1 /*
2 Unix SMB/CIFS implementation.
3 SMB client generic functions
4 Copyright (C) Andrew Tridgell 1994-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "libsmb/libsmb.h"
23 #include "../lib/util/tevent_ntstatus.h"
24 #include "../libcli/smb/smb_signing.h"
25 #include "../libcli/smb/smb_seal.h"
26 #include "async_smb.h"
27 #include "../libcli/smb/smbXcli_base.h"
28 #include "../librpc/ndr/libndr.h"
29 #include "../include/client.h"
30
31 /*******************************************************************
32 Setup the word count and byte count for a client smb message.
33 ********************************************************************/
34
cli_set_message(char * buf,int num_words,int num_bytes,bool zero)35 int cli_set_message(char *buf,int num_words,int num_bytes,bool zero)
36 {
37 if (zero && (num_words || num_bytes)) {
38 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
39 }
40 SCVAL(buf,smb_wct,num_words);
41 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
42 smb_setlen(buf,smb_size + num_words*2 + num_bytes - 4);
43 return (smb_size + num_words*2 + num_bytes);
44 }
45
46 /****************************************************************************
47 Change the timeout (in milliseconds).
48 ****************************************************************************/
49
cli_set_timeout(struct cli_state * cli,unsigned int timeout)50 unsigned int cli_set_timeout(struct cli_state *cli, unsigned int timeout)
51 {
52 unsigned int old_timeout = cli->timeout;
53 cli->timeout = timeout;
54 return old_timeout;
55 }
56
57 /****************************************************************************
58 Set the 'backup_intent' flag.
59 ****************************************************************************/
60
cli_set_backup_intent(struct cli_state * cli,bool flag)61 bool cli_set_backup_intent(struct cli_state *cli, bool flag)
62 {
63 bool old_state = cli->backup_intent;
64 cli->backup_intent = flag;
65 return old_state;
66 }
67
68 /****************************************************************************
69 Initialise a client structure. Always returns a talloc'ed struct.
70 Set the signing state (used from the command line).
71 ****************************************************************************/
72
73 struct GUID cli_state_client_guid;
74
cli_state_create(TALLOC_CTX * mem_ctx,int fd,const char * remote_name,int signing_state,int flags)75 struct cli_state *cli_state_create(TALLOC_CTX *mem_ctx,
76 int fd,
77 const char *remote_name,
78 int signing_state, int flags)
79 {
80 struct cli_state *cli = NULL;
81 bool use_spnego = lp_client_use_spnego();
82 bool force_dos_errors = false;
83 bool force_ascii = false;
84 bool use_level_II_oplocks = false;
85 uint32_t smb1_capabilities = 0;
86 uint32_t smb2_capabilities = 0;
87 struct GUID client_guid;
88
89 if (!GUID_all_zero(&cli_state_client_guid)) {
90 client_guid = cli_state_client_guid;
91 } else {
92 client_guid = GUID_random();
93 }
94
95 /* Check the effective uid - make sure we are not setuid */
96 if (is_setuid_root()) {
97 DEBUG(0,("libsmb based programs must *NOT* be setuid root.\n"));
98 return NULL;
99 }
100
101 cli = talloc_zero(mem_ctx, struct cli_state);
102 if (!cli) {
103 return NULL;
104 }
105
106 cli->server_domain = talloc_strdup(cli, "");
107 if (!cli->server_domain) {
108 goto error;
109 }
110 cli->server_os = talloc_strdup(cli, "");
111 if (!cli->server_os) {
112 goto error;
113 }
114 cli->server_type = talloc_strdup(cli, "");
115 if (!cli->server_type) {
116 goto error;
117 }
118
119 cli->dfs_mountpoint = talloc_strdup(cli, "");
120 if (!cli->dfs_mountpoint) {
121 goto error;
122 }
123 cli->raw_status = NT_STATUS_INTERNAL_ERROR;
124 cli->map_dos_errors = true; /* remove this */
125 cli->timeout = CLIENT_TIMEOUT;
126
127 /* Set the CLI_FORCE_DOSERR environment variable to test
128 client routines using DOS errors instead of STATUS32
129 ones. This intended only as a temporary hack. */
130 if (getenv("CLI_FORCE_DOSERR")) {
131 force_dos_errors = true;
132 }
133 if (flags & CLI_FULL_CONNECTION_FORCE_DOS_ERRORS) {
134 force_dos_errors = true;
135 }
136
137 if (getenv("CLI_FORCE_ASCII")) {
138 force_ascii = true;
139 }
140 if (!lp_unicode()) {
141 force_ascii = true;
142 }
143 if (flags & CLI_FULL_CONNECTION_FORCE_ASCII) {
144 force_ascii = true;
145 }
146
147 if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO) {
148 use_spnego = false;
149 } else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS) {
150 cli->use_kerberos = true;
151 }
152 if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
153 cli->use_kerberos) {
154 cli->fallback_after_kerberos = true;
155 }
156
157 if (flags & CLI_FULL_CONNECTION_USE_CCACHE) {
158 cli->use_ccache = true;
159 }
160
161 if (flags & CLI_FULL_CONNECTION_USE_NT_HASH) {
162 cli->pw_nt_hash = true;
163 }
164
165 if (flags & CLI_FULL_CONNECTION_OPLOCKS) {
166 cli->use_oplocks = true;
167 }
168 if (flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) {
169 use_level_II_oplocks = true;
170 }
171
172 if (signing_state == SMB_SIGNING_IPC_DEFAULT) {
173 /*
174 * Ensure for IPC/RPC the default is to require
175 * signing unless explicitly turned off by the
176 * administrator.
