s3:libsmb: Use cli_cm_force_encryption() instead of cli_force_encryption()
[samba.git] / source3 / libsmb / libsmb_server.c
index 92a36912d3cfa46d7d67d0c47ad98e68a0f8a58d..e0cdc97eeb68c0e4fbfc0c76d15f600206c5b92f 100644 (file)
@@ -1,10 +1,10 @@
-/* 
+/*
    Unix SMB/Netbios implementation.
    SMB client library implementation
    Copyright (C) Andrew Tridgell 1998
    Copyright (C) Richard Sharpe 2000, 2002
    Copyright (C) John Terpstra 2000
-   Copyright (C) Tom Jansen (Ninja ISD) 2002 
+   Copyright (C) Tom Jansen (Ninja ISD) 2002
    Copyright (C) Derrell Lipman 2003-2008
    Copyright (C) Jeremy Allison 2007, 2008
    Copyright (C) SATOH Fumiyasu <fumiyas@osstech.co.jp> 2009.
 #include "libsmb/nmblib.h"
 #include "../libcli/smb/smbXcli_base.h"
 
-/* 
+/*
  * Check a server for being alive and well.
- * returns 0 if the server is in shape. Returns 1 on error 
- * 
+ * returns 0 if the server is in shape. Returns 1 on error
+ *
  * Also useable outside libsmbclient to enable external cache
  * to do some checks too.
  */
 int
 SMBC_check_server(SMBCCTX * context,
-                  SMBCSRV * server) 
+                  SMBCSRV * server)
 {
+       time_t now;
+
        if (!cli_state_is_connected(server->cli)) {
                return 1;
        }
 
+       now = time_mono(NULL);
+
+       if (server->last_echo_time == (time_t)0 ||
+                       now > server->last_echo_time +
+                               (server->cli->timeout/1000)) {
+               unsigned char data[16] = {0};
+               NTSTATUS status = cli_echo(server->cli,
+                                       1,
+                                       data_blob_const(data, sizeof(data)));
+               if (!NT_STATUS_IS_OK(status)) {
+                       return 1;
+               }
+               server->last_echo_time = now;
+       }
        return 0;
 }
 
-/* 
+/*
  * Remove a server from the cached server list it's unused.
  * On success, 0 is returned. 1 is returned if the server could not be removed.
- * 
+ *
  * Also useable outside libsmbclient
  */
 int
@@ -105,14 +121,20 @@ SMBC_call_auth_fn(TALLOC_CTX *ctx,
                   char **pp_username,
                   char **pp_password)
 {
-       fstring workgroup;
-       fstring username;
-       fstring password;
+       fstring workgroup = { 0 };
+       fstring username = { 0 };
+       fstring password = { 0 };
         smbc_get_auth_data_with_context_fn auth_with_context_fn;
 
-       strlcpy(workgroup, *pp_workgroup, sizeof(workgroup));
-       strlcpy(username, *pp_username, sizeof(username));
-       strlcpy(password, *pp_password, sizeof(password));
+       if (*pp_workgroup != NULL) {
+               strlcpy(workgroup, *pp_workgroup, sizeof(workgroup));
+       }
+       if (*pp_username != NULL) {
+               strlcpy(username, *pp_username, sizeof(username));
+       }
+       if (*pp_password != NULL) {
+               strlcpy(password, *pp_password, sizeof(password));
+       }
 
         /* See if there's an authentication with context function provided */
         auth_with_context_fn = smbc_getFunctionAuthDataWithContext(context);
@@ -199,7 +221,7 @@ check_server_cache:
                          * servers in the cache
                          */
                        if (smbc_getFunctionRemoveUnusedServer(context)(context,
-                                                                        srv)) { 
+                                                                        srv)) {
                                 /*
                                  * We could not remove the server completely,
                                  * remove it from the cache so we will not get
@@ -239,6 +261,7 @@ SMBC_server_internal(TALLOC_CTX *ctx,
             SMBCCTX *context,
             bool connect_if_not_found,
             const char *server,
+            uint16_t port,
             const char *share,
             char **pp_workgroup,
             char **pp_username,
@@ -250,11 +273,14 @@ SMBC_server_internal(TALLOC_CTX *ctx,
        struct cli_state *c = NULL;
        const char *server_n = server;
         int is_ipc = (share != NULL && strcmp(share, "IPC$") == 0);
-       uint32 fs_attrs = 0;
-        const char *username_used;
+       uint32_t fs_attrs = 0;
+       const char *username_used = NULL;
+       const char *password_used = NULL;
        NTSTATUS status;
        char *newserver, *newshare;
        int flags = 0;
+       struct smbXcli_tcon *tcon = NULL;
+       int signing_state = SMB_SIGNING_DEFAULT;
 
