Fix denial of service - memory corruption.

[samba.git] / source3 / client / client.c

diff --git a/source3/client/client.c b/source3/client/client.c
index 529f21ab302d649d9dc0d475d3f40d9d8f15b77f..1e5e8e1acb3cdae326b574fe062c93646e82e53f 100644 (file)
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -45,7 +45,7 @@ const char *cmd_ptr = NULL;
 static int io_bufsize = 524288;
 
 static int name_type = 0x20;
-extern int max_protocol;
+static int max_protocol = PROTOCOL_NT1;
 
 static int process_tok(char *tok);
 static int cmd_help(void);
@@ -103,6 +103,9 @@ struct cli_state *cli;
 static char CLI_DIRSEP_CHAR = '\\';
 static char CLI_DIRSEP_STR[] = { '\\', '\0' };
 
+/* Authentication for client connections. */
+struct user_auth_info *auth_info;
+
 /* Accessor functions for directory paths. */
 static char *fileselection;
 static const char *client_get_fileselection(void)
@@ -299,7 +302,7 @@ static int do_dskattr(void)
        char *targetpath = NULL;
        TALLOC_CTX *ctx = talloc_tos();
 
-       if ( !cli_resolve_path(ctx, "", cli, client_get_cur_dir(), &targetcli, &targetpath)) {
+       if ( !cli_resolve_path(ctx, "", auth_info, cli, client_get_cur_dir(), &targetcli, &targetpath)) {
                d_printf("Error in dskattr: %s\n", cli_errstr(cli));
                return 1;
        }
@@ -393,7 +396,7 @@ static int do_cd(const char *new_dir)
        new_cd = clean_name(ctx, new_cd);
        client_set_cur_dir(new_cd);
 
-       if ( !cli_resolve_path(ctx, "", cli, new_cd, &targetcli, &targetpath)) {
+       if ( !cli_resolve_path(ctx, "", auth_info, cli, new_cd, &targetcli, &targetpath)) {
                d_printf("cd %s: %s\n", new_cd, cli_errstr(cli));
                client_set_cur_dir(saved_dir);
                goto out;
@@ -747,11 +750,11 @@ static void do_list_helper(const char *mntpoint, file_info *f, const char *mask,
                                return;
                        }
                        p = strrchr_m(mask2,CLI_DIRSEP_CHAR);
-                       if (!p) {
-                               TALLOC_FREE(dir);
-                               return;
+                       if (p) {
+                               p[1] = 0;
+                       } else {
+                               mask2[0] = '\0';
                        }
-                       p[1] = 0;
                        mask2 = talloc_asprintf_append(mask2,
                                        "%s%s*",
                                        f->name,
@@ -819,7 +822,7 @@ void do_list(const char *mask,
 
                        /* check for dfs */
 
-                       if ( !cli_resolve_path(ctx, "", cli, head, &targetcli, &targetpath ) ) {
+                       if ( !cli_resolve_path(ctx, "", auth_info, cli, head, &targetcli, &targetpath ) ) {
                                d_printf("do_list: [%s] %s\n", head, cli_errstr(cli));
                                remove_do_list_queue_head();
                                continue;
@@ -852,7 +855,7 @@ void do_list(const char *mask,
                }
        } else {
                /* check for dfs */
-               if (cli_resolve_path(ctx, "", cli, mask, &targetcli, &targetpath)) {
+               if (cli_resolve_path(ctx, "", auth_info, cli, mask, &targetcli, &targetpath)) {
                        if (cli_list(targetcli, targetpath, attribute, do_list_helper, NULL) == -1) {
                                d_printf("%s listing %s\n",
                                        cli_errstr(targetcli), targetpath);
@@ -1018,7 +1021,7 @@ static int do_get(const char *rname, const char *lname_in, bool reget)
                strlower_m(lname);
        }
 
