
1336 &cli->server_domain,
1337 p,
1338 bytes+num_bytes-p,
1339 &ret);
1340
1341 if (!NT_STATUS_IS_OK(status)) {
1342 tevent_req_nterror(req, status);
1343 return;
1344 }
1345 p += ret;
1346
1347 if (state->blob.length != 0) {
1348 /*
1349 * More to send
1350 */
1351 if (!cli_sesssetup_blob_next(state, &subreq)) {
1352 tevent_req_oom(req);
1353 return;
1354 }
1355 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1356 return;
1357 }
1358 tevent_req_done(req);
1359 }
1360
1361 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
1362 TALLOC_CTX *mem_ctx,
1363 DATA_BLOB *pblob,
1364 char **pinbuf)
1365 {
1366 struct cli_sesssetup_blob_state *state = tevent_req_data(
1367 req, struct cli_sesssetup_blob_state);
1368 NTSTATUS status;
1369 char *inbuf;
1370
1371 if (tevent_req_is_nterror(req, &status)) {
1372 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1373 return status;
1374 }
1375
1376 inbuf = talloc_move(mem_ctx, &state->inbuf);
1377 if (pblob != NULL) {
1378 *pblob = state->ret_blob;
1379 }
1380 if (pinbuf != NULL) {
1381 *pinbuf = inbuf;
1382 }
1383 /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
1384 return state->status;
1385 }
1386
1387 #ifdef HAVE_KRB5
1388
1389 /****************************************************************************
1390 Use in-memory credentials cache
1391 ****************************************************************************/
1392
1393 static void use_in_memory_ccache(void) {
1394 setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
1395 }
1396
1397 /****************************************************************************
1398 Do a spnego/kerberos encrypted session setup.
1399 ****************************************************************************/
1400
1401 struct cli_session_setup_kerberos_state {
1402 struct cli_state *cli;
1403 DATA_BLOB negTokenTarg;
1404 DATA_BLOB session_key_krb5;
1405 ADS_STATUS ads_status;
1406 };
1407
1408 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
1409
1410 static struct tevent_req *cli_session_setup_kerberos_send(
1411 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1412 const char *principal)
1413 {
1414 struct tevent_req *req, *subreq;
1415 struct cli_session_setup_kerberos_state *state;
1416 int rc;
1417
1418 DEBUG(2,("Doing kerberos session setup\n"));
1419
1420 req = tevent_req_create(mem_ctx, &state,
1421 struct cli_session_setup_kerberos_state);
1422 if (req == NULL) {
1423 return NULL;
1424 }
1425 state->cli = cli;
1426 state->ads_status = ADS_SUCCESS;
1427
1428 /*
1429 * Ok, this is cheating: spnego_gen_krb5_negTokenInit can block if
1430 * we have to acquire a ticket. To be fixed later :-)
1431 */
1432 rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
1433 &state->session_key_krb5, 0, NULL);
1434 if (rc) {
1435 DEBUG(1, ("cli_session_setup_kerberos: "
1436 "spnego_gen_krb5_negTokenInit failed: %s\n",
1437 error_message(rc)));
1438 state->ads_status = ADS_ERROR_KRB5(rc);
1439 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1440 return tevent_req_post(req, ev);
1441 }
1442
1443 #if 0
1444 file_save("negTokenTarg.dat", state->negTokenTarg.data,
1445 state->negTokenTarg.length);
1446 #endif
1447
1448 subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
1449 if (tevent_req_nomem(subreq, req)) {
1450 return tevent_req_post(req, ev);
1451 }
1452 tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
1453 return req;
1454 }
1455
1456 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
1457 {
1458 struct tevent_req *req = tevent_req_callback_data(
1459 subreq, struct tevent_req);
1460 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1461 req, struct cli_session_setup_kerberos_state);
1462 char *inbuf = NULL;
1463 NTSTATUS status;
1464
1465 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), NULL, &inbuf);
1466 TALLOC_FREE(subreq);
1467 if (!NT_STATUS_IS_OK(status)) {
1468 tevent_req_nterror(req, status);
1469 return;
1470 }
1471
1472 cli_set_session_key(state->cli, state->session_key_krb5);
1473
1474 if (cli_simple_set_signing(state->cli, state->session_key_krb5,
1475 data_blob_null)
1476 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1477 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1478 return;
1479 }
1480
1481 tevent_req_done(req);
1482 }
1483
1484 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
1485 {
1486 struct cli_session_setup_kerberos_state *state = tevent_req_data(
1487 req, struct cli_session_setup_kerberos_state);
1488 NTSTATUS status;
1489
1490 if (tevent_req_is_nterror(req, &status)) {
1491 return ADS_ERROR_NT(status);
1492 }
1493 return state->ads_status;
1494 }
1495
1496 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
1497 const char *principal)
1498 {
1499 struct tevent_context *ev;
1500 struct tevent_req *req;
1501 ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1502
1503 if (cli_has_async_calls(cli)) {
1504 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1505 }
1506 ev = tevent_context_init(talloc_tos());
1507 if (ev == NULL) {
1508 goto fail;
1509 }
1510 req = cli_session_setup_kerberos_send(ev, ev, cli, principal);
1511 if (req == NULL) {
1512 goto fail;
1513 }
1514 if (!tevent_req_poll(req, ev)) {
1515 status = ADS_ERROR_SYSTEM(errno);
1516 goto fail;
1517 }
1518 status = cli_session_setup_kerberos_recv(req);
1519 fail:
1520 TALLOC_FREE(ev);
1521 return status;
1522 }
1523 #endif /* HAVE_KRB5 */
1524
1525 /****************************************************************************
