CVE-2016-2115: s4:libcli/raw: pass the minprotocol to smb_raw_negotiate*()
[samba.git] / source4 / libcli / cliconnect.c
index 66882f605d6a2c9b34b692379fe12bd4867046dc..35d963eebf8df63d62844892271b348b17dd857a 100644 (file)
@@ -1,11 +1,14 @@
 /*
    Unix SMB/CIFS implementation.
+
    client connect/disconnect routines
-   Copyright (C) Andrew Tridgell 2003
+
+   Copyright (C) Andrew Tridgell 2003-2005
+   Copyright (C) James Peach 2005
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 #include "includes.h"
+#include "libcli/libcli.h"
+#include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
+#include "libcli/auth/libcli_auth.h"
+#include "libcli/smb_composite/smb_composite.h"
+#include "libcli/smb/smbXcli_base.h"
 
 /*
   wrapper around smbcli_sock_connect()
 */
-BOOL smbcli_socket_connect(struct smbcli_state *cli, const char *server)
+bool smbcli_socket_connect(struct smbcli_state *cli, const char *server, 
+                          const char **ports, 
+                          struct tevent_context *ev_ctx,
+                          struct resolve_context *resolve_ctx,
+                          struct smbcli_options *options,
+                          const char *socket_options,
+                          struct nbt_name *calling,
+                          struct nbt_name *called)
 {
-       struct smbcli_socket *sock;
-
-       sock = smbcli_sock_init();
-       if (!sock) return False;
+       NTSTATUS status;
 
-       if (!smbcli_sock_connect_byname(sock, server, 0)) {
-               smbcli_sock_close(sock);
-               return False;
-       }
-       
-       cli->transport = smbcli_transport_init(sock);
-       if (!cli->transport) {
-               smbcli_sock_close(sock);
-               return False;
+       cli->options = *options;
+
+       status = smbcli_sock_connect(cli,
+                                    NULL, /* host_addr */
+                                    ports,
+                                    server,
+                                    resolve_ctx,
+                                    ev_ctx,
+                                    socket_options,
+                                    calling,
+                                    called,
+                                    &cli->sock);
+       if (!NT_STATUS_IS_OK(status)) {
+               return false;
        }
 
-       return True;
-}
-
-/* wrapper around smbcli_transport_connect() */
-BOOL smbcli_transport_establish(struct smbcli_state *cli, 
-                            struct nmb_name *calling,
-                            struct nmb_name *called)
-{
-       return smbcli_transport_connect(cli->transport, calling, called);
+       return true;
 }
 
 /* wrapper around smb_raw_negotiate() */
-NTSTATUS smbcli_negprot(struct smbcli_state *cli)
+NTSTATUS smbcli_negprot(struct smbcli_state *cli, bool unicode, int maxprotocol)
 {
-       return smb_raw_negotiate(cli->transport);
+       if (unicode) {
+               cli->options.unicode = 1;
+       } else {
+               cli->options.unicode = 0;
+       }
+
+       cli->transport = smbcli_transport_init(cli->sock, cli,
+                                              true, &cli->options);
+       cli->sock = NULL;
+       if (!cli->transport) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       return smb_raw_negotiate(cli->transport, unicode, PROTOCOL_CORE, maxprotocol);
 }
 
-/* wrapper around smb_raw_session_setup() */
+/* wrapper around smb_raw_sesssetup() */
 NTSTATUS smbcli_session_setup(struct smbcli_state *cli, 
-                          const char *user, 
-                          const char *password, 
-                          const char *domain)
+                             struct cli_credentials *credentials,
+                             const char *workgroup,
+                             struct smbcli_session_options options,
+                             struct gensec_settings *gensec_settings)
 {
-       union smb_sesssetup setup;
+       struct smb_composite_sesssetup setup;
        NTSTATUS status;
-       TALLOC_CTX *mem_ctx;
 
-       cli->session = smbcli_session_init(cli->transport);
+       cli->session = smbcli_session_init(cli->transport, cli, true,
+                                          options);
        if (!cli->session) return NT_STATUS_UNSUCCESSFUL;
 
