CVE-2016-2115: s4:libcli/raw: pass the minprotocol to smb_raw_negotiate*()

[samba.git] / source4 / libcli / cliconnect.c

diff --git a/source4/libcli/cliconnect.c b/source4/libcli/cliconnect.c
index dda05c8d739460423f389736801aee2616173b7a..35d963eebf8df63d62844892271b348b17dd857a 100644 (file)
--- a/source4/libcli/cliconnect.c
+++ b/source4/libcli/cliconnect.c
@@ -26,47 +26,58 @@
 #include "libcli/raw/raw_proto.h"
 #include "libcli/auth/libcli_auth.h"
 #include "libcli/smb_composite/smb_composite.h"
+#include "libcli/smb/smbXcli_base.h"
 
 /*
   wrapper around smbcli_sock_connect()
 */
 bool smbcli_socket_connect(struct smbcli_state *cli, const char *server, 
                           const char **ports, 
-                          struct event_context *ev_ctx,
+                          struct tevent_context *ev_ctx,
                           struct resolve_context *resolve_ctx,
                           struct smbcli_options *options,
-                          struct smb_iconv_convenience *iconv_convenience,
-               const char *socket_options)
+                          const char *socket_options,
+                          struct nbt_name *calling,
+                          struct nbt_name *called)
 {
-       struct smbcli_socket *sock;
-
-       sock = smbcli_sock_connect_byname(server, ports, NULL,
-                                         resolve_ctx, ev_ctx,
-                      socket_options);
+       NTSTATUS status;
 
-       if (sock == NULL) return false;
-       
-       cli->transport = smbcli_transport_init(sock, cli, true, options, 
-                                                                                  iconv_convenience);
-       if (!cli->transport) {
+       cli->options = *options;
+
+       status = smbcli_sock_connect(cli,
+                                    NULL, /* host_addr */
+                                    ports,
+                                    server,
+                                    resolve_ctx,
+                                    ev_ctx,
+                                    socket_options,
+                                    calling,
+                                    called,
+                                    &cli->sock);
+       if (!NT_STATUS_IS_OK(status)) {
                return false;
        }
 
        return true;
 }
 
-/* wrapper around smbcli_transport_connect() */
-bool smbcli_transport_establish(struct smbcli_state *cli, 
-                               struct nbt_name *calling,
-                               struct nbt_name *called)
-{
-       return smbcli_transport_connect(cli->transport, calling, called);
-}
-
 /* wrapper around smb_raw_negotiate() */
 NTSTATUS smbcli_negprot(struct smbcli_state *cli, bool unicode, int maxprotocol)
 {
-       return smb_raw_negotiate(cli->transport, unicode, maxprotocol);
+       if (unicode) {
+               cli->options.unicode = 1;
+       } else {
+               cli->options.unicode = 0;
+       }
+
+       cli->transport = smbcli_transport_init(cli->sock, cli,
+                                              true, &cli->options);
+       cli->sock = NULL;
+       if (!cli->transport) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       return smb_raw_negotiate(cli->transport, unicode, PROTOCOL_CORE, maxprotocol);
 }
 
 /* wrapper around smb_raw_sesssetup() */
@@ -114,7 +125,8 @@ NTSTATUS smbcli_tconX(struct smbcli_state *cli, const char *sharename,
 
        /* setup a tree connect */
        tcon.generic.level = RAW_TCON_TCONX;
-       tcon.tconx.in.flags = 0;
+       tcon.tconx.in.flags = TCONX_FLAG_EXTENDED_RESPONSE;
+       tcon.tconx.in.flags |= TCONX_FLAG_EXTENDED_SIGNATURES;
        if (cli->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
                tcon.tconx.in.password = data_blob(NULL, 0);
        } else if (cli->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
@@ -133,6 +145,10 @@ NTSTATUS smbcli_tconX(struct smbcli_state *cli, const char *sharename,
 
        cli->tree->tid = tcon.tconx.out.tid;
 
+       if (tcon.tconx.out.options & SMB_EXTENDED_SIGNATURES) {
+               smb1cli_session_protect_session_key(cli->tree->session->smbXcli);
+       }
+
        talloc_free(mem_ctx);
 
        return status;
@@ -151,10 +167,9 @@ NTSTATUS smbcli_full_connection(TALLOC_CTX *parent_ctx,
                                const char *socket_options,
                                struct cli_credentials *credentials,
                                struct resolve_context *resolve_ctx,
-                               struct event_context *ev,
+                               struct tevent_context *ev,
                                struct smbcli_options *options,
                                struct smbcli_session_options *session_options,
-                               struct smb_iconv_convenience *iconv_convenience,
                                struct gensec_settings *gensec_settings)
 {
        struct smbcli_tree *tree;
@@ -169,7 +184,6 @@ NTSTATUS smbcli_full_connection(TALLOC_CTX *parent_ctx,
                                             credentials, resolve_ctx, ev,
                                             options,
                                             session_options,
-                                                iconv_convenience,
                                                 gensec_settings);
        if (!NT_STATUS_IS_OK(status)) {
                goto done;
@@ -238,13 +252,13 @@ bool smbcli_parse_unc(const char *unc_name, TALLOC_CTX *mem_ctx,
 {
        char *p;
 
-       *hostname = *sharename = NULL;
-
        if (strncmp(unc_name, "\\\\", 2) &&
            strncmp(unc_name, "//", 2)) {
                return false;
        }
 
+       *hostname = *sharename = NULL;
+
        *hostname = talloc_strdup(mem_ctx, &unc_name[2]);
        p = terminate_path_at_separator(*hostname);