2 Unix SMB/CIFS implementation.
4 Copyright (C) Andrew Tridgell 2005
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 a composite API for making handling a generic async session setup
24 #include "libcli/raw/libcliraw.h"
25 #include "libcli/raw/raw_proto.h"
26 #include "libcli/composite/composite.h"
27 #include "libcli/smb_composite/smb_composite.h"
28 #include "libcli/auth/libcli_auth.h"
29 #include "auth/auth.h"
30 #include "auth/gensec/gensec.h"
31 #include "auth/credentials/credentials.h"
33 #include "param/param.h"
35 struct sesssetup_state {
36 union smb_sesssetup setup;
37 NTSTATUS remote_status;
38 NTSTATUS gensec_status;
39 struct smb_composite_sesssetup *io;
40 struct smbcli_request *req;
43 static int sesssetup_state_destructor(struct sesssetup_state *state)
46 talloc_free(state->req);
53 static NTSTATUS session_setup_old(struct composite_context *c,
54 struct smbcli_session *session,
55 struct smb_composite_sesssetup *io,
56 struct smbcli_request **req);
57 static NTSTATUS session_setup_nt1(struct composite_context *c,
58 struct smbcli_session *session,
59 struct smb_composite_sesssetup *io,
60 struct smbcli_request **req);
61 static NTSTATUS session_setup_spnego(struct composite_context *c,
62 struct smbcli_session *session,
63 struct smb_composite_sesssetup *io,
64 struct smbcli_request **req);
67 store the user session key for a transport
69 static void set_user_session_key(struct smbcli_session *session,
70 const DATA_BLOB *session_key)
72 session->user_session_key = data_blob_talloc(session,
78 handler for completion of a smbcli_request sub-request
80 static void request_handler(struct smbcli_request *req)
82 struct composite_context *c = (struct composite_context *)req->async.private_data;
83 struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
84 struct smbcli_session *session = req->session;
85 DATA_BLOB null_data_blob = data_blob(NULL, 0);
86 NTSTATUS session_key_err, nt_status;
87 struct smbcli_request *check_req = NULL;
88 const char *os = NULL;
89 const char *lanman = NULL;
91 if (req->sign_caller_checks) {
92 req->do_not_free = true;
96 state->remote_status = smb_raw_sesssetup_recv(req, state, &state->setup);
97 c->status = state->remote_status;
101 * we only need to check the signature if the
102 * NT_STATUS_OK is returned
104 if (!NT_STATUS_IS_OK(state->remote_status)) {
105 talloc_free(check_req);
109 switch (state->setup.old.level) {
110 case RAW_SESSSETUP_OLD:
111 state->io->out.vuid = state->setup.old.out.vuid;
112 /* This doesn't work, as this only happens on old
113 * protocols, where this comparison won't match. */
114 if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
115 /* we neet to reset the vuid for a new try */
117 if (cli_credentials_wrong_password(state->io->in.credentials)) {
118 nt_status = session_setup_old(c, session,
121 if (NT_STATUS_IS_OK(nt_status)) {
122 talloc_free(check_req);
123 c->status = nt_status;
124 composite_continue_smb(c, state->req, request_handler, c);
129 os = state->setup.old.out.os;
130 lanman = state->setup.old.out.lanman;
133 case RAW_SESSSETUP_NT1:
134 state->io->out.vuid = state->setup.nt1.out.vuid;
135 if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
136 /* we neet to reset the vuid for a new try */
138 if (cli_credentials_wrong_password(state->io->in.credentials)) {
139 nt_status = session_setup_nt1(c, session,
142 if (NT_STATUS_IS_OK(nt_status)) {
143 talloc_free(check_req);
144 c->status = nt_status;
145 composite_continue_smb(c, state->req, request_handler, c);
150 os = state->setup.nt1.out.os;
151 lanman = state->setup.nt1.out.lanman;
154 case RAW_SESSSETUP_SPNEGO:
155 state->io->out.vuid = state->setup.spnego.out.vuid;
156 if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
157 /* we need to reset the vuid for a new try */
159 if (cli_credentials_wrong_password(state->io->in.credentials)) {
160 nt_status = session_setup_spnego(c, session,
163 if (NT_STATUS_IS_OK(nt_status)) {
164 talloc_free(check_req);
165 c->status = nt_status;
166 composite_continue_smb(c, state->req, request_handler, c);
171 if (!NT_STATUS_EQUAL(c->status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
172 !NT_STATUS_IS_OK(c->status)) {
175 if (NT_STATUS_EQUAL(state->gensec_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