-       if (!cli_resolve_path(ctx, "", cli, rname, &targetcli, &targetname ) ) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, rname, &targetcli, &targetname ) ) {
                d_printf("Failed to open %s: %s\n", rname, cli_errstr(cli));
                return 1;
        }
@@ -1353,6 +1356,11 @@ static int cmd_mget(void)
                do_list(mget_mask, attribute, do_mget, false, true);
        }
 
+       if (mget_mask == NULL) {
+               d_printf("nothing to mget\n");
+               return 0;
+       }
+
        if (!*mget_mask) {
                mget_mask = talloc_asprintf(ctx,
                                        "%s*",
@@ -1376,7 +1384,7 @@ static bool do_mkdir(const char *name)
        struct cli_state *targetcli;
        char *targetname = NULL;
 
-       if (!cli_resolve_path(ctx, "", cli, name, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, name, &targetcli, &targetname)) {
                d_printf("mkdir %s: %s\n", name, cli_errstr(cli));
                return false;
        }
@@ -1414,7 +1422,7 @@ static bool do_altname(const char *name)
 
 static int cmd_quit(void)
 {
-       cli_cm_shutdown();
+       cli_shutdown(cli);
        exit(0);
        /* NOTREACHED */
        return 0;
@@ -1459,7 +1467,7 @@ static int cmd_mkdir(void)
                        return 1;
                }
 
-               if (!cli_resolve_path(ctx, "", cli, mask, &targetcli, &targetname)) {
+               if (!cli_resolve_path(ctx, "", auth_info, cli, mask, &targetcli, &targetname)) {
                        return 1;
                }
 
@@ -1620,7 +1628,7 @@ static int do_put(const char *rname, const char *lname, bool reput)
        struct push_state state;
        NTSTATUS status;
 
-       if (!cli_resolve_path(ctx, "", cli, rname, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, rname, &targetcli, &targetname)) {
                d_printf("Failed to open %s: %s\n", rname, cli_errstr(cli));
                return 1;
        }
@@ -1709,7 +1717,7 @@ static int do_put(const char *rname, const char *lname, bool reput)
        }
 
        if (f == x_stdin) {
-               cli_cm_shutdown();
+               cli_shutdown(cli);
                exit(0);
        }
 
@@ -1779,13 +1787,13 @@ static struct file_list {
  Free a file_list structure.
 ****************************************************************************/
 
-static void free_file_list (struct file_list *list_head)
+static void free_file_list (struct file_list *l_head)
 {
        struct file_list *list, *next;
 
-       for (list = list_head; list; list = next) {
+       for (list = l_head; list; list = next) {
                next = list->next;
-               DLIST_REMOVE(list_head, list);
+               DLIST_REMOVE(l_head, list);
                SAFE_FREE(list->file_path);
                SAFE_FREE(list);
        }
@@ -2178,7 +2186,7 @@ static int cmd_wdel(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, mask, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, mask, &targetcli, &targetname)) {
                d_printf("cmd_wdel %s: %s\n", mask, cli_errstr(cli));
                return 1;
        }
@@ -2213,7 +2221,7 @@ static int cmd_open(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, mask, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, mask, &targetcli, &targetname)) {
                d_printf("open %s: %s\n", mask, cli_errstr(cli));
                return 1;
        }
@@ -2306,7 +2314,7 @@ static int cmd_posix_open(void)
        }
        mode = (mode_t)strtol(buf, (char **)NULL, 8);
 
-       if (!cli_resolve_path(ctx, "", cli, mask, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, mask, &targetcli, &targetname)) {
                d_printf("posix_open %s: %s\n", mask, cli_errstr(cli));
                return 1;
        }
@@ -2354,7 +2362,7 @@ static int cmd_posix_mkdir(void)
        }
        mode = (mode_t)strtol(buf, (char **)NULL, 8);
 
