LCOV - code coverage report
Current view: top level - source4/libcli/smb_composite - sesssetup.c (source / functions) Hit Total Coverage
Test: coverage report for v4-17-test 1498b464 Lines: 263 413 63.7 %
Date: 2024-06-13 04:01:37 Functions: 11 11 100.0 %

          Line data    Source code
       1             : /* 
       2             :    Unix SMB/CIFS implementation.
       3             : 
       4             :    Copyright (C) Andrew Tridgell 2005
       5             :    
       6             :    This program is free software; you can redistribute it and/or modify
       7             :    it under the terms of the GNU General Public License as published by
       8             :    the Free Software Foundation; either version 3 of the License, or
       9             :    (at your option) any later version.
      10             :    
      11             :    This program is distributed in the hope that it will be useful,
      12             :    but WITHOUT ANY WARRANTY; without even the implied warranty of
      13             :    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      14             :    GNU General Public License for more details.
      15             :    
      16             :    You should have received a copy of the GNU General Public License
      17             :    along with this program.  If not, see <http://www.gnu.org/licenses/>.
      18             : */
      19             : /*
      20             :   a composite API for making handling a generic async session setup
      21             : */
      22             : 
      23             : #include "includes.h"
      24             : #include <tevent.h>
      25             : #include "libcli/raw/libcliraw.h"
      26             : #include "libcli/raw/raw_proto.h"
      27             : #include "libcli/composite/composite.h"
      28             : #include "libcli/smb_composite/smb_composite.h"
      29             : #include "libcli/auth/libcli_auth.h"
      30             : #include "auth/auth.h"
      31             : #include "auth/gensec/gensec.h"
      32             : #include "auth/credentials/credentials.h"
      33             : #include "version.h"
      34             : #include "param/param.h"
      35             : #include "libcli/smb/smbXcli_base.h"
      36             : 
      37             : struct sesssetup_state {
      38             :         struct smbcli_session *session;
      39             :         union smb_sesssetup setup;
      40             :         const char *chosen_oid;
      41             :         NTSTATUS remote_status;
      42             :         NTSTATUS gensec_status;
      43             :         struct smb_composite_sesssetup *io;
      44             :         struct smbcli_request *req;
      45             :         struct smbcli_request *check_req;
      46             :         unsigned int logon_retries;
      47             : };
      48             : 
      49         927 : static int sesssetup_state_destructor(struct sesssetup_state *state)
      50             : {
      51         927 :         if (state->req) {
      52           0 :                 talloc_free(state->req);
      53           0 :                 state->req = NULL;
      54             :         }
      55             : 
      56         927 :         return 0;
      57             : }
      58             : 
      59             : static NTSTATUS session_setup_old(struct composite_context *c,
      60             :                                   struct smbcli_session *session, 
      61             :                                   struct smb_composite_sesssetup *io,
      62             :                                   struct smbcli_request **req); 
      63             : static NTSTATUS session_setup_nt1(struct composite_context *c,
      64             :                                   struct smbcli_session *session, 
      65             :                                   struct smb_composite_sesssetup *io,
      66             :                                   struct smbcli_request **req); 
      67             : static NTSTATUS session_setup_spnego_restart(struct composite_context *c,
      68             :                                              struct smbcli_session *session,
      69             :                                              struct smb_composite_sesssetup *io);
      70             : static NTSTATUS session_setup_spnego(struct composite_context *c,
      71             :                                      struct smbcli_session *session, 
      72             :                                      struct smb_composite_sesssetup *io,
      73             :                                      struct smbcli_request **req);
      74             : static void smb_composite_sesssetup_spnego_done1(struct tevent_req *subreq);
      75             : static void smb_composite_sesssetup_spnego_done2(struct tevent_req *subreq);
      76             : 
      77             : 
      78             : /*
      79             :   handler for completion of a smbcli_request sub-request
      80             : */
      81        1034 : static void request_handler(struct smbcli_request *req)
      82             : {
      83        1034 :         struct composite_context *c = (struct composite_context *)req->async.private_data;
      84        1034 :         struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
      85        1034 :         struct smbcli_session *session = req->session;
      86        1034 :         DATA_BLOB null_data_blob = data_blob(NULL, 0);
      87             :         NTSTATUS session_key_err, nt_status;
      88        1034 :         struct smbcli_request *check_req = NULL;
      89        1034 :         const char *os = NULL;
      90        1034 :         const char *lanman = NULL;
      91             : 
      92        1034 :         if (req->sign_caller_checks) {
      93         985 :                 req->do_not_free = true;
      94         985 :                 check_req = req;
      95             :         }
      96             : 
      97        1034 :         state->remote_status = smb_raw_sesssetup_recv(req, state, &state->setup);
      98        1034 :         c->status = state->remote_status;
      99        1034 :         state->req = NULL;
     100             : 
     101             :         /*
     102             :          * we only need to check the signature if the
     103             :          * NT_STATUS_OK is returned
     104             :          */
     105        1034 :         if (!NT_STATUS_IS_OK(state->remote_status)) {
     106         115 :                 talloc_free(check_req);
     107         115 :                 check_req = NULL;
     108             :         }
     109             : 
     110        1034 :         switch (state->setup.old.level) {
     111           4 :         case RAW_SESSSETUP_OLD:
     112           4 :                 state->io->out.vuid = state->setup.old.out.vuid;
     113             :                 /* This doesn't work, as this only happens on old
     114             :                  * protocols, where this comparison won't match. */