177 /* The status value here, from the earlier pass at GENSEC is
178 * vital to the security of the system. Even if the other end
179 * accepts, if GENSEC claims 'MORE_PROCESSING_REQUIRED' then
180 * you must keep feeding it blobs, or else the remote
181 * host/attacker might avoid mutal authentication
184 state->gensec_status = gensec_update(session->gensec, state,
185 state->setup.spnego.out.secblob,
186 &state->setup.spnego.in.secblob);
187 c->status = state->gensec_status;
188 if (!NT_STATUS_EQUAL(c->status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
189 !NT_STATUS_IS_OK(c->status)) {
193 state->setup.spnego.in.secblob = data_blob(NULL, 0);
196 if (NT_STATUS_IS_OK(state->remote_status)) {
197 if (state->setup.spnego.in.secblob.length) {
198 c->status = NT_STATUS_INTERNAL_ERROR;
201 session_key_err = gensec_session_key(session->gensec, session, &session->user_session_key);
202 if (NT_STATUS_IS_OK(session_key_err)) {
203 smbcli_transport_simple_set_signing(session->transport, session->user_session_key, null_data_blob);
207 if (state->setup.spnego.in.secblob.length) {
209 * set the session->vuid value only for calling
210 * smb_raw_sesssetup_send()
212 uint16_t vuid = session->vuid;
213 session->vuid = state->io->out.vuid;
214 state->req = smb_raw_sesssetup_send(session, &state->setup);
215 session->vuid = vuid;
217 state->req->sign_caller_checks = true;
219 composite_continue_smb(c, state->req, request_handler, c);
222 os = state->setup.spnego.out.os;
223 lanman = state->setup.spnego.out.lanman;
226 case RAW_SESSSETUP_SMB2:
227 c->status = NT_STATUS_INTERNAL_ERROR;
232 check_req->sign_caller_checks = false;
233 if (!smbcli_request_check_sign_mac(check_req)) {
234 c->status = NT_STATUS_ACCESS_DENIED;
236 talloc_free(check_req);
240 /* enforce the local signing required flag */
241 if (NT_STATUS_IS_OK(c->status) && !cli_credentials_is_anonymous(state->io->in.credentials)) {
242 if (!session->transport->negotiate.sign_info.doing_signing
243 && session->transport->negotiate.sign_info.mandatory_signing) {
244 DEBUG(0, ("SMB signing required, but server does not support it\n"));
245 c->status = NT_STATUS_ACCESS_DENIED;
249 if (!NT_STATUS_IS_OK(c->status)) {
250 composite_error(c, c->status);
255 session->os = talloc_strdup(session, os);
256 if (composite_nomem(session->os, c)) return;
261 session->lanman = talloc_strdup(session, lanman);
262 if (composite_nomem(session->lanman, c)) return;
264 session->lanman = NULL;
272 send a nt1 style session setup
274 static NTSTATUS session_setup_nt1(struct composite_context *c,
275 struct smbcli_session *session,
276 struct smb_composite_sesssetup *io,
277 struct smbcli_request **req)
279 NTSTATUS nt_status = NT_STATUS_INTERNAL_ERROR;
280 struct sesssetup_state *state = talloc_get_type(c->private_data,
281 struct sesssetup_state);
282 const char *domain = cli_credentials_get_domain(io->in.credentials);
285 * domain controllers tend to reject the NTLM v2 blob
286 * if the netbiosname is not valid (e.g. IP address or FQDN)
287 * so just leave it away (as Windows client do)
289 DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, NULL, domain);
291 DATA_BLOB session_key = data_blob(NULL, 0);
292 int flags = CLI_CRED_NTLM_AUTH;
294 smbcli_temp_set_signing(session->transport);
296 if (session->options.lanman_auth) {
297 flags |= CLI_CRED_LANMAN_AUTH;
300 if (session->options.ntlmv2_auth) {
301 flags |= CLI_CRED_NTLMv2_AUTH;
304 state->setup.nt1.level = RAW_SESSSETUP_NT1;
305 state->setup.nt1.in.bufsize = session->transport->options.max_xmit;
306 state->setup.nt1.in.mpx_max = session->transport->options.max_mux;
307 state->setup.nt1.in.vc_num = 1;
308 state->setup.nt1.in.sesskey = io->in.sesskey;
309 state->setup.nt1.in.capabilities = io->in.capabilities;
310 state->setup.nt1.in.os = "Unix";
311 state->setup.nt1.in.lanman = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
313 cli_credentials_get_ntlm_username_domain(io->in.credentials, state,
314 &state->setup.nt1.in.user,
315 &state->setup.nt1.in.domain);
318 if (session->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
319 nt_status = cli_credentials_get_ntlm_response(io->in.credentials, state,
321 session->transport->negotiate.secblob,
