This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
a composite API for making handling a generic async session setup
#include "libcli/raw/libcliraw.h"
#include "libcli/composite/composite.h"
#include "libcli/smb_composite/smb_composite.h"
+#include "libcli/auth/libcli_auth.h"
#include "auth/auth.h"
+#include "auth/gensec/gensec.h"
+#include "auth/credentials/credentials.h"
#include "version.h"
+#include "param/param.h"
struct sesssetup_state {
union smb_sesssetup setup;
struct smbcli_request *req;
};
-
-/*
- form an encrypted lanman password from a plaintext password
- and the server supplied challenge
-*/
-static DATA_BLOB lanman_blob(TALLOC_CTX *mem_ctx, const char *pass, DATA_BLOB challenge)
+static int sesssetup_state_destructor(struct sesssetup_state *state)
{
- DATA_BLOB blob = data_blob_talloc(mem_ctx, NULL, 24);
- SMBencrypt(pass, challenge.data, blob.data);
- return blob;
-}
+ if (state->req) {
+ talloc_free(state->req);
+ state->req = NULL;
+ }
-/*
- form an encrypted NT password from a plaintext password
- and the server supplied challenge
-*/
-static DATA_BLOB nt_blob(TALLOC_CTX *mem_ctx, const struct samr_Password *nt_hash, DATA_BLOB challenge)
-{
- DATA_BLOB blob = data_blob_talloc(mem_ctx, NULL, 24);
- SMBOWFencrypt(nt_hash->hash, challenge.data, blob.data);
- return blob;
+ return 0;
}
+static NTSTATUS session_setup_old(struct composite_context *c,
+ struct smbcli_session *session,
+ struct smb_composite_sesssetup *io,
+ struct smbcli_request **req);
+static NTSTATUS session_setup_nt1(struct composite_context *c,
+ struct smbcli_session *session,
+ struct smb_composite_sesssetup *io,
+ struct smbcli_request **req);
+static NTSTATUS session_setup_spnego(struct composite_context *c,
+ struct smbcli_session *session,
+ struct smb_composite_sesssetup *io,
+ struct smbcli_request **req);
+
/*
store the user session key for a transport
*/
*/
static void request_handler(struct smbcli_request *req)
{
- struct composite_context *c = req->async.private;
+ struct composite_context *c = (struct composite_context *)req->async.private;
struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
struct smbcli_session *session = req->session;
DATA_BLOB session_key = data_blob(NULL, 0);
DATA_BLOB null_data_blob = data_blob(NULL, 0);
- NTSTATUS session_key_err;
+ NTSTATUS session_key_err, nt_status;
c->status = smb_raw_sesssetup_recv(req, state, &state->setup);
+ state->req = NULL;
switch (state->setup.old.level) {
case RAW_SESSSETUP_OLD:
state->io->out.vuid = state->setup.old.out.vuid;
+ /* This doesn't work, as this only happens on old
+ * protocols, where this comparison won't match. */
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ /* we neet to reset the vuid for a new try */
+ session->vuid = 0;
+ if (cli_credentials_wrong_password(state->io->in.credentials)) {
+ nt_status = session_setup_old(c, session,
+ state->io,
+ &state->req);
+ if (NT_STATUS_IS_OK(nt_status)) {
+ c->status = nt_status;
+ composite_continue_smb(c, state->req, request_handler, c);
+ return;
+ }
+ }
+ }
break;
case RAW_SESSSETUP_NT1:
state->io->out.vuid = state->setup.nt1.out.vuid;
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ /* we neet to reset the vuid for a new try */
+ session->vuid = 0;
+ if (cli_credentials_wrong_password(state->io->in.credentials)) {
+ nt_status = session_setup_nt1(c, session,
+ state->io,
+ &state->req);
+ if (NT_STATUS_IS_OK(nt_status)) {
+ c->status = nt_status;
+ composite_continue_smb(c, state->req, request_handler, c);
+ return;
+ }
+ }
+ }
break;
case RAW_SESSSETUP_SPNEGO:
- session->vuid = state->io->out.vuid = state->setup.spnego.out.vuid;
+ state->io->out.vuid = state->setup.spnego.out.vuid;
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ /* we need to reset the vuid for a new try */
+ session->vuid = 0;
+ if (cli_credentials_wrong_password(state->io->in.credentials)) {
+ nt_status = session_setup_spnego(c, session,
+ state->io,
+ &state->req);
+ if (NT_STATUS_IS_OK(nt_status)) {
+ c->status = nt_status;
+ composite_continue_smb(c, state->req, request_handler, c);
+ return;
+ }
+ }
+ }
if (!NT_STATUS_EQUAL(c->status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
!NT_STATUS_IS_OK(c->status)) {
break;
} else {
state->setup.spnego.in.secblob = data_blob(NULL, 0);
}
-
+
/* we need to do another round of session setup. We keep going until both sides
are happy */
session_key_err = gensec_session_key(session->gensec, &session_key);
}
if (state->setup.spnego.in.secblob.length) {
+ /*
+ * set the session->vuid value only for calling
+ * smb_raw_sesssetup_send()
+ */
+ uint16_t vuid = session->vuid;
+ session->vuid = state->io->out.vuid;
state->req = smb_raw_sesssetup_send(session, &state->setup);
- state->req->async.fn = request_handler;
- state->req->async.private = c;
+ session->vuid = vuid;
+ composite_continue_smb(c, state->req, request_handler, c);
return;
}
+ break;
+
+ case RAW_SESSSETUP_SMB2:
+ c->status = NT_STATUS_INTERNAL_ERROR;
+ break;
}
/* enforce the local signing required flag */
}
}
- if (NT_STATUS_IS_OK(c->status)) {
- c->state = COMPOSITE_STATE_DONE;
- } else {
- c->state = COMPOSITE_STATE_ERROR;
- }
- if (c->async.fn) {
- c->async.fn(c);
+ if (!NT_STATUS_IS_OK(c->status)) {
+ composite_error(c, c->status);
+ return;
}
+
+ composite_done(c);
}
struct smb_composite_sesssetup *io,
struct smbcli_request **req)
{
+ NTSTATUS nt_status;
struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
- const struct samr_Password *nt_hash = cli_credentials_get_nt_hash(io->in.credentials, state);
const char *password = cli_credentials_get_password(io->in.credentials);
+ DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, session->transport->socket->hostname, lp_workgroup(global_loadparm));
+ DATA_BLOB session_key;
+ int flags = CLI_CRED_NTLM_AUTH;
+ if (lp_client_lanman_auth(global_loadparm)) {
+ flags |= CLI_CRED_LANMAN_AUTH;
+ }
+
+ if (lp_client_ntlmv2_auth(global_loadparm)) {
+ flags |= CLI_CRED_NTLMv2_AUTH;
+ }
state->setup.nt1.level = RAW_SESSSETUP_NT1;
state->setup.nt1.in.bufsize = session->transport->options.max_xmit;
state->setup.nt1.in.capabilities = io->in.capabilities;
state->setup.nt1.in.os = "Unix";
state->setup.nt1.in.lanman = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
+
cli_credentials_get_ntlm_username_domain(io->in.credentials, state,
&state->setup.nt1.in.user,
&state->setup.nt1.in.domain);
+
- if (!password) {
- state->setup.nt1.in.password1 = data_blob(NULL, 0);
- state->setup.nt1.in.password2 = data_blob(NULL, 0);
- } else if (session->transport->negotiate.sec_mode &
- NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
- DATA_BLOB session_key;
- if (lp_client_ntlmv2_auth()) {
- DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, lp_netbios_name(), lp_workgroup());
- DATA_BLOB lmv2_response, ntlmv2_response, lmv2_session_key;
-
- if (!SMBNTLMv2encrypt_hash(state,
- state->setup.nt1.in.user, state->setup.nt1.in.domain,
- nt_hash->hash, &session->transport->negotiate.secblob,
- &names_blob,
- &lmv2_response, &ntlmv2_response,
- &lmv2_session_key, &session_key)) {
- data_blob_free(&names_blob);
- return NT_STATUS_NO_MEMORY;
- }
- data_blob_free(&names_blob);
- state->setup.nt1.in.password1 = lmv2_response;