177 */
178 signing_state = lp_client_ipc_signing();
179 }
180
181 if (signing_state == SMB_SIGNING_DEFAULT) {
182 signing_state = lp_client_signing();
183 }
184
185 smb1_capabilities = 0;
186 smb1_capabilities |= CAP_LARGE_FILES;
187 smb1_capabilities |= CAP_NT_SMBS | CAP_RPC_REMOTE_APIS;
188 smb1_capabilities |= CAP_LOCK_AND_READ | CAP_NT_FIND;
189 smb1_capabilities |= CAP_DFS | CAP_W2K_SMBS;
190 smb1_capabilities |= CAP_LARGE_READX|CAP_LARGE_WRITEX;
191 smb1_capabilities |= CAP_LWIO;
192
193 if (!force_dos_errors) {
194 smb1_capabilities |= CAP_STATUS32;
195 }
196
197 if (!force_ascii) {
198 smb1_capabilities |= CAP_UNICODE;
199 }
200
201 if (use_spnego) {
202 smb1_capabilities |= CAP_EXTENDED_SECURITY;
203 }
204
205 if (use_level_II_oplocks) {
206 smb1_capabilities |= CAP_LEVEL_II_OPLOCKS;
207 }
208
209 smb2_capabilities = SMB2_CAP_ALL;
210
211 cli->conn = smbXcli_conn_create(cli, fd, remote_name,
212 signing_state,
213 smb1_capabilities,
214 &client_guid,
215 smb2_capabilities);
216 if (cli->conn == NULL) {
217 goto error;
218 }
219
220 cli->smb1.pid = (uint32_t)getpid();
221 cli->smb1.vc_num = cli->smb1.pid;
222 cli->smb1.session = smbXcli_session_create(cli, cli->conn);
223 if (cli->smb1.session == NULL) {
224 goto error;
225 }
226
227 cli->initialised = 1;
228 return cli;
229
230 /* Clean up after malloc() error */
231
232 error:
233
234 TALLOC_FREE(cli);
235 return NULL;
236 }
237
238 /****************************************************************************
239 Close all pipes open on this session.
240 ****************************************************************************/
241
cli_nt_pipes_close(struct cli_state * cli)242 void cli_nt_pipes_close(struct cli_state *cli)
243 {
244 while (cli->pipe_list != NULL) {
245 /*
246 * No TALLOC_FREE here!
247 */
248 talloc_free(cli->pipe_list);
249 }
250 }
251
252 /****************************************************************************
253 Shutdown a client structure.
254 ****************************************************************************/
255
_cli_shutdown(struct cli_state * cli)256 static void _cli_shutdown(struct cli_state *cli)
257 {
258 cli_nt_pipes_close(cli);
259
260 /*
261 * tell our peer to free his resources. Wihtout this, when an
262 * application attempts to do a graceful shutdown and calls
263 * smbc_free_context() to clean up all connections, some connections
264 * can remain active on the peer end, until some (long) timeout period
265 * later. This tree disconnect forces the peer to clean up, since the
266 * connection will be going away.
267 */
268 if (cli_state_has_tcon(cli)) {
269 cli_tdis(cli);
270 }
271
272 smbXcli_conn_disconnect(cli->conn, NT_STATUS_OK);
273
274 TALLOC_FREE(cli);
275 }
276
cli_shutdown(struct cli_state * cli)277 void cli_shutdown(struct cli_state *cli)
278 {
279 struct cli_state *cli_head;
280 if (cli == NULL) {
281 return;
282 }
283 DLIST_HEAD(cli, cli_head);
284 if (cli_head == cli) {
285 /*
286 * head of a DFS list, shutdown all subsidiary DFS
287 * connections.