323 &state->setup.nt1.in.password1,
324 &state->setup.nt1.in.password2,
326 NT_STATUS_NOT_OK_RETURN(nt_status);
327 } else if (session->options.plaintext_auth) {
328 const char *password = cli_credentials_get_password(io->in.credentials);
329 state->setup.nt1.in.password1 = data_blob_talloc(state, password, strlen(password));
330 state->setup.nt1.in.password2 = data_blob(NULL, 0);
332 /* could match windows client and return 'cannot logon from this workstation', but it just confuses everybody */
333 return NT_STATUS_INVALID_PARAMETER;
336 *req = smb_raw_sesssetup_send(session, &state->setup);
338 return NT_STATUS_NO_MEMORY;
341 if (NT_STATUS_IS_OK(nt_status)) {
342 smbcli_transport_simple_set_signing(session->transport, session_key,
343 state->setup.nt1.in.password2);
344 set_user_session_key(session, &session_key);
346 data_blob_free(&session_key);
349 return (*req)->status;
354 old style session setup (pre NT1 protocol level)
356 static NTSTATUS session_setup_old(struct composite_context *c,
357 struct smbcli_session *session,
358 struct smb_composite_sesssetup *io,
359 struct smbcli_request **req)
362 struct sesssetup_state *state = talloc_get_type(c->private_data,
363 struct sesssetup_state);
364 const char *password = cli_credentials_get_password(io->in.credentials);
365 const char *domain = cli_credentials_get_domain(io->in.credentials);
368 * domain controllers tend to reject the NTLM v2 blob
369 * if the netbiosname is not valid (e.g. IP address or FQDN)
370 * so just leave it away (as Windows client do)
372 DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, NULL, domain);
374 DATA_BLOB session_key;
376 if (session->options.lanman_auth) {
377 flags |= CLI_CRED_LANMAN_AUTH;
380 if (session->options.ntlmv2_auth) {
381 flags |= CLI_CRED_NTLMv2_AUTH;
384 state->setup.old.level = RAW_SESSSETUP_OLD;
385 state->setup.old.in.bufsize = session->transport->options.max_xmit;
386 state->setup.old.in.mpx_max = session->transport->options.max_mux;
387 state->setup.old.in.vc_num = 1;
388 state->setup.old.in.sesskey = io->in.sesskey;
389 state->setup.old.in.os = "Unix";
390 state->setup.old.in.lanman = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
391 cli_credentials_get_ntlm_username_domain(io->in.credentials, state,
392 &state->setup.old.in.user,
393 &state->setup.old.in.domain);
395 if (session->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
396 nt_status = cli_credentials_get_ntlm_response(io->in.credentials, state,
398 session->transport->negotiate.secblob,
400 &state->setup.old.in.password,
403 NT_STATUS_NOT_OK_RETURN(nt_status);
404 set_user_session_key(session, &session_key);
406 data_blob_free(&session_key);
407 } else if (session->options.plaintext_auth) {
408 state->setup.old.in.password = data_blob_talloc(state, password, strlen(password));
410 /* could match windows client and return 'cannot logon from this workstation', but it just confuses everybody */
411 return NT_STATUS_INVALID_PARAMETER;
414 *req = smb_raw_sesssetup_send(session, &state->setup);
416 return NT_STATUS_NO_MEMORY;
418 return (*req)->status;
423 Modern, all singing, all dancing extended security (and possibly SPNEGO) request
425 static NTSTATUS session_setup_spnego(struct composite_context *c,
426 struct smbcli_session *session,
427 struct smb_composite_sesssetup *io,
428 struct smbcli_request **req)
430 struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
432 const char *chosen_oid = NULL;
434 state->setup.spnego.level = RAW_SESSSETUP_SPNEGO;
435 state->setup.spnego.in.bufsize = session->transport->options.max_xmit;
436 state->setup.spnego.in.mpx_max = session->transport->options.max_mux;
437 state->setup.spnego.in.vc_num = 1;
438 state->setup.spnego.in.sesskey = io->in.sesskey;
439 state->setup.spnego.in.capabilities = io->in.capabilities;
440 state->setup.spnego.in.os = "Unix";
441 state->setup.spnego.in.lanman = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
442 state->setup.spnego.in.workgroup = io->in.workgroup;
444 smbcli_temp_set_signing(session->transport);
446 status = gensec_client_start(session, &session->gensec, c->event_ctx,
447 io->in.gensec_settings);
448 if (!NT_STATUS_IS_OK(status)) {