-       if (!cli_resolve_path(ctx, "", cli, mask, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, mask, &targetcli, &targetname)) {
                d_printf("posix_mkdir %s: %s\n", mask, cli_errstr(cli));
                return 1;
        }
@@ -2388,7 +2396,7 @@ static int cmd_posix_unlink(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, mask, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, mask, &targetcli, &targetname)) {
                d_printf("posix_unlink %s: %s\n", mask, cli_errstr(cli));
                return 1;
        }
@@ -2422,7 +2430,7 @@ static int cmd_posix_rmdir(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, mask, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, mask, &targetcli, &targetname)) {
                d_printf("posix_rmdir %s: %s\n", mask, cli_errstr(cli));
                return 1;
        }
@@ -2662,7 +2670,7 @@ static int cmd_rmdir(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, mask, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, mask, &targetcli, &targetname)) {
                d_printf("rmdir %s: %s\n", mask, cli_errstr(cli));
                return 1;
        }
@@ -2709,7 +2717,7 @@ static int cmd_link(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, oldname, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, oldname, &targetcli, &targetname)) {
                d_printf("link %s: %s\n", oldname, cli_errstr(cli));
                return 1;
        }
@@ -2760,7 +2768,7 @@ static int cmd_symlink(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, oldname, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, oldname, &targetcli, &targetname)) {
                d_printf("link %s: %s\n", oldname, cli_errstr(cli));
                return 1;
        }
@@ -2808,7 +2816,7 @@ static int cmd_chmod(void)
 
        mode = (mode_t)strtol(buf, NULL, 8);
 
-       if (!cli_resolve_path(ctx, "", cli, src, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, src, &targetcli, &targetname)) {
                d_printf("chmod %s: %s\n", src, cli_errstr(cli));
                return 1;
        }
@@ -2961,7 +2969,7 @@ static int cmd_getfacl(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, src, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, src, &targetcli, &targetname)) {
                d_printf("stat %s: %s\n", src, cli_errstr(cli));
                return 1;
        }
@@ -3127,7 +3135,7 @@ static int cmd_stat(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, src, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, src, &targetcli, &targetname)) {
                d_printf("stat %s: %s\n", src, cli_errstr(cli));
                return 1;
        }
@@ -3228,7 +3236,7 @@ static int cmd_chown(void)
        if (!src) {
                return 1;
        }
-       if (!cli_resolve_path(ctx, "", cli, src, &targetcli, &targetname) ) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, src, &targetcli, &targetname) ) {
                d_printf("chown %s: %s\n", src, cli_errstr(cli));
                return 1;
        }
@@ -3282,12 +3290,12 @@ static int cmd_rename(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, src, &targetcli, &targetsrc)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, src, &targetcli, &targetsrc)) {
                d_printf("rename %s: %s\n", src, cli_errstr(cli));
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, dest, &targetcli, &targetdest)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, dest, &targetcli, &targetdest)) {
                d_printf("rename %s: %s\n", dest, cli_errstr(cli));
                return 1;
        }
@@ -3357,7 +3365,7 @@ static int cmd_hardlink(void)
                return 1;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, src, &targetcli, &targetname)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, src, &targetcli, &targetname)) {
                d_printf("hardlink %s: %s\n", src, cli_errstr(cli));
                return 1;
        }
@@ -3810,7 +3818,7 @@ static int cmd_logon(void)
 
 static int cmd_list_connect(void)
 {
-       cli_cm_display();
+       cli_cm_display(cli);
        return 0;
 }
 
@@ -3824,7 +3832,7 @@ static int cmd_show_connect( void )
        struct cli_state *targetcli;
        char *targetpath;
 
-       if (!cli_resolve_path(ctx, "", cli, client_get_cur_dir(),
+       if (!cli_resolve_path(ctx, "", auth_info, cli, client_get_cur_dir(),
                                &targetcli, &targetpath ) ) {
                d_printf("showconnect %s: %s\n", cur_dir, cli_errstr(cli));
                return 1;
@@ -4046,7 +4054,9 @@ static int process_command_string(const char *cmd_in)
        if (!cli) {
                cli = cli_cm_open(talloc_tos(), NULL,
                                have_ip ? dest_ss_str : desthost,
-                               service, true, smb_encrypt);
+                               service, auth_info,
+                               true, smb_encrypt,
+                               max_protocol, port, name_type);
                if (!cli) {
                        return 1;
                }
@@ -4214,7 +4224,7 @@ static char **remote_completion(const char *text, int len)
                goto cleanup;
        }
 
