This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
a composite API for making handling a generic async session setup
#include "includes.h"
#include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
#include "libcli/composite/composite.h"
#include "libcli/smb_composite/smb_composite.h"
+#include "libcli/smb_composite/proto.h"
+#include "libcli/auth/libcli_auth.h"
#include "auth/auth.h"
+#include "auth/gensec/gensec.h"
+#include "auth/credentials/credentials.h"
#include "version.h"
+#include "param/param.h"
struct sesssetup_state {
union smb_sesssetup setup;
+ NTSTATUS remote_status;
NTSTATUS gensec_status;
struct smb_composite_sesssetup *io;
struct smbcli_request *req;
};
+static int sesssetup_state_destructor(struct sesssetup_state *state)
+{
+ if (state->req) {
+ talloc_free(state->req);
+ state->req = NULL;
+ }
+
+ return 0;
+}
+
+static NTSTATUS session_setup_old(struct composite_context *c,
+ struct smbcli_session *session,
+ struct smb_composite_sesssetup *io,
+ struct smbcli_request **req);
+static NTSTATUS session_setup_nt1(struct composite_context *c,
+ struct smbcli_session *session,
+ struct smb_composite_sesssetup *io,
+ struct smbcli_request **req);
+static NTSTATUS session_setup_spnego(struct composite_context *c,
+ struct smbcli_session *session,
+ struct smb_composite_sesssetup *io,
+ struct smbcli_request **req);
/*
store the user session key for a transport
*/
static void request_handler(struct smbcli_request *req)
{
- struct composite_context *c = req->async.private;
+ struct composite_context *c = (struct composite_context *)req->async.private_data;
struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
struct smbcli_session *session = req->session;
DATA_BLOB session_key = data_blob(NULL, 0);
DATA_BLOB null_data_blob = data_blob(NULL, 0);
- NTSTATUS session_key_err;
+ NTSTATUS session_key_err, nt_status;
+ struct smbcli_request *check_req = NULL;
+ const char *os = NULL;
+ const char *lanman = NULL;
+
+ if (req->sign_caller_checks) {
+ req->do_not_free = true;
+ check_req = req;
+ }
- c->status = smb_raw_sesssetup_recv(req, state, &state->setup);
+ state->remote_status = smb_raw_sesssetup_recv(req, state, &state->setup);
+ c->status = state->remote_status;
+ state->req = NULL;
+
+ /*
+ * we only need to check the signature if the
+ * NT_STATUS_OK is returned
+ */
+ if (!NT_STATUS_IS_OK(state->remote_status)) {
+ talloc_free(check_req);
+ check_req = NULL;
+ }
switch (state->setup.old.level) {
case RAW_SESSSETUP_OLD:
state->io->out.vuid = state->setup.old.out.vuid;
+ /* This doesn't work, as this only happens on old
+ * protocols, where this comparison won't match. */
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ /* we neet to reset the vuid for a new try */
+ session->vuid = 0;
+ if (cli_credentials_wrong_password(state->io->in.credentials)) {
+ nt_status = session_setup_old(c, session,
+ state->io,
+ &state->req);
+ if (NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(check_req);
+ c->status = nt_status;
+ composite_continue_smb(c, state->req, request_handler, c);
+ return;
+ }
+ }
+ }
+ os = state->setup.old.out.os;
+ lanman = state->setup.old.out.lanman;
break;
case RAW_SESSSETUP_NT1:
state->io->out.vuid = state->setup.nt1.out.vuid;
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ /* we neet to reset the vuid for a new try */
+ session->vuid = 0;
+ if (cli_credentials_wrong_password(state->io->in.credentials)) {
+ nt_status = session_setup_nt1(c, session,
+ state->io,
+ &state->req);
+ if (NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(check_req);
+ c->status = nt_status;
+ composite_continue_smb(c, state->req, request_handler, c);
+ return;
+ }
+ }
+ }
+ os = state->setup.nt1.out.os;