449 DEBUG(1, ("Failed to start GENSEC client mode: %s\n", nt_errstr(status)));
453 gensec_want_feature(session->gensec, GENSEC_FEATURE_SESSION_KEY);
455 status = gensec_set_credentials(session->gensec, io->in.credentials);
456 if (!NT_STATUS_IS_OK(status)) {
457 DEBUG(1, ("Failed to start set GENSEC client credentials: %s\n",
462 status = gensec_set_target_hostname(session->gensec, session->transport->socket->hostname);
463 if (!NT_STATUS_IS_OK(status)) {
464 DEBUG(1, ("Failed to start set GENSEC target hostname: %s\n",
469 status = gensec_set_target_service(session->gensec, "cifs");
470 if (!NT_STATUS_IS_OK(status)) {
471 DEBUG(1, ("Failed to start set GENSEC target service: %s\n",
476 if (session->transport->negotiate.secblob.length) {
477 chosen_oid = GENSEC_OID_SPNEGO;
478 status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
479 if (!NT_STATUS_IS_OK(status)) {
480 DEBUG(1, ("Failed to start set GENSEC client mechanism %s: %s\n",
481 gensec_get_name_by_oid(session->gensec, chosen_oid), nt_errstr(status)));
482 chosen_oid = GENSEC_OID_NTLMSSP;
483 status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
484 if (!NT_STATUS_IS_OK(status)) {
485 DEBUG(1, ("Failed to start set (fallback) GENSEC client mechanism %s: %s\n",
486 gensec_get_name_by_oid(session->gensec, chosen_oid),
492 /* without a sec blob, means raw NTLMSSP */
493 chosen_oid = GENSEC_OID_NTLMSSP;
494 status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
495 if (!NT_STATUS_IS_OK(status)) {
496 DEBUG(1, ("Failed to start set GENSEC client mechanism %s: %s\n",
497 gensec_get_name_by_oid(session->gensec, chosen_oid), nt_errstr(status)));
501 if ((const void *)chosen_oid == (const void *)GENSEC_OID_SPNEGO) {
502 status = gensec_update(session->gensec, state,
503 session->transport->negotiate.secblob,
504 &state->setup.spnego.in.secblob);
506 status = gensec_update(session->gensec, state,
508 &state->setup.spnego.in.secblob);
512 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
513 !NT_STATUS_IS_OK(status)) {
514 DEBUG(1, ("Failed initial gensec_update with mechanism %s: %s\n",
515 gensec_get_name_by_oid(session->gensec, chosen_oid),
519 state->gensec_status = status;
521 *req = smb_raw_sesssetup_send(session, &state->setup);
523 return NT_STATUS_NO_MEMORY;
527 * we need to check the signature ourself
528 * as the session key might be the acceptor subkey
529 * which comes within the response itself
531 (*req)->sign_caller_checks = true;
533 return (*req)->status;
538 composite session setup function that hides the details of all the
539 different session setup varients, including the multi-pass nature of
542 struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *session,
543 struct smb_composite_sesssetup *io)
545 struct composite_context *c;
546 struct sesssetup_state *state;
549 c = composite_create(session, session->transport->socket->event.ctx);
550 if (c == NULL) return NULL;
552 state = talloc_zero(c, struct sesssetup_state);
553 if (composite_nomem(state, c)) return c;
554 c->private_data = state;
558 talloc_set_destructor(state, sesssetup_state_destructor);
560 /* no session setup at all in earliest protocol varients */
561 if (session->transport->negotiate.protocol < PROTOCOL_LANMAN1) {
562 ZERO_STRUCT(io->out);
567 /* see what session setup interface we will use */
568 if (session->transport->negotiate.protocol < PROTOCOL_NT1) {
569 status = session_setup_old(c, session, io, &state->req);
570 } else if (!session->transport->options.use_spnego ||
571 !(io->in.capabilities & CAP_EXTENDED_SECURITY)) {
572 status = session_setup_nt1(c, session, io, &state->req);
574 status = session_setup_spnego(c, session, io, &state->req);
577 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
578 NT_STATUS_IS_OK(status)) {
579 composite_continue_smb(c, state->req, request_handler, c);
583 composite_error(c, status);
589 receive a composite session setup reply
591 NTSTATUS smb_composite_sesssetup_recv(struct composite_context *c)
594 status = composite_wait(c);
600 sync version of smb_composite_sesssetup
602 NTSTATUS smb_composite_sesssetup(struct smbcli_session *session, struct smb_composite_sesssetup *io)
604 struct composite_context *c = smb_composite_sesssetup_send(session, io);
605 return smb_composite_sesssetup_recv(c);