-       if (!cli_resolve_path(ctx, "", cli, dirmask, &targetcli, &targetpath)) {
+       if (!cli_resolve_path(ctx, "", auth_info, cli, dirmask, &targetcli, &targetpath)) {
                goto cleanup;
        }
        if (cli_list(targetcli, targetpath, aDIR | aSYSTEM | aHIDDEN,
@@ -4374,8 +4384,10 @@ static void readline_callback(void)
 
  again:
 
-       if (cli->fd == -1)
+       if (cli->fd < 0 || cli->fd >= FD_SETSIZE) {
+               errno = EBADF;
                return;
+       }
 
        FD_ZERO(&fds);
        FD_SET(cli->fd,&fds);
@@ -4511,7 +4523,8 @@ static int process(const char *base_directory)
 
        cli = cli_cm_open(talloc_tos(), NULL,
                        have_ip ? dest_ss_str : desthost,
-                       service, true, smb_encrypt);
+                       service, auth_info, true, smb_encrypt,
+                       max_protocol, port, name_type);
        if (!cli) {
                return 1;
        }
@@ -4519,7 +4532,7 @@ static int process(const char *base_directory)
        if (base_directory && *base_directory) {
                rc = do_cd(base_directory);
                if (rc) {
-                       cli_cm_shutdown();
+                       cli_shutdown(cli);
                        return rc;
                }
        }
@@ -4530,7 +4543,7 @@ static int process(const char *base_directory)
                process_stdin();
        }
 
-       cli_cm_shutdown();
+       cli_shutdown(cli);
        return rc;
 }
 
@@ -4540,19 +4553,24 @@ static int process(const char *base_directory)
 
 static int do_host_query(const char *query_host)
 {
-       struct sockaddr_storage ss;
-
        cli = cli_cm_open(talloc_tos(), NULL,
-                       query_host, "IPC$", true, smb_encrypt);
+                       query_host, "IPC$", auth_info, true, smb_encrypt,
+                       max_protocol, port, name_type);
        if (!cli)
                return 1;
 
        browse_host(true);
 
-       if (interpret_string_addr(&ss, query_host, 0) && (ss.ss_family != AF_INET)) {
-               d_printf("%s is an IPv6 address -- no workgroup available\n",
-                       query_host);
-               return 1;
+       /* Ensure that the host can do IPv4 */
+
+       if (!interpret_addr(query_host)) {
+               struct sockaddr_storage ss;
+               if (interpret_string_addr(&ss, query_host, 0) &&
+                               (ss.ss_family != AF_INET)) {
+                       d_printf("%s is an IPv6 address -- no workgroup available\n",
+                               query_host);
+                       return 1;
+               }
        }
 
        if (port != 139) {
@@ -4560,10 +4578,10 @@ static int do_host_query(const char *query_host)
                /* Workgroups simply don't make sense over anything
                   else but port 139... */
 
-               cli_cm_shutdown();
-               cli_cm_set_port( 139 );
+               cli_shutdown(cli);
                cli = cli_cm_open(talloc_tos(), NULL,
-                               query_host, "IPC$", true, smb_encrypt);
+                               query_host, "IPC$", auth_info, true, smb_encrypt,
+                               max_protocol, 139, name_type);
        }
 
        if (cli == NULL) {
@@ -4573,7 +4591,7 @@ static int do_host_query(const char *query_host)
 
        list_servers(lp_workgroup());
 
-       cli_cm_shutdown();
+       cli_shutdown(cli);
 
        return(0);
 }
@@ -4590,7 +4608,8 @@ static int do_tar_op(const char *base_directory)
        if (!cli) {
                cli = cli_cm_open(talloc_tos(), NULL,
                        have_ip ? dest_ss_str : desthost,
-                       service, true, smb_encrypt);
+                       service, auth_info, true, smb_encrypt,
+                       max_protocol, port, name_type);
                if (!cli)
                        return 1;
        }
@@ -4600,14 +4619,14 @@ static int do_tar_op(const char *base_directory)
        if (base_directory && *base_directory)  {
                ret = do_cd(base_directory);
                if (ret) {
-                       cli_cm_shutdown();
+                       cli_shutdown(cli);
                        return ret;
                }
        }
 
        ret=process_tar();
 