     115           4 :                 if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
     116             :                         /* we neet to reset the vuid for a new try */
     117           0 :                         session->vuid = 0;
     118           0 :                         if (cli_credentials_wrong_password(state->io->in.credentials)) {
     119           0 :                                 nt_status = session_setup_old(c, session, 
     120             :                                                               state->io, 
     121             :                                                               &state->req);
     122           0 :                                 if (NT_STATUS_IS_OK(nt_status)) {
     123           0 :                                         talloc_free(check_req);
     124           0 :                                         c->status = nt_status;
     125           0 :                                         composite_continue_smb(c, state->req, request_handler, c);
     126           0 :                                         return;
     127             :                                 }
     128             :                         }
     129             :                 }
     130           4 :                 if (!NT_STATUS_IS_OK(c->status)) {
     131           4 :                         composite_error(c, c->status);
     132           4 :                         return;
     133             :                 }
     134           0 :                 os = state->setup.old.out.os;
     135           0 :                 lanman = state->setup.old.out.lanman;
     136           1 :                 break;
     137             : 
     138           5 :         case RAW_SESSSETUP_NT1:
     139           5 :                 state->io->out.vuid = state->setup.nt1.out.vuid;
     140           5 :                 if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
     141             :                         /* we need to reset the vuid for a new try */
     142           0 :                         session->vuid = 0;
     143           0 :                         if (cli_credentials_wrong_password(state->io->in.credentials)) {
     144           0 :                                 nt_status = session_setup_nt1(c, session, 
     145             :                                                               state->io, 
     146             :                                                               &state->req);
     147           0 :                                 if (NT_STATUS_IS_OK(nt_status)) {
     148           0 :                                         talloc_free(check_req);
     149           0 :                                         c->status = nt_status;
     150           0 :                                         composite_continue_smb(c, state->req, request_handler, c);
     151           0 :                                         return;
     152             :                                 }
     153             :                         }
     154             :                 }
     155           5 :                 if (!NT_STATUS_IS_OK(c->status)) {
     156           0 :                         composite_error(c, c->status);
     157           0 :                         return;
     158             :                 }
     159           5 :                 os = state->setup.nt1.out.os;
     160           5 :                 lanman = state->setup.nt1.out.lanman;
     161           5 :                 break;
     162             : 
     163        1025 :         case RAW_SESSSETUP_SPNEGO:
     164        1025 :                 state->io->out.vuid = state->setup.spnego.out.vuid;
     165        1025 :                 if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
     166             :                         const char *principal;
     167             : 
     168             :                         /* we need to reset the vuid for a new try */
     169           0 :                         session->vuid = 0;
     170             : 
     171           0 :                         principal = gensec_get_target_principal(session->gensec);
     172           0 :                         if (principal == NULL) {
     173           0 :                                 const char *hostname = gensec_get_target_hostname(session->gensec);
     174           0 :                                 const char *service  = gensec_get_target_service(session->gensec);
     175           0 :                                 if (hostname != NULL && service != NULL) {
     176           0 :                                         principal = talloc_asprintf(state, "%s/%s", service, hostname);
     177             :                                 }
     178             :                         }
     179           0 :                         if (cli_credentials_failed_kerberos_login(state->io->in.credentials, principal, &state->logon_retries) ||
     180           0 :                             cli_credentials_wrong_password(state->io->in.credentials)) {
     181           0 :                                 struct tevent_req *subreq = NULL;
     182             : 
     183           0 :                                 nt_status = session_setup_spnego_restart(c, session, state->io);
     184           0 :                                 if (!NT_STATUS_IS_OK(nt_status)) {
     185           0 :                                         DEBUG(1, ("session_setup_spnego_restart() failed: %s\n",
     186             :                                                   nt_errstr(nt_status)));
     187           0 :                                         c->status = nt_status;
     188           0 :                                         composite_error(c, c->status);
     189           0 :                                         return;
     190             :                                 }
     191             : 
     192           0 :                                 subreq = gensec_update_send(state, c->event_ctx,
     193             :                                                             session->gensec,
     194             :                                                             state->setup.spnego.out.secblob);
     195           0 :                                 if (composite_nomem(subreq, c)) {
     196           0 :                                         return;
     197             :                                 }
     198           0 :                                 tevent_req_set_callback(subreq,
     199             :                                                         smb_composite_sesssetup_spnego_done1,
     200             :                                                         c);
     201           0 :                                 return;
     202             :                         }
     203             :                 }
     204        1025 :                 if (GENSEC_UPDATE_IS_NTERROR(c->status)) {
     205           3 :                         composite_error(c, c->status);
     206           3 :                         return;