-       mem_ctx = talloc_init("smbcli_session_setup");
-       if (!mem_ctx) return NT_STATUS_NO_MEMORY;
-
-       setup.generic.level = RAW_SESSSETUP_GENERIC;
-       setup.generic.in.sesskey = cli->transport->negotiate.sesskey;
-       setup.generic.in.capabilities = cli->transport->negotiate.capabilities;
-       if (!user || !user[0]) {
-               setup.generic.in.password = NULL;
-               setup.generic.in.user = "";
-               setup.generic.in.domain = "";
-               setup.generic.in.capabilities &= ~CAP_EXTENDED_SECURITY;
-       } else {
-               if (cli->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
-                       setup.generic.in.password = password;
-               } else {
-                       setup.generic.in.password = NULL;
-               }
-               setup.generic.in.user = user;
-               setup.generic.in.domain = domain;
-       }
-
-       status = smb_raw_session_setup(cli->session, mem_ctx, &setup);
+       setup.in.sesskey = cli->transport->negotiate.sesskey;
+       setup.in.capabilities = cli->transport->negotiate.capabilities;
+       setup.in.credentials = credentials;
+       setup.in.workgroup = workgroup;
+       setup.in.gensec_settings = gensec_settings;
 
-       cli->session->vuid = setup.generic.out.vuid;
+       status = smb_composite_sesssetup(cli->session, &setup);
 
-       talloc_free(mem_ctx);
+       cli->session->vuid = setup.out.vuid;
 
        return status;
 }
 
-/* wrapper around smb_tree_connect() */
-NTSTATUS smbcli_send_tconX(struct smbcli_state *cli, const char *sharename, 
-                          const char *devtype, const char *password)
+/* wrapper around smb_raw_tcon() */
+NTSTATUS smbcli_tconX(struct smbcli_state *cli, const char *sharename, 
+                     const char *devtype, const char *password)
 {
        union smb_tcon tcon;
        TALLOC_CTX *mem_ctx;
        NTSTATUS status;
 
-       cli->tree = smbcli_tree_init(cli->session);
+       cli->tree = smbcli_tree_init(cli->session, cli, true);
        if (!cli->tree) return NT_STATUS_UNSUCCESSFUL;
 
-       cli->tree->reference_count++;
-
        mem_ctx = talloc_init("tcon");
        if (!mem_ctx) {
                return NT_STATUS_NO_MEMORY;
@@ -121,7 +125,8 @@ NTSTATUS smbcli_send_tconX(struct smbcli_state *cli, const char *sharename,
 
        /* setup a tree connect */
        tcon.generic.level = RAW_TCON_TCONX;
-       tcon.tconx.in.flags = 0;
+       tcon.tconx.in.flags = TCONX_FLAG_EXTENDED_RESPONSE;
+       tcon.tconx.in.flags |= TCONX_FLAG_EXTENDED_SIGNATURES;
        if (cli->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
                tcon.tconx.in.password = data_blob(NULL, 0);
        } else if (cli->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
@@ -136,9 +141,13 @@ NTSTATUS smbcli_send_tconX(struct smbcli_state *cli, const char *sharename,
        tcon.tconx.in.path = sharename;
        tcon.tconx.in.device = devtype;
        
-       status = smb_tree_connect(cli->tree, mem_ctx, &tcon);
+       status = smb_raw_tcon(cli->tree, mem_ctx, &tcon);
 
-       cli->tree->tid = tcon.tconx.out.cnum;
+       cli->tree->tid = tcon.tconx.out.tid;
+
+       if (tcon.tconx.out.options & SMB_EXTENDED_SIGNATURES) {
+               smb1cli_session_protect_session_key(cli->tree->session->smbXcli);
+       }
 
        talloc_free(mem_ctx);
 
@@ -149,49 +158,46 @@ NTSTATUS smbcli_send_tconX(struct smbcli_state *cli, const char *sharename,
 /*
   easy way to get to a fully connected smbcli_state in one call
 */
-NTSTATUS smbcli_full_connection(struct smbcli_state **ret_cli, 
-                            const char *myname,
-                            const char *host,
-                            struct in_addr *ip,
-                            const char *sharename,
-                            const char *devtype,
-                            const char *username,
-                            const char *domain,
-                            const char *password,
-                            uint_t flags,
-                            BOOL *retry)
+NTSTATUS smbcli_full_connection(TALLOC_CTX *parent_ctx,
+                               struct smbcli_state **ret_cli, 
+                               const char *host,
+                               const char **ports,
+                               const char *sharename,
+                               const char *devtype,
+                               const char *socket_options,
+                               struct cli_credentials *credentials,
+                               struct resolve_context *resolve_ctx,
+                               struct tevent_context *ev,
+                               struct smbcli_options *options,
+                               struct smbcli_session_options *session_options,
+                               struct gensec_settings *gensec_settings)
 {
        struct smbcli_tree *tree;
        NTSTATUS status;
-       char *p;
-       TALLOC_CTX *mem_ctx;
-
-       mem_ctx = talloc_init("smbcli_full_connection");
 
