This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
a composite API for making handling a generic async session setup
#include "includes.h"
#include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
#include "libcli/composite/composite.h"
#include "libcli/smb_composite/smb_composite.h"
-#include "auth/credentials/credentials.h"
-#include "libcli/auth/proto.h"
+#include "libcli/smb_composite/proto.h"
+#include "libcli/auth/libcli_auth.h"
#include "auth/auth.h"
+#include "auth/gensec/gensec.h"
+#include "auth/credentials/credentials.h"
#include "version.h"
+#include "param/param.h"
struct sesssetup_state {
union smb_sesssetup setup;
struct smbcli_request *req;
};
+static int sesssetup_state_destructor(struct sesssetup_state *state)
+{
+ if (state->req) {
+ talloc_free(state->req);
+ state->req = NULL;
+ }
+
+ return 0;
+}
+
+static NTSTATUS session_setup_old(struct composite_context *c,
+ struct smbcli_session *session,
+ struct smb_composite_sesssetup *io,
+ struct smbcli_request **req);
+static NTSTATUS session_setup_nt1(struct composite_context *c,
+ struct smbcli_session *session,
+ struct smb_composite_sesssetup *io,
+ struct smbcli_request **req);
+static NTSTATUS session_setup_spnego(struct composite_context *c,
+ struct smbcli_session *session,
+ struct smb_composite_sesssetup *io,
+ struct smbcli_request **req);
/*
store the user session key for a transport
*/
static void request_handler(struct smbcli_request *req)
{
- struct composite_context *c = req->async.private;
+ struct composite_context *c = (struct composite_context *)req->async.private;
struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
struct smbcli_session *session = req->session;
DATA_BLOB session_key = data_blob(NULL, 0);
DATA_BLOB null_data_blob = data_blob(NULL, 0);
- NTSTATUS session_key_err;
+ NTSTATUS session_key_err, nt_status;
+ struct smbcli_request *check_req = NULL;
+
+ if (req->sign_caller_checks) {
+ req->do_not_free = true;
+ check_req = req;
+ }
c->status = smb_raw_sesssetup_recv(req, state, &state->setup);
+ state->req = NULL;
switch (state->setup.old.level) {
case RAW_SESSSETUP_OLD:
state->io->out.vuid = state->setup.old.out.vuid;
+ /* This doesn't work, as this only happens on old
+ * protocols, where this comparison won't match. */
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ /* we neet to reset the vuid for a new try */
+ session->vuid = 0;
+ if (cli_credentials_wrong_password(state->io->in.credentials)) {
+ nt_status = session_setup_old(c, session,
+ state->io,
+ &state->req);
+ if (NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(check_req);
+ c->status = nt_status;
+ composite_continue_smb(c, state->req, request_handler, c);
+ return;
+ }
+ }
+ }
break;
case RAW_SESSSETUP_NT1:
state->io->out.vuid = state->setup.nt1.out.vuid;
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ /* we neet to reset the vuid for a new try */
+ session->vuid = 0;
+ if (cli_credentials_wrong_password(state->io->in.credentials)) {
+ nt_status = session_setup_nt1(c, session,
+ state->io,
+ &state->req);
+ if (NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(check_req);
+ c->status = nt_status;
+ composite_continue_smb(c, state->req, request_handler, c);
+ return;
+ }
+ }
+ }
break;
case RAW_SESSSETUP_SPNEGO:
- session->vuid = state->io->out.vuid = state->setup.spnego.out.vuid;
+ state->io->out.vuid = state->setup.spnego.out.vuid;
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ /* we need to reset the vuid for a new try */
+ session->vuid = 0;
+ if (cli_credentials_wrong_password(state->io->in.credentials)) {
+ nt_status = session_setup_spnego(c, session,
+ state->io,
+ &state->req);
+ if (NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(check_req);
+ c->status = nt_status;
+ composite_continue_smb(c, state->req, request_handler, c);
+ return;
+ }
+ }
+ }
if (!NT_STATUS_EQUAL(c->status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
!NT_STATUS_IS_OK(c->status)) {
+ talloc_free(check_req);
break;
}
if (NT_STATUS_EQUAL(state->gensec_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
c->status = state->gensec_status;
if (!NT_STATUS_EQUAL(c->status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
!NT_STATUS_IS_OK(c->status)) {
+ talloc_free(check_req);
break;
}
