From 77a771be72a6084216ea848f2d851eb7192ae9b9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 16:15:03 +0200 Subject: [PATCH 001/105] libcli:smb2: Do not leak ptext on error Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- libcli/smb/smb2_signing.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c index 623fc23fb18..bba80817018 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c @@ -522,6 +522,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, ctext = talloc_size(talloc_tos(), ctext_size); if (ctext == NULL) { + TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; goto out; } -- 2.28.0 From eb5fbbd3090cbdea95b14e9ac167253fafe633f8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 17:23:37 +0200 Subject: [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have a stackframe If we execute this code from python we don't have a talloc stackframe around and segfault with talloc_tos(). To fix the crash we use the NULL context as we take care for freeing the memory as soon as possible. Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- libcli/smb/smb2_signing.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c index bba80817018..7669b219bbe 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c @@ -513,14 +513,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, uint8_t *ctext = NULL; size_t len = 0; int i; + TALLOC_CTX *tmp_ctx = NULL; - ptext = talloc_size(talloc_tos(), ptext_size); + /* + * If we come from python bindings, we don't have a stackframe + * around, so use the NULL context. + * + * This is fine as we make sure we free the memory. + */ + if (talloc_stackframe_exists()) { + tmp_ctx = talloc_tos(); + } + + ptext = talloc_size(tmp_ctx, ptext_size); if (ptext == NULL) { status = NT_STATUS_NO_MEMORY; goto out; } - ctext = talloc_size(talloc_tos(), ctext_size); + ctext = talloc_size(tmp_ctx, ctext_size); if (ctext == NULL) { TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; @@ -713,16 +724,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, uint8_t *ptext = NULL; size_t len = 0; int i; + TALLOC_CTX *tmp_ctx = NULL; + + /* + * If we come from python bindings, we don't have a stackframe + * around, so use the NULL context. + * + * This is fine as we make sure we free the memory. + */ + if (talloc_stackframe_exists()) { + tmp_ctx = talloc_tos(); + } /* GnuTLS doesn't have a iovec API for decryption yet */ - ptext = talloc_size(talloc_tos(), ptext_size); + ptext = talloc_size(tmp_ctx, ptext_size); if (ptext == NULL) { status = NT_STATUS_NO_MEMORY; goto out; } - ctext = talloc_size(talloc_tos(), ctext_size); + ctext = talloc_size(tmp_ctx, ctext_size); if (ctext == NULL) { TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; -- 2.28.0 From 66ee204aee9a4919d94003a9a3263a44c2d5b436 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 6 Nov 2019 17:37:45 +0100 Subject: [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF We have several places where we check '> CRED_UNINITIALISED', so we better don't use CRED_UNINITIALISED for values from our smb.conf. Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider --- auth/credentials/credentials.c | 6 +++--- auth/credentials/credentials.h | 1 + auth/credentials/pycredentials.c | 1 + python/samba/tests/credentials.py | 4 ++-- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c index 81f9dbb9eb3..80a31b248ae 100644 --- a/auth/credentials/credentials.c +++ b/auth/credentials/credentials.c @@ -902,12 +902,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, if (lpcfg_parm_is_cmdline(lp_ctx, "workgroup")) { cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SPECIFIED); } else { - cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_UNINITIALISED); + cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SMB_CONF); } if (lpcfg_parm_is_cmdline(lp_ctx, "netbios name")) { cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SPECIFIED); } else { - cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED); + cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SMB_CONF); } if (realm != NULL && strlen(realm) == 0) { realm = NULL; @@ -915,7 +915,7 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, if (lpcfg_parm_is_cmdline(lp_ctx, "realm")) { cli_credentials_set_realm(cred, realm, CRED_SPECIFIED); } else { - cli_credentials_set_realm(cred, realm, CRED_UNINITIALISED); + cli_credentials_set_realm(cred, realm, CRED_SMB_CONF); } sep = lpcfg_winbind_separator(lp_ctx); diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h index 9fe6a82b1ea..7154c2a008c 100644 --- a/auth/credentials/credentials.h +++ b/auth/credentials/credentials.h @@ -42,6 +42,7 @@ struct db_context; /* In order of priority */ enum credentials_obtained { CRED_UNINITIALISED = 0, /* We don't even have a guess yet */ + CRED_SMB_CONF, /* Current value should be used, which comes from smb.conf */ CRED_CALLBACK, /* Callback should be used to obtain value */ CRED_GUESS_ENV, /* Current value should be used, which was guessed */ CRED_GUESS_FILE, /* A guess from a file (or file pointed at in env variable) */ diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c index a5d0f9e051c..68edc282741 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c @@ -1275,6 +1275,7 @@ MODULE_INIT_FUNC(credentials) return NULL; PyModule_AddObject(m, "UNINITIALISED", PyLong_FromLong(CRED_UNINITIALISED)); + PyModule_AddObject(m, "SMB_CONF", PyLong_FromLong(CRED_SMB_CONF)); PyModule_AddObject(m, "CALLBACK", PyLong_FromLong(CRED_CALLBACK)); PyModule_AddObject(m, "GUESS_ENV", PyLong_FromLong(CRED_GUESS_ENV)); PyModule_AddObject(m, "GUESS_FILE", PyLong_FromLong(CRED_GUESS_FILE)); diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py index d2a81506de3..6454ac9ff7c 100644 --- a/python/samba/tests/credentials.py +++ b/python/samba/tests/credentials.py @@ -332,7 +332,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): os.environ["USER"] = "env_user" creds.guess(lp) realm = "realm.example.com" - creds.set_realm(realm, credentials.UNINITIALISED) + creds.set_realm(realm, credentials.SMB_CONF) creds.parse_string("user") self.assertEqual(creds.get_username(), "user") self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) @@ -360,7 +360,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): os.environ["USER"] = "env_user" creds.guess(lp) realm = "realm.example.com" - creds.set_realm(realm, credentials.UNINITIALISED) + creds.set_realm(realm, credentials.SMB_CONF) self.assertEqual(creds.get_username(), "env_user") self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) self.assertEqual(creds.get_realm(), realm.upper()) -- 2.28.0 From 8d2d8cdc90d0455429c9d461ebd65d21a0b29b8d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 10 Oct 2019 14:18:23 +0200 Subject: [PATCH 004/105] param: Add 'server smb encrypt' parameter And this also makes 'smb encrypt' a synonym of that. Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- .../smbdotconf/security/serversmbencrypt.xml | 241 ++++++++++++++++++ docs-xml/smbdotconf/security/smbencrypt.xml | 241 +----------------- source3/param/loadparm.c | 2 +- source3/smbd/service.c | 4 +- source3/smbd/smb2_negprot.c | 2 +- source3/smbd/smb2_sesssetup.c | 4 +- source3/smbd/smb2_tcon.c | 4 +- source3/smbd/trans2.c | 2 +- 8 files changed, 257 insertions(+), 243 deletions(-) create mode 100644 docs-xml/smbdotconf/security/serversmbencrypt.xml diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml new file mode 100644 index 00000000000..714aacbf1ca --- /dev/null +++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml @@ -0,0 +1,241 @@ + + + + This parameter controls whether a remote client is allowed or required + to use SMB encryption. It has different effects depending on whether + the connection uses SMB1 or SMB2 and newer: + + + + + + If the connection uses SMB1, then this option controls the use + of a Samba-specific extension to the SMB protocol introduced in + Samba 3.2 that makes use of the Unix extensions. + + + + + + If the connection uses SMB2 or newer, then this option controls + the use of the SMB-level encryption that is supported in SMB + version 3.0 and above and available in Windows 8 and newer. + + + + + + This parameter can be set globally and on a per-share bases. + Possible values are + + off, + if_required, + desired, + and + required. + A special value is default which is + the implicit default setting of if_required. + + + + + Effects for SMB1 + + + The Samba-specific encryption of SMB1 connections is an + extension to the SMB protocol negotiated as part of the UNIX + extensions. SMB encryption uses the GSSAPI (SSPI on Windows) + ability to encrypt and sign every request/response in a SMB + protocol stream. When enabled it provides a secure method of + SMB/CIFS communication, similar to an ssh protected session, but + using SMB/CIFS authentication to negotiate encryption and + signing keys. Currently this is only supported smbclient of by + Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X + clients. Windows clients do not support this feature. + + + This may be set on a per-share + basis, but clients may chose to encrypt the entire session, not + just traffic to a specific share. If this is set to mandatory + then all traffic to a share must + be encrypted once the connection has been made to the share. + The server would return "access denied" to all non-encrypted + requests on such a share. Selecting encrypted traffic reduces + throughput as smaller packet sizes must be used (no huge UNIX + style read/writes allowed) as well as the overhead of encrypting + and signing all the data. + + + + If SMB encryption is selected, Windows style SMB signing (see + the option) is no longer + necessary, as the GSSAPI flags use select both signing and + sealing of the data. + + + + When set to auto or default, SMB encryption is offered, but not + enforced. When set to mandatory, SMB encryption is required and + if set to disabled, SMB encryption can not be negotiated. + + + + + + Effects for SMB2 and newer + + + Native SMB transport encryption is available in SMB version 3.0 + or newer. It is only offered by Samba if + server max protocol is set to + SMB3 or newer. + Clients supporting this type of encryption include + Windows 8 and newer, + Windows server 2012 and newer, + and smbclient of Samba 4.1 and newer. + + + + The protocol implementation offers various options: + + + + + + The capability to perform SMB encryption can be + negotiated during protocol negotiation. + + + + + + Data encryption can be enabled globally. In that case, + an encryption-capable connection will have all traffic + in all its sessions encrypted. In particular all share + connections will be encrypted. + + + + + + Data encryption can also be enabled per share if not + enabled globally. For an encryption-capable connection, + all connections to an encryption-enabled share will be + encrypted. + + + + + + Encryption can be enforced. This means that session + setups will be denied on non-encryption-capable + connections if data encryption has been enabled + globally. And tree connections will be denied for + non-encryption capable connections to shares with data + encryption enabled. + + + + + + These features can be controlled with settings of + server smb encrypt as follows: + + + + + + Leaving it as default, explicitly setting + default, or setting it to + if_required globally will enable + negotiation of encryption but will not turn on + data encryption globally or per share. + + + + + + Setting it to desired globally + will enable negotiation and will turn on data encryption + on sessions and share connections for those clients + that support it. + + + + + + Setting it to required globally + will enable negotiation and turn on data encryption + on sessions and share connections. Clients that do + not support encryption will be denied access to the + server. + + + + + + Setting it to off globally will + completely disable the encryption feature for all + connections. Setting server smb encrypt = + required for individual shares (while it's + globally off) will deny access to this shares for all + clients. + + + + + + Setting it to desired on a share + will turn on data encryption for this share for clients + that support encryption if negotiation has been + enabled globally. + + + + + + Setting it to required on a share + will enforce data encryption for this share if + negotiation has been enabled globally. I.e. clients that + do not support encryption will be denied access to the + share. + + + Note that this allows per-share enforcing to be + controlled in Samba differently from Windows: + In Windows, RejectUnencryptedAccess + is a global setting, and if it is set, all shares with + data encryption turned on + are automatically enforcing encryption. In order to + achieve the same effect in Samba, one + has to globally set server smb encrypt to + if_required, and then set all shares + that should be encrypted to + required. + Additionally, it is possible in Samba to have some + shares with encryption required + and some other shares with encryption only + desired, which is not possible in + Windows. + + + + + + Setting it to off or + if_required for a share has + no effect. + + + + + + + + +default + diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml index 32a22cb58f5..798e616b765 100644 --- a/docs-xml/smbdotconf/security/smbencrypt.xml +++ b/docs-xml/smbdotconf/security/smbencrypt.xml @@ -1,241 +1,14 @@ + context="S" + type="enum" + enumlist="enum_smb_signing_vals" + function="server_smb_encrypt" + synonym="1" + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> - This parameter controls whether a remote client is allowed or required - to use SMB encryption. It has different effects depending on whether - the connection uses SMB1 or SMB2 and newer: + This is a synonym for . - - - - - If the connection uses SMB1, then this option controls the use - of a Samba-specific extension to the SMB protocol introduced in - Samba 3.2 that makes use of the Unix extensions. - - - - - - If the connection uses SMB2 or newer, then this option controls - the use of the SMB-level encryption that is supported in SMB - version 3.0 and above and available in Windows 8 and newer. - - - - - - This parameter can be set globally and on a per-share bases. - Possible values are - off (or disabled), - enabled (or auto, or - if_required), - desired, - and - required - (or mandatory). - A special value is default which is - the implicit default setting of enabled. - - - - - Effects for SMB1 - - - The Samba-specific encryption of SMB1 connections is an - extension to the SMB protocol negotiated as part of the UNIX - extensions. SMB encryption uses the GSSAPI (SSPI on Windows) - ability to encrypt and sign every request/response in a SMB - protocol stream. When enabled it provides a secure method of - SMB/CIFS communication, similar to an ssh protected session, but - using SMB/CIFS authentication to negotiate encryption and - signing keys. Currently this is only supported smbclient of by - Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X - clients. Windows clients do not support this feature. - - - This may be set on a per-share - basis, but clients may chose to encrypt the entire session, not - just traffic to a specific share. If this is set to mandatory - then all traffic to a share must - be encrypted once the connection has been made to the share. - The server would return "access denied" to all non-encrypted - requests on such a share. Selecting encrypted traffic reduces - throughput as smaller packet sizes must be used (no huge UNIX - style read/writes allowed) as well as the overhead of encrypting - and signing all the data. - - - - If SMB encryption is selected, Windows style SMB signing (see - the option) is no longer - necessary, as the GSSAPI flags use select both signing and - sealing of the data. - - - - When set to auto or default, SMB encryption is offered, but not - enforced. When set to mandatory, SMB encryption is required and - if set to disabled, SMB encryption can not be negotiated. - - - - - - Effects for SMB2 - - - Native SMB transport encryption is available in SMB version 3.0 - or newer. It is only offered by Samba if - server max protocol is set to - SMB3 or newer. - Clients supporting this type of encryption include - Windows 8 and newer, - Windows server 2012 and newer, - and smbclient of Samba 4.1 and newer. - - - - The protocol implementation offers various options: - - - - - - The capability to perform SMB encryption can be - negotiated during protocol negotiation. - - - - - - Data encryption can be enabled globally. In that case, - an encryption-capable connection will have all traffic - in all its sessions encrypted. In particular all share - connections will be encrypted. - - - - - - Data encryption can also be enabled per share if not - enabled globally. For an encryption-capable connection, - all connections to an encryption-enabled share will be - encrypted. - - - - - - Encryption can be enforced. This means that session - setups will be denied on non-encryption-capable - connections if data encryption has been enabled - globally. And tree connections will be denied for - non-encryption capable connections to shares with data - encryption enabled. - - - - - - These features can be controlled with settings of - smb encrypt as follows: - - - - - - Leaving it as default, explicitly setting - default, or setting it to - enabled globally will enable - negotiation of encryption but will not turn on - data encryption globally or per share. - - - - - - Setting it to desired globally - will enable negotiation and will turn on data encryption - on sessions and share connections for those clients - that support it. - - - - - - Setting it to required globally - will enable negotiation and turn on data encryption - on sessions and share connections. Clients that do - not support encryption will be denied access to the - server. - - - - - - Setting it to off globally will - completely disable the encryption feature for all - connections. Setting smb encrypt = - required for individual shares (while it's - globally off) will deny access to this shares for all - clients. - - - - - - Setting it to desired on a share - will turn on data encryption for this share for clients - that support encryption if negotiation has been - enabled globally. - - - - - - Setting it to required on a share - will enforce data encryption for this share if - negotiation has been enabled globally. I.e. clients that - do not support encryption will be denied access to the - share. - - - Note that this allows per-share enforcing to be - controlled in Samba differently from Windows: - In Windows, RejectUnencryptedAccess - is a global setting, and if it is set, all shares with - data encryption turned on - are automatically enforcing encryption. In order to - achieve the same effect in Samba, one - has to globally set smb encrypt to - enabled, and then set all shares - that should be encrypted to - required. - Additionally, it is possible in Samba to have some - shares with encryption required - and some other shares with encryption only - desired, which is not possible in - Windows. - - - - - - Setting it to off or - enabled for a share has - no effect. - - - - - - default diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 6674485738a..82be31e8437 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = .aio_write_size = 1, .map_readonly = MAP_READONLY_NO, .directory_name_cache_size = 100, - .smb_encrypt = SMB_SIGNING_DEFAULT, + .server_smb_encrypt = SMB_SIGNING_DEFAULT, .kernel_share_modes = true, .durable_handles = true, .check_parent_directory_delete_on_close = false, diff --git a/source3/smbd/service.c b/source3/smbd/service.c index ed38121f292..a263c33b7e2 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c @@ -567,9 +567,9 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, conn->case_preserve = lp_preserve_case(snum); conn->short_case_preserve = lp_short_preserve_case(snum); - conn->encrypt_level = lp_smb_encrypt(snum); + conn->encrypt_level = lp_server_smb_encrypt(snum); if (conn->encrypt_level > SMB_SIGNING_OFF) { - if (lp_smb_encrypt(-1) == SMB_SIGNING_OFF) { + if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) { if (conn->encrypt_level == SMB_SIGNING_REQUIRED) { DBG_ERR("Service [%s] requires encryption, but " "it is disabled globally!\n", diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c index 4071f42b5e0..674942b71de 100644 --- a/source3/smbd/smb2_negprot.c +++ b/source3/smbd/smb2_negprot.c @@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) } if ((protocol >= PROTOCOL_SMB2_24) && - (lp_smb_encrypt(-1) != SMB_SIGNING_OFF) && + (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) && (in_capabilities & SMB2_CAP_ENCRYPTION)) { capabilities |= SMB2_CAP_ENCRYPTION; } diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c index 2b6b3a820d4..8957411e167 100644 --- a/source3/smbd/smb2_sesssetup.c +++ b/source3/smbd/smb2_sesssetup.c @@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED; } - if ((lp_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && + if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) { x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED; } - if (lp_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { + if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED | SMBXSRV_ENCRYPTION_DESIRED; } diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c index 76112d04889..0dd3c653b4b 100644 --- a/source3/smbd/smb2_tcon.c +++ b/source3/smbd/smb2_tcon.c @@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, TALLOC_FREE(proxy); } - if ((lp_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && + if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && (conn->smb2.server.cipher != 0)) { encryption_desired = true; } - if (lp_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { + if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { encryption_desired = true; encryption_required = true; } diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index 7acde285a90..b745e0906b1 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -4484,7 +4484,7 @@ static void call_trans2setfsinfo(connection_struct *conn, return; } - if (lp_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { + if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { reply_nterror( req, NT_STATUS_NOT_SUPPORTED); -- 2.28.0 From 71b97ba1fd9260efd29e3ab3456b82d2a4f6dcc8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 10:04:19 +0200 Subject: [PATCH 005/105] param: Create and use enum_smb_encryption_vals Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- .../smbdotconf/security/serversmbencrypt.xml | 2 +- docs-xml/smbdotconf/security/smbencrypt.xml | 2 +- lib/param/param_table.c | 23 +++++++++++++++++++ libcli/smb/smb_constants.h | 9 ++++++++ 4 files changed, 34 insertions(+), 2 deletions(-) diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml index 714aacbf1ca..5f38b46419e 100644 --- a/docs-xml/smbdotconf/security/serversmbencrypt.xml +++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml @@ -1,7 +1,7 @@ diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml index 798e616b765..60271200c0a 100644 --- a/docs-xml/smbdotconf/security/smbencrypt.xml +++ b/docs-xml/smbdotconf/security/smbencrypt.xml @@ -1,7 +1,7 @@ diff --git a/lib/param/param_table.c b/lib/param/param_table.c index 47b85de1f87..e2f737279dc 100644 --- a/lib/param/param_table.c +++ b/lib/param/param_table.c @@ -138,6 +138,29 @@ static const struct enum_list enum_smb_signing_vals[] = { {-1, NULL} }; +static const struct enum_list enum_smb_encryption_vals[] = { + {SMB_ENCRYPTION_DEFAULT, "default"}, + {SMB_ENCRYPTION_OFF, "No"}, + {SMB_ENCRYPTION_OFF, "False"}, + {SMB_ENCRYPTION_OFF, "0"}, + {SMB_ENCRYPTION_OFF, "Off"}, + {SMB_ENCRYPTION_OFF, "disabled"}, + {SMB_ENCRYPTION_IF_REQUIRED, "if_required"}, + {SMB_ENCRYPTION_IF_REQUIRED, "Yes"}, + {SMB_ENCRYPTION_IF_REQUIRED, "True"}, + {SMB_ENCRYPTION_IF_REQUIRED, "1"}, + {SMB_ENCRYPTION_IF_REQUIRED, "On"}, + {SMB_ENCRYPTION_IF_REQUIRED, "enabled"}, + {SMB_ENCRYPTION_IF_REQUIRED, "auto"}, + {SMB_ENCRYPTION_DESIRED, "desired"}, + {SMB_ENCRYPTION_REQUIRED, "required"}, + {SMB_ENCRYPTION_REQUIRED, "mandatory"}, + {SMB_ENCRYPTION_REQUIRED, "force"}, + {SMB_ENCRYPTION_REQUIRED, "forced"}, + {SMB_ENCRYPTION_REQUIRED, "enforced"}, + {-1, NULL} +}; + static const struct enum_list enum_mdns_name_values[] = { {MDNS_NAME_NETBIOS, "netbios"}, {MDNS_NAME_MDNS, "mdns"}, diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h index b424b13cde4..2fb1fd7189e 100644 --- a/libcli/smb/smb_constants.h +++ b/libcli/smb/smb_constants.h @@ -106,6 +106,15 @@ enum smb_signing_setting { SMB_SIGNING_REQUIRED = 3, }; +/* This MUST align with 'enum smb_signing_setting' */ +enum smb_encryption_setting { + SMB_ENCRYPTION_DEFAULT = SMB_SIGNING_DEFAULT, + SMB_ENCRYPTION_OFF = SMB_SIGNING_OFF, + SMB_ENCRYPTION_IF_REQUIRED = SMB_SIGNING_IF_REQUIRED, + SMB_ENCRYPTION_DESIRED = SMB_SIGNING_DESIRED, + SMB_ENCRYPTION_REQUIRED = SMB_SIGNING_REQUIRED, +}; + /* types of buffers in core SMB protocol */ #define SMB_DATA_BLOCK 0x1 #define SMB_ASCII4 0x4 -- 2.28.0 From ca1e10a901af67327d25765bfed404e2d1c756a5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:34:54 +0200 Subject: [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/param/loadparm.c | 2 +- source3/smbd/service.c | 8 ++++---- source3/smbd/smb2_negprot.c | 2 +- source3/smbd/smb2_sesssetup.c | 4 ++-- source3/smbd/smb2_tcon.c | 4 ++-- source3/smbd/trans2.c | 3 ++- 6 files changed, 12 insertions(+), 11 deletions(-) diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 82be31e8437..b305e34b252 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = .aio_write_size = 1, .map_readonly = MAP_READONLY_NO, .directory_name_cache_size = 100, - .server_smb_encrypt = SMB_SIGNING_DEFAULT, + .server_smb_encrypt = SMB_ENCRYPTION_DEFAULT, .kernel_share_modes = true, .durable_handles = true, .check_parent_directory_delete_on_close = false, diff --git a/source3/smbd/service.c b/source3/smbd/service.c index a263c33b7e2..43803e721c2 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c @@ -568,16 +568,16 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, conn->short_case_preserve = lp_short_preserve_case(snum); conn->encrypt_level = lp_server_smb_encrypt(snum); - if (conn->encrypt_level > SMB_SIGNING_OFF) { - if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) { - if (conn->encrypt_level == SMB_SIGNING_REQUIRED) { + if (conn->encrypt_level > SMB_ENCRYPTION_OFF) { + if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_OFF) { + if (conn->encrypt_level == SMB_ENCRYPTION_REQUIRED) { DBG_ERR("Service [%s] requires encryption, but " "it is disabled globally!\n", lp_const_servicename(snum)); status = NT_STATUS_ACCESS_DENIED; goto err_root_exit; } - conn->encrypt_level = SMB_SIGNING_OFF; + conn->encrypt_level = SMB_ENCRYPTION_OFF; } } diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c index 674942b71de..99303f1b07b 100644 --- a/source3/smbd/smb2_negprot.c +++ b/source3/smbd/smb2_negprot.c @@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) } if ((protocol >= PROTOCOL_SMB2_24) && - (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) && + (lp_server_smb_encrypt(-1) != SMB_ENCRYPTION_OFF) && (in_capabilities & SMB2_CAP_ENCRYPTION)) { capabilities |= SMB2_CAP_ENCRYPTION; } diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c index 8957411e167..907dd92321e 100644 --- a/source3/smbd/smb2_sesssetup.c +++ b/source3/smbd/smb2_sesssetup.c @@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED; } - if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && + if ((lp_server_smb_encrypt(-1) >= SMB_ENCRYPTION_DESIRED) && (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) { x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED; } - if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { + if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_REQUIRED) { x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED | SMBXSRV_ENCRYPTION_DESIRED; } diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c index 0dd3c653b4b..d7e0cf90f47 100644 --- a/source3/smbd/smb2_tcon.c +++ b/source3/smbd/smb2_tcon.c @@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, TALLOC_FREE(proxy); } - if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && + if ((lp_server_smb_encrypt(snum) >= SMB_ENCRYPTION_DESIRED) && (conn->smb2.server.cipher != 0)) { encryption_desired = true; } - if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { + if (lp_server_smb_encrypt(snum) == SMB_ENCRYPTION_REQUIRED) { encryption_desired = true; encryption_required = true; } diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index b745e0906b1..2f2fdcb7260 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -4484,7 +4484,8 @@ static void call_trans2setfsinfo(connection_struct *conn, return; } - if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { + if (lp_server_smb_encrypt(SNUM(conn)) == + SMB_ENCRYPTION_OFF) { reply_nterror( req, NT_STATUS_NOT_SUPPORTED); -- 2.28.0 From a5630bb933393fe69ff9b7f072221b9085d6277c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Apr 2020 10:38:41 +0200 Subject: [PATCH 007/105] docs-xml: Add 'client smb encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- .../smbdotconf/security/clientsmbencrypt.xml | 126 ++++++++++++++++++ lib/param/loadparm.c | 4 + source3/param/loadparm.c | 2 + 3 files changed, 132 insertions(+) create mode 100644 docs-xml/smbdotconf/security/clientsmbencrypt.xml diff --git a/docs-xml/smbdotconf/security/clientsmbencrypt.xml b/docs-xml/smbdotconf/security/clientsmbencrypt.xml new file mode 100644 index 00000000000..05df152e734 --- /dev/null +++ b/docs-xml/smbdotconf/security/clientsmbencrypt.xml @@ -0,0 +1,126 @@ + + + + This parameter controls whether a client should try or is required + to use SMB encryption. It has different effects depending on whether + the connection uses SMB1 or SMB3: + + + + + + If the connection uses SMB1, then this option controls the use + of a Samba-specific extension to the SMB protocol introduced in + Samba 3.2 that makes use of the Unix extensions. + + + + + + If the connection uses SMB2 or newer, then this option controls + the use of the SMB-level encryption that is supported in SMB + version 3.0 and above and available in Windows 8 and newer. + + + + + + This parameter can be set globally. Possible values are + + off, + if_required, + desired, + and + required. + A special value is default which is + the implicit default setting of if_required. + + + + + Effects for SMB1 + + + The Samba-specific encryption of SMB1 connections is an + extension to the SMB protocol negotiated as part of the UNIX + extensions. SMB encryption uses the GSSAPI (SSPI on Windows) + ability to encrypt and sign every request/response in a SMB + protocol stream. When enabled it provides a secure method of + SMB/CIFS communication, similar to an ssh protected session, but + using SMB/CIFS authentication to negotiate encryption and + signing keys. Currently this is only supported smbclient of by + Samba 3.2 and newer. Windows does not support this feature. + + + + When set to default, SMB encryption is probed, but not + enforced. When set to required, SMB encryption is required and + if set to disabled, SMB encryption can not be negotiated. + + + + + + Effects for SMB3 and newer + + + Native SMB transport encryption is available in SMB version 3.0 + or newer. It is only used by Samba if + client max protocol is set to + SMB3 or newer. + + + + These features can be controlled with settings of + client smb encrypt as follows: + + + + + + Leaving it as default, explicitly setting + default, or setting it to + if_required globally will enable + negotiation of encryption but will not turn on + data encryption globally. + + + + + + Setting it to desired globally + will enable negotiation and will turn on data encryption + on sessions and share connections for those servers + that support it. + + + + + + Setting it to required globally + will enable negotiation and turn on data encryption + on sessions and share connections. Clients that do + not support encryption will be denied access to the + server. + + + + + + Setting it to off globally will + completely disable the encryption feature for all + connections. + + + + + + + + +default + diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index e041f4fb01b..e167903dbd9 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -3079,6 +3079,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) lpcfg_do_global_parameter( lp_ctx, "ldap max search request size", "256000"); + lpcfg_do_global_parameter(lp_ctx, + "client smb encrypt", + "default"); + for (i = 0; parm_table[i].label; i++) { if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { lp_ctx->flags[i] |= FLAG_DEFAULT; diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index b305e34b252..9a2a309b781 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -960,6 +960,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) Globals.ldap_max_authenticated_request_size = 16777216; Globals.ldap_max_search_request_size = 256000; + Globals.client_smb_encrypt = SMB_ENCRYPTION_DEFAULT; + /* Now put back the settings that were set with lp_set_cmdline() */ apply_lp_set_cmdline(); } -- 2.28.0 From 3d826b1efb4a0e1f77875c7cbad2fcd16c3ac17b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jul 2020 17:48:25 +0200 Subject: [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- lib/param/loadparm.c | 30 ++++++++++++++++++++++++++++++ lib/param/loadparm.h | 2 ++ 2 files changed, 32 insertions(+) diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index e167903dbd9..952d2b49811 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -3674,3 +3674,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, raw_value, lp_sub->private_data); } + +/** + * @brief Parse a string value of a given parameter to its integer enum value. + * + * @param[in] param_name The parameter name (e.g. 'client smb encrypt') + * + * @param[in] param_value The parameter value (e.g. 'required'). + * + * @return The integer value of the enum the param_value matches or INT32_MIN + * on error. + */ +int32_t lpcfg_parse_enum_vals(const char *param_name, + const char *param_value) +{ + struct parm_struct *parm = NULL; + int32_t ret = INT32_MIN; + bool ok; + + parm = lpcfg_parm_struct(NULL, param_name); + if (parm == NULL) { + return INT32_MIN; + } + + ok = lp_set_enum_parm(parm, param_value, &ret); + if (!ok) { + return INT32_MIN; + } + + return ret; +} diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h index 323fcf84523..e66ce2324b4 100644 --- a/lib/param/loadparm.h +++ b/lib/param/loadparm.h @@ -316,6 +316,8 @@ bool lp_do_section(const char *pszSectionName, void *userdata); bool store_lp_set_cmdline(const char *pszParmName, const char *pszParmValue); int num_parameters(void); +int32_t lpcfg_parse_enum_vals(const char *param_name, + const char *param_value); struct loadparm_substitution; #ifdef LOADPARM_SUBSTITUTION_INTERNALS -- 2.28.0 From 2f74f9d6a5d38e6eb2ca3d32f61d5d9b1c55f3c1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:38:08 +0200 Subject: [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- libcli/smb/smb_util.h | 7 ++++ libcli/smb/test_util_translate.c | 64 ++++++++++++++++++++++++++++++++ libcli/smb/util.c | 20 ++++++++++ libcli/smb/wscript | 5 +++ selftest/tests.py | 2 + 5 files changed, 98 insertions(+) create mode 100644 libcli/smb/test_util_translate.c diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h index 8861741c92f..15bdbe856d1 100644 --- a/libcli/smb/smb_util.h +++ b/libcli/smb/smb_util.h @@ -24,6 +24,9 @@ #include "smb_constants.h" #include +#ifndef _SMB_UTIL_H +#define _SMB_UTIL_H + const char *smb_protocol_types_string(enum protocol_types protocol); char *attrib_string(TALLOC_CTX *mem_ctx, uint32_t attrib); uint32_t unix_perms_to_wire(mode_t perms); @@ -46,3 +49,7 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, const uint8_t *buf, size_t buf_len, const uint8_t *position, size_t *_consumed); + +enum smb_signing_setting smb_signing_setting_translate(const char *str); + +#endif /* _SMB_UTIL_H */ diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c new file mode 100644 index 00000000000..4b81984affa --- /dev/null +++ b/libcli/smb/test_util_translate.c @@ -0,0 +1,64 @@ +/* + * Unix SMB/CIFS implementation. + * + * Copyright (C) 2020 Andreas Schneider + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#include +#include +#include +#include +#include + +#include "lib/replace/replace.h" +#include + +#include "libcli/smb/util.c" + +static void test_smb_signing_setting_translate(void **state) +{ + enum smb_signing_setting signing_state; + + signing_state = smb_signing_setting_translate("wurst"); + assert_int_equal(signing_state, SMB_SIGNING_REQUIRED); + + signing_state = smb_signing_setting_translate("off"); + assert_int_equal(signing_state, SMB_SIGNING_OFF); + + signing_state = smb_signing_setting_translate("if_required"); + assert_int_equal(signing_state, SMB_SIGNING_IF_REQUIRED); + + signing_state = smb_signing_setting_translate("mandatory"); + assert_int_equal(signing_state, SMB_SIGNING_REQUIRED); + +} + +int main(int argc, char *argv[]) +{ + int rc; + const struct CMUnitTest tests[] = { + cmocka_unit_test(test_smb_signing_setting_translate), + }; + + if (argc == 2) { + cmocka_set_test_filter(argv[1]); + } + cmocka_set_message_output(CM_OUTPUT_SUBUNIT); + + rc = cmocka_run_group_tests(tests, NULL, NULL); + + return rc; +} diff --git a/libcli/smb/util.c b/libcli/smb/util.c index 6fdf35fbbf3..da0e4db2bf3 100644 --- a/libcli/smb/util.c +++ b/libcli/smb/util.c @@ -22,6 +22,7 @@ #include "includes.h" #include "libcli/smb/smb_common.h" #include "system/filesys.h" +#include "lib/param/loadparm.h" const char *smb_protocol_types_string(enum protocol_types protocol) { @@ -428,3 +429,22 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, return internal_bytes_pull_str(mem_ctx, _str, ucs2, true, buf, buf_len, position, _consumed); } + +/** + * @brief Translate SMB signing settings as string to an enum. + * + * @param[in] str The string to translate. + * + * @return A corresponding enum @smb_signing_setting tranlated from the string. + */ +enum smb_signing_setting smb_signing_setting_translate(const char *str) +{ + enum smb_signing_setting signing_state = SMB_SIGNING_REQUIRED; + int32_t val = lpcfg_parse_enum_vals("client signing", str); + + if (val != INT32_MIN) { + signing_state = val; + } + + return signing_state; +} diff --git a/libcli/smb/wscript b/libcli/smb/wscript index 86e377f570b..c047fd33278 100644 --- a/libcli/smb/wscript +++ b/libcli/smb/wscript @@ -72,3 +72,8 @@ def build(bld): source='test_smb1cli_session.c', deps='cmocka cli_smb_common', for_selftest=True) + + bld.SAMBA_BINARY('test_util_translate', + source='test_util_translate.c', + deps='cmocka cli_smb_common', + for_selftest=True) diff --git a/selftest/tests.py b/selftest/tests.py index 6918e1306c3..20981754db4 100644 --- a/selftest/tests.py +++ b/selftest/tests.py @@ -376,6 +376,8 @@ plantestsuite("samba.unittests.lib_util_modules", "none", plantestsuite("samba.unittests.smb1cli_session", "none", [os.path.join(bindir(), "default/libcli/smb/test_smb1cli_session")]) +plantestsuite("samba.unittests.smb_util_translate", "none", + [os.path.join(bindir(), "default/libcli/smb/test_util_translate")]) plantestsuite("samba.unittests.talloc_keep_secret", "none", [os.path.join(bindir(), "default/lib/util/test_talloc_keep_secret")]) -- 2.28.0 From 912ec83bf4ec6a965ee10ace1d74036c5c6a4c92 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 08:39:34 +0200 Subject: [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() Add encryption enum and function to avoid confusion when reading the code. Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- libcli/smb/smb_util.h | 1 + libcli/smb/test_util_translate.c | 19 +++++++++++++++++++ libcli/smb/util.c | 20 ++++++++++++++++++++ 3 files changed, 40 insertions(+) diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h index 15bdbe856d1..2a727db8b6f 100644 --- a/libcli/smb/smb_util.h +++ b/libcli/smb/smb_util.h @@ -51,5 +51,6 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, size_t *_consumed); enum smb_signing_setting smb_signing_setting_translate(const char *str); +enum smb_encryption_setting smb_encryption_setting_translate(const char *str); #endif /* _SMB_UTIL_H */ diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c index 4b81984affa..b300af52c09 100644 --- a/libcli/smb/test_util_translate.c +++ b/libcli/smb/test_util_translate.c @@ -46,11 +46,30 @@ static void test_smb_signing_setting_translate(void **state) } +static void test_smb_encryption_setting_translate(void **state) +{ + enum smb_encryption_setting encryption_state; + + encryption_state = smb_encryption_setting_translate("wurst"); + assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED); + + encryption_state = smb_encryption_setting_translate("off"); + assert_int_equal(encryption_state, SMB_ENCRYPTION_OFF); + + encryption_state = smb_encryption_setting_translate("if_required"); + assert_int_equal(encryption_state, SMB_ENCRYPTION_IF_REQUIRED); + + encryption_state = smb_encryption_setting_translate("mandatory"); + assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED); + +} + int main(int argc, char *argv[]) { int rc; const struct CMUnitTest tests[] = { cmocka_unit_test(test_smb_signing_setting_translate), + cmocka_unit_test(test_smb_encryption_setting_translate), }; if (argc == 2) { diff --git a/libcli/smb/util.c b/libcli/smb/util.c index da0e4db2bf3..ac2887ee5c4 100644 --- a/libcli/smb/util.c +++ b/libcli/smb/util.c @@ -448,3 +448,23 @@ enum smb_signing_setting smb_signing_setting_translate(const char *str) return signing_state; } + +/** + * @brief Translate SMB encryption settings as string to an enum. + * + * @param[in] str The string to translate. + * + * @return A corresponding enum @smb_encryption_setting tranlated from the + * string. + */ +enum smb_encryption_setting smb_encryption_setting_translate(const char *str) +{ + enum smb_encryption_setting encryption_state = SMB_ENCRYPTION_REQUIRED; + int32_t val = lpcfg_parse_enum_vals("client smb encrypt", str); + + if (val != INT32_MIN) { + encryption_state = val; + } + + return encryption_state; +} -- 2.28.0 From 7d2c3a519805549f577b54cf72a5d95b4ae744f3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:47:59 +0200 Subject: [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline parsing The function will be removed soon. Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/lib/util_cmdline.c | 17 +++-------------- source3/wscript_build | 2 +- 2 files changed, 4 insertions(+), 15 deletions(-) diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c index 90ee67c4cb7..bc1f1c3ed25 100644 --- a/source3/lib/util_cmdline.c +++ b/source3/lib/util_cmdline.c @@ -28,6 +28,7 @@ #include "librpc/gen_ndr/samr.h" #include "auth/credentials/credentials.h" #include "auth/gensec/gensec.h" +#include "libcli/smb/smb_util.h" /**************************************************************************n Code to cope with username/password auth options from the commandline. @@ -240,20 +241,8 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info, bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info, const char *arg) { - auth_info->signing_state = SMB_SIGNING_DEFAULT; - if (strequal(arg, "off") || strequal(arg, "no") || - strequal(arg, "false")) { - auth_info->signing_state = SMB_SIGNING_OFF; - } else if (strequal(arg, "on") || strequal(arg, "yes") || - strequal(arg, "if_required") || - strequal(arg, "true") || strequal(arg, "auto")) { - auth_info->signing_state = SMB_SIGNING_IF_REQUIRED; - } else if (strequal(arg, "force") || strequal(arg, "required") || - strequal(arg, "forced")) { - auth_info->signing_state = SMB_SIGNING_REQUIRED; - } else { - return false; - } + auth_info->signing_state = smb_signing_setting_translate(arg); + return true; } diff --git a/source3/wscript_build b/source3/wscript_build index 5a07eddac44..6a08afe4a25 100644 --- a/source3/wscript_build +++ b/source3/wscript_build @@ -279,7 +279,7 @@ bld.SAMBA3_LIBRARY('popt_samba3_cmdline', bld.SAMBA3_LIBRARY('util_cmdline', source='lib/util_cmdline.c', - deps='secrets3 samba-credentials', + deps='secrets3 samba-credentials cli_smb_common', private_library=True) bld.SAMBA3_LIBRARY('cmdline_contexts', -- 2.28.0 From d488762aa9468bd54890a2fe3dba3fd52582b556 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 07:47:18 +0200 Subject: [PATCH 012/105] auth:creds: Remove unused credentials autoproto header Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- auth/credentials/credentials_krb5.c | 1 - auth/credentials/credentials_secrets.c | 1 - auth/credentials/wscript_build | 1 - source4/auth/kerberos/kerberos_util.c | 1 - source4/auth/tests/kerberos.c | 1 - 5 files changed, 5 deletions(-) diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c index 20e677e521a..259b35b73b0 100644 --- a/auth/credentials/credentials_krb5.c +++ b/auth/credentials/credentials_krb5.c @@ -27,7 +27,6 @@ #include "auth/kerberos/kerberos.h" #include "auth/credentials/credentials.h" #include "auth/credentials/credentials_internal.h" -#include "auth/credentials/credentials_proto.h" #include "auth/credentials/credentials_krb5.h" #include "auth/kerberos/kerberos_credentials.h" #include "auth/kerberos/kerberos_srv_keytab.h" diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c index 54f3ce2d078..52a89d4d5b4 100644 --- a/auth/credentials/credentials_secrets.c +++ b/auth/credentials/credentials_secrets.c @@ -29,7 +29,6 @@ #include "system/filesys.h" #include "auth/credentials/credentials.h" #include "auth/credentials/credentials_internal.h" -#include "auth/credentials/credentials_proto.h" #include "auth/credentials/credentials_krb5.h" #include "auth/kerberos/kerberos_util.h" #include "param/param.h" diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build index f5aba1de248..564a04fe8dd 100644 --- a/auth/credentials/wscript_build +++ b/auth/credentials/wscript_build @@ -2,7 +2,6 @@ bld.SAMBA_LIBRARY('samba-credentials', source='credentials.c', - autoproto='credentials_proto.h', public_headers='credentials.h', pc_files='samba-credentials.pc', deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c index ffef24f285c..544d9d853cc 100644 --- a/source4/auth/kerberos/kerberos_util.c +++ b/source4/auth/kerberos/kerberos_util.c @@ -24,7 +24,6 @@ #include "system/kerberos.h" #include "auth/kerberos/kerberos.h" #include "auth/credentials/credentials.h" -#include "auth/credentials/credentials_proto.h" #include "auth/credentials/credentials_krb5.h" #include "auth/kerberos/kerberos_credentials.h" #include "auth/kerberos/kerberos_util.h" diff --git a/source4/auth/tests/kerberos.c b/source4/auth/tests/kerberos.c index 7711eac2afa..d9be3562adb 100644 --- a/source4/auth/tests/kerberos.c +++ b/source4/auth/tests/kerberos.c @@ -10,7 +10,6 @@ #include "system/kerberos.h" #include "auth/kerberos/kerberos.h" #include "auth/credentials/credentials.h" -#include "auth/credentials/credentials_proto.h" #include "auth/credentials/credentials_krb5.h" #include "auth/kerberos/kerberos_credentials.h" #include "auth/kerberos/kerberos_util.h" -- 2.28.0 From 696d2230503dada1e4369500c7c632bd7d3e5527 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:32:44 +0200 Subject: [PATCH 013/105] auth:creds: Add cli_credentials_(get|set)_smb_signing() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- auth/credentials/credentials.c | 45 +++++++++++++++++++++++++ auth/credentials/credentials.h | 7 ++++ auth/credentials/credentials_internal.h | 4 +++ 3 files changed, 56 insertions(+) diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c index 80a31b248ae..365a6def7ea 100644 --- a/auth/credentials/credentials.c +++ b/auth/credentials/credentials.c @@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) cred->winbind_separator = '\\'; + cred->signing_state = SMB_SIGNING_DEFAULT; + return cred; } @@ -922,6 +924,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, if (sep != NULL && sep[0] != '\0') { cred->winbind_separator = *lpcfg_winbind_separator(lp_ctx); } + + if (cred->signing_state_obtained <= CRED_SMB_CONF) { + /* Will be set to default for invalid smb.conf values */ + cred->signing_state = lpcfg_client_signing(lp_ctx); + cred->signing_state_obtained = CRED_SMB_CONF; + } } /** @@ -1304,6 +1312,43 @@ _PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credenti return true; } +/** + * @brief Set the SMB signing state to request for a SMB connection. + * + * @param[in] creds The credentials structure to update. + * + * @param[in] signing_state The signing state to set. + * + * @param obtained This way the described signing state was specified. + * + * @return true if we could set the signing state, false otherwise. + */ +_PUBLIC_ bool cli_credentials_set_smb_signing(struct cli_credentials *creds, + enum smb_signing_setting signing_state, + enum credentials_obtained obtained) +{ + if (obtained >= creds->signing_state_obtained) { + creds->signing_state_obtained = obtained; + creds->signing_state = signing_state; + return true; + } + + return false; +} + +/** + * @brief Obtain the SMB signing state from a credentials structure. + * + * @param[in] creds The credential structure to obtain the SMB signing state + * from. + * + * @return The SMB singing state. + */ +_PUBLIC_ enum smb_signing_setting +cli_credentials_get_smb_signing(struct cli_credentials *creds) +{ + return creds->signing_state; +} /** * Encrypt a data blob using the session key and the negotiated encryption diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h index 7154c2a008c..422391ad585 100644 --- a/auth/credentials/credentials.h +++ b/auth/credentials/credentials.h @@ -38,6 +38,7 @@ struct gssapi_creds_container; struct smb_krb5_context; struct keytab_container; struct db_context; +enum smb_signing_setting; /* In order of priority */ enum credentials_obtained { @@ -290,6 +291,12 @@ void *_cli_credentials_callback_data(struct cli_credentials *cred); #define cli_credentials_callback_data_void(_cred) \ _cli_credentials_callback_data(_cred) +bool cli_credentials_set_smb_signing(struct cli_credentials *cred, + enum smb_signing_setting signing_state, + enum credentials_obtained obtained); +enum smb_signing_setting +cli_credentials_get_smb_signing(struct cli_credentials *cred); + /** * Return attached NETLOGON credentials */ diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h index 68f1f25dce1..9cde0000b5f 100644 --- a/auth/credentials/credentials_internal.h +++ b/auth/credentials/credentials_internal.h @@ -24,6 +24,7 @@ #include "../lib/util/data_blob.h" #include "librpc/gen_ndr/misc.h" +#include "libcli/smb/smb_constants.h" struct cli_credentials { enum credentials_obtained workstation_obtained; @@ -36,6 +37,7 @@ struct cli_credentials { enum credentials_obtained principal_obtained; enum credentials_obtained keytab_obtained; enum credentials_obtained server_gss_creds_obtained; + enum credentials_obtained signing_state_obtained; /* Threshold values (essentially a MAX() over a number of the * above) for the ccache and GSS credentials, to ensure we @@ -117,6 +119,8 @@ struct cli_credentials { char winbind_separator; bool password_will_be_nt_hash; + + enum smb_signing_setting signing_state; }; #endif /* __CREDENTIALS_INTERNAL_H__ */ -- 2.28.0 From 0176a9d55aed4bdb49ac6f703dcae778b2f4ac5c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 11:56:01 +0200 Subject: [PATCH 014/105] auth:creds: Add python bindings for (get|set)_smb_signing Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- auth/credentials/pycredentials.c | 63 +++++++++++++++++++++++++++++++ python/samba/tests/credentials.py | 6 +++ 2 files changed, 69 insertions(+) diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c index 68edc282741..846c418419f 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c @@ -34,6 +34,7 @@ #include "auth/credentials/credentials_internal.h" #include "system/kerberos.h" #include "auth/kerberos/kerberos.h" +#include "libcli/smb/smb_constants.h" void initcredentials(void); @@ -929,6 +930,52 @@ static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self, Py_RETURN_NONE; } +static PyObject *py_creds_get_smb_signing(PyObject *self, PyObject *unused) +{ + enum smb_signing_setting signing_state; + struct cli_credentials *creds = NULL; + + creds = PyCredentials_AsCliCredentials(self); + if (creds == NULL) { + PyErr_Format(PyExc_TypeError, "Credentials expected"); + return NULL; + } + + signing_state = cli_credentials_get_smb_signing(creds); + return PyLong_FromLong(signing_state); +} + +static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) +{ + enum smb_signing_setting signing_state; + struct cli_credentials *creds = NULL; + enum credentials_obtained obt = CRED_SPECIFIED; + + creds = PyCredentials_AsCliCredentials(self); + if (creds == NULL) { + PyErr_Format(PyExc_TypeError, "Credentials expected"); + return NULL; + } + if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) { + return NULL; + } + + switch (signing_state) { + case SMB_SIGNING_DEFAULT: + case SMB_SIGNING_OFF: + case SMB_SIGNING_IF_REQUIRED: + case SMB_SIGNING_DESIRED: + case SMB_SIGNING_REQUIRED: + break; + default: + PyErr_Format(PyExc_TypeError, "Invalid signing state value"); + return NULL; + } + + cli_credentials_set_smb_signing(creds, signing_state, obt); + Py_RETURN_NONE; +} + static PyMethodDef py_creds_methods[] = { { .ml_name = "get_username", @@ -1209,6 +1256,16 @@ static PyMethodDef py_creds_methods[] = { "Encrypt the supplied password using the session key and\n" "the negotiated encryption algorithm in place\n" "i.e. it overwrites the original data"}, + { + .ml_name = "get_smb_signing", + .ml_meth = py_creds_get_smb_signing, + .ml_flags = METH_NOARGS, + }, + { + .ml_name = "set_smb_signing", + .ml_meth = py_creds_set_smb_signing, + .ml_flags = METH_VARARGS, + }, { .ml_name = NULL } }; @@ -1295,6 +1352,12 @@ MODULE_INIT_FUNC(credentials) PyModule_AddObject(m, "CLI_CRED_NTLM_AUTH", PyLong_FromLong(CLI_CRED_NTLM_AUTH)); PyModule_AddObject(m, "CLI_CRED_CLEAR_AUTH", PyLong_FromLong(CLI_CRED_CLEAR_AUTH)); + PyModule_AddObject(m, "SMB_SIGNING_DEFAULT", PyLong_FromLong(SMB_SIGNING_DEFAULT)); + PyModule_AddObject(m, "SMB_SIGNING_OFF", PyLong_FromLong(SMB_SIGNING_OFF)); + PyModule_AddObject(m, "SMB_SIGNING_IF_REQUIRED", PyLong_FromLong(SMB_SIGNING_IF_REQUIRED)); + PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED)); + PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED)); + Py_INCREF(&PyCredentials); PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials); Py_INCREF(&PyCredentialCacheContainer); diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py index 6454ac9ff7c..e5f8122fa21 100644 --- a/python/samba/tests/credentials.py +++ b/python/samba/tests/credentials.py @@ -456,3 +456,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): self.assertEqual(creds.get_principal(), "user@samba.org") self.assertEqual(creds.is_anonymous(), False) self.assertEqual(creds.authentication_requested(), True) + + def test_smb_signing(self): + creds = credentials.Credentials() + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) + creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) -- 2.28.0 From 96c4ce197bb62772778d822f0e5956d5a3ffe28d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:31:35 +0200 Subject: [PATCH 015/105] auth:creds: Add cli_credentials_(get|set)_smb_ipc_signing() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- auth/credentials/credentials.c | 51 +++++++++++++++++++++++++ auth/credentials/credentials.h | 6 +++ auth/credentials/credentials_internal.h | 3 ++ 3 files changed, 60 insertions(+) diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c index 365a6def7ea..dc5d51f1424 100644 --- a/auth/credentials/credentials.c +++ b/auth/credentials/credentials.c @@ -46,6 +46,12 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) cred->signing_state = SMB_SIGNING_DEFAULT; + /* + * The default value of lpcfg_client_ipc_signing() is REQUIRED, so use + * the same value here. + */ + cred->ipc_signing_state = SMB_SIGNING_REQUIRED; + return cred; } @@ -930,6 +936,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, cred->signing_state = lpcfg_client_signing(lp_ctx); cred->signing_state_obtained = CRED_SMB_CONF; } + + if (cred->ipc_signing_state_obtained <= CRED_SMB_CONF) { + /* Will be set to required for invalid smb.conf values */ + cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx); + cred->ipc_signing_state_obtained = CRED_SMB_CONF; + } } /** @@ -1350,6 +1362,45 @@ cli_credentials_get_smb_signing(struct cli_credentials *creds) return creds->signing_state; } +/** + * @brief Set the SMB IPC signing state to request for a SMB connection. + * + * @param[in] creds The credentials structure to update. + * + * @param[in] signing_state The signing state to set. + * + * @param obtained This way the described signing state was specified. + * + * @return true if we could set the signing state, false otherwise. + */ +_PUBLIC_ bool +cli_credentials_set_smb_ipc_signing(struct cli_credentials *creds, + enum smb_signing_setting ipc_signing_state, + enum credentials_obtained obtained) +{ + if (obtained >= creds->ipc_signing_state_obtained) { + creds->ipc_signing_state_obtained = obtained; + creds->ipc_signing_state = ipc_signing_state; + return true; + } + + return false; +} + +/** + * @brief Obtain the SMB IPC signing state from a credentials structure. + * + * @param[in] creds The credential structure to obtain the SMB IPC signing + * state from. + * + * @return The SMB singing state. + */ +_PUBLIC_ enum smb_signing_setting +cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds) +{ + return creds->ipc_signing_state; +} + /** * Encrypt a data blob using the session key and the negotiated encryption * algorithm diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h index 422391ad585..25bec916278 100644 --- a/auth/credentials/credentials.h +++ b/auth/credentials/credentials.h @@ -297,6 +297,12 @@ bool cli_credentials_set_smb_signing(struct cli_credentials *cred, enum smb_signing_setting cli_credentials_get_smb_signing(struct cli_credentials *cred); +bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred, + enum smb_signing_setting ipc_signing_state, + enum credentials_obtained obtained); +enum smb_signing_setting +cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred); + /** * Return attached NETLOGON credentials */ diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h index 9cde0000b5f..54e8271471f 100644 --- a/auth/credentials/credentials_internal.h +++ b/auth/credentials/credentials_internal.h @@ -38,6 +38,7 @@ struct cli_credentials { enum credentials_obtained keytab_obtained; enum credentials_obtained server_gss_creds_obtained; enum credentials_obtained signing_state_obtained; + enum credentials_obtained ipc_signing_state_obtained; /* Threshold values (essentially a MAX() over a number of the * above) for the ccache and GSS credentials, to ensure we @@ -121,6 +122,8 @@ struct cli_credentials { bool password_will_be_nt_hash; enum smb_signing_setting signing_state; + + enum smb_signing_setting ipc_signing_state; }; #endif /* __CREDENTIALS_INTERNAL_H__ */ -- 2.28.0 From 301adf15736a4cb10f9dca267a906efb8f885354 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:32:46 +0200 Subject: [PATCH 016/105] auth:creds: Add python bindings for (get|set)_smb_ipc_signing Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- auth/credentials/pycredentials.c | 56 +++++++++++++++++++++++++++++++ python/samba/tests/credentials.py | 6 ++++ 2 files changed, 62 insertions(+) diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c index 846c418419f..1a83c506088 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c @@ -976,6 +976,52 @@ static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) Py_RETURN_NONE; } +static PyObject *py_creds_get_smb_ipc_signing(PyObject *self, PyObject *unused) +{ + enum smb_signing_setting signing_state; + struct cli_credentials *creds = NULL; + + creds = PyCredentials_AsCliCredentials(self); + if (creds == NULL) { + PyErr_Format(PyExc_TypeError, "Credentials expected"); + return NULL; + } + + signing_state = cli_credentials_get_smb_ipc_signing(creds); + return PyLong_FromLong(signing_state); +} + +static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) +{ + enum smb_signing_setting signing_state; + struct cli_credentials *creds = NULL; + enum credentials_obtained obt = CRED_SPECIFIED; + + creds = PyCredentials_AsCliCredentials(self); + if (creds == NULL) { + PyErr_Format(PyExc_TypeError, "Credentials expected"); + return NULL; + } + if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) { + return NULL; + } + + switch (signing_state) { + case SMB_SIGNING_DEFAULT: + case SMB_SIGNING_OFF: + case SMB_SIGNING_IF_REQUIRED: + case SMB_SIGNING_DESIRED: + case SMB_SIGNING_REQUIRED: + break; + default: + PyErr_Format(PyExc_TypeError, "Invalid signing state value"); + return NULL; + } + + cli_credentials_set_smb_ipc_signing(creds, signing_state, obt); + Py_RETURN_NONE; +} + static PyMethodDef py_creds_methods[] = { { .ml_name = "get_username", @@ -1266,6 +1312,16 @@ static PyMethodDef py_creds_methods[] = { .ml_meth = py_creds_set_smb_signing, .ml_flags = METH_VARARGS, }, + { + .ml_name = "get_smb_ipc_signing", + .ml_meth = py_creds_get_smb_ipc_signing, + .ml_flags = METH_NOARGS, + }, + { + .ml_name = "set_smb_ipc_signing", + .ml_meth = py_creds_set_smb_ipc_signing, + .ml_flags = METH_VARARGS, + }, { .ml_name = NULL } }; diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py index e5f8122fa21..8edf13ce6ff 100644 --- a/python/samba/tests/credentials.py +++ b/python/samba/tests/credentials.py @@ -462,3 +462,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) + + def test_smb_ipc_signing(self): + creds = credentials.Credentials() + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) -- 2.28.0 From cf2cafb38dd319c01ff539a73d40dac8813f03a0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:10:52 +0200 Subject: [PATCH 017/105] auth:creds: Add cli_credentials_(get|set)_smb_encryption() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- auth/credentials/credentials.c | 45 +++++++++++++++++++++++++ auth/credentials/credentials.h | 7 ++++ auth/credentials/credentials_internal.h | 3 ++ 3 files changed, 55 insertions(+) diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c index dc5d51f1424..9168b92d3ec 100644 --- a/auth/credentials/credentials.c +++ b/auth/credentials/credentials.c @@ -51,6 +51,7 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) * the same value here. */ cred->ipc_signing_state = SMB_SIGNING_REQUIRED; + cred->encryption_state = SMB_ENCRYPTION_DEFAULT; return cred; } @@ -942,6 +943,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx); cred->ipc_signing_state_obtained = CRED_SMB_CONF; } + + if (cred->encryption_state_obtained <= CRED_SMB_CONF) { + /* Will be set to default for invalid smb.conf values */ + cred->encryption_state = lpcfg_client_smb_encrypt(lp_ctx); + cred->encryption_state_obtained = CRED_SMB_CONF; + } } /** @@ -1401,6 +1408,44 @@ cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds) return creds->ipc_signing_state; } +/** + * @brief Set the SMB encryption state to request for a SMB connection. + * + * @param[in] creds The credentials structure to update. + * + * @param[in] encryption_state The encryption state to set. + * + * @param obtained This way the described encryption state was specified. + * + * @return true if we could set the encryption state, false otherwise. + */ +_PUBLIC_ bool cli_credentials_set_smb_encryption(struct cli_credentials *creds, + enum smb_encryption_setting encryption_state, + enum credentials_obtained obtained) +{ + if (obtained >= creds->encryption_state_obtained) { + creds->encryption_state_obtained = obtained; + creds->encryption_state = encryption_state; + return true; + } + + return false; +} + +/** + * @brief Obtain the SMB encryption state from a credentials structure. + * + * @param[in] creds The credential structure to obtain the SMB encryption state + * from. + * + * @return The SMB singing state. + */ +_PUBLIC_ enum smb_encryption_setting +cli_credentials_get_smb_encryption(struct cli_credentials *creds) +{ + return creds->encryption_state; +} + /** * Encrypt a data blob using the session key and the negotiated encryption * algorithm diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h index 25bec916278..7d0cf53194b 100644 --- a/auth/credentials/credentials.h +++ b/auth/credentials/credentials.h @@ -39,6 +39,7 @@ struct smb_krb5_context; struct keytab_container; struct db_context; enum smb_signing_setting; +enum smb_encryption_setting; /* In order of priority */ enum credentials_obtained { @@ -303,6 +304,12 @@ bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred, enum smb_signing_setting cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred); +bool cli_credentials_set_smb_encryption(struct cli_credentials *cred, + enum smb_encryption_setting encryption_state, + enum credentials_obtained obtained); +enum smb_encryption_setting +cli_credentials_get_smb_encryption(struct cli_credentials *cred); + /** * Return attached NETLOGON credentials */ diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h index 54e8271471f..3b86b742448 100644 --- a/auth/credentials/credentials_internal.h +++ b/auth/credentials/credentials_internal.h @@ -39,6 +39,7 @@ struct cli_credentials { enum credentials_obtained server_gss_creds_obtained; enum credentials_obtained signing_state_obtained; enum credentials_obtained ipc_signing_state_obtained; + enum credentials_obtained encryption_state_obtained; /* Threshold values (essentially a MAX() over a number of the * above) for the ccache and GSS credentials, to ensure we @@ -124,6 +125,8 @@ struct cli_credentials { enum smb_signing_setting signing_state; enum smb_signing_setting ipc_signing_state; + + enum smb_encryption_setting encryption_state; }; #endif /* __CREDENTIALS_INTERNAL_H__ */ -- 2.28.0 From a25732f42cf7418789c2102f093dc0b3062543fd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:38:30 +0200 Subject: [PATCH 018/105] auth:creds: Add python bindings for (get|set)_smb_encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- auth/credentials/pycredentials.c | 62 +++++++++++++++++++++++++++++++ python/samba/tests/credentials.py | 6 +++ 2 files changed, 68 insertions(+) diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c index 1a83c506088..628aae6500b 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c @@ -1022,6 +1022,52 @@ static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) Py_RETURN_NONE; } +static PyObject *py_creds_get_smb_encryption(PyObject *self, PyObject *unused) +{ + enum smb_encryption_setting encryption_state; + struct cli_credentials *creds = NULL; + + creds = PyCredentials_AsCliCredentials(self); + if (creds == NULL) { + PyErr_Format(PyExc_TypeError, "Credentials expected"); + return NULL; + } + + encryption_state = cli_credentials_get_smb_encryption(creds); + return PyLong_FromLong(encryption_state); +} + +static PyObject *py_creds_set_smb_encryption(PyObject *self, PyObject *args) +{ + enum smb_encryption_setting encryption_state; + struct cli_credentials *creds = NULL; + enum credentials_obtained obt = CRED_SPECIFIED; + + creds = PyCredentials_AsCliCredentials(self); + if (creds == NULL) { + PyErr_Format(PyExc_TypeError, "Credentials expected"); + return NULL; + } + if (!PyArg_ParseTuple(args, "i|i", &encryption_state, &obt)) { + return NULL; + } + + switch (encryption_state) { + case SMB_ENCRYPTION_DEFAULT: + case SMB_ENCRYPTION_OFF: + case SMB_ENCRYPTION_IF_REQUIRED: + case SMB_ENCRYPTION_DESIRED: + case SMB_ENCRYPTION_REQUIRED: + break; + default: + PyErr_Format(PyExc_TypeError, "Invalid encryption state value"); + return NULL; + } + + cli_credentials_set_smb_encryption(creds, encryption_state, obt); + Py_RETURN_NONE; +} + static PyMethodDef py_creds_methods[] = { { .ml_name = "get_username", @@ -1322,6 +1368,16 @@ static PyMethodDef py_creds_methods[] = { .ml_meth = py_creds_set_smb_ipc_signing, .ml_flags = METH_VARARGS, }, + { + .ml_name = "get_smb_encryption", + .ml_meth = py_creds_get_smb_encryption, + .ml_flags = METH_NOARGS, + }, + { + .ml_name = "set_smb_encryption", + .ml_meth = py_creds_set_smb_encryption, + .ml_flags = METH_VARARGS, + }, { .ml_name = NULL } }; @@ -1414,6 +1470,12 @@ MODULE_INIT_FUNC(credentials) PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED)); PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED)); + PyModule_AddObject(m, "SMB_ENCRYPTION_DEFAULT", PyLong_FromLong(SMB_ENCRYPTION_DEFAULT)); + PyModule_AddObject(m, "SMB_ENCRYPTION_OFF", PyLong_FromLong(SMB_ENCRYPTION_OFF)); + PyModule_AddObject(m, "SMB_ENCRYPTION_IF_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_IF_REQUIRED)); + PyModule_AddObject(m, "SMB_ENCRYPTION_DESIRED", PyLong_FromLong(SMB_ENCRYPTION_DESIRED)); + PyModule_AddObject(m, "SMB_ENCRYPTION_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_REQUIRED)); + Py_INCREF(&PyCredentials); PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials); Py_INCREF(&PyCredentialCacheContainer); diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py index 8edf13ce6ff..e0a6248d37a 100644 --- a/python/samba/tests/credentials.py +++ b/python/samba/tests/credentials.py @@ -468,3 +468,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) + + def test_smb_encryption(self): + creds = credentials.Credentials() + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) + creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) -- 2.28.0 From 1a1809bd260ceff97dd4ff697f78b97a63f60b48 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 11:19:53 +0200 Subject: [PATCH 019/105] auth:creds: Add python bindings for cli_credentials_set_conf() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- auth/credentials/pycredentials.c | 41 +++++++++++++++++++++++++++++++ python/samba/tests/credentials.py | 33 +++++++++++++++++++++++++ 2 files changed, 74 insertions(+) diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c index 628aae6500b..17c90573f09 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c @@ -621,6 +621,42 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args) Py_RETURN_NONE; } +static PyObject *py_creds_set_conf(PyObject *self, PyObject *args) +{ + PyObject *py_lp_ctx = Py_None; + struct loadparm_context *lp_ctx; + TALLOC_CTX *mem_ctx; + struct cli_credentials *creds; + + creds = PyCredentials_AsCliCredentials(self); + if (creds == NULL) { + PyErr_Format(PyExc_TypeError, "Credentials expected"); + return NULL; + } + + if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx)) { + return NULL; + } + + mem_ctx = talloc_new(NULL); + if (mem_ctx == NULL) { + PyErr_NoMemory(); + return NULL; + } + + lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx); + if (lp_ctx == NULL) { + talloc_free(mem_ctx); + return NULL; + } + + cli_credentials_set_conf(creds, lp_ctx); + + talloc_free(mem_ctx); + + Py_RETURN_NONE; +} + static PyObject *py_creds_guess(PyObject *self, PyObject *args) { PyObject *py_lp_ctx = Py_None; @@ -1279,6 +1315,11 @@ static PyMethodDef py_creds_methods[] = { .ml_meth = py_creds_set_krb_forwardable, .ml_flags = METH_VARARGS, }, + { + .ml_name = "set_conf", + .ml_meth = py_creds_set_conf, + .ml_flags = METH_VARARGS, + }, { .ml_name = "guess", .ml_meth = py_creds_guess, diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py index e0a6248d37a..6187bded0b6 100644 --- a/python/samba/tests/credentials.py +++ b/python/samba/tests/credentials.py @@ -463,14 +463,47 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) + def test_smb_signing_set_conf(self): + lp = samba.tests.env_loadparm() + + creds = credentials.Credentials() + creds.set_conf(lp) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) + creds.set_smb_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF) + creds.set_conf(lp) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF) + def test_smb_ipc_signing(self): creds = credentials.Credentials() self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) + def test_smb_ipc_signing_set_conf(self): + lp = samba.tests.env_loadparm() + + creds = credentials.Credentials() + creds.set_conf(lp) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) + creds.set_conf(lp) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) + def test_smb_encryption(self): creds = credentials.Credentials() self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) + + def test_smb_encryption_set_conf(self): + lp = samba.tests.env_loadparm() + + creds = credentials.Credentials() + creds.set_conf(lp) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) + creds.set_smb_encryption(credentials.SMB_ENCRYPTION_OFF) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) + creds.set_conf(lp) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) -- 2.28.0 From 72b31403174eb23fe4fdf75ad918e845a740db6f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 08:14:23 +0200 Subject: [PATCH 020/105] auth:creds: Bump library version We added new functions so bump the version. Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- auth/credentials/wscript_build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build index 564a04fe8dd..1e3302e3e48 100644 --- a/auth/credentials/wscript_build +++ b/auth/credentials/wscript_build @@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials', public_headers='credentials.h', pc_files='samba-credentials.pc', deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', - vnum='0.0.1' + vnum='0.1.0' ) bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', -- 2.28.0 From 918b87437b9c36981049ca4e3cf0220ad56ec7c2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 May 2020 11:10:30 +0200 Subject: [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/lib/util_cmdline.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c index bc1f1c3ed25..6038ec11515 100644 --- a/source3/lib/util_cmdline.c +++ b/source3/lib/util_cmdline.c @@ -40,7 +40,6 @@ struct user_auth_info { struct loadparm_context *lp_ctx; bool got_username; bool got_pass; - int signing_state; bool smb_encrypt; bool use_machine_account; bool use_pw_nt_hash; @@ -70,7 +69,6 @@ struct user_auth_info *user_auth_info_init(TALLOC_CTX *mem_ctx) cli_credentials_set_conf(result->creds, result->lp_ctx); - result->signing_state = SMB_SIGNING_DEFAULT; return result; } @@ -241,15 +239,23 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info, bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info, const char *arg) { - auth_info->signing_state = smb_signing_setting_translate(arg); + enum smb_signing_setting signing_state = + smb_signing_setting_translate(arg); + bool ok; - return true; + ok = cli_credentials_set_smb_signing(auth_info->creds, + signing_state, + CRED_SPECIFIED); + + return ok; } void set_cmdline_auth_info_signing_state_raw(struct user_auth_info *auth_info, int signing_state) { - auth_info->signing_state = signing_state; + cli_credentials_set_smb_signing(auth_info->creds, + signing_state, + CRED_SPECIFIED); } int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info) @@ -257,7 +263,7 @@ int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info) if (auth_info->smb_encrypt) { return SMB_SIGNING_REQUIRED; } - return auth_info->signing_state; + return cli_credentials_get_smb_signing(auth_info->creds); } void set_cmdline_auth_info_use_ccache(struct user_auth_info *auth_info, bool b) -- 2.28.0 From 22efb02d818946e4f03ebfb72ea345e9106deca8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:45:34 +0200 Subject: [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/lib/util_cmdline.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c index 6038ec11515..9c9e2f0ac0f 100644 --- a/source3/lib/util_cmdline.c +++ b/source3/lib/util_cmdline.c @@ -377,6 +377,9 @@ void set_cmdline_auth_info_use_krb5_ticket(struct user_auth_info *auth_info) /* This should only be used by lib/popt_common.c JRA */ void set_cmdline_auth_info_smb_encrypt(struct user_auth_info *auth_info) { + cli_credentials_set_smb_encryption(auth_info->creds, + SMB_ENCRYPTION_REQUIRED, + CRED_SPECIFIED); auth_info->smb_encrypt = true; } -- 2.28.0 From 9abae48706106793f8952524ad2325bdd6a5101c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 10:40:23 +0200 Subject: [PATCH 023/105] python: Remove unused sign argument from smb_connection() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- python/samba/netcmd/gpo.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py index 1e2c2918ebe..ad60cda0690 100644 --- a/python/samba/netcmd/gpo.py +++ b/python/samba/netcmd/gpo.py @@ -382,13 +382,13 @@ def create_directory_hier(conn, remotedir): if not conn.chkpath(path): conn.mkdir(path) -def smb_connection(dc_hostname, service, lp, creds, sign=False): +def smb_connection(dc_hostname, service, lp, creds): # SMB connect to DC try: # the SMB bindings rely on having a s3 loadparm s3_lp = s3param.get_context() s3_lp.load(lp.configfile) - conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=sign) + conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) except Exception: raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) return conn @@ -998,7 +998,7 @@ class cmd_fetch(GPOCommand): # SMB connect to DC conn = smb_connection(dc_hostname, service, lp=self.lp, - creds=self.creds, sign=True) + creds=self.creds) # Copy GPT tmpdir, gpodir = self.construct_tmpdir(tmpdir, gpo) @@ -1629,8 +1629,7 @@ class cmd_admxload(Command): conn = smb_connection(dc_hostname, 'sysvol', lp=self.lp, - creds=self.creds, - sign=True) + creds=self.creds) smb_dir = '\\'.join([self.lp.get('realm').lower(), 'Policies', 'PolicyDefinitions']) -- 2.28.0 From e2f0f56ea6ec4f9696affdee08de89c0bdffa719 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 14:02:37 +0200 Subject: [PATCH 024/105] python: Set smb signing via the creds API Pair-Programmed-With: Stefan Metzmacher Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- python/samba/gpclass.py | 7 +++++++ python/samba/netcmd/domain_backup.py | 10 +++++++++- python/samba/netcmd/gpo.py | 6 ++++++ 3 files changed, 22 insertions(+), 1 deletion(-) diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py index cc574e12a42..1781a55a618 100644 --- a/python/samba/gpclass.py +++ b/python/samba/gpclass.py @@ -38,6 +38,7 @@ from tempfile import NamedTemporaryFile from samba.dcerpc import preg from samba.dcerpc import misc from samba.ndr import ndr_pack, ndr_unpack +from samba.credentials import SMB_SIGNING_REQUIRED try: from enum import Enum @@ -421,7 +422,13 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos): # the SMB bindings rely on having a s3 loadparm s3_lp = s3param.get_context() s3_lp.load(lp.configfile) + + # Force signing for the connection + saved_signing_state = creds.get_smb_signing() + creds.set_smb_signing(SMB_SIGNING_REQUIRED) conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True) + # Reset signing state + creds.set_smb_signing(saved_signing_state) cache_path = lp.cache_path('gpo_cache') for gpo in gpos: if not gpo.file_sys_path: diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py index a3dc7fb454f..a9e0ba5bc67 100644 --- a/python/samba/netcmd/domain_backup.py +++ b/python/samba/netcmd/domain_backup.py @@ -54,6 +54,7 @@ from subprocess import CalledProcessError from samba import sites from samba.dsdb import _dsdb_load_udv_v2 from samba.ndr import ndr_pack +from samba.credentials import SMB_SIGNING_REQUIRED # work out a SID (based on a free RID) to use when the domain gets restored. @@ -115,7 +116,14 @@ def smb_sysvol_conn(server, lp, creds): # the SMB bindings rely on having a s3 loadparm s3_lp = s3param.get_context() s3_lp.load(lp.configfile) - return libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) + + # Force signing for the connection + saved_signing_state = creds.get_smb_signing() + creds.set_smb_signing(SMB_SIGNING_REQUIRED) + conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) + # Reset signing state + creds.set_smb_signing(saved_signing_state) + return conn def get_timestamp(): diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py index ad60cda0690..0f2f6520fc3 100644 --- a/python/samba/netcmd/gpo.py +++ b/python/samba/netcmd/gpo.py @@ -62,6 +62,7 @@ from samba.gp_parse.gp_csv import GPAuditCsvParser from samba.gp_parse.gp_inf import GptTmplInfParser from samba.gp_parse.gp_aas import GPAasParser from samba import param +from samba.credentials import SMB_SIGNING_REQUIRED def attr_default(msg, attrname, default): @@ -384,6 +385,9 @@ def create_directory_hier(conn, remotedir): def smb_connection(dc_hostname, service, lp, creds): # SMB connect to DC + # Force signing for the smb connection + saved_signing_state = creds.get_smb_signing() + creds.set_smb_signing(SMB_SIGNING_REQUIRED) try: # the SMB bindings rely on having a s3 loadparm s3_lp = s3param.get_context() @@ -391,6 +395,8 @@ def smb_connection(dc_hostname, service, lp, creds): conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) except Exception: raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) + # Reset signing state + creds.set_smb_signing(saved_signing_state) return conn -- 2.28.0 From 53b2d53349b8f453cd0144f01b833deca52e3626 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:22:12 +0200 Subject: [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- examples/winexe/winexe.c | 2 +- source3/include/client.h | 1 + source3/libnet/libnet_join.c | 6 +++--- source3/libsmb/cliconnect.c | 3 ++- source3/rpc_server/spoolss/srv_spoolss_nt.c | 4 +++- source3/rpcclient/cmd_spoolss.c | 2 +- source3/rpcclient/rpcclient.c | 2 +- source3/utils/mdfind.c | 2 +- source3/utils/net_ads.c | 3 ++- source3/utils/net_util.c | 9 +++++++-- source3/utils/netlookup.c | 4 +++- 11 files changed, 25 insertions(+), 13 deletions(-) diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c index fc6b15f8e52..bb9c27e2e6d 100644 --- a/examples/winexe/winexe.c +++ b/examples/winexe/winexe.c @@ -1919,7 +1919,7 @@ int main(int argc, const char *argv[]) "IPC$", "?????", options.credentials, - 0, + CLI_FULL_CONNECTION_IPC, 0); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/include/client.h b/source3/include/client.h index 6a3b1b02ff3..19a738900b7 100644 --- a/source3/include/client.h +++ b/source3/include/client.h @@ -121,5 +121,6 @@ struct file_info { #define CLI_FULL_CONNECTION_FORCE_ASCII 0x0100 #define CLI_FULL_CONNECTION_FORCE_SMB1 0x0400 #define CLI_FULL_CONNECTION_DISABLE_SMB1 0x0800 +#define CLI_FULL_CONNECTION_IPC 0x1000 #endif /* _CLIENT_H */ diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c index 34938603606..392e3eff74f 100644 --- a/source3/libnet/libnet_join.c +++ b/source3/libnet/libnet_join.c @@ -1068,7 +1068,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc, bool use_ccache = false; bool pw_nt_hash = false; struct cli_credentials *creds = NULL; - int flags = 0; + int flags = CLI_FULL_CONNECTION_IPC; NTSTATUS status; if (use_kerberos && pass) { @@ -1684,7 +1684,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, struct netlogon_creds_CredentialState *creds = NULL; uint32_t netlogon_flags = 0; NTSTATUS status; - int flags = 0; + int flags = CLI_FULL_CONNECTION_IPC; if (!dc_name) { TALLOC_FREE(frame); @@ -1734,7 +1734,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, NULL, 0, "IPC$", "IPC", anon_creds, - 0, + flags, SMB_SIGNING_OFF); } diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index 1fb1f0127b9..f20146378e3 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -2788,7 +2788,7 @@ static struct tevent_req *cli_start_connection_send( } state->ev = ev; - if (signing_state == SMB_SIGNING_IPC_DEFAULT) { + if (flags & CLI_FULL_CONNECTION_IPC) { state->min_protocol = lp_client_ipc_min_protocol(); state->max_protocol = lp_client_ipc_max_protocol(); } else { @@ -3673,6 +3673,7 @@ struct cli_state *get_ipc_connect(char *server, uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK; flags |= CLI_FULL_CONNECTION_FORCE_SMB1; + flags |= CLI_FULL_CONNECTION_IPC; nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", get_cmdline_auth_info_creds(user_info), diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c index 8b6a803a910..16e3ee485f0 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c @@ -2481,7 +2481,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c /* setup the connection */ ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, &rm_addr, 0, "IPC$", "IPC", - anon_creds, 0, SMB_SIGNING_OFF); + anon_creds, + CLI_FULL_CONNECTION_IPC, + SMB_SIGNING_OFF); TALLOC_FREE(anon_creds); if ( !NT_STATUS_IS_OK( ret ) ) { DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c index a7e0c673a65..7198a451ab7 100644 --- a/source3/rpcclient/cmd_spoolss.c +++ b/source3/rpcclient/cmd_spoolss.c @@ -3537,7 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli, "IPC$", "IPC", get_cmdline_auth_info_creds( popt_get_cmdline_auth_info()), - 0, /* flags */ + CLI_FULL_CONNECTION_IPC, get_cmdline_auth_info_signing_state( popt_get_cmdline_auth_info())); diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index 67a1066fc15..c86474d08f1 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -1019,7 +1019,7 @@ out_free: static int opt_port = 0; int result = 0; TALLOC_CTX *frame = talloc_stackframe(); - uint32_t flags = 0; + uint32_t flags = CLI_FULL_CONNECTION_IPC; struct dcerpc_binding *binding = NULL; enum dcerpc_transport_t transport; uint32_t bflags = 0; diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c index 2f952c29b4f..a3c879e75fb 100644 --- a/source3/utils/mdfind.c +++ b/source3/utils/mdfind.c @@ -70,7 +70,7 @@ int main(int argc, char **argv) const char *mds_query = NULL; struct cli_state *cli = NULL; char *basepath = NULL; - uint32_t flags = 0; + uint32_t flags = CLI_FULL_CONNECTION_IPC; int signing_state = SMB_SIGNING_IPC_DEFAULT; uint64_t *cnids = NULL; size_t ncnids; diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c index e5db844c2f2..28ef6dc9974 100644 --- a/source3/utils/net_ads.c +++ b/source3/utils/net_ads.c @@ -2437,7 +2437,8 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername, &server_ss, 0, "IPC$", "IPC", - creds, 0, + creds, + CLI_FULL_CONNECTION_IPC, SMB_SIGNING_IPC_DEFAULT); if (NT_STATUS_IS_ERR(nt_status)) { diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c index c566ecc9000..d01b2d8c771 100644 --- a/source3/utils/net_util.c +++ b/source3/utils/net_util.c @@ -110,6 +110,7 @@ NTSTATUS connect_to_service(struct net_context *c, NTSTATUS nt_status; enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT; struct cli_credentials *creds = NULL; + int flags = 0; creds = net_context_creds(c, c); if (creds == NULL) { @@ -119,12 +120,14 @@ NTSTATUS connect_to_service(struct net_context *c, if (strequal(service_type, "IPC")) { signing_setting = SMB_SIGNING_IPC_DEFAULT; + flags |= CLI_FULL_CONNECTION_IPC; } nt_status = cli_full_connection_creds(cli_ctx, NULL, server_name, server_ss, c->opt_port, service_name, service_type, - creds, 0, + creds, + flags, signing_setting); if (!NT_STATUS_IS_OK(nt_status)) { d_fprintf(stderr, _("Could not connect to server %s\n"), @@ -195,7 +198,9 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c, nt_status = cli_full_connection_creds(cli_ctx, c->opt_requester_name, server_name, server_ss, c->opt_port, "IPC$", "IPC", - anon_creds, 0, SMB_SIGNING_OFF); + anon_creds, + CLI_FULL_CONNECTION_IPC, + SMB_SIGNING_OFF); if (NT_STATUS_IS_OK(nt_status)) { return nt_status; diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c index 6cea2ee306c..2241beb331f 100644 --- a/source3/utils/netlookup.c +++ b/source3/utils/netlookup.c @@ -98,7 +98,9 @@ static struct con_struct *create_cs(struct net_context *c, nt_status = cli_full_connection_creds(&cs->cli, lp_netbios_name(), lp_netbios_name(), &loopback_ss, 0, "IPC$", "IPC", - anon_creds, 0, SMB_SIGNING_OFF); + anon_creds, + CLI_FULL_CONNECTION_IPC, + SMB_SIGNING_OFF); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); -- 2.28.0 From 975383e368a3891e92fb071ab20f2b5208167500 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:29:25 +0200 Subject: [PATCH 026/105] s3:pylibsmb: Add ipc=True support for CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/libsmb/pylibsmb.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c index 3fcc3424a57..3579a040830 100644 --- a/source3/libsmb/pylibsmb.c +++ b/source3/libsmb/pylibsmb.c @@ -445,6 +445,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, int signing_state = SMB_SIGNING_DEFAULT; PyObject *py_force_smb1 = Py_False; bool force_smb1 = false; + PyObject *py_ipc = Py_False; + bool use_ipc = false; struct tevent_req *req; bool ret; int flags = 0; @@ -452,6 +454,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, static const char *kwlist[] = { "host", "share", "lp", "creds", "multi_threaded", "sign", "force_smb1", + "ipc", NULL }; @@ -462,12 +465,13 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, } ret = ParseTupleAndKeywords( - args, kwds, "ssO|O!OOO", kwlist, + args, kwds, "ssO|O!OOOO", kwlist, &host, &share, &py_lp, py_type_Credentials, &creds, &py_multi_threaded, &py_sign, - &py_force_smb1); + &py_force_smb1, + &py_ipc); Py_DECREF(py_type_Credentials); @@ -493,6 +497,11 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, flags = CLI_FULL_CONNECTION_FORCE_SMB1; } + use_ipc = PyObject_IsTrue(py_ipc); + if (use_ipc) { + flags |= CLI_FULL_CONNECTION_IPC; + } + if (multi_threaded) { #ifdef HAVE_PTHREAD ret = py_cli_state_setup_mt_ev(self); -- 2.28.0 From 59831141a17195b9308d75257123134b0217489c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 09:47:11 +0200 Subject: [PATCH 027/105] python:tests: Mark libsmb connection as an IPC connection Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- python/samba/tests/dcerpc/raw_testcase.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py index ba7440df13b..2c028d381db 100644 --- a/python/samba/tests/dcerpc/raw_testcase.py +++ b/python/samba/tests/dcerpc/raw_testcase.py @@ -43,7 +43,7 @@ class smb_pipe_socket(object): lp3 = s3param.get_context() lp3.load(lp.configfile) self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, - creds=creds, sign=True) + creds=creds, ipc=True, sign=True) self.smbfid = self.smbconn.create(pipename, DesiredAccess=0x12019f, ShareAccess=0x7, -- 2.28.0 From b9df53c20a753bf31b8684776f2b6aaaf1583abe Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 12:52:39 +0200 Subject: [PATCH 028/105] python:tests: Set smb ipc signing via the creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- python/samba/tests/dcerpc/raw_testcase.