     207             :                 }
     208        1022 :                 if (NT_STATUS_EQUAL(state->gensec_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
     209        1022 :                         struct tevent_req *subreq = NULL;
     210             : 
     211             :                         /* The status value here, from the earlier pass at GENSEC is
     212             :                          * vital to the security of the system.  Even if the other end
     213             :                          * accepts, if GENSEC claims 'MORE_PROCESSING_REQUIRED' then
     214             :                          * you must keep feeding it blobs, or else the remote
     215             :                          * host/attacker might avoid mutal authentication
     216             :                          * requirements */
     217             : 
     218        1022 :                         subreq = gensec_update_send(state, c->event_ctx,
     219             :                                                     session->gensec,
     220             :                                                     state->setup.spnego.out.secblob);
     221        1022 :                         if (composite_nomem(subreq, c)) {
     222          82 :                                 return;
     223             :                         }
     224        1022 :                         tevent_req_set_callback(subreq,
     225             :                                                 smb_composite_sesssetup_spnego_done2,
     226             :                                                 c);
     227        1022 :                         if (NT_STATUS_IS_OK(state->remote_status)) {
     228         914 :                                 state->check_req = check_req;
     229             :                         } else {
     230         108 :                                 TALLOC_FREE(check_req);
     231             :                         }
     232        1022 :                         return;
     233             :                 } else {
     234           0 :                         state->setup.spnego.in.secblob = data_blob(NULL, 0);
     235             :                 }
     236             : 
     237           0 :                 if (cli_credentials_is_anonymous(state->io->in.credentials)) {
     238             :                         /*
     239             :                          * anonymous => no signing
     240             :                          */
     241           0 :                 } else if (NT_STATUS_IS_OK(state->remote_status)) {
     242             :                         DATA_BLOB session_key;
     243             : 
     244           0 :                         if (state->setup.spnego.in.secblob.length) {
     245           0 :                                 c->status = NT_STATUS_INTERNAL_ERROR;
     246           0 :                                 composite_error(c, c->status);
     247           0 :                                 return;
     248             :                         }
     249           0 :                         session_key_err = gensec_session_key(session->gensec, session, &session_key);
     250           0 :                         if (NT_STATUS_IS_OK(session_key_err)) {
     251           0 :                                 smb1cli_conn_activate_signing(session->transport->conn,
     252             :                                                               session_key,
     253             :                                                               null_data_blob);
     254             :                         }
     255             : 
     256           0 :                         c->status = smb1cli_session_set_session_key(session->smbXcli,
     257             :                                                                     session_key);
     258           0 :                         data_blob_free(&session_key);
     259           0 :                         if (!NT_STATUS_IS_OK(c->status)) {
     260           0 :                                 composite_error(c, c->status);
     261           0 :                                 return;
     262             :                         }
     263             :                 }
     264             : 
     265           0 :                 os = state->setup.spnego.out.os;
     266           0 :                 lanman = state->setup.spnego.out.lanman;
     267           0 :                 break;
     268             : 
     269           0 :         case RAW_SESSSETUP_SMB2:
     270           0 :                 c->status = NT_STATUS_INTERNAL_ERROR;
     271           0 :                 composite_error(c, c->status);
     272           0 :                 return;
     273             :         }
     274             : 
     275           5 :         if (check_req) {
     276             :                 bool ok;
     277             : 
     278           0 :                 check_req->sign_caller_checks = false;
     279             : 
     280           0 :                 ok = smb1cli_conn_check_signing(check_req->transport->conn,
     281           0 :                                                 check_req->in.buffer, 1);
     282           0 :                 TALLOC_FREE(check_req);
     283           0 :                 if (!ok) {
     284           0 :                         c->status = NT_STATUS_ACCESS_DENIED;
     285           0 :                         composite_error(c, c->status);
     286           0 :                         return;
     287             :                 }
     288             :         }
     289             : 
     290           5 :         if (!NT_STATUS_IS_OK(c->status)) {
     291           0 :                 composite_error(c, c->status);
     292           0 :                 return;
     293             :         }
     294             : 
     295           5 :         if (os) {
     296           5 :                 session->os = talloc_strdup(session, os);
     297           5 :                 if (composite_nomem(session->os, c)) return;
     298             :         } else {
     299           0 :                 session->os = NULL;
     300             :         }
     301           5 :         if (lanman) {
     302           5 :                 session->lanman = talloc_strdup(session, lanman);
     303           5 :                 if (composite_nomem(session->lanman, c)) return;
     304             :         } else {
     305           0 :                 session->lanman = NULL;
     306             :         }
     307             : 
     308           5 :         composite_done(c);
     309             : }
     310             : 
     311             : 
     312             : /*
     313             :   send a nt1 style session setup
     314             : */
     315           6 : static NTSTATUS session_setup_nt1(struct composite_context *c,
     316             :                                   struct smbcli_session *session, 
     317             :                                   struct smb_composite_sesssetup *io,
     318             :                                   struct smbcli_request **req) 
