ctx.c revision 4bff34e37def8a90f9194d81bc345c52ba20086a
/*
* Copyright (c) 2000, Boris Popov
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* This product includes software developed by Boris Popov.
* 4. Neither the name of the author nor the names of any co-contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $Id: ctx.c,v 1.32.70.2 2005/06/02 00:55:40 lindak Exp $
*/
#pragma ident "%Z%%M% %I% %E% SMI"
#include <sys/byteorder.h>
#include <fcntl.h>
#include <ctype.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <strings.h>
#include <stdlib.h>
#include <pwd.h>
#include <grp.h>
#include <unistd.h>
#include <libintl.h>
#include <assert.h>
#include <nss_dbdefs.h>
#include <kerberosv5/krb5.h>
#include <kerberosv5/com_err.h>
#define NB_NEEDRESOLVER
#include <cflib.h>
#include <charsets.h>
#include <spnego.h>
#include "derparse.h"
extern MECH_OID g_stcMechOIDList [];
#define POWEROF2(x) (((x) & ((x)-1)) == 0)
/* These two may be set by commands. */
int smb_debug, smb_verbose;
/*
* We want more strict layering than this.
* The redirector should simply export a
* remote pipe API, comsumed by dce rpc.
* Make it a no-op for now.
*/
#if 0
#include <rpc_cleanup.h>
#else
static void
{
}
#endif
void
dump_ctx_flags(int flags)
{
printf(" Flags: ");
if (flags == 0)
printf("0");
if (flags & SMBCF_NOPWD)
printf("NOPWD ");
if (flags & SMBCF_SRIGHTS)
printf("SRIGHTS ");
if (flags & SMBCF_LOCALE)
printf("LOCALE ");
if (flags & SMBCF_CMD_DOM)
printf("CMD_DOM ");
if (flags & SMBCF_CMD_USR)
printf("CMD_USR ");
if (flags & SMBCF_CMD_PW)
printf("CMD_PW ");
if (flags & SMBCF_RESOLVED)
printf("RESOLVED ");
if (flags & SMBCF_KCBAD)
printf("KCBAD ");
if (flags & SMBCF_KCFOUND)
printf("KCFOUND ");
if (flags & SMBCF_BROWSEOK)
printf("BROWSEOK ");
if (flags & SMBCF_AUTHREQ)
printf("AUTHREQ ");
if (flags & SMBCF_KCSAVE)
printf("KCSAVE ");
printf("XXX ");
if (flags & SMBCF_SSNACTIVE)
printf("SSNACTIVE ");
if (flags & SMBCF_KCDOMAIN)
printf("KCDOMAIN ");
printf("\n");
}
void
{
printf(" srvname=\"%s\", dom=\"%s\", user=\"%s\", password=%s\n",
printf(" timeout=%d, retry=%d, owner=%d, group=%d\n",
}
void
{
printf(" share_name=\"%s\", share_pw=\"%s\"\n",
}
void
{
if (ctx->ct_fullserver)
else
printf(" fullserver=NULL");
if (ctx->ct_srvaddr)
else
printf(" srvaddr=NULL\n");
}
/*
* Initialize an smb_ctx struct.
*
* The sequence for getting all the members filled in
* has some tricky aspects. Here's how it works:
*
* The search order for options is as follows:
* command line options
* values parsed from UNC path (cmd)
* values from RC file (per-user)
* values from SMF (system-wide)
* built-in defaults
*
* Normally, one would simply get all the values starting with
* the bottom of the above list and working to the top, and
* overwriting values as you go. But we need an exception.
*
* In this function, we parse the UNC path and command line options,
* because we need (at least) the server name when we're getting the
* SMF and RC file values. However, values we get from the command
* should not be overwritten by SMF or RC file parsing, so we mark
* values from the command as "from CMD" and the RC file parser
* leaves in place any values so marked. See: SMBCF_CMD_*
*
* The semantics of these flags are: "This value came from the
* current command instance, not from sources that may apply to
* multiple commands." (Different from the old "FROMUSR" flag.)