1526 Do a spnego/NTLMSSP encrypted session setup.
1527 ****************************************************************************/
1528
1529 struct cli_session_setup_ntlmssp_state {
1530 struct tevent_context *ev;
1531 struct cli_state *cli;
1532 struct ntlmssp_state *ntlmssp_state;
1533 int turn;
1534 DATA_BLOB blob_out;
1535 };
1536
1537 static int cli_session_setup_ntlmssp_state_destructor(
1538 struct cli_session_setup_ntlmssp_state *state)
1539 {
1540 if (state->ntlmssp_state != NULL) {
1541 TALLOC_FREE(state->ntlmssp_state);
1542 }
1543 return 0;
1544 }
1545
1546 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
1547
1548 static struct tevent_req *cli_session_setup_ntlmssp_send(
1549 TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1550 const char *user, const char *pass, const char *domain)
1551 {
1552 struct tevent_req *req, *subreq;
1553 struct cli_session_setup_ntlmssp_state *state;
1554 NTSTATUS status;
1555 DATA_BLOB blob_out;
1556 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
1557
1558 req = tevent_req_create(mem_ctx, &state,
1559 struct cli_session_setup_ntlmssp_state);
1560 if (req == NULL) {
1561 return NULL;
1562 }
1563 state->ev = ev;
1564 state->cli = cli;
1565 state->turn = 1;
1566
1567 state->ntlmssp_state = NULL;
1568 talloc_set_destructor(
1569 state, cli_session_setup_ntlmssp_state_destructor);
1570
1571 status = ntlmssp_client_start(state,
1572 lp_netbios_name(),
1573 lp_workgroup(),
1574 lp_client_ntlmv2_auth(),
1575 &state->ntlmssp_state);
1576 if (!NT_STATUS_IS_OK(status)) {
1577 goto fail;
1578 }
1579 ntlmssp_want_feature(state->ntlmssp_state,
1580 NTLMSSP_FEATURE_SESSION_KEY);
1581 if (cli->use_ccache) {
1582 ntlmssp_want_feature(state->ntlmssp_state,
1583 NTLMSSP_FEATURE_CCACHE);
1584 }
1585 status = ntlmssp_set_username(state->ntlmssp_state, user);
1586 if (!NT_STATUS_IS_OK(status)) {
1587 goto fail;
1588 }
1589 status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1590 if (!NT_STATUS_IS_OK(status)) {
1591 goto fail;
1592 }
1593 status = ntlmssp_set_password(state->ntlmssp_state, pass);
1594 if (!NT_STATUS_IS_OK(status)) {
1595 goto fail;
1596 }
1597 status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1598 &blob_out);
1599 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1600 goto fail;
1601 }
1602
1603 state->blob_out = spnego_gen_negTokenInit(state, OIDs_ntlm, &blob_out, NULL);
1604 data_blob_free(&blob_out);
1605
1606 subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1607 if (tevent_req_nomem(subreq, req)) {
1608 return tevent_req_post(req, ev);
1609 }
1610 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1611 return req;
1612 fail:
1613 tevent_req_nterror(req, status);
1614 return tevent_req_post(req, ev);
1615 }
1616
1617 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1618 {
1619 struct tevent_req *req = tevent_req_callback_data(
1620 subreq, struct tevent_req);
1621 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1622 req, struct cli_session_setup_ntlmssp_state);
1623 DATA_BLOB blob_in, msg_in, blob_out;
1624 char *inbuf = NULL;
1625 bool parse_ret;
1626 NTSTATUS status;
1627
1628 status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1629 &inbuf);
1630 TALLOC_FREE(subreq);
1631 data_blob_free(&state->blob_out);
1632
1633 if (NT_STATUS_IS_OK(status)) {
1634 if (state->cli->server_domain[0] == '\0') {
1635 TALLOC_FREE(state->cli->server_domain);
1636 state->cli->server_domain = talloc_strdup(state->cli,
1637 state->ntlmssp_state->server.netbios_domain);
1638 if (state->cli->server_domain == NULL) {
1639 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1640 return;
1641 }
1642 }
1643 cli_set_session_key(
1644 state->cli, state->ntlmssp_state->session_key);
1645
1646 if (cli_simple_set_signing(
1647 state->cli, state->ntlmssp_state->session_key,
1648 data_blob_null)
1649 && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1650 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1651 return;
1652 }
1653 TALLOC_FREE(state->ntlmssp_state);
1654 tevent_req_done(req);
1655 return;
1656 }
1657 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1658 tevent_req_nterror(req, status);
1659 return;
1660 }
1661
1662 if (blob_in.length == 0) {
1663 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1664 return;
1665 }
1666
1667 if ((state->turn == 1)
1668 && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1669 DATA_BLOB tmp_blob = data_blob_null;
1670 /* the server might give us back two challenges */
1671 parse_ret = spnego_parse_challenge(state, blob_in, &msg_in,
1672 &tmp_blob);
1673 data_blob_free(&tmp_blob);
1674 } else {
1675 parse_ret = spnego_parse_auth_response(state, blob_in, status,
1676 OID_NTLMSSP, &msg_in);
1677 }
1678 state->turn += 1;
1679
1680 if (!parse_ret) {
1681 DEBUG(3,("Failed to parse auth response\n"));
1682 if (NT_STATUS_IS_OK(status)
1683 || NT_STATUS_EQUAL(status,
1684 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1685 tevent_req_nterror(
1686 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1687 return;
1688 }
1689 }
1690
1691 status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1692
1693 if (!NT_STATUS_IS_OK(status)
1694 && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1695 TALLOC_FREE(state->ntlmssp_state);
1696 tevent_req_nterror(req, status);
1697 return;
1698 }
1699
1700 state->blob_out = spnego_gen_auth(state, blob_out);
1701 if (tevent_req_nomem(state->blob_out.data, req)) {
1702 return;
1703 }
1704
1705 subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1706 state->blob_out);
1707 if (tevent_req_nomem(subreq, req)) {
1708 return;
1709 }
1710 tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1711 }
1712
1713 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1714 {
1715 struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1716 req, struct cli_session_setup_ntlmssp_state);
1717 NTSTATUS status;
1718
1719 if (tevent_req_is_nterror(req, &status)) {
1720 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1721 return status;
1722 }
1723 return NT_STATUS_OK;
1724 }
1725
1726 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1727 const char *user,
1728 const char *pass,
1729 const char *domain)
1730 {
1731 struct tevent_context *ev;
1732 struct tevent_req *req;
1733 NTSTATUS status = NT_STATUS_NO_MEMORY;
1734
1735 if (cli_has_async_calls(cli)) {
1736 return NT_STATUS_INVALID_PARAMETER;
1737 }
1738 ev = tevent_context_init(talloc_tos());
1739 if (ev == NULL) {
1740 goto fail;
1741 }
1742 req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1743 if (req == NULL) {
1744 goto fail;
1745 }
1746 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1747 goto fail;
1748 }
1749 status = cli_session_setup_ntlmssp_recv(req);
1750 fail:
1751 TALLOC_FREE(ev);
1752 return status;
1753 }
1754
1755 /****************************************************************************
1756 Do a spnego encrypted session setup.
1757
1758 user_domain: The shortname of the domain the user/machine is a member of.
1759 dest_realm: The realm we're connecting to, if NULL we use our default realm.
1760 ****************************************************************************/
1761
1762 static ADS_STATUS cli_session_setup_spnego(struct cli_state *cli,
1763 const char *user,
1764 const char *pass,
1765 const char *user_domain,
1766 const char * dest_realm)
1767 {
1768 char *principal = NULL;
1769 char *OIDs[ASN1_MAX_OIDS];
1770 int i;
1771 const DATA_BLOB *server_blob;
1772 DATA_BLOB blob = data_blob_null;
1773 const char *p = NULL;
1774 char *account = NULL;
1775 NTSTATUS status;
1776
1777 server_blob = cli_state_server_gss_blob(cli);
1778 if (server_blob) {
1779 blob = data_blob(server_blob->data, server_blob->length);
1780 }
1781
1782 DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)blob.length));
1783
1784 /* the server might not even do spnego */
1785 if (blob.length == 0) {
1786 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1787 goto ntlmssp;
1788 }
1789
1790 #if 0
1791 file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1792 #endif
1793
1794 /* The server sent us the first part of the SPNEGO exchange in the
1795 * negprot reply. It is WRONG to depend on the principal sent in the
1796 * negprot reply, but right now we do it. If we don't receive one,
1797 * we try to best guess, then fall back to NTLM. */