     319             : {
     320           6 :         NTSTATUS nt_status = NT_STATUS_INTERNAL_ERROR;
     321           6 :         struct sesssetup_state *state = talloc_get_type(c->private_data,
     322             :                                                         struct sesssetup_state);
     323           6 :         const char *domain = cli_credentials_get_domain(io->in.credentials);
     324             : 
     325             :         /*
     326             :          * domain controllers tend to reject the NTLM v2 blob
     327             :          * if the netbiosname is not valid (e.g. IP address or FQDN)
     328             :          * so just leave it away (as Windows client do)
     329             :          */
     330           6 :         DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, NULL, domain);
     331             : 
     332           6 :         DATA_BLOB session_key = data_blob(NULL, 0);
     333           6 :         int flags = CLI_CRED_NTLM_AUTH;
     334             : 
     335           6 :         if (session->options.lanman_auth) {
     336           6 :                 flags |= CLI_CRED_LANMAN_AUTH;
     337             :         }
     338             : 
     339           6 :         if (session->options.ntlmv2_auth) {
     340           6 :                 flags |= CLI_CRED_NTLMv2_AUTH;
     341             :         }
     342             : 
     343           6 :         state->setup.nt1.level           = RAW_SESSSETUP_NT1;
     344           6 :         state->setup.nt1.in.bufsize      = session->transport->options.max_xmit;
     345           6 :         state->setup.nt1.in.mpx_max      = session->transport->options.max_mux;
     346           6 :         state->setup.nt1.in.vc_num       = 1;
     347           6 :         state->setup.nt1.in.sesskey      = io->in.sesskey;
     348           6 :         state->setup.nt1.in.capabilities = io->in.capabilities;
     349           6 :         state->setup.nt1.in.os           = "Unix";
     350           6 :         state->setup.nt1.in.lanman       = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
     351             : 
     352           6 :         cli_credentials_get_ntlm_username_domain(io->in.credentials, state, 
     353             :                                                  &state->setup.nt1.in.user,
     354             :                                                  &state->setup.nt1.in.domain);
     355             :         
     356             : 
     357           6 :         if (session->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
     358           6 :                 if (!cli_credentials_is_anonymous(io->in.credentials) &&
     359           5 :                     session->options.ntlmv2_auth &&
     360           5 :                     session->transport->options.use_spnego)
     361             :                 {
     362             :                         /*
     363             :                          * Don't send an NTLMv2_RESPONSE without NTLMSSP
     364             :                          * if we want to use spnego
     365             :                          */
     366           1 :                         return NT_STATUS_INVALID_PARAMETER;
     367             :                 }
     368             : 
     369           9 :                 nt_status = cli_credentials_get_ntlm_response(io->in.credentials, state, 
     370             :                                                               &flags, 
     371           5 :                                                               session->transport->negotiate.secblob, 
     372             :                                                               NULL, /* server_timestamp */
     373             :                                                               names_blob,
     374             :                                                               &state->setup.nt1.in.password1,
     375             :                                                               &state->setup.nt1.in.password2,
     376             :                                                               NULL, &session_key);
     377           5 :                 NT_STATUS_NOT_OK_RETURN(nt_status);
     378           0 :         } else if (session->options.plaintext_auth) {
     379           0 :                 const char *password = cli_credentials_get_password(io->in.credentials);
     380           0 :                 state->setup.nt1.in.password1 = data_blob_talloc(state, password, strlen(password));
     381           0 :                 state->setup.nt1.in.password2 = data_blob(NULL, 0);
     382             :         } else {
     383             :                 /* could match windows client and return 'cannot logon from this workstation', but it just confuses everybody */
     384           0 :                 return NT_STATUS_INVALID_PARAMETER;
     385             :         }
     386             : 
     387           5 :         *req = smb_raw_sesssetup_send(session, &state->setup);
     388           5 :         if (!*req) {
     389           0 :                 return NT_STATUS_NO_MEMORY;
     390             :         }
     391             : 
     392           5 :         if (!NT_STATUS_IS_OK(nt_status)) {
     393             :                 /*
     394             :                  * plain text => no signing
     395             :                  */
     396           0 :                 return (*req)->status;
     397             :         }
     398             : 
     399           5 :         if (cli_credentials_is_anonymous(io->in.credentials)) {
     400             :                 /*
     401             :                  * anonymous => no signing
     402             :                  */
     403           1 :                 return (*req)->status;
     404             :         }
     405             : 
     406           4 :         smb1cli_conn_activate_signing(session->transport->conn,
     407             :                                       session_key,
     408             :                                       state->setup.nt1.in.password2);
     409             : 
     410           4 :         nt_status = smb1cli_session_set_session_key(session->smbXcli,
     411             :                                                     session_key);
     412           4 :         data_blob_free(&session_key);
     413           4 :         if (!NT_STATUS_IS_OK(nt_status)) {
     414           0 :                 return nt_status;
     415             :         }
     416             : 
     417           4 :         return (*req)->status;
     418             : }
     419             : 
     420             : 
     421             : /*
     422             :   old style session setup (pre NT1 protocol level)
     423             : */
     424           4 : static NTSTATUS session_setup_old(struct composite_context *c,
     425             :                                   struct smbcli_session *session, 
     426             :                                   struct smb_composite_sesssetup *io,