*
* Note that smb_ctx_opt() is called later to handle the
* remaining options, which should be ignored here.
* The (magic) leading ":" in cf_getopt() makes it
* ignore options not in the options string.
*/
int
{
char pwbuf[NSS_BUFLEN_PASSWD];
if (sharetype == SMB_ST_DISK)
if (error)
return (error);
/*
* if the user name is not specified some other way,
* use the current user name (built-in default)
*/
/*
* Set a built-in default domain (workgroup).
* XXX: What's the best default? Use "?" instead?
*/
/*
* Parse the UNC path. Values from here are
* marked as "from CMD".
*/
goto done;
continue;
if (error)
return (error);
break;
}
/*
* Parse options, if any. Values from here too
* are marked as "from CMD".
*/
switch (opt) {
case 'A':
aflg = 1;
break;
case 'E':
#if 0 /* We don't support any "charset" stuff. (ignore -E) */
if (error)
return (error);
#endif
break;
case 'L':
#if 0 /* Use the standard environment variables (ignore -L) */
if (error)
break;
#endif
break;
case 'U':
uflg = 1;
break;
}
}
return (1);
}
done:
if (smb_debug)
return (error);
}
void
{
/* Kerberos stuff. See smb_ctx_krb5init() */
if (ctx->ct_krb5ctx) {
}
#if 0 /* XXX: not pointers anymore */
#endif
if (ctx->ct_srvaddr)
if (ctx->ct_secblob)
if (ctx->ct_origshare)
if (ctx->ct_fullserver)
}
static int
const char **next)
{
int len;
maxlen--;
if (*p == 0)
return (EINVAL);
*dest = *p;
}
*dest = 0;
*next = *p ? p + 1 : p;
return (0);
}
/*
* Parse the UNC path. Here we expect something like
* "//[workgroup;][user[:password]@]host[/share[/path]]"
* Values found here are marked as "from CMD".
*/
int
const char **next)
{
const char *p = unc;
char tmp[1024];
char tmp2[1024];
int error;
if (*p++ != '/' || *p++ != '/') {
"UNC should start with '//'"), 0);
return (EINVAL);
}
if (!error) {
if (*p1 == 0) {
"empty workgroup name"), 0);
return (EINVAL);
}
if (error)
return (error);
}
colon = (char *)p;
if (!error) {
"no user name required"), 0);
return (EINVAL);
}
if (p1) {
*p1++ = (char)0;
if (error)
return (error);
if (p - colon > 2)
}
if (*p1 == 0) {
"empty user name"), 0);
return (EINVAL);
}
if (error)
return (error);
}
if (error) {
if (error) {
"no server name found"), 0);
return (error);
}
}
if (*p1 == 0) {
return (EINVAL);
}
/*
* It's safe to uppercase this string, which
* consists of ascii characters that should
* be uppercased, %s, and ascii characters representing
* hex digits 0-9 and A-F (already uppercased, and
* if not uppercased they need to be). However,
* it is NOT safe to uppercase after it has been
* converted, below!
*/
/*
* scan for % in the string.
* If we find one, convert
* to the assumed codepage.
*/
/* use the 1st buffer, we don't need the old string */
servername = tmp;
return (EINVAL);
}
/*
* Converts utf8 to win equivalent of
* what is configured on this machine.
* Note that we are assuming this is the
* encoding used on the server, and that
* assumption might be incorrect. This is
* the best we can do now, and we should
* move to use port 445 to avoid having
* to worry about server codepages.