1798 if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &principal, NULL) ||
1799 OIDs[0] == NULL) {
1800 data_blob_free(&blob);
1801 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1802 }
1803 data_blob_free(&blob);
1804
1805 /* make sure the server understands kerberos */
1806 for (i=0;OIDs[i];i++) {
1807 if (i == 0)
1808 DEBUG(3,("got OID=%s\n", OIDs[i]));
1809 else
1810 DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1811 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1812 strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1813 cli->got_kerberos_mechanism = True;
1814 }
1815 talloc_free(OIDs[i]);
1816 }
1817
1818 DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1819
1820 status = cli_set_username(cli, user);
1821 if (!NT_STATUS_IS_OK(status)) {
1822 TALLOC_FREE(principal);
1823 return ADS_ERROR_NT(status);
1824 }
1825
1826 #ifdef HAVE_KRB5
1827 /* If password is set we reauthenticate to kerberos server
1828 * and do not store results */
1829
1830 if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1831 ADS_STATUS rc;
1832 const char *remote_name = cli_state_remote_name(cli);
1833
1834 if (pass && *pass) {
1835 int ret;
1836
1837 use_in_memory_ccache();
1838 ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1839
1840 if (ret){
1841 TALLOC_FREE(principal);
1842 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1843 if (cli->fallback_after_kerberos)
1844 goto ntlmssp;
1845 return ADS_ERROR_KRB5(ret);
1846 }
1847 }
1848
1849 /* We may not be allowed to use the server-supplied SPNEGO principal, or it may not have been supplied to us
1850 */
1851 if (!lp_client_use_spnego_principal() || strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1852 TALLOC_FREE(principal);
1853 }
1854
1855 if (principal == NULL &&
1856 !is_ipaddress(remote_name) &&
1857 !strequal(STAR_SMBSERVER,
1858 remote_name)) {
1859 char *realm = NULL;
1860 char *host = NULL;
1861 DEBUG(3,("cli_session_setup_spnego: using target "
1862 "hostname not SPNEGO principal\n"));
1863
1864 host = strchr_m(remote_name, '.');
1865 if (dest_realm) {
1866 realm = SMB_STRDUP(dest_realm);
1867 if (!realm) {
1868 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1869 }
1870 strupper_m(realm);
1871 } else {
1872 if (host) {
1873 /* DNS name. */
1874 realm = kerberos_get_realm_from_hostname(remote_name);
1875 } else {
1876 /* NetBIOS name - use our realm. */
1877 realm = kerberos_get_default_realm_from_ccache();
1878 }
1879 }
1880
1881 if (realm == NULL || *realm == '\0') {
1882 realm = SMB_STRDUP(lp_realm());
1883 if (!realm) {
1884 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1885 }
1886 strupper_m(realm);
1887 DEBUG(3,("cli_session_setup_spnego: cannot "
1888 "get realm from dest_realm %s, "
1889 "desthost %s. Using default "
1890 "smb.conf realm %s\n",
1891 dest_realm ? dest_realm : "<null>",
1892 remote_name,
1893 realm));
1894 }
1895
1896 principal = talloc_asprintf(talloc_tos(),
1897 "cifs/%s@%s",
1898 remote_name,
1899 realm);
1900 if (!principal) {
1901 SAFE_FREE(realm);
1902 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1903 }
1904 DEBUG(3,("cli_session_setup_spnego: guessed "
1905 "server principal=%s\n",
1906 principal ? principal : "<null>"));
1907
1908 SAFE_FREE(realm);
1909 }
1910
1911 if (principal) {
1912 rc = cli_session_setup_kerberos(cli, principal);
1913 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1914 TALLOC_FREE(principal);
1915 return rc;
1916 }
1917 }
1918 }
1919 #endif
1920
1921 TALLOC_FREE(principal);
1922
1923 ntlmssp:
1924
1925 account = talloc_strdup(talloc_tos(), user);
1926 if (!account) {
1927 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1928 }
1929
1930 /* when falling back to ntlmssp while authenticating with a machine
1931 * account strip off the realm - gd */
1932
1933 if ((p = strchr_m(user, '@')) != NULL) {
1934 account[PTR_DIFF(p,user)] = '\0';
1935 }
1936
1937 return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1938 }
1939
1940 /****************************************************************************
1941 Send a session setup. The username and workgroup is in UNIX character
1942 format and must be converted to DOS codepage format before sending. If the
1943 password is in plaintext, the same should be done.
1944 ****************************************************************************/
1945
1946 NTSTATUS cli_session_setup(struct cli_state *cli,
1947 const char *user,
1948 const char *pass, int passlen,
1949 const char *ntpass, int ntpasslen,
1950 const char *workgroup)
1951 {
1952 char *p;
1953 char *user2;
1954 uint16_t sec_mode = cli_state_security_mode(cli);
1955
1956 if (user) {
1957 user2 = talloc_strdup(talloc_tos(), user);
1958 } else {
1959 user2 = talloc_strdup(talloc_tos(), "");
1960 }
1961 if (user2 == NULL) {
1962 return NT_STATUS_NO_MEMORY;
1963 }
1964
1965 if (!workgroup) {
1966 workgroup = "";
1967 }
1968
1969 /* allow for workgroups as part of the username */
1970 if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1971 (p=strchr_m(user2,*lp_winbind_separator()))) {
1972 *p = 0;
1973 user = p+1;
1974 strupper_m(user2);
1975 workgroup = user2;
1976 }
1977
1978 if (cli_state_protocol(cli) < PROTOCOL_LANMAN1) {
1979 /*
1980 * Ensure cli->server_domain,
1981 * cli->server_os and cli->server_type
1982 * are valid pointers.
1983 */
1984 cli->server_domain = talloc_strdup(cli, "");
1985 cli->server_os = talloc_strdup(cli, "");
1986 cli->server_type = talloc_strdup(cli, "");
1987 if (cli->server_domain == NULL ||
1988 cli->server_os == NULL ||
1989 cli->server_type == NULL) {
1990 return NT_STATUS_NO_MEMORY;
1991 }
1992 return NT_STATUS_OK;
1993 }
1994
1995 /* now work out what sort of session setup we are going to
1996 do. I have split this into separate functions to make the
1997 flow a bit easier to understand (tridge) */
1998
1999 /* if its an older server then we have to use the older request format */
2000
2001 if (cli_state_protocol(cli) < PROTOCOL_NT1) {
2002 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
2003 DEBUG(1, ("Server requested LM password but 'client lanman auth = no'"
2004 " or 'client ntlmv2 auth = yes'\n"));
2005 return NT_STATUS_ACCESS_DENIED;
2006 }
2007
2008 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
2009 !lp_client_plaintext_auth() && (*pass)) {
2010 DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
2011 " or 'client ntlmv2 auth = yes'\n"));
2012 return NT_STATUS_ACCESS_DENIED;
2013 }
2014
2015 return cli_session_setup_lanman2(cli, user, pass, passlen,
2016 workgroup);
2017 }
2018
2019 /* if no user is supplied then we have to do an anonymous connection.
2020 passwords are ignored */
2021
2022 if (!user || !*user)
2023 return cli_session_setup_guest(cli);
2024
2025 /* if the server is share level then send a plaintext null
2026 password at this point. The password is sent in the tree
2027 connect */
2028
2029 if ((sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
2030 return cli_session_setup_plain(cli, user, "", workgroup);
2031
2032 /* if the server doesn't support encryption then we have to use
2033 plaintext. The second password is ignored */
2034
2035 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
2036 if (!lp_client_plaintext_auth() && (*pass)) {
2037 DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
2038 " or 'client ntlmv2 auth = yes'\n"));
2039 return NT_STATUS_ACCESS_DENIED;
2040 }
2041 return cli_session_setup_plain(cli, user, pass, workgroup);
2042 }
2043
2044 /* if the server supports extended security then use SPNEGO */
2045
2046 if (cli_state_capabilities(cli) & CAP_EXTENDED_SECURITY) {
2047 const char *remote_realm = cli_state_remote_realm(cli);
2048 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2049 workgroup,
2050 remote_realm);
2051 if (!ADS_ERR_OK(status)) {
2052 DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
2053 return ads_ntstatus(status);
2054 }
2055 } else {
2056 NTSTATUS status;
2057
2058 /* otherwise do a NT1 style session setup */
2059 status = cli_session_setup_nt1(cli, user, pass, passlen,
2060 ntpass, ntpasslen, workgroup);
2061 if (!NT_STATUS_IS_OK(status)) {
2062 DEBUG(3,("cli_session_setup: NT1 session setup "
2063 "failed: %s\n", nt_errstr(status)));
2064 return status;
2065 }
2066 }
2067
2068 return NT_STATUS_OK;
2069 }
2070
2071 /****************************************************************************