     427             :                                   struct smbcli_request **req) 
     428             : {
     429             :         NTSTATUS nt_status;
     430           4 :         struct sesssetup_state *state = talloc_get_type(c->private_data,
     431             :                                                         struct sesssetup_state);
     432           4 :         const char *password = cli_credentials_get_password(io->in.credentials);
     433             : 
     434             :         /*
     435             :          * domain controllers tend to reject the NTLM v2 blob
     436             :          * if the netbiosname is not valid (e.g. IP address or FQDN)
     437             :          * so just leave it away (as Windows client do)
     438             :          */
     439             :         DATA_BLOB session_key;
     440             : 
     441           4 :         state->setup.old.level      = RAW_SESSSETUP_OLD;
     442           4 :         state->setup.old.in.bufsize = session->transport->options.max_xmit;
     443           4 :         state->setup.old.in.mpx_max = session->transport->options.max_mux;
     444           4 :         state->setup.old.in.vc_num  = 1;
     445           4 :         state->setup.old.in.sesskey = io->in.sesskey;
     446           4 :         state->setup.old.in.os      = "Unix";
     447           4 :         state->setup.old.in.lanman  = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
     448           4 :         cli_credentials_get_ntlm_username_domain(io->in.credentials, state, 
     449             :                                                  &state->setup.old.in.user,
     450             :                                                  &state->setup.old.in.domain);
     451             :         
     452           4 :         if (session->transport->negotiate.sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
     453           4 :                 DATA_BLOB names_blob = data_blob_null;
     454           4 :                 int flags = 0;
     455             : 
     456           6 :                 if (!cli_credentials_is_anonymous(io->in.credentials) &&
     457           4 :                     !session->options.lanman_auth)
     458             :                 {
     459           0 :                         return NT_STATUS_INVALID_PARAMETER;
     460             :                 }
     461             : 
     462           4 :                 flags |= CLI_CRED_LANMAN_AUTH;
     463             : 
     464           6 :                 nt_status = cli_credentials_get_ntlm_response(io->in.credentials, state, 
     465             :                                                               &flags, 
     466           4 :                                                               session->transport->negotiate.secblob, 
     467             :                                                               NULL, /* server_timestamp */
     468             :                                                               names_blob,
     469             :                                                               &state->setup.old.in.password,
     470             :                                                               NULL,
     471             :                                                               NULL, &session_key);
     472           4 :                 NT_STATUS_NOT_OK_RETURN(nt_status);
     473             : 
     474           4 :                 nt_status = smb1cli_session_set_session_key(session->smbXcli,
     475             :                                                             session_key);
     476           4 :                 data_blob_free(&session_key);
     477           4 :                 if (!NT_STATUS_IS_OK(nt_status)) {
     478           0 :                         return nt_status;
     479             :                 }
     480           0 :         } else if (session->options.plaintext_auth) {
     481           0 :                 state->setup.old.in.password = data_blob_talloc(state, password, strlen(password));
     482             :         } else {
     483             :                 /* could match windows client and return 'cannot logon from this workstation', but it just confuses everybody */
     484           0 :                 return NT_STATUS_INVALID_PARAMETER;
     485             :         }
     486             :         
     487           4 :         *req = smb_raw_sesssetup_send(session, &state->setup);
     488           4 :         if (!*req) {
     489           0 :                 return NT_STATUS_NO_MEMORY;
     490             :         }
     491           4 :         return (*req)->status;
     492             : }
     493             : 
     494         917 : static NTSTATUS session_setup_spnego_restart(struct composite_context *c,
     495             :                                              struct smbcli_session *session,
     496             :                                              struct smb_composite_sesssetup *io)
     497             : {
     498         917 :         struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
     499             :         NTSTATUS status;
     500             : 
     501         917 :         status = gensec_client_start(session, &session->gensec,
     502             :                                      io->in.gensec_settings);
     503         917 :         if (!NT_STATUS_IS_OK(status)) {
     504           0 :                 DEBUG(1, ("Failed to start GENSEC client mode: %s\n", nt_errstr(status)));
     505           0 :                 return status;
     506             :         }
     507             : 
     508         917 :         gensec_want_feature(session->gensec, GENSEC_FEATURE_SESSION_KEY);
     509             : 
     510         917 :         status = gensec_set_credentials(session->gensec, io->in.credentials);
     511         917 :         if (!NT_STATUS_IS_OK(status)) {
     512           0 :                 DEBUG(1, ("Failed to start set GENSEC client credentials: %s\n", 
     513             :                           nt_errstr(status)));
     514           0 :                 return status;
     515             :         }
     516             : 
     517         917 :         status = gensec_set_target_hostname(session->gensec,
     518         917 :                         smbXcli_conn_remote_name(session->transport->conn));
     519         917 :         if (!NT_STATUS_IS_OK(status)) {
     520           0 :                 DEBUG(1, ("Failed to start set GENSEC target hostname: %s\n", 
     521             :                           nt_errstr(status)));
     522           0 :                 return status;
     523             :         }
     524             : 
     525         917 :         status = gensec_set_target_service(session->gensec, "cifs");
     526         917 :         if (!NT_STATUS_IS_OK(status)) {
     527           0 :                 DEBUG(1, ("Failed to start set GENSEC target service: %s\n", 
     528             :                           nt_errstr(status)));