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py index 2c028d381db..d6f5de7440a 100644 --- a/python/samba/tests/dcerpc/raw_testcase.py +++ b/python/samba/tests/dcerpc/raw_testcase.py @@ -36,14 +36,18 @@ from samba.ntstatus import ( from samba import NTSTATUSError from samba.samba3 import param as s3param from samba.samba3 import libsmb_samba_internal as libsmb +from samba.credentials import SMB_SIGNING_REQUIRED class smb_pipe_socket(object): def __init__(self, target_hostname, pipename, creds, impersonation_level, lp): lp3 = s3param.get_context() lp3.load(lp.configfile) + saved_signing_state = creds.get_smb_ipc_signing() + creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED) self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, creds=creds, ipc=True, sign=True) + creds.set_smb_ipc_signing(saved_signing_state) self.smbfid = self.smbconn.create(pipename, DesiredAccess=0x12019f, ShareAccess=0x7, -- 2.28.0 From c9e88d833db2b472099e5751b7731e337342d2c4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:59:19 +0200 Subject: [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in cliconnect.c Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/libsmb/cliconnect.c | 14 +++++++------- source3/libsmb/proto.h | 10 +++++----- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index f20146378e3..bb20aa59385 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -2631,7 +2631,7 @@ static NTSTATUS cli_connect_sock_recv(struct tevent_req *req, struct cli_connect_nb_state { const char *desthost; - int signing_state; + enum smb_signing_setting signing_state; int flags; struct cli_state *cli; }; @@ -2642,7 +2642,7 @@ static struct tevent_req *cli_connect_nb_send( TALLOC_CTX *mem_ctx, struct tevent_context *ev, const char *host, const struct sockaddr_storage *dest_ss, uint16_t port, int name_type, const char *myname, - int signing_state, int flags) + enum smb_signing_setting signing_state, int flags) { struct tevent_req *req, *subreq; struct cli_connect_nb_state *state; @@ -2727,7 +2727,7 @@ static NTSTATUS cli_connect_nb_recv(struct tevent_req *req, NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss, uint16_t port, int name_type, const char *myname, - int signing_state, int flags, struct cli_state **pcli) + enum smb_signing_setting signing_state, int flags, struct cli_state **pcli) { struct tevent_context *ev; struct tevent_req *req; @@ -2776,7 +2776,7 @@ static struct tevent_req *cli_start_connection_send( TALLOC_CTX *mem_ctx, struct tevent_context *ev, const char *my_name, const char *dest_host, const struct sockaddr_storage *dest_ss, int port, - int signing_state, int flags) + enum smb_signing_setting signing_state, int flags) { struct tevent_req *req, *subreq; struct cli_start_connection_state *state; @@ -2881,7 +2881,7 @@ NTSTATUS cli_start_connection(struct cli_state **output_cli, const char *my_name, const char *dest_host, const struct sockaddr_storage *dest_ss, int port, - int signing_state, int flags) + enum smb_signing_setting signing_state, int flags) { struct tevent_context *ev; struct tevent_req *req; @@ -3361,7 +3361,7 @@ struct tevent_req *cli_full_connection_creds_send( const struct sockaddr_storage *dest_ss, int port, const char *service, const char *service_type, struct cli_credentials *creds, - int flags, int signing_state) + int flags, enum smb_signing_setting signing_state) { struct tevent_req *req, *subreq; struct cli_full_connection_creds_state *state; @@ -3520,7 +3520,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, const char *service, const char *service_type, struct cli_credentials *creds, int flags, - int signing_state) + enum smb_signing_setting signing_state) { struct tevent_context *ev; struct tevent_req *req; diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h index d214cdabca4..995187e21b4 100644 --- a/source3/libsmb/proto.h +++ b/source3/libsmb/proto.h @@ -86,12 +86,12 @@ NTSTATUS cli_tree_connect(struct cli_state *cli, const char *share, NTSTATUS cli_tdis(struct cli_state *cli); NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss, uint16_t port, int name_type, const char *myname, - int signing_state, int flags, struct cli_state **pcli); + enum smb_signing_setting signing_state, int flags, struct cli_state **pcli); NTSTATUS cli_start_connection(struct cli_state **output_cli, const char *my_name, const char *dest_host, const struct sockaddr_storage *dest_ss, int port, - int signing_state, int flags); + enum smb_signing_setting signing_state, int flags); NTSTATUS cli_smb1_setup_encryption(struct cli_state *cli, struct cli_credentials *creds); struct tevent_req *cli_full_connection_creds_send( @@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send( const struct sockaddr_storage *dest_ss, int port, const char *service, const char *service_type, struct cli_credentials *creds, - int flags, int signing_state); + int flags, enum smb_signing_setting signing_state); NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req, struct cli_state **output_cli); NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, @@ -110,7 +110,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, const char *service, const char *service_type, struct cli_credentials *creds, int flags, - int signing_state); + enum smb_signing_setting signing_state); NTSTATUS cli_raw_tcon(struct cli_state *cli, const char *service, const char *pass, const char *dev, uint16_t *max_xmit, uint16_t *tid); @@ -177,7 +177,7 @@ extern struct GUID cli_state_client_guid; struct cli_state *cli_state_create(TALLOC_CTX *mem_ctx, int fd, const char *remote_name, - int signing_state, + enum smb_signing_setting signing_state, int flags); void cli_nt_pipes_close(struct cli_state *cli); void cli_shutdown(struct cli_state *cli); -- 2.28.0 From 40c201c4d1b4621e823485e3082d0ca5799a6237 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:11:31 +0200 Subject: [PATCH 030/105] s3:client: Turn off smb signing for message op Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- python/samba/gpclass.py | 2 +- python/samba/netcmd/domain_backup.py | 2 +- python/samba/netcmd/gpo.py | 2 +- python/samba/tests/dcerpc/raw_testcase.py | 2 +- source3/client/client.c | 5 ++++- source3/libsmb/pylibsmb.c | 20 +++++++++----------- 6 files changed, 17 insertions(+), 16 deletions(-) diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py index 1781a55a618..2c00f5349a0 100644 --- a/python/samba/gpclass.py +++ b/python/samba/gpclass.py @@ -426,7 +426,7 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos): # Force signing for the connection saved_signing_state = creds.get_smb_signing() creds.set_smb_signing(SMB_SIGNING_REQUIRED) - conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True) + conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds) # Reset signing state creds.set_smb_signing(saved_signing_state) cache_path = lp.cache_path('gpo_cache') diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py index a9e0ba5bc67..2977b071ec3 100644 --- a/python/samba/netcmd/domain_backup.py +++ b/python/samba/netcmd/domain_backup.py @@ -120,7 +120,7 @@ def smb_sysvol_conn(server, lp, creds): # Force signing for the connection saved_signing_state = creds.get_smb_signing() creds.set_smb_signing(SMB_SIGNING_REQUIRED) - conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) + conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds) # Reset signing state creds.set_smb_signing(saved_signing_state) return conn diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py index 0f2f6520fc3..bbaa0c17881 100644 --- a/python/samba/netcmd/gpo.py +++ b/python/samba/netcmd/gpo.py @@ -392,7 +392,7 @@ def smb_connection(dc_hostname, service, lp, creds): # the SMB bindings rely on having a s3 loadparm s3_lp = s3param.get_context() s3_lp.load(lp.configfile) - conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) + conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds) except Exception: raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) # Reset signing state diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py index d6f5de7440a..34785e2a2a7 100644 --- a/python/samba/tests/dcerpc/raw_testcase.py +++ b/python/samba/tests/dcerpc/raw_testcase.py @@ -46,7 +46,7 @@ class smb_pipe_socket(object): saved_signing_state = creds.get_smb_ipc_signing() creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED) self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, - creds=creds, ipc=True, sign=True) + creds=creds, ipc=True) creds.set_smb_ipc_signing(saved_signing_state) self.smbfid = self.smbconn.create(pipename, DesiredAccess=0x12019f, diff --git a/source3/client/client.c b/source3/client/client.c index f65293849d0..30287ffd253 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -6228,7 +6228,10 @@ static int do_message_op(struct user_auth_info *a_info) status = cli_connect_nb(desthost, have_ip ? &dest_ss : NULL, port ? port : NBT_SMB_PORT, name_type, - lp_netbios_name(), SMB_SIGNING_DEFAULT, 0, &cli); + lp_netbios_name(), + SMB_SIGNING_OFF, + 0, + &cli); if (!NT_STATUS_IS_OK(status)) { d_printf("Connection to %s failed. Error %s\n", desthost, nt_errstr(status)); return 1; diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c index 3579a040830..f8a4d56cf53 100644 --- a/source3/libsmb/pylibsmb.c +++ b/source3/libsmb/pylibsmb.c @@ -440,9 +440,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, PyObject *py_lp = Py_None; PyObject *py_multi_threaded = Py_False; bool multi_threaded = false; - PyObject *py_sign = Py_False; - bool sign = false; - int signing_state = SMB_SIGNING_DEFAULT; + enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT; PyObject *py_force_smb1 = Py_False; bool force_smb1 = false; PyObject *py_ipc = Py_False; @@ -453,7 +451,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, static const char *kwlist[] = { "host", "share", "lp", "creds", - "multi_threaded", "sign", "force_smb1", + "multi_threaded", "force_smb1", "ipc", NULL }; @@ -465,11 +463,10 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, } ret = ParseTupleAndKeywords( - args, kwds, "ssO|O!OOOO", kwlist, + args, kwds, "ssO|O!OOO", kwlist, &host, &share, &py_lp, py_type_Credentials, &creds, &py_multi_threaded, - &py_sign, &py_force_smb1, &py_ipc); @@ -480,13 +477,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, } multi_threaded = PyObject_IsTrue(py_multi_threaded); - sign = PyObject_IsTrue(py_sign); force_smb1 = PyObject_IsTrue(py_force_smb1); - if (sign) { - signing_state = SMB_SIGNING_REQUIRED; - } - if (force_smb1) { /* * As most of the cli_*_send() function @@ -532,6 +524,12 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, cli_creds = PyCredentials_AsCliCredentials(creds); } + if (use_ipc) { + signing_state = cli_credentials_get_smb_ipc_signing(cli_creds); + } else { + signing_state = cli_credentials_get_smb_signing(cli_creds); + } + req = cli_full_connection_creds_send( NULL, self->ev, "myname", host, NULL, 0, share, "?????", cli_creds, flags, signing_state); -- 2.28.0 From 639de1d5ddf200d03f51b0436789f5dde4cd083b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:20:02 +0200 Subject: [PATCH 031/105] s3:libsmb: Remove signing_state from cli_full_connection_creds_send() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/libsmb/cliconnect.c | 11 +++++++++-- source3/libsmb/proto.h | 2 +- source3/libsmb/pylibsmb.c | 9 +-------- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index bb20aa59385..0ff9c283e39 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -3361,10 +3361,11 @@ struct tevent_req *cli_full_connection_creds_send( const struct sockaddr_storage *dest_ss, int port, const char *service, const char *service_type, struct cli_credentials *creds, - int flags, enum smb_signing_setting signing_state) + int flags) { struct tevent_req *req, *subreq; struct cli_full_connection_creds_state *state; + enum smb_signing_setting signing_state; req = tevent_req_create(mem_ctx, &state, struct cli_full_connection_creds_state); @@ -3379,6 +3380,12 @@ struct tevent_req *cli_full_connection_creds_send( state->creds = creds; state->flags = flags; + if (flags & CLI_FULL_CONNECTION_IPC) { + signing_state = cli_credentials_get_smb_ipc_signing(creds); + } else { + signing_state = cli_credentials_get_smb_signing(creds); + } + subreq = cli_start_connection_send( state, ev, my_name, dest_host, dest_ss, port, signing_state, flags); @@ -3532,7 +3539,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, } req = cli_full_connection_creds_send( ev, ev, my_name, dest_host, dest_ss, port, service, - service_type, creds, flags, signing_state); + service_type, creds, flags); if (req == NULL) { goto fail; } diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h index 995187e21b4..bef04d32638 100644 --- a/source3/libsmb/proto.h +++ b/source3/libsmb/proto.h @@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send( const struct sockaddr_storage *dest_ss, int port, const char *service, const char *service_type, struct cli_credentials *creds, - int flags, enum smb_signing_setting signing_state); + int flags); NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req, struct cli_state **output_cli); NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c index f8a4d56cf53..c7a2d73afcb 100644 --- a/source3/libsmb/pylibsmb.c +++ b/source3/libsmb/pylibsmb.c @@ -440,7 +440,6 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, PyObject *py_lp = Py_None; PyObject *py_multi_threaded = Py_False; bool multi_threaded = false; - enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT; PyObject *py_force_smb1 = Py_False; bool force_smb1 = false; PyObject *py_ipc = Py_False; @@ -524,15 +523,9 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, cli_creds = PyCredentials_AsCliCredentials(creds); } - if (use_ipc) { - signing_state = cli_credentials_get_smb_ipc_signing(cli_creds); - } else { - signing_state = cli_credentials_get_smb_signing(cli_creds); - } - req = cli_full_connection_creds_send( NULL, self->ev, "myname", host, NULL, 0, share, "?????", - cli_creds, flags, signing_state); + cli_creds, flags); if (!py_tevent_req_wait_exc(self, req)) { return -1; } -- 2.28.0 From 57336e07f2e23dade5fcd0b8f0d002202cda223d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 14:59:14 +0200 Subject: [PATCH 032/105] s3:libsmb: Remove signing_state from cli_full_connection_creds() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- examples/fuse/smb2mount.c | 3 +-- examples/winexe/winexe.c | 4 +--- source3/libnet/libnet_join.c | 9 +++------ source3/libsmb/cliconnect.c | 6 ++---- source3/libsmb/libsmb_server.c | 8 +------- source3/libsmb/proto.h | 3 +-- source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 +-- source3/rpcclient/cmd_spoolss.c | 5 +---- source3/rpcclient/rpcclient.c | 3 +-- source3/torture/locktest2.c | 11 +++++++++-- source3/torture/torture.c | 6 ++---- source3/utils/mdfind.c | 3 +-- source3/utils/net_ads.c | 3 +-- source3/utils/net_util.c | 8 ++------ source3/utils/netlookup.c | 3 +-- source3/utils/smbcacls.c | 3 +-- source3/utils/smbcquotas.c | 4 +--- 17 files changed, 30 insertions(+), 55 deletions(-) diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c index ea1d9a11e0b..6206c3a9701 100644 --- a/examples/fuse/smb2mount.c +++ b/examples/fuse/smb2mount.c @@ -37,8 +37,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, NULL, port, share, "?????", get_cmdline_auth_info_creds(auth_info), - flags, - get_cmdline_auth_info_signing_state(auth_info)); + flags); if (!NT_STATUS_IS_OK(nt_status)) { DBG_ERR("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)); diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c index bb9c27e2e6d..03e7ec85198 100644 --- a/examples/winexe/winexe.c +++ b/examples/winexe/winexe.c @@ -360,7 +360,6 @@ static NTSTATUS winexe_svc_upload( "ADMIN$", "?????", credentials, - 0, 0); if (!NT_STATUS_IS_OK(status)) { DBG_WARNING("cli_full_connection_creds failed: %s\n", @@ -1919,8 +1918,7 @@ int main(int argc, const char *argv[]) "IPC$", "?????", options.credentials, - CLI_FULL_CONNECTION_IPC, - 0); + CLI_FULL_CONNECTION_IPC); if (!NT_STATUS_IS_OK(status)) { DBG_WARNING("cli_full_connection_creds failed: %s\n", diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c index 392e3eff74f..f3bf27e6c00 100644 --- a/source3/libnet/libnet_join.c +++ b/source3/libnet/libnet_join.c @@ -1095,8 +1095,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc, NULL, 0, "IPC$", "IPC", creds, - flags, - SMB_SIGNING_IPC_DEFAULT); + flags); if (!NT_STATUS_IS_OK(status)) { TALLOC_FREE(frame); return status; @@ -1716,8 +1715,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, NULL, 0, "IPC$", "IPC", cli_creds, - flags, - SMB_SIGNING_IPC_DEFAULT); + flags); if (!NT_STATUS_IS_OK(status)) { struct cli_credentials *anon_creds = NULL; @@ -1734,8 +1732,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, NULL, 0, "IPC$", "IPC", anon_creds, - flags, - SMB_SIGNING_OFF); + flags); } if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index 0ff9c283e39..b24743d789b 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -3526,8 +3526,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, const struct sockaddr_storage *dest_ss, int port, const char *service, const char *service_type, struct cli_credentials *creds, - int flags, - enum smb_signing_setting signing_state) + int flags) { struct tevent_context *ev; struct tevent_req *req; @@ -3684,8 +3683,7 @@ struct cli_state *get_ipc_connect(char *server, nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", get_cmdline_auth_info_creds(user_info), - flags, - SMB_SIGNING_DEFAULT); + flags); if (NT_STATUS_IS_OK(nt_status)) { return cli; diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c index 3d1cd602f6c..33dc8419deb 100644 --- a/source3/libsmb/libsmb_server.c +++ b/source3/libsmb/libsmb_server.c @@ -785,7 +785,6 @@ SMBC_attr_server(TALLOC_CTX *ctx, pp_workgroup, pp_username, pp_password); if (!ipc_srv) { struct cli_credentials *creds = NULL; - int signing_state = SMB_SIGNING_DEFAULT; /* We didn't find a cached connection. Get the password */ if (!*pp_password || (*pp_password)[0] == '\0') { @@ -812,16 +811,11 @@ SMBC_attr_server(TALLOC_CTX *ctx, return NULL; } - if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) { - signing_state = SMB_SIGNING_REQUIRED; - } - nt_status = cli_full_connection_creds(&ipc_cli, lp_netbios_name(), server, NULL, 0, "IPC$", "?????", creds, - flags, - signing_state); + flags); if (! NT_STATUS_IS_OK(nt_status)) { TALLOC_FREE(creds); DEBUG(1,("cli_full_connection failed! (%s)\n", diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h index bef04d32638..850cf12c8a6 100644 --- a/source3/libsmb/proto.h +++ b/source3/libsmb/proto.h @@ -109,8 +109,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, const struct sockaddr_storage *dest_ss, int port, const char *service, const char *service_type, struct cli_credentials *creds, - int flags, - enum smb_signing_setting signing_state); + int flags); NTSTATUS cli_raw_tcon(struct cli_state *cli, const char *service, const char *pass, const char *dev, uint16_t *max_xmit, uint16_t *tid); diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c index 16e3ee485f0..e98401a4365 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c @@ -2482,8 +2482,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, &rm_addr, 0, "IPC$", "IPC", anon_creds, - CLI_FULL_CONNECTION_IPC, - SMB_SIGNING_OFF); + CLI_FULL_CONNECTION_IPC); TALLOC_FREE(anon_creds); if ( !NT_STATUS_IS_OK( ret ) ) { DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c index 7198a451ab7..02889a0a666 100644 --- a/source3/rpcclient/cmd_spoolss.c +++ b/source3/rpcclient/cmd_spoolss.c @@ -3537,10 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli, "IPC$", "IPC", get_cmdline_auth_info_creds( popt_get_cmdline_auth_info()), - CLI_FULL_CONNECTION_IPC, - get_cmdline_auth_info_signing_state( - popt_get_cmdline_auth_info())); - + CLI_FULL_CONNECTION_IPC); if ( !NT_STATUS_IS_OK(nt_status) ) return WERR_GEN_FAILURE; diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index c86474d08f1..2ead6cc7ba5 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -1206,8 +1206,7 @@ out_free: "IPC$", "IPC", get_cmdline_auth_info_creds( popt_get_cmdline_auth_info()), - flags, - SMB_SIGNING_IPC_DEFAULT); + flags); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0,("Cannot connect to server. Error was %s\n", nt_errstr(nt_status))); diff --git a/source3/torture/locktest2.c b/source3/torture/locktest2.c index 84c335f959f..92ddb7629b9 100644 --- a/source3/torture/locktest2.c +++ b/source3/torture/locktest2.c @@ -217,8 +217,15 @@ static struct cli_state *connect_one(char *share) slprintf(myname,sizeof(myname), "lock-%lu-%u", (unsigned long)getpid(), count++); - nt_status = cli_full_connection_creds(&c, myname, server_n, NULL, 0, share, "?????", - creds, 0, SMB_SIGNING_DEFAULT); + nt_status = cli_full_connection_creds(&c, + myname, + server_n, + NULL, + 0, + share, + "?????", + creds, + 0); TALLOC_FREE(creds); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("cli_full_connection failed with error %s\n", nt_errstr(nt_status))); diff --git a/source3/torture/torture.c b/source3/torture/torture.c index 2a3133373e9..a4edeefd628 100644 --- a/source3/torture/torture.c +++ b/source3/torture/torture.c @@ -345,8 +345,7 @@ static bool torture_open_connection_share(struct cli_state **c, sharename, "?????", torture_creds, - flags, - signing_state); + flags); if (!NT_STATUS_IS_OK(status)) { printf("failed to open share connection: //%s/%s port:%d - %s\n", hostname, sharename, port_to_use, nt_errstr(status)); @@ -1523,8 +1522,7 @@ static bool run_tcon_devtype_test(int dummy) NULL, /* service */ NULL, /* service_type */ torture_creds, - flags, - signing_state); + flags); if (!NT_STATUS_IS_OK(status)) { printf("could not open connection\n"); diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c index a3c879e75fb..2ac4fde7daf 100644 --- a/source3/utils/mdfind.c +++ b/source3/utils/mdfind.c @@ -153,8 +153,7 @@ int main(int argc, char **argv) "IPC$", "IPC", creds, - flags, - SMB_SIGNING_IPC_DEFAULT); + flags); if (!NT_STATUS_IS_OK(status)) { DBG_ERR("Cannot connect to server: %s\n", nt_errstr(status)); goto fail; diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c index 28ef6dc9974..7f5b9c3a440 100644 --- a/source3/utils/net_ads.c +++ b/source3/utils/net_ads.c @@ -2438,8 +2438,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * &server_ss, 0, "IPC$", "IPC", creds, - CLI_FULL_CONNECTION_IPC, - SMB_SIGNING_IPC_DEFAULT); + CLI_FULL_CONNECTION_IPC); if (NT_STATUS_IS_ERR(nt_status)) { d_fprintf(stderr, _("Unable to open a connection to %s to " diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c index d01b2d8c771..b139fb2d0da 100644 --- a/source3/utils/net_util.c +++ b/source3/utils/net_util.c @@ -108,7 +108,6 @@ NTSTATUS connect_to_service(struct net_context *c, const char *service_type) { NTSTATUS nt_status; - enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT; struct cli_credentials *creds = NULL; int flags = 0; @@ -119,7 +118,6 @@ NTSTATUS connect_to_service(struct net_context *c, } if (strequal(service_type, "IPC")) { - signing_setting = SMB_SIGNING_IPC_DEFAULT; flags |= CLI_FULL_CONNECTION_IPC; } @@ -127,8 +125,7 @@ NTSTATUS connect_to_service(struct net_context *c, server_ss, c->opt_port, service_name, service_type, creds, - flags, - signing_setting); + flags); if (!NT_STATUS_IS_OK(nt_status)) { d_fprintf(stderr, _("Could not connect to server %s\n"), server_name); @@ -199,8 +196,7 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c, server_name, server_ss, c->opt_port, "IPC$", "IPC", anon_creds, - CLI_FULL_CONNECTION_IPC, - SMB_SIGNING_OFF); + CLI_FULL_CONNECTION_IPC); if (NT_STATUS_IS_OK(nt_status)) { return nt_status; diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c index 2241beb331f..aaf78b0977a 100644 --- a/source3/utils/netlookup.c +++ b/source3/utils/netlookup.c @@ -99,8 +99,7 @@ static struct con_struct *create_cs(struct net_context *c, &loopback_ss, 0, "IPC$", "IPC", anon_creds, - CLI_FULL_CONNECTION_IPC, - SMB_SIGNING_OFF); + CLI_FULL_CONNECTION_IPC); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c index f3209c31877..5983ebbd0a5 100644 --- a/source3/utils/smbcacls.c +++ b/source3/utils/smbcacls.c @@ -778,8 +778,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, NULL, 0, share, "?????", get_cmdline_auth_info_creds(auth_info), - flags, - get_cmdline_auth_info_signing_state(auth_info)); + flags); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); return NULL; diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c index 954d6eba804..fea066ce468 100644 --- a/source3/utils/smbcquotas.c +++ b/source3/utils/smbcquotas.c @@ -527,9 +527,7 @@ static struct cli_state *connect_one(const char *share) share, "?????", get_cmdline_auth_info_creds( popt_get_cmdline_auth_info()), - flags, - get_cmdline_auth_info_signing_state( - popt_get_cmdline_auth_info())); + flags); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); return NULL; -- 2.28.0 From 6752c123f20d46aa68725971e09548a47b7c7457 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 8 Jun 2020 08:04:24 +0200 Subject: [PATCH 033/105] s3:libsmb: Add encryption support to cli_full_connection_creds*() Pair-Programmed-With: Andreas Schneider Signed-off-by: Andreas Schneider Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider --- source3/libsmb/cliconnect.c | 166 ++++++++++++++++++++++++++++++++++++ 1 file changed, 166 insertions(+) diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index b24743d789b..abfd18bfaf1 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -3352,6 +3352,10 @@ static int cli_full_connection_creds_state_destructor( static void cli_full_connection_creds_conn_done(struct tevent_req *subreq); static void cli_full_connection_creds_sess_start(struct tevent_req *req); static void cli_full_connection_creds_sess_done(struct tevent_req *subreq); +static void cli_full_connection_creds_enc_start(struct tevent_req *req); +static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq); +static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq); +static void cli_full_connection_creds_enc_done(struct tevent_req *subreq); static void cli_full_connection_creds_tcon_start(struct tevent_req *req); static void cli_full_connection_creds_tcon_done(struct tevent_req *subreq); @@ -3366,6 +3370,8 @@ struct tevent_req *cli_full_connection_creds_send( struct tevent_req *req, *subreq; struct cli_full_connection_creds_state *state; enum smb_signing_setting signing_state; + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(creds); req = tevent_req_create(mem_ctx, &state, struct cli_full_connection_creds_state); @@ -3386,6 +3392,16 @@ struct tevent_req *cli_full_connection_creds_send( signing_state = cli_credentials_get_smb_signing(creds); } + if (encryption_state == SMB_ENCRYPTION_REQUIRED) { + if (flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK) { + encryption_state = SMB_ENCRYPTION_DESIRED; + } + } + + if (encryption_state >= SMB_ENCRYPTION_DESIRED) { + signing_state = SMB_SIGNING_REQUIRED; + } + subreq = cli_start_connection_send( state, ev, my_name, dest_host, dest_ss, port, signing_state, flags); @@ -3460,6 +3476,156 @@ static void cli_full_connection_creds_sess_done(struct tevent_req *subreq) return; } + cli_full_connection_creds_enc_start(req); +} + +static void cli_full_connection_creds_enc_start(struct tevent_req *req) +{ + struct cli_full_connection_creds_state *state = tevent_req_data( + req, struct cli_full_connection_creds_state); + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(state->creds); + struct tevent_req *subreq = NULL; + NTSTATUS status; + + if (encryption_state < SMB_ENCRYPTION_DESIRED) { + cli_full_connection_creds_tcon_start(req); + return; + } + + if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) { + status = smb2cli_session_encryption_on(state->cli->smb2.session); + if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) { + if (encryption_state < SMB_ENCRYPTION_REQUIRED) { + cli_full_connection_creds_tcon_start(req); + return; + } + d_printf("Encryption required and " + "server doesn't support " + "SMB3 encryption - failing connect\n"); + tevent_req_nterror(req, status); + return; + } else if (!NT_STATUS_IS_OK(status)) { + d_printf("Encryption required and " + "setup failed with error %s.\n", + nt_errstr(status)); + tevent_req_nterror(req, status); + return; + } + + cli_full_connection_creds_tcon_start(req); + return; + } + + if (!SERVER_HAS_UNIX_CIFS(state->cli)) { + if (encryption_state < SMB_ENCRYPTION_REQUIRED) { + cli_full_connection_creds_tcon_start(req); + return; + } + + status = NT_STATUS_NOT_SUPPORTED; + d_printf("Encryption required and " + "server doesn't support " + "SMB1 Unix Extensions - failing connect\n"); + tevent_req_nterror(req, status); + return; + } + + /* + * We do a tcon on IPC$ just to setup the encryption, + * the real tcon will be encrypted then. + */ + subreq = cli_tree_connect_send(state, state->ev, state->cli, + "IPC$", "IPC", NULL); + if (tevent_req_nomem(subreq, req)) { + return; + } + tevent_req_set_callback(subreq, cli_full_connection_creds_enc_tcon, req); +} + +static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq) +{ + struct tevent_req *req = tevent_req_callback_data( + subreq, struct tevent_req); + struct cli_full_connection_creds_state *state = tevent_req_data( + req, struct cli_full_connection_creds_state); + NTSTATUS status; + + status = cli_tree_connect_recv(subreq); + TALLOC_FREE(subreq); + if (tevent_req_nterror(req, status)) { + return; + } + + subreq = cli_unix_extensions_version_send(state, state->ev, state->cli); + if (tevent_req_nomem(subreq, req)) { + return; + } + tevent_req_set_callback(subreq, cli_full_connection_creds_enc_ver, req); +} + +static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq) +{ + struct tevent_req *req = tevent_req_callback_data( + subreq, struct tevent_req); + struct cli_full_connection_creds_state *state = tevent_req_data( + req, struct cli_full_connection_creds_state); + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(state->creds); + uint16_t major, minor; + uint32_t caplow, caphigh; + NTSTATUS status; + + status = cli_unix_extensions_version_recv(subreq, + &major, &minor, + &caplow, + &caphigh); + TALLOC_FREE(subreq); + if (!NT_STATUS_IS_OK(status)) { + if (encryption_state < SMB_ENCRYPTION_REQUIRED) { + cli_full_connection_creds_tcon_start(req); + return; + } + DEBUG(10, ("%s: cli_unix_extensions_version " + "returned %s\n", __func__, nt_errstr(status))); + tevent_req_nterror(req, NT_STATUS_UNKNOWN_REVISION); + return; + } + + if (!(caplow & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)) { + if (encryption_state < SMB_ENCRYPTION_REQUIRED) { + cli_full_connection_creds_tcon_start(req); + return; + } + DEBUG(10, ("%s: CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP " + "not supported\n", __func__)); + tevent_req_nterror(req, NT_STATUS_UNSUPPORTED_COMPRESSION); + return; + } + + subreq = cli_smb1_setup_encryption_send(state, state->ev, + state->cli, + state->creds); + if (tevent_req_nomem(subreq, req)) { + return; + } + tevent_req_set_callback(subreq, + cli_full_connection_creds_enc_done, + req); +} + +static void cli_full_connection_creds_enc_done(struct tevent_req *subreq) +{ + struct tevent_req *req = tevent_req_callback_data( + subreq, struct tevent_req); + NTSTATUS status; + + status = cli_smb1_setup_encryption_recv(subreq); + TALLOC_FREE(subreq); + if (tevent_req_nterror(req, status)) { + return; + } + cli_full_connection_creds_tcon_start(req); } -- 2.28.0 From bdb894ebb29820b97dba3721a517a61d96fac152 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 11:26:00 +0200 Subject: [PATCH 034/105] python: Add a test for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- python/samba/tests/libsmb.py | 37 ++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/python/samba/tests/libsmb.py b/python/samba/tests/libsmb.py index e8f8e7fe94d..81d4e482644 100644 --- a/python/samba/tests/libsmb.py +++ b/python/samba/tests/libsmb.py @@ -21,10 +21,12 @@ from samba.samba3 import libsmb_samba_internal as libsmb from samba.dcerpc import security from samba.samba3 import param as s3param from samba import credentials +from samba.credentials import SMB_ENCRYPTION_REQUIRED import samba.tests import threading import sys import os +import random class LibsmbTestCase(samba.tests.TestCase): @@ -77,6 +79,41 @@ class LibsmbTestCase(samba.tests.TestCase): if t.exc: raise t.exc[0](t.exc[1]) + def test_SMB3EncryptionRequired(self): + test_dir = 'testing_%d' % random.randint(0, 0xFFFF) + + lp = s3param.get_context() + lp.load(os.getenv("SMB_CONF_PATH")) + + creds = credentials.Credentials() + creds.guess(lp) + creds.set_username(os.getenv("USERNAME")) + creds.set_password(os.getenv("PASSWORD")) + creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) + + c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp", + lp, creds) + + c.mkdir(test_dir) + c.rmdir(test_dir) + + def test_SMB1EncryptionRequired(self): + test_dir = 'testing_%d' % random.randint(0, 0xFFFF) + + lp = s3param.get_context() + lp.load(os.getenv("SMB_CONF_PATH")) + + creds = credentials.Credentials() + creds.guess(lp) + creds.set_username(os.getenv("USERNAME")) + creds.set_password(os.getenv("PASSWORD")) + creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) + + c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp", + lp, creds, force_smb1=True) + + c.mkdir(test_dir) + c.rmdir(test_dir) if __name__ == "__main__": import unittest -- 2.28.0 From d26afd8352435db71c542388220e951184adcdde Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:31:02 +0200 Subject: [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/utils/net_util.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c index b139fb2d0da..5829d891075 100644 --- a/source3/utils/net_util.c +++ b/source3/utils/net_util.c @@ -148,16 +148,6 @@ NTSTATUS connect_to_service(struct net_context *c, return nt_status; } - if (c->smb_encrypt) { - nt_status = cli_cm_force_encryption_creds(*cli_ctx, - creds, - service_name); - if (!NT_STATUS_IS_OK(nt_status)) { - cli_shutdown(*cli_ctx); - *cli_ctx = NULL; - } - } - return nt_status; } @@ -577,6 +567,12 @@ struct cli_credentials *net_context_creds(struct net_context *c, CRED_SPECIFIED); } + if (c->smb_encrypt) { + cli_credentials_set_smb_encryption(creds, + SMB_ENCRYPTION_REQUIRED, + CRED_SPECIFIED); + } + return creds; } -- 2.28.0 From c228933e88c6b615fa49402d2e826a5ec14b9f85 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:40:13 +0200 Subject: [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() This also adds a SMBC_ENCRYPTLEVEL_DEFAULT to 'enum smbc_smb_encrypt_level' in order to use the smb.conf default value. Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/include/libsmbclient.h | 1 + source3/libsmb/ABI/smbclient-0.7.0.sigs | 188 ++++++++++++++++++++++++ source3/libsmb/libsmb_context.c | 4 +- source3/libsmb/libsmb_server.c | 72 +++------ source3/libsmb/wscript | 2 +- 5 files changed, 216 insertions(+), 51 deletions(-) create mode 100644 source3/libsmb/ABI/smbclient-0.7.0.sigs diff --git a/source3/include/libsmbclient.h b/source3/include/libsmbclient.h index c47e7c2a872..84c98089251 100644 --- a/source3/include/libsmbclient.h +++ b/source3/include/libsmbclient.h @@ -225,6 +225,7 @@ typedef enum smbc_share_mode */ typedef enum smbc_smb_encrypt_level { + SMBC_ENCRYPTLEVEL_DEFAULT = -1, SMBC_ENCRYPTLEVEL_NONE = 0, SMBC_ENCRYPTLEVEL_REQUEST = 1, SMBC_ENCRYPTLEVEL_REQUIRE = 2 diff --git a/source3/libsmb/ABI/smbclient-0.7.0.sigs b/source3/libsmb/ABI/smbclient-0.7.0.sigs new file mode 100644 index 00000000000..ee758e21b50 --- /dev/null +++ b/source3/libsmb/ABI/smbclient-0.7.0.sigs @@ -0,0 +1,188 @@ +smbc_chmod: int (const char *, mode_t) +smbc_close: int (int) +smbc_closedir: int (int) +smbc_creat: int (const char *, mode_t) +smbc_fgetxattr: int (int, const char *, const void *, size_t) +smbc_flistxattr: int (int, char *, size_t) +smbc_free_context: int (SMBCCTX *, int) +smbc_fremovexattr: int (int, const char *) +smbc_fsetxattr: int (int, const char *, const void *, size_t, int) +smbc_fstat: int (int, struct stat *) +smbc_fstatvfs: int (int, struct statvfs *) +smbc_ftruncate: int (int, off_t) +smbc_getDebug: int (SMBCCTX *) +smbc_getFunctionAddCachedServer: smbc_add_cached_srv_fn (SMBCCTX *) +smbc_getFunctionAuthData: smbc_get_auth_data_fn (SMBCCTX *) +smbc_getFunctionAuthDataWithContext: smbc_get_auth_data_with_context_fn (SMBCCTX *) +smbc_getFunctionCheckServer: smbc_check_server_fn (SMBCCTX *) +smbc_getFunctionChmod: smbc_chmod_fn (SMBCCTX *) +smbc_getFunctionClose: smbc_close_fn (SMBCCTX *) +smbc_getFunctionClosedir: smbc_closedir_fn (SMBCCTX *) +smbc_getFunctionCreat: smbc_creat_fn (SMBCCTX *) +smbc_getFunctionFstat: smbc_fstat_fn (SMBCCTX *) +smbc_getFunctionFstatVFS: smbc_fstatvfs_fn (SMBCCTX *) +smbc_getFunctionFstatdir: smbc_fstatdir_fn (SMBCCTX *) +smbc_getFunctionFtruncate: smbc_ftruncate_fn (SMBCCTX *) +smbc_getFunctionGetCachedServer: smbc_get_cached_srv_fn (SMBCCTX *) +smbc_getFunctionGetdents: smbc_getdents_fn (SMBCCTX *) +smbc_getFunctionGetxattr: smbc_getxattr_fn (SMBCCTX *) +smbc_getFunctionListPrintJobs: smbc_list_print_jobs_fn (SMBCCTX *) +smbc_getFunctionListxattr: smbc_listxattr_fn (SMBCCTX *) +smbc_getFunctionLseek: smbc_lseek_fn (SMBCCTX *) +smbc_getFunctionLseekdir: smbc_lseekdir_fn (SMBCCTX *) +smbc_getFunctionMkdir: smbc_mkdir_fn (SMBCCTX *) +smbc_getFunctionNotify: smbc_notify_fn (SMBCCTX *) +smbc_getFunctionOpen: smbc_open_fn (SMBCCTX *) +smbc_getFunctionOpenPrintJob: smbc_open_print_job_fn (SMBCCTX *) +smbc_getFunctionOpendir: smbc_opendir_fn (SMBCCTX *) +smbc_getFunctionPrintFile: smbc_print_file_fn (SMBCCTX *) +smbc_getFunctionPurgeCachedServers: smbc_purge_cached_fn (SMBCCTX *) +smbc_getFunctionRead: smbc_read_fn (SMBCCTX *) +smbc_getFunctionReaddir: smbc_readdir_fn (SMBCCTX *) +smbc_getFunctionReaddirPlus: smbc_readdirplus_fn (SMBCCTX *) +smbc_getFunctionReaddirPlus2: smbc_readdirplus2_fn (SMBCCTX *) +smbc_getFunctionRemoveCachedServer: smbc_remove_cached_srv_fn (SMBCCTX *) +smbc_getFunctionRemoveUnusedServer: smbc_remove_unused_server_fn (SMBCCTX *) +smbc_getFunctionRemovexattr: smbc_removexattr_fn (SMBCCTX *) +smbc_getFunctionRename: smbc_rename_fn (SMBCCTX *) +smbc_getFunctionRmdir: smbc_rmdir_fn (SMBCCTX *) +smbc_getFunctionSetxattr: smbc_setxattr_fn (SMBCCTX *) +smbc_getFunctionSplice: smbc_splice_fn (SMBCCTX *) +smbc_getFunctionStat: smbc_stat_fn (SMBCCTX *) +smbc_getFunctionStatVFS: smbc_statvfs_fn (SMBCCTX *) +smbc_getFunctionTelldir: smbc_telldir_fn (SMBCCTX *) +smbc_getFunctionUnlink: smbc_unlink_fn (SMBCCTX *) +smbc_getFunctionUnlinkPrintJob: smbc_unlink_print_job_fn (SMBCCTX *) +smbc_getFunctionUtimes: smbc_utimes_fn (SMBCCTX *) +smbc_getFunctionWrite: smbc_write_fn (SMBCCTX *) +smbc_getNetbiosName: const char *(SMBCCTX *) +smbc_getOptionBrowseMaxLmbCount: int (SMBCCTX *) +smbc_getOptionCaseSensitive: smbc_bool (SMBCCTX *) +smbc_getOptionDebugToStderr: smbc_bool (SMBCCTX *) +smbc_getOptionFallbackAfterKerberos: smbc_bool (SMBCCTX *) +smbc_getOptionFullTimeNames: smbc_bool (SMBCCTX *) +smbc_getOptionNoAutoAnonymousLogin: smbc_bool (SMBCCTX *) +smbc_getOptionOneSharePerServer: smbc_bool (SMBCCTX *) +smbc_getOptionOpenShareMode: smbc_share_mode (SMBCCTX *) +smbc_getOptionSmbEncryptionLevel: smbc_smb_encrypt_level (SMBCCTX *) +smbc_getOptionUrlEncodeReaddirEntries: smbc_bool (SMBCCTX *) +smbc_getOptionUseCCache: smbc_bool (SMBCCTX *) +smbc_getOptionUseKerberos: smbc_bool (SMBCCTX *) +smbc_getOptionUseNTHash: smbc_bool (SMBCCTX *) +smbc_getOptionUserData: void *(SMBCCTX *) +smbc_getPort: uint16_t (SMBCCTX *) +smbc_getServerCacheData: struct smbc_server_cache *(SMBCCTX *) +smbc_getTimeout: int (SMBCCTX *) +smbc_getUser: const char *(SMBCCTX *) +smbc_getWorkgroup: const char *(SMBCCTX *) +smbc_getdents: int (unsigned int, struct smbc_dirent *, int) +smbc_getxattr: int (const char *, const char *, const void *, size_t) +smbc_init: int (smbc_get_auth_data_fn, int) +smbc_init_context: SMBCCTX *(SMBCCTX *) +smbc_lgetxattr: int (const char *, const char *, const void *, size_t) +smbc_list_print_jobs: int (const char *, smbc_list_print_job_fn) +smbc_listxattr: int (const char *, char *, size_t) +smbc_llistxattr: int (const char *, char *, size_t) +smbc_lremovexattr: int (const char *, const char *) +smbc_lseek: off_t (int, off_t, int) +smbc_lseekdir: int (int, off_t) +smbc_lsetxattr: int (const char *, const char *, const void *, size_t, int) +smbc_mkdir: int (const char *, mode_t) +smbc_new_context: SMBCCTX *(void) +smbc_notify: int (int, smbc_bool, uint32_t, unsigned int, smbc_notify_callback_fn, void *) +smbc_open: int (const char *, int, mode_t) +smbc_open_print_job: int (const char *) +smbc_opendir: int (const char *) +smbc_option_get: void *(SMBCCTX *, char *) +smbc_option_set: void (SMBCCTX *, char *, ...) +smbc_print_file: int (const char *, const char *) +smbc_read: ssize_t (int, void *, size_t) +smbc_readdir: struct smbc_dirent *(unsigned int) +smbc_readdirplus: const struct libsmb_file_info *(unsigned int) +smbc_readdirplus2: const struct libsmb_file_info *(unsigned int, struct stat *) +smbc_removexattr: int (const char *, const char *) +smbc_rename: int (const char *, const char *) +smbc_rmdir: int (const char *) +smbc_setConfiguration: int (SMBCCTX *, const char *) +smbc_setDebug: void (SMBCCTX *, int) +smbc_setFunctionAddCachedServer: void (SMBCCTX *, smbc_add_cached_srv_fn) +smbc_setFunctionAuthData: void (SMBCCTX *, smbc_get_auth_data_fn) +smbc_setFunctionAuthDataWithContext: void (SMBCCTX *, smbc_get_auth_data_with_context_fn) +smbc_setFunctionCheckServer: void (SMBCCTX *, smbc_check_server_fn) +smbc_setFunctionChmod: void (SMBCCTX *, smbc_chmod_fn) +smbc_setFunctionClose: void (SMBCCTX *, smbc_close_fn) +smbc_setFunctionClosedir: void (SMBCCTX *, smbc_closedir_fn) +smbc_setFunctionCreat: void (SMBCCTX *, smbc_creat_fn) +smbc_setFunctionFstat: void (SMBCCTX *, smbc_fstat_fn) +smbc_setFunctionFstatVFS: void (SMBCCTX *, smbc_fstatvfs_fn) +smbc_setFunctionFstatdir: void (SMBCCTX *, smbc_fstatdir_fn) +smbc_setFunctionFtruncate: void (SMBCCTX *, smbc_ftruncate_fn) +smbc_setFunctionGetCachedServer: void (SMBCCTX *, smbc_get_cached_srv_fn) +smbc_setFunctionGetdents: void (SMBCCTX *, smbc_getdents_fn) +smbc_setFunctionGetxattr: void (SMBCCTX *, smbc_getxattr_fn) +smbc_setFunctionListPrintJobs: void (SMBCCTX *, smbc_list_print_jobs_fn) +smbc_setFunctionListxattr: void (SMBCCTX *, smbc_listxattr_fn) +smbc_setFunctionLseek: void (SMBCCTX *, smbc_lseek_fn) +smbc_setFunctionLseekdir: void (SMBCCTX *, smbc_lseekdir_fn) +smbc_setFunctionMkdir: void (SMBCCTX *, smbc_mkdir_fn) +smbc_setFunctionNotify: void (SMBCCTX *, smbc_notify_fn) +smbc_setFunctionOpen: void (SMBCCTX *, smbc_open_fn) +smbc_setFunctionOpenPrintJob: void (SMBCCTX *, smbc_open_print_job_fn) +smbc_setFunctionOpendir: void (SMBCCTX *, smbc_opendir_fn) +smbc_setFunctionPrintFile: void (SMBCCTX *, smbc_print_file_fn) +smbc_setFunctionPurgeCachedServers: void (SMBCCTX *, smbc_purge_cached_fn) +smbc_setFunctionRead: void (SMBCCTX *, smbc_read_fn) +smbc_setFunctionReaddir: void (SMBCCTX *, smbc_readdir_fn) +smbc_setFunctionReaddirPlus: void (SMBCCTX *, smbc_readdirplus_fn) +smbc_setFunctionReaddirPlus2: void (SMBCCTX *, smbc_readdirplus2_fn) +smbc_setFunctionRemoveCachedServer: void (SMBCCTX *, smbc_remove_cached_srv_fn) +smbc_setFunctionRemoveUnusedServer: void (SMBCCTX *, smbc_remove_unused_server_fn) +smbc_setFunctionRemovexattr: void (SMBCCTX *, smbc_removexattr_fn) +smbc_setFunctionRename: void (SMBCCTX *, smbc_rename_fn) +smbc_setFunctionRmdir: void (SMBCCTX *, smbc_rmdir_fn) +smbc_setFunctionSetxattr: void (SMBCCTX *, smbc_setxattr_fn) +smbc_setFunctionSplice: void (SMBCCTX *, smbc_splice_fn) +smbc_setFunctionStat: void (SMBCCTX *, smbc_stat_fn) +smbc_setFunctionStatVFS: void (SMBCCTX *, smbc_statvfs_fn) +smbc_setFunctionTelldir: void (SMBCCTX *, smbc_telldir_fn) +smbc_setFunctionUnlink: void (SMBCCTX *, smbc_unlink_fn) +smbc_setFunctionUnlinkPrintJob: void (SMBCCTX *, smbc_unlink_print_job_fn) +smbc_setFunctionUtimes: void (SMBCCTX *, smbc_utimes_fn) +smbc_setFunctionWrite: void (SMBCCTX *, smbc_write_fn) +smbc_setLogCallback: void (SMBCCTX *, void *, smbc_debug_callback_fn) +smbc_setNetbiosName: void (SMBCCTX *, const char *) +smbc_setOptionBrowseMaxLmbCount: void (SMBCCTX *, int) +smbc_setOptionCaseSensitive: void (SMBCCTX *, smbc_bool) +smbc_setOptionDebugToStderr: void (SMBCCTX *, smbc_bool) +smbc_setOptionFallbackAfterKerberos: void (SMBCCTX *, smbc_bool) +smbc_setOptionFullTimeNames: void (SMBCCTX *, smbc_bool) +smbc_setOptionNoAutoAnonymousLogin: void (SMBCCTX *, smbc_bool) +smbc_setOptionOneSharePerServer: void (SMBCCTX *, smbc_bool) +smbc_setOptionOpenShareMode: void (SMBCCTX *, smbc_share_mode) +smbc_setOptionProtocols: smbc_bool (SMBCCTX *, const char *, const char *) +smbc_setOptionSmbEncryptionLevel: void (SMBCCTX *, smbc_smb_encrypt_level) +smbc_setOptionUrlEncodeReaddirEntries: void (SMBCCTX *, smbc_bool) +smbc_setOptionUseCCache: void (SMBCCTX *, smbc_bool) +smbc_setOptionUseKerberos: void (SMBCCTX *, smbc_bool) +smbc_setOptionUseNTHash: void (SMBCCTX *, smbc_bool) +smbc_setOptionUserData: void (SMBCCTX *, void *) +smbc_setPort: void (SMBCCTX *, uint16_t) +smbc_setServerCacheData: void (SMBCCTX *, struct smbc_server_cache *) +smbc_setTimeout: void (SMBCCTX *, int) +smbc_setUser: void (SMBCCTX *, const char *) +smbc_setWorkgroup: void (SMBCCTX *, const char *) +smbc_set_context: SMBCCTX *(SMBCCTX *) +smbc_set_credentials: void (const char *, const char *, const char *, smbc_bool, const char *) +smbc_set_credentials_with_fallback: void (SMBCCTX *, const char *, const char *, const char *) +smbc_setxattr: int (const char *, const char *, const void *, size_t, int) +smbc_stat: int (const char *, struct stat *) +smbc_statvfs: int (char *, struct statvfs *) +smbc_telldir: off_t (int) +smbc_unlink: int (const char *) +smbc_unlink_print_job: int (const char *, int) +smbc_urldecode: int (char *, char *, size_t) +smbc_urlencode: int (char *, char *, int) +smbc_utime: int (const char *, struct utimbuf *) +smbc_utimes: int (const char *, struct timeval *) +smbc_version: const char *(void) +smbc_write: ssize_t (int, const void *, size_t) diff --git a/source3/libsmb/libsmb_context.c b/source3/libsmb/libsmb_context.c index eaa0cdeca93..ea741f41c7d 100644 --- a/source3/libsmb/libsmb_context.c +++ b/source3/libsmb/libsmb_context.c @@ -171,7 +171,7 @@ smbc_new_context(void) smbc_setOptionFullTimeNames(context, False); smbc_setOptionOpenShareMode(context, SMBC_SHAREMODE_DENY_NONE); - smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_NONE); + smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_DEFAULT); smbc_setOptionUseCCache(context, True); smbc_setOptionCaseSensitive(context, False); smbc_setOptionBrowseMaxLmbCount(context, 3); /* # LMBs to query */ @@ -474,6 +474,8 @@ smbc_option_get(SMBCCTX *context, } else if (strcmp(option_name, "smb_encrypt_level") == 0) { switch(smbc_getOptionSmbEncryptionLevel(context)) { + case SMBC_ENCRYPTLEVEL_DEFAULT: + return discard_const_p(void, "default"); case 0: return discard_const_p(void, "none"); case 1: diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c index 33dc8419deb..eb58d7c6ac9 100644 --- a/source3/libsmb/libsmb_server.c +++ b/source3/libsmb/libsmb_server.c @@ -284,6 +284,29 @@ static struct cli_credentials *SMBC_auth_credentials(TALLOC_CTX *mem_ctx, return NULL; } + switch (context->internal->smb_encryption_level) { + case SMBC_ENCRYPTLEVEL_DEFAULT: + /* Use the config option */ + break; + case SMBC_ENCRYPTLEVEL_NONE: + cli_credentials_set_smb_encryption(creds, + SMB_ENCRYPTION_OFF, + CRED_SPECIFIED); + break; + case SMBC_ENCRYPTLEVEL_REQUEST: + cli_credentials_set_smb_encryption(creds, + SMB_ENCRYPTION_DESIRED, + CRED_SPECIFIED); + break; + case SMBC_ENCRYPTLEVEL_REQUIRE: + default: + cli_credentials_set_smb_encryption(creds, + SMB_ENCRYPTION_REQUIRED, + CRED_SPECIFIED); + break; + } + + return creds; } @@ -625,30 +648,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, smbXcli_tcon_set_fs_attributes(tcon, fs_attrs); } - if (context->internal->smb_encryption_level) { - /* Attempt encryption. */ - status = cli_cm_force_encryption_creds(c, - creds, - share); - if (!NT_STATUS_IS_OK(status)) { - - /* - * context->smb_encryption_level == 1 - * means don't fail if encryption can't be negotiated, - * == 2 means fail if encryption can't be negotiated. - */ - - DEBUG(4,(" SMB encrypt failed\n")); - - if (context->internal->smb_encryption_level == 2) { - cli_shutdown(c); - errno = EPERM; - return NULL; - } - } - DEBUG(4,(" SMB encrypt ok\n")); - } - /* * Ok, we have got a nice connection * Let's allocate a server structure. @@ -825,31 +824,6 @@ SMBC_attr_server(TALLOC_CTX *ctx, } talloc_steal(ipc_cli, creds); - if (context->internal->smb_encryption_level) { - /* Attempt encryption. */ - nt_status = cli_cm_force_encryption_creds(ipc_cli, - creds, - "IPC$"); - if (!NT_STATUS_IS_OK(nt_status)) { - - /* - * context->smb_encryption_level == - * 1 means don't fail if encryption can't be - * negotiated, == 2 means fail if encryption - * can't be negotiated. - */ - - DEBUG(4,(" SMB encrypt failed on IPC$\n")); - - if (context->internal->smb_encryption_level == 2) { - cli_shutdown(ipc_cli); - errno = EPERM; - return NULL; - } - } - DEBUG(4,(" SMB encrypt ok on IPC$\n")); - } - ipc_srv = SMB_MALLOC_P(SMBCSRV); if (!ipc_srv) { errno = ENOMEM; diff --git a/source3/libsmb/wscript b/source3/libsmb/wscript index ec4a516b2ee..61503d0a98b 100644 --- a/source3/libsmb/wscript +++ b/source3/libsmb/wscript @@ -26,5 +26,5 @@ def build(bld): public_headers='../include/libsmbclient.h', abi_directory='ABI', abi_match='smbc_*', - vnum='0.6.0', + vnum='0.7.0', pc_files='smbclient.pc') -- 2.28.0 From 76dc706e6449161c27a5f117bc45922ab467dbfc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:43:33 +0200 Subject: [PATCH 037/105] s3:client: Remove unused smb encryption code Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/client/smbspool.