- state->setup.nt1.in.password2 = ntlmv2_response;
-
- smbcli_transport_simple_set_signing(session->transport, session_key,
- state->setup.nt1.in.password2);
- set_user_session_key(session, &session_key);
-
- data_blob_free(&lmv2_session_key);
- data_blob_free(&session_key);
- } else {
-
- state->setup.nt1.in.password2 = nt_blob(state, nt_hash,
- session->transport->negotiate.secblob);
- if (lp_client_lanman_auth()) {
- state->setup.nt1.in.password1 = lanman_blob(state, password,
- session->transport->negotiate.secblob);
- } else {
- /* if not sending the LM password, send the NT password twice */
- state->setup.nt1.in.password1 = state->setup.nt1.in.password2;
- }
-
- session_key = data_blob_talloc(session, NULL, 16);
- SMBsesskeygen_ntv1(nt_hash->hash, session_key.data);
- smbcli_transport_simple_set_signing(session->transport, session_key,
- state->setup.nt1.in.password2);
- set_user_session_key(session, &session_key);
-
- data_blob_free(&session_key);
- }
-
- } else if (lp_client_plaintext_auth()) {
+ if (session->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
+ nt_status = cli_credentials_get_ntlm_response(io->in.credentials, state,
+ &flags,
+ session->transport->negotiate.secblob,
+ names_blob,
+ &state->setup.nt1.in.password1,
+ &state->setup.nt1.in.password2,
+ NULL, &session_key);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+
+ smbcli_transport_simple_set_signing(session->transport, session_key,
+ state->setup.nt1.in.password2);
+ set_user_session_key(session, &session_key);
+
+ data_blob_free(&session_key);
+ } else if (lp_client_plaintext_auth(global_loadparm)) {
state->setup.nt1.in.password1 = data_blob_talloc(state, password, strlen(password));
state->setup.nt1.in.password2 = data_blob(NULL, 0);
} else {
struct smb_composite_sesssetup *io,
struct smbcli_request **req)
{
+ NTSTATUS nt_status;
struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
const char *password = cli_credentials_get_password(io->in.credentials);
+ DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, session->transport->socket->hostname, lp_workgroup(global_loadparm));
+ DATA_BLOB session_key;
+ int flags = 0;
+ if (lp_client_lanman_auth(global_loadparm)) {
+ flags |= CLI_CRED_LANMAN_AUTH;
+ }
+
+ if (lp_client_ntlmv2_auth(global_loadparm)) {
+ flags |= CLI_CRED_NTLMv2_AUTH;
+ }
state->setup.old.level = RAW_SESSSETUP_OLD;
state->setup.old.in.bufsize = session->transport->options.max_xmit;
&state->setup.old.in.user,
&state->setup.old.in.domain);
- if (!password) {
- state->setup.old.in.password = data_blob(NULL, 0);
- } else if (session->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
- state->setup.old.in.password = lanman_blob(state, password,
- session->transport->negotiate.secblob);
+ if (session->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
+ nt_status = cli_credentials_get_ntlm_response(io->in.credentials, state,
+ &flags,
+ session->transport->negotiate.secblob,
+ names_blob,
+ &state->setup.old.in.password,
+ NULL,
+ NULL, &session_key);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+ set_user_session_key(session, &session_key);
+
+ data_blob_free(&session_key);
+ } else if (lp_client_plaintext_auth(global_loadparm)) {
+ state->setup.old.in.password = data_blob_talloc(state, password, strlen(password));
} else {
- state->setup.old.in.password = data_blob_talloc(state,
- password,
- strlen(password));
+ /* could match windows client and return 'cannot logon from this workstation', but it just confuses everybody */
+ return NT_STATUS_INVALID_PARAMETER;
}