     529           0 :                 return status;
     530             :         }
     531             : 
     532         917 :         state->setup.spnego.out.secblob =
     533         917 :                         session->transport->negotiate.secblob;
     534         917 :         if (session->transport->negotiate.secblob.length) {
     535         917 :                 state->chosen_oid = GENSEC_OID_SPNEGO;
     536         917 :                 status = gensec_start_mech_by_oid(session->gensec,
     537             :                                                   state->chosen_oid);
     538         917 :                 if (!NT_STATUS_IS_OK(status)) {
     539           0 :                         DEBUG(1, ("Failed to start set GENSEC client mechanism %s: %s\n",
     540             :                                   gensec_get_name_by_oid(session->gensec,
     541             :                                                          state->chosen_oid),
     542             :                                   nt_errstr(status)));
     543           0 :                         state->setup.spnego.out.secblob = data_blob_null;
     544           0 :                         state->chosen_oid = GENSEC_OID_NTLMSSP;
     545           0 :                         status = gensec_start_mech_by_oid(session->gensec,
     546             :                                                           state->chosen_oid);
     547           0 :                         if (!NT_STATUS_IS_OK(status)) {
     548           0 :                                 DEBUG(1, ("Failed to start set (fallback) GENSEC client mechanism %s: %s\n",
     549             :                                           gensec_get_name_by_oid(session->gensec,
     550             :                                                                  state->chosen_oid),
     551             :                                           nt_errstr(status)));
     552           0 :                                 return status;
     553             :                         }
     554             :                 }
     555             :         } else {
     556             :                 /* without a sec blob, means raw NTLMSSP */
     557           0 :                 state->chosen_oid = GENSEC_OID_NTLMSSP;
     558           0 :                 status = gensec_start_mech_by_oid(session->gensec,
     559             :                                                   state->chosen_oid);
     560           0 :                 if (!NT_STATUS_IS_OK(status)) {
     561           0 :                         DEBUG(1, ("Failed to start set GENSEC client mechanism %s: %s\n",
     562             :                                   gensec_get_name_by_oid(session->gensec,
     563             :                                                          state->chosen_oid),
     564             :                                   nt_errstr(status)));
     565           0 :                         return status;
     566             :                 }
     567             :         }
     568             : 
     569         917 :         state->gensec_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
     570         917 :         state->remote_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
     571         917 :         return NT_STATUS_OK;
     572             : }
     573             : 
     574             : /*
     575             :   Modern, all singing, all dancing extended security (and possibly SPNEGO) request
     576             : */
     577         917 : static NTSTATUS session_setup_spnego(struct composite_context *c,
     578             :                                      struct smbcli_session *session,
     579             :                                      struct smb_composite_sesssetup *io,
     580             :                                      struct smbcli_request **req)
     581             : {
     582         917 :         struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
     583             : 
     584         917 :         state->setup.spnego.level           = RAW_SESSSETUP_SPNEGO;
     585         917 :         state->setup.spnego.in.bufsize      = session->transport->options.max_xmit;
     586         917 :         state->setup.spnego.in.mpx_max      = session->transport->options.max_mux;
     587         917 :         state->setup.spnego.in.vc_num       = 1;
     588         917 :         state->setup.spnego.in.sesskey      = io->in.sesskey;
     589         917 :         state->setup.spnego.in.capabilities = io->in.capabilities;
     590         917 :         state->setup.spnego.in.os           = "Unix";
     591         917 :         state->setup.spnego.in.lanman       = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
     592         917 :         state->setup.spnego.in.workgroup    = io->in.workgroup;
     593             : 
     594         917 :         *req = smb_raw_sesssetup_send(session, &state->setup);
     595         917 :         if (!*req) {
     596           0 :                 return NT_STATUS_NO_MEMORY;
     597             :         }
     598             : 
     599             :         /*
     600             :          * we need to check the signature ourself
     601             :          * as the session key might be the acceptor subkey
     602             :          * which comes within the response itself
     603             :          */
     604         917 :         if (!smb1cli_conn_signing_is_active((*req)->transport->conn)) {
     605         886 :                 (*req)->sign_caller_checks = true;
     606             :         }
     607             : 
     608         917 :         return (*req)->status;
     609             : }
     610             : 
     611             : 
     612             : /*
     613             :   composite session setup function that hides the details of all the
     614             :   different session setup varients, including the multi-pass nature of
     615             :   the spnego varient
     616             : */
     617         927 : struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *session, 
     618             :                                                        struct smb_composite_sesssetup *io)
     619             : {
     620             :         struct composite_context *c;
     621             :         struct sesssetup_state *state;
     622             :         NTSTATUS status;
     623         883 :         enum smb_encryption_setting encryption_state =
     624         927 :                 cli_credentials_get_smb_encryption(io->in.credentials);
     625         883 :         enum credentials_use_kerberos krb5_state =
     626         927 :                 cli_credentials_get_kerberos_state(io->in.credentials);
     627             : 
     628         927 :         c = composite_create(session, session->transport->ev);
     629         927 :         if (c == NULL) return NULL;
     630             : 
     631         927 :         if (encryption_state > SMB_ENCRYPTION_DESIRED) {
     632           0 :                 composite_error(c, NT_STATUS_PROTOCOL_NOT_SUPPORTED);