2072 Send a uloggoff.
2073 *****************************************************************************/
2074
2075 struct cli_ulogoff_state {
2076 struct cli_state *cli;
2077 uint16_t vwv[3];
2078 };
2079
2080 static void cli_ulogoff_done(struct tevent_req *subreq);
2081
2082 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
2083 struct tevent_context *ev,
2084 struct cli_state *cli)
2085 {
2086 struct tevent_req *req, *subreq;
2087 struct cli_ulogoff_state *state;
2088
2089 req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
2090 if (req == NULL) {
2091 return NULL;
2092 }
2093 state->cli = cli;
2094
2095 SCVAL(state->vwv+0, 0, 0xFF);
2096 SCVAL(state->vwv+1, 0, 0);
2097 SSVAL(state->vwv+2, 0, 0);
2098
2099 subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
2100 0, NULL);
2101 if (tevent_req_nomem(subreq, req)) {
2102 return tevent_req_post(req, ev);
2103 }
2104 tevent_req_set_callback(subreq, cli_ulogoff_done, req);
2105 return req;
2106 }
2107
2108 static void cli_ulogoff_done(struct tevent_req *subreq)
2109 {
2110 struct tevent_req *req = tevent_req_callback_data(
2111 subreq, struct tevent_req);
2112 struct cli_ulogoff_state *state = tevent_req_data(
2113 req, struct cli_ulogoff_state);
2114 NTSTATUS status;
2115
2116 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2117 if (!NT_STATUS_IS_OK(status)) {
2118 tevent_req_nterror(req, status);
2119 return;
2120 }
2121 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
2122 tevent_req_done(req);
2123 }
2124
2125 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
2126 {
2127 return tevent_req_simple_recv_ntstatus(req);
2128 }
2129
2130 NTSTATUS cli_ulogoff(struct cli_state *cli)
2131 {
2132 struct tevent_context *ev;
2133 struct tevent_req *req;
2134 NTSTATUS status = NT_STATUS_NO_MEMORY;
2135
2136 if (cli_has_async_calls(cli)) {
2137 return NT_STATUS_INVALID_PARAMETER;
2138 }
2139 ev = tevent_context_init(talloc_tos());
2140 if (ev == NULL) {
2141 goto fail;
2142 }
2143 req = cli_ulogoff_send(ev, ev, cli);
2144 if (req == NULL) {
2145 goto fail;
2146 }
2147 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2148 goto fail;
2149 }
2150 status = cli_ulogoff_recv(req);
2151 fail:
2152 TALLOC_FREE(ev);
2153 return status;
2154 }
2155
2156 /****************************************************************************
2157 Send a tconX.
2158 ****************************************************************************/
2159
2160 struct cli_tcon_andx_state {
2161 struct cli_state *cli;
2162 uint16_t vwv[4];
2163 struct iovec bytes;
2164 };
2165
2166 static void cli_tcon_andx_done(struct tevent_req *subreq);
2167
2168 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
2169 struct event_context *ev,
2170 struct cli_state *cli,
2171 const char *share, const char *dev,
2172 const char *pass, int passlen,
2173 struct tevent_req **psmbreq)
2174 {
2175 struct tevent_req *req, *subreq;
2176 struct cli_tcon_andx_state *state;
2177 uint8_t p24[24];
2178 uint16_t *vwv;
2179 char *tmp = NULL;
2180 uint8_t *bytes;
2181 uint16_t sec_mode = cli_state_security_mode(cli);
2182
2183 *psmbreq = NULL;
2184
2185 req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
2186 if (req == NULL) {
2187 return NULL;
2188 }
2189 state->cli = cli;
2190 vwv = state->vwv;
2191
2192 cli->share = talloc_strdup(cli, share);
2193 if (!cli->share) {
2194 return NULL;
2195 }
2196
2197 /* in user level security don't send a password now */
2198 if (sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
2199 passlen = 1;
2200 pass = "";
2201 } else if (pass == NULL) {
2202 DEBUG(1, ("Server not using user level security and no "
2203 "password supplied.\n"));
2204 goto access_denied;
2205 }
2206
2207 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
2208 *pass && passlen != 24) {
2209 if (!lp_client_lanman_auth()) {
2210 DEBUG(1, ("Server requested LANMAN password "
2211 "(share-level security) but "
2212 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2213 goto access_denied;
2214 }
2215
2216 /*
2217 * Non-encrypted passwords - convert to DOS codepage before
2218 * encryption.
2219 */
2220 SMBencrypt(pass, cli_state_server_challenge(cli), p24);
2221 passlen = 24;
2222 pass = (const char *)p24;
2223 } else {
2224 if((sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
2225 |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
2226 == 0) {
2227 uint8_t *tmp_pass;
2228
2229 if (!lp_client_plaintext_auth() && (*pass)) {
2230 DEBUG(1, ("Server requested plaintext "
2231 "password but "
2232 "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2233 goto access_denied;
2234 }
2235
2236 /*
2237 * Non-encrypted passwords - convert to DOS codepage
2238 * before using.
2239 */
2240 tmp_pass = talloc_array(talloc_tos(), uint8, 0);
2241 if (tevent_req_nomem(tmp_pass, req)) {
2242 return tevent_req_post(req, ev);
2243 }
2244 tmp_pass = trans2_bytes_push_str(tmp_pass,
2245 false, /* always DOS */
2246 pass,
2247 passlen,
2248 NULL);
2249 if (tevent_req_nomem(tmp_pass, req)) {
2250 return tevent_req_post(req, ev);
2251 }
2252 pass = (const char *)tmp_pass;
2253 passlen = talloc_get_size(tmp_pass);
2254 }
2255 }
2256
2257 SCVAL(vwv+0, 0, 0xFF);
2258 SCVAL(vwv+0, 1, 0);
2259 SSVAL(vwv+1, 0, 0);
2260 SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
2261 SSVAL(vwv+3, 0, passlen);
2262
2263 if (passlen && pass) {
2264 bytes = (uint8_t *)talloc_memdup(state, pass, passlen);
2265 } else {
2266 bytes = talloc_array(state, uint8_t, 0);
2267 }
2268
2269 /*
2270 * Add the sharename
2271 */
2272 tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
2273 cli_state_remote_name(cli), share);
2274 if (tmp == NULL) {
2275 TALLOC_FREE(req);
2276 return NULL;
2277 }
2278 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
2279 NULL);
2280 TALLOC_FREE(tmp);
2281
2282 /*
2283 * Add the devicetype
2284 */
2285 tmp = talloc_strdup_upper(talloc_tos(), dev);
2286 if (tmp == NULL) {
2287 TALLOC_FREE(req);
2288 return NULL;
2289 }
2290 bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
2291 TALLOC_FREE(tmp);
2292
2293 if (bytes == NULL) {
2294 TALLOC_FREE(req);
2295 return NULL;
2296 }
2297
2298 state->bytes.iov_base = (void *)bytes;
2299 state->bytes.iov_len = talloc_get_size(bytes);
2300
2301 subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
2302 1, &state->bytes);
2303 if (subreq == NULL) {
2304 TALLOC_FREE(req);
2305 return NULL;
2306 }
2307 tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
2308 *psmbreq = subreq;
2309 return req;
2310
2311 access_denied:
2312 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2313 return tevent_req_post(req, ev);
2314 }
2315
2316 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
2317 struct event_context *ev,
2318 struct cli_state *cli,
2319 const char *share, const char *dev,
2320 const char *pass, int passlen)
2321 {
2322 struct tevent_req *req, *subreq;
2323 NTSTATUS status;
2324
2325 req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
2326 &subreq);
2327 if (req == NULL) {
2328 return NULL;
2329 }
2330 if (subreq == NULL) {
2331 return req;
2332 }
2333 status = cli_smb_req_send(subreq);
2334 if (!NT_STATUS_IS_OK(status)) {
2335 tevent_req_nterror(req, status);
2336 return tevent_req_post(req, ev);
2337 }
2338 return req;
2339 }
2340
2341 static void cli_tcon_andx_done(struct tevent_req *subreq)
2342 {
2343 struct tevent_req *req = tevent_req_callback_data(
2344 subreq, struct tevent_req);
2345 struct cli_tcon_andx_state *state = tevent_req_data(
2346 req, struct cli_tcon_andx_state);
2347 struct cli_state *cli = state->cli;
2348 uint8_t *in;
2349 char *inbuf;
2350 uint8_t wct;
2351 uint16_t *vwv;
2352 uint32_t num_bytes;
2353 uint8_t *bytes;
2354 NTSTATUS status;
2355
2356 status = cli_smb_recv(subreq, state, &in, 0, &wct, &vwv,
2357 &num_bytes, &bytes);
2358 TALLOC_FREE(subreq);
2359 if (!NT_STATUS_IS_OK(status)) {
2360 tevent_req_nterror(req, status);
2361 return;
2362 }
2363
2364 inbuf = (char *)in;
2365
2366 if (num_bytes) {
2367 if (clistr_pull_talloc(cli,
2368 inbuf,
2369 SVAL(inbuf, smb_flg2),
2370 &cli->dev,
2371 bytes,
2372 num_bytes,
2373 STR_TERMINATE|STR_ASCII) == -1) {
2374 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2375 return;
2376 }
2377 } else {
2378 cli->dev = talloc_strdup(cli, "");
2379 if (cli->dev == NULL) {
2380 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2381 return;
2382 }
2383 }
2384
2385 if ((cli_state_protocol(cli) >= PROTOCOL_NT1) && (num_bytes == 3)) {
2386 /* almost certainly win95 - enable bug fixes */
2387 cli->win95 = True;
2388 }
2389
2390 /*
2391 * Make sure that we have the optional support 16-bit field. WCT > 2.