} else {
state->setup.spnego.in.secblob = data_blob(NULL, 0);
}
-
+
/* we need to do another round of session setup. We keep going until both sides
are happy */
session_key_err = gensec_session_key(session->gensec, &session_key);
}
if (state->setup.spnego.in.secblob.length) {
+ uint16_t vuid = session->vuid;
+
+ if (check_req) {
+ check_req->sign_caller_checks = false;
+ if (!smbcli_request_check_sign_mac(check_req)) {
+ talloc_free(check_req);
+ c->status = NT_STATUS_ACCESS_DENIED;
+ break;
+ }
+ talloc_free(check_req);
+ }
+
+ /*
+ * set the session->vuid value only for calling
+ * smb_raw_sesssetup_send()
+ */
+ session->vuid = state->io->out.vuid;
state->req = smb_raw_sesssetup_send(session, &state->setup);
- state->req->async.fn = request_handler;
- state->req->async.private = c;
+ session->vuid = vuid;
+ composite_continue_smb(c, state->req, request_handler, c);
return;
}
+ break;
+
+ case RAW_SESSSETUP_SMB2:
+ c->status = NT_STATUS_INTERNAL_ERROR;
+ break;
+ }
+
+ if (check_req) {
+ check_req->sign_caller_checks = false;
+ if (!smbcli_request_check_sign_mac(check_req)) {
+ c->status = NT_STATUS_ACCESS_DENIED;
+ }
+ talloc_free(check_req);
}
/* enforce the local signing required flag */
if (NT_STATUS_IS_OK(c->status) && !cli_credentials_is_anonymous(state->io->in.credentials)) {
if (!session->transport->negotiate.sign_info.doing_signing
- && session->transport->negotiate.sign_info.mandatory_signing) {
+ && session->transport->negotiate.sign_info.require_signing) {
+/* TODO: moves this checks*/
DEBUG(0, ("SMB signing required, but server does not support it\n"));
c->status = NT_STATUS_ACCESS_DENIED;
}
}
- if (NT_STATUS_IS_OK(c->status)) {
- c->state = COMPOSITE_STATE_DONE;
- } else {
- c->state = COMPOSITE_STATE_ERROR;
- }
- if (c->async.fn) {
- c->async.fn(c);
+ if (!NT_STATUS_IS_OK(c->status)) {
+ composite_error(c, c->status);
+ return;
}
+
+ composite_done(c);
}
{
NTSTATUS nt_status;
struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
- const char *password = cli_credentials_get_password(io->in.credentials);
- DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, session->transport->socket->hostname, lp_workgroup());
+ DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, lp_iconv_convenience(global_loadparm), session->transport->socket->hostname, lp_workgroup(global_loadparm));
DATA_BLOB session_key;
int flags = CLI_CRED_NTLM_AUTH;
- if (lp_client_lanman_auth()) {
+ if (session->options.lanman_auth) {
flags |= CLI_CRED_LANMAN_AUTH;
}
- if (lp_client_ntlmv2_auth()) {
+ if (session->options.ntlmv2_auth) {
flags |= CLI_CRED_NTLMv2_AUTH;
}
&state->setup.nt1.in.password1,
&state->setup.nt1.in.password2,
NULL, &session_key);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
smbcli_transport_simple_set_signing(session->transport, session_key,
state->setup.nt1.in.password2);
set_user_session_key(session, &session_key);
data_blob_free(&session_key);
- } else if (lp_client_plaintext_auth()) {
+ } else if (session->options.plaintext_auth) {
+ const char *password = cli_credentials_get_password(io->in.credentials);
state->setup.nt1.in.password1 = data_blob_talloc(state, password, strlen(password));
state->setup.nt1.in.password2 = data_blob(NULL, 0);
} else {
NTSTATUS nt_status;
struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
const char *password = cli_credentials_get_password(io->in.credentials);
- DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, session->transport->socket->hostname, lp_workgroup());
+ DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, lp_iconv_convenience(global_loadparm), session->transport->socket->hostname, lp_workgroup(global_loadparm));
DATA_BLOB session_key;
int flags = 0;
- if (lp_client_lanman_auth()) {
+ if (session->options.lanman_auth) {
flags |= CLI_CRED_LANMAN_AUTH;
}
- if (lp_client_ntlmv2_auth()) {
+ if (session->options.ntlmv2_auth) {
flags |= CLI_CRED_NTLMv2_AUTH;
}
&state->setup.old.in.password,
NULL,
NULL, &session_key);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
set_user_session_key(session, &session_key);
data_blob_free(&session_key);
- } else if (lp_client_plaintext_auth()) {
+ } else if (session->options.plaintext_auth) {
state->setup.old.in.password = data_blob_talloc(state, password, strlen(password));