     633           0 :                 return c;
     634             :         }
     635             : 
     636         927 :         state = talloc_zero(c, struct sesssetup_state);
     637         927 :         if (composite_nomem(state, c)) return c;
     638         927 :         c->private_data = state;
     639             : 
     640         927 :         state->session = session;
     641         927 :         state->io = io;
     642             : 
     643         927 :         talloc_set_destructor(state, sesssetup_state_destructor);
     644             : 
     645             :         /* no session setup at all in earliest protocol varients */
     646         927 :         if (session->transport->negotiate.protocol < PROTOCOL_LANMAN1) {
     647           0 :                 if (krb5_state == CRED_USE_KERBEROS_REQUIRED) {
     648           0 :                         composite_error(c, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT);
     649           0 :                         return c;
     650             :                 }
     651           0 :                 ZERO_STRUCT(io->out);
     652           0 :                 composite_done(c);
     653           0 :                 return c;
     654             :         }
     655             : 
     656             :         /* see what session setup interface we will use */
     657         927 :         if (session->transport->negotiate.protocol < PROTOCOL_NT1) {
     658           4 :                 if (krb5_state == CRED_USE_KERBEROS_REQUIRED) {
     659           0 :                         composite_error(c, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT);
     660           0 :                         return c;
     661             :                 }
     662           4 :                 status = session_setup_old(c, session, io, &state->req);
     663        1801 :         } else if (!session->transport->options.use_spnego ||
     664         919 :                    !(io->in.capabilities & CAP_EXTENDED_SECURITY)) {
     665           6 :                 if (krb5_state == CRED_USE_KERBEROS_REQUIRED) {
     666           0 :                         composite_error(c, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT);
     667           0 :                         return c;
     668             :                 }
     669           6 :                 status = session_setup_nt1(c, session, io, &state->req);
     670             :         } else {
     671         917 :                 struct tevent_req *subreq = NULL;
     672             : 
     673         917 :                 status = session_setup_spnego_restart(c, session, io);
     674         917 :                 if (!NT_STATUS_IS_OK(status)) {
     675           0 :                         DEBUG(1, ("session_setup_spnego_restart() failed: %s\n",
     676             :                                   nt_errstr(status)));
     677           0 :                         c->status = status;
     678           0 :                         composite_error(c, c->status);
     679           0 :                         return c;
     680             :                 }
     681             : 
     682         917 :                 subreq = gensec_update_send(state, c->event_ctx,
     683             :                                             session->gensec,
     684             :                                             state->setup.spnego.out.secblob);
     685         917 :                 if (composite_nomem(subreq, c)) {
     686           0 :                         return c;
     687             :                 }
     688         917 :                 tevent_req_set_callback(subreq,
     689             :                                         smb_composite_sesssetup_spnego_done1,
     690             :                                         c);
     691         917 :                 return c;
     692             :         }
     693             : 
     694          17 :         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) || 
     695          10 :             NT_STATUS_IS_OK(status)) {
     696           9 :                 composite_continue_smb(c, state->req, request_handler, c);   
     697           9 :                 return c;
     698             :         }
     699             : 
     700           1 :         composite_error(c, status);
     701           1 :         return c;
     702             : }
     703             : 
     704         917 : static void smb_composite_sesssetup_spnego_done1(struct tevent_req *subreq)
     705             : {
     706         876 :         struct composite_context *c =
     707         917 :                 tevent_req_callback_data(subreq,
     708             :                 struct composite_context);
     709         876 :         struct sesssetup_state *state =
     710         917 :                 talloc_get_type_abort(c->private_data,
     711             :                 struct sesssetup_state);
     712             :         NTSTATUS status;
     713             : 
     714         917 :         status = gensec_update_recv(subreq, state,
     715             :                                     &state->setup.spnego.in.secblob);
     716         917 :         TALLOC_FREE(subreq);
     717         917 :         if (GENSEC_UPDATE_IS_NTERROR(status)) {
     718           0 :                 DEBUG(1, ("Failed initial gensec_update with mechanism %s: %s\n",
     719             :                           gensec_get_name_by_oid(state->session->gensec,
     720             :                                                  state->chosen_oid),
     721             :                           nt_errstr(status)));
     722           0 :                 c->status = status;
     723           0 :                 composite_error(c, c->status);
     724           0 :                 return;
     725             :         }
     726         917 :         state->gensec_status = status;
     727             : 
     728         917 :         status = session_setup_spnego(c, state->session, state->io, &state->req);
     729         917 :         if (!NT_STATUS_IS_OK(status)) {
     730           0 :                 c->status = status;
     731           0 :                 composite_error(c, c->status);
     732           0 :                 return;
     733             :         }
     734             : 
     735         917 :         composite_continue_smb(c, state->req, request_handler, c);
     736             : }
     737             : 
     738        1022 : static void smb_composite_sesssetup_spnego_done2(struct tevent_req *subreq)
     739             : {
     740         940 :         struct composite_context *c =
     741        1022 :                 tevent_req_callback_data(subreq,
     742             :                 struct composite_context);
     743         940 :         struct sesssetup_state *state =
     744        1022 :                 talloc_get_type_abort(c->private_data,
     745             :                 struct sesssetup_state);
     746        1022 :         struct smbcli_session *session = state->session;