2392 * Avoids issues when connecting to Win9x boxes sharing files
2393 */
2394
2395 cli->dfsroot = false;
2396
2397 if ((wct > 2) && (cli_state_protocol(cli) >= PROTOCOL_LANMAN2)) {
2398 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
2399 }
2400
2401 cli->smb1.tid = SVAL(inbuf,smb_tid);
2402 tevent_req_done(req);
2403 }
2404
2405 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
2406 {
2407 return tevent_req_simple_recv_ntstatus(req);
2408 }
2409
2410 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
2411 const char *dev, const char *pass, int passlen)
2412 {
2413 TALLOC_CTX *frame = talloc_stackframe();
2414 struct event_context *ev;
2415 struct tevent_req *req;
2416 NTSTATUS status = NT_STATUS_OK;
2417
2418 if (cli_has_async_calls(cli)) {
2419 /*
2420 * Can't use sync call while an async call is in flight
2421 */
2422 status = NT_STATUS_INVALID_PARAMETER;
2423 goto fail;
2424 }
2425
2426 ev = event_context_init(frame);
2427 if (ev == NULL) {
2428 status = NT_STATUS_NO_MEMORY;
2429 goto fail;
2430 }
2431
2432 req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
2433 if (req == NULL) {
2434 status = NT_STATUS_NO_MEMORY;
2435 goto fail;
2436 }
2437
2438 if (!tevent_req_poll(req, ev)) {
2439 status = map_nt_error_from_unix(errno);
2440 goto fail;
2441 }
2442
2443 status = cli_tcon_andx_recv(req);
2444 fail:
2445 TALLOC_FREE(frame);
2446 return status;
2447 }
2448
2449 /****************************************************************************
2450 Send a tree disconnect.
2451 ****************************************************************************/
2452
2453 struct cli_tdis_state {
2454 struct cli_state *cli;
2455 };
2456
2457 static void cli_tdis_done(struct tevent_req *subreq);
2458
2459 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
2460 struct tevent_context *ev,
2461 struct cli_state *cli)
2462 {
2463 struct tevent_req *req, *subreq;
2464 struct cli_tdis_state *state;
2465
2466 req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
2467 if (req == NULL) {
2468 return NULL;
2469 }
2470 state->cli = cli;
2471
2472 subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
2473 if (tevent_req_nomem(subreq, req)) {
2474 return tevent_req_post(req, ev);
2475 }
2476 tevent_req_set_callback(subreq, cli_tdis_done, req);
2477 return req;
2478 }
2479
2480 static void cli_tdis_done(struct tevent_req *subreq)
2481 {
2482 struct tevent_req *req = tevent_req_callback_data(
2483 subreq, struct tevent_req);
2484 struct cli_tdis_state *state = tevent_req_data(
2485 req, struct cli_tdis_state);
2486 NTSTATUS status;
2487
2488 status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2489 TALLOC_FREE(subreq);
2490 if (!NT_STATUS_IS_OK(status)) {
2491 tevent_req_nterror(req, status);
2492 return;
2493 }
2494 state->cli->smb1.tid = UINT16_MAX;
2495 tevent_req_done(req);
2496 }
2497
2498 NTSTATUS cli_tdis_recv(struct tevent_req *req)
2499 {
2500 return tevent_req_simple_recv_ntstatus(req);
2501 }
2502
2503 NTSTATUS cli_tdis(struct cli_state *cli)
2504 {
2505 struct tevent_context *ev;
2506 struct tevent_req *req;
2507 NTSTATUS status = NT_STATUS_NO_MEMORY;
2508
2509 if (cli_has_async_calls(cli)) {
2510 return NT_STATUS_INVALID_PARAMETER;
2511 }
2512 ev = tevent_context_init(talloc_tos());
2513 if (ev == NULL) {
2514 goto fail;
2515 }
2516 req = cli_tdis_send(ev, ev, cli);
2517 if (req == NULL) {
2518 goto fail;
2519 }
2520 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2521 goto fail;
2522 }
2523 status = cli_tdis_recv(req);
2524 fail:
2525 TALLOC_FREE(ev);
2526 return status;
2527 }
2528
2529 /****************************************************************************
2530 Send a negprot command.
2531 ****************************************************************************/
2532
2533 struct cli_negprot_state {
2534 struct cli_state *cli;
2535 enum protocol_types max_protocol;
2536 };
2537
2538 static void cli_negprot_done(struct tevent_req *subreq);
2539
2540 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
2541 struct event_context *ev,
2542 struct cli_state *cli,
2543 enum protocol_types max_protocol)
2544 {
2545 struct tevent_req *req, *subreq;
2546 struct cli_negprot_state *state;
2547 uint8_t *bytes = NULL;
2548 int numprots;
2549 enum protocol_types tmp_protocol;
2550
2551 req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
2552 if (req == NULL) {
2553 return NULL;
2554 }
2555 state->cli = cli;
2556 state->max_protocol = max_protocol;
2557
2558 /* setup the protocol strings */
2559 for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
2560 uint8_t c = 2;
2561 if (prots[numprots].prot > state->max_protocol) {
2562 break;
2563 }
2564 bytes = (uint8_t *)talloc_append_blob(
2565 state, bytes, data_blob_const(&c, sizeof(c)));
2566 if (tevent_req_nomem(bytes, req)) {
2567 return tevent_req_post(req, ev);
2568 }
2569 bytes = smb_bytes_push_str(bytes, false,
2570 prots[numprots].name,
2571 strlen(prots[numprots].name)+1,
2572 NULL);
2573 if (tevent_req_nomem(bytes, req)) {
2574 return tevent_req_post(req, ev);
2575 }
2576 }
2577
2578 tmp_protocol = cli->conn.protocol;
2579 cli->conn.protocol = state->max_protocol;
2580 subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
2581 talloc_get_size(bytes), bytes);
2582 cli->conn.protocol = tmp_protocol;
2583 if (tevent_req_nomem(subreq, req)) {
2584 return tevent_req_post(req, ev);
2585 }
2586 tevent_req_set_callback(subreq, cli_negprot_done, req);
2587 return req;
2588 }
2589
2590 static void cli_negprot_done(struct tevent_req *subreq)
2591 {
2592 struct tevent_req *req = tevent_req_callback_data(
2593 subreq, struct tevent_req);
2594 struct cli_negprot_state *state = tevent_req_data(
2595 req, struct cli_negprot_state);
2596 struct cli_state *cli = state->cli;
2597 uint8_t flags;
2598 uint8_t wct;
2599 uint16_t *vwv;
2600 uint32_t num_bytes;
2601 uint8_t *bytes;
2602 NTSTATUS status;
2603 uint16_t protnum;
2604 uint8_t *inbuf;
2605 uint32_t client_capabilities = cli->conn.smb1.client.capabilities;
2606 uint32_t both_capabilities;
2607 uint32_t server_capabilities = 0;
2608 uint32_t capabilities;
2609 uint32_t client_max_xmit = cli->conn.smb1.client.max_xmit;
2610 uint32_t server_max_xmit = 0;
2611 uint32_t max_xmit;
2612 uint32_t server_max_mux = 0;
2613 uint16_t server_security_mode = 0;
2614 uint32_t server_session_key = 0;
2615 bool server_readbraw = false;
2616 bool server_writebraw = false;
2617 bool server_lockread = false;
2618 bool server_writeunlock = false;
2619 struct GUID server_guid = GUID_zero();
2620 DATA_BLOB server_gss_blob = data_blob_null;
2621 uint8_t server_challenge[8];