288 */
289 struct cli_state *p, *next;
290
291 for (p = cli_head->next; p; p = next) {
292 next = p->next;
293 DLIST_REMOVE(cli_head, p);
294 _cli_shutdown(p);
295 }
296 } else {
297 DLIST_REMOVE(cli_head, cli);
298 }
299
300 _cli_shutdown(cli);
301 }
302
cli_state_get_vc_num(struct cli_state * cli)303 uint16_t cli_state_get_vc_num(struct cli_state *cli)
304 {
305 return cli->smb1.vc_num;
306 }
307
308 /****************************************************************************
309 Set the PID to use for smb messages. Return the old pid.
310 ****************************************************************************/
311
cli_setpid(struct cli_state * cli,uint32_t pid)312 uint32_t cli_setpid(struct cli_state *cli, uint32_t pid)
313 {
314 uint32_t ret = cli->smb1.pid;
315 cli->smb1.pid = pid;
316 return ret;
317 }
318
cli_getpid(struct cli_state * cli)319 uint32_t cli_getpid(struct cli_state *cli)
320 {
321 return cli->smb1.pid;
322 }
323
cli_state_is_encryption_on(struct cli_state * cli)324 bool cli_state_is_encryption_on(struct cli_state *cli)
325 {
326 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) {
327 return smb1cli_conn_encryption_on(cli->conn);
328 }
329
330 if (cli->smb2.tcon == NULL) {
331 return false;
332 }
333
334 return smb2cli_tcon_is_encryption_on(cli->smb2.tcon);
335 }
336
cli_state_has_tcon(struct cli_state * cli)337 bool cli_state_has_tcon(struct cli_state *cli)
338 {
339 uint32_t tid;
340 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
341 if (cli->smb2.tcon == NULL) {
342 return false;
343 }
344 tid = cli_state_get_tid(cli);
345 if (tid == UINT32_MAX) {
346 return false;
347 }
348 } else {
349 if (cli->smb1.tcon == NULL) {
350 return false;
351 }
352 tid = cli_state_get_tid(cli);
353 if (tid == UINT16_MAX) {
354 return false;
355 }
356 }
357 return true;
358 }
359
cli_state_get_tid(struct cli_state * cli)360 uint32_t cli_state_get_tid(struct cli_state *cli)
361 {
362 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
363 return smb2cli_tcon_current_id(cli->smb2.tcon);
364 } else {
365 return (uint32_t)smb1cli_tcon_current_id(cli->smb1.tcon);
366 }
367 }
368
cli_state_set_tid(struct cli_state * cli,uint32_t tid)369 uint32_t cli_state_set_tid(struct cli_state *cli, uint32_t tid)
370 {
371 uint32_t ret;
372 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
373 ret = smb2cli_tcon_current_id(cli->smb2.tcon);
374 smb2cli_tcon_set_id(cli->smb2.tcon, tid);
375 } else {
376 ret = smb1cli_tcon_current_id(cli->smb1.tcon);
377 smb1cli_tcon_set_id(cli->smb1.tcon, tid);
378 }
379 return ret;
380 }
381
cli_state_save_tcon(struct cli_state * cli)382 struct smbXcli_tcon *cli_state_save_tcon(struct cli_state *cli)
383 {
384 /*
385 * Note. This used to make a deep copy of either
386 * cli->smb2.tcon or cli->smb1.tcon, but this leaves
387 * the original pointer in place which will then get
388 * TALLOC_FREE()'d when the new connection is made on
389 * this cli_state.
390 *
391 * As there may be pipes open on the old connection with
392 * talloc'ed state allocated using the tcon pointer as a
393 * parent we can't deep copy and then free this as that
394 * closes the open pipes.
395 *
396 * This call is used to temporarily swap out a tcon pointer
397 * to allow a new tcon on the same cli_state.
398 *
399 * Just return the raw pointer and set the old value to NULL.
400 * We know we MUST be calling cli_state_restore_tcon() below
401 * to restore before closing the session.