        ZERO_STRUCT(c);
        *in_cache = false;
@@ -318,8 +344,7 @@ SMBC_server_internal(TALLOC_CTX *ctx,
                        status = cli_tree_connect(srv->cli,
                                                  srv->cli->share,
                                                  "?????",
-                                                 *pp_password,
-                                                 strlen(*pp_password)+1);
+                                                 *pp_password);
                        if (!NT_STATUS_IS_OK(status)) {
                                 errno = map_errno_from_nt_status(status);
                                 cli_shutdown(srv->cli);
@@ -421,22 +446,28 @@ SMBC_server_internal(TALLOC_CTX *ctx,
                flags |= CLI_FULL_CONNECTION_USE_NT_HASH;
        }
 
-        if (share == NULL || *share == '\0' || is_ipc) {
-               /*
-                * Try 139 first for IPC$
-                */
-               status = cli_connect_nb(server_n, NULL, NBT_SMB_PORT, 0x20,
+       if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) {
+               signing_state = SMB_SIGNING_REQUIRED;
+       }
+
+       if (port == 0) {
+               if (share == NULL || *share == '\0' || is_ipc) {
+                       /*
+                        * Try 139 first for IPC$
+                        */
+                       status = cli_connect_nb(server_n, NULL, NBT_SMB_PORT, 0x20,
                                        smbc_getNetbiosName(context),
-                                       SMB_SIGNING_DEFAULT, flags, &c);
+                                       signing_state, flags, &c);
+               }
        }
 
        if (!NT_STATUS_IS_OK(status)) {
                /*
                 * No IPC$ or 139 did not work
                 */
-               status = cli_connect_nb(server_n, NULL, 0, 0x20,
+               status = cli_connect_nb(server_n, NULL, port, 0x20,
                                        smbc_getNetbiosName(context),
-                                       SMB_SIGNING_DEFAULT, flags, &c);
+                                       signing_state, flags, &c);
        }
 
        if (!NT_STATUS_IS_OK(status)) {
@@ -446,31 +477,34 @@ SMBC_server_internal(TALLOC_CTX *ctx,
 
        cli_set_timeout(c, smbc_getTimeout(context));
 
-       status = smbXcli_negprot(c->conn, c->timeout, PROTOCOL_CORE,
-                                PROTOCOL_NT1);
-
+       status = smbXcli_negprot(c->conn, c->timeout,
+                                lp_client_min_protocol(),
+                                lp_client_max_protocol());
        if (!NT_STATUS_IS_OK(status)) {
                cli_shutdown(c);
                errno = ETIMEDOUT;
                return NULL;
        }
 
-        username_used = *pp_username;
+       if (smbXcli_conn_protocol(c->conn) >= PROTOCOL_SMB2_02) {
+               /* Ensure we ask for some initial credits. */
+               smb2cli_conn_set_max_credits(c->conn, DEFAULT_SMB2_MAX_CREDITS);
+       }
+
+       username_used = *pp_username;
+       password_used = *pp_password;
 
        if (!NT_STATUS_IS_OK(cli_session_setup(c, username_used,
-                                              *pp_password,
-                                               strlen(*pp_password),
-                                              *pp_password,
-                                               strlen(*pp_password),
+                                              password_used,
                                               *pp_workgroup))) {
 