*/
} else /* no conversion needed */
servername = tmp2;
if (error)
return (error);
if (sharetype == SMB_ST_NONE) {
*next = p;
return (0);
}
return (EINVAL);
}
if (error) {
if (error) {
"unexpected end of line"), 0);
return (error);
}
}
return (EINVAL);
}
*next = p;
if (*p1 == 0)
return (0);
return (error);
}
int
{
"invalid local charset specification (%s)"), 0, arg);
return (EINVAL);
}
"invalid server charset specification (%s)"), 0, arg);
return (EINVAL);
}
if (error == 0)
return (0);
"can't initialize iconv support (%s:%s)"),
localcs[0] = 0;
servercs[0] = 0;
return (error);
}
int
{
return (ENOMEM);
return (0);
}
/*
* XXX TODO FIXME etc etc
* If the call to nbns_getnodestatus(...) fails we can try one of two other
* methods; use a name of "*SMBSERVER", which is supported by Samba (at least)
* or, as a last resort, try the "truncate-at-dot" heuristic.
* And the heuristic really should attempt truncation at
* each dot in turn, left to right.
*
* These fallback heuristics should be triggered when the attempt to open the
* session fails instead of in the code below.
*
*/
int
{
int error;
#if 0
char *dot;
#endif
if (error == 0) {
/*
* Used to set our domain name to be the same as
* the server's domain name. Unnecessary at best,
* and wrong for accounts in a trusted domain.
*/
#ifdef APPLE
#endif
if (server[0])
} else {
if (smb_verbose)
"Failed to get NetBIOS node status."), 0);
}
#if 0
if (server[0] == (char)0) {
if (dot)
*dot = '\0';
/*
* don't uppercase the server name. it comes from
* NBNS and uppercasing can clobber the characters
*/
error = 0;
} else {
error = -1;
}
if (dot)
*dot = '.';
}
#endif
return (error);
}
/* this routine does not uppercase the server name */
void
{
/* don't uppercase the server name */
} else
}
int
{
"user name '%s' too long"), 0, name);
return (ENAMETOOLONG);
}
/*
* Don't overwrite a value from the command line
* with one from anywhere else.
*/
return (0);
/* don't uppercase the username, just copy it. */
/* Mark this as "from the command line". */
if (from_cmd)
return (0);
}
/*
* Never uppercase the workgroup
* name here, because it might come
* from a Windows codepage encoding.
*
* Don't overwrite a domain name from the
* command line with one from anywhere else.
* See smb_ctx_init() for notes about this.
*/
int
{
"workgroup name '%s' too long"), 0, name);
return (ENAMETOOLONG);
}
/*
* Don't overwrite a value from the command line
* with one from anywhere else.
*/
return (0);
/* Mark this as "from the command line". */
if (from_cmd)
return (0);
}
int
{
return (EINVAL);
return (ENAMETOOLONG);
}
/*
* Don't overwrite a value from the command line
* with one from anywhere else.
*/
return (0);
else
/* Mark this as "from the command line". */
if (from_cmd)
return (0);
}
int
{
"share name '%s' too long"), 0, share);
return (ENAMETOOLONG);
}
if (ctx->ct_origshare)
return (ENOMEM);
if (share[0] != 0)
return (0);
}
int
{
return (EINVAL);
if (ctx->ct_srvaddr)
return (ENOMEM);
return (0);
}
static int
{
char buf[NSS_BUFLEN_PASSWD];
char *cp;
if (cp) {
*cp++ = '\0';
if (*cp) {
} else
"Invalid group name %s, ignored"), 0, cp);
}
}
if (*pair) {
} else
"Invalid user name %s, ignored"), 0, pair);
}
return (0);
}
/*
* Commands use this with getopt. See:
* STDPARAM_OPT, STDPARAM_ARGS
* Called after smb_ctx_readrc().
*/
int
{
int error = 0;
char *p, *cp;
char tmp[1024];
switch (opt) {
case 'A':
case 'U':
/* Handled in smb_ctx_init() */
break;
case 'I':
break;
case 'M':
if (*cp == '/') {
}
break;
case 'N':
break;
case 'O':
if (cp) {
*cp++ = '\0';
}
if (*p && error == 0) {
}
free(p);
break;
case 'P':
/* ctx->ct_ssn.ioc_opt |= SMBCOPT_PERMANENT; */
break;
case 'R':
break;
case 'T':
break;
case 'W':
break;
}
return (error);
}
#if 0
static void
int ofs = 0;
while (len--) {
if (ofs % 16 == 0)
ofs++;
}
printf("\n");
}
#endif
static int
{
int error;
/*
* Not able to find out what is the work of this routine till
* now. Still investigating.