-       cli_cm_shutdown();
+       cli_shutdown(cli);
 
        return(ret);
 }
@@ -4616,7 +4635,7 @@ static int do_tar_op(const char *base_directory)
  Handle a message operation.
 ****************************************************************************/
 
-static int do_message_op(struct user_auth_info *auth_info)
+static int do_message_op(struct user_auth_info *a_info)
 {
        struct sockaddr_storage ss;
        struct nmb_name called, calling;
@@ -4640,10 +4659,11 @@ static int do_message_op(struct user_auth_info *auth_info)
 
        msg_port = port ? port : 139;
 
-       if (!(cli=cli_initialise()) || (cli_set_port(cli, msg_port) != msg_port)) {
+       if (!(cli=cli_initialise())) {
                d_printf("Connection to %s failed\n", desthost);
                return 1;
        }
+       cli_set_port(cli, msg_port);
 
        status = cli_connect(cli, server_name, &ss);
        if (!NT_STATUS_IS_OK(status)) {
@@ -4653,12 +4673,12 @@ static int do_message_op(struct user_auth_info *auth_info)
 
        if (!cli_session_request(cli, &calling, &called)) {
                d_printf("session request failed\n");
-               cli_cm_shutdown();
+               cli_shutdown(cli);
                return 1;
        }
 
-       send_message(get_cmdline_auth_info_username(auth_info));
-       cli_cm_shutdown();
+       send_message(get_cmdline_auth_info_username(a_info));
+       cli_shutdown(cli);
 
        return 0;
 }
@@ -4704,7 +4724,6 @@ static int do_message_op(struct user_auth_info *auth_info)
                POPT_TABLEEND
        };
        TALLOC_CTX *frame = talloc_stackframe();
-       struct user_auth_info *auth_info;
 
        if (!client_set_cur_dir("\\")) {
                exit(ENOMEM);
@@ -4781,13 +4800,12 @@ static int do_message_op(struct user_auth_info *auth_info)
                         * to port 139 instead of port 445. srl,crh
                         */
                        name_type = 0x03;
-                       cli_cm_set_dest_name_type( name_type );
                        desthost = talloc_strdup(frame,poptGetOptArg(pc));
                        if (!desthost) {
                                exit(ENOMEM);
                        }
                        if( !port )
-                               cli_cm_set_port( 139 );
+                               port = 139;
                        message = true;
                        break;
                case 'I':
@@ -4883,11 +4901,6 @@ static int do_message_op(struct user_auth_info *auth_info)
                                               poptGetArg(pc));
        }
 
-       /* check for the -P option */
-
-       if ( port != 0 )
-               cli_cm_set_port( port );
-
        /*
         * Don't load debug level from smb.conf. It should be
         * set by cmdline arg or remain default (0)
@@ -4966,11 +4979,10 @@ static int do_message_op(struct user_auth_info *auth_info)
 
        poptFreeContext(pc);
 
-       /* Store the username and password for dfs support */
-
-       cli_cm_set_credentials(auth_info);
+       DEBUG(3,("Client started (version %s).\n", samba_version_string()));
 
-       DEBUG(3,("Client started (version %s).\n", SAMBA_VERSION_STRING));
+       /* Ensure we have a password (or equivalent). */
+       set_cmdline_auth_info_getpass(auth_info);
 
        if (tar_type) {
                if (cmdstr)
@@ -4994,7 +5006,6 @@ static int do_message_op(struct user_auth_info *auth_info)
                        *p = 0;
                        p++;
                        sscanf(p, "%x", &name_type);
-                       cli_cm_set_dest_name_type( name_type );
                }
 
                return do_host_query(qhost);