+ lanman = state->setup.nt1.out.lanman;
break;
case RAW_SESSSETUP_SPNEGO:
- session->vuid = state->io->out.vuid = state->setup.spnego.out.vuid;
+ state->io->out.vuid = state->setup.spnego.out.vuid;
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ /* we need to reset the vuid for a new try */
+ session->vuid = 0;
+ if (cli_credentials_wrong_password(state->io->in.credentials)) {
+ nt_status = session_setup_spnego(c, session,
+ state->io,
+ &state->req);
+ if (NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(check_req);
+ c->status = nt_status;
+ composite_continue_smb(c, state->req, request_handler, c);
+ return;
+ }
+ }
+ }
if (!NT_STATUS_EQUAL(c->status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
!NT_STATUS_IS_OK(c->status)) {
break;
} else {
state->setup.spnego.in.secblob = data_blob(NULL, 0);
}
-
- /* we need to do another round of session setup. We keep going until both sides
- are happy */
- session_key_err = gensec_session_key(session->gensec, &session_key);
- if (NT_STATUS_IS_OK(session_key_err)) {
- set_user_session_key(session, &session_key);
- smbcli_transport_simple_set_signing(session->transport, session_key, null_data_blob);
+
+ if (NT_STATUS_IS_OK(state->remote_status)) {
+ if (state->setup.spnego.in.secblob.length) {
+ c->status = NT_STATUS_INTERNAL_ERROR;
+ break;
+ }
+ session_key_err = gensec_session_key(session->gensec, &session_key);
+ if (NT_STATUS_IS_OK(session_key_err)) {
+ set_user_session_key(session, &session_key);
+ smbcli_transport_simple_set_signing(session->transport, session_key, null_data_blob);
+ }
}
if (state->setup.spnego.in.secblob.length) {
+ /*
+ * set the session->vuid value only for calling
+ * smb_raw_sesssetup_send()
+ */
+ uint16_t vuid = session->vuid;
+ session->vuid = state->io->out.vuid;
state->req = smb_raw_sesssetup_send(session, &state->setup);
- state->req->async.fn = request_handler;
- state->req->async.private = c;
+ session->vuid = vuid;
+ if (state->req) {
+ state->req->sign_caller_checks = true;
+ }
+ composite_continue_smb(c, state->req, request_handler, c);
return;
}
+ os = state->setup.spnego.out.os;
+ lanman = state->setup.spnego.out.lanman;
+ break;
+
+ case RAW_SESSSETUP_SMB2:
+ c->status = NT_STATUS_INTERNAL_ERROR;
+ break;
+ }
+
+ if (check_req) {
+ check_req->sign_caller_checks = false;
+ if (!smbcli_request_check_sign_mac(check_req)) {
+ c->status = NT_STATUS_ACCESS_DENIED;
+ }
+ talloc_free(check_req);
+ check_req = NULL;
}
/* enforce the local signing required flag */
}
}
- if (NT_STATUS_IS_OK(c->status)) {
- c->state = COMPOSITE_STATE_DONE;
+ if (!NT_STATUS_IS_OK(c->status)) {
+ composite_error(c, c->status);
+ return;
+ }
+
+ if (os) {
+ session->os = talloc_strdup(session, os);
+ if (composite_nomem(session->os, c)) return;
} else {
- c->state = COMPOSITE_STATE_ERROR;
+ session->os = NULL;
}
- if (c->async.fn) {
- c->async.fn(c);
+ if (lanman) {
+ session->lanman = talloc_strdup(session, lanman);
+ if (composite_nomem(session->lanman, c)) return;
+ } else {
+ session->lanman = NULL;
}
+
+ composite_done(c);
}
struct smb_composite_sesssetup *io,
struct smbcli_request **req)
{
- NTSTATUS nt_status;
- struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
- const char *password = cli_credentials_get_password(io->in.credentials);
- DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, session->transport->socket->hostname, lp_workgroup());
- DATA_BLOB session_key;
+ NTSTATUS nt_status = NT_STATUS_INTERNAL_ERROR;
+ struct sesssetup_state *state = talloc_get_type(c->private_data,
+ struct sesssetup_state);
+ const char *domain = cli_credentials_get_domain(io->in.credentials);
+
+ /*
+ * domain controllers tend to reject the NTLM v2 blob
+ * if the netbiosname is not valid (e.g. IP address or FQDN)