} else {
/* could match windows client and return 'cannot logon from this workstation', but it just confuses everybody */
DATA_BLOB session_key = data_blob(NULL, 0);
DATA_BLOB null_data_blob = data_blob(NULL, 0);
const char *chosen_oid = NULL;
+ bool bsrspyl = lp_parm_bool(global_loadparm, NULL, "smbcli", "spnego_start_with_bsrspyl", false);
state->setup.spnego.level = RAW_SESSSETUP_SPNEGO;
state->setup.spnego.in.bufsize = session->transport->options.max_xmit;
state->setup.spnego.in.lanman = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
state->setup.spnego.in.workgroup = io->in.workgroup;
- state->setup.spnego.out.vuid = session->vuid;
-
smbcli_temp_set_signing(session->transport);
- status = gensec_client_start(session, &session->gensec, c->event_ctx);
+ status = gensec_client_start(session, &session->gensec, c->event_ctx,
+ global_loadparm);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to start GENSEC client mode: %s\n", nt_errstr(status)));
return status;
status = gensec_set_credentials(session->gensec, io->in.credentials);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to start set GENSEC client credentails: %s\n",
+ DEBUG(1, ("Failed to start set GENSEC client credentials: %s\n",
nt_errstr(status)));
return status;
}
}
}
- if (chosen_oid == GENSEC_OID_SPNEGO) {
+ if ((const void *)chosen_oid == (const void *)GENSEC_OID_SPNEGO) {
status = gensec_update(session->gensec, state,
session->transport->negotiate.secblob,
&state->setup.spnego.in.secblob);
}
state->gensec_status = status;
- session_key_err = gensec_session_key(session->gensec, &session_key);
- if (NT_STATUS_IS_OK(session_key_err)) {
- smbcli_transport_simple_set_signing(session->transport, session_key, null_data_blob);
+ if (!bsrspyl) {
+ /*
+ * windows servers are happy to accept the first
+ * session setup request to be signed.
+ */
+ session_key_err = gensec_session_key(session->gensec, &session_key);
+ if (NT_STATUS_IS_OK(session_key_err)) {
+ smbcli_transport_simple_set_signing(session->transport, session_key, null_data_blob);
+ }
}
*req = smb_raw_sesssetup_send(session, &state->setup);
if (!*req) {
return NT_STATUS_NO_MEMORY;
}
+
+ if (bsrspyl) {
+ /*
+ * this code path demonstrates windows client behavior
+ * where the first client request has the BSRSYL signature
+ *
+ * but the reply will be signed by the server with the correct
+ * session key, which means that the seq_num counter has already
+ * started on the server, as if the request would have been signed.
+ */
+ session_key_err = gensec_session_key(session->gensec, &session_key);
+ if (NT_STATUS_IS_OK(session_key_err)) {
+ smbcli_transport_simple_set_signing(session->transport, session_key, null_data_blob);
+ smb_signing_next_seq_num(&session->transport->negotiate.sign_info, false);
+ }
+ }
+
+ if (NT_STATUS_IS_OK(session_key_err)) {
+ /*
+ * as the response might be signed with a session key from within the response
+ * we need to check the signiture of the response ourself.
+ */
+ (*req)->sign_caller_checks = true;
+ }
+
return (*req)->status;
}
struct sesssetup_state *state;
NTSTATUS status;
- c = talloc_zero(session, struct composite_context);
+ c = composite_create(session, session->transport->socket->event.ctx);
if (c == NULL) return NULL;
- state = talloc(c, struct sesssetup_state);
- if (state == NULL) {
- talloc_free(c);
- return NULL;
- }
+ state = talloc_zero(c, struct sesssetup_state);
+ if (composite_nomem(state, c)) return c;
+ c->private_data = state;
state->io = io;
- c->state = COMPOSITE_STATE_IN_PROGRESS;
- c->private_data = state;
- c->event_ctx = session->transport->socket->event.ctx;
+ talloc_set_destructor(state, sesssetup_state_destructor);
/* no session setup at all in earliest protocol varients */
if (session->transport->negotiate.protocol < PROTOCOL_LANMAN1) {
ZERO_STRUCT(io->out);
- c->state = COMPOSITE_STATE_DONE;
+ composite_done(c);
return c;
}
if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
NT_STATUS_IS_OK(status)) {
- state->req->async.fn = request_handler;
- state->req->async.private = c;
+ composite_continue_smb(c, state->req, request_handler, c);
return c;
}
- c->state = COMPOSITE_STATE_ERROR;
- c->status = status;
+ composite_error(c, status);
return c;
}
git.samba.org / metze / samba / wip.git / blobdiff