                 /* Failed.  Try an anonymous login, if allowed by flags. */
-                username_used = "";
+               username_used = "";
+               password_used = "";
 
                 if (smbc_getOptionNoAutoAnonymousLogin(context) ||
-                    !NT_STATUS_IS_OK(cli_session_setup(c, username_used,
-                                                       *pp_password, 1,
-                                                       *pp_password, 0,
+                   !NT_STATUS_IS_OK(cli_session_setup(c, username_used,
+                                                      password_used,
                                                        *pp_workgroup))) {
 
                         cli_shutdown(c);
@@ -479,14 +513,6 @@ SMBC_server_internal(TALLOC_CTX *ctx,
                 }
        }
 
-       status = cli_init_creds(c, username_used,
-                               *pp_workgroup, *pp_password);
-       if (!NT_STATUS_IS_OK(status)) {
-               errno = map_errno_from_nt_status(status);
-               cli_shutdown(c);
-               return NULL;
-       }
-
        DEBUG(4,(" session setup ok\n"));
 
        /* here's the fun part....to support 'msdfs proxy' shares
@@ -494,7 +520,7 @@ SMBC_server_internal(TALLOC_CTX *ctx,
           here before trying to connect to the original share.
           cli_check_msdfs_proxy() will fail if it is a normal share. */
 
-       if ((smb1cli_conn_capabilities(c->conn) & CAP_DFS) &&
+       if (smbXcli_conn_dfs_supported(c->conn) &&
                        cli_check_msdfs_proxy(ctx, c, share,
                                &newserver, &newshare,
                                /* FIXME: cli_check_msdfs_proxy() does
@@ -506,7 +532,7 @@ SMBC_server_internal(TALLOC_CTX *ctx,
                                *pp_workgroup)) {
                cli_shutdown(c);
                srv = SMBC_server_internal(ctx, context, connect_if_not_found,
-                               newserver, newshare, pp_workgroup,
+                               newserver, port, newshare, pp_workgroup,
                                pp_username, pp_password, in_cache);
                TALLOC_FREE(newserver);
                TALLOC_FREE(newshare);
@@ -515,8 +541,7 @@ SMBC_server_internal(TALLOC_CTX *ctx,
 
        /* must be a normal share */
 
-       status = cli_tree_connect(c, share, "?????", *pp_password,
-                                 strlen(*pp_password)+1);
+       status = cli_tree_connect(c, share, "?????", *pp_password);
        if (!NT_STATUS_IS_OK(status)) {
                errno = map_errno_from_nt_status(status);
                cli_shutdown(c);
@@ -525,6 +550,12 @@ SMBC_server_internal(TALLOC_CTX *ctx,
 
        DEBUG(4,(" tconx ok\n"));
 
+       if (smbXcli_conn_protocol(c->conn) >= PROTOCOL_SMB2_02) {
+               tcon = c->smb2.tcon;
+       } else {
+               tcon = c->smb1.tcon;
+       }
+
         /* Determine if this share supports case sensitivity */
        if (is_ipc) {
                 DEBUG(4, ("IPC$ so ignore case sensitivity\n"));
@@ -552,18 +583,17 @@ SMBC_server_internal(TALLOC_CTX *ctx,
                           (fs_attrs & FILE_CASE_SENSITIVE_SEARCH
                            ? "True"
                            : "False")));
-                cli_set_case_sensitive(c,
-                                       (fs_attrs & FILE_CASE_SENSITIVE_SEARCH
-                                        ? True
-                                        : False));
+               smbXcli_tcon_set_fs_attributes(tcon, fs_attrs);
         }
 
        if (context->internal->smb_encryption_level) {
-               /* Attempt UNIX smb encryption. */
-               if (!NT_STATUS_IS_OK(cli_force_encryption(c,
-                                                          username_used,
-                                                          *pp_password,
-                                                          *pp_workgroup))) {
+               /* Attempt encryption. */
+               status = cli_cm_force_encryption(c,
+                                                username_used,
+                                                password_used,
+                                                *pp_workgroup,
+                                                share);
+               if (!NT_STATUS_IS_OK(status)) {
 
                        /*
                         * context->smb_encryption_level == 1
@@ -595,10 +625,11 @@ SMBC_server_internal(TALLOC_CTX *ctx,
        }
 