+ * so just leave it away (as Windows client do)
+ */
+ DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, NULL, domain);
+
+ DATA_BLOB session_key = data_blob(NULL, 0);
int flags = CLI_CRED_NTLM_AUTH;
- if (lp_client_lanman_auth()) {
+
+ smbcli_temp_set_signing(session->transport);
+
+ if (session->options.lanman_auth) {
flags |= CLI_CRED_LANMAN_AUTH;
}
- if (lp_client_ntlmv2_auth()) {
+ if (session->options.ntlmv2_auth) {
flags |= CLI_CRED_NTLMv2_AUTH;
}
&state->setup.nt1.in.password1,
&state->setup.nt1.in.password2,
NULL, &session_key);
-
- smbcli_transport_simple_set_signing(session->transport, session_key,
- state->setup.nt1.in.password2);
- set_user_session_key(session, &session_key);
-
- data_blob_free(&session_key);
- } else if (lp_client_plaintext_auth()) {
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+ } else if (session->options.plaintext_auth) {
+ const char *password = cli_credentials_get_password(io->in.credentials);
state->setup.nt1.in.password1 = data_blob_talloc(state, password, strlen(password));
state->setup.nt1.in.password2 = data_blob(NULL, 0);
} else {
if (!*req) {
return NT_STATUS_NO_MEMORY;
}
+
+ if (NT_STATUS_IS_OK(nt_status)) {
+ smbcli_transport_simple_set_signing(session->transport, session_key,
+ state->setup.nt1.in.password2);
+ set_user_session_key(session, &session_key);
+
+ data_blob_free(&session_key);
+ }
+
return (*req)->status;
}
struct smbcli_request **req)
{
NTSTATUS nt_status;
- struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
+ struct sesssetup_state *state = talloc_get_type(c->private_data,
+ struct sesssetup_state);
const char *password = cli_credentials_get_password(io->in.credentials);
- DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, session->transport->socket->hostname, lp_workgroup());
+ const char *domain = cli_credentials_get_domain(io->in.credentials);
+
+ /*
+ * domain controllers tend to reject the NTLM v2 blob
+ * if the netbiosname is not valid (e.g. IP address or FQDN)
+ * so just leave it away (as Windows client do)
+ */
+ DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, NULL, domain);
+
DATA_BLOB session_key;
int flags = 0;
- if (lp_client_lanman_auth()) {
+ if (session->options.lanman_auth) {
flags |= CLI_CRED_LANMAN_AUTH;
}
- if (lp_client_ntlmv2_auth()) {
+ if (session->options.ntlmv2_auth) {
flags |= CLI_CRED_NTLMv2_AUTH;
}
&state->setup.old.in.password,
NULL,
NULL, &session_key);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
set_user_session_key(session, &session_key);
data_blob_free(&session_key);
- } else if (lp_client_plaintext_auth()) {
+ } else if (session->options.plaintext_auth) {
state->setup.old.in.password = data_blob_talloc(state, password, strlen(password));
} else {
/* could match windows client and return 'cannot logon from this workstation', but it just confuses everybody */
struct smbcli_request **req)
{
struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
- NTSTATUS status, session_key_err;
- DATA_BLOB session_key = data_blob(NULL, 0);
- DATA_BLOB null_data_blob = data_blob(NULL, 0);
+ NTSTATUS status;
const char *chosen_oid = NULL;
state->setup.spnego.level = RAW_SESSSETUP_SPNEGO;
state->setup.spnego.in.lanman = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
state->setup.spnego.in.workgroup = io->in.workgroup;
- state->setup.spnego.out.vuid = session->vuid;
-
smbcli_temp_set_signing(session->transport);
- status = gensec_client_start(session, &session->gensec, c->event_ctx);
+ status = gensec_client_start(session, &session->gensec, c->event_ctx,
+ io->in.gensec_settings);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to start GENSEC client mode: %s\n", nt_errstr(status)));
return status;