402 *
403 * See BUG: https://bugzilla.samba.org/show_bug.cgi?id=13992
404 */
405 struct smbXcli_tcon *tcon_ret = NULL;
406
407 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
408 tcon_ret = cli->smb2.tcon;
409 cli->smb2.tcon = NULL; /* *Not* TALLOC_FREE(). */
410 } else {
411 tcon_ret = cli->smb1.tcon;
412 cli->smb1.tcon = NULL; /* *Not* TALLOC_FREE(). */
413 }
414 return tcon_ret;
415 }
416
cli_state_restore_tcon(struct cli_state * cli,struct smbXcli_tcon * tcon)417 void cli_state_restore_tcon(struct cli_state *cli, struct smbXcli_tcon *tcon)
418 {
419 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
420 TALLOC_FREE(cli->smb2.tcon);
421 cli->smb2.tcon = tcon;
422 } else {
423 TALLOC_FREE(cli->smb1.tcon);
424 cli->smb1.tcon = tcon;
425 }
426 }
427
cli_state_get_uid(struct cli_state * cli)428 uint16_t cli_state_get_uid(struct cli_state *cli)
429 {
430 return smb1cli_session_current_id(cli->smb1.session);
431 }
432
cli_state_set_uid(struct cli_state * cli,uint16_t uid)433 uint16_t cli_state_set_uid(struct cli_state *cli, uint16_t uid)
434 {
435 uint16_t ret = smb1cli_session_current_id(cli->smb1.session);
436 smb1cli_session_set_id(cli->smb1.session, uid);
437 return ret;
438 }
439
440 /****************************************************************************
441 Set the case sensitivity flag on the packets. Returns old state.
442 ****************************************************************************/
443
cli_set_case_sensitive(struct cli_state * cli,bool case_sensitive)444 bool cli_set_case_sensitive(struct cli_state *cli, bool case_sensitive)
445 {
446 bool ret;
447 uint32_t fs_attrs;
448 struct smbXcli_tcon *tcon;
449
450 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
451 tcon = cli->smb2.tcon;
452 } else {
453 tcon = cli->smb1.tcon;
454 }
455
456 fs_attrs = smbXcli_tcon_get_fs_attributes(tcon);
457 if (fs_attrs & FILE_CASE_SENSITIVE_SEARCH) {
458 ret = true;
459 } else {
460 ret = false;
461 }
462 if (case_sensitive) {
463 fs_attrs |= FILE_CASE_SENSITIVE_SEARCH;
464 } else {
465 fs_attrs &= ~FILE_CASE_SENSITIVE_SEARCH;
466 }
467 smbXcli_tcon_set_fs_attributes(tcon, fs_attrs);
468
469 return ret;
470 }
471
cli_state_available_size(struct cli_state * cli,uint32_t ofs)472 uint32_t cli_state_available_size(struct cli_state *cli, uint32_t ofs)
473 {
474 uint32_t ret = smb1cli_conn_max_xmit(cli->conn);
475
476 if (ofs >= ret) {
477 return 0;
478 }
479
480 ret -= ofs;
481
482 return ret;
483 }
484
cli_state_server_time(struct cli_state * cli)485 time_t cli_state_server_time(struct cli_state *cli)
486 {
487 NTTIME nt;
488 time_t t;
489
490 nt = smbXcli_conn_server_system_time(cli->conn);
491 t = nt_time_to_unix(nt);
492
493 return t;
494 }
495
496 struct cli_echo_state {
497 bool is_smb2;
498 };
499
500 static void cli_echo_done(struct tevent_req *subreq);
501
cli_echo_send(TALLOC_CTX * mem_ctx,struct tevent_context * ev,struct cli_state * cli,uint16_t num_echos,DATA_BLOB data)502 struct tevent_req *cli_echo_send(TALLOC_CTX *mem_ctx, struct tevent_context *ev,
503 struct cli_state *cli, uint16_t num_echos,
504 DATA_BLOB data)
505 {
506 struct tevent_req *req, *subreq;
507 struct cli_echo_state *state;
508
509 req = tevent_req_create(mem_ctx, &state, struct cli_echo_state);
510 if (req == NULL) {
511 return NULL;
512 }
513
514 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
515 state->is_smb2 = true;
516 subreq = smb2cli_echo_send(state, ev,
517 cli->conn,
518 cli->timeout);
519 } else {
520 subreq = smb1cli_echo_send(state, ev,
521 cli->conn,
522 cli->timeout,
523 num_echos,
524 data);
525 }
526 if (tevent_req_nomem(subreq, req)) {
527 return tevent_req_post(req, ev);
528 }
529 tevent_req_set_callback(subreq, cli_echo_done, req);
530
531 return req;
532 }
533
cli_echo_done(struct tevent_req * subreq)534 static void cli_echo_done(struct tevent_req *subreq)
535 {
536 struct tevent_req *req = tevent_req_callback_data(
537 subreq, struct tevent_req);
538 struct cli_echo_state *state = tevent_req_data(
539 req, struct cli_echo_state);
540 NTSTATUS status;
541
542 if (state->is_smb2) {
543 status = smb2cli_echo_recv(subreq);
544 } else {
545 status = smb1cli_echo_recv(subreq);
546 }
547 TALLOC_FREE(subreq);
548 if (!NT_STATUS_IS_OK(status)) {
549 tevent_req_nterror(req, status);
550 return;
551 }
552
553 tevent_req_done(req);
554 }
555
556 /**
557 * Get the result out from an echo request
558 * @param[in] req The async_req from cli_echo_send
559 * @retval Did the server reply correctly?