        ZERO_STRUCTP(srv);
-       srv->cli = c;
+       DLIST_ADD(srv->cli, c);
        srv->dev = (dev_t)(str_checksum(server) ^ str_checksum(share));
         srv->no_pathinfo = False;
         srv->no_pathinfo2 = False;
+       srv->no_pathinfo3 = False;
         srv->no_nt_session = False;
 
 done:
@@ -629,6 +660,7 @@ SMBC_server(TALLOC_CTX *ctx,
                SMBCCTX *context,
                bool connect_if_not_found,
                const char *server,
+               uint16_t port,
                const char *share,
                char **pp_workgroup,
                char **pp_username,
@@ -638,7 +670,7 @@ SMBC_server(TALLOC_CTX *ctx,
        bool in_cache = false;
 
        srv = SMBC_server_internal(ctx, context, connect_if_not_found,
-                       server, share, pp_workgroup,
+                       server, port, share, pp_workgroup,
                        pp_username, pp_password, &in_cache);
 
        if (!srv) {
@@ -699,7 +731,7 @@ SMBC_attr_server(TALLOC_CTX *ctx,
         * i.e., a normal share or a referred share from
         * 'msdfs proxy' share.
         */
-       srv = SMBC_server(ctx, context, true, server, share,
+       srv = SMBC_server(ctx, context, true, server, port, share,
                        pp_workgroup, pp_username, pp_password);
        if (!srv) {
                return NULL;
@@ -715,6 +747,7 @@ SMBC_attr_server(TALLOC_CTX *ctx,
         ipc_srv = SMBC_find_server(ctx, context, server, "*IPC$",
                                    pp_workgroup, pp_username, pp_password);
         if (!ipc_srv) {
+               int signing_state = SMB_SIGNING_DEFAULT;
 
                 /* We didn't find a cached connection.  Get the password */
                if (!*pp_password || (*pp_password)[0] == '\0') {
@@ -736,6 +769,9 @@ SMBC_attr_server(TALLOC_CTX *ctx,
                 if (smbc_getOptionUseCCache(context)) {
                         flags |= CLI_FULL_CONNECTION_USE_CCACHE;
                 }
+               if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) {
+                       signing_state = SMB_SIGNING_REQUIRED;
+               }
 
                 nt_status = cli_full_connection(&ipc_cli,
                                                lp_netbios_name(), server,
@@ -744,7 +780,7 @@ SMBC_attr_server(TALLOC_CTX *ctx,
                                                *pp_workgroup,
                                                *pp_password,
                                                flags,
-                                               SMB_SIGNING_DEFAULT);
+                                               signing_state);
                 if (! NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(1,("cli_full_connection failed! (%s)\n",
                                  nt_errstr(nt_status)));
@@ -753,11 +789,13 @@ SMBC_attr_server(TALLOC_CTX *ctx,
                 }
 
                if (context->internal->smb_encryption_level) {
-                       /* Attempt UNIX smb encryption. */
-                       if (!NT_STATUS_IS_OK(cli_force_encryption(ipc_cli,
-                                                                  *pp_username,
-                                                                  *pp_password,
-                                                                  *pp_workgroup))) {
+                       /* Attempt encryption. */
+                       nt_status = cli_cm_force_encryption(ipc_cli,
+                                                           *pp_username,
+                                                           *pp_password,
+                                                           *pp_workgroup,
+                                                           "IPC$");
+                       if (!NT_STATUS_IS_OK(nt_status)) {
 
                                /*
                                 * context->smb_encryption_level ==
@@ -785,10 +823,10 @@ SMBC_attr_server(TALLOC_CTX *ctx,
                 }
 
                 ZERO_STRUCTP(ipc_srv);
-                ipc_srv->cli = ipc_cli;
+                DLIST_ADD(ipc_srv->cli, ipc_cli);
 
                 nt_status = cli_rpc_pipe_open_noauth(
-                       ipc_srv->cli, &ndr_table_lsarpc.syntax_id, &pipe_hnd);
+                       ipc_srv->cli, &ndr_table_lsarpc, &pipe_hnd);
                 if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(1, ("cli_nt_session_open fail!\n"));
                         errno = ENOTSUP;