status = gensec_set_credentials(session->gensec, io->in.credentials);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to start set GENSEC client credentails: %s\n",
+ DEBUG(1, ("Failed to start set GENSEC client credentials: %s\n",
nt_errstr(status)));
return status;
}
if (session->transport->negotiate.secblob.length) {
chosen_oid = GENSEC_OID_SPNEGO;
+ status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Failed to start set GENSEC client mechanism %s: %s\n",
+ gensec_get_name_by_oid(session->gensec, chosen_oid), nt_errstr(status)));
+ chosen_oid = GENSEC_OID_NTLMSSP;
+ status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Failed to start set (fallback) GENSEC client mechanism %s: %s\n",
+ gensec_get_name_by_oid(session->gensec, chosen_oid),
+ nt_errstr(status)));
+ return status;
+ }
+ }
} else {
/* without a sec blob, means raw NTLMSSP */
chosen_oid = GENSEC_OID_NTLMSSP;
+ status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Failed to start set GENSEC client mechanism %s: %s\n",
+ gensec_get_name_by_oid(session->gensec, chosen_oid), nt_errstr(status)));
+ }
}
- status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to start set GENSEC client SPNEGO mechanism %s: %s\n",
- gensec_get_name_by_oid(chosen_oid), nt_errstr(status)));
- return status;
+ if ((const void *)chosen_oid == (const void *)GENSEC_OID_SPNEGO) {
+ status = gensec_update(session->gensec, state,
+ session->transport->negotiate.secblob,
+ &state->setup.spnego.in.secblob);
+ } else {
+ status = gensec_update(session->gensec, state,
+ data_blob(NULL, 0),
+ &state->setup.spnego.in.secblob);
+
}
-
- status = gensec_update(session->gensec, state,
- session->transport->negotiate.secblob,
- &state->setup.spnego.in.secblob);
+
if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed initial gensec_update with mechanism %s: %s\n",
- gensec_get_name_by_oid(chosen_oid), nt_errstr(status)));
+ gensec_get_name_by_oid(session->gensec, chosen_oid),
+ nt_errstr(status)));
return status;
}
state->gensec_status = status;
- session_key_err = gensec_session_key(session->gensec, &session_key);
- if (NT_STATUS_IS_OK(session_key_err)) {
- smbcli_transport_simple_set_signing(session->transport, session_key, null_data_blob);
- }
-
*req = smb_raw_sesssetup_send(session, &state->setup);
if (!*req) {
return NT_STATUS_NO_MEMORY;
}
+
+ /*
+ * we need to check the signature ourself
+ * as the session key might be the acceptor subkey
+ * which comes within the response itself
+ */
+ (*req)->sign_caller_checks = true;
+
return (*req)->status;
}
struct sesssetup_state *state;
NTSTATUS status;
- c = talloc_zero(session, struct composite_context);
+ c = composite_create(session, session->transport->socket->event.ctx);
if (c == NULL) return NULL;
- state = talloc(c, struct sesssetup_state);
- if (state == NULL) {
- talloc_free(c);
- return NULL;
- }
+ state = talloc_zero(c, struct sesssetup_state);
+ if (composite_nomem(state, c)) return c;
+ c->private_data = state;
state->io = io;
- c->state = COMPOSITE_STATE_IN_PROGRESS;
- c->private_data = state;
- c->event_ctx = session->transport->socket->event.ctx;
+ talloc_set_destructor(state, sesssetup_state_destructor);
/* no session setup at all in earliest protocol varients */
if (session->transport->negotiate.protocol < PROTOCOL_LANMAN1) {
ZERO_STRUCT(io->out);
- c->state = COMPOSITE_STATE_DONE;
+ composite_done(c);
return c;
}
if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
NT_STATUS_IS_OK(status)) {
- state->req->async.fn = request_handler;
- state->req->async.private = c;
+ composite_continue_smb(c, state->req, request_handler, c);
return c;
}
- c->state = COMPOSITE_STATE_ERROR;
- c->status = status;
+ composite_error(c, status);
return c;
}
git.samba.org / mat / samba.git / blobdiff