* REVISIT
*/
#ifdef KICONV_SUPPORT
"can not setup kernel iconv table (%s:%s)"),
return (error);
}
#endif
return (0);
}
/*
* Verify context before connect operation(s),
* lookup specified server and try to fill all forgotten fields.
*/
int
{
char *cp;
uint_t i;
int error = 0;
int renego = 0;
if (isatty(STDIN_FILENO))
browseok = 0;
"no server name specified"), 0);
return (EINVAL);
}
!browseok) {
"no share name specified for %s@%s"),
return (EINVAL);
}
if (error)
return (error);
if (ssn->ioc_localcs[0] == 0)
if (error)
return (error);
if (error)
return (error);
if (ssn->ioc_servercs[0] != 0) {
for (i = 0; i < sizeof (cstbl); i++)
cstbl[i] = i;
cstbl);
if (error)
return (error);
for (i = 0; i < sizeof (cstbl); i++)
cstbl[i] = i;
cstbl);
if (error)
return (error);
}
/*
* If we have an explicit address set for the server in
* an "addr=X" setting in .nsmbrc or SMF, just try using a
* gethostbyname() lookup for it.
*/
if (ctx->ct_srvaddr) {
if (error == 0)
} else
error = -1;
/*
* Next try a gethostbyname() lookup on the original user-
* specified server name. This is similar to Windows
* NBT option "Use DNS for name resolution."
*/
if (error == 0)
}
/*
* Finally, try the shorter, upper-cased ssn->ioc_srvname
* true (the default). nbns_resolvename() may unicast to the
* "nbns" server or broadcast on the subnet.
*/
/*
* Used to get the NetBIOS node status here.
* Not necessary (we have the NetBIOS name).
*/
}
if (error) {
"can't get server address"), error);
return (error);
}
/* XXX: no nls_str_upper(ssn->ioc_srvname) here? */
if (error) {
"can't allocate server address"), error);
return (error);
}
/* We know it's a NetBIOS address here. */
sizeof (struct sockaddr_nb));
if (ctx->ct_locname[0] == 0) {
SMB_MAXUSERNAMELEN + 1);
if (error) {
"can't get local name"), error);
return (error);
}
}
/* XXX: no nls_str_upper(ctx->ct_locname); here? */
if (error) {
"can't allocate local address"), error);
return (error);
}
/* We know it's a NetBIOS address here. */
sizeof (struct sockaddr_nb));
ssn->ioc_workgroup);
if (error)
return (error);
/* assert: anon share list is subset of overall server shares */
if (error) /* user cancel or other error? */
return (error);
/*
* A share was selected, authenticate button was pressed,
* or anon-authentication failed getting browse list.
*/
}
/*
* This function is implemented in both
* ui-apple.c and ui-sun.c so let's try to
* keep the same interface. Not sure why
* they didn't just pass ssn here.
*/
if (error)
return (error);
}
/*
* if we have a session it is either anonymous
* or from a stale authentication. re-negotiating
* gets us ready for a fresh session
*/
renego = 0;
/* don't clobber workgroup name, pass null arg */
if (error)
return (error);
}
"smb_ctx_resolve: bad keychain entry"), 0);
renego = 1;
goto reauth;
}
if (error) /* auth, user cancel, or other error */
return (error);
/*
* Re-authenticate button was pressed?
*/
goto reauth;
"no share specified for %s@%s"),
return (EINVAL);
}
}
if (smb_debug)
return (0);
}
int
{
char buf[20];
/*
* First try to open as clone
*/
if (fd >= 0)
goto opened;
#ifdef APPLE
/*
* well, no clone capabilities available - we have to scan
* all devices in order to get free one
*/
for (i = 0; i < 1024; i++) {
if (fd >= 0)
goto opened;
if (i && POWEROF2(i+1))
}
#endif
return (-1);
/*
* Check the driver version (paranoia)
* Do this BEFORE any other ioctl calls.