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c index f56dc323b6e..16a8d44c069 100644 --- a/source3/client/smbspool.c +++ b/source3/client/smbspool.c @@ -584,16 +584,6 @@ smb_complete_connection(struct cli_state **output_cli, return nt_status; } -#if 0 - /* Need to work out how to specify this on the URL. */ - if (smb_encrypt) { - if (!cli_cm_force_encryption_creds(cli, creds, share)) { - fprintf(stderr, "ERROR: encryption setup failed\n"); - cli_shutdown(cli); - return NULL; - } - } -#endif *output_cli = cli; return NT_STATUS_OK; -- 2.28.0 From a444688a6ed50c8443a778fbddb4dbd8a39d49d4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:47:05 +0200 Subject: [PATCH 038/105] s3:utils: Remove obsolete force encryption from smbacls Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/utils/smbcacls.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c index 5983ebbd0a5..8fd9fcc5780 100644 --- a/source3/utils/smbcacls.c +++ b/source3/utils/smbcacls.c @@ -784,16 +784,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, return NULL; } - if (get_cmdline_auth_info_smb_encrypt(auth_info)) { - nt_status = cli_cm_force_encryption_creds(c, - get_cmdline_auth_info_creds(auth_info), - share); - if (!NT_STATUS_IS_OK(nt_status)) { - cli_shutdown(c); - c = NULL; - } - } - return c; } -- 2.28.0 From 21b72b6107cd849b9da77e17520e658745fb897a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:48:18 +0200 Subject: [PATCH 039/105] s3:utils: Remove obsolete force encryption from mdfind Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/utils/mdfind.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c index 2ac4fde7daf..ef2657e4fa5 100644 --- a/source3/utils/mdfind.c +++ b/source3/utils/mdfind.c @@ -159,13 +159,6 @@ int main(int argc, char **argv) goto fail; } - if (get_cmdline_auth_info_smb_encrypt(auth)) { - status = cli_cm_force_encryption_creds(cli, creds, "IPC$"); - if (!NT_STATUS_IS_OK(status)) { - goto fail; - } - } - status = cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP, &ndr_table_mdssvc, -- 2.28.0 From 842c3c1346cba54c92d6ba2d462818875403a394 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:49:28 +0200 Subject: [PATCH 040/105] s3:utils: Remove obsolete force encryption from smbcquotas Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/utils/smbcquotas.c | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c index fea066ce468..4ceac7b3ab0 100644 --- a/source3/utils/smbcquotas.c +++ b/source3/utils/smbcquotas.c @@ -533,17 +533,6 @@ static struct cli_state *connect_one(const char *share) return NULL; } - if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) { - nt_status = cli_cm_force_encryption_creds(c, - get_cmdline_auth_info_creds( - popt_get_cmdline_auth_info()), - share); - if (!NT_STATUS_IS_OK(nt_status)) { - cli_shutdown(c); - return NULL; - } - } - return c; } -- 2.28.0 From be36aec550d817bbcfdea88b433e31b44886ba19 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:51:18 +0200 Subject: [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from rpcclient Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/rpcclient/rpcclient.c | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index 2ead6cc7ba5..575a42ebf70 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -1214,17 +1214,6 @@ out_free: goto done; } - if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) { - nt_status = cli_cm_force_encryption_creds(cli, - get_cmdline_auth_info_creds( - popt_get_cmdline_auth_info()), - "IPC$"); - if (!NT_STATUS_IS_OK(nt_status)) { - result = 1; - goto done; - } - } - #if 0 /* COMMENT OUT FOR TESTING */ memset(cmdline_auth_info.password,'X',sizeof(cmdline_auth_info.password)); #endif -- 2.28.0 From 8e2de7801238eb7f1090a9307dc4b05885b3dda2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 10:58:36 +0200 Subject: [PATCH 042/105] examples: Remove obsolete force encryption from smb2mount Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- examples/fuse/smb2mount.c | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c index 6206c3a9701..c64be573462 100644 --- a/examples/fuse/smb2mount.c +++ b/examples/fuse/smb2mount.c @@ -44,17 +44,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, return NULL; } - if (get_cmdline_auth_info_smb_encrypt(auth_info)) { - nt_status = cli_cm_force_encryption_creds( - c, - get_cmdline_auth_info_creds(auth_info), - share); - if (!NT_STATUS_IS_OK(nt_status)) { - cli_shutdown(c); - c = NULL; - } - } - return c; } -- 2.28.0 From 8c9a31cc180c674925919771ccdce1bb6895c1a3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 11:05:59 +0200 Subject: [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() static Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/libsmb/clidfs.c | 6 +++--- source3/libsmb/proto.h | 3 --- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index 4495a027830..aff998f6187 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -43,9 +43,9 @@ Ensure a connection is encrypted. ********************************************************************/ -NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, - struct cli_credentials *creds, - const char *sharename) +static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, + struct cli_credentials *creds, + const char *sharename) { uint16_t major, minor; uint32_t caplow, caphigh; diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h index 850cf12c8a6..eeabcaa7463 100644 --- a/source3/libsmb/proto.h +++ b/source3/libsmb/proto.h @@ -123,9 +123,6 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx, /* The following definitions come from libsmb/clidfs.c */ -NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, - struct cli_credentials *creds, - const char *sharename); NTSTATUS cli_cm_open(TALLOC_CTX *ctx, struct cli_state *referring_cli, const char *server, -- 2.28.0 From 6e2a7196c424edd2c447cfd4377e38e5b51ee675 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 16:16:55 +0200 Subject: [PATCH 044/105] s4:libcli: Return NTSTATUS errors for smb_composite_connect_send() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source4/libcli/smb_composite/connect.c | 40 +++++++++++++++++++------- 1 file changed, 29 insertions(+), 11 deletions(-) diff --git a/source4/libcli/smb_composite/connect.c b/source4/libcli/smb_composite/connect.c index 582d43ef173..ad50ae0ac81 100644 --- a/source4/libcli/smb_composite/connect.c +++ b/source4/libcli/smb_composite/connect.c @@ -420,15 +420,25 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec struct connect_state *state; c = talloc_zero(mem_ctx, struct composite_context); - if (c == NULL) goto failed; - - c->event_ctx = event_ctx; - if (c->event_ctx == NULL) goto failed; + if (c == NULL) { + goto nomem; + } state = talloc_zero(c, struct connect_state); - if (state == NULL) goto failed; + if (state == NULL) { + goto nomem; + } + + c->event_ctx = event_ctx; + if (c->event_ctx == NULL) { + composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX); + return c; + } - if (io->in.gensec_settings == NULL) goto failed; + if (io->in.gensec_settings == NULL) { + composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX); + return c; + } state->io = io; c->state = COMPOSITE_STATE_IN_PROGRESS; @@ -449,12 +459,14 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec &io->in.options, &state->transport); if (!NT_STATUS_IS_OK(status)) { - goto failed; + composite_error(c, status); + return c; } status = connect_send_session(c, io); if (!NT_STATUS_IS_OK(status)) { - goto failed; + composite_error(c, status); + return c; } return c; @@ -468,15 +480,18 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec io->in.socket_options, &state->calling, &state->called); - if (state->creq == NULL) goto failed; + if (state->creq == NULL) { + composite_error(c, NT_STATUS_NO_MEMORY); + return c; + } state->stage = CONNECT_SOCKET; state->creq->async.private_data = c; state->creq->async.fn = composite_handler; return c; -failed: - talloc_free(c); +nomem: + TALLOC_FREE(c); return NULL; } @@ -506,5 +521,8 @@ NTSTATUS smb_composite_connect(struct smb_composite_connect *io, TALLOC_CTX *mem struct tevent_context *ev) { struct composite_context *c = smb_composite_connect_send(io, mem_ctx, resolve_ctx, ev); + if (c == NULL) { + return NT_STATUS_NO_MEMORY; + } return smb_composite_connect_recv(c, mem_ctx); } -- 2.28.0 From cf89573a78556993d7ecb43257d347edc6c61151 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:54:26 +0200 Subject: [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source4/libcli/smb_composite/sesssetup.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c index 6ee4929e8d7..51e121bdce6 100644 --- a/source4/libcli/smb_composite/sesssetup.c +++ b/source4/libcli/smb_composite/sesssetup.c @@ -620,10 +620,17 @@ struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *se struct composite_context *c; struct sesssetup_state *state; NTSTATUS status; + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(io->in.credentials); c = composite_create(session, session->transport->ev); if (c == NULL) return NULL; + if (encryption_state > SMB_ENCRYPTION_DESIRED) { + composite_error(c, NT_STATUS_PROTOCOL_NOT_SUPPORTED); + return c; + } + state = talloc_zero(c, struct sesssetup_state); if (composite_nomem(state, c)) return c; c->private_data = state; -- 2.28.0 From 05914c4f85f71c7d1df884e33b8c0b8f5062ee3b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:29:39 +0200 Subject: [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source4/libcli/smb2/connect.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c index 6fc3993a4e8..95ff05eac8f 100644 --- a/source4/libcli/smb2/connect.c +++ b/source4/libcli/smb2/connect.c @@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req) tevent_req_set_callback(subreq, smb2_connect_session_done, req); } +static void smb2_connect_tcon_start(struct tevent_req *req); static void smb2_connect_tcon_done(struct tevent_req *subreq); static void smb2_connect_session_done(struct tevent_req *subreq) @@ -248,7 +249,6 @@ static void smb2_connect_session_done(struct tevent_req *subreq) tevent_req_data(req, struct smb2_connect_state); NTSTATUS status; - uint32_t timeout_msec; status = smb2_session_setup_spnego_recv(subreq); TALLOC_FREE(subreq); @@ -289,6 +289,17 @@ static void smb2_connect_session_done(struct tevent_req *subreq) return; } + smb2_connect_tcon_start(req); +} + +static void smb2_connect_tcon_start(struct tevent_req *req) +{ + struct smb2_connect_state *state = + tevent_req_data(req, + struct smb2_connect_state); + struct tevent_req *subreq = NULL; + uint32_t timeout_msec; + timeout_msec = state->transport->options.request_timeout * 1000; subreq = smb2cli_tcon_send(state, state->ev, -- 2.28.0 From 63b0086d8ffdfca44134c09ff0db76d7a9ae8f6c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:44:26 +0200 Subject: [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source4/libcli/smb2/connect.c | 38 +++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c index 95ff05eac8f..3a3ecdf20e8 100644 --- a/source4/libcli/smb2/connect.c +++ b/source4/libcli/smb2/connect.c @@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req) tevent_req_set_callback(subreq, smb2_connect_session_done, req); } +static void smb2_connect_enc_start(struct tevent_req *req); static void smb2_connect_tcon_start(struct tevent_req *req); static void smb2_connect_tcon_done(struct tevent_req *subreq); @@ -289,6 +290,43 @@ static void smb2_connect_session_done(struct tevent_req *subreq) return; } + smb2_connect_enc_start(req); +} + +static void smb2_connect_enc_start(struct tevent_req *req) +{ + struct smb2_connect_state *state = + tevent_req_data(req, + struct smb2_connect_state); + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(state->credentials); + NTSTATUS status; + + if (encryption_state < SMB_ENCRYPTION_DESIRED) { + smb2_connect_tcon_start(req); + return; + } + + status = smb2cli_session_encryption_on(state->session->smbXcli); + if (!NT_STATUS_IS_OK(status)) { + if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) { + if (encryption_state < SMB_ENCRYPTION_REQUIRED) { + smb2_connect_tcon_start(req); + return; + } + + DBG_ERR("Encryption required and server doesn't support " + "SMB3 encryption - failing connect\n"); + tevent_req_nterror(req, status); + return; + } + + DBG_ERR("Encryption required and setup failed with error %s.\n", + nt_errstr(status)); + tevent_req_nterror(req, NT_STATUS_PROTOCOL_NOT_SUPPORTED); + return; + } + smb2_connect_tcon_start(req); } -- 2.28.0 From 8bc1b5f884d1e6a88e1ac403d9bc64c3b77e9428 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 10:18:52 +0200 Subject: [PATCH 048/105] s4:libcli: Require signing for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source4/libcli/smb2/connect.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c index 3a3ecdf20e8..9540704491e 100644 --- a/source4/libcli/smb2/connect.c +++ b/source4/libcli/smb2/connect.c @@ -31,6 +31,7 @@ #include "param/param.h" #include "auth/credentials/credentials.h" #include "../libcli/smb/smbXcli_base.h" +#include "smb2_constants.h" struct smb2_connect_state { struct tevent_context *ev; @@ -76,6 +77,8 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, struct smb2_connect_state *state; struct composite_context *creq; static const char *default_ports[] = { "445", "139", NULL }; + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(credentials); req = tevent_req_create(mem_ctx, &state, struct smb2_connect_state); @@ -99,6 +102,10 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, state->ports = default_ports; } + if (encryption_state >= SMB_ENCRYPTION_DESIRED) { + state->options.signing = SMB_SIGNING_REQUIRED; + } + make_nbt_name_client(&state->calling, cli_credentials_get_workstation(credentials)); @@ -116,7 +123,7 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, status = smb2_transport_raw_init(state, ev, existing_conn, - options, + &state->options, &state->transport); if (tevent_req_nterror(req, status)) { return tevent_req_post(req, ev); -- 2.28.0 From 5cc8a0bc7381444804cde992afdc7aa0c0b70074 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 14:27:07 +0200 Subject: [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC connection Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Wed Aug 19 17:46:28 UTC 2020 on sn-devel-184 --- python/samba/tests/dcerpc/binding.py | 82 ++++++++++++++++++++++++++++ selftest/tests.py | 1 + 2 files changed, 83 insertions(+) create mode 100644 python/samba/tests/dcerpc/binding.py diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py new file mode 100644 index 00000000000..8e0d6a5ef0a --- /dev/null +++ b/python/samba/tests/dcerpc/binding.py @@ -0,0 +1,82 @@ +# +# Unix SMB/CIFS implementation. +# Copyright (c) 2020 Andreas Schneider +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +"""Tests for samba.dcerpc., credentials and binding strings""" + +import samba.tests +from samba.tests import RpcInterfaceTestCase, TestCase +from samba.dcerpc import lsa +import samba.dcerpc.security as security +from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED +from samba import NTSTATUSError + +class RpcBindingTests(RpcInterfaceTestCase): + def setUp(self): + super(RpcBindingTests, self).setUp() + + def get_user_creds(self): + c = Credentials() + c.guess() + domain = samba.tests.env_get_var_value('DOMAIN') + username = samba.tests.env_get_var_value('USERNAME') + password = samba.tests.env_get_var_value('PASSWORD') + c.set_domain(domain) + c.set_username(username) + c.set_password(password) + return c + + def test_smb3_dcerpc_encryption(self): + creds = self.get_user_creds() + creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) + + lp = self.get_loadparm() + lp.set('client ipc max protocol', 'SMB3') + lp.set('client ipc min protocol', 'SMB3') + + binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) + lsa_conn = lsa.lsarpc(binding_string, lp, creds) + + objectAttr = lsa.ObjectAttribute() + objectAttr.sec_qos = lsa.QosInfo() + + pol_handle = lsa_conn.OpenPolicy2('', + objectAttr, + security.SEC_FLAG_MAXIMUM_ALLOWED) + self.assertIsNotNone(pol_handle) + + def test_smb2_dcerpc_encryption(self): + creds = self.get_user_creds() + creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) + + lp = self.get_loadparm() + lp.set('client ipc max protocol', 'SMB2') + lp.set('client ipc min protocol', 'SMB2') + + binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) + self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) + + def test_smb1_dcerpc_encryption(self): + creds = self.get_user_creds() + creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) + + lp = self.get_loadparm() + lp.set('client ipc max protocol', 'NT1') + lp.set('client ipc min protocol', 'NT1') + + binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) + self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) diff --git a/selftest/tests.py b/selftest/tests.py index 20981754db4..adcb5b53189 100644 --- a/selftest/tests.py +++ b/selftest/tests.py @@ -92,6 +92,7 @@ planpythontestsuite( extra_path=[os.path.join(samba4srcdir, "..", "buildtools"), os.path.join(samba4srcdir, "..", "third_party", "waf")]) planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") +planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding") def cmdline(script, *args): -- 2.28.0 From 546ecfae4f11e0625de86e47e90a98a7aafa0453 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:47:54 +0200 Subject: [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() Pair-Programmed-With: Andreas Schneider Signed-off-by: Andreas Schneider Signed-off-by: Stefan Metzmacher (cherry picked from commit b34e8dc8982b625d946e2ac8794ee41311bc41c2) --- auth/gensec/gensec.h | 2 + auth/gensec/gensec_start.c | 87 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 89 insertions(+) diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h index d424067d02c..fe26fff171a 100644 --- a/auth/gensec/gensec.h +++ b/auth/gensec/gensec.h @@ -308,6 +308,8 @@ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, const char *sasl_name); +const char **gensec_security_sasl_names(struct gensec_security *gensec_security, + TALLOC_CTX *mem_ctx); int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value); bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value); diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c index d2d62d6652e..4eb45643714 100644 --- a/auth/gensec/gensec_start.c +++ b/auth/gensec/gensec_start.c @@ -299,6 +299,93 @@ const struct gensec_security_ops *gensec_security_by_name(struct gensec_security return NULL; } +static const char **gensec_security_sasl_names_from_ops( + struct gensec_security *gensec_security, + TALLOC_CTX *mem_ctx, + const struct gensec_security_ops * const *ops) +{ + const char **sasl_names = NULL; + size_t i, sasl_names_count = 0; + + if (ops == NULL) { + return NULL; + } + + sasl_names = talloc_array(mem_ctx, const char *, 1); + if (sasl_names == NULL) { + return NULL; + } + + for (i = 0; ops[i] != NULL; i++) { + enum gensec_role role = GENSEC_SERVER; + const char **tmp = NULL; + + if (ops[i]->sasl_name == NULL) { + continue; + } + + if (gensec_security != NULL) { + if (!gensec_security_ops_enabled(ops[i], + gensec_security)) { + continue; + } + + role = gensec_security->gensec_role; + } + + switch (role) { + case GENSEC_CLIENT: + if (ops[i]->client_start == NULL) { + continue; + } + break; + case GENSEC_SERVER: + if (ops[i]->server_start == NULL) { + continue; + } + break; + } + + tmp = talloc_realloc(mem_ctx, + sasl_names, + const char *, + sasl_names_count + 2); + if (tmp == NULL) { + TALLOC_FREE(sasl_names); + return NULL; + } + sasl_names = tmp; + + sasl_names[sasl_names_count] = ops[i]->sasl_name; + sasl_names_count++; + } + sasl_names[sasl_names_count] = NULL; + + return sasl_names; +} + +/** + * @brief Get the sasl names from the gensec security context. + * + * @param[in] gensec_security The gensec security context. + * + * @param[in] mem_ctx The memory context to allocate memory on. + * + * @return An allocated array with sasl names, NULL on error. + */ +_PUBLIC_ +const char **gensec_security_sasl_names(struct gensec_security *gensec_security, + TALLOC_CTX *mem_ctx) +{ + const struct gensec_security_ops **ops = NULL; + + ops = gensec_security_mechs(gensec_security, mem_ctx); + + return gensec_security_sasl_names_from_ops(gensec_security, + mem_ctx, + ops); +} + /** * Return a unique list of security subsystems from those specified in * the list of SASL names. -- 2.28.0 From ec079d88720a99a5bc5e6b5efd03f87342364f15 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:48:27 +0200 Subject: [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in ldapsrv_backend_Init() Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider (cherry picked from commit 5e3363e0b82193700f91a9bae5080aae0b744e5c) --- source4/dsdb/samdb/ldb_modules/rootdse.c | 4 +- source4/ldap_server/ldap_backend.c | 49 +++++++++++------------- 2 files changed, 25 insertions(+), 28 deletions(-) diff --git a/source4/dsdb/samdb/ldb_modules/rootdse.c b/source4/dsdb/samdb/ldb_modules/rootdse.c index 55340fa4f1e..4be9550747c 100644 --- a/source4/dsdb/samdb/ldb_modules/rootdse.c +++ b/source4/dsdb/samdb/ldb_modules/rootdse.c @@ -230,7 +230,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m struct ldb_context *ldb; struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(ac->module), struct rootdse_private_data); const char * const *attrs = ac->req->op.search.attrs; - char **server_sasl; + const char **server_sasl = NULL; const struct dsdb_schema *schema; int *val; struct ldb_control *edn_control; @@ -341,7 +341,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m } server_sasl = talloc_get_type(ldb_get_opaque(ldb, "supportedSASLMechanisms"), - char *); + const char *); if (server_sasl && do_attribute(attrs, "supportedSASLMechanisms")) { for (i = 0; server_sasl && server_sasl[i]; i++) { char *sasl_name = talloc_strdup(msg, server_sasl[i]); diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c index 2839082daef..915d9b94f9b 100644 --- a/source4/ldap_server/ldap_backend.c +++ b/source4/ldap_server/ldap_backend.c @@ -33,6 +33,7 @@ #include "ldb_wrap.h" #include "lib/tsocket/tsocket.h" #include "libcli/ldap/ldap_proto.h" +#include "source4/auth/auth.h" static int map_ldb_error(TALLOC_CTX *mem_ctx, int ldb_err, const char *add_err_string, const char **errstring) @@ -199,37 +200,33 @@ int ldapsrv_backend_Init(struct ldapsrv_connection *conn, } if (conn->server_credentials) { - char **sasl_mechs = NULL; - const struct gensec_security_ops * const *backends = gensec_security_all(); - const struct gensec_security_ops **ops - = gensec_use_kerberos_mechs(conn, backends, conn->server_credentials); - unsigned int i, j = 0; - for (i = 0; ops && ops[i]; i++) { - if (!lpcfg_parm_bool(conn->lp_ctx, NULL, "gensec", ops[i]->name, ops[i]->enabled)) - continue; - - if (ops[i]->sasl_name && ops[i]->server_start) { - char *sasl_name = talloc_strdup(conn, ops[i]->sasl_name); - - if (!sasl_name) { - return LDB_ERR_OPERATIONS_ERROR; - } - sasl_mechs = talloc_realloc(conn, sasl_mechs, char *, j + 2); - if (!sasl_mechs) { - return LDB_ERR_OPERATIONS_ERROR; - } - sasl_mechs[j] = sasl_name; - talloc_steal(sasl_mechs, sasl_name); - sasl_mechs[j+1] = NULL; - j++; - } + struct gensec_security *gensec_security = NULL; + const char **sasl_mechs = NULL; + NTSTATUS status; + + status = samba_server_gensec_start(conn, + conn->connection->event.ctx, + conn->connection->msg_ctx, + conn->lp_ctx, + conn->server_credentials, + "ldap", + &gensec_security); + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("samba_server_gensec_start failed: %s\n", + nt_errstr(status)); + return LDB_ERR_OPERATIONS_ERROR; } - talloc_unlink(conn, ops); /* ldb can have a different lifetime to conn, so we need to ensure that sasl_mechs lives as long as the ldb does */ - talloc_steal(conn->ldb, sasl_mechs); + sasl_mechs = gensec_security_sasl_names(gensec_security, + conn->ldb); + TALLOC_FREE(gensec_security); + if (sasl_mechs == NULL) { + DBG_ERR("Failed to get sasl mechs!\n"); + return LDB_ERR_OPERATIONS_ERROR; + } ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs); } -- 2.28.0 From bc128ea1ea455a3a63e0ce3dc8777a7482c356f8 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:39:15 +0200 Subject: [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a static function Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider (cherry picked from commit 2186d4131ad4c7961d0c830bf9d48f3d06d27924) --- auth/gensec/gensec.h | 3 --- auth/gensec/gensec_start.c | 7 ++++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h index fe26fff171a..8bece3c3458 100644 --- a/auth/gensec/gensec.h +++ b/auth/gensec/gensec.h @@ -302,9 +302,6 @@ NTSTATUS gensec_wrap(struct gensec_security *gensec_security, const struct gensec_security_ops * const *gensec_security_all(void); bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct gensec_security *security); -const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, - const struct gensec_security_ops * const *old_gensec_list, - struct cli_credentials *creds); NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, const char *sasl_name); diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c index 4eb45643714..ebcab76999a 100644 --- a/auth/gensec/gensec_start.c +++ b/auth/gensec/gensec_start.c @@ -83,9 +83,10 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g * more compplex. */ -_PUBLIC_ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, - const struct gensec_security_ops * const *old_gensec_list, - struct cli_credentials *creds) +static const struct gensec_security_ops **gensec_use_kerberos_mechs( + TALLOC_CTX *mem_ctx, + const struct gensec_security_ops * const *old_gensec_list, + struct cli_credentials *creds) { const struct gensec_security_ops **new_gensec_list; int i, j, num_mechs_in; -- 2.28.0 From 37b7016fba1eae75fc4a87c9c5aebbbb47b7ff39 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:41:43 +0200 Subject: [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to gensec_use_kerberos_mechs() Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider (cherry picked from commit a33a40bbc848e5691869cf264009d23a03128f31) --- auth/gensec/gensec_start.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c index ebcab76999a..8d1b41fec74 100644 --- a/auth/gensec/gensec_start.c +++ b/auth/gensec/gensec_start.c @@ -86,19 +86,11 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g static const struct gensec_security_ops **gensec_use_kerberos_mechs( TALLOC_CTX *mem_ctx, const struct gensec_security_ops * const *old_gensec_list, - struct cli_credentials *creds) + enum credentials_use_kerberos use_kerberos, + bool keep_schannel) { const struct gensec_security_ops **new_gensec_list; int i, j, num_mechs_in; - enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; - bool keep_schannel = false; - - if (creds) { - use_kerberos = cli_credentials_get_kerberos_state(creds); - if (cli_credentials_get_netlogon_creds(creds) != NULL) { - keep_schannel = true; - } - } for (num_mechs_in=0; old_gensec_list && old_gensec_list[num_mechs_in]; num_mechs_in++) { /* noop */ @@ -163,18 +155,28 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( struct gensec_security *gensec_security, TALLOC_CTX *mem_ctx) { - struct cli_credentials *creds = NULL; const struct gensec_security_ops * const *backends = gensec_security_all(); + enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; + bool keep_schannel = false; if (gensec_security != NULL) { + struct cli_credentials *creds = NULL; + creds = gensec_get_credentials(gensec_security); + if (creds != NULL) { + use_kerberos = cli_credentials_get_kerberos_state(creds); + if (cli_credentials_get_netlogon_creds(creds) != NULL) { + keep_schannel = true; + } + } if (gensec_security->settings->backends) { backends = gensec_security->settings->backends; } } - return gensec_use_kerberos_mechs(mem_ctx, backends, creds); + return gensec_use_kerberos_mechs(mem_ctx, backends, + use_kerberos, keep_schannel); } -- 2.28.0 From 0579dbd6faa5a828cff42cd797f78c51316324b0 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 17:00:45 +0200 Subject: [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel for machine account auth Signed-off-by: Stefan Metzmacher Signed-off-by: Andreas Schneider (cherry picked from commit 515cffb1f20eacb041ff7b3d43f8a122a82ddfbd) --- auth/gensec/gensec_start.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c index 8d1b41fec74..3f42d611140 100644 --- a/auth/gensec/gensec_start.c +++ b/auth/gensec/gensec_start.c @@ -168,6 +168,15 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( if (cli_credentials_get_netlogon_creds(creds) != NULL) { keep_schannel = true; } + + /* + * Even if Kerberos is set to REQUIRED, keep the + * schannel auth mechanism that machine accounts are + * able to authenticate via netlogon. + */ + if (gensec_security->gensec_role == GENSEC_SERVER) { + keep_schannel = true; + } } if (gensec_security->settings->backends) { -- 2.28.0 From 0f3676f4f84184b5bf83101e0b1eca0bb05a5079 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:21 +0200 Subject: [PATCH 055/105] auth:creds: Add cli_credentials_init_server() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher (cherry picked from commit 2c00bea2aefdcc69608dffdafa7ce581d31f9354) --- auth/credentials/credentials.c | 25 +++++++++++++++++++++++++ auth/credentials/credentials.h | 2 ++ 2 files changed, 27 insertions(+) diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c index 9168b92d3ec..77c35dd104b 100644 --- a/auth/credentials/credentials.c +++ b/auth/credentials/credentials.c @@ -56,6 +56,31 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) return cred; } +_PUBLIC_ +struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx, + struct loadparm_context *lp_ctx) +{ + struct cli_credentials *server_creds = NULL; + NTSTATUS status; + + server_creds = cli_credentials_init(mem_ctx); + if (server_creds == NULL) { + return NULL; + } + + cli_credentials_set_conf(server_creds, lp_ctx); + + status = cli_credentials_set_machine_account(server_creds, lp_ctx); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, ("Failed to obtain server credentials: %s\n", + nt_errstr(status))); + TALLOC_FREE(server_creds); + return NULL; + } + + return server_creds; +} + _PUBLIC_ void cli_credentials_set_callback_data(struct cli_credentials *cred, void *callback_data) { diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h index 7d0cf53194b..438bcdce232 100644 --- a/auth/credentials/credentials.h +++ b/auth/credentials/credentials.h @@ -76,6 +76,8 @@ bool cli_credentials_set_workstation(struct cli_credentials *cred, enum credentials_obtained obtained); bool cli_credentials_is_anonymous(struct cli_credentials *cred); struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx); +struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx, + struct loadparm_context *lp_ctx); void cli_credentials_set_anonymous(struct cli_credentials *cred); bool cli_credentials_wrong_password(struct cli_credentials *cred); const char *cli_credentials_get_password(struct cli_credentials *cred); -- 2.28.0 From e1d566c2962ebd5596638df6f81fd120aaf32fcd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:36 +0200 Subject: [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() Signed-off-by: Andreas Schneider (cherry picked from commit 6c94ebf77fdb7383be2042f5e20ba2ef598cd4a4) --- source4/rpc_server/dcerpc_server.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c index 084857a44bf..e64148ef788 100644 --- a/source4/rpc_server/dcerpc_server.c +++ b/source4/rpc_server/dcerpc_server.c @@ -673,25 +673,14 @@ NTSTATUS dcesrv_gensec_prepare(TALLOC_CTX *mem_ctx, struct cli_credentials *server_creds = NULL; struct imessaging_context *imsg_ctx = dcesrv_imessaging_context(call->conn); - NTSTATUS status; - server_creds = cli_credentials_init(call->auth_state); - if (!server_creds) { + server_creds = cli_credentials_init_server(call->auth_state, + call->conn->dce_ctx->lp_ctx); + if (server_creds == NULL) { DEBUG(1, ("Failed to init server credentials\n")); return NT_STATUS_NO_MEMORY; } - cli_credentials_set_conf(server_creds, call->conn->dce_ctx->lp_ctx); - - status = cli_credentials_set_machine_account(server_creds, - call->conn->dce_ctx->lp_ctx); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(1, ("Failed to obtain server credentials: %s\n", - nt_errstr(status))); - talloc_free(server_creds); - return status; - } - return samba_server_gensec_start(mem_ctx, call->event_ctx, imsg_ctx, -- 2.28.0 From 694e1d1ca62372baba69818acf25a2eec8847115 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 7 Sep 2020 09:19:43 +0200 Subject: [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for negprot Signed-off-by: Andreas Schneider Autobuild-User(master): Stefan Metzmacher Autobuild-Date(master): Mon Sep 7 13:22:26 UTC 2020 on sn-devel-184 (cherry picked from commit 0b742ec6a0558397d5cf01b99a401f8e2bc0e2e0) --- source4/smb_server/smb/negprot.c | 28 ++++++++++++++-------------- source4/smb_server/smb2/negprot.c | 25 +++++++++++++------------ 2 files changed, 27 insertions(+), 26 deletions(-) diff --git a/source4/smb_server/smb/negprot.c b/source4/smb_server/smb/negprot.c index a6177a72019..04b69dd9883 100644 --- a/source4/smb_server/smb/negprot.c +++ b/source4/smb_server/smb/negprot.c @@ -374,22 +374,22 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice) DATA_BLOB blob = data_blob_null; const char *oid; NTSTATUS nt_status; - - server_credentials - = cli_credentials_init(req); - if (!server_credentials) { - smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n"); - return; - } - - cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx); - nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx); - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status))); + + server_credentials = + cli_credentials_init_server(req, req->smb_conn->lp_ctx); + if (server_credentials == NULL) { + DBG_DEBUG("Failed to obtain server credentials, " + "perhaps a standalone server?\n"); /* - * We keep the server_credentials as anonymous - * this is required for the spoolss.notify test + * Create anon server credentials for for the + * spoolss.notify test. */ + server_credentials = cli_credentials_init_anon(req); + if (server_credentials == NULL) { + smbsrv_terminate_connection(req->smb_conn, + "Failed to init server credentials\n"); + return; + } } nt_status = samba_server_gensec_start(req, diff --git a/source4/smb_server/smb2/negprot.c b/source4/smb_server/smb2/negprot.c index 4aaaf46793b..c433eb194bd 100644 --- a/source4/smb_server/smb2/negprot.c +++ b/source4/smb_server/smb2/negprot.c @@ -39,20 +39,21 @@ static NTSTATUS smb2srv_negprot_secblob(struct smb2srv_request *req, DATA_BLOB * NTSTATUS nt_status; struct cli_credentials *server_credentials; - server_credentials = cli_credentials_init(req); - if (!server_credentials) { - smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n"); - return NT_STATUS_NO_MEMORY; - } - - cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx); - nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx); - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status))); + server_credentials = + cli_credentials_init_server(req, req->smb_conn->lp_ctx); + if (server_credentials == NULL) { + DBG_DEBUG("Failed to obtain server credentials, " + "perhaps a standalone server?\n"); /* - * We keep the server_credentials as anonymous - * this is required for the spoolss.notify test + * Create anon server credentials for for the + * spoolss.notify test. */ + server_credentials = cli_credentials_init_anon(req); + if (server_credentials == NULL) { + smbsrv_terminate_connection(req->smb_conn, + "Failed to init server credentials\n"); + return NT_STATUS_NO_MEMORY; + } } req->smb_conn->negotiate.server_credentials = talloc_steal(req->smb_conn, server_credentials); -- 2.28.0 From c3b277172554d1d3155c3a1b4ad76685985273df Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:22 +0200 Subject: [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb encrypt' This makes it more clear what we want. 'smb encrypt' is a synonym for 'server smb encrypt'. Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit c75e8ff47b4d79b37240f9461ddae10a4f03c892) --- selftest/target/Samba3.pm | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index 0a8cefa811d..a31165b372d 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -1178,7 +1178,7 @@ sub setup_simpleserver ntlm auth = yes vfs objects = xattr_tdb streams_depot change notify = no - smb encrypt = off + server smb encrypt = off [vfs_aio_pthread] path = $prefix_abs/share @@ -1245,7 +1245,7 @@ sub setup_simpleserver [enc_desired] path = $prefix_abs/share vfs objects = - smb encrypt = desired + server smb encrypt = desired [hidenewfiles] path = $prefix_abs/share @@ -2340,7 +2340,7 @@ sub provision($$) [tmpenc] path = $shrdir comment = encrypt smb username is [%U] - smb encrypt = required + server smb encrypt = required vfs objects = dirsort [tmpguest] path = $shrdir -- 2.28.0 From 355afa22953cf8838dc83210315bc2557e764082 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 12:30:08 +0200 Subject: [PATCH 059/105] selftest: Move enc_desired to provision to have it in 'fileserver' too Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit 1b67943f938ae774360dc3db73db940f9982243b) --- selftest/target/Samba3.pm | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index a31165b372d..eda2c428793 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -1242,11 +1242,6 @@ sub setup_simpleserver hide files = /hidefile/ hide dot files = yes -[enc_desired] - path = $prefix_abs/share - vfs objects = - server smb encrypt = desired - [hidenewfiles] path = $prefix_abs/share hide new files timeout = 5 @@ -2822,7 +2817,13 @@ sub provision($$) [delete_readonly] path = $prefix_abs/share delete readonly = yes + +[enc_desired] + path = $prefix_abs/share + vfs objects = + server smb encrypt = desired "; + close(CONF); my $net = Samba::bindir_path($self, "net"); -- 2.28.0 From 2a8b98850f61219a1c97da9151e55d0e21a4265b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:20 +0200 Subject: [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit e7577ab6cbc83b496ac091c3e425c7c7fea29cdb) --- selftest/knownfail.d/smbclient-encryption | 2 + selftest/target/Samba3.pm | 5 ++ .../script/tests/test_smbclient_encryption.sh | 72 +++++++++++++++++++ source3/selftest/tests.py | 6 ++ 4 files changed, 85 insertions(+) create mode 100644 selftest/knownfail.d/smbclient-encryption create mode 100755 source3/script/tests/test_smbclient_encryption.sh diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption new file mode 100644 index 00000000000..972096bdc8b --- /dev/null +++ b/selftest/knownfail.d/smbclient-encryption @@ -0,0 +1,2 @@ +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index eda2c428793..9f86f2b59cf 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -2822,6 +2822,11 @@ sub provision($$) path = $prefix_abs/share vfs objects = server smb encrypt = desired + +[enc_off] + path = $prefix_abs/share + vfs objects = + server smb encrypt = off "; close(CONF); diff --git a/source3/script/tests/test_smbclient_encryption.sh b/source3/script/tests/test_smbclient_encryption.sh new file mode 100755 index 00000000000..9a717cdac4f --- /dev/null +++ b/source3/script/tests/test_smbclient_encryption.sh @@ -0,0 +1,72 @@ +#!/bin/sh + +if [ $# -lt 5 ]; then +cat < Date: Thu, 27 Aug 2020 15:19:27 +0200 Subject: [PATCH 061/105] s3:client: Remove global smb_encrypt Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit 1189b20cb7ea09cfed5c246cf977442a51ef72cb) --- source3/client/client.