560 */
561
cli_echo_recv(struct tevent_req * req)562 NTSTATUS cli_echo_recv(struct tevent_req *req)
563 {
564 return tevent_req_simple_recv_ntstatus(req);
565 }
566
567 /**
568 * @brief Send/Receive SMBEcho requests
569 * @param[in] mem_ctx The memory context to put the async_req on
570 * @param[in] ev The event context that will call us back
571 * @param[in] cli The connection to send the echo to
572 * @param[in] num_echos How many times do we want to get the reply?
573 * @param[in] data The data we want to get back
574 * @retval Did the server reply correctly?
575 */
576
cli_echo(struct cli_state * cli,uint16_t num_echos,DATA_BLOB data)577 NTSTATUS cli_echo(struct cli_state *cli, uint16_t num_echos, DATA_BLOB data)
578 {
579 TALLOC_CTX *frame = talloc_stackframe();
580 struct tevent_context *ev;
581 struct tevent_req *req;
582 NTSTATUS status = NT_STATUS_OK;
583
584 if (smbXcli_conn_has_async_calls(cli->conn)) {
585 /*
586 * Can't use sync call while an async call is in flight
587 */
588 status = NT_STATUS_INVALID_PARAMETER;
589 goto fail;
590 }
591
592 ev = samba_tevent_context_init(frame);
593 if (ev == NULL) {
594 status = NT_STATUS_NO_MEMORY;
595 goto fail;
596 }
597
598 req = cli_echo_send(frame, ev, cli, num_echos, data);
599 if (req == NULL) {
600 status = NT_STATUS_NO_MEMORY;
601 goto fail;
602 }
603
604 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
605 goto fail;
606 }
607
608 status = cli_echo_recv(req);
609 fail:
610 TALLOC_FREE(frame);
611 return status;
612 }
613
cli_smb(TALLOC_CTX * mem_ctx,struct cli_state * cli,uint8_t smb_command,uint8_t additional_flags,uint8_t wct,uint16_t * vwv,uint32_t num_bytes,const uint8_t * bytes,struct tevent_req ** result_parent,uint8_t min_wct,uint8_t * pwct,uint16_t ** pvwv,uint32_t * pnum_bytes,uint8_t ** pbytes)614 NTSTATUS cli_smb(TALLOC_CTX *mem_ctx, struct cli_state *cli,
615 uint8_t smb_command, uint8_t additional_flags,
616 uint8_t wct, uint16_t *vwv,
617 uint32_t num_bytes, const uint8_t *bytes,
618 struct tevent_req **result_parent,
619 uint8_t min_wct, uint8_t *pwct, uint16_t **pvwv,
620 uint32_t *pnum_bytes, uint8_t **pbytes)
621 {
622 struct tevent_context *ev;
623 struct tevent_req *req = NULL;
624 NTSTATUS status = NT_STATUS_NO_MEMORY;
625
626 if (smbXcli_conn_has_async_calls(cli->conn)) {
627 return NT_STATUS_INVALID_PARAMETER;
628 }
629 ev = samba_tevent_context_init(mem_ctx);
630 if (ev == NULL) {
631 goto fail;
632 }
633 req = cli_smb_send(mem_ctx, ev, cli, smb_command, additional_flags, 0,
634 wct, vwv, num_bytes, bytes);
635 if (req == NULL) {
636 goto fail;
637 }
638 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
639 goto fail;
640 }
641 status = cli_smb_recv(req, NULL, NULL, min_wct, pwct, pvwv,
642 pnum_bytes, pbytes);
643 fail:
644 TALLOC_FREE(ev);
645 if (NT_STATUS_IS_OK(status) && (result_parent != NULL)) {
646 *result_parent = req;
647 }
648 return status;
649 }
650