2622 char *server_workgroup = NULL;
2623 int server_time_zone = 0;
2624 time_t server_system_time = 0;
2625 enum protocol_types protocol;
2626
2627 ZERO_STRUCT(server_challenge);
2628
2629 status = cli_smb_recv(subreq, state, &inbuf, 1, &wct, &vwv,
2630 &num_bytes, &bytes);
2631 TALLOC_FREE(subreq);
2632 if (!NT_STATUS_IS_OK(status)) {
2633 tevent_req_nterror(req, status);
2634 return;
2635 }
2636
2637 flags = CVAL(inbuf, smb_flg);
2638
2639 protnum = SVAL(vwv, 0);
2640
2641 if ((protnum >= ARRAY_SIZE(prots))
2642 || (prots[protnum].prot > state->max_protocol)) {
2643 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2644 return;
2645 }
2646
2647 protocol = prots[protnum].prot;
2648
2649 if ((protocol < PROTOCOL_NT1) &&
2650 client_is_signing_mandatory(cli)) {
2651 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
2652 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2653 return;
2654 }
2655
2656 if (flags & FLAG_SUPPORT_LOCKREAD) {
2657 server_lockread = true;
2658 server_writeunlock = true;
2659 }
2660
2661 if (protocol >= PROTOCOL_NT1) {
2662 struct timespec ts;
2663 const char *client_signing = NULL;
2664 bool server_mandatory;
2665 bool server_allowed;
2666 const char *server_signing = NULL;
2667 bool ok;
2668 uint16_t key_len;
2669
2670 if (wct != 0x11) {
2671 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2672 return;
2673 }
2674
2675 /* NT protocol */
2676 server_security_mode = CVAL(vwv + 1, 0);
2677 server_max_mux = SVAL(vwv + 1, 1);
2678 server_max_xmit = IVAL(vwv + 3, 1);
2679 server_session_key = IVAL(vwv + 7, 1);
2680 server_time_zone = SVALS(vwv + 15, 1);
2681 server_time_zone *= 60;
2682 /* this time arrives in real GMT */
2683 ts = interpret_long_date(((char *)(vwv+11))+1);
2684 server_system_time = ts.tv_sec;
2685 server_capabilities = IVAL(vwv + 9, 1);
2686
2687 key_len = CVAL(vwv + 16, 1);
2688
2689 if (server_capabilities & CAP_RAW_MODE) {
2690 server_readbraw = true;
2691 server_writebraw = true;
2692 }
2693 if (server_capabilities & CAP_LOCK_AND_READ) {
2694 server_lockread = true;
2695 }
2696
2697 if (server_capabilities & CAP_EXTENDED_SECURITY) {
2698 DATA_BLOB blob1, blob2;
2699
2700 if (num_bytes < 16) {
2701 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2702 return;
2703 }
2704
2705 blob1 = data_blob_const(bytes, 16);
2706 GUID_from_data_blob(&blob1, &server_guid);
2707
2708 blob1 = data_blob_const(bytes+16, num_bytes-16);
2709 blob2 = data_blob_dup_talloc(state, blob1);
2710 if (blob1.length > 0 &&
2711 tevent_req_nomem(blob2.data, req)) {
2712 return;
2713 }
2714 server_gss_blob = blob2;
2715 } else {
2716 DATA_BLOB blob1;
2717 ssize_t ret;
2718
2719 if (num_bytes < key_len) {
2720 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2721 return;
2722 }
2723
2724 if (key_len != 0 && key_len != 8) {
2725 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2726 return;
2727 }
2728
2729 if (key_len == 8) {
2730 memcpy(server_challenge, bytes, 8);
2731 }
2732
2733 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
2734 if (blob1.length > 0) {
2735 ret = pull_string_talloc(state,
2736 (char *)inbuf,
2737 SVAL(inbuf, smb_flg2),
2738 &server_workgroup,
2739 blob1.data, blob1.length,
2740 STR_TERMINATE);
2741 if (ret == -1) {
2742 tevent_req_oom(req);
2743 return;
2744 }
2745 }
2746 }
2747
2748 client_signing = "disabled";
2749 if (client_is_signing_allowed(cli)) {
2750 client_signing = "allowed";
2751 }
2752 if (client_is_signing_mandatory(cli)) {
2753 client_signing = "required";
2754 }
2755
2756 server_signing = "not supported";
2757
2758 server_allowed = false;
2759 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
2760 server_signing = "supported";
2761 server_allowed = true;
2762 }
2763
2764 server_mandatory = false;
2765 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
2766 server_signing = "required";
2767 server_mandatory = true;
2768 }
2769
2770 ok = cli_set_signing_negotiated(cli,
2771 server_allowed,
2772 server_mandatory);
2773 if (!ok) {
2774 DEBUG(1,("cli_negprot: SMB signing is required, "
2775 "but client[%s] and server[%s] mismatch\n",
2776 client_signing, server_signing));
2777 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2778 return;
2779 }
2780
2781 } else if (protocol >= PROTOCOL_LANMAN1) {
2782 if (wct != 0x0D) {
2783 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2784 return;
2785 }
2786
2787 server_security_mode = SVAL(vwv + 1, 0);
2788 server_max_xmit = SVAL(vwv + 2, 0);
2789 server_max_mux = SVAL(vwv + 3, 0);
2790 server_session_key = IVAL(vwv + 6, 0);
2791 server_time_zone = SVALS(vwv + 10, 0);
2792 server_time_zone *= 60;
2793 /* this time is converted to GMT by make_unix_date */
2794 server_system_time = make_unix_date(
2795 (char *)(vwv + 8), server_time_zone);
2796 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
2797 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
2798
2799 if (num_bytes != 0 && num_bytes != 8) {
2800 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2801 return;
2802 }
2803
2804 if (num_bytes == 8) {
2805 memcpy(server_challenge, bytes, 8);
2806 }
2807 } else {
2808 /* the old core protocol */
2809 server_time_zone = get_time_zone(time(NULL));
2810 server_system_time = 0;
2811 server_max_xmit = 1024;
2812 server_max_mux = 1;
2813 server_security_mode = 0;
2814 }
2815
2816 if (server_max_xmit < 1024) {
2817 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2818 return;
2819 }
2820
2821 if (server_max_mux < 1) {
2822 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2823 return;
2824 }
2825
2826 /*
2827 * Now calculate the negotiated capabilities
2828 * based on the mask for:
2829 * - client only flags
2830 * - flags used in both directions
2831 * - server only flags
2832 */
2833 both_capabilities = client_capabilities & server_capabilities;
2834 capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
2835 capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
2836 capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
2837
2838 max_xmit = MIN(client_max_xmit, server_max_xmit);
2839
2840 if (server_workgroup) {
2841 cli->server_domain = talloc_strdup(cli, server_workgroup);
2842 if (tevent_req_nomem(cli->server_domain, req)) {
2843 return;
2844 }
2845 }
2846
2847 cli->conn.protocol = protocol;
2848
2849 cli->conn.smb1.server.capabilities = server_capabilities;
2850 cli->conn.smb1.capabilities = capabilities;
2851
2852 cli->conn.smb1.server.max_xmit = server_max_xmit;
2853 cli->conn.smb1.max_xmit = max_xmit;
2854
2855 cli->conn.smb1.server.max_mux = server_max_mux;
2856
2857 cli->conn.smb1.server.security_mode = server_security_mode;
2858
2859 cli->conn.smb1.server.readbraw = server_readbraw;