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c index 30287ffd253..e1128bf4a8c 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -98,9 +98,6 @@ static unsigned int put_total_time_ms = 0; /* totals globals */ static double dir_total; -/* encrypted state. */ -static bool smb_encrypt; - /* root cli_state connection */ struct cli_state *cli; @@ -2822,7 +2819,7 @@ static int cmd_posix_encrypt(void) d_printf("posix_encrypt failed with error %s\n", nt_errstr(status)); } else { d_printf("encryption on\n"); - smb_encrypt = true; + set_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info()); } return 0; @@ -5347,6 +5344,9 @@ int cmd_iosize(void) TALLOC_CTX *ctx = talloc_tos(); char *buf; int iosize; + bool smb_encrypt = + get_cmdline_auth_info_smb_encrypt( + popt_get_cmdline_auth_info()); if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) { @@ -5610,6 +5610,9 @@ static int process_command_string(const char *cmd_in) TALLOC_CTX *ctx = talloc_tos(); char *cmd = talloc_strdup(ctx, cmd_in); int rc = 0; + bool smb_encrypt = + get_cmdline_auth_info_smb_encrypt( + popt_get_cmdline_auth_info()); if (!cmd) { return 1; @@ -6063,6 +6066,9 @@ static int process(const char *base_directory) { int rc = 0; NTSTATUS status; + bool smb_encrypt = + get_cmdline_auth_info_smb_encrypt( + popt_get_cmdline_auth_info()); status = cli_cm_open(talloc_tos(), NULL, desthost, @@ -6101,6 +6107,9 @@ static int process(const char *base_directory) static int do_host_query(const char *query_host) { NTSTATUS status; + bool smb_encrypt = + get_cmdline_auth_info_smb_encrypt( + popt_get_cmdline_auth_info()); status = cli_cm_open(talloc_tos(), NULL, query_host, @@ -6178,6 +6187,9 @@ static int do_tar_op(const char *base_directory) { struct tar *tar_ctx = tar_get_ctx(); int ret = 0; + bool smb_encrypt = + get_cmdline_auth_info_smb_encrypt( + popt_get_cmdline_auth_info()); /* do we already have a connection? */ if (!cli) { @@ -6523,9 +6535,6 @@ int main(int argc,char *argv[]) case 'q': quiet=true; break; - case 'e': - smb_encrypt=true; - break; case 'B': return(do_smb_browse()); @@ -6595,8 +6604,6 @@ int main(int argc,char *argv[]) /* Ensure we have a password (or equivalent). */ popt_common_credentials_post(); - smb_encrypt = get_cmdline_auth_info_smb_encrypt( - popt_get_cmdline_auth_info()); max_protocol = lp_client_max_protocol(); -- 2.28.0 From 088473e47bcb30fe3b179133265da9ea6b8ec684 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:24:27 +0200 Subject: [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit a9fbc8dae878ddfa54153e91cc1128c307816b76) --- source3/client/client.c | 21 ++++----------------- source3/lib/netapi/cm.c | 1 - source3/libsmb/clidfs.c | 4 ++-- source3/libsmb/proto.h | 1 - 4 files changed, 6 insertions(+), 21 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c index e1128bf4a8c..1f18024b798 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -5610,9 +5610,6 @@ static int process_command_string(const char *cmd_in) TALLOC_CTX *ctx = talloc_tos(); char *cmd = talloc_strdup(ctx, cmd_in); int rc = 0; - bool smb_encrypt = - get_cmdline_auth_info_smb_encrypt( - popt_get_cmdline_auth_info()); if (!cmd) { return 1; @@ -5625,7 +5622,6 @@ static int process_command_string(const char *cmd_in) status = cli_cm_open(talloc_tos(), NULL, desthost, service, popt_get_cmdline_auth_info(), - smb_encrypt, max_protocol, have_ip ? &dest_ss : NULL, port, name_type, @@ -6066,14 +6062,11 @@ static int process(const char *base_directory) { int rc = 0; NTSTATUS status; - bool smb_encrypt = - get_cmdline_auth_info_smb_encrypt( - popt_get_cmdline_auth_info()); status = cli_cm_open(talloc_tos(), NULL, desthost, service, popt_get_cmdline_auth_info(), - smb_encrypt, max_protocol, + max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -6107,14 +6100,11 @@ static int process(const char *base_directory) static int do_host_query(const char *query_host) { NTSTATUS status; - bool smb_encrypt = - get_cmdline_auth_info_smb_encrypt( - popt_get_cmdline_auth_info()); status = cli_cm_open(talloc_tos(), NULL, query_host, "IPC$", popt_get_cmdline_auth_info(), - smb_encrypt, max_protocol, + max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -6161,7 +6151,7 @@ static int do_host_query(const char *query_host) status = cli_cm_open(talloc_tos(), NULL, query_host, "IPC$", popt_get_cmdline_auth_info(), - smb_encrypt, max_proto, + max_proto, have_ip ? &dest_ss : NULL, NBT_SMB_PORT, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -6187,9 +6177,6 @@ static int do_tar_op(const char *base_directory) { struct tar *tar_ctx = tar_get_ctx(); int ret = 0; - bool smb_encrypt = - get_cmdline_auth_info_smb_encrypt( - popt_get_cmdline_auth_info()); /* do we already have a connection? */ if (!cli) { @@ -6198,7 +6185,7 @@ static int do_tar_op(const char *base_directory) status = cli_cm_open(talloc_tos(), NULL, desthost, service, popt_get_cmdline_auth_info(), - smb_encrypt, max_protocol, + max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c index 1b8f2a4e97a..0fd31ef3d5a 100644 --- a/source3/lib/netapi/cm.c +++ b/source3/lib/netapi/cm.c @@ -110,7 +110,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, status = cli_cm_open(ctx, NULL, server_name, "IPC$", auth_info, - false, lp_client_ipc_max_protocol(), NULL, 0, 0x20, &cli_ipc); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index aff998f6187..4825b8f3fae 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -383,7 +383,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, const char *server, const char *share, const struct user_auth_info *auth_info, - bool force_encrypt, int max_protocol, const struct sockaddr_storage *dest_ss, int port, @@ -393,6 +392,8 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, /* Try to reuse an existing connection in this list. */ struct cli_state *c = cli_cm_find(referring_cli, server, share); NTSTATUS status; + bool force_encrypt = + get_cmdline_auth_info_smb_encrypt(auth_info); if (c) { *pcli = c; @@ -962,7 +963,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, smbXcli_conn_remote_name(rootcli->conn), "IPC$", dfs_auth_info, - cli_state_is_encryption_on(rootcli), smbXcli_conn_protocol(rootcli->conn), NULL, /* dest_ss not needed, we reuse the transport */ 0, diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h index eeabcaa7463..bb3e9e6874e 100644 --- a/source3/libsmb/proto.h +++ b/source3/libsmb/proto.h @@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, const char *server, const char *share, const struct user_auth_info *auth_info, - bool force_encrypt, int max_protocol, const struct sockaddr_storage *dest_ss, int port, -- 2.28.0 From 0291ff12056c914b3f9429a5bba48190897fe6c1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:26:39 +0200 Subject: [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit d27e237cf37fb254646d94827935d9c302c379ff) --- source3/libsmb/clidfs.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index 4825b8f3fae..b0032005398 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -287,7 +287,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, const char *server, const char *share, const struct user_auth_info *auth_info, - bool force_encrypt, int max_protocol, const struct sockaddr_storage *dest_ss, int port, @@ -296,6 +295,8 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, { struct cli_state *cli = NULL; NTSTATUS status; + bool force_encrypt = + get_cmdline_auth_info_smb_encrypt(auth_info); status = do_connect(ctx, server, share, auth_info, @@ -392,8 +393,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, /* Try to reuse an existing connection in this list. */ struct cli_state *c = cli_cm_find(referring_cli, server, share); NTSTATUS status; - bool force_encrypt = - get_cmdline_auth_info_smb_encrypt(auth_info); if (c) { *pcli = c; @@ -414,7 +413,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, server, share, auth_info, - force_encrypt, max_protocol, dest_ss, port, @@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, dfs_refs[count].server, dfs_refs[count].share, dfs_auth_info, - cli_state_is_encryption_on(rootcli), smbXcli_conn_protocol(rootcli->conn), NULL, /* dest_ss */ 0, /* port */ -- 2.28.0 From 32f7fd016ecbeb3b24ad93d593ba06e8292dd02f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:28:28 +0200 Subject: [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs do_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit 615a9a68166bdeb0ab7dbacf395c6125ec70f288) --- source3/libsmb/clidfs.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index b0032005398..5503506de97 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, const char *server, const char *share, const struct user_auth_info *auth_info, - bool force_encrypt, int max_protocol, const struct sockaddr_storage *dest_ss, int port, @@ -123,6 +122,8 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, enum protocol_types protocol = PROTOCOL_NONE; int signing_state = get_cmdline_auth_info_signing_state(auth_info); struct cli_credentials *creds = NULL; + bool force_encrypt = + get_cmdline_auth_info_smb_encrypt(auth_info); if (force_encrypt) { signing_state = SMB_SIGNING_REQUIRED; @@ -233,7 +234,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, cli_shutdown(c); return do_connect(ctx, newserver, newshare, auth_info, - force_encrypt, max_protocol, + max_protocol, NULL, port, name_type, pcli); } @@ -295,12 +296,10 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, { struct cli_state *cli = NULL; NTSTATUS status; - bool force_encrypt = - get_cmdline_auth_info_smb_encrypt(auth_info); status = do_connect(ctx, server, share, auth_info, - force_encrypt, max_protocol, + max_protocol, dest_ss, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -- 2.28.0 From 4afc92a55aa63557db2b4e2a9b0bbe5bc7d12c55 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:52:11 +0200 Subject: [PATCH 065/105] s3:libsmb: Remove force_encrypt from cli_check_msdfs_proxy() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit 4ddec1ca257fff418847c5d1e83a3fb7cb5ade1a) --- source3/libsmb/clidfs.c | 17 ++++++++++++----- source3/libsmb/libsmb_server.c | 4 ---- source3/libsmb/proto.h | 1 - 3 files changed, 12 insertions(+), 10 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index 5503506de97..736c565a7a8 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -230,7 +230,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, if (smbXcli_conn_dfs_supported(c->conn) && cli_check_msdfs_proxy(ctx, c, sharename, &newserver, &newshare, - force_encrypt, creds)) { + creds)) { cli_shutdown(c); return do_connect(ctx, newserver, newshare, auth_info, @@ -1176,7 +1176,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, const char *sharename, char **pp_newserver, char **pp_newshare, - bool force_encrypt, struct cli_credentials *creds) { struct client_dfs_referral *refs = NULL; @@ -1188,6 +1187,8 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, char *newextrapath = NULL; NTSTATUS status; const char *remote_name; + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(creds); if (!cli || !sharename) { return false; @@ -1223,11 +1224,17 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, return false; } - if (force_encrypt) { + if (encryption_state >= SMB_ENCRYPTION_DESIRED) { status = cli_cm_force_encryption_creds(cli, creds, "IPC$"); if (!NT_STATUS_IS_OK(status)) { - cli_state_restore_tcon(cli, orig_tcon); - return false; + switch (encryption_state) { + case SMB_ENCRYPTION_DESIRED: + break; + case SMB_ENCRYPTION_REQUIRED: + default: + cli_state_restore_tcon(cli, orig_tcon); + return false; + } } } diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c index eb58d7c6ac9..5a1055ba773 100644 --- a/source3/libsmb/libsmb_server.c +++ b/source3/libsmb/libsmb_server.c @@ -587,10 +587,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, if (smbXcli_conn_dfs_supported(c->conn) && cli_check_msdfs_proxy(ctx, c, share, &newserver, &newshare, - /* FIXME: cli_check_msdfs_proxy() does - not support smbc_smb_encrypt_level type */ - context->internal->smb_encryption_level ? - true : false, creds)) { cli_shutdown(c); srv = SMBC_server_internal(ctx, context, connect_if_not_found, diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h index bb3e9e6874e..f2b0a8c5ff8 100644 --- a/source3/libsmb/proto.h +++ b/source3/libsmb/proto.h @@ -161,7 +161,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, const char *sharename, char **pp_newserver, char **pp_newshare, - bool force_encrypt, struct cli_credentials *creds); /* The following definitions come from libsmb/clientgen.c */ -- 2.28.0 From 2c50d0ba7eec6d37943b7afdf426b114c9e1f292 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:15:09 +0200 Subject: [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs do_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit 276563de06f2071ec2ed9a8b73f92215ab621bba) --- selftest/knownfail.d/smbclient-encryption | 2 -- source3/libsmb/clidfs.c | 34 +++++++++++++---------- 2 files changed, 20 insertions(+), 16 deletions(-) delete mode 100644 selftest/knownfail.d/smbclient-encryption diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption deleted file mode 100644 index 972096bdc8b..00000000000 --- a/selftest/knownfail.d/smbclient-encryption +++ /dev/null @@ -1,2 +0,0 @@ -^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver -^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index 736c565a7a8..d536e0597af 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -106,7 +106,7 @@ static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, static NTSTATUS do_connect(TALLOC_CTX *ctx, const char *server, const char *share, - const struct user_auth_info *auth_info, + struct cli_credentials *creds, int max_protocol, const struct sockaddr_storage *dest_ss, int port, @@ -120,12 +120,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, NTSTATUS status; int flags = 0; enum protocol_types protocol = PROTOCOL_NONE; - int signing_state = get_cmdline_auth_info_signing_state(auth_info); - struct cli_credentials *creds = NULL; - bool force_encrypt = - get_cmdline_auth_info_smb_encrypt(auth_info); + enum smb_signing_setting signing_state = + cli_credentials_get_smb_signing(creds); + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(creds); - if (force_encrypt) { + if (encryption_state >= SMB_ENCRYPTION_DESIRED) { signing_state = SMB_SIGNING_REQUIRED; } @@ -192,13 +192,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, smb2cli_conn_set_max_credits(c->conn, DEFAULT_SMB2_MAX_CREDITS); } - creds = get_cmdline_auth_info_creds(auth_info); - status = cli_session_setup_creds(c, creds); if (!NT_STATUS_IS_OK(status)) { /* If a password was not supplied then * try again with a null username. */ - if (force_encrypt || smbXcli_conn_signing_mandatory(c->conn) || + if (encryption_state == SMB_ENCRYPTION_REQUIRED || + smbXcli_conn_signing_mandatory(c->conn) || cli_credentials_authentication_requested(creds) || cli_credentials_is_anonymous(creds) || !NT_STATUS_IS_OK(status = cli_session_setup_anon(c))) @@ -233,7 +232,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, creds)) { cli_shutdown(c); return do_connect(ctx, newserver, - newshare, auth_info, + newshare, creds, max_protocol, NULL, port, name_type, pcli); } @@ -247,13 +246,19 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, return status; } - if (force_encrypt) { + if (encryption_state >= SMB_ENCRYPTION_DESIRED) { status = cli_cm_force_encryption_creds(c, creds, sharename); if (!NT_STATUS_IS_OK(status)) { - cli_shutdown(c); - return status; + switch (encryption_state) { + case SMB_ENCRYPTION_DESIRED: + break; + case SMB_ENCRYPTION_REQUIRED: + default: + cli_shutdown(c); + return status; + } } } @@ -295,10 +300,11 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, struct cli_state **pcli) { struct cli_state *cli = NULL; + struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); NTSTATUS status; status = do_connect(ctx, server, share, - auth_info, + creds, max_protocol, dest_ss, port, name_type, &cli); -- 2.28.0 From 608c0b87761f75e539b2e1e7599ceb981770b647 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:18:16 +0200 Subject: [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit c8349111243fec81a2b95484e56a6d6bebaba80e) --- source3/libsmb/clidfs.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index d536e0597af..a2c6f5fe5ec 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -292,7 +292,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, struct cli_state *referring_cli, const char *server, const char *share, - const struct user_auth_info *auth_info, + struct cli_credentials *creds, int max_protocol, const struct sockaddr_storage *dest_ss, int port, @@ -300,7 +300,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, struct cli_state **pcli) { struct cli_state *cli = NULL; - struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); NTSTATUS status; status = do_connect(ctx, server, share, @@ -397,6 +396,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, { /* Try to reuse an existing connection in this list. */ struct cli_state *c = cli_cm_find(referring_cli, server, share); + struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); NTSTATUS status; if (c) { @@ -417,7 +417,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, referring_cli, server, share, - auth_info, + creds, max_protocol, dest_ss, port, @@ -886,6 +886,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, struct smbXcli_tcon *root_tcon = NULL; struct smbXcli_tcon *target_tcon = NULL; struct cli_dfs_path_split *dfs_refs = NULL; + struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info); if ( !rootcli || !path || !targetcli ) { return NT_STATUS_INVALID_PARAMETER; @@ -1022,7 +1023,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, status = cli_cm_connect(ctx, rootcli, dfs_refs[count].server, dfs_refs[count].share, - dfs_auth_info, + creds, smbXcli_conn_protocol(rootcli->conn), NULL, /* dest_ss */ 0, /* port */ -- 2.28.0 From d6d5da0e28c3879280e1139f51bfe2ef03bc450e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:26:54 +0200 Subject: [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit df1623abd7267916696e2e60c146ef8fa6c9dfc9) --- source3/client/client.c | 23 ++++++++++++++++++----- source3/lib/netapi/cm.c | 4 +++- source3/libsmb/clidfs.c | 25 ++++++++++++------------- source3/libsmb/proto.h | 18 +++++++++--------- 4 files changed, 42 insertions(+), 28 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c index 1f18024b798..35bc3a7c5c3 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -5610,6 +5610,8 @@ static int process_command_string(const char *cmd_in) TALLOC_CTX *ctx = talloc_tos(); char *cmd = talloc_strdup(ctx, cmd_in); int rc = 0; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); if (!cmd) { return 1; @@ -5621,7 +5623,8 @@ static int process_command_string(const char *cmd_in) status = cli_cm_open(talloc_tos(), NULL, desthost, - service, popt_get_cmdline_auth_info(), + service, + creds, max_protocol, have_ip ? &dest_ss : NULL, port, name_type, @@ -6062,10 +6065,13 @@ static int process(const char *base_directory) { int rc = 0; NTSTATUS status; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); status = cli_cm_open(talloc_tos(), NULL, desthost, - service, popt_get_cmdline_auth_info(), + service, + creds, max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); @@ -6100,10 +6106,13 @@ static int process(const char *base_directory) static int do_host_query(const char *query_host) { NTSTATUS status; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); status = cli_cm_open(talloc_tos(), NULL, query_host, - "IPC$", popt_get_cmdline_auth_info(), + "IPC$", + creds, max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); @@ -6150,7 +6159,8 @@ static int do_host_query(const char *query_host) d_printf("Reconnecting with SMB1 for workgroup listing.\n"); status = cli_cm_open(talloc_tos(), NULL, query_host, - "IPC$", popt_get_cmdline_auth_info(), + "IPC$", + creds, max_proto, have_ip ? &dest_ss : NULL, NBT_SMB_PORT, name_type, &cli); @@ -6177,6 +6187,8 @@ static int do_tar_op(const char *base_directory) { struct tar *tar_ctx = tar_get_ctx(); int ret = 0; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); /* do we already have a connection? */ if (!cli) { @@ -6184,7 +6196,8 @@ static int do_tar_op(const char *base_directory) status = cli_cm_open(talloc_tos(), NULL, desthost, - service, popt_get_cmdline_auth_info(), + service, + creds, max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c index 0fd31ef3d5a..943f7498e8c 100644 --- a/source3/lib/netapi/cm.c +++ b/source3/lib/netapi/cm.c @@ -71,6 +71,7 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, struct cli_state *cli_ipc = NULL; struct client_ipc_connection *p; NTSTATUS status; + struct cli_credentials *creds = NULL; if (!ctx || !pp || !server_name) { return WERR_INVALID_PARAMETER; @@ -106,10 +107,11 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, if (ctx->use_ccache) { set_cmdline_auth_info_use_ccache(auth_info, true); } + creds = get_cmdline_auth_info_creds(auth_info); status = cli_cm_open(ctx, NULL, server_name, "IPC$", - auth_info, + creds, lp_client_ipc_max_protocol(), NULL, 0, 0x20, &cli_ipc); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index a2c6f5fe5ec..ef75fb36a45 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -384,19 +384,18 @@ static struct cli_state *cli_cm_find(struct cli_state *cli, ****************************************************************************/ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - struct cli_state *referring_cli, - const char *server, - const char *share, - const struct user_auth_info *auth_info, - int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, - int name_type, - struct cli_state **pcli) + struct cli_state *referring_cli, + const char *server, + const char *share, + struct cli_credentials *creds, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, + struct cli_state **pcli) { /* Try to reuse an existing connection in this list. */ struct cli_state *c = cli_cm_find(referring_cli, server, share); - struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); NTSTATUS status; if (c) { @@ -404,11 +403,11 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, return NT_STATUS_OK; } - if (auth_info == NULL) { + if (creds == NULL) { /* Can't do a new connection * without auth info. */ d_printf("cli_cm_open() Unable to open connection [\\%s\\%s] " - "without auth info\n", + "without client credentials\n", server, share ); return NT_STATUS_INVALID_PARAMETER; } @@ -966,7 +965,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, rootcli, smbXcli_conn_remote_name(rootcli->conn), "IPC$", - dfs_auth_info, + creds, smbXcli_conn_protocol(rootcli->conn), NULL, /* dest_ss not needed, we reuse the transport */ 0, diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h index f2b0a8c5ff8..0b8cf2a6036 100644 --- a/source3/libsmb/proto.h +++ b/source3/libsmb/proto.h @@ -124,15 +124,15 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx, /* The following definitions come from libsmb/clidfs.c */ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - struct cli_state *referring_cli, - const char *server, - const char *share, - const struct user_auth_info *auth_info, - int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, - int name_type, - struct cli_state **pcli); + struct cli_state *referring_cli, + const char *server, + const char *share, + struct cli_credentials *creds, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, + struct cli_state **pcli); void cli_cm_display(struct cli_state *c); struct client_dfs_referral; NTSTATUS cli_dfs_get_referral_ex(TALLOC_CTX *ctx, -- 2.28.0 From 1c07abb4b9690b62b2ae7841134d7a71e4771bb9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:42:25 +0200 Subject: [PATCH 069/105] s3:libsmb: Pass cli_credentials to cli_resolve_path(), using helper variables. Signed-off-by: Andreas Schneider Signed-off-by: Jeremy Allison (cherry picked from commit 5245ab3c4dacc88d5cbe3bb1e3e339e4fb77a4db) --- source3/client/client.c | 148 +++++++++++++++++++++++++++------- source3/libsmb/clidfs.c | 5 +- source3/libsmb/libsmb_dir.c | 43 ++++++++-- source3/libsmb/libsmb_file.c | 13 ++- source3/libsmb/libsmb_stat.c | 6 +- source3/libsmb/libsmb_xattr.c | 13 ++- source3/libsmb/proto.h | 2 +- source3/utils/smbcacls.c | 5 +- 8 files changed, 188 insertions(+), 47 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c index 35bc3a7c5c3..23de5befee3 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -300,9 +300,14 @@ static int do_dskattr(void) struct cli_state *targetcli = NULL; char *targetpath = NULL; TALLOC_CTX *ctx = talloc_tos(); + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli, + status = cli_resolve_path(ctx, + "", + creds, + cli, client_get_cur_dir(), &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { @@ -392,6 +397,8 @@ static int do_cd(const char *new_dir) uint32_t attributes; int ret = 1; TALLOC_CTX *ctx = talloc_stackframe(); + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; newdir = talloc_strdup(ctx, new_dir); @@ -434,7 +441,8 @@ static int do_cd(const char *new_dir) new_cd = client_clean_name(ctx, new_cd); client_set_cur_dir(new_cd); - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, new_cd, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("cd %s: %s\n", new_cd, nt_errstr(status)); @@ -811,6 +819,8 @@ NTSTATUS do_list(const char *mask, TALLOC_CTX *ctx = talloc_tos(); struct cli_state *targetcli = NULL; char *targetpath = NULL; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS ret_status = NT_STATUS_OK; NTSTATUS status = NT_STATUS_OK; @@ -834,7 +844,7 @@ NTSTATUS do_list(const char *mask, /* check for dfs */ status = cli_resolve_path(ctx, "", - popt_get_cmdline_auth_info(), + creds, cli, head, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("do_list: [%s] %s\n", head, @@ -1044,6 +1054,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) struct cli_state *targetcli = NULL; char *targetname = NULL; char *lname = NULL; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; lname = talloc_strdup(ctx, lname_in); @@ -1058,7 +1070,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) } } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, rname, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); @@ -1477,9 +1490,12 @@ static bool do_mkdir(const char *name) TALLOC_CTX *ctx = talloc_tos(); struct cli_state *targetcli; char *targetname = NULL; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, name, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("mkdir %s: %s\n", name, nt_errstr(status)); @@ -1538,6 +1554,8 @@ static int cmd_mkdir(void) TALLOC_CTX *ctx = talloc_tos(); char *mask = NULL; char *buf = NULL; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; mask = talloc_strdup(ctx, client_get_cur_dir()); @@ -1574,7 +1592,8 @@ static int cmd_mkdir(void) } status = cli_resolve_path(ctx, "", - popt_get_cmdline_auth_info(), cli, mask, + creds, + cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { return 1; @@ -1888,9 +1907,12 @@ static int do_put(const char *rname, const char *lname, bool reput) struct cli_state *targetcli; char *targetname = NULL; struct push_state state; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, rname, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); @@ -2665,6 +2687,8 @@ static int cmd_wdel(void) uint32_t attribute; struct cli_state *targetcli; char *targetname = NULL; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { @@ -2690,7 +2714,8 @@ static int cmd_wdel(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("cmd_wdel %s: %s\n", mask, nt_errstr(status)); @@ -2716,6 +2741,8 @@ static int cmd_open(void) char *targetname = NULL; struct cli_state *targetcli; uint16_t fnum = (uint16_t)-1; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { @@ -2735,7 +2762,8 @@ static int cmd_open(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("open %s: %s\n", mask, nt_errstr(status)); @@ -2837,6 +2865,8 @@ static int cmd_posix_open(void) struct cli_state *targetcli; mode_t mode; uint16_t fnum; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { @@ -2861,7 +2891,8 @@ static int cmd_posix_open(void) } mode = (mode_t)strtol(buf, (char **)NULL, 8); - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_open %s: %s\n", mask, nt_errstr(status)); @@ -2896,6 +2927,8 @@ static int cmd_posix_mkdir(void) char *targetname = NULL; struct cli_state *targetcli; mode_t mode; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { @@ -2920,7 +2953,8 @@ static int cmd_posix_mkdir(void) } mode = (mode_t)strtol(buf, (char **)NULL, 8); - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_mkdir %s: %s\n", mask, nt_errstr(status)); @@ -2944,6 +2978,8 @@ static int cmd_posix_unlink(void) char *buf = NULL; char *targetname = NULL; struct cli_state *targetcli; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { @@ -2962,7 +2998,8 @@ static int cmd_posix_unlink(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_unlink %s: %s\n", mask, nt_errstr(status)); @@ -2987,6 +3024,8 @@ static int cmd_posix_rmdir(void) char *buf = NULL; char *targetname = NULL; struct cli_state *targetcli; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { @@ -3005,7 +3044,8 @@ static int cmd_posix_rmdir(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_rmdir %s: %s\n", mask, nt_errstr(status)); @@ -3294,6 +3334,8 @@ static int cmd_rmdir(void) char *buf = NULL; char *targetname = NULL; struct cli_state *targetcli; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { @@ -3312,7 +3354,8 @@ static int cmd_rmdir(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("rmdir %s: %s\n", mask, nt_errstr(status)); @@ -3341,6 +3384,8 @@ static int cmd_link(void) char *buf2 = NULL; char *targetname = NULL; struct cli_state *targetcli; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || @@ -3371,7 +3416,8 @@ static int cmd_link(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, oldname, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("link %s: %s\n", oldname, nt_errstr(status)); @@ -3404,6 +3450,8 @@ static int cmd_readlink(void) char *targetname = NULL; char *linkname = NULL; struct cli_state *targetcli; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { @@ -3422,7 +3470,8 @@ static int cmd_readlink(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, name, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("readlink %s: %s\n", name, nt_errstr(status)); @@ -3461,6 +3510,8 @@ static int cmd_symlink(void) char *buf = NULL; char *buf2 = NULL; struct cli_state *newcli; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || @@ -3483,7 +3534,8 @@ static int cmd_symlink(void) } /* New name must be present in share namespace. */ status = cli_resolve_path(ctx, "", - popt_get_cmdline_auth_info(), cli, newname, + creds, + cli, newname, &newcli, &newname); if (!NT_STATUS_IS_OK(status)) { d_printf("link %s: %s\n", newname, @@ -3519,6 +3571,8 @@ static int cmd_chmod(void) char *targetname = NULL; struct cli_state *targetcli; mode_t mode; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || @@ -3540,7 +3594,8 @@ static int cmd_chmod(void) mode = (mode_t)strtol(buf, NULL, 8); - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("chmod %s: %s\n", src, nt_errstr(status)); @@ -3684,6 +3739,8 @@ static int cmd_getfacl(void) size_t num_dir_acls = 0; size_t expected_buflen; uint16_t i; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { @@ -3702,7 +3759,8 @@ static int cmd_getfacl(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); @@ -3867,6 +3925,8 @@ static int cmd_geteas(void) NTSTATUS status; size_t i, num_eas; struct ea_struct *eas; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { d_printf("geteas filename\n"); @@ -3884,7 +3944,8 @@ static int cmd_geteas(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); @@ -3923,6 +3984,8 @@ static int cmd_setea(void) char *eavalue = NULL; char *targetname = NULL; struct cli_state *targetcli; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr, &name, NULL) @@ -3945,7 +4008,8 @@ static int cmd_setea(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); @@ -3977,6 +4041,8 @@ static int cmd_stat(void) SMB_STRUCT_STAT sbuf; struct tm *lt; time_t tmp_time; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { @@ -3995,7 +4061,8 @@ static int cmd_stat(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); @@ -4084,6 +4151,8 @@ static int cmd_chown(void) char *buf, *buf2, *buf3; struct cli_state *targetcli; char *targetname = NULL; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || @@ -4107,7 +4176,8 @@ static int cmd_chown(void) if (src == NULL) { return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("chown %s: %s\n", src, nt_errstr(status)); @@ -4141,6 +4211,8 @@ static int cmd_rename(void) struct cli_state *targetcli; char *targetsrc; char *targetdest; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; bool replace = false; @@ -4179,14 +4251,16 @@ static int cmd_rename(void) replace = true; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, src, &targetcli, &targetsrc); if (!NT_STATUS_IS_OK(status)) { d_printf("rename %s: %s\n", src, nt_errstr(status)); return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, dest, &targetcli, &targetdest); if (!NT_STATUS_IS_OK(status)) { d_printf("rename %s: %s\n", dest, nt_errstr(status)); @@ -4243,6 +4317,8 @@ static int cmd_scopy(void) off_t written = 0; struct scopy_timing st; int rc = 0; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || @@ -4275,14 +4351,16 @@ static int cmd_scopy(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, src, &targetcli, &targetsrc); if (!NT_STATUS_IS_OK(status)) { d_printf("scopy %s: %s\n", src, nt_errstr(status)); return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, dest, &targetcli, &targetdest); if (!NT_STATUS_IS_OK(status)) { d_printf("scopy %s: %s\n", dest, nt_errstr(status)); @@ -4381,6 +4459,8 @@ static int cmd_hardlink(void) char *buf, *buf2; struct cli_state *targetcli; char *targetname; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || @@ -4413,7 +4493,8 @@ static int cmd_hardlink(void) return 1; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("hardlink %s: %s\n", src, nt_errstr(status)); @@ -5087,9 +5168,13 @@ static int cmd_show_connect( void ) TALLOC_CTX *ctx = talloc_tos(); struct cli_state *targetcli; char *targetpath; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli, + status = cli_resolve_path(ctx, "", + creds, + cli, client_get_cur_dir(), &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { @@ -5749,6 +5834,8 @@ static char **remote_completion(const char *text, int len) struct cli_state *targetcli = NULL; int i; struct completion_remote info = { NULL, NULL, 1, 0, NULL, 0 }; + struct cli_credentials *creds = + get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); NTSTATUS status; /* can't have non-static initialisation on Sun CC, so do it @@ -5809,7 +5896,8 @@ static char **remote_completion(const char *text, int len) goto cleanup; } - status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), + status = cli_resolve_path(ctx, "", + creds, cli, dirmask, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { goto cleanup; diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index ef75fb36a45..e6695159a96 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -859,7 +859,7 @@ struct cli_dfs_path_split { NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, const char *mountpt, - const struct user_auth_info *dfs_auth_info, + struct cli_credentials *creds, struct cli_state *rootcli, const char *path, struct cli_state **targetcli, @@ -885,7 +885,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, struct smbXcli_tcon *root_tcon = NULL; struct smbXcli_tcon *target_tcon = NULL; struct cli_dfs_path_split *dfs_refs = NULL; - struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info); if ( !rootcli || !path || !targetcli ) { return NT_STATUS_INVALID_PARAMETER; @@ -1130,7 +1129,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, if (!strequal(*pp_targetpath, "\\") && !strequal(*pp_targetpath, "/")) { status = cli_resolve_path(ctx, newmount, - dfs_auth_info, + creds, *targetcli, *pp_targetpath, &newcli, diff --git a/source3/libsmb/libsmb_dir.c b/source3/libsmb/libsmb_dir.c index 12abb734c2d..0326f27125b 100644 --- a/source3/libsmb/libsmb_dir.c +++ b/source3/libsmb/libsmb_dir.c @@ -911,6 +911,7 @@ SMBC_opendir_ctx(SMBCCTX *context, */ char *targetpath; struct cli_state *targetcli; + struct cli_credentials *creds = NULL; NTSTATUS status; /* We connect to the server and list the directory */ @@ -943,8 +944,12 @@ SMBC_opendir_ctx(SMBCCTX *context, return NULL; } + creds = get_cmdline_auth_info_creds( + context->internal->auth_info); + status = cli_resolve_path( - frame, "", context->internal->auth_info, + frame, "", + creds, srv->cli, path, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("Could not resolve %s\n", path); @@ -1543,6 +1548,7 @@ SMBC_mkdir_ctx(SMBCCTX *context, char *targetpath = NULL; uint16_t port = 0; struct cli_state *targetcli = NULL; + struct cli_credentials *creds = NULL; TALLOC_CTX *frame = talloc_stackframe(); NTSTATUS status; @@ -1595,8 +1601,11 @@ SMBC_mkdir_ctx(SMBCCTX *context, } + creds = get_cmdline_auth_info_creds(context->internal->auth_info); + /*d_printf(">>>mkdir: resolving %s\n", path);*/ - status = cli_resolve_path(frame, "", context->internal->auth_info, + status = cli_resolve_path(frame, "", + creds, srv->cli, path, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("Could not resolve %s\n", path); @@ -1654,6 +1663,7 @@ SMBC_rmdir_ctx(SMBCCTX *context, char *targetpath = NULL; uint16_t port = 0; struct cli_state *targetcli = NULL; + struct cli_credentials *creds = NULL; TALLOC_CTX *frame = talloc_stackframe(); NTSTATUS status; @@ -1706,8 +1716,11 @@ SMBC_rmdir_ctx(SMBCCTX *context, } + creds = get_cmdline_auth_info_creds(context->internal->auth_info), + /*d_printf(">>>rmdir: resolving %s\n", path);*/ - status = cli_resolve_path(frame, "", context->internal->auth_info, + status = cli_resolve_path(frame, "", + creds, srv->cli, path, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("Could not resolve %s\n", path); @@ -1959,6 +1972,7 @@ SMBC_chmod_ctx(SMBCCTX *context, char *path = NULL; uint32_t attr; uint16_t port = 0; + struct cli_credentials *creds = NULL; TALLOC_CTX *frame = talloc_stackframe(); NTSTATUS status; @@ -2010,8 +2024,11 @@ SMBC_chmod_ctx(SMBCCTX *context, return -1; /* errno set by SMBC_server */ } + creds = get_cmdline_auth_info_creds(context->internal->auth_info); + /*d_printf(">>>unlink: resolving %s\n", path);*/ - status = cli_resolve_path(frame, "", context->internal->auth_info, + status = cli_resolve_path(frame, "", + creds, srv->cli, path, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("Could not resolve %s\n", path); @@ -2152,6 +2169,7 @@ SMBC_unlink_ctx(SMBCCTX *context, uint16_t port = 0; struct cli_state *targetcli = NULL; SMBCSRV *srv = NULL; + struct cli_credentials *creds = NULL; TALLOC_CTX *frame = talloc_stackframe(); NTSTATUS status; @@ -2204,8 +2222,11 @@ SMBC_unlink_ctx(SMBCCTX *context, } + creds = get_cmdline_auth_info_creds(context->internal->auth_info); + /*d_printf(">>>unlink: resolving %s\n", path);*/ - status = cli_resolve_path(frame, "", context->internal->auth_info, + status = cli_resolve_path(frame, "", + creds, srv->cli, path, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("Could not resolve %s\n", path); @@ -2282,6 +2303,8 @@ SMBC_rename_ctx(SMBCCTX *ocontext, SMBCSRV *srv = NULL; uint16_t port1 = 0; uint16_t port2 = 0; + struct cli_credentials *ocreds = NULL; + struct cli_credentials *ncreds = NULL; TALLOC_CTX *frame = talloc_stackframe(); NTSTATUS status; @@ -2375,7 +2398,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext, password1); /*d_printf(">>>rename: resolving %s\n", path1);*/ - status = cli_resolve_path(frame, "", ocontext->internal->auth_info, + ocreds = get_cmdline_auth_info_creds(ocontext->internal->auth_info); + + status = cli_resolve_path(frame, "", + ocreds, srv->cli, path1, &targetcli1, &targetpath1); if (!NT_STATUS_IS_OK(status)) { d_printf("Could not resolve %s\n", path1); @@ -2392,7 +2418,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext, /*d_printf(">>>rename: resolved path as %s\n", targetpath1);*/ /*d_printf(">>>rename: resolving %s\n", path2);*/ - status = cli_resolve_path(frame, "", ncontext->internal->auth_info, + ncreds = get_cmdline_auth_info_creds(ncontext->internal->auth_info); + + status = cli_resolve_path(frame, "", + ncreds, srv->cli, path2, &targetcli2, &targetpath2); if (!NT_STATUS_IS_OK(status)) { d_printf("Could not resolve %s\n", path2); diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c index 0791df36690..a44925e0e0e 100644 --- a/source3/libsmb/libsmb_file.c +++ b/source3/libsmb/libsmb_file.c @@ -103,6 +103,8 @@ SMBC_open_ctx(SMBCCTX *context, if (strlen(path) > 0 && path[strlen(path) - 1] == '\\') { status = NT_STATUS_OBJECT_PATH_INVALID; } else { + struct cli_credentials *creds = NULL; + file = SMB_MALLOC_P(SMBCFILE); if (!file) { errno = ENOMEM; @@ -112,9 +114,12 @@ SMBC_open_ctx(SMBCCTX *context, ZERO_STRUCTP(file); + creds = get_cmdline_auth_info_creds( + context->internal->auth_info); /*d_printf(">>>open: resolving %s\n", path);*/ status = cli_resolve_path( - frame, "", context->internal->auth_info, + frame, "", + creds, srv->cli, path, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("Could not resolve %s\n", path); @@ -461,6 +466,7 @@ SMBC_getatr(SMBCCTX * context, struct timespec change_time_ts = {0}; time_t write_time = 0; SMB_INO_T ino = 0; + struct cli_credentials *creds = NULL; TALLOC_CTX *frame = talloc_stackframe(); NTSTATUS status; @@ -490,7 +496,10 @@ SMBC_getatr(SMBCCTX * context, } DEBUG(4,("SMBC_getatr: sending qpathinfo\n")); - status = cli_resolve_path(frame, "", context->internal->auth_info, + creds = get_cmdline_auth_info_creds(context->internal->auth_info); + + status = cli_resolve_path(frame, "", + creds, srv->cli, fixedpath, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/libsmb_stat.c b/source3/libsmb/libsmb_stat.c index 790934bd565..1260928d0ff 100644 --- a/source3/libsmb/libsmb_stat.c +++ b/source3/libsmb/libsmb_stat.c @@ -242,6 +242,7 @@ SMBC_fstat_ctx(SMBCCTX *context, struct cli_state *targetcli = NULL; SMB_INO_T ino = 0; uint16_t port = 0; + struct cli_credentials *creds = NULL; TALLOC_CTX *frame = talloc_stackframe(); NTSTATUS status; @@ -279,8 +280,11 @@ SMBC_fstat_ctx(SMBCCTX *context, return -1; } + creds = get_cmdline_auth_info_creds(context->internal->auth_info); + /*d_printf(">>>fstat: resolving %s\n", path);*/ - status = cli_resolve_path(frame, "", context->internal->auth_info, + status = cli_resolve_path(frame, "", + creds, file->srv->cli, path, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/libsmb/libsmb_xattr.c b/source3/libsmb/libsmb_xattr.c index d1b6548eb90..8b74d0a39e3 100644 --- a/source3/libsmb/libsmb_xattr.c +++ b/source3/libsmb/libsmb_xattr.c @@ -860,13 +860,18 @@ cacl_get(SMBCCTX *context, if (ipc_cli && (all || some_nt || all_nt_acls)) { char *targetpath = NULL; struct cli_state *targetcli = NULL; + struct cli_credentials *creds = NULL; NTSTATUS status; /* Point to the portion after "system.nt_sec_desc." */ name += 19; /* if (all) this will be invalid but unused */ + creds = get_cmdline_auth_info_creds( + context->internal->auth_info); + status = cli_resolve_path( - ctx, "", context->internal->auth_info, + ctx, "", + creds, cli, filename, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { DEBUG(5, ("cacl_get Could not resolve %s\n", @@ -1511,6 +1516,7 @@ cacl_set(SMBCCTX *context, bool numeric = True; char *targetpath = NULL; struct cli_state *targetcli = NULL; + struct cli_credentials *creds = NULL; NTSTATUS status; /* the_acl will be null for REMOVE_ALL operations */ @@ -1540,7 +1546,10 @@ cacl_set(SMBCCTX *context, return -1; } - status = cli_resolve_path(ctx, "", context->internal->auth_info, + creds = get_cmdline_auth_info_creds(context->internal->auth_info); + + status = cli_resolve_path(ctx, "", + creds, cli, filename, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { DEBUG(5,("cacl_set: Could not resolve %s\n", filename)); diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h index 0b8cf2a6036..517738dbcd7 100644 --- a/source3/libsmb/proto.h +++ b/source3/libsmb/proto.h @@ -150,7 +150,7 @@ NTSTATUS cli_dfs_get_referral(TALLOC_CTX *ctx, size_t *consumed); NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, const char *mountpt, - const struct user_auth_info *dfs_auth_info, + struct cli_credentials *creds, struct cli_state *rootcli, const char *path, struct cli_state **targetcli, diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c index 8fd9fcc5780..4989ec633c3 100644 --- a/source3/utils/smbcacls.c +++ b/source3/utils/smbcacls.c @@ -806,6 +806,7 @@ int main(int argc, char *argv[]) than going via LSA calls to resolve them */ int numeric = 0; struct cli_state *targetcli = NULL; + struct cli_credentials *creds = NULL; char *targetfile = NULL; NTSTATUS status; @@ -1069,9 +1070,11 @@ int main(int argc, char *argv[]) } } + creds = get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()), + status = cli_resolve_path(frame, "", - popt_get_cmdline_auth_info(), + creds, cli, filename, &targetcli, -- 2.28.0 From 100dad122572d927889f4c03b19f169a3bf61df4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:40:49 +0200 Subject: [PATCH 070/105] s3:client: Remove global max_protocol Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit d07f28645f37c1f976017d5b89864791a18d1943) --- source3/client/client.