*/
"failed to get driver version"), err);
return (-1);
}
if (version != NSMB_VERSION) {
"incorrect driver version"), 0);
return (-1);
}
return (fd);
}
static int
{
}
fd = smb_open_driver();
if (fd < 0)
return (ENODEV);
return (0);
}
int
{
int rc = 0;
int i;
return (ENOMEM);
/* Note: No longer put length in outtok[0] */
/* *((int *)rqp->ioc_ssn.ioc_outtok) = (int)siz; */
goto out;
}
goto out;
/*
* Operation completed, but our output token wasn't large enough.
* The re-call below only pulls the token from the kernel.
*/
goto out;
}
/* Note: No longer put length in outtok[0] */
/* *((int *)rqp->ioc_ssn.ioc_outtok) = siz; */
out:
return (rc);
}
/*
* adds a GSSAPI wrapper
*/
char *
{
char *failure;
uchar_t *b;
goto out;
b = blob;
b += ASNDerWriteOID(b, spnego_mech_oid_Kerberos_V5);
b += sizeof (krbapreq);
goto out;
out:;
return (failure);
}
/*
* Initialization for Kerberos, pulled out of smb_ctx_principal2tkt.
* This just gets our cached credentials, if we have any.
* Based on the "klist" command.
*/
char *
{
char *failure;
if (kerr) {
failure = "krb5_init_context";
goto out;
}
/* non-default would instead use krb5_cc_resolve */
if (kerr) {
failure = "krb5_cc_default";
goto out;
}
/*
* Get the client principal (ticket),
* or find out if we don't have one.
*/
if (kerr) {
failure = "krb5_cc_get_principal";
goto out;
}
if (smb_verbose) {
}
out:
return (failure);
}
/*
* See "Windows 2000 Kerberos Interoperability" paper by
* Christopher Nebergall. RC4 HMAC is the W2K default but
* Samba support lagged (not due to Samba itself, but due to OS'
* Kerberos implementations.)
*
* Only session enc type should matter, not ticket enc type,
* per Sam Hartman on krbdev.
*
* Preauthentication failure topics in krb-protocol may help here...
*/
static krb5_enctype kenctypes[] = {
ENCTYPE_ARCFOUR_HMAC, /* defined in Tiger krb5.h */
};
/*
* Obtain a kerberos ticket...
* (if TLD != "gov" then pray first)
*/
char *
{
char *failure;
/* These shoud have been done in smb_ctx_krb5init() */
failure = "smb_ctx_krb5init";
goto out;
}
failure = "krb5_set_default_tgs_enctypes";
goto out;
/*
* The following is an unrolling of krb5_mk_req. Something like:
* krb5_mk_req(kctx, &kauth, 0, service(prin), hostname(prin),
* &kdata0, kcc, &kdata);)
* ...except we needed krb5_parse_name not krb5_sname_to_principal.
*/
failure = "krb5_parse_name";
goto out;
failure = "krb5_copy_principal(server)";
goto out;
failure = "krb5_copy_principal(client)";
goto out;
failure = "krb5_get_credentials";
goto out;
failure = "krb5_mk_req_extended";
&kdata)))
goto out;
failure = "malloc";
goto out;
}
out:;
if (kerr) {
if (!failure)
failure = "smb_ctx_principal2tkt";
/*
* Avoid logging the typical "No credentials cache found"
*/
if (kerr != KRB5_FCC_NOFILE ||
}
if (kauth)
if (kcredsp)
if (kprin)
/* Free kctx in smb_ctx_done */
return (failure);
}
char *
char *prin)
{
int rc = 0;
char *failure;
goto out;
goto out;
/*
* RFC says to send NegTokenTarg now. So does MS docs. But
* win2k gives ERRbaduid if we do... we must send
* another NegTokenInit now!
