CVE-2016-2115: s4:libcli/raw: pass the minprotocol to smb_raw_negotiate*()
[samba.git] / source4 / libcli / smb_composite / connect.c
index d36bf2691410d4b3c0a95b4a322a154cb16ab933..fffa768ac977c2291dc44a0e0421e49849146f0d 100644 (file)
 #include "librpc/gen_ndr/ndr_nbt.h"
 #include "param/param.h"
 #include "lib/util/util_net.h"
+#include "libcli/smb/smbXcli_base.h"
 
 /* the stages of this call */
 enum connect_stage {CONNECT_SOCKET, 
-                   CONNECT_SESSION_REQUEST,
                    CONNECT_NEGPROT,
                    CONNECT_SESSION_SETUP,
                    CONNECT_SESSION_SETUP_ANON,
@@ -52,11 +52,14 @@ struct connect_state {
        struct smb_composite_sesssetup *io_setup;
        struct smbcli_request *req;
        struct composite_context *creq;
+       struct tevent_req *subreq;
+       struct nbt_name calling, called;
 };
 
 
 static void request_handler(struct smbcli_request *);
 static void composite_handler(struct composite_context *);
+static void subreq_handler(struct tevent_req *subreq);
 
 /*
   a tree connect request has completed
@@ -70,6 +73,10 @@ static NTSTATUS connect_tcon(struct composite_context *c,
        status = smb_raw_tcon_recv(state->req, c, state->io_tcon);
        NT_STATUS_NOT_OK_RETURN(status);
 
+       if (state->io_tcon->tconx.out.options & SMB_EXTENDED_SIGNATURES) {
+               smb1cli_session_protect_session_key(io->out.tree->session->smbXcli);
+       }
+
        io->out.tree->tid = state->io_tcon->tconx.out.tid;
        if (state->io_tcon->tconx.out.dev_type) {
                io->out.tree->device = talloc_strdup(io->out.tree, 
@@ -108,7 +115,7 @@ static NTSTATUS connect_session_setup_anon(struct composite_context *c,
 
        /* connect to a share using a tree connect */
        state->io_tcon->generic.level = RAW_TCON_TCONX;
-       state->io_tcon->tconx.in.flags = 0;
+       state->io_tcon->tconx.in.flags = TCONX_FLAG_EXTENDED_RESPONSE;
        state->io_tcon->tconx.in.password = data_blob(NULL, 0); 
        
        state->io_tcon->tconx.in.path = talloc_asprintf(state->io_tcon, 
@@ -161,7 +168,6 @@ static NTSTATUS connect_session_setup(struct composite_context *c,
                 * have been given a uid in the NTLMSSP_CHALLENGE reply. This
                 * would lead to an invalid uid in the anonymous fallback */
                state->session->vuid = 0;
-               data_blob_free(&state->session->user_session_key);
                talloc_free(state->session->gensec);
                state->session->gensec = NULL;
 
@@ -194,7 +200,8 @@ static NTSTATUS connect_session_setup(struct composite_context *c,
 
        /* connect to a share using a tree connect */
        state->io_tcon->generic.level = RAW_TCON_TCONX;
-       state->io_tcon->tconx.in.flags = 0;
+       state->io_tcon->tconx.in.flags = TCONX_FLAG_EXTENDED_RESPONSE;
+       state->io_tcon->tconx.in.flags |= TCONX_FLAG_EXTENDED_SIGNATURES;
        state->io_tcon->tconx.in.password = data_blob(NULL, 0); 
        
        state->io_tcon->tconx.in.path = talloc_asprintf(state->io_tcon, 
@@ -230,7 +237,8 @@ static NTSTATUS connect_negprot(struct composite_context *c,
        struct connect_state *state = talloc_get_type(c->private_data, struct connect_state);
        NTSTATUS status;
 
-       status = smb_raw_negotiate_recv(state->req);
+       status = smb_raw_negotiate_recv(state->subreq);
+       TALLOC_FREE(state->subreq);
        NT_STATUS_NOT_OK_RETURN(status);
 
        /* next step is a session setup */
@@ -281,31 +289,21 @@ static NTSTATUS connect_send_negprot(struct composite_context *c,
 {
        struct connect_state *state = talloc_get_type(c->private_data, struct connect_state);
 
-       state->req = smb_raw_negotiate_send(state->transport, io->in.options.unicode, io->in.options.max_protocol);
-       NT_STATUS_HAVE_NO_MEMORY(state->req);
+       /* the socket is up - we can initialise the smbcli transport layer */
+       state->transport = smbcli_transport_init(state->sock, state, true,
+                                                &io->in.options);
+       NT_STATUS_HAVE_NO_MEMORY(state->transport);
 