2860 cli->conn.smb1.server.writebraw = server_writebraw;
2861 cli->conn.smb1.server.lockread = server_lockread;
2862 cli->conn.smb1.server.writeunlock = server_writeunlock;
2863
2864 cli->conn.smb1.server.session_key = server_session_key;
2865
2866 talloc_steal(cli, server_gss_blob.data);
2867 cli->conn.smb1.server.gss_blob = server_gss_blob;
2868 cli->conn.smb1.server.guid = server_guid;
2869 memcpy(cli->conn.smb1.server.challenge, server_challenge, 8);
2870 cli->conn.smb1.server.workgroup = talloc_move(cli, &server_workgroup);
2871
2872 cli->conn.smb1.server.time_zone = server_time_zone;
2873 cli->conn.smb1.server.system_time = server_system_time;
2874
2875 tevent_req_done(req);
2876 }
2877
2878 NTSTATUS cli_negprot_recv(struct tevent_req *req)
2879 {
2880 return tevent_req_simple_recv_ntstatus(req);
2881 }
2882
2883 NTSTATUS cli_negprot(struct cli_state *cli, enum protocol_types max_protocol)
2884 {
2885 TALLOC_CTX *frame = talloc_stackframe();
2886 struct event_context *ev;
2887 struct tevent_req *req;
2888 NTSTATUS status = NT_STATUS_OK;
2889
2890 if (cli_has_async_calls(cli)) {
2891 /*
2892 * Can't use sync call while an async call is in flight
2893 */
2894 status = NT_STATUS_INVALID_PARAMETER;
2895 goto fail;
2896 }
2897
2898 ev = event_context_init(frame);
2899 if (ev == NULL) {
2900 status = NT_STATUS_NO_MEMORY;
2901 goto fail;
2902 }
2903
2904 req = cli_negprot_send(frame, ev, cli, max_protocol);
2905 if (req == NULL) {
2906 status = NT_STATUS_NO_MEMORY;
2907 goto fail;
2908 }
2909
2910 if (!tevent_req_poll(req, ev)) {
2911 status = map_nt_error_from_unix(errno);
2912 goto fail;
2913 }
2914
2915 status = cli_negprot_recv(req);
2916 fail:
2917 TALLOC_FREE(frame);
2918 return status;
2919 }
2920
2921 static NTSTATUS cli_connect_sock(const char *host, int name_type,
2922 const struct sockaddr_storage *pss,
2923 const char *myname, uint16_t port,
2924 int sec_timeout, int *pfd, uint16_t *pport)
2925 {
2926 TALLOC_CTX *frame = talloc_stackframe();
2927 const char *prog;
2928 unsigned int i, num_addrs;
2929 const char **called_names;
2930 const char **calling_names;
2931 int *called_types;
2932 NTSTATUS status;
2933 int fd;
2934
2935 prog = getenv("LIBSMB_PROG");
2936 if (prog != NULL) {
2937 fd = sock_exec(prog);
2938 if (fd == -1) {
2939 return map_nt_error_from_unix(errno);
2940 }
2941 port = 0;
2942 goto done;
2943 }
2944
2945 if ((pss == NULL) || is_zero_addr(pss)) {
2946 struct sockaddr_storage *addrs;
2947 status = resolve_name_list(talloc_tos(), host, name_type,
2948 &addrs, &num_addrs);
2949 if (!NT_STATUS_IS_OK(status)) {
2950 goto fail;
2951 }
2952 pss = addrs;
2953 } else {
2954 num_addrs = 1;
2955 }
2956
2957 called_names = talloc_array(talloc_tos(), const char *, num_addrs);
2958 if (called_names == NULL) {
2959 status = NT_STATUS_NO_MEMORY;
2960 goto fail;
2961 }
2962 called_types = talloc_array(talloc_tos(), int, num_addrs);
2963 if (called_types == NULL) {
2964 status = NT_STATUS_NO_MEMORY;
2965 goto fail;
2966 }
2967 calling_names = talloc_array(talloc_tos(), const char *, num_addrs);
2968 if (calling_names == NULL) {
2969 status = NT_STATUS_NO_MEMORY;
2970 goto fail;
2971 }
2972 for (i=0; i<num_addrs; i++) {
2973 called_names[i] = host;
2974 called_types[i] = name_type;
2975 calling_names[i] = myname;
2976 }
2977 status = smbsock_any_connect(pss, called_names, called_types,
2978 calling_names, NULL, num_addrs, port,
2979 sec_timeout, &fd, NULL, &port);
2980 if (!NT_STATUS_IS_OK(status)) {
2981 goto fail;
2982 }
2983 set_socket_options(fd, lp_socket_options());
2984 done:
2985 *pfd = fd;
2986 *pport = port;
2987 status = NT_STATUS_OK;
2988 fail:
2989 TALLOC_FREE(frame);
2990 return status;
2991 }
2992
2993 NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss,
2994 uint16_t port, int name_type, const char *myname,
2995 int signing_state, int flags, struct cli_state **pcli)
2996 {
2997 TALLOC_CTX *frame = talloc_stackframe();
2998 struct cli_state *cli;
2999 NTSTATUS status = NT_STATUS_NO_MEMORY;
3000 int fd = -1;
3001 char *desthost;
3002 char *p;
3003
3004 desthost = talloc_strdup(talloc_tos(), host);
3005 if (desthost == NULL) {
3006 goto fail;
3007 }
3008
3009 p = strchr(host, '#');
3010 if (p != NULL) {
3011 name_type = strtol(p+1, NULL, 16);
3012 host = talloc_strndup(talloc_tos(), host, p - host);
3013 if (host == NULL) {
3014 goto fail;
3015 }
3016 }
3017
3018 status = cli_connect_sock(host, name_type, dest_ss, myname, port,
3019 20, &fd, &port);
3020 if (!NT_STATUS_IS_OK(status)) {
3021 goto fail;
3022 }
3023
3024 cli = cli_state_create(NULL, fd, desthost, NULL, signing_state, flags);
3025 if (cli == NULL) {
3026 goto fail;
3027 }
3028
3029 *pcli = cli;
3030 status = NT_STATUS_OK;
3031 fail:
3032 TALLOC_FREE(frame);
3033 return status;
3034 }
3035
3036 /**
3037 establishes a connection to after the negprot.
3038 @param output_cli A fully initialised cli structure, non-null only on success
3039 @param dest_host The netbios name of the remote host
3040 @param dest_ss (optional) The the destination IP, NULL for name based lookup
3041 @param port (optional) The destination port (0 for default)
3042 */
3043 NTSTATUS cli_start_connection(struct cli_state **output_cli,
3044 const char *my_name,
3045 const char *dest_host,
3046 const struct sockaddr_storage *dest_ss, int port,
3047 int signing_state, int flags)
3048 {
3049 NTSTATUS nt_status;
3050 struct cli_state *cli;
3051
3052 nt_status = cli_connect_nb(dest_host, dest_ss, port, 0x20, my_name,
3053 signing_state, flags, &cli);
3054 if (!NT_STATUS_IS_OK(nt_status)) {
3055 DEBUG(10, ("cli_connect_nb failed: %s\n",
3056 nt_errstr(nt_status)));
3057 return nt_status;
3058 }
3059
3060 nt_status = cli_negprot(cli, PROTOCOL_NT1);
3061 if (!NT_STATUS_IS_OK(nt_status)) {
3062 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
3063 cli_shutdown(cli);
3064 return nt_status;
3065 }
3066
3067 *output_cli = cli;
3068 return NT_STATUS_OK;
3069 }
3070
3071
3072 /**
3073 establishes a connection right up to doing tconX, password specified.
3074 @param output_cli A fully initialised cli structure, non-null only on success
3075 @param dest_host The netbios name of the remote host
3076 @param dest_ip (optional) The the destination IP, NULL for name based lookup
3077 @param port (optional) The destination port (0 for default)
3078 @param service (optional) The share to make the connection to. Should be 'unqualified' in any way.
3079 @param service_type The 'type' of serivice.
3080 @param user Username, unix string
3081 @param domain User's domain
3082 @param password User's password, unencrypted unix string.