*req = smb_raw_sesssetup_send(session, &state->setup);
state->setup.spnego.in.lanman = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
state->setup.spnego.in.workgroup = io->in.workgroup;
- state->setup.spnego.out.vuid = session->vuid;
-
smbcli_temp_set_signing(session->transport);
- status = gensec_client_start(session, &session->gensec, c->event_ctx);
+ status = gensec_client_start(session, &session->gensec, c->event_ctx,
+ global_loadparm);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to start GENSEC client mode: %s\n", nt_errstr(status)));
return status;
status = gensec_set_credentials(session->gensec, io->in.credentials);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to start set GENSEC client credentails: %s\n",
+ DEBUG(1, ("Failed to start set GENSEC client credentials: %s\n",
nt_errstr(status)));
return status;
}
if (session->transport->negotiate.secblob.length) {
chosen_oid = GENSEC_OID_SPNEGO;
+ status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Failed to start set GENSEC client mechanism %s: %s\n",
+ gensec_get_name_by_oid(chosen_oid), nt_errstr(status)));
+ chosen_oid = GENSEC_OID_NTLMSSP;
+ status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Failed to start set (fallback) GENSEC client mechanism %s: %s\n",
+ gensec_get_name_by_oid(chosen_oid), nt_errstr(status)));
+ return status;
+ }
+ }
} else {
/* without a sec blob, means raw NTLMSSP */
chosen_oid = GENSEC_OID_NTLMSSP;
+ status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Failed to start set GENSEC client mechanism %s: %s\n",
+ gensec_get_name_by_oid(chosen_oid), nt_errstr(status)));
+ }
}
- status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to start set GENSEC client SPNEGO mechanism %s: %s\n",
- gensec_get_name_by_oid(chosen_oid), nt_errstr(status)));
- return status;
+ if ((const void *)chosen_oid == (const void *)GENSEC_OID_SPNEGO) {
+ status = gensec_update(session->gensec, state,
+ session->transport->negotiate.secblob,
+ &state->setup.spnego.in.secblob);
+ } else {
+ status = gensec_update(session->gensec, state,
+ data_blob(NULL, 0),
+ &state->setup.spnego.in.secblob);
+
}
-
- status = gensec_update(session->gensec, state,
- session->transport->negotiate.secblob,
- &state->setup.spnego.in.secblob);
+
if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed initial gensec_update with mechanism %s: %s\n",
struct sesssetup_state *state;
NTSTATUS status;
- c = talloc_zero(session, struct composite_context);
+ c = composite_create(session, session->transport->socket->event.ctx);
if (c == NULL) return NULL;
- state = talloc(c, struct sesssetup_state);
- if (state == NULL) {
- c->state = COMPOSITE_STATE_ERROR;
- c->status = NT_STATUS_NO_MEMORY;
- }
+ state = talloc_zero(c, struct sesssetup_state);
+ if (composite_nomem(state, c)) return c;
+ c->private_data = state;
state->io = io;
- c->state = COMPOSITE_STATE_IN_PROGRESS;
- c->private_data = state;
- c->event_ctx = session->transport->socket->event.ctx;
+ talloc_set_destructor(state, sesssetup_state_destructor);
/* no session setup at all in earliest protocol varients */
if (session->transport->negotiate.protocol < PROTOCOL_LANMAN1) {
ZERO_STRUCT(io->out);
- c->state = COMPOSITE_STATE_DONE;
+ composite_done(c);
return c;
}
if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
NT_STATUS_IS_OK(status)) {
- state->req->async.fn = request_handler;
- state->req->async.private = c;
+ composite_continue_smb(c, state->req, request_handler, c);
return c;
}
- c->state = COMPOSITE_STATE_ERROR;
- c->status = status;
+ composite_error(c, status);
return c;
}
git.samba.org / ira / wip.git / blobdiff