-       state->req->async.fn = request_handler;
-       state->req->async.private_data = c;
+       state->subreq = smb_raw_negotiate_send(state,
+                                              state->transport->ev,
+                                              state->transport,
+                                              state->transport->options.min_protocol,
+                                              state->transport->options.max_protocol);
+       NT_STATUS_HAVE_NO_MEMORY(state->subreq);
+       tevent_req_set_callback(state->subreq, subreq_handler, c);
        state->stage = CONNECT_NEGPROT;
-       
-       return NT_STATUS_OK;
-}
-
 
-/*
-  a session request operation has completed
-*/
-static NTSTATUS connect_session_request(struct composite_context *c, 
-                                       struct smb_composite_connect *io)
-{
-       struct connect_state *state = talloc_get_type(c->private_data, struct connect_state);
-       NTSTATUS status;
-
-       status = smbcli_transport_connect_recv(state->req);
-       NT_STATUS_NOT_OK_RETURN(status);
-
-       /* next step is a negprot */
-       return connect_send_negprot(c, io);
+       return NT_STATUS_OK;
 }
 
 /*
@@ -316,16 +314,10 @@ static NTSTATUS connect_socket(struct composite_context *c,
 {
        struct connect_state *state = talloc_get_type(c->private_data, struct connect_state);
        NTSTATUS status;
-       struct nbt_name calling, called;
 
        status = smbcli_sock_connect_recv(state->creq, state, &state->sock);
        NT_STATUS_NOT_OK_RETURN(status);
 
-       /* the socket is up - we can initialise the smbcli transport layer */
-       state->transport = smbcli_transport_init(state->sock, state, true, 
-                                                &io->in.options);
-       NT_STATUS_HAVE_NO_MEMORY(state->transport);
-
        if (is_ipaddress(state->sock->hostname) &&
            (state->io->in.called_name != NULL)) {
                /* If connecting to an IP address, we might want the real name
@@ -336,28 +328,8 @@ static NTSTATUS connect_socket(struct composite_context *c,
                NT_STATUS_HAVE_NO_MEMORY(state->sock->hostname);
        }
 
-       make_nbt_name_client(&calling, cli_credentials_get_workstation(io->in.credentials));
-
-       nbt_choose_called_name(state, &called, io->in.called_name, NBT_NAME_SERVER);
-
-       /* we have a connected socket - next step is a session
-          request, if needed. Port 445 doesn't need it, so it goes
-          straight to the negprot */
-       if (state->sock->port == 445) {
-               status = nbt_name_dup(state->transport, &called, 
-                                     &state->transport->called);
-               NT_STATUS_NOT_OK_RETURN(status);
-               return connect_send_negprot(c, io);
-       }
-
-       state->req = smbcli_transport_connect_send(state->transport, &calling, &called);
-       NT_STATUS_HAVE_NO_MEMORY(state->req);
-
-       state->req->async.fn = request_handler;
-       state->req->async.private_data = c;
-       state->stage = CONNECT_SESSION_REQUEST;
-
-       return NT_STATUS_OK;
+       /* next step is a negprot */
+       return connect_send_negprot(c, io);
 }
 
 
@@ -372,9 +344,6 @@ static void state_handler(struct composite_context *c)
        case CONNECT_SOCKET:
                c->status = connect_socket(c, state->io);
                break;
-       case CONNECT_SESSION_REQUEST:
-               c->status = connect_session_request(c, state->io);
-               break;
        case CONNECT_NEGPROT:
                c->status = connect_negprot(c, state->io);
                break;
@@ -420,6 +389,17 @@ static void composite_handler(struct composite_context *creq)
        state_handler(c);
 }
 
+/*
+  handler for completion of a tevent_req sub-request
+*/
+static void subreq_handler(struct tevent_req *subreq)
+{
+       struct composite_context *c =
+               tevent_req_callback_data(subreq,
+               struct composite_context);
+       state_handler(c);
+}
+
 /*
   a function to establish a smbcli_tree from scratch
 */
@@ -446,12 +426,20 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec
        c->state = COMPOSITE_STATE_IN_PROGRESS;
        c->private_data = state;
 
+       make_nbt_name_client(&state->calling,
+                            cli_credentials_get_workstation(io->in.credentials));
+
+       nbt_choose_called_name(state, &state->called,
+                              io->in.called_name, NBT_NAME_SERVER);
+
        state->creq = smbcli_sock_connect_send(state, 
                                               NULL,
                                               io->in.dest_ports,
                                               io->in.dest_host, 
                                               resolve_ctx, c->event_ctx, 
-                                              io->in.socket_options);
+                                              io->in.socket_options,
+                                              &state->calling,
+                                              &state->called);
        if (state->creq == NULL) goto failed;
 
        state->stage = CONNECT_SOCKET;