     747             :         NTSTATUS status;
     748        1022 :         const char *os = NULL;
     749        1022 :         const char *lanman = NULL;
     750             : 
     751        1022 :         status = gensec_update_recv(subreq, state,
     752             :                                     &state->setup.spnego.in.secblob);
     753        1022 :         TALLOC_FREE(subreq);
     754        1022 :         if (GENSEC_UPDATE_IS_NTERROR(status)) {
     755           0 :                 DEBUG(1, ("Failed initial gensec_update with mechanism %s: %s\n",
     756             :                           gensec_get_name_by_oid(state->session->gensec,
     757             :                                                  state->chosen_oid),
     758             :                           nt_errstr(status)));
     759           0 :                 c->status = status;
     760           0 :                 composite_error(c, c->status);
     761           0 :                 return;
     762             :         }
     763        1022 :         state->gensec_status = status;
     764             : 
     765        1022 :         if (NT_STATUS_IS_OK(state->remote_status)) {
     766         914 :                 if (state->setup.spnego.in.secblob.length) {
     767           0 :                         c->status = NT_STATUS_INTERNAL_ERROR;
     768           0 :                         composite_error(c, c->status);
     769           0 :                         return;
     770             :                 }
     771             :         }
     772             : 
     773        1022 :         if (state->setup.spnego.in.secblob.length) {
     774             :                 /*
     775             :                  * set the session->vuid value only for calling
     776             :                  * smb_raw_sesssetup_send()
     777             :                  */
     778         108 :                 uint16_t vuid = session->vuid;
     779         108 :                 session->vuid = state->io->out.vuid;
     780         108 :                 state->req = smb_raw_sesssetup_send(session, &state->setup);
     781         108 :                 session->vuid = vuid;
     782         175 :                 if (state->req &&
     783         108 :                     !smb1cli_conn_signing_is_active(state->req->transport->conn)) {
     784          99 :                         state->req->sign_caller_checks = true;
     785             :                 }
     786         108 :                 composite_continue_smb(c, state->req, request_handler, c);
     787         108 :                 return;
     788             :         }
     789             : 
     790         914 :         if (cli_credentials_is_anonymous(state->io->in.credentials)) {
     791             :                 /*
     792             :                  * anonymous => no signing
     793             :                  */
     794         901 :         } else if (NT_STATUS_IS_OK(state->remote_status)) {
     795             :                 NTSTATUS session_key_err;
     796             :                 DATA_BLOB session_key;
     797             : 
     798         901 :                 session_key_err = gensec_session_key(session->gensec, session, &session_key);
     799         901 :                 if (NT_STATUS_IS_OK(session_key_err)) {
     800         901 :                         smb1cli_conn_activate_signing(session->transport->conn,
     801             :                                                       session_key,
     802             :                                                       data_blob_null);
     803             :                 }
     804             : 
     805         901 :                 c->status = smb1cli_session_set_session_key(session->smbXcli,
     806             :                                                             session_key);
     807         901 :                 data_blob_free(&session_key);
     808         901 :                 if (!NT_STATUS_IS_OK(c->status)) {
     809           0 :                         composite_error(c, c->status);
     810           0 :                         return;
     811             :                 }
     812             :         }
     813             : 
     814         914 :         os = state->setup.spnego.out.os;
     815         914 :         lanman = state->setup.spnego.out.lanman;
     816             : 
     817         914 :         if (state->check_req) {
     818         886 :                 struct smbcli_request *check_req = state->check_req;
     819             :                 bool ok;
     820             : 
     821         886 :                 check_req->sign_caller_checks = false;
     822             : 
     823         886 :                 ok = smb1cli_conn_check_signing(check_req->transport->conn,
     824         886 :                                                 check_req->in.buffer, 1);
     825         886 :                 TALLOC_FREE(check_req);
     826         886 :                 if (!ok) {
     827           0 :                         c->status = NT_STATUS_ACCESS_DENIED;
     828           0 :                         composite_error(c, c->status);
     829           0 :                         return;
     830             :                 }
     831             :         }
     832             : 
     833         914 :         if (os) {
     834         914 :                 session->os = talloc_strdup(session, os);
     835         914 :                 if (composite_nomem(session->os, c)) return;
     836             :         } else {
     837           0 :                 session->os = NULL;
     838             :         }
     839         914 :         if (lanman) {
     840         914 :                 session->lanman = talloc_strdup(session, lanman);
     841         914 :                 if (composite_nomem(session->lanman, c)) return;
     842             :         } else {
     843           0 :                 session->lanman = NULL;
     844             :         }
     845             : 
     846         914 :         composite_done(c);
     847             : }
     848             : 
     849             : /*
     850             :   receive a composite session setup reply
     851             : */
     852         927 : NTSTATUS smb_composite_sesssetup_recv(struct composite_context *c)
     853             : {
     854             :         NTSTATUS status;
     855         927 :         status = composite_wait(c);
     856         927 :         talloc_free(c);
     857         927 :         return status;
     858             : }
     859             : 
     860             : /*
     861             :   sync version of smb_composite_sesssetup 
     862             : */
     863          18 : NTSTATUS smb_composite_sesssetup(struct smbcli_session *session, struct smb_composite_sesssetup *io)
     864             : {
     865          18 :         struct composite_context *c = smb_composite_sesssetup_send(session, io);
     866          18 :         return smb_composite_sesssetup_recv(c);
     867             : }

Generated by: LCOV version 1.13