3083 */
3084
3085 NTSTATUS cli_full_connection(struct cli_state **output_cli,
3086 const char *my_name,
3087 const char *dest_host,
3088 const struct sockaddr_storage *dest_ss, int port,
3089 const char *service, const char *service_type,
3090 const char *user, const char *domain,
3091 const char *password, int flags,
3092 int signing_state)
3093 {
3094 NTSTATUS nt_status;
3095 struct cli_state *cli = NULL;
3096 int pw_len = password ? strlen(password)+1 : 0;
3097
3098 *output_cli = NULL;
3099
3100 if (password == NULL) {
3101 password = "";
3102 }
3103
3104 nt_status = cli_start_connection(&cli, my_name, dest_host,
3105 dest_ss, port, signing_state,
3106 flags);
3107
3108 if (!NT_STATUS_IS_OK(nt_status)) {
3109 return nt_status;
3110 }
3111
3112 nt_status = cli_session_setup(cli, user, password, pw_len, password,
3113 pw_len, domain);
3114 if (!NT_STATUS_IS_OK(nt_status)) {
3115
3116 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
3117 DEBUG(1,("failed session setup with %s\n",
3118 nt_errstr(nt_status)));
3119 cli_shutdown(cli);
3120 return nt_status;
3121 }
3122
3123 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
3124 if (!NT_STATUS_IS_OK(nt_status)) {
3125 DEBUG(1,("anonymous failed session setup with %s\n",
3126 nt_errstr(nt_status)));
3127 cli_shutdown(cli);
3128 return nt_status;
3129 }
3130 }
3131
3132 if (service) {
3133 nt_status = cli_tcon_andx(cli, service, service_type, password,
3134 pw_len);
3135 if (!NT_STATUS_IS_OK(nt_status)) {
3136 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
3137 cli_shutdown(cli);
3138 if (NT_STATUS_IS_OK(nt_status)) {
3139 nt_status = NT_STATUS_UNSUCCESSFUL;
3140 }
3141 return nt_status;
3142 }
3143 }
3144
3145 nt_status = cli_init_creds(cli, user, domain, password);
3146 if (!NT_STATUS_IS_OK(nt_status)) {
3147 cli_shutdown(cli);
3148 return nt_status;
3149 }
3150
3151 *output_cli = cli;
3152 return NT_STATUS_OK;
3153 }
3154
3155 /****************************************************************************
3156 Send an old style tcon.
3157 ****************************************************************************/
3158 NTSTATUS cli_raw_tcon(struct cli_state *cli,
3159 const char *service, const char *pass, const char *dev,
3160 uint16 *max_xmit, uint16 *tid)
3161 {
3162 struct tevent_req *req;
3163 uint16_t *ret_vwv;
3164 uint8_t *bytes;
3165 NTSTATUS status;
3166
3167 if (!lp_client_plaintext_auth() && (*pass)) {
3168 DEBUG(1, ("Server requested plaintext password but 'client "
3169 "plaintext auth' is disabled\n"));
3170 return NT_STATUS_ACCESS_DENIED;
3171 }
3172
3173 bytes = talloc_array(talloc_tos(), uint8_t, 0);
3174 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
3175 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
3176 service, strlen(service)+1, NULL);
3177 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
3178 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
3179 pass, strlen(pass)+1, NULL);
3180 bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
3181 bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
3182 dev, strlen(dev)+1, NULL);
3183
3184 status = cli_smb(talloc_tos(), cli, SMBtcon, 0, 0, NULL,
3185 talloc_get_size(bytes), bytes, &req,
3186 2, NULL, &ret_vwv, NULL, NULL);
3187 if (!NT_STATUS_IS_OK(status)) {
3188 return status;
3189 }
3190
3191 *max_xmit = SVAL(ret_vwv + 0, 0);
3192 *tid = SVAL(ret_vwv + 1, 0);
3193
3194 return NT_STATUS_OK;
3195 }
3196
3197 /* Return a cli_state pointing at the IPC$ share for the given server */
3198
3199 struct cli_state *get_ipc_connect(char *server,
3200 struct sockaddr_storage *server_ss,
3201 const struct user_auth_info *user_info)
3202 {
3203 struct cli_state *cli;
3204 NTSTATUS nt_status;
3205 uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
3206
3207 if (user_info->use_kerberos) {
3208 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
3209 }
3210
3211 nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
3212 user_info->username ? user_info->username : "",
3213 lp_workgroup(),
3214 user_info->password ? user_info->password : "",
3215 flags,
3216 SMB_SIGNING_DEFAULT);
3217
3218 if (NT_STATUS_IS_OK(nt_status)) {
3219 return cli;
3220 } else if (is_ipaddress(server)) {
3221 /* windows 9* needs a correct NMB name for connections */
3222 fstring remote_name;
3223
3224 if (name_status_find("*", 0, 0, server_ss, remote_name)) {
3225 cli = get_ipc_connect(remote_name, server_ss, user_info);
3226 if (cli)
3227 return cli;
3228 }
3229 }
3230 return NULL;
3231 }
3232
3233 /*
3234 * Given the IP address of a master browser on the network, return its
3235 * workgroup and connect to it.
3236 *
3237 * This function is provided to allow additional processing beyond what
3238 * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
3239 * browsers and obtain each master browsers' list of domains (in case the
3240 * first master browser is recently on the network and has not yet
3241 * synchronized with other master browsers and therefore does not yet have the
3242 * entire network browse list)
3243 */
3244
3245 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
3246 struct sockaddr_storage *mb_ip,
3247 const struct user_auth_info *user_info,
3248 char **pp_workgroup_out)
3249 {
3250 char addr[INET6_ADDRSTRLEN];
3251 fstring name;
3252 struct cli_state *cli;
3253 struct sockaddr_storage server_ss;
3254
3255 *pp_workgroup_out = NULL;
3256
3257 print_sockaddr(addr, sizeof(addr), mb_ip);
3258 DEBUG(99, ("Looking up name of master browser %s\n",
3259 addr));
3260
3261 /*
3262 * Do a name status query to find out the name of the master browser.
3263 * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
3264 * master browser will not respond to a wildcard query (or, at least,
3265 * an NT4 server acting as the domain master browser will not).
3266 *
3267 * We might be able to use ONLY the query on MSBROWSE, but that's not
3268 * yet been tested with all Windows versions, so until it is, leave
3269 * the original wildcard query as the first choice and fall back to
3270 * MSBROWSE if the wildcard query fails.
3271 */
3272 if (!name_status_find("*", 0, 0x1d, mb_ip, name) &&
3273 !name_status_find(MSBROWSE, 1, 0x1d, mb_ip, name)) {
3274
3275 DEBUG(99, ("Could not retrieve name status for %s\n",
3276 addr));
3277 return NULL;
3278 }
3279
3280 if (!find_master_ip(name, &server_ss)) {
3281 DEBUG(99, ("Could not find master ip for %s\n", name));
3282 return NULL;
3283 }
3284
3285 *pp_workgroup_out = talloc_strdup(ctx, name);
3286
3287 DEBUG(4, ("found master browser %s, %s\n", name, addr));
3288
3289 print_sockaddr(addr, sizeof(addr), &server_ss);
3290 cli = get_ipc_connect(addr, &server_ss, user_info);
3291
3292 return cli;
3293 }
3294
3295 /*
3296 * Return the IP address and workgroup of a master browser on the network, and
3297 * connect to it.
3298 */
3299
3300 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
3301 const struct user_auth_info *user_info,
3302 char **pp_workgroup_out)
3303 {
3304 struct sockaddr_storage *ip_list;
3305 struct cli_state *cli;
3306 int i, count;
3307 NTSTATUS status;
3308
3309 *pp_workgroup_out = NULL;
3310
3311 DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
3312
3313 /* Go looking for workgroups by broadcasting on the local network */
3314
3315 status = name_resolve_bcast(MSBROWSE, 1, talloc_tos(),
3316 &ip_list, &count);
3317 if (!NT_STATUS_IS_OK(status)) {
3318 DEBUG(99, ("No master browsers responded: %s\n",
3319 nt_errstr(status)));
3320 return False;
3321 }
3322
3323 for (i = 0; i < count; i++) {
3324 char addr[INET6_ADDRSTRLEN];
3325 print_sockaddr(addr, sizeof(addr), &ip_list[i]);
3326 DEBUG(99, ("Found master browser %s\n", addr));
3327
3328 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
3329 user_info, pp_workgroup_out);
3330 if (cli)
3331 return(cli);
3332 }
3333
3334 return NULL;
3335 }