        *ret_cli = NULL;
 
-       /* if the username is of the form DOMAIN\username then split out the domain */
-       p = strpbrk(username, "\\/");
-       if (p) {
-               domain = talloc_strndup(mem_ctx, username, PTR_DIFF(p, username));
-               username = talloc_strdup(mem_ctx, p+1);
-       }
-
-       status = smbcli_tree_full_connection(&tree, myname, host, 0, sharename, devtype,
-                                            username, domain, password);
+       status = smbcli_tree_full_connection(parent_ctx,
+                                            &tree, host, ports, 
+                                            sharename, devtype,
+                                                socket_options,
+                                            credentials, resolve_ctx, ev,
+                                            options,
+                                            session_options,
+                                                gensec_settings);
        if (!NT_STATUS_IS_OK(status)) {
                goto done;
        }
 
-       (*ret_cli) = smbcli_state_init();
+       (*ret_cli) = smbcli_state_init(parent_ctx);
 
        (*ret_cli)->tree = tree;
        (*ret_cli)->session = tree->session;
        (*ret_cli)->transport = tree->session->transport;
-       tree->reference_count++;
 
+       talloc_steal(*ret_cli, tree);
+       
 done:
-       talloc_free(mem_ctx);
        return status;
 }
 
@@ -207,27 +213,69 @@ NTSTATUS smbcli_tdis(struct smbcli_state *cli)
 /****************************************************************************
  Initialise a client state structure.
 ****************************************************************************/
-struct smbcli_state *smbcli_state_init(void)
+struct smbcli_state *smbcli_state_init(TALLOC_CTX *mem_ctx)
+{
+       return talloc_zero(mem_ctx, struct smbcli_state);
+}
+
+/* Insert a NULL at the first separator of the given path and return a pointer
+ * to the remainder of the string.
+ */
+static char *
+terminate_path_at_separator(char * path)
 {
-       struct smbcli_state *cli;
+       char * p;
+
+       if (!path) {
+               return NULL;
+       }
 
-       cli = talloc_named(NULL, sizeof(*cli), "smbcli_state");
-       if (cli) {
-               ZERO_STRUCTP(cli);
+       if ((p = strchr_m(path, '/'))) {
+               *p = '\0';
+               return p + 1;
        }
 
-       return cli;
+       if ((p = strchr_m(path, '\\'))) {
+               *p = '\0';
+               return p + 1;
+       }
+       
+       /* No separator. */
+       return NULL;
 }
 
-/****************************************************************************
- Shutdown a client structure.
-****************************************************************************/
-void smbcli_shutdown(struct smbcli_state *cli)
+/*
+  parse a //server/share type UNC name
+*/
+bool smbcli_parse_unc(const char *unc_name, TALLOC_CTX *mem_ctx,
+                     char **hostname, char **sharename)
 {
-       if (!cli) return;
-       if (cli->tree) {
-               cli->tree->reference_count++;
-               smbcli_tree_close(cli->tree);
+       char *p;
+
+       if (strncmp(unc_name, "\\\\", 2) &&
+           strncmp(unc_name, "//", 2)) {
+               return false;
+       }
+
+       *hostname = *sharename = NULL;
+
+       *hostname = talloc_strdup(mem_ctx, &unc_name[2]);
+       p = terminate_path_at_separator(*hostname);
+
+       if (p != NULL && *p) {
+               *sharename = talloc_strdup(mem_ctx, p);
+               terminate_path_at_separator(*sharename);
+       }
+
+       if (*hostname && *sharename) {
+               return true;
        }
-       talloc_free(cli);
+
+       talloc_free(*hostname);
+       talloc_free(*sharename);
+       *hostname = *sharename = NULL;
+       return false;
 }
+
+
+