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c index 23de5befee3..329463795e0 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -61,7 +61,6 @@ static int io_bufsize = 0; /* we use the default size */ static int io_timeout = (CLIENT_TIMEOUT/1000); /* Per operation timeout (in seconds). */ static int name_type = 0x20; -static int max_protocol = -1; static int process_tok(char *tok); static int cmd_help(void); @@ -5710,7 +5709,7 @@ static int process_command_string(const char *cmd_in) desthost, service, creds, - max_protocol, + lp_client_max_protocol(), have_ip ? &dest_ss : NULL, port, name_type, &cli); @@ -6160,7 +6159,7 @@ static int process(const char *base_directory) desthost, service, creds, - max_protocol, + lp_client_max_protocol(), have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -6201,7 +6200,7 @@ static int do_host_query(const char *query_host) query_host, "IPC$", creds, - max_protocol, + lp_client_max_protocol(), have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -6236,7 +6235,7 @@ static int do_host_query(const char *query_host) if (port != NBT_SMB_PORT || smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) { - int max_proto = MIN(max_protocol, PROTOCOL_NT1); + int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1); /* * Workgroups simply don't make sense over anything @@ -6286,7 +6285,7 @@ static int do_tar_op(const char *base_directory) desthost, service, creds, - max_protocol, + lp_client_max_protocol(), have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -6693,8 +6692,6 @@ int main(int argc,char *argv[]) /* Ensure we have a password (or equivalent). */ popt_common_credentials_post(); - max_protocol = lp_client_max_protocol(); - if (tar_to_process(tar_ctx)) { if (cmdstr) process_command_string(cmdstr); -- 2.28.0 From fecf06bd00bc8ff23634bded86d649e432431957 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:43:46 +0200 Subject: [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit 4aac9daf095e7c2de6a27697a13385ee87a4b634) --- source3/client/client.c | 7 ------- source3/lib/netapi/cm.c | 1 - source3/libsmb/clidfs.c | 4 +--- source3/libsmb/proto.h | 1 - 4 files changed, 1 insertion(+), 12 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c index 329463795e0..e9e6cb1ac2c 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -5709,7 +5709,6 @@ static int process_command_string(const char *cmd_in) desthost, service, creds, - lp_client_max_protocol(), have_ip ? &dest_ss : NULL, port, name_type, &cli); @@ -6159,7 +6158,6 @@ static int process(const char *base_directory) desthost, service, creds, - lp_client_max_protocol(), have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -6200,7 +6198,6 @@ static int do_host_query(const char *query_host) query_host, "IPC$", creds, - lp_client_max_protocol(), have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -6235,8 +6232,6 @@ static int do_host_query(const char *query_host) if (port != NBT_SMB_PORT || smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) { - int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1); - /* * Workgroups simply don't make sense over anything * else but port 139 and SMB1. @@ -6248,7 +6243,6 @@ static int do_host_query(const char *query_host) query_host, "IPC$", creds, - max_proto, have_ip ? &dest_ss : NULL, NBT_SMB_PORT, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -6285,7 +6279,6 @@ static int do_tar_op(const char *base_directory) desthost, service, creds, - lp_client_max_protocol(), have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c index 943f7498e8c..3f4e188b396 100644 --- a/source3/lib/netapi/cm.c +++ b/source3/lib/netapi/cm.c @@ -112,7 +112,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, status = cli_cm_open(ctx, NULL, server_name, "IPC$", creds, - lp_client_ipc_max_protocol(), NULL, 0, 0x20, &cli_ipc); if (!NT_STATUS_IS_OK(status)) { cli_ipc = NULL; diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index e6695159a96..fb1a0c72e6d 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -388,7 +388,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, const char *server, const char *share, struct cli_credentials *creds, - int max_protocol, const struct sockaddr_storage *dest_ss, int port, int name_type, @@ -417,7 +416,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, server, share, creds, - max_protocol, + lp_client_max_protocol(), dest_ss, port, name_type, @@ -965,7 +964,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, smbXcli_conn_remote_name(rootcli->conn), "IPC$", creds, - smbXcli_conn_protocol(rootcli->conn), NULL, /* dest_ss not needed, we reuse the transport */ 0, 0x20, diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h index 517738dbcd7..8aaaff2cb1e 100644 --- a/source3/libsmb/proto.h +++ b/source3/libsmb/proto.h @@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, const char *server, const char *share, struct cli_credentials *creds, - int max_protocol, const struct sockaddr_storage *dest_ss, int port, int name_type, -- 2.28.0 From 2af136fd7c1ecae9cc06bc2cf26a7feac16cb279 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:45:12 +0200 Subject: [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit 2159582610ecc932047b85a77ec321b3d3ac806f) --- source3/libsmb/clidfs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index fb1a0c72e6d..023dd4d2757 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -293,7 +293,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, const char *server, const char *share, struct cli_credentials *creds, - int max_protocol, const struct sockaddr_storage *dest_ss, int port, int name_type, @@ -304,7 +303,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, status = do_connect(ctx, server, share, creds, - max_protocol, + lp_client_max_protocol(), dest_ss, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { @@ -416,7 +415,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, server, share, creds, - lp_client_max_protocol(), dest_ss, port, name_type, @@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, dfs_refs[count].server, dfs_refs[count].share, creds, - smbXcli_conn_protocol(rootcli->conn), NULL, /* dest_ss */ 0, /* port */ 0x20, -- 2.28.0 From dc8cfd9551afa10b0610c6663cb28bfb1ec5888a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:46:29 +0200 Subject: [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs do_connect() The if check for max_protocol == 0 is part of lp_client_max_protocol(). Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit 50b59b4c28bc816094a4ca97f64450860e2495b2) --- source3/libsmb/clidfs.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c index 023dd4d2757..ee5becf76a6 100644 --- a/source3/libsmb/clidfs.c +++ b/source3/libsmb/clidfs.c @@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, const char *server, const char *share, struct cli_credentials *creds, - int max_protocol, const struct sockaddr_storage *dest_ss, int port, int name_type, @@ -167,14 +166,11 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, return status; } - if (max_protocol == 0) { - max_protocol = PROTOCOL_LATEST; - } DEBUG(4,(" session request ok\n")); status = smbXcli_negprot(c->conn, c->timeout, lp_client_min_protocol(), - max_protocol); + lp_client_max_protocol()); if (!NT_STATUS_IS_OK(status)) { d_printf("protocol negotiation failed: %s\n", @@ -233,7 +229,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, cli_shutdown(c); return do_connect(ctx, newserver, newshare, creds, - max_protocol, NULL, port, name_type, pcli); } @@ -303,7 +298,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, status = do_connect(ctx, server, share, creds, - lp_client_max_protocol(), dest_ss, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -- 2.28.0 From 3a99225868e079e108968552f43b937b5b9b702f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Aug 2020 15:47:35 +0200 Subject: [PATCH 074/105] s3:include: Move loadparm prototypes to own header file Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison (cherry picked from commit d4d8218b9618dd289f54b41f13d7015f1b3994fd) --- source3/include/includes.h | 3 + source3/include/proto.h | 167 ------------------------------- source3/param/loadparm.h | 200 +++++++++++++++++++++++++++++++++++++ 3 files changed, 203 insertions(+), 167 deletions(-) create mode 100644 source3/param/loadparm.h diff --git a/source3/include/includes.h b/source3/include/includes.h index 8fa65cc3122..c94f919ed59 100644 --- a/source3/include/includes.h +++ b/source3/include/includes.h @@ -293,6 +293,9 @@ typedef char fstring[FSTRING_LEN]; #endif #include "lib/param/loadparm.h" +#include "source3/param/loadparm.h" +/* Automatically generated by generate_param.py. */ +#include "source3/param/param_proto.h" /* String routines */ diff --git a/source3/include/proto.h b/source3/include/proto.h index 12aa392abae..b9a6cb7f116 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -739,173 +739,6 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context, const char *dcname, bool force); -/* The following definitions come from param/loadparm.c */ - -const struct loadparm_substitution *loadparm_s3_global_substitution(void); - -char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx, - const struct loadparm_substitution *lp_sub, - int snum, - const char *type, - const char *option, - const char *def); - -#include "source3/param/param_proto.h" - -char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int); -const char *lp_const_servicename(int); -bool lp_autoloaded(int); -const char *lp_dnsdomain(void); -int lp_winbind_max_domain_connections(void); -bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high); -bool lp_idmap_default_range(uint32_t *low, uint32_t *high); -const char *lp_idmap_backend(const char *domain_name); -const char *lp_idmap_default_backend (void); -int lp_security(void); -int lp_client_max_protocol(void); -int lp_client_ipc_min_protocol(void); -int lp_client_ipc_max_protocol(void); -int lp_client_ipc_signing(void); -int lp_smb2_max_credits(void); -int lp_cups_encrypt(void); -bool lp_widelinks(int ); -int lp_rpc_low_port(void); -int lp_rpc_high_port(void); -bool lp_lanman_auth(void); -enum samba_weak_crypto lp_weak_crypto(void); - -int lp_wi_scan_global_parametrics( - const char *regex, size_t max_matches, - bool (*cb)(const char *string, regmatch_t matches[], - void *private_data), - void *private_data); - -const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def); -struct loadparm_service; -const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type, - const char *option, const char *def); -const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def); -int lp_parm_int(int snum, const char *type, const char *option, int def); -unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def); -unsigned long long lp_parm_ulonglong(int snum, const char *type, - const char *option, - unsigned long long def); -bool lp_parm_bool(int snum, const char *type, const char *option, bool def); -struct enum_list; -int lp_parm_enum(int snum, const char *type, const char *option, - const struct enum_list *_enum, int def); -char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src); -bool lp_add_home(const char *pszHomename, int iDefaultService, - const char *user, const char *pszHomedir); -int lp_add_service(const char *pszService, int iDefaultService); -bool lp_add_printer(const char *pszPrintername, int iDefaultService); -bool lp_parameter_is_valid(const char *pszParmName); -bool lp_parameter_is_global(const char *pszParmName); -bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm, - bool *inverse); -bool lp_canonicalize_parameter_with_value(const char *parm_name, - const char *val, - const char **canon_parm, - const char **canon_val); -void show_parameter_list(void); -bool lp_invert_boolean(const char *str, const char **inverse_str); -bool lp_canonicalize_boolean(const char *str, const char**canon_str); -bool process_registry_service(const char *service_name); -bool process_registry_shares(void); -bool lp_config_backend_is_registry(void); -bool lp_config_backend_is_file(void); -bool lp_file_list_changed(void); -const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx); -const char *lp_ldap_user_suffix(TALLOC_CTX *ctx); -const char *lp_ldap_group_suffix(TALLOC_CTX *ctx); -const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx); -struct parm_struct; -/* Return a pointer to a service by name. */ -struct loadparm_service *lp_service(const char *pszServiceName); -struct loadparm_service *lp_servicebynum(int snum); -struct loadparm_service *lp_default_loadparm_service(void); -void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm); -void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm); -bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue); -bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue); -bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal); -bool lp_snum_ok(int iService); -void lp_add_one_printer(const char *name, const char *comment, - const char *location, void *pdata); -bool lp_loaded(void); -void lp_killunused(struct smbd_server_connection *sconn, - bool (*snumused) (struct smbd_server_connection *, int)); -void lp_kill_all_services(void); -void lp_killservice(int iServiceIn); -const char* server_role_str(uint32_t role); -enum usershare_err parse_usershare_file(TALLOC_CTX *ctx, - SMB_STRUCT_STAT *psbuf, - const char *servicename, - int snum, - char **lines, - int numlines, - char **pp_sharepath, - char **pp_comment, - char **pp_cp_share_name, - struct security_descriptor **ppsd, - bool *pallow_guest); -int load_usershare_service(const char *servicename); -int load_usershare_shares(struct smbd_server_connection *sconn, - bool (*snumused) (struct smbd_server_connection *, int)); -void gfree_loadparm(void); -bool lp_load_initial_only(const char *pszFname); -bool lp_load_global(const char *file_name); -bool lp_load_with_shares(const char *file_name); -bool lp_load_client(const char *file_name); -bool lp_load_global_no_reinit(const char *file_name); -bool lp_load_no_reinit(const char *file_name); -bool lp_load_client_no_reinit(const char *file_name); -bool lp_load_with_registry_shares(const char *pszFname); -int lp_numservices(void); -void lp_dump(FILE *f, bool show_defaults, int maxtoprint); -void lp_dump_one(FILE * f, bool show_defaults, int snum); -int lp_servicenumber(const char *pszServiceName); -const char *volume_label(TALLOC_CTX *ctx, int snum); -bool lp_domain_master(void); -bool lp_preferred_master(void); -void lp_remove_service(int snum); -void lp_copy_service(int snum, const char *new_name); -int lp_default_server_announce(void); -const char *lp_printername(TALLOC_CTX *ctx, - const struct loadparm_substitution *lp_sub, - int snum); -void lp_set_logfile(const char *name); -int lp_maxprintjobs(int snum); -const char *lp_printcapname(void); -bool lp_disable_spoolss( void ); -void lp_set_spoolss_state( uint32_t state ); -uint32_t lp_get_spoolss_state( void ); -struct smb_signing_state; -void set_use_sendfile(int snum, bool val); -void lp_set_mangling_method(const char *new_method); -bool lp_posix_pathnames(void); -void lp_set_posix_pathnames(void); -enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp); -void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val); -int lp_min_receive_file_size(void); -void widelinks_warning(int snum); -const char *lp_ncalrpc_dir(void); -void _lp_set_server_role(int server_role); - -/* The following definitions come from param/loadparm_ctx.c */ - -const struct loadparm_s3_helpers *loadparm_s3_helpers(void); - -/* The following definitions come from param/loadparm_server_role.c */ - -int lp_server_role(void); -void set_server_role(void); - -/* The following definitions come from param/util.c */ - -uint32_t get_int_param( const char* param ); -char* get_string_param( const char* param ); - /* The following definitions come from lib/server_contexts.c */ struct tevent_context *global_event_context(void); void global_event_context_free(void); diff --git a/source3/param/loadparm.h b/source3/param/loadparm.h new file mode 100644 index 00000000000..7686877ccf1 --- /dev/null +++ b/source3/param/loadparm.h @@ -0,0 +1,200 @@ +/* + * + * Unix SMB/CIFS implementation. + * + * Type definitions for loadparm + * + * Copyright (c) 2020 Andreas Schneider + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#ifndef _S3_LOADPARM_H +#define _S3_LOADPARM_H + +#include +#include + +/* Forward declarations */ +typedef struct stat_ex SMB_STRUCT_STAT; +typedef struct files_struct files_struct; +struct smbd_server_connection; +struct security_descriptor; + +/* The following definitions come from param/loadparm.c */ + +const struct loadparm_substitution *loadparm_s3_global_substitution(void); + +char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx, + const struct loadparm_substitution *lp_sub, + int snum, + const char *type, + const char *option, + const char *def); + +char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int); +const char *lp_const_servicename(int); +bool lp_autoloaded(int); +const char *lp_dnsdomain(void); +int lp_winbind_max_domain_connections(void); +bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high); +bool lp_idmap_default_range(uint32_t *low, uint32_t *high); +const char *lp_idmap_backend(const char *domain_name); +const char *lp_idmap_default_backend (void); +int lp_security(void); +int lp_client_max_protocol(void); +int lp_client_ipc_min_protocol(void); +int lp_client_ipc_max_protocol(void); +int lp_client_ipc_signing(void); +int lp_smb2_max_credits(void); +int lp_cups_encrypt(void); +bool lp_widelinks(int ); +int lp_rpc_low_port(void); +int lp_rpc_high_port(void); +bool lp_lanman_auth(void); +enum samba_weak_crypto lp_weak_crypto(void); + +int lp_wi_scan_global_parametrics( + const char *regex, size_t max_matches, + bool (*cb)(const char *string, regmatch_t matches[], + void *private_data), + void *private_data); + +const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def); +struct loadparm_service; +const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type, + const char *option, const char *def); +const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def); +int lp_parm_int(int snum, const char *type, const char *option, int def); +unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def); +unsigned long long lp_parm_ulonglong(int snum, const char *type, + const char *option, + unsigned long long def); +bool lp_parm_bool(int snum, const char *type, const char *option, bool def); +struct enum_list; +int lp_parm_enum(int snum, const char *type, const char *option, + const struct enum_list *_enum, int def); +char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src); +bool lp_add_home(const char *pszHomename, int iDefaultService, + const char *user, const char *pszHomedir); +int lp_add_service(const char *pszService, int iDefaultService); +bool lp_add_printer(const char *pszPrintername, int iDefaultService); +bool lp_parameter_is_valid(const char *pszParmName); +bool lp_parameter_is_global(const char *pszParmName); +bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm, + bool *inverse); +bool lp_canonicalize_parameter_with_value(const char *parm_name, + const char *val, + const char **canon_parm, + const char **canon_val); +void show_parameter_list(void); +bool lp_invert_boolean(const char *str, const char **inverse_str); +bool lp_canonicalize_boolean(const char *str, const char**canon_str); +bool process_registry_service(const char *service_name); +bool process_registry_shares(void); +bool lp_config_backend_is_registry(void); +bool lp_config_backend_is_file(void); +bool lp_file_list_changed(void); +const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx); +const char *lp_ldap_user_suffix(TALLOC_CTX *ctx); +const char *lp_ldap_group_suffix(TALLOC_CTX *ctx); +const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx); +struct parm_struct; +/* Return a pointer to a service by name. */ +struct loadparm_service *lp_service(const char *pszServiceName); +struct loadparm_service *lp_servicebynum(int snum); +struct loadparm_service *lp_default_loadparm_service(void); +void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm); +void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm); +bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue); +bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue); +bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal); +bool lp_snum_ok(int iService); +void lp_add_one_printer(const char *name, const char *comment, + const char *location, void *pdata); +bool lp_loaded(void); +void lp_killunused(struct smbd_server_connection *sconn, + bool (*snumused) (struct smbd_server_connection *, int)); +void lp_kill_all_services(void); +void lp_killservice(int iServiceIn); +const char* server_role_str(uint32_t role); +enum usershare_err parse_usershare_file(TALLOC_CTX *ctx, + SMB_STRUCT_STAT *psbuf, + const char *servicename, + int snum, + char **lines, + int numlines, + char **pp_sharepath, + char **pp_comment, + char **pp_cp_share_name, + struct security_descriptor **ppsd, + bool *pallow_guest); +int load_usershare_service(const char *servicename); +int load_usershare_shares(struct smbd_server_connection *sconn, + bool (*snumused) (struct smbd_server_connection *, int)); +void gfree_loadparm(void); +bool lp_load_initial_only(const char *pszFname); +bool lp_load_global(const char *file_name); +bool lp_load_with_shares(const char *file_name); +bool lp_load_client(const char *file_name); +bool lp_load_global_no_reinit(const char *file_name); +bool lp_load_no_reinit(const char *file_name); +bool lp_load_client_no_reinit(const char *file_name); +bool lp_load_with_registry_shares(const char *pszFname); +int lp_numservices(void); +void lp_dump(FILE *f, bool show_defaults, int maxtoprint); +void lp_dump_one(FILE * f, bool show_defaults, int snum); +int lp_servicenumber(const char *pszServiceName); +const char *volume_label(TALLOC_CTX *ctx, int snum); +bool lp_domain_master(void); +bool lp_preferred_master(void); +void lp_remove_service(int snum); +void lp_copy_service(int snum, const char *new_name); +int lp_default_server_announce(void); +const char *lp_printername(TALLOC_CTX *ctx, + const struct loadparm_substitution *lp_sub, + int snum); +void lp_set_logfile(const char *name); +int lp_maxprintjobs(int snum); +const char *lp_printcapname(void); +bool lp_disable_spoolss( void ); +void lp_set_spoolss_state( uint32_t state ); +uint32_t lp_get_spoolss_state( void ); +struct smb_signing_state; +void set_use_sendfile(int snum, bool val); +void lp_set_mangling_method(const char *new_method); +bool lp_posix_pathnames(void); +void lp_set_posix_pathnames(void); +enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp); +void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val); +int lp_min_receive_file_size(void); +void widelinks_warning(int snum); +const char *lp_ncalrpc_dir(void); +void _lp_set_server_role(int server_role); +uint32_t lp_get_async_dns_timeout(void); + +/* The following definitions come from param/loadparm_ctx.c */ + +const struct loadparm_s3_helpers *loadparm_s3_helpers(void); + +/* The following definitions come from param/loadparm_server_role.c */ + +int lp_server_role(void); +void set_server_role(void); + +/* The following definitions come from param/util.c */ + +uint32_t get_int_param( const char* param ); +char *get_string_param( const char* param ); + +#endif /* _S3_LOADPARM_H */ -- 2.28.0 From 076e6929c3c8d1dc161e7dacfc7fb7aeceb588bd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 11 Aug 2020 10:41:07 +0200 Subject: [PATCH 075/105] s3:lib: Move interface prototypes to own header file Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Fri Oct 9 20:36:13 UTC 2020 on sn-devel-184 (cherry picked from commit 925cc9aafbe17cb2cbd89f468fac70f96ae89475) --- source3/include/proto.h | 21 +------------------ source3/lib/interface.h | 46 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+), 20 deletions(-) create mode 100644 source3/lib/interface.h diff --git a/source3/include/proto.h b/source3/include/proto.h index b9a6cb7f116..1bbd8e9d526 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -84,26 +84,7 @@ NTSTATUS vfs_at_fspcwd(TALLOC_CTX *mem_ctx, struct connection_struct *conn, struct files_struct **_fsp); -/* The following definitions come from lib/interface.c */ - -bool ismyaddr(const struct sockaddr *ip); -bool ismyip_v4(struct in_addr ip); -bool is_local_net(const struct sockaddr *from); -void setup_linklocal_scope_id(struct sockaddr *pss); -bool is_local_net_v4(struct in_addr from); -int iface_count(void); -int iface_count_v4_nl(void); -const struct in_addr *first_ipv4_iface(void); -struct interface *get_interface(int n); -const struct sockaddr_storage *iface_n_sockaddr_storage(int n); -const struct in_addr *iface_n_ip_v4(int n); -const struct in_addr *iface_n_bcast_v4(int n); -const struct sockaddr_storage *iface_n_bcast(int n); -const struct sockaddr_storage *iface_ip(const struct sockaddr *ip); -bool iface_local(const struct sockaddr *ip); -void load_interfaces(void); -void gfree_interfaces(void); -bool interfaces_changed(void); +#include "source3/lib/interface.h" /* The following definitions come from lib/ldap_debug_handler.c */ diff --git a/source3/lib/interface.h b/source3/lib/interface.h new file mode 100644 index 00000000000..f45435b4a81 --- /dev/null +++ b/source3/lib/interface.h @@ -0,0 +1,46 @@ +/* + * + * Unix SMB/CIFS implementation. + * + * Type definitions for interfaces + * + * Copyright (c) 2020 Andreas Schneider + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#ifndef _INTERFACE_H +#define _INTERFACE_H + +#include + +bool ismyaddr(const struct sockaddr *ip); +bool ismyip_v4(struct in_addr ip); +bool is_local_net(const struct sockaddr *from); +void setup_linklocal_scope_id(struct sockaddr *pss); +bool is_local_net_v4(struct in_addr from); +int iface_count(void); +int iface_count_v4_nl(void); +const struct in_addr *first_ipv4_iface(void); +struct interface *get_interface(int n); +const struct sockaddr_storage *iface_n_sockaddr_storage(int n); +const struct in_addr *iface_n_ip_v4(int n); +const struct in_addr *iface_n_bcast_v4(int n); +const struct sockaddr_storage *iface_n_bcast(int n); +const struct sockaddr_storage *iface_ip(const struct sockaddr *ip); +bool iface_local(const struct sockaddr *ip); +void load_interfaces(void); +void gfree_interfaces(void); +bool interfaces_changed(void); + +#endif /* _INTERFACE_H */ -- 2.28.0 From b6d36e462fe41f7b88bbf120831c3765c40ef326 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:16 +0100 Subject: [PATCH 076/105] idl: Add SID_SAMBA_SMB3 Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 56879ec5876625346df89110f62d52e3fd5b8934) --- librpc/idl/security.idl | 3 +++ 1 file changed, 3 insertions(+) diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl index a92e8f1518e..06bf7449a70 100644 --- a/librpc/idl/security.idl +++ b/librpc/idl/security.idl @@ -282,6 +282,9 @@ interface security const string SID_SAMBA_UNIX_USER_OWNER = "S-1-22-1"; const string SID_SAMBA_UNIX_GROUP_OWNER = "S-1-22-2"; + /* Information passing via security token */ + const string SID_SAMBA_SMB3 = "S-1-22-1397571891"; + /* SECURITY_NT_SERVICE */ const string NAME_NT_SERVICE = "NT SERVICE"; -- 2.28.0 From 3128ed8c26c13ccc068b5e50ae52604f5ffc9241 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:29 +0100 Subject: [PATCH 077/105] s3:smbd: Add SMB3 connection information to session info Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 905c2b9722a64ee57f3fbcff51e6bb591c6e3edc) --- source3/include/vfs.h | 1 + source3/smbd/pipes.c | 82 +++++++++++++++++++++++++++++++++++++- source3/smbd/smb2_server.c | 5 +++ 3 files changed, 87 insertions(+), 1 deletion(-) diff --git a/source3/include/vfs.h b/source3/include/vfs.h index d527f850628..c0d60636c31 100644 --- a/source3/include/vfs.h +++ b/source3/include/vfs.h @@ -411,6 +411,7 @@ typedef struct files_struct { bool use_ofd_locks : 1; bool closing : 1; bool lock_failure_seen : 1; + bool encryption_required : 1; } fsp_flags; struct tevent_timer *update_write_time_event; diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c index 2dd38bb7ab3..d51a3de9497 100644 --- a/source3/smbd/pipes.c +++ b/source3/smbd/pipes.c @@ -30,13 +30,16 @@ #include "smbd/globals.h" #include "libcli/security/security.h" #include "rpc_server/srv_pipe_hnd.h" +#include "auth/auth_util.h" NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, struct files_struct **pfsp) { + struct smbXsrv_connection *xconn = smb_req->xconn; struct connection_struct *conn = smb_req->conn; struct files_struct *fsp; struct smb_filename *smb_fname = NULL; + struct auth_session_info *session_info = conn->session_info; NTSTATUS status; status = file_new(smb_req, conn, &fsp); @@ -68,10 +71,87 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, return status; } + if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) { + struct security_token *security_token = NULL; + uint16_t dialect = xconn->smb2.server.dialect; + uint16_t srv_smb_encrypt = 0x0002; + uint16_t cipher = xconn->smb2.server.cipher; + char smb3_sid_str[SID_MAX_SIZE]; + struct dom_sid smb3_dom_sid; + struct dom_sid smb3_sid; + uint32_t i; + bool ok; + int rc; + + session_info = copy_session_info(fsp, conn->session_info); + if (session_info == NULL) { + DBG_ERR("Failed to copy session info\n"); + file_free(smb_req, fsp); + return NT_STATUS_NO_MEMORY; + } + security_token = session_info->security_token; + + ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid); + if (!ok) { + file_free(smb_req, fsp); + return NT_STATUS_BUFFER_TOO_SMALL; + } + + /* + * Security check: + * + * Make sure we don't have a SMB3 SID in the security token! + */ + for (i = 0; i < security_token->num_sids; i++) { + int cmp; + + cmp = dom_sid_compare_domain(&security_token->sids[i], + &smb3_dom_sid); + if (cmp == 0) { + DBG_ERR("ERROR: An SMB3 SID has already been " + "detected in the security token!\n"); + file_free(smb_req, fsp); + return NT_STATUS_ACCESS_DENIED; + } + } + + rc = snprintf(smb3_sid_str, + sizeof(smb3_sid_str), + "%s-%u-%u-%u", + SID_SAMBA_SMB3, + dialect, + srv_smb_encrypt, + cipher); + if (rc < 0) { + DBG_ERR("Buffer too small\n"); + file_free(smb_req, fsp); + return NT_STATUS_BUFFER_TOO_SMALL; + } + + ok = dom_sid_parse(smb3_sid_str, &smb3_sid); + if (!ok) { + DBG_ERR("Failed to parse SMB3 SID\n"); + file_free(smb_req, fsp); + return NT_STATUS_INVALID_PARAMETER; + } + + status = add_sid_to_array_unique(security_token, + &smb3_sid, + &security_token->sids, + &security_token->num_sids); + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("Failed to add SMB3 SID to security token\n"); + file_free(smb_req, fsp); + return status; + } + + fsp->fsp_flags.encryption_required = true; + } + status = np_open(fsp, name, conn->sconn->remote_address, conn->sconn->local_address, - conn->session_info, + session_info, conn->sconn->ev_ctx, conn->sconn->msg_ctx, conn->sconn->dce_ctx, diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c index cf9de185c1f..cd24b7d2ed5 100644 --- a/source3/smbd/smb2_server.c +++ b/source3/smbd/smb2_server.c @@ -3232,6 +3232,11 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED); } + } else { + if (fsp->fsp_flags.encryption_required && !req->was_encrypted) { + return smbd_smb2_request_error(req, + NT_STATUS_ACCESS_DENIED); + } } } -- 2.28.0 From 333ae30e7f8238c684d2a1aec2b0516369068a7e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Mar 2020 14:11:56 +0100 Subject: [PATCH 078/105] librpc: Add dcerpc helper dcerpc_is_transport_encrypted() Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 8bbe5c8c94aaf75d715f558c363e5b2de49f7bf9) --- librpc/rpc/dcerpc_helper.c | 137 +++++++++++++++++++++++++++++++++++++ librpc/rpc/dcerpc_helper.h | 26 +++++++ librpc/wscript_build | 9 +++ 3 files changed, 172 insertions(+) create mode 100644 librpc/rpc/dcerpc_helper.c create mode 100644 librpc/rpc/dcerpc_helper.h diff --git a/librpc/rpc/dcerpc_helper.c b/librpc/rpc/dcerpc_helper.c new file mode 100644 index 00000000000..c5443764628 --- /dev/null +++ b/librpc/rpc/dcerpc_helper.c @@ -0,0 +1,137 @@ +/* + * Copyright (c) 2020 Andreas Schneider + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#include "includes.h" +#include "librpc/gen_ndr/security.h" +#include "librpc/gen_ndr/auth.h" +#include "lib/crypto/gnutls_helpers.h" +#include "libcli/security/dom_sid.h" +#include "libcli/smb/smb2_constants.h" + +#include "dcerpc_helper.h" + +static bool smb3_sid_parse(const struct dom_sid *sid, + uint16_t *pdialect, + uint16_t *pencrypt, + uint16_t *pcipher) +{ + uint16_t dialect; + uint16_t encrypt; + uint16_t cipher; + + if (sid->sub_auths[0] != 1397571891) { + return false; + } + + dialect = sid->sub_auths[1]; + if (dialect > 0x03ff) { + return false; + } + + encrypt = sid->sub_auths[2]; + if (encrypt > 0x0002) { + return false; + } + + cipher = sid->sub_auths[3]; + if (cipher > SMB2_ENCRYPTION_AES128_GCM) { + return false; + } + + if (pdialect != NULL) { + *pdialect = dialect; + } + + if (pencrypt != NULL) { + *pencrypt = encrypt; + } + + if (pcipher != NULL) { + *pcipher = cipher; + } + + return true; +} + +bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info) +{ + struct security_token *token = session_info->security_token; + struct dom_sid smb3_dom_sid; + const struct dom_sid *smb3_sid = NULL; + uint16_t dialect = 0; + uint16_t encrypt = 0; + uint16_t cipher = 0; + uint32_t i; + bool ok; + + ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid); + if (!ok) { + return false; + } + + for (i = 0; i < token->num_sids; i++) { + int cmp; + + /* There is only one SMB3 SID allowed! */ + cmp = dom_sid_compare_domain(&token->sids[i], &smb3_dom_sid); + if (cmp == 0) { + if (smb3_sid == NULL) { + smb3_sid = &token->sids[i]; + } else { + DBG_ERR("ERROR: The SMB3 SID has been detected " + "multiple times\n"); + return false; + } + } + } + + if (smb3_sid == NULL) { + return false; + } + + ok = smb3_sid_parse(smb3_sid, &dialect, &encrypt, &cipher); + if (!ok) { + DBG_ERR("Failed to parse SMB3 SID!\n"); + return false; + } + + DBG_DEBUG("SMB SID - dialect: %#04x, encrypt: %#04x, cipher: %#04x\n", + dialect, + encrypt, + cipher); + + if (dialect < SMB3_DIALECT_REVISION_300) { + DBG_DEBUG("Invalid SMB3 dialect!\n"); + return false; + } + + if (encrypt != DCERPC_SMB_ENCRYPTION_REQUIRED) { + DBG_DEBUG("Invalid SMB3 encryption!\n"); + return false; + } + + switch (cipher) { + case SMB2_ENCRYPTION_AES128_CCM: + case SMB2_ENCRYPTION_AES128_GCM: + break; + default: + DBG_DEBUG("Invalid SMB3 cipher!\n"); + return false; + } + + return true; +} diff --git a/librpc/rpc/dcerpc_helper.h b/librpc/rpc/dcerpc_helper.h new file mode 100644 index 00000000000..c0f09ee494e --- /dev/null +++ b/librpc/rpc/dcerpc_helper.h @@ -0,0 +1,26 @@ +/* + * Copyright (c) 2020 Andreas Schneider + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#ifndef _DCERPC_HELPER_H +#define _DCERPC_HELPER_H + +#define DCERPC_SMB_ENCRYPTION_OFF 0x0000 +#define DCERPC_SMB_ENCRYPTION_REQUIRED 0x0002 + +bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info); + +#endif /* _DCERPC_HELPER_H */ diff --git a/librpc/wscript_build b/librpc/wscript_build index 27b180fa63d..109a1834841 100644 --- a/librpc/wscript_build +++ b/librpc/wscript_build @@ -669,6 +669,15 @@ bld.SAMBA_LIBRARY('dcerpc-server-core', autoproto='rpc/dcesrv_core_proto.h', vnum='0.0.1') +bld.SAMBA_SUBSYSTEM('DCERPC_HELPER', + source='rpc/dcerpc_helper.c', + public_deps=''' + samba-hostconfig + samba-security + gnutls + GNUTLS_HELPERS + ''') + bld.SAMBA_SUBSYSTEM('NDR_WINBIND', source='gen_ndr/ndr_winbind.c', public_deps='ndr NDR_LSA' -- 2.28.0 From 4a2e7909f3a40c6ab82c045a5a54f8604a6f1dd2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 28 Aug 2020 16:31:17 +0200 Subject: [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 5f1a73be6311c68a21a550c0de5078baeb78f4ee) --- source3/smbd/pipes.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c index d51a3de9497..785cbb23b5f 100644 --- a/source3/smbd/pipes.c +++ b/source3/smbd/pipes.c @@ -31,6 +31,7 @@ #include "libcli/security/security.h" #include "rpc_server/srv_pipe_hnd.h" #include "auth/auth_util.h" +#include "librpc/rpc/dcerpc_helper.h" NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, struct files_struct **pfsp) @@ -74,7 +75,7 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) { struct security_token *security_token = NULL; uint16_t dialect = xconn->smb2.server.dialect; - uint16_t srv_smb_encrypt = 0x0002; + uint16_t srv_smb_encrypt = DCERPC_SMB_ENCRYPTION_REQUIRED; uint16_t cipher = xconn->smb2.server.cipher; char smb3_sid_str[SID_MAX_SIZE]; struct dom_sid smb3_dom_sid; -- 2.28.0 From 69b9e46fa29adcf5a478a240ea6980bf7d97ae4b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 12 Nov 2019 16:56:45 +0100 Subject: [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit c6a21e1897985f267bcfc681179cea95165c3c57) --- source3/rpc_server/samr/srv_samr_chgpasswd.c | 3 + source3/rpc_server/samr/srv_samr_nt.c | 78 +++++++++++++++++++- source3/rpc_server/wscript_build | 2 +- 3 files changed, 81 insertions(+), 2 deletions(-) diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c index cb9837ecf01..e326745169e 100644 --- a/source3/rpc_server/samr/srv_samr_chgpasswd.c +++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c @@ -769,11 +769,13 @@ static NTSTATUS check_oem_password(const char *user, .size = 16, }; + GNUTLS_FIPS140_SET_LAX_MODE(); rc = gnutls_cipher_init(&cipher_hnd, GNUTLS_CIPHER_ARCFOUR_128, &enc_key, NULL); if (rc < 0) { + GNUTLS_FIPS140_SET_STRICT_MODE(); return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); } @@ -781,6 +783,7 @@ static NTSTATUS check_oem_password(const char *user, password_encrypted, 516); gnutls_cipher_deinit(cipher_hnd); + GNUTLS_FIPS140_SET_STRICT_MODE(); if (rc < 0) { return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); } diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c index 5ffc3331185..77cb18b6a88 100644 --- a/source3/rpc_server/samr/srv_samr_nt.c +++ b/source3/rpc_server/samr/srv_samr_nt.c @@ -46,6 +46,8 @@ #include "rpc_server/srv_access_check.h" #include "../lib/tsocket/tsocket.h" #include "lib/util/base64.h" +#include "param/param.h" +#include "librpc/rpc/dcerpc_helper.h" #include "lib/crypto/gnutls_helpers.h" #include @@ -1887,6 +1889,7 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p, char *user_name = NULL; char *rhost; const char *wks = NULL; + bool encrypted; DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__)); @@ -1915,6 +1918,12 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p, return NT_STATUS_NO_MEMORY; } + encrypted = dcerpc_is_transport_encrypted(p->session_info); + if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + return NT_STATUS_ACCESS_DENIED; + } + /* * UNIX username case mangling not required, pass_oem_change * is case insensitive. @@ -1948,6 +1957,7 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p, char *user_name = NULL; const char *wks = NULL; char *rhost; + bool encrypted; DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__)); @@ -1985,6 +1995,12 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p, return NT_STATUS_NO_MEMORY; } + encrypted = dcerpc_is_transport_encrypted(p->session_info); + if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + return NT_STATUS_ACCESS_DENIED; + } + status = pass_oem_change(user_name, rhost, r->in.password->data, @@ -5200,8 +5216,13 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, char *rhost; DATA_BLOB session_key; struct dom_sid_buf buf; + struct loadparm_context *lp_ctx = NULL; + bool encrypted; - DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__)); + lp_ctx = loadparm_init_s3(p->mem_ctx, loadparm_s3_helpers()); + if (lp_ctx == NULL) { + return NT_STATUS_NO_MEMORY; + } /* This is tricky. A WinXP domain join sets (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES) @@ -5390,13 +5411,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, break; case 23: + encrypted = + dcerpc_is_transport_encrypted(p->session_info); + if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + status = NT_STATUS_ACCESS_DENIED; + break; + } + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); if(!NT_STATUS_IS_OK(status)) { break; } + /* + * This can be allowed as it requires a session key + * which we only have if we have a SMB session. + */ + GNUTLS_FIPS140_SET_LAX_MODE(); status = arc4_decrypt_data(session_key, info->info23.password.data, 516); + GNUTLS_FIPS140_SET_STRICT_MODE(); if(!NT_STATUS_IS_OK(status)) { break; } @@ -5412,14 +5447,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, break; case 24: + encrypted = + dcerpc_is_transport_encrypted(p->session_info); + if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + status = NT_STATUS_ACCESS_DENIED; + break; + } status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); if(!NT_STATUS_IS_OK(status)) { break; } + /* + * This can be allowed as it requires a session key + * which we only have if we have a SMB session. + */ + GNUTLS_FIPS140_SET_LAX_MODE(); status = arc4_decrypt_data(session_key, info->info24.password.data, 516); + GNUTLS_FIPS140_SET_STRICT_MODE(); if(!NT_STATUS_IS_OK(status)) { break; } @@ -5434,12 +5482,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, break; case 25: + encrypted = + dcerpc_is_transport_encrypted(p->session_info); + if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + status = NT_STATUS_ACCESS_DENIED; + break; + } + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); if(!NT_STATUS_IS_OK(status)) { break; } + /* + * This can be allowed as it requires a session key + * which we only have if we have a SMB session. + */ + GNUTLS_FIPS140_SET_LAX_MODE(); status = decode_rc4_passwd_buffer(&session_key, &info->info25.password); + GNUTLS_FIPS140_SET_STRICT_MODE(); if (!NT_STATUS_IS_OK(status)) { break; } @@ -5454,12 +5516,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, break; case 26: + encrypted = + dcerpc_is_transport_encrypted(p->session_info); + if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + status = NT_STATUS_ACCESS_DENIED; + break; + } + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); if(!NT_STATUS_IS_OK(status)) { break; } + /* + * This can be allowed as it requires a session key + * which we only have if we have a SMB session. + */ + GNUTLS_FIPS140_SET_LAX_MODE(); status = decode_rc4_passwd_buffer(&session_key, &info->info26.password); + GNUTLS_FIPS140_SET_STRICT_MODE(); if (!NT_STATUS_IS_OK(status)) { break; } diff --git a/source3/rpc_server/wscript_build b/source3/rpc_server/wscript_build index 2af02ad6fa8..eb91ac09384 100644 --- a/source3/rpc_server/wscript_build +++ b/source3/rpc_server/wscript_build @@ -85,7 +85,7 @@ bld.SAMBA3_SUBSYSTEM('RPC_SAMR', source='''samr/srv_samr_nt.c samr/srv_samr_util.c samr/srv_samr_chgpasswd.c''', - deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK') + deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK DCERPC_HELPER') bld.SAMBA3_SUBSYSTEM('RPC_SPOOLSS', source='''spoolss/srv_spoolss_nt.c -- 2.28.0 From 110323b646715aabd4468d70773c2d94968f2e99 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 15 Nov 2019 13:49:40 +0100 Subject: [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit a9c532c6d3e85fbe49b7040254cfc66ab54074bc) --- source4/rpc_server/samr/samr_password.c | 30 +++++++++++++++++++++++++ source4/rpc_server/wscript_build | 2 +- 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c index 52a644176e2..83b104fbd0e 100644 --- a/source4/rpc_server/samr/samr_password.c +++ b/source4/rpc_server/samr/samr_password.c @@ -31,6 +31,8 @@ #include "../lib/util/util_ldb.h" #include "rpc_server/samr/proto.h" #include "auth/auth_sam.h" +#include "lib/param/loadparm.h" +#include "librpc/rpc/dcerpc_helper.h" #include "lib/crypto/gnutls_helpers.h" #include @@ -129,6 +131,8 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, struct dom_sid *user_objectSid = NULL; gnutls_cipher_hd_t cipher_hnd = NULL; gnutls_datum_t lm_session_key; + struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; + bool encrypted; int rc; if (pwbuf == NULL) { @@ -144,6 +148,12 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, return NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER; } + encrypted = dcerpc_is_transport_encrypted(session_info); + if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + return NT_STATUS_ACCESS_DENIED; + } + /* Connect to a SAMDB with system privileges for fetching the old pw * hashes. */ sam_ctx = samdb_connect(mem_ctx, @@ -188,11 +198,13 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, .size = sizeof(lm_pwd->hash), }; + GNUTLS_FIPS140_SET_LAX_MODE(); rc = gnutls_cipher_init(&cipher_hnd, GNUTLS_CIPHER_ARCFOUR_128, &lm_session_key, NULL); if (rc < 0) { + GNUTLS_FIPS140_SET_STRICT_MODE(); status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto failed; } @@ -201,6 +213,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, pwbuf->data, 516); gnutls_cipher_deinit(cipher_hnd); + GNUTLS_FIPS140_SET_STRICT_MODE(); if (rc < 0) { status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto failed; @@ -607,7 +620,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, DATA_BLOB session_key = data_blob(NULL, 0); gnutls_cipher_hd_t cipher_hnd = NULL; gnutls_datum_t _session_key; + struct auth_session_info *session_info = + dcesrv_call_session_info(dce_call); + struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; int rc; + bool encrypted; + + encrypted = dcerpc_is_transport_encrypted(session_info); + if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + return NT_STATUS_ACCESS_DENIED; + } nt_status = dcesrv_transport_session_key(dce_call, &session_key); if (!NT_STATUS_IS_OK(nt_status)) { @@ -621,11 +644,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, .size = session_key.length, }; + /* + * This is safe to support as we only have a session key + * over a SMB connection which we force to be encrypted. + */ + GNUTLS_FIPS140_SET_LAX_MODE(); rc = gnutls_cipher_init(&cipher_hnd, GNUTLS_CIPHER_ARCFOUR_128, &_session_key, NULL); if (rc < 0) { + GNUTLS_FIPS140_SET_STRICT_MODE(); nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; } @@ -634,6 +663,7 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, pwbuf->data, 516); gnutls_cipher_deinit(cipher_hnd); + GNUTLS_FIPS140_SET_STRICT_MODE(); if (rc < 0) { nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build index de55ad6239a..c9c1978f223 100644 --- a/source4/rpc_server/wscript_build +++ b/source4/rpc_server/wscript_build @@ -87,7 +87,7 @@ bld.SAMBA_MODULE('dcesrv_samr', autoproto='samr/proto.h', subsystem='dcerpc_server', init_function='dcerpc_server_samr_init', - deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS' + deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS DCERPC_HELPER' ) -- 2.28.0 From 6353a991bc6d35b9468867c0e809e752b060da9b Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:45:49 +0200 Subject: [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips mode Signed-off-by: Isaac Boukris Reviewed-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 32d4c75d6cbf9153068a0487347097707afb356a) --- lib/crypto/py_crypto.