*/
failure = "spnegoCreateNegTokenInit";
goto out;
failure = "spnegoTokenGetBinary(NULL)";
if (rc != SPNEGO_E_BUFFER_TOO_SMALL)
goto out;
failure = "malloc";
goto out;
/* No longer store length at start of blob. */
/* *blob = bloblen; */
failure = "spnegoTokenGetBinary";
goto out;
out:;
if (rc) {
/* XXX better is to embed rc in failure */
"spnego principal2blob error %d"), 0, -rc);
if (!failure)
failure = "spnego";
}
if (stok)
if (gtok)
if (tkt)
return (failure);
}
#if 0
void
{
while (len--)
}
#endif
/*
* We navigate the SPNEGO & ASN1 encoding to find a kerberos principal
* Note: driver no longer puts length at start of blob.
*/
char *
char **prinp)
{
int rc = 0;
int indx = 0;
char *failure;
unsigned long plen = 0;
#if 0
#endif
/* Skip the GUID */
blob += SMB_GUIDLEN;
len -= SMB_GUIDLEN;
failure = "spnegoInitFromBinary";
goto out;
/*
* Needn't use new Kerberos OID - the Legacy one is fine.
*/
failure = "spnegoIsMechTypeAvailable";
&indx))
goto out;
/*
* Ignoring optional context flags for now. May want to pass
* them to krb5 layer. XXX
*/
"spnego context flags 0x%x\n"), flags);
failure = "spnegoGetMechListMIC(NULL)";
if (rc != SPNEGO_E_BUFFER_TOO_SMALL)
goto out;
failure = "malloc";
goto out;
failure = "spnegoGetMechListMIC";
goto out;
}
out:;
if (stok)
if (rc) {
/* XXX better is to embed rc in failure */
"spnego blob2principal error %d"), 0, -rc);
if (!failure)
failure = "spnego";
}
return (failure);
}
int
{
struct smbioc_lookup rq;
int error = 0;
char c;
int i;
/*
* We leave ct_secblob set iff extended security
* negotiation succeeds.
*/
if (ctx->ct_secblob) {
}
#ifdef XXX
"smb_ctx_lookup() data is not resolved"), 0);
return (EINVAL);
}
#endif
return (error);
/*
* Find out if we have a Kerberos ticket,
* and only offer SPNEGO if we have one.
*/
if (failure) {
if (smb_verbose)
goto out;
}
if (error) {
return (error);
goto out;
}
/*
* If the server capabilities did not include
* SMB_CAP_EXT_SECURITY then the driver clears
* the flag SMBVOPT_EXT_SEC for us.
* XXX: should add the capabilities to ioc_ssn
* XXX: see comment in driver - smb_usr.c
*/
if (smb_verbose)
/*
* Do regular (old style) NTLM or NTLMv2
* Nothing more to do here in negotiate.
*/
return (0);
}
/*
* Capabilities DO include SMB_CAP_EXT_SECURITY,
* so this should be an SPNEGO security blob.
* XXX: Handle STATUS_MORE_PROCESSING_REQUIRED?
* XXX: Requires additional session setup calls.
*/
goto out;
/* some servers send padding junk */
if (blob[0] == 0)
goto out;
if (failure)
goto out;
if (failure)
goto out;
/* Success! Save the blob to send next. */
out:
if (principal)
if (!failure)
return (0); /* Success! */
/*
* Negotiate failed with "extended security".
*
* XXX: If we are doing SPNEGO correctly,
* we should never get here unless the user
* supplied invalid authentication data,
* or we saw some kind of protocol error.
*
* XXX: The error message below should be
* XXX: unconditional (remove "if verbose")
* XXX: but not until we have "NTLMSSP"
* Avoid spew for anticipated failure modes
* but enable this with the verbose flag
*/
if (smb_verbose) {
}
/*
* XXX: Try again using NTLM (or NTLMv2)
* XXX: Normal clients don't do this.
* XXX: Should just return an error, but
* keep the fall-back to NTLM for now.
*
* Start over with a new connection.