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c index 32b946eee8f..ad18d3ada0f 100644 --- a/lib/crypto/py_crypto.c +++ b/lib/crypto/py_crypto.c @@ -24,6 +24,7 @@ #include #include +#include "lib/crypto/gnutls_helpers.h" static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) { @@ -85,12 +86,27 @@ static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) return result; } +static PyObject *py_crypto_set_relax_mode(PyObject *module) +{ + GNUTLS_FIPS140_SET_LAX_MODE(); + + Py_RETURN_NONE; +} + +static PyObject *py_crypto_set_strict_mode(PyObject *module) +{ + GNUTLS_FIPS140_SET_STRICT_MODE(); + + Py_RETURN_NONE; +} static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n" "Encrypt the data with RC4 algorithm using the key"; static PyMethodDef py_crypto_methods[] = { { "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc }, + { "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" }, + { "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" }, {0}, }; -- 2.28.0 From 525072939b9292a1744f929803a9597b5f725f9a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 28 Oct 2020 17:05:36 +0100 Subject: [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 7d54e4b49c235dc571f47d15e6b0a6fa63340773) --- source4/param/pyparam.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/source4/param/pyparam.c b/source4/param/pyparam.c index 4023fac4dd6..e15592b5743 100644 --- a/source4/param/pyparam.c +++ b/source4/param/pyparam.c @@ -463,6 +463,23 @@ static PyObject *py_lp_ctx_config_file(PyObject *self, void *closure) return PyUnicode_FromString(configfile); } +static PyObject *py_lp_ctx_weak_crypto(PyObject *self, void *closure) +{ + enum samba_weak_crypto weak_crypto = + lpcfg_weak_crypto(PyLoadparmContext_AsLoadparmContext(self)); + + switch(weak_crypto) { + case SAMBA_WEAK_CRYPTO_UNKNOWN: + Py_RETURN_NONE; + case SAMBA_WEAK_CRYPTO_ALLOWED: + return PyUnicode_FromString("allowed"); + case SAMBA_WEAK_CRYPTO_DISALLOWED: + return PyUnicode_FromString("disallowed"); + } + + Py_RETURN_NONE; +} + static PyGetSetDef py_lp_ctx_getset[] = { { .name = discard_const_p(char, "default_service"), @@ -473,6 +490,11 @@ static PyGetSetDef py_lp_ctx_getset[] = { .get = (getter)py_lp_ctx_config_file, .doc = discard_const_p(char, "Name of last config file that was loaded.") }, + { + .name = discard_const_p(char, "weak_crypto"), + .get = (getter)py_lp_ctx_weak_crypto, + .doc = discard_const_p(char, "If weak crypto is allowed.") + }, { .name = NULL } }; -- 2.28.0 From c7dfaf75a8f8bdb18c42325c470bdee8e600d930 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 Subject: [PATCH 084/105] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 9a3ba502d8193b25799ef92917efafd52de2e8c2) --- .../tests/dcerpc/samr_change_password.py | 188 ++++++++++++++++++ selftest/tests.py | 2 + 2 files changed, 190 insertions(+) create mode 100644 python/samba/tests/dcerpc/samr_change_password.py diff --git a/python/samba/tests/dcerpc/samr_change_password.py b/python/samba/tests/dcerpc/samr_change_password.py new file mode 100644 index 00000000000..109eeea98cc --- /dev/null +++ b/python/samba/tests/dcerpc/samr_change_password.py @@ -0,0 +1,188 @@ +# Unix SMB/CIFS implementation. +# +# Copyright © 2020 Andreas Schneider +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +"""Tests for samba.dcerpc.samr.password""" + +import os +import ctypes +import samba.tests + +from samba import crypto, generate_random_password, generate_random_bytes, ntstatus +from samba.auth import system_session +from samba.credentials import Credentials +from samba.credentials import SMB_ENCRYPTION_REQUIRED +from samba.dcerpc import samr, security, lsa +from samba.samdb import SamDB +from samba.tests import RpcInterfaceTestCase + + +class SamrPasswordTests(RpcInterfaceTestCase): + def setUp(self): + super(SamrPasswordTests, self).setUp() + self.open_samdb() + + self.create_user_account(10000) + + self.remote_server = samba.tests.env_get_var_value('SERVER') + self.remote_domain = samba.tests.env_get_var_value('DOMAIN') + self.remote_user = samba.tests.env_get_var_value('USERNAME') + self.remote_password = samba.tests.env_get_var_value('PASSWORD') + self.remote_binding_string = "ncacn_np:%s[krb5]" % (self.remote_server) + + self.remote_creds = Credentials() + self.remote_creds.guess(self.lp) + self.remote_creds.set_username(self.remote_user) + self.remote_creds.set_password(self.remote_password) + + def tearDown(self): + super(SamrPasswordTests, self).tearDown() + + samr.Close(self.user_handle) + samr.Close(self.domain_handle) + samr.Close(self.handle) + + samba.tests.delete_force(self.samdb, self.user_dn) + + # + # Open the samba database + # + def open_samdb(self): + self.lp = samba.tests.env_loadparm() + + self.local_creds = Credentials() + self.local_creds.guess(self.lp) + self.session = system_session() + self.samdb = SamDB(session_info=self.session, + credentials=self.local_creds, + lp=self.lp) + + # + # Open a SAMR Domain handle + # + def open_domain_handle(self): + self.handle = self.conn.Connect2(None, + security.SEC_FLAG_MAXIMUM_ALLOWED) + + self.domain_sid = self.conn.LookupDomain(self.handle, + lsa.String(self.remote_domain)) + + self.domain_handle = self.conn.OpenDomain(self.handle, + security.SEC_FLAG_MAXIMUM_ALLOWED, + self.domain_sid) + + def open_user_handle(self): + name = lsa.String(self.user_name) + + rids = self.conn.LookupNames(self.domain_handle, [name]) + + self.user_handle = self.conn.OpenUser(self.domain_handle, + security.SEC_FLAG_MAXIMUM_ALLOWED, + rids[0].ids[0]) + # + # Create a test user account + # + def create_user_account(self, user_id): + self.user_name = ("SAMR_USER_%d" % user_id) + self.user_pass = generate_random_password(32, 32) + self.user_dn = "cn=%s,cn=users,%s" % (self.user_name, self.samdb.domain_dn()) + + samba.tests.delete_force(self.samdb, self.user_dn) + + self.samdb.newuser(self.user_name, + self.user_pass, + description="Password for " + self.user_name + " is " + self.user_pass, + givenname=self.user_name, + surname=self.user_name) + + + def init_samr_CryptPassword(self, password, session_key): + + def encode_pw_buffer(password): + data = bytearray([0] * 516) + + p = samba.string_to_byte_array(password.encode('utf-16-le')) + plen = len(p) + + b = generate_random_bytes(512 - plen) + + i = 512 - plen + data[0:i] = b + data[i:i+plen] = p + data[512:516] = plen.to_bytes(4, byteorder='little') + + return bytes(data) + + # This is a test, so always allow to encrypt using RC4 + try: + crypto.set_relax_mode() + encrypted_blob = samba.arcfour_encrypt(session_key, encode_pw_buffer(password)) + finally: + crypto.set_strict_mode() + + out_blob = samr.CryptPassword() + out_blob.data = list(encrypted_blob) + + return out_blob + + + def test_setUserInfo2_Password(self, password='P@ssw0rd'): + self.conn = samr.samr(self.remote_binding_string, + self.get_loadparm(), + self.remote_creds) + self.open_domain_handle() + self.open_user_handle() + + password='P@ssw0rd' + + level = 24 + info = samr.UserInfo24() + + info.password_expired = 0 + info.password = self.init_samr_CryptPassword(password, self.conn.session_key) + + # If the server is in FIPS mode, it should reject the password change! + try: + self.conn.SetUserInfo2(self.user_handle, level, info) + except samba.NTSTATUSError as e: + code = ctypes.c_uint32(e.args[0]).value + print(code) + if ((code == ntstatus.NT_STATUS_ACCESS_DENIED) and + (self.lp.weak_crypto == 'disallowed')): + pass + else: + raise + + + def test_setUserInfo2_Password_Encrypted(self, password='P@ssw0rd'): + self.remote_creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) + + self.conn = samr.samr(self.remote_binding_string, + self.get_loadparm(), + self.remote_creds) + self.open_domain_handle() + self.open_user_handle() + + password='P@ssw0rd' + + level = 24 + info = samr.UserInfo24() + + info.password_expired = 0 + info.password = self.init_samr_CryptPassword(password, self.conn.session_key) + + self.conn.SetUserInfo2(self.user_handle, level, info) diff --git a/selftest/tests.py b/selftest/tests.py index adcb5b53189..86cab3f8046 100644 --- a/selftest/tests.py +++ b/selftest/tests.py @@ -93,6 +93,8 @@ planpythontestsuite( os.path.join(samba4srcdir, "..", "third_party", "waf")]) planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding") +for env in [ 'ad_dc:local', 'ad_dc_fips:local' ]: + planpythontestsuite(env, "samba.tests.dcerpc.samr_change_password") def cmdline(script, *args): -- 2.28.0 From 9dfef9d7129babedfdc0fddd60f76859f44fe7c1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 Subject: [PATCH 085/105] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Thu Oct 29 15:41:37 UTC 2020 on sn-devel-184 (cherry picked from commit ebd687335b9accfdbae7dbc65c9882ab4d5c0986) --- selftest/target/Samba4.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm index 649e923ff9a..1ebdf2a5484 100755 --- a/selftest/target/Samba4.pm +++ b/selftest/target/Samba4.pm @@ -1040,7 +1040,7 @@ servicePrincipalName: http/testupnspn.$ctx->{dnsname} $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" "; $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool") - . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'"; + . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account' -d10"; unless (system($samba_tool_cmd) == 0) { warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n"); return undef; -- 2.28.0 From 8e8b9d33f25c7ef89fdf4af90821ea4de77525e1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 09:40:41 +0200 Subject: [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 1298280a22ef7494fb85a6a5953bae15d22fa204) --- auth/credentials/credentials.c | 8 +++++--- auth/credentials/credentials.h | 9 ++++++--- auth/credentials/credentials_krb5.c | 4 ++-- auth/credentials/credentials_ntlm.c | 2 +- auth/credentials/credentials_secrets.c | 5 +++-- auth/credentials/pycredentials.c | 6 +++--- auth/credentials/tests/simple.c | 2 +- auth/credentials/wscript_build | 2 +- auth/gensec/gensec_start.c | 8 ++++---- examples/winexe/winexe.c | 4 ++-- source3/auth/auth_generic.c | 4 ++-- source3/lib/util_cmdline.c | 18 +++++++++--------- source3/libads/sasl.c | 8 ++++---- source3/libnet/libnet_join.c | 2 +- source3/libsmb/cliconnect.c | 16 ++++++++-------- source3/passdb/passdb.c | 6 +++--- source3/passdb/pdb_samba_dsdb.c | 4 ++-- source3/rpc_client/cli_pipe.c | 2 +- source3/rpcclient/rpcclient.c | 8 ++++---- source3/utils/net_ads.c | 2 +- source3/utils/net_util.c | 6 +++--- source3/utils/ntlm_auth.c | 4 ++-- source3/winbindd/winbindd_cm.c | 2 +- source4/auth/gensec/gensec_gssapi.c | 2 +- source4/auth/session.c | 2 +- source4/lib/cmdline/popt_credentials.c | 4 ++-- source4/torture/ldap/session_expiry.c | 2 +- source4/torture/raw/session.c | 4 ++-- source4/torture/rpc/schannel.c | 4 ++-- source4/torture/smb2/session.c | 12 ++++++------ 30 files changed, 84 insertions(+), 78 deletions(-) diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c index 77c35dd104b..1bdd6f15a09 100644 --- a/auth/credentials/credentials.c +++ b/auth/credentials/credentials.c @@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) cred->winbind_separator = '\\'; + cred->use_kerberos = CRED_USE_KERBEROS_DESIRED; + cred->signing_state = SMB_SIGNING_DEFAULT; /* @@ -360,7 +362,7 @@ _PUBLIC_ bool cli_credentials_authentication_requested(struct cli_credentials *c return true; } - if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) { + if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) { return true; } @@ -1018,7 +1020,7 @@ _PUBLIC_ void cli_credentials_guess(struct cli_credentials *cred, } if (lp_ctx != NULL && - cli_credentials_get_kerberos_state(cred) != CRED_DONT_USE_KERBEROS) { + cli_credentials_get_kerberos_state(cred) != CRED_USE_KERBEROS_DISABLED) { cli_credentials_set_ccache(cred, lp_ctx, NULL, CRED_GUESS_FILE, &error_string); } @@ -1097,7 +1099,7 @@ _PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred) cli_credentials_set_principal(cred, NULL, CRED_SPECIFIED); cli_credentials_set_realm(cred, NULL, CRED_SPECIFIED); cli_credentials_set_workstation(cred, "", CRED_UNINITIALISED); - cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS); + cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_DISABLED); } /** diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h index 438bcdce232..f468b8558dd 100644 --- a/auth/credentials/credentials.h +++ b/auth/credentials/credentials.h @@ -53,9 +53,12 @@ enum credentials_obtained { }; enum credentials_use_kerberos { - CRED_AUTO_USE_KERBEROS = 0, /* Default, we try kerberos if available */ - CRED_DONT_USE_KERBEROS, /* Sometimes trying kerberos just does 'bad things', so don't */ - CRED_MUST_USE_KERBEROS /* Sometimes administrators are parinoid, so always do kerberos */ + /** Sometimes trying kerberos just does 'bad things', so don't */ + CRED_USE_KERBEROS_DISABLED = 0, + /** Default, we try kerberos if available */ + CRED_USE_KERBEROS_DESIRED, + /** Sometimes administrators are paranoid, so always do kerberos */ + CRED_USE_KERBEROS_REQUIRED, }; enum credentials_krb_forwardable { diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c index 259b35b73b0..36f6b59a72b 100644 --- a/auth/credentials/credentials_krb5.c +++ b/auth/credentials/credentials_krb5.c @@ -871,7 +871,7 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred, ret = cli_credentials_get_ccache(cred, event_ctx, lp_ctx, &ccache, error_string); if (ret) { - if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) { + if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) { DEBUG(1, ("Failed to get kerberos credentials (kerberos required): %s\n", *error_string)); } else { DEBUG(4, ("Failed to get kerberos credentials: %s\n", *error_string)); @@ -1431,7 +1431,7 @@ _PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials * cred->impersonate_principal = talloc_strdup(cred, principal); talloc_free(cred->self_service); cred->self_service = talloc_strdup(cred, self_service); - cli_credentials_set_kerberos_state(cred, CRED_MUST_USE_KERBEROS); + cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_REQUIRED); } /* diff --git a/auth/credentials/credentials_ntlm.c b/auth/credentials/credentials_ntlm.c index f1b22a6c9e2..1bec60e5dce 100644 --- a/auth/credentials/credentials_ntlm.c +++ b/auth/credentials/credentials_ntlm.c @@ -53,7 +53,7 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred const struct samr_Password *nt_hash = NULL; int rc; - if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) { + if (cred->use_kerberos == CRED_USE_KERBEROS_REQUIRED) { TALLOC_FREE(frame); return NT_STATUS_INVALID_PARAMETER_MIX; } diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c index 52a89d4d5b4..58067a5bece 100644 --- a/auth/credentials/credentials_secrets.c +++ b/auth/credentials/credentials_secrets.c @@ -370,7 +370,8 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti } if (secrets_tdb_password_more_recent) { - enum credentials_use_kerberos use_kerberos = CRED_DONT_USE_KERBEROS; + enum credentials_use_kerberos use_kerberos = + CRED_USE_KERBEROS_DISABLED; char *machine_account = talloc_asprintf(tmp_ctx, "%s$", lpcfg_netbios_name(lp_ctx)); cli_credentials_set_password(cred, secrets_tdb_password, CRED_SPECIFIED); cli_credentials_set_old_password(cred, secrets_tdb_old_password, CRED_SPECIFIED); @@ -386,7 +387,7 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti FALL_THROUGH; case ROLE_ACTIVE_DIRECTORY_DC: - use_kerberos = CRED_AUTO_USE_KERBEROS; + use_kerberos = CRED_USE_KERBEROS_DESIRED; break; } } diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c index 17c90573f09..95dde276ef7 100644 --- a/auth/credentials/pycredentials.c +++ b/auth/credentials/pycredentials.c @@ -1492,9 +1492,9 @@ MODULE_INIT_FUNC(credentials) PyModule_AddObject(m, "CALLBACK_RESULT", PyLong_FromLong(CRED_CALLBACK_RESULT)); PyModule_AddObject(m, "SPECIFIED", PyLong_FromLong(CRED_SPECIFIED)); - PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_AUTO_USE_KERBEROS)); - PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_DONT_USE_KERBEROS)); - PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_MUST_USE_KERBEROS)); + PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DESIRED)); + PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DISABLED)); + PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_REQUIRED)); PyModule_AddObject(m, "AUTO_KRB_FORWARDABLE", PyLong_FromLong(CRED_AUTO_KRB_FORWARDABLE)); PyModule_AddObject(m, "NO_KRB_FORWARDABLE", PyLong_FromLong(CRED_NO_KRB_FORWARDABLE)); diff --git a/auth/credentials/tests/simple.c b/auth/credentials/tests/simple.c index 7f122bed3bc..b39d7a2251b 100644 --- a/auth/credentials/tests/simple.c +++ b/auth/credentials/tests/simple.c @@ -73,7 +73,7 @@ static bool test_guess(struct torture_context *tctx) const char *passwd_fd = getenv("PASSWD_FD"); const char *passwd_file = getenv("PASSWD_FILE"); - cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); + cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); unsetenv("USER"); unsetenv("PASSWD_FD"); diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build index 1e3302e3e48..ad16b7d8008 100644 --- a/auth/credentials/wscript_build +++ b/auth/credentials/wscript_build @@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials', public_headers='credentials.h', pc_files='samba-credentials.pc', deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', - vnum='0.1.0' + vnum='1.0.0' ) bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c index 3f42d611140..56306efed13 100644 --- a/auth/gensec/gensec_start.c +++ b/auth/gensec/gensec_start.c @@ -117,18 +117,18 @@ static const struct gensec_security_ops **gensec_use_kerberos_mechs( } switch (use_kerberos) { - case CRED_AUTO_USE_KERBEROS: + case CRED_USE_KERBEROS_DESIRED: keep = true; break; - case CRED_DONT_USE_KERBEROS: + case CRED_USE_KERBEROS_DISABLED: if (old_gensec_list[i]->kerberos == false) { keep = true; } break; - case CRED_MUST_USE_KERBEROS: + case CRED_USE_KERBEROS_REQUIRED: if (old_gensec_list[i]->kerberos == true) { keep = true; } @@ -156,7 +156,7 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( TALLOC_CTX *mem_ctx) { const struct gensec_security_ops * const *backends = gensec_security_all(); - enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; + enum credentials_use_kerberos use_kerberos = CRED_USE_KERBEROS_DESIRED; bool keep_schannel = false; if (gensec_security != NULL) { diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c index 03e7ec85198..95386211c0a 100644 --- a/examples/winexe/winexe.c +++ b/examples/winexe/winexe.c @@ -283,8 +283,8 @@ static void parse_args(int argc, const char *argv[], if (opt_kerberos) { cli_credentials_set_kerberos_state(cred, strcmp(opt_kerberos, "yes") - ? CRED_MUST_USE_KERBEROS - : CRED_DONT_USE_KERBEROS); + ? CRED_USE_KERBEROS_REQUIRED + : CRED_USE_KERBEROS_DISABLED); } if (options->runas == NULL && options->runas_file != NULL) { diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c index 0e9500ac08d..f314acd9559 100644 --- a/source3/auth/auth_generic.c +++ b/source3/auth/auth_generic.c @@ -356,9 +356,9 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx, cli_credentials_set_conf(server_credentials, lp_ctx); if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { - cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS); + cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED); } else { - cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS); + cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED); } nt_status = gensec_server_start(tmp_ctx, gensec_settings, diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c index 9c9e2f0ac0f..d2af34ee19b 100644 --- a/source3/lib/util_cmdline.c +++ b/source3/lib/util_cmdline.c @@ -307,9 +307,9 @@ void set_cmdline_auth_info_use_kerberos(struct user_auth_info *auth_info, enum credentials_use_kerberos krb5_state; if (b) { - krb5_state = CRED_MUST_USE_KERBEROS; + krb5_state = CRED_USE_KERBEROS_REQUIRED; } else { - krb5_state = CRED_DONT_USE_KERBEROS; + krb5_state = CRED_USE_KERBEROS_DISABLED; } cli_credentials_set_kerberos_state(auth_info->creds, krb5_state); @@ -321,7 +321,7 @@ bool get_cmdline_auth_info_use_kerberos(const struct user_auth_info *auth_info) krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); - if (krb5_state == CRED_MUST_USE_KERBEROS) { + if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { return true; } @@ -336,17 +336,17 @@ void set_cmdline_auth_info_fallback_after_kerberos(struct user_auth_info *auth_i krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); switch (krb5_state) { - case CRED_MUST_USE_KERBEROS: + case CRED_USE_KERBEROS_REQUIRED: if (b) { - krb5_state = CRED_AUTO_USE_KERBEROS; + krb5_state = CRED_USE_KERBEROS_DESIRED; } break; - case CRED_AUTO_USE_KERBEROS: + case CRED_USE_KERBEROS_DESIRED: if (!b) { - krb5_state = CRED_MUST_USE_KERBEROS; + krb5_state = CRED_USE_KERBEROS_REQUIRED; } break; - case CRED_DONT_USE_KERBEROS: + case CRED_USE_KERBEROS_DISABLED: /* nothing to do */ break; } @@ -360,7 +360,7 @@ bool get_cmdline_auth_info_fallback_after_kerberos(const struct user_auth_info * krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); - if (krb5_state == CRED_AUTO_USE_KERBEROS) { + if (krb5_state == CRED_USE_KERBEROS_DESIRED) { return true; } diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c index 87beeafe3ed..90ffa040ec0 100644 --- a/source3/libads/sasl.c +++ b/source3/libads/sasl.c @@ -158,7 +158,7 @@ static ADS_STATUS ads_sasl_spnego_gensec_bind(ADS_STRUCT *ads, use_spnego_principal = false; } - if (krb5_state == CRED_DONT_USE_KERBEROS) { + if (krb5_state == CRED_USE_KERBEROS_DISABLED) { use_spnego_principal = false; } @@ -565,7 +565,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) { status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", - CRED_MUST_USE_KERBEROS, + CRED_USE_KERBEROS_REQUIRED, p.service, p.hostname, blob); if (ADS_ERR_OK(status)) { @@ -581,7 +581,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) if (ADS_ERR_OK(status)) { status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", - CRED_MUST_USE_KERBEROS, + CRED_USE_KERBEROS_REQUIRED, p.service, p.hostname, blob); if (!ADS_ERR_OK(status)) { @@ -616,7 +616,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) library for HMAC_MD4 encryption */ mech = "NTLMSSP"; status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", - CRED_DONT_USE_KERBEROS, + CRED_USE_KERBEROS_DISABLED, p.service, p.hostname, data_blob_null); done: diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c index f3bf27e6c00..bd3aeec9434 100644 --- a/source3/libnet/libnet_join.c +++ b/source3/libnet/libnet_join.c @@ -1707,7 +1707,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, if (use_kerberos) { cli_credentials_set_kerberos_state(cli_creds, - CRED_MUST_USE_KERBEROS); + CRED_USE_KERBEROS_REQUIRED); } status = cli_full_connection_creds(&cli, NULL, diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index abfd18bfaf1..f7b4741de89 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -124,13 +124,13 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx, if (use_kerberos && fallback_after_kerberos) { cli_credentials_set_kerberos_state(creds, - CRED_AUTO_USE_KERBEROS); + CRED_USE_KERBEROS_DESIRED); } else if (use_kerberos) { cli_credentials_set_kerberos_state(creds, - CRED_MUST_USE_KERBEROS); + CRED_USE_KERBEROS_REQUIRED); } else { cli_credentials_set_kerberos_state(creds, - CRED_DONT_USE_KERBEROS); + CRED_USE_KERBEROS_DISABLED); } if (use_ccache) { @@ -255,7 +255,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, krb5_state = cli_credentials_get_kerberos_state(creds); - if (krb5_state != CRED_DONT_USE_KERBEROS) { + if (krb5_state != CRED_USE_KERBEROS_DISABLED) { try_kerberos = true; } @@ -275,7 +275,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, try_kerberos = false; } - if (krb5_state == CRED_MUST_USE_KERBEROS && !try_kerberos) { + if (krb5_state == CRED_USE_KERBEROS_REQUIRED && !try_kerberos) { DEBUG(0, ("Kerberos auth with '%s' (%s\\%s) to access " "'%s' not possible\n", user_principal, user_domain, user_account, @@ -286,7 +286,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, if (pass == NULL || strlen(pass) == 0) { need_kinit = false; - } else if (krb5_state == CRED_MUST_USE_KERBEROS) { + } else if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { need_kinit = try_kerberos; } else { need_kinit = try_kerberos; @@ -321,14 +321,14 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, if (ret != 0) { int dbglvl = DBGLVL_NOTICE; - if (krb5_state == CRED_MUST_USE_KERBEROS) { + if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { dbglvl = DBGLVL_ERR; } DEBUG(dbglvl, ("Kinit for %s to access %s failed: %s\n", user_principal, target_hostname, error_message(ret))); - if (krb5_state == CRED_MUST_USE_KERBEROS) { + if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { TALLOC_FREE(frame); return krb5_to_nt_status(ret); } diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 8ed1bafcea3..b12c845d9d2 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -2630,7 +2630,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, /* * It's not possible to use NTLMSSP with a domain trust account. */ - cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); + cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); } else { /* * We can't use kerberos against an NT4 domain. @@ -2638,7 +2638,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, * We should have a mode that also disallows NTLMSSP here, * as only NETLOGON SCHANNEL is possible. */ - cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); + cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); } ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED); @@ -2656,7 +2656,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, /* * We currently can't do kerberos just with an NTHASH. */ - cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); + cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); goto done; } diff --git a/source3/passdb/pdb_samba_dsdb.c b/source3/passdb/pdb_samba_dsdb.c index 276bda88efc..93e8f5bebe6 100644 --- a/source3/passdb/pdb_samba_dsdb.c +++ b/source3/passdb/pdb_samba_dsdb.c @@ -2599,13 +2599,13 @@ static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m, * Force kerberos if this is an active directory domain */ cli_credentials_set_kerberos_state(creds, - CRED_MUST_USE_KERBEROS); + CRED_USE_KERBEROS_REQUIRED); } else { /* * TODO: we should allow krb5 with the raw nt hash. */ cli_credentials_set_kerberos_state(creds, - CRED_DONT_USE_KERBEROS); + CRED_USE_KERBEROS_DISABLED); } *_creds = talloc_move(mem_ctx, &creds); diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c index 8227ef0b0bd..ba6c86cc227 100644 --- a/source3/rpc_client/cli_pipe.c +++ b/source3/rpc_client/cli_pipe.c @@ -2637,7 +2637,7 @@ NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx, NAME_NT_AUTHORITY, /* domain */ "SYSTEM", NULL, /* password */ - CRED_DONT_USE_KERBEROS, + CRED_USE_KERBEROS_DISABLED, NULL, /* netlogon_creds_CredentialState */ presult); } diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index 575a42ebf70..a38f69f5592 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -810,19 +810,19 @@ static NTSTATUS do_cmd(struct cli_state *cli, case DCERPC_AUTH_TYPE_SPNEGO: switch (pipe_default_auth_spnego_type) { case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP: - krb5_state = CRED_DONT_USE_KERBEROS; + krb5_state = CRED_USE_KERBEROS_DISABLED; break; case PIPE_AUTH_TYPE_SPNEGO_KRB5: - krb5_state = CRED_MUST_USE_KERBEROS; + krb5_state = CRED_USE_KERBEROS_REQUIRED; break; case PIPE_AUTH_TYPE_SPNEGO_NONE: - krb5_state = CRED_AUTO_USE_KERBEROS; + krb5_state = CRED_USE_KERBEROS_DESIRED; break; } FALL_THROUGH; case DCERPC_AUTH_TYPE_NTLMSSP: case DCERPC_AUTH_TYPE_KRB5: - if (krb5_state != CRED_AUTO_USE_KERBEROS) { + if (krb5_state != CRED_USE_KERBEROS_DESIRED) { cli_credentials_set_kerberos_state(creds, krb5_state); } diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c index 7f5b9c3a440..1a0e8a5c9dd 100644 --- a/source3/utils/net_ads.c +++ b/source3/utils/net_ads.c @@ -2432,7 +2432,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * talloc_destroy(mem_ctx); return -1; } - cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); + cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername, &server_ss, 0, diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c index 5829d891075..6c5321db0fd 100644 --- a/source3/utils/net_util.c +++ b/source3/utils/net_util.c @@ -493,13 +493,13 @@ struct cli_credentials *net_context_creds(struct net_context *c, if (c->opt_kerberos && c->opt_user_specified) { cli_credentials_set_kerberos_state(creds, - CRED_AUTO_USE_KERBEROS); + CRED_USE_KERBEROS_DESIRED); } else if (c->opt_kerberos) { cli_credentials_set_kerberos_state(creds, - CRED_MUST_USE_KERBEROS); + CRED_USE_KERBEROS_REQUIRED); } else { cli_credentials_set_kerberos_state(creds, - CRED_DONT_USE_KERBEROS); + CRED_USE_KERBEROS_DISABLED); } if (c->opt_ccache) { diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c index 7f8d2688978..bfaeff5188d 100644 --- a/source3/utils/ntlm_auth.c +++ b/source3/utils/ntlm_auth.c @@ -1364,9 +1364,9 @@ static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx, cli_credentials_set_conf(server_credentials, lp_ctx); if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { - cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS); + cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED); } else { - cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS); + cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED); } nt_status = gensec_server_start(tmp_ctx, gensec_settings, diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c index 5fb22d7e9c8..466a0095ef2 100644 --- a/source3/winbindd/winbindd_cm.c +++ b/source3/winbindd/winbindd_cm.c @@ -706,7 +706,7 @@ static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx, } cli_credentials_set_conf(creds, lp_ctx); - cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); + cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED); if (!ok) { diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c index d66abf32a7f..b668d4ed258 100644 --- a/source4/auth/gensec/gensec_gssapi.c +++ b/source4/auth/gensec/gensec_gssapi.c @@ -1556,7 +1556,7 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi } /* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */ - cli_credentials_set_kerberos_state(session_info->credentials, CRED_MUST_USE_KERBEROS); + cli_credentials_set_kerberos_state(session_info->credentials, CRED_USE_KERBEROS_REQUIRED); /* It has been taken from this place... */ gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL; diff --git a/source4/auth/session.c b/source4/auth/session.c index c5fc226a7d7..8e44dcd24f1 100644 --- a/source4/auth/session.c +++ b/source4/auth/session.c @@ -295,7 +295,7 @@ struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx, /* This credential handle isn't useful for password * authentication, so ensure nobody tries to do that */ cli_credentials_set_kerberos_state(creds, - CRED_MUST_USE_KERBEROS); + CRED_USE_KERBEROS_REQUIRED); } #endif diff --git a/source4/lib/cmdline/popt_credentials.c b/source4/lib/cmdline/popt_credentials.c index 5dd61f6339c..7d8963da99e 100644 --- a/source4/lib/cmdline/popt_credentials.c +++ b/source4/lib/cmdline/popt_credentials.c @@ -120,8 +120,8 @@ static void popt_common_credentials_callback(poptContext con, cli_credentials_set_kerberos_state( popt_get_cmdline_credentials(), use_kerberos - ? CRED_MUST_USE_KERBEROS - : CRED_DONT_USE_KERBEROS); + ? CRED_USE_KERBEROS_REQUIRED + : CRED_USE_KERBEROS_DISABLED); break; } diff --git a/source4/torture/ldap/session_expiry.c b/source4/torture/ldap/session_expiry.c index 35dda439b17..e5e38450745 100644 --- a/source4/torture/ldap/session_expiry.c +++ b/source4/torture/ldap/session_expiry.c @@ -55,7 +55,7 @@ bool torture_ldap_session_expiry(struct torture_context *torture) torture, url!=NULL, ret, fail, "talloc_asprintf failed"); cli_credentials_set_kerberos_state( - credentials, CRED_MUST_USE_KERBEROS); + credentials, CRED_USE_KERBEROS_REQUIRED); ok = lpcfg_set_option( torture->lp_ctx, "gensec_gssapi:requested_life_time=4"); diff --git a/source4/torture/raw/session.c b/source4/torture/raw/session.c index 0c460ae3069..e246d25e9fb 100644 --- a/source4/torture/raw/session.c +++ b/source4/torture/raw/session.c @@ -245,12 +245,12 @@ static bool test_session_expire1(struct torture_context *tctx) use_kerberos = cli_credentials_get_kerberos_state( popt_get_cmdline_credentials()); - if (use_kerberos != CRED_MUST_USE_KERBEROS) { + if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); } - torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, + torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, "please use -k yes"); lpcfg_set_option(tctx->lp_ctx, "gensec_gssapi:requested_life_time=4"); diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c index fff0b1aacbd..a5755041040 100644 --- a/source4/torture/rpc/schannel.c +++ b/source4/torture/rpc/schannel.c @@ -965,8 +965,8 @@ bool torture_rpc_schannel_bench1(struct torture_context *torture) torture_assert(torture, s->join_ctx2 != NULL, "Failed to join domain with acct_flags=ACB_WSTRUST"); - cli_credentials_set_kerberos_state(s->wks_creds1, CRED_DONT_USE_KERBEROS); - cli_credentials_set_kerberos_state(s->wks_creds2, CRED_DONT_USE_KERBEROS); + cli_credentials_set_kerberos_state(s->wks_creds1, CRED_USE_KERBEROS_DISABLED); + cli_credentials_set_kerberos_state(s->wks_creds2, CRED_USE_KERBEROS_DISABLED); for (i=0; i < s->nprocs; i++) { struct cli_credentials *wks = s->wks_creds1; diff --git a/source4/torture/smb2/session.c b/source4/torture/smb2/session.c index 07c6faebb15..701dfc10a07 100644 --- a/source4/torture/smb2/session.c +++ b/source4/torture/smb2/session.c @@ -956,7 +956,7 @@ bool test_session_reauth6(struct torture_context *tctx, struct smb2_tree *tree) krb_state = cli_credentials_get_kerberos_state( popt_get_cmdline_credentials()); - if (krb_state == CRED_MUST_USE_KERBEROS) { + if (krb_state == CRED_USE_KERBEROS_REQUIRED) { torture_skip(tctx, "Can't test failing session setup with kerberos."); } @@ -1064,12 +1064,12 @@ static bool test_session_expire1i(struct torture_context *tctx, size_t i; use_kerberos = cli_credentials_get_kerberos_state(credentials); - if (use_kerberos != CRED_MUST_USE_KERBEROS) { + if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); } - torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, + torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, "please use -k yes"); cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED); @@ -1250,12 +1250,12 @@ static bool test_session_expire2i(struct torture_context *tctx, struct smb2_notify ntf2; use_kerberos = cli_credentials_get_kerberos_state(credentials); - if (use_kerberos != CRED_MUST_USE_KERBEROS) { + if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { torture_warning(tctx, "smb2.session.expire2 requires -k yes!"); torture_skip(tctx, "smb2.session.expire2 requires -k yes!"); } - torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, + torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, "please use -k yes"); cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED); @@ -1612,7 +1612,7 @@ static bool test_session_expire_disconnect(struct torture_context *tctx) bool connected; use_kerberos = cli_credentials_get_kerberos_state(credentials); - if (use_kerberos != CRED_MUST_USE_KERBEROS) { + if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); } -- 2.28.0 From 6a356a6e79fa76de18a4ca0760ac4f053d70137f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Sep 2020 12:32:28 +0200 Subject: [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 1a92994a9513f5e73d30604a1dc217ddeb1ac8d5) --- auth/credentials/tests/test_creds.c | 221 ++++++++++++++++++++++++++++ auth/credentials/wscript_build | 6 + selftest/tests.py | 2 + source4/torture/local/local.c | 1 - source4/torture/local/wscript_build | 2 +- 5 files changed, 230 insertions(+), 2 deletions(-) create mode 100644 auth/credentials/tests/test_creds.c diff --git a/auth/credentials/tests/test_creds.c b/auth/credentials/tests/test_creds.c new file mode 100644 index 00000000000..d2d3d30d73d --- /dev/null +++ b/auth/credentials/tests/test_creds.c @@ -0,0 +1,221 @@ +/* + * Unix SMB/CIFS implementation. + * + * Copyright (C) 2018-2019 Andreas Schneider + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#include +#include +#include +#include +#include + +#include "lib/replace/replace.h" +#include "auth/credentials/credentials.c" + +static int setup_talloc_context(void **state) +{ + TALLOC_CTX *frame = talloc_stackframe(); + + *state = frame; + return 0; +} + +static int teardown_talloc_context(void **state) +{ + TALLOC_CTX *frame = *state; + TALLOC_FREE(frame); + return 0; +} + +static void torture_creds_init(void **state) +{ + TALLOC_CTX *mem_ctx = *state; + struct cli_credentials *creds = NULL; + const char *username = NULL; + const char *domain = NULL; + const char *password = NULL; + bool ok; + + creds = cli_credentials_init(mem_ctx); + assert_non_null(creds); + assert_null(creds->username); + assert_int_equal(creds->username_obtained, CRED_UNINITIALISED); + + domain = cli_credentials_get_domain(creds); + assert_null(domain); + ok = cli_credentials_set_domain(creds, "WURST", CRED_SPECIFIED); + assert_true(ok); + assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); + domain = cli_credentials_get_domain(creds); + assert_string_equal(domain, "WURST"); + + username = cli_credentials_get_username(creds); + assert_null(username); + ok = cli_credentials_set_username(creds, "brot", CRED_SPECIFIED); + assert_true(ok); + assert_int_equal(creds->username_obtained, CRED_SPECIFIED); + username = cli_credentials_get_username(creds); + assert_string_equal(username, "brot"); + + password = cli_credentials_get_password(creds); + assert_null(password); + ok = cli_credentials_set_password(creds, "SECRET", CRED_SPECIFIED); + assert_true(ok); + assert_int_equal(creds->password_obtained, CRED_SPECIFIED); + password = cli_credentials_get_password(creds); + assert_string_equal(password, "SECRET"); +} + +static void torture_creds_init_anonymous(void **state) +{ + TALLOC_CTX *mem_ctx = *state; + struct cli_credentials *creds = NULL; + + creds = cli_credentials_init_anon(mem_ctx); + assert_non_null(creds); + + assert_string_equal(creds->domain, ""); + assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); + + assert_string_equal(creds->username, ""); + assert_int_equal(creds->username_obtained, CRED_SPECIFIED); + + assert_null(creds->password); + assert_int_equal(creds->password_obtained, CRED_SPECIFIED); +} + +static void torture_creds_guess(void **state) +{ + TALLOC_CTX *mem_ctx = *state; + struct cli_credentials *creds = NULL; + const char *env_user = getenv("USER"); + + creds = cli_credentials_init(mem_ctx); + assert_non_null(creds); + + setenv("PASSWD", "SECRET", 1); + cli_credentials_guess(creds, NULL); + + assert_string_equal(creds->username, env_user); + assert_int_equal(creds->username_obtained, CRED_GUESS_ENV); + + assert_string_equal(creds->password, "SECRET"); + assert_int_equal(creds->password_obtained, CRED_GUESS_ENV); + unsetenv("PASSWD"); +} + +static void torture_creds_anon_guess(void **state) +{ + TALLOC_CTX *mem_ctx = *state; + struct cli_credentials *creds = NULL; + + creds = cli_credentials_init_anon(mem_ctx); + assert_non_null(creds); + + setenv("PASSWD", "SECRET", 1); + cli_credentials_guess(creds, NULL); + + assert_string_equal(creds->username, ""); + assert_int_equal(creds->username_obtained, CRED_SPECIFIED); + + assert_null(creds->password); + assert_int_equal(creds->password_obtained, CRED_SPECIFIED); + unsetenv("PASSWD"); +} + +static void torture_creds_parse_string(void **state) +{ + TALLOC_CTX *mem_ctx = *state; + struct cli_credentials *creds = NULL; + + creds = cli_credentials_init(mem_ctx); + assert_non_null(creds); + + /* Anonymous */ + cli_credentials_parse_string(creds, "%", CRED_SPECIFIED); + + assert_string_equal(creds->domain, ""); + assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); + + assert_string_equal(creds->username, ""); + assert_int_equal(creds->username_obtained, CRED_SPECIFIED); + + assert_null(creds->password); + assert_int_equal(creds->password_obtained, CRED_SPECIFIED); + + /* Username + password */ + cli_credentials_parse_string(creds, "wurst%BROT", CRED_SPECIFIED); + + assert_string_equal(creds->domain, ""); + assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); + + assert_string_equal(creds->username, "wurst"); + assert_int_equal(creds->username_obtained, CRED_SPECIFIED); + + assert_string_equal(creds->password, "BROT"); + assert_int_equal(creds->password_obtained, CRED_SPECIFIED); + + /* Domain + username + password */ + cli_credentials_parse_string(creds, "XXL\\wurst%BROT", CRED_SPECIFIED); + + assert_string_equal(creds->domain, "XXL"); + assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); + + assert_string_equal(creds->username, "wurst"); + assert_int_equal(creds->username_obtained, CRED_SPECIFIED); + + assert_string_equal(creds->password, "BROT"); + assert_int_equal(creds->password_obtained, CRED_SPECIFIED); + + /* Principal */ + cli_credentials_parse_string(creds, "wurst@brot.realm", CRED_SPECIFIED); + + assert_string_equal(creds->domain, ""); + assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); + + assert_string_equal(creds->username, "wurst@brot.realm"); + assert_int_equal(creds->username_obtained, CRED_SPECIFIED); + + assert_string_equal(creds->principal, "wurst@brot.realm"); + assert_int_equal(creds->principal_obtained, CRED_SPECIFIED); + + assert_string_equal(creds->password, "BROT"); + assert_int_equal(creds->password_obtained, CRED_SPECIFIED); +} + +int main(int argc, char *argv[]) +{ + int rc; + const struct CMUnitTest tests[] = { + cmocka_unit_test(torture_creds_init), + cmocka_unit_test(torture_creds_init_anonymous), + cmocka_unit_test(torture_creds_guess), + cmocka_unit_test(torture_creds_anon_guess), + cmocka_unit_test(torture_creds_parse_string), + }; + + if (argc == 2) { + cmocka_set_test_filter(argv[1]); + } + cmocka_set_message_output(CM_OUTPUT_SUBUNIT); + + rc = cmocka_run_group_tests(tests, + setup_talloc_context, + teardown_talloc_context); + + return rc; +} diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build index ad16b7d8008..46111164b36 100644 --- a/auth/credentials/wscript_build +++ b/auth/credentials/wscript_build @@ -31,3 +31,9 @@ bld.SAMBA_PYTHON('pycredentials', public_deps='samba-credentials cmdline-credentials %s %s CREDENTIALS_KRB5 CREDENTIALS_SECRETS' % (pytalloc_util, pyparam_util), realname='samba/credentials.so' ) + +bld.SAMBA_BINARY('test_creds', + source='tests/test_creds.c', + deps='cmocka samba-credentials', + local_include=False, + for_selftest=True) diff --git a/selftest/tests.py b/selftest/tests.py index 86cab3f8046..4a968cdbe8a 100644 --- a/selftest/tests.py +++ b/selftest/tests.py @@ -418,3 +418,5 @@ plantestsuite("samba.unittests.test_oLschema2ldif", "none", if with_elasticsearch_backend: plantestsuite("samba.unittests.mdsparser_es", "none", [os.path.join(bindir(), "default/source3/test_mdsparser_es")] + [configuration]) +plantestsuite("samba.unittests.credentials", "none", + [os.path.join(bindir(), "default/auth/credentials/test_creds")]) diff --git a/source4/torture/local/local.c b/source4/torture/local/local.c index a3186788524..d19b55e9502 100644 --- a/source4/torture/local/local.c +++ b/source4/torture/local/local.c @@ -70,7 +70,6 @@ torture_local_tevent_req, torture_local_torture, torture_local_dbspeed, - torture_local_credentials, torture_ldb, torture_dsdb_dn, torture_dsdb_syntax, diff --git a/source4/torture/local/wscript_build b/source4/torture/local/wscript_build index 38b6c8f4b6e..f0ab0357986 100644 --- a/source4/torture/local/wscript_build +++ b/source4/torture/local/wscript_build @@ -16,7 +16,7 @@ TORTURE_LOCAL_SOURCE = '''../../../lib/util/charset/tests/iconv.c ../../libcli/security/tests/sddl.c ../../../lib/tdr/testsuite.c ../../../lib/tevent/testsuite.c ../../param/tests/share.c ../../../lib/tevent/test_req.c - ../../param/tests/loadparm.c ../../../auth/credentials/tests/simple.c local.c + ../../param/tests/loadparm.c local.c dbspeed.c torture.c ../ldb/ldb.c ../../dsdb/common/tests/dsdb_dn.c ../../dsdb/schema/tests/schema_syntax.c ../../../lib/util/tests/anonymous_shared.c -- 2.28.0 From f6a4f70007e5c5ad1df3ddb018bde8568fc63f57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 2 Nov 2020 16:10:44 +0100 Subject: [PATCH 088/105] s3-vfs_glusterfs: always disable write-behind translator The "pass-through" option has now been merged upstream as of: https://github.com/gluster/glusterfs/pull/1640 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 Guenther Signed-off-by: Guenther Deschner Pair-Programmed-With: Anoop C S Pair-Programmed-With: Sachin Prabhu Reviewed-by: Jeremy Allison Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Wed Nov 4 22:53:49 UTC 2020 on sn-devel-184 (cherry picked from commit a51cda69ec6a017ad04b5690a3ae67a5478deee9) Autobuild-User(v4-13-test): Karolin Seeger Autobuild-Date(v4-13-test): Thu Nov 5 13:54:25 UTC 2020 on sn-devel-184 --- source3/modules/vfs_glusterfs.c | 20 +++++++++++++++++--- source3/wscript | 3 +++ 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c index 3cbb1ab6cb6..bdfe35ced82 100644 --- a/source3/modules/vfs_glusterfs.c +++ b/source3/modules/vfs_glusterfs.c @@ -363,6 +363,7 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, glfs_t *fs = NULL; TALLOC_CTX *tmp_ctx; int ret = 0; + bool write_behind_pass_through_set = false; tmp_ctx = talloc_new(NULL); if (tmp_ctx == NULL) { @@ -435,6 +436,17 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, goto done; } +#ifdef HAVE_GFAPI_VER_7_9 + ret = glfs_set_xlator_option(fs, "*-write-behind", "pass-through", + "true"); + if (ret < 0) { + DBG_ERR("%s: Failed to set xlator option: pass-through\n", + volume); + goto done; + } + write_behind_pass_through_set = true; +#endif + ret = glfs_set_logging(fs, logfile, loglevel); if (ret < 0) { DEBUG(0, ("%s: Failed to set logfile %s loglevel %d\n", @@ -449,9 +461,11 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, goto done; } - ret = check_for_write_behind_translator(tmp_ctx, fs, volume); - if (ret < 0) { - goto done; + if (!write_behind_pass_through_set) { + ret = check_for_write_behind_translator(tmp_ctx, fs, volume); + if (ret < 0) { + goto done; + } } ret = glfs_set_preopened(volume, handle->conn->connectpath, fs); diff --git a/source3/wscript b/source3/wscript index 335cfd797f1..9920432a360 100644 --- a/source3/wscript +++ b/source3/wscript @@ -1766,6 +1766,9 @@ main() { conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.6" --cflags --libs', msg='Checking for glusterfs-api >= 7.6', uselib_store="GFAPI_VER_7_6") + conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.9" --cflags --libs', + msg='Checking for glusterfs-api >= 7.9', + uselib_store="GFAPI_VER_7_9") else: conf.SET_TARGET_TYPE('gfapi', 'EMPTY') conf.undefine('HAVE_GLUSTERFS') -- 2.28.0 From 0d6268ff0a055e8fb418da761eeb820a8e11e2ad Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:09:05 +0200 Subject: [PATCH 089/105] Add smb2cli_session_get_encryption_cipher() When 'session->smb2->should_encrypt' is true, the client MUST encrypt all transport messages (see also MS-SMB2 3.2.4.1.8). Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy (cherry picked from commit f0f8de9d4a4e05445e427f00bb10eb34e1110a97) --- libcli/smb/smbXcli_base.c | 13 +++++++++++++ libcli/smb/smbXcli_base.h | 1 + 2 files changed, 14 insertions(+) diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c index 7d2da4b9ebc..471319a32f1 100644 --- a/libcli/smb/smbXcli_base.c +++ b/libcli/smb/smbXcli_base.c @@ -6436,6 +6436,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session) return NT_STATUS_OK; } +uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session) +{ + if (session->conn->protocol < PROTOCOL_SMB2_24) { + return 0; + } + + if (!session->smb2->should_encrypt) { + return 0; + } + + return session->conn->smb2.server.cipher; +} + struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx) { struct smbXcli_tcon *tcon; diff --git a/libcli/smb/smbXcli_base.h b/libcli/smb/smbXcli_base.h index 2afc7165cd9..db5f5d58799 100644 --- a/libcli/smb/smbXcli_base.h +++ b/libcli/smb/smbXcli_base.h @@ -518,6 +518,7 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session, const DATA_BLOB channel_key, const struct iovec *recv_iov); NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session); +uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session); struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx); struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx, -- 2.28.0 From 3f77e6cb6220d50b75ceb197e26813e9e5244cc0 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:18:21 +0200 Subject: [PATCH 090/105] Add dcerpc_transport_encrypted() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy (cherry picked from commit 339bfcd67af2675d10287946d8f5dabba1022d57) --- source4/librpc/rpc/dcerpc.h | 2 ++ source4/librpc/rpc/dcerpc_smb.c | 11 +++++++++++ source4/librpc/rpc/dcerpc_util.c | 13 +++++++++++++ 3 files changed, 26 insertions(+) diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h index 6b0b841d64d..57124f10778 100644 --- a/source4/librpc/rpc/dcerpc.h +++ b/source4/librpc/rpc/dcerpc.h @@ -87,6 +87,7 @@ struct dcecli_connection { struct dcerpc_transport { enum dcerpc_transport_t transport; void *private_data; + bool encrypted; struct tstream_context *stream; /** to serialize write events */ @@ -181,6 +182,7 @@ NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p, const struct ndr_interface_table *table); NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p, DATA_BLOB *session_key); +bool dcerpc_transport_encrypted(struct dcerpc_pipe *p); struct composite_context; NTSTATUS dcerpc_secondary_connection_recv(struct composite_context *c, struct dcerpc_pipe **p2); diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c index b20b154a1cb..101ed64f0cd 100644 --- a/source4/librpc/rpc/dcerpc_smb.c +++ b/source4/librpc/rpc/dcerpc_smb.c @@ -145,6 +145,7 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq) struct dcerpc_pipe_open_smb_state); struct composite_context *ctx = state->ctx; struct dcecli_connection *c = state->c; + uint16_t enc_cipher; ctx->status = tstream_smbXcli_np_open_recv(subreq, state->smb, @@ -173,6 +174,16 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq) /* Over-ride the default session key with the SMB session key */ c->security_state.session_key = smb_session_key; + enc_cipher = smb2cli_session_get_encryption_cipher(state->smb->session); + switch (enc_cipher) { + case SMB2_ENCRYPTION_AES128_CCM: + case SMB2_ENCRYPTION_AES128_GCM: + c->transport.encrypted = true; + break; + default: + c->transport.encrypted = false; + } + c->transport.private_data = talloc_move(c, &state->smb); composite_done(ctx); diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c index bd79a072bc8..6ea27a8d9a3 100644 --- a/source4/librpc/rpc/dcerpc_util.c +++ b/source4/librpc/rpc/dcerpc_util.c @@ -743,6 +743,19 @@ _PUBLIC_ NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p, return NT_STATUS_OK; } +_PUBLIC_ bool dcerpc_transport_encrypted(struct dcerpc_pipe *p) +{ + if (p == NULL) { + return false; + } + + if (p->conn == NULL) { + return false; + } + + return p->conn->transport.encrypted; +} + /* create a secondary context from a primary connection -- 2.28.0 From 4045c677a3ea3c44e5509025c1c7d03936ba9d82 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:35:01 +0200 Subject: [PATCH 091/105] Add py binding for dcerpc_transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy (cherry picked from commit eba91f0dfa8e3267689b4076302e257f4cecd63b) --- source4/librpc/rpc/pyrpc.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/source4/librpc/rpc/pyrpc.c b/source4/librpc/rpc/pyrpc.c index be914ed5f14..309a6d72e26 100644 --- a/source4/librpc/rpc/pyrpc.c +++ b/source4/librpc/rpc/pyrpc.c @@ -293,11 +293,25 @@ static PyObject *py_iface_request(PyObject *self, PyObject *args, PyObject *kwar return ret; } +static PyObject *py_iface_transport_encrypted(PyObject *self) +{ + dcerpc_InterfaceObject *iface = (dcerpc_InterfaceObject *)self; + + if (dcerpc_transport_encrypted(iface->pipe)) { + Py_RETURN_TRUE; + } + + Py_RETURN_FALSE; +} + static PyMethodDef dcerpc_interface_methods[] = { { "request", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_request), METH_VARARGS|METH_KEYWORDS, "S.request(opnum, data, object=None) -> data\n" "Make a raw request" }, + { "transport_encrypted", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_transport_encrypted), + METH_NOARGS, + "Check if the DCE transport is encrypted" }, { NULL, NULL, 0, NULL }, }; -- 2.28.0 From 07a87eaff7e2e18c2d462f4caff95cace92a0130 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:44:08 +0200 Subject: [PATCH 092/105] selftest: add a test for py dce transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy (cherry picked from commit a77551bea969ce73a3dc27384d94b4126bef04f7) --- python/samba/tests/dcerpc/binding.py | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py index 8e0d6a5ef0a..24e4ac77d89 100644 --- a/python/samba/tests/dcerpc/binding.py +++ b/python/samba/tests/dcerpc/binding.py @@ -22,7 +22,7 @@ import samba.tests from samba.tests import RpcInterfaceTestCase, TestCase from samba.dcerpc import lsa import samba.dcerpc.security as security -from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED +from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF from samba import NTSTATUSError class RpcBindingTests(RpcInterfaceTestCase): @@ -40,6 +40,26 @@ class RpcBindingTests(RpcInterfaceTestCase): c.set_password(password) return c + def test_smb3_dcerpc_no_encryption(self): + creds = self.get_user_creds() + creds.set_smb_encryption(SMB_ENCRYPTION_OFF) + + lp = self.get_loadparm() + lp.set('client ipc max protocol', 'SMB3') + lp.set('client ipc min protocol', 'SMB3') + + binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) + lsa_conn = lsa.lsarpc(binding_string, lp, creds) + self.assertFalse(lsa_conn.transport_encrypted()) + + objectAttr = lsa.ObjectAttribute() + objectAttr.sec_qos = lsa.QosInfo() + + pol_handle = lsa_conn.OpenPolicy2('', + objectAttr, + security.SEC_FLAG_MAXIMUM_ALLOWED) + self.assertIsNotNone(pol_handle) + def test_smb3_dcerpc_encryption(self): creds = self.get_user_creds() creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) @@ -50,6 +70,7 @@ class RpcBindingTests(RpcInterfaceTestCase): binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) lsa_conn = lsa.lsarpc(binding_string, lp, creds) + self.assertTrue(lsa_conn.transport_encrypted()) objectAttr = lsa.ObjectAttribute() objectAttr.sec_qos = lsa.QosInfo() -- 2.28.0 From 1c74d87e4dfe78d6e884c9bb4e57ec383d632a88 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:47:12 +0200 Subject: [PATCH 093/105] Add CreateTrustedDomainRelax wrapper for fips mode Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy (cherry picked from commit c2644032b49b4160517a7c73634cebc54a76f827) --- python/samba/trust_utils.py | 62 +++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 python/samba/trust_utils.py diff --git a/python/samba/trust_utils.py b/python/samba/trust_utils.py new file mode 100644 index 00000000000..b4df0fa5bb8 --- /dev/null +++ b/python/samba/trust_utils.py @@ -0,0 +1,62 @@ +# trust utils +# +# Copyright Isaac Boukris 2020 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + + +from samba.dcerpc import lsa, drsblobs +from samba.ndr import ndr_pack +from samba import arcfour_encrypt, string_to_byte_array +import random +from samba import crypto + +def CreateTrustedDomainRelax(lsaconn, policy, trust_info, mask, in_blob, out_blob): + + def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None): + confounder = [0] * 512 + for i in range(len(confounder)): + confounder[i] = random.randint(0, 255) + + trustpass = drsblobs.trustDomainPasswords() + + trustpass.confounder = confounder + trustpass.outgoing = outgoing + trustpass.incoming = incoming + + trustpass_blob = ndr_pack(trustpass) + + encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob) + + auth_blob = lsa.DATA_BUF2() + auth_blob.size = len(encrypted_trustpass) + auth_blob.data = string_to_byte_array(encrypted_trustpass) + + auth_info = lsa.TrustDomainInfoAuthInfoInternal() + auth_info.auth_blob = auth_blob + + return auth_info + + session_key = lsaconn.session_key + + try: + if lsaconn.transport_encrypted(): + crypto.set_relax_mode() + auth_info = generate_AuthInfoInternal(session_key, + incoming=in_blob, + outgoing=out_blob) + finally: + crypto.set_strict_mode() + + return lsaconn.CreateTrustedDomainEx2(policy, trust_info, auth_info, mask) -- 2.28.0 From 067c8d73800b928b02bcb1095c13083d9e0e368d Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:49:17 +0200 Subject: [PATCH 094/105] Use the new CreateTrustedDomainRelax() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy (cherry picked from commit baf4e2930ee13b47c23c63c7e945fdc4444f0c69) --- python/samba/netcmd/domain.py | 57 ++++++++--------------------------- 1 file changed, 13 insertions(+), 44 deletions(-) diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py index 1d12c362911..93a3258d28d 100644 --- a/python/samba/netcmd/domain.py +++ b/python/samba/netcmd/domain.py @@ -102,6 +102,7 @@ from samba.netcmd.domain_backup import cmd_domain_backup from samba.compat import binary_type from samba.compat import get_string +from samba.trust_utils import CreateTrustedDomainRelax string_version_to_constant = { "2008_R2": DS_DOMAIN_FUNCTION_2008_R2, @@ -2528,54 +2529,20 @@ class cmd_domain_trust_create(DomainTrustCommand): return blob - def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None): - confounder = [0] * 512 - for i in range(len(confounder)): - confounder[i] = random.randint(0, 255) - - trustpass = drsblobs.trustDomainPasswords() - - trustpass.confounder = confounder - trustpass.outgoing = outgoing - trustpass.incoming = incoming - - trustpass_blob = ndr_pack(trustpass) - - encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob) - - auth_blob = lsa.DATA_BUF2() - auth_blob.size = len(encrypted_trustpass) - auth_blob.data = string_to_byte_array(encrypted_trustpass) - - auth_info = lsa.TrustDomainInfoAuthInfoInternal() - auth_info.auth_blob = auth_blob - - return auth_info - update_time = samba.current_unix_time() incoming_blob = generate_AuthInOutBlob(incoming_secret, update_time) outgoing_blob = generate_AuthInOutBlob(outgoing_secret, update_time) - local_tdo_handle = None - remote_tdo_handle = None - - local_auth_info = generate_AuthInfoInternal(local_lsa.session_key, - incoming=incoming_blob, - outgoing=outgoing_blob) - if remote_trust_info: - remote_auth_info = generate_AuthInfoInternal(remote_lsa.session_key, - incoming=outgoing_blob, - outgoing=incoming_blob) - try: if remote_trust_info: self.outf.write("Creating remote TDO.\n") current_request = {"location": "remote", "name": "CreateTrustedDomainEx2"} - remote_tdo_handle = \ - remote_lsa.CreateTrustedDomainEx2(remote_policy, - remote_trust_info, - remote_auth_info, - lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS) + remote_tdo_handle = CreateTrustedDomainRelax(remote_lsa, + remote_policy, + remote_trust_info, + lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS, + outgoing_blob, + incoming_blob) self.outf.write("Remote TDO created.\n") if enc_types: self.outf.write("Setting supported encryption types on remote TDO.\n") @@ -2586,10 +2553,12 @@ class cmd_domain_trust_create(DomainTrustCommand): self.outf.write("Creating local TDO.\n") current_request = {"location": "local", "name": "CreateTrustedDomainEx2"} - local_tdo_handle = local_lsa.CreateTrustedDomainEx2(local_policy, - local_trust_info, - local_auth_info, - lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS) + local_tdo_handle = CreateTrustedDomainRelax(local_lsa, + local_policy, + local_trust_info, + lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS, + incoming_blob, + outgoing_blob) self.outf.write("Local TDO created\n") if enc_types: self.outf.write("Setting supported encryption types on local TDO.\n") -- 2.28.0 From 72dfcc923d0cf8054cb0f011e8405fa96b9ec6e0 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 1 Sep 2020 20:14:29 +0300 Subject: [PATCH 095/105] selftest: add a test for the CreateTrustedDomainRelax wrapper Originally copied from 'source4/scripting/devel/createtrust' (had to drop the TRUST_AUTH_TYPE_VERSION part though, as it fails against samba DC). Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy (cherry picked from commit cfaad16ff632df83a881fe5d8ec498bab102c9c9) --- python/samba/tests/dcerpc/createtrustrelax.py | 131 ++++++++++++++++++ selftest/knownfail.d/createtrustrelax_server | 1 + source4/selftest/tests.py | 4 + 3 files changed, 136 insertions(+) create mode 100644 python/samba/tests/dcerpc/createtrustrelax.py create mode 100644 selftest/knownfail.d/createtrustrelax_server diff --git a/python/samba/tests/dcerpc/createtrustrelax.py b/python/samba/tests/dcerpc/createtrustrelax.py new file mode 100644 index 00000000000..48beb0f9680 --- /dev/null +++ b/python/samba/tests/dcerpc/createtrustrelax.py @@ -0,0 +1,131 @@ +# Unix SMB/CIFS implementation. +# +# Copyright (C) Andrew Bartlett 2011 +# Copyright (C) Isaac Boukris 2020 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +"""Tests for the CreateTrustedDomainRelax wrapper""" + +import os +import samba +from samba.tests import TestCase +from samba.dcerpc import lsa, security, drsblobs +from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF +from samba.trust_utils import CreateTrustedDomainRelax + +class CreateTrustedDomainRelaxTest(TestCase): + def setUp(self): + super(CreateTrustedDomainRelaxTest, self).setUp() + + def get_user_creds(self): + c = Credentials() + c.guess() + domain = samba.tests.env_get_var_value('DOMAIN') + username = samba.tests.env_get_var_value('USERNAME') + password = samba.tests.env_get_var_value('PASSWORD') + c.set_domain(domain) + c.set_username(username) + c.set_password(password) + return c + + def _create_trust_relax(self, smbencrypt=True): + creds = self.get_user_creds() + + if smbencrypt: + creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) + else: + creds.set_smb_encryption(SMB_ENCRYPTION_OFF) + + lp = self.get_loadparm() + + binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) + lsa_conn = lsa.lsarpc(binding_string, lp, creds) + + if smbencrypt: + self.assertTrue(lsa_conn.transport_encrypted()) + else: + self.assertFalse(lsa_conn.transport_encrypted()) + + objectAttr = lsa.ObjectAttribute() + objectAttr.sec_qos = lsa.QosInfo() + + pol_handle = lsa_conn.OpenPolicy2('', + objectAttr, + security.SEC_FLAG_MAXIMUM_ALLOWED) + self.assertIsNotNone(pol_handle) + + name = lsa.String() + name.string = "tests.samba.example.com" + try: + info = lsa_conn.QueryTrustedDomainInfoByName(pol_handle, name, + lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) + + lsa_conn.DeleteTrustedDomain(pol_handle, info.info_ex.sid) + except RuntimeError: + pass + + info = lsa.TrustDomainInfoInfoEx() + info.domain_name.string = name.string + info.netbios_name.string = "createtrustrelax" + info.sid = security.dom_sid("S-1-5-21-538490383-3740119673-95748416") + info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND + info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL + info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE + + password_blob = samba.string_to_byte_array("password".encode('utf-16-le')) + + clear_value = drsblobs.AuthInfoClear() + clear_value.size = len(password_blob) + clear_value.password = password_blob + + clear_authentication_information = drsblobs.AuthenticationInformation() + clear_authentication_information.LastUpdateTime = 0 + clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR + clear_authentication_information.AuthInfo = clear_value + + authentication_information_array = drsblobs.AuthenticationInformationArray() + authentication_information_array.count = 1 + authentication_information_array.array = [clear_authentication_information] + + outgoing = drsblobs.trustAuthInOutBlob() + outgoing.count = 1 + outgoing.current = authentication_information_array + + trustdom_handle = None + try: + trustdom_handle = CreateTrustedDomainRelax(lsa_conn, + pol_handle, + info, + security.SEC_STD_DELETE, + outgoing, + outgoing) + except samba.NTSTATUSError as nt: + raise AssertionError(nt) + except OSError as e: + if smbencrypt: + raise AssertionError(e) + + if smbencrypt: + self.assertIsNotNone(trustdom_handle) + lsa_conn.DeleteTrustedDomain(pol_handle, info.sid) + else: + self.assertIsNone(trustdom_handle) + + def test_create_trust_relax_encrypt(self): + self._create_trust_relax(True) + + def test_create_trust_relax_no_enc(self): + self._create_trust_relax(False) diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server new file mode 100644 index 00000000000..80effda8343 --- /dev/null +++ b/selftest/knownfail.d/createtrustrelax_server @@ -0,0 +1 @@ +^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py index 3a903a7eee0..96f51b68cfc 100755 --- a/source4/selftest/tests.py +++ b/source4/selftest/tests.py @@ -704,6 +704,10 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex name = module plantestsuite_loadlist(name, env, args) +if have_gnutls_crypto_policies: + planoldpythontestsuite("ad_dc", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'}) + planoldpythontestsuite("ad_dc_fips", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'}) + # Run complex search expressions test once for each database backend. # Right now ad_dc has mdb and ad_dc_ntvfs has tdb mdb_testenv = "ad_dc" -- 2.28.0 From 341cc046bf816ad5818932c6c5d170a2a9a38783 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 5 Nov 2020 15:38:19 +0200 Subject: [PATCH 096/105] Remove source4/scripting/devel/createtrust script We now have the 'samba-tool domain trust' command. Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy Autobuild-User(master): Isaac Boukris Autobuild-Date(master): Fri Nov 6 11:25:02 UTC 2020 on sn-devel-184 (cherry picked from commit 604153525afc892f57a1df710c41ffca275b0dd3) --- source4/scripting/devel/createtrust | 125 ---------------------------- 1 file changed, 125 deletions(-) delete mode 100755 source4/scripting/devel/createtrust diff --git a/source4/scripting/devel/createtrust b/source4/scripting/devel/createtrust deleted file mode 100755 index 26b0d0dcb68..00000000000 --- a/source4/scripting/devel/createtrust +++ /dev/null @@ -1,125 +0,0 @@ -#!/usr/bin/env python3 - -# create a domain trust - -import sys -from optparse import OptionParser - -sys.path.insert(0, "bin/python") - -import samba -import samba.getopt as options -from samba.dcerpc import lsa, security, drsblobs -from samba.ndr import ndr_pack -from samba import arcfour_encrypt, string_to_byte_array -import random - -########### main code ########### -if __name__ == "__main__": - parser = OptionParser("createtrust [options] server") - sambaopts = options.SambaOptions(parser) - credopts = options.CredentialsOptionsDouble(parser) - parser.add_option_group(credopts) - - (opts, args) = parser.parse_args() - - lp = sambaopts.get_loadparm() - creds = credopts.get_credentials(lp) - - if len(args) != 1: - parser.error("You must supply a server") - - if not creds.authentication_requested(): - parser.error("You must supply credentials") - - server = args[0] - - binding_str = "ncacn_np:%s[print]" % server - - lsaconn = lsa.lsarpc(binding_str, lp, creds) - - objectAttr = lsa.ObjectAttribute() - objectAttr.sec_qos = lsa.QosInfo() - - pol_handle = lsaconn.OpenPolicy2(''.decode('utf-8'), - objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED) - - name = lsa.String() - name.string = "sub2.win2k3.obed.home.abartlet.net" - try: - info = lsaconn.QueryTrustedDomainInfoByName(pol_handle, name, lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) - - lsaconn.DeleteTrustedDomain(pol_handle, info.info_ex.sid) - except RuntimeError: - pass - - info = lsa.TrustDomainInfoInfoEx() - info.domain_name.string = "sub2.win2k3.obed.home.abartlet.net" - info.netbios_name.string = "sub2" - info.sid = security.dom_sid("S-1-5-21-538090388-3760119675-95745416") - info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND - info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL - info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_WITHIN_FOREST - - password_blob = string_to_byte_array("password".encode('utf-16-le')) - - clear_value = drsblobs.AuthInfoClear() - clear_value.size = len(password_blob) - clear_value.password = password_blob - - clear_authentication_information = drsblobs.AuthenticationInformation() - clear_authentication_information.LastUpdateTime = 0 - clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR - clear_authentication_information.AuthInfo = clear_value - - version_value = drsblobs.AuthInfoVersion() - version_value.version = 1 - - version = drsblobs.AuthenticationInformation() - version.LastUpdateTime = 0 - version.AuthType = lsa.TRUST_AUTH_TYPE_VERSION - version.AuthInfo = version_value - - authentication_information_array = drsblobs.AuthenticationInformationArray() - authentication_information_array.count = 2 - authentication_information_array.array = [clear_authentication_information, version] - - outgoing = drsblobs.trustAuthInOutBlob() - outgoing.count = 1 - outgoing.current = authentication_information_array - - trustpass = drsblobs.trustDomainPasswords() - confounder = [3] * 512 - - for i in range(512): - confounder[i] = random.randint(0, 255) - - trustpass.confounder = confounder - -# print "confounder: ", trustpass.confounder - - trustpass.outgoing = outgoing - trustpass.incoming = outgoing - - trustpass_blob = ndr_pack(trustpass) - -# print "trustpass_blob: ", list(trustpass_blob) - - encrypted_trustpass = arcfour_encrypt(lsaconn.session_key, trustpass_blob) - -# print "encrypted_trustpass: ", list(encrypted_trustpass) - - auth_blob = lsa.DATA_BUF2() - auth_blob.size = len(encrypted_trustpass) - auth_blob.data = string_to_byte_array(encrypted_trustpass) - - auth_info = lsa.TrustDomainInfoAuthInfoInternal() - auth_info.auth_blob = auth_blob - - -# print "auth_info.auth_blob.data: ", auth_info.auth_blob.data - - trustdom_handle = lsaconn.CreateTrustedDomainEx2(pol_handle, - info, - auth_info, - security.SEC_STD_DELETE) -- 2.28.0 From f51b23a9b8ad22d4cd4d7dea3ed8f0150974a209 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:30:26 +0100 Subject: [PATCH 097/105] s3:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit 6c11e5f42ba3248c97d85c989d422b256d2465a9) --- source3/rpc_server/lsa/srv_lsa_nt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c index 198387424e6..e749caf2551 100644 --- a/source3/rpc_server/lsa/srv_lsa_nt.c +++ b/source3/rpc_server/lsa/srv_lsa_nt.c @@ -1726,7 +1726,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, goto out; } - rc = gnutls_cipher_encrypt(cipher_hnd, + rc = gnutls_cipher_decrypt(cipher_hnd, auth_blob->data, auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- 2.28.0 From 7b24fdcb4a797b1daa97750f8a2c4f2c603115f3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:33:38 +0100 Subject: [PATCH 098/105] s4:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy (cherry picked from commit c93ccebdfedd60c1d19f1b1436ac30062259952a) --- source4/rpc_server/lsa/dcesrv_lsa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c index 8333cb149b6..4bb8aaa9592 100644 --- a/source4/rpc_server/lsa/dcesrv_lsa.c +++ b/source4/rpc_server/lsa/dcesrv_lsa.c @@ -889,7 +889,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, goto out; } - rc = gnutls_cipher_encrypt(cipher_hnd, + rc = gnutls_cipher_decrypt(cipher_hnd, auth_blob->data, auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- 2.28.0 From acbb59f45cb2b4c35df678ba774425180e9cf8c6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:40:21 +0200 Subject: [PATCH 099/105] s3:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy Reviewed-by: Stefan Metzmacher (cherry picked from commit 4425f2c113a4dc33a8dc609d84a92018d61b4d2e) --- source3/rpc_server/lsa/srv_lsa_nt.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c index e749caf2551..d6d606ddeca 100644 --- a/source3/rpc_server/lsa/srv_lsa_nt.c +++ b/source3/rpc_server/lsa/srv_lsa_nt.c @@ -51,6 +51,8 @@ #include "../libcli/lsarpc/util_lsarpc.h" #include "lsa.h" #include "librpc/rpc/dcesrv_core.h" +#include "librpc/rpc/dcerpc_helper.h" +#include "lib/param/loadparm.h" #include "lib/crypto/gnutls_helpers.h" #include @@ -1706,6 +1708,14 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, gnutls_datum_t my_session_key; NTSTATUS status; int rc; + bool encrypted; + + encrypted = + dcerpc_is_transport_encrypted(p->session_info); + if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + return NT_STATUS_ACCESS_DENIED; + } status = session_extract_session_key(p->session_info, &lsession_key, KEY_USE_16BYTES); if (!NT_STATUS_IS_OK(status)) { @@ -1717,11 +1727,13 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, .size = lsession_key.length, }; + GNUTLS_FIPS140_SET_LAX_MODE(); rc = gnutls_cipher_init(&cipher_hnd, GNUTLS_CIPHER_ARCFOUR_128, &my_session_key, NULL); if (rc < 0) { + GNUTLS_FIPS140_SET_STRICT_MODE(); status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; } @@ -1730,6 +1742,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, auth_blob->data, auth_blob->length); gnutls_cipher_deinit(cipher_hnd); + GNUTLS_FIPS140_SET_STRICT_MODE(); if (rc < 0) { status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- 2.28.0 From a4d0e69eb7a429a13e456cff7f96870e87791694 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:51:39 +0200 Subject: [PATCH 100/105] s4:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy Reviewed-by: Stefan Metzmacher (cherry picked from commit c75dd1ea178325b8f65343cb5c35bb93f43a49a3) --- source4/rpc_server/lsa/dcesrv_lsa.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c index 4bb8aaa9592..5b3ef71d458 100644 --- a/source4/rpc_server/lsa/dcesrv_lsa.c +++ b/source4/rpc_server/lsa/dcesrv_lsa.c @@ -33,6 +33,8 @@ #include "libcli/lsarpc/util_lsarpc.h" #include "lib/messaging/irpc.h" #include "libds/common/roles.h" +#include "lib/param/loadparm.h" +#include "librpc/rpc/dcerpc_helper.h" #include "lib/crypto/gnutls_helpers.h" #include @@ -869,6 +871,19 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, gnutls_cipher_hd_t cipher_hnd = NULL; gnutls_datum_t _session_key; int rc; + struct auth_session_info *session_info = + dcesrv_call_session_info(dce_call); + struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; + bool encrypted; + + encrypted = + dcerpc_is_transport_encrypted(session_info); + if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + DBG_ERR("Transport isn't encrypted and weak crypto disallowed!\n"); + return NT_STATUS_ACCESS_DENIED; + } + nt_status = dcesrv_transport_session_key(dce_call, &session_key); if (!NT_STATUS_IS_OK(nt_status)) { @@ -880,11 +895,13 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, .size = session_key.length, }; + GNUTLS_FIPS140_SET_LAX_MODE(); rc = gnutls_cipher_init(&cipher_hnd, GNUTLS_CIPHER_ARCFOUR_128, &_session_key, NULL); if (rc < 0) { + GNUTLS_FIPS140_SET_STRICT_MODE(); nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; } @@ -893,6 +910,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, auth_blob->data, auth_blob->length); gnutls_cipher_deinit(cipher_hnd); + GNUTLS_FIPS140_SET_STRICT_MODE(); if (rc < 0) { nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- 2.28.0 From f327133ced90a52d1ff9e104b1722876b21b7a78 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 10:13:48 +0100 Subject: [PATCH 101/105] sefltest: Enable the dcerpc.createtrustrelax test against ad_dc_fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy Reviewed-by: Stefan Metzmacher Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Mon Nov 9 10:22:51 UTC 2020 on sn-devel-184 (cherry picked from commit b89134013041e772418c2c8bcfffe8a9ade6db91) --- selftest/knownfail.d/createtrustrelax_server | 1 - 1 file changed, 1 deletion(-) delete mode 100644 selftest/knownfail.d/createtrustrelax_server diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server deleted file mode 100644 index 80effda8343..00000000000 --- a/selftest/knownfail.d/createtrustrelax_server +++ /dev/null @@ -1 +0,0 @@ -^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) -- 2.28.0 From 721f97817de2d1e14d99459f9e6af9fccf11b621 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 5 Nov 2020 15:48:08 -0800 Subject: [PATCH 102/105] s3: spoolss: Make parameters in call to user_ok_token() match all other uses. We already have p->session_info->unix_info->unix_name, we don't need to go through a legacy call to uidtoname(p->session_info->unix_token->uid). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14568 Signed-off-by: Jeremy Allison Reviewed-by: Andrew Bartlett Autobuild-User(master): Andrew Bartlett Autobuild-Date(master): Mon Nov 9 04:10:45 UTC 2020 on sn-devel-184 (cherry picked from commit e5e1759057a767f517bf480a2172a36623df2799) --- source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c index e98401a4365..906fab2adb5 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c @@ -1880,7 +1880,8 @@ WERROR _spoolss_OpenPrinterEx(struct pipes_struct *p, return WERR_ACCESS_DENIED; } - if (!user_ok_token(uidtoname(p->session_info->unix_token->uid), NULL, + if (!user_ok_token(p->session_info->unix_info->unix_name, + p->session_info->info->domain_name, p->session_info->security_token, snum) || !W_ERROR_IS_OK(print_access_check(p->session_info, p->msg_ctx, -- 2.28.0 From a078205ce3816c175cd16dc22875dc147a5da645 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 11 Nov 2020 13:42:06 +0100 Subject: [PATCH 103/105] s3:smbd: Fix possible null pointer dereference in token_contains_name() BUG: https://bugzilla.samba.org/show_bug.cgi?id=14572 Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy Autobuild-User(master): Alexander Bokovoy Autobuild-Date(master): Thu Nov 12 15:13:47 UTC 2020 on sn-devel-184 (cherry picked from commit 8036bf9717f83e83c3e4a9cf00fded42e9a5de15) --- source3/smbd/share_access.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c index 57754a0f766..694c0c290e8 100644 --- a/source3/smbd/share_access.c +++ b/source3/smbd/share_access.c @@ -79,7 +79,7 @@ static bool token_contains_name(TALLOC_CTX *mem_ctx, enum lsa_SidType type; if (username != NULL) { - size_t domain_len = strlen(domain); + size_t domain_len = domain != NULL ? strlen(domain) : 0; /* Check if username starts with domain name */ if (domain_len > 0) { -- 2.28.0 From 5654101584b7742e684d12e6aea43e5004142dcb Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 10 Nov 2020 17:35:24 +0200 Subject: [PATCH 104/105] lookup_name: allow lookup names prefixed with DNS forest root for FreeIPA DC In FreeIPA deployment with active Global Catalog service, when a two-way trust to Active Directory forest is established, Windows systems can look up FreeIPA users and groups. When using a security tab in Windows Explorer on AD side, a lookup over a trusted forest might come as realm\name instead of NetBIOS domain name: -------------------------------------------------------------------- [2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) lsa_LookupNames3: struct lsa_LookupNames3 in: struct lsa_LookupNames3 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000e-0000-0000-1c5e-a750e5810000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001e (30) size : 0x0020 (32) string : * string : 'ipa.test\admins' sids : * sids: struct lsa_TransSidArray3 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) -------------------------------------------------------------------- If we are running as a DC and PASSDB supports returning domain info (pdb_get_domain_info() returns a valid structure), check domain of the name in lookup_name() against DNS forest name and allow the request to be done against the primary domain. This corresponds to FreeIPA's use of Samba as a DC. For normal domain members a realm-based lookup falls back to a lookup over to its own domain controller with the help of winbindd. Signed-off-by: Alexander Bokovoy Reviewed-by: Stefan Metzmacher Autobuild-User(master): Alexander Bokovoy Autobuild-Date(master): Wed Nov 11 10:59:01 UTC 2020 on sn-devel-184 (cherry picked from commit 31c703766fd2b89737826fb7e9a707f0622bb8cd) --- source3/passdb/lookup_sid.c | 37 ++++++++++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 9 deletions(-) diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c index 82c47b3145b..864246da56e 100644 --- a/source3/passdb/lookup_sid.c +++ b/source3/passdb/lookup_sid.c @@ -113,17 +113,36 @@ bool lookup_name(TALLOC_CTX *mem_ctx, full_name, domain, name)); DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); - if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && - strequal(domain, get_global_sam_name())) - { + if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { + bool check_global_sam = false; + + check_global_sam = strequal(domain, get_global_sam_name()); + + /* If we are running on a DC that has PASSDB module with domain + * information, check if DNS forest name is matching the domain + * name. This is the case of FreeIPA domain controller when + * trusted AD DC looks up users found in a Global Catalog of + * the forest root domain. */ + if (!check_global_sam && (IS_DC)) { + struct pdb_domain_info *dom_info = NULL; + dom_info = pdb_get_domain_info(tmp_ctx); + + if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { + check_global_sam = strequal(domain, dom_info->dns_forest); + } - /* It's our own domain, lookup the name in passdb */ - if (lookup_global_sam_name(name, flags, &rid, &type)) { - sid_compose(&sid, get_global_sam_sid(), rid); - goto ok; + TALLOC_FREE(dom_info); + } + + if (check_global_sam) { + /* It's our own domain, lookup the name in passdb */ + if (lookup_global_sam_name(name, flags, &rid, &type)) { + sid_compose(&sid, get_global_sam_sid(), rid); + goto ok; + } + TALLOC_FREE(tmp_ctx); + return false; } - TALLOC_FREE(tmp_ctx); - return false; } if ((flags & LOOKUP_NAME_BUILTIN) && -- 2.28.0 From efa59aa4b2455ea3bc4d0fd0358b160858626585 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 11 Nov 2020 14:42:55 +0200 Subject: [PATCH 105/105] auth_sam: use pdb_get_domain_info to look up DNS forest information When Samba is used as a part of FreeIPA domain controller, Windows clients for a trusted AD forest may try to authenticate (perform logon operation) as a REALM\name user account. Fix auth_sam plugins to accept DNS forest name if we are running on a DC with PASSDB module providing domain information (e.g. pdb_get_domain_info() returning non-NULL structure). Right now, only FreeIPA or Samba AD DC PASSDB backends return this information but Samba AD DC configuration is explicitly ignored by the two auth_sam (strict and netlogon3) modules. Detailed logs below: [2020/11/11 09:23:53.281296, 1, pid=42677, effective(65534, 65534), real(65534, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:482(ndr_print_function_debug) netr_LogonSamLogonWithFlags: struct netr_LogonSamLogonWithFlags in: struct netr_LogonSamLogonWithFlags server_name : * server_name : '\\master.ipa.test' computer_name : * computer_name : 'AD1' credential : * credential: struct netr_Authenticator cred: struct netr_Credential data : 529f4b087c5f6546 timestamp : Wed Nov 11 09:23:55 AM 2020 UTC return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : 204f28f622010000 timestamp : Fri May 2 06:37:50 AM 1986 UTC logon_level : NetlogonNetworkTransitiveInformation (6) logon : * logon : union netr_LogonLevel(case 6) network : * network: struct netr_NetworkInfo identity_info: struct netr_IdentityInfo domain_name: struct lsa_String length : 0x0010 (16) size : 0x01fe (510) string : * string : 'IPA.TEST' parameter_control : 0x00002ae0 (10976) 0: MSV1_0_CLEARTEXT_PASSWORD_ALLOWED 0: MSV1_0_UPDATE_LOGON_STATISTICS 0: MSV1_0_RETURN_USER_PARAMETERS 0: MSV1_0_DONT_TRY_GUEST_ACCOUNT 1: MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT 1: MSV1_0_RETURN_PASSWORD_EXPIRY 1: MSV1_0_USE_CLIENT_CHALLENGE 0: MSV1_0_TRY_GUEST_ACCOUNT_ONLY 1: MSV1_0_RETURN_PROFILE_PATH 0: MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY 1: MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT 0: MSV1_0_DISABLE_PERSONAL_FALLBACK 1: MSV1_0_ALLOW_FORCE_GUEST 0: MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED 0: MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY 0: MSV1_0_ALLOW_MSVCHAPV2 0: MSV1_0_S4U2SELF 0: MSV1_0_CHECK_LOGONHOURS_FOR_S4U 0: MSV1_0_SUBAUTHENTICATION_DLL_EX logon_id : 0x0000000000884ef2 (8933106) account_name: struct lsa_String length : 0x000e (14) size : 0x000e (14) string : * string : 'idmuser' workstation: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' challenge : 417207867bd33c74 nt: struct netr_ChallengeResponse length : 0x00c0 (192) size : 0x00c0 (192) data : * data: ARRAY(192) [0000] A5 24 62 6E 31 DF 69 66 9E DC 54 D6 63 4C D6 2F .$bn1.if ..T.cL./ [0010] 01 01 00 00 00 00 00 00 50 37 D7 60 0C B8 D6 01 ........ P7.`.... [0020] 15 1B 38 4F 47 95 4D 62 00 00 00 00 02 00 0E 00 ..8OG.Mb ........ [0030] 57 00 49 00 4E 00 32 00 30 00 31 00 36 00 01 00 W.I.N.2. 0.1.6... [0040] 06 00 41 00 44 00 31 00 04 00 18 00 77 00 69 00 ..A.D.1. ....w.i. [0050] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. [0060] 73 00 74 00 03 00 20 00 61 00 64 00 31 00 2E 00 s.t... . a.d.1... [0070] 77 00 69 00 6E 00 32 00 30 00 31 00 36 00 2E 00 w.i.n.2. 0.1.6... [0080] 74 00 65 00 73 00 74 00 05 00 18 00 77 00 69 00 t.e.s.t. ....w.i. [0090] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. [00A0] 73 00 74 00 07 00 08 00 50 37 D7 60 0C B8 D6 01 s.t..... P7.`.... [00B0] 06 00 04 00 02 00 00 00 00 00 00 00 00 00 00 00 ........ ........ lm: struct netr_ChallengeResponse length : 0x0018 (24) size : 0x0018 (24) data : * data : 000000000000000000000000000000000000000000000000 validation_level : 0x0006 (6) flags : * flags : 0x00000000 (0) 0: NETLOGON_SAMLOGON_FLAG_PASS_TO_FOREST_ROOT 0: NETLOGON_SAMLOGON_FLAG_PASS_CROSS_FOREST_HOP 0: NETLOGON_SAMLOGON_FLAG_RODC_TO_OTHER_DOMAIN 0: NETLOGON_SAMLOGON_FLAG_RODC_NTLM_REQUEST In such case checks for a workgroup name will not match the DNS forest name used in the username specification: [2020/11/11 09:23:53.283055, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:200(auth_check_ntlm_password) check_ntlm_password: Checking password for unmapped user [IPA.TEST]\[idmuser]@[] with the new password interface [2020/11/11 09:23:53.283073, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:203(auth_check_ntlm_password) check_ntlm_password: mapped user is: [IPA.TEST]\[idmuser]@[] [2020/11/11 09:23:53.283082, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:213(auth_check_ntlm_password) check_ntlm_password: auth_context challenge created by fixed [2020/11/11 09:23:53.283091, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:216(auth_check_ntlm_password) challenge is: [2020/11/11 09:23:53.283099, 5, pid=42677, effective(65534, 65534), real(65534, 0)] ../../lib/util/util.c:678(dump_data) [0000] 41 72 07 86 7B D3 3C 74 Ar..{. Reviewed-by: Andreas Schneider (cherry picked from commit 2a8b672652dcbcf55ec59be537773d76f0f14d0a) --- source3/auth/auth_sam.c | 45 +++++++++++++++++++++++++++++++++++++---- 1 file changed, 41 insertions(+), 4 deletions(-) diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c index 3c12f959faf..e8e0d543f8c 100644 --- a/source3/auth/auth_sam.c +++ b/source3/auth/auth_sam.c @@ -22,6 +22,7 @@ #include "includes.h" #include "auth.h" +#include "passdb.h" #undef DBGC_CLASS #define DBGC_CLASS DBGC_AUTH @@ -142,10 +143,28 @@ static NTSTATUS auth_samstrict_auth(const struct auth_context *auth_context, break; case ROLE_DOMAIN_PDC: case ROLE_DOMAIN_BDC: - if ( !is_local_name && !is_my_domain ) { - DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n", - effective_domain)); - return NT_STATUS_NOT_IMPLEMENTED; + if (!is_local_name && !is_my_domain) { + /* If we are running on a DC that has PASSDB module with domain + * information, check if DNS forest name is matching the domain + * name. This is the case of FreeIPA domain controller when + * trusted AD DCs attempt to authenticate FreeIPA users using + * the forest root domain (which is the only domain in FreeIPA). + */ + struct pdb_domain_info *dom_info = NULL; + + dom_info = pdb_get_domain_info(mem_ctx); + if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { + is_my_domain = strequal(user_info->mapped.domain_name, + dom_info->dns_forest); + } + + TALLOC_FREE(dom_info); + if (!is_my_domain) { + DEBUG(6,("check_samstrict_security: %s is not one " + "of my local names or domain name (DC)\n", + effective_domain)); + return NT_STATUS_NOT_IMPLEMENTED; + } } break; @@ -230,6 +249,24 @@ static NTSTATUS auth_sam_netlogon3_auth(const struct auth_context *auth_context, } is_my_domain = strequal(user_info->mapped.domain_name, lp_workgroup()); + if (!is_my_domain) { + /* If we are running on a DC that has PASSDB module with domain + * information, check if DNS forest name is matching the domain + * name. This is the case of FreeIPA domain controller when + * trusted AD DCs attempt to authenticate FreeIPA users using + * the forest root domain (which is the only domain in FreeIPA). + */ + struct pdb_domain_info *dom_info = NULL; + dom_info = pdb_get_domain_info(mem_ctx); + + if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { + is_my_domain = strequal(user_info->mapped.domain_name, + dom_info->dns_forest); + } + + TALLOC_FREE(dom_info); + } + if (!is_my_domain) { DBG_INFO("%s is not our domain name (DC for %s)\n", effective_domain, lp_workgroup()); -- 2.28.0