*/
return (error);
/* Note: NO SMBVOPT_EXT_SEC */
if (error) {
return (error);
}
/*
* Used to copy the workgroup out of the SMB_NEGOTIATE response
* here, to default our domain name to be the same as the server.
* Not a good idea: Unnecessary at best, and sometimes wrong, i.e.
* when our account is in a trusted domain.
*/
return (error);
}
int
{
int error = 0;
"tree disconnect without handle?!"), 0);
return (EINVAL);
}
"tree disconnect without session?!"), 0);
return (EINVAL);
}
"tree disconnect failed"), error);
}
return (error);
}
int
{
struct smbioc_lookup rq;
int error = 0;
"smb_ctx_lookup() data is not resolved"), 0);
return (EINVAL);
}
"handle from smb_ctx_nego() gone?!"), 0);
return (EINVAL);
}
if (!(flags & SMBLK_CREATE))
return (0);
/*
* Iff we have a security blob, we're using
* extended security...
*/
if (ctx->ct_secblob) {
}
if (error) {
"session setup failed");
} else {
"tree connect failed");
}
if (!failure)
return (0);
/* unwise to failback to NTLM now */
return (error);
}
/*
* Otherwise we're doing plain old NTLM
*/
/*
* This is the magic that tells the driver to
* copy the password from the keychain, and
* whether to use the system name or the
* account domain to lookup the keychain.
*/
goto out;
}
}
}
out:
if (failure) {
}
return (error);
}
/*
* Return the hflags2 word for an smb_ctx.
*/
int
{
"can't get flags2 for a session"), errno);
return (-1);
}
return (flags2);
}
/*
* level values:
* 0 - default
* 1 - server
* 2 - server:user
* 3 - server:user:share
*/
static int
{
char *p;
int error;
#ifdef NOT_DEFINED
if (level > 0) {
if (p) {
if (error)
"charset specification in the section '%s' ignored"),
}
}
#endif
if (level <= 1) {
/* Section is: [default] or [server] */
#ifdef NOT_DEFINED
if (p && strcmp(p, "NO") == 0)
#endif
if (p) {
/*
* "minauth" was set in this section; override
* the current minimum authentication setting.
*/
if (strcmp(p, "kerberos") == 0) {
/*
* Don't fall back to NTLMv2, NTLMv1, or
* a clear text password.
*/
} else if (strcmp(p, "ntlmv2") == 0) {
/*
* Don't fall back to NTLMv1 or a clear
* text password.
*/
} else if (strcmp(p, "ntlm") == 0) {
/*
* Don't send the LM response over the wire.
*/
} else if (strcmp(p, "lm") == 0) {
/*
* Fail if the server doesn't do encrypted
* passwords.
*/
} else if (strcmp(p, "none") == 0) {
/*
* Anything goes.
* (The following statement should be
* optimized away.)
*/
/* LINTED */
} else {
/*
* Unknown minimum authentication level.
*/
"invalid minimum authentication level \"%s\" specified in the section %s"),
0, p, sname);
return (EINVAL);
}
}
/*
* Domain name. Allow both keywords:
* "workgroup", "domain"
*
* Note: these are NOT marked "from CMD".
* See long comment at smb_ctx_init()
*/
if (p) {
nls_str_upper(p, p);
if (error)
"workgroup specification in the "
}
if (p) {
nls_str_upper(p, p);
if (error)
"domain specification in the "
}
if (p) {
if (error)
"user specification in the "
}
}
if (level == 1) {
/* Section is: [server] */
if (p) {
if (error) {
"invalid address specified in section %s"),
0, sname);
return (error);
}
}
}
if (p) {
if (error)
"password specification in the section '%s' ignored"),
}
return (0);
}
/*
* read rc file as follows:
* 0: read [default] section
* 1: override with [server] section
* 2: override with [server:user] section
* 3: override with [server:user:share] section
* Since absence of rcfile is not fatal, silently ignore this fact.
* smb_rc file should be closed by caller.
*/
int
{
SMB_MAXSHARENAMELEN + 4];
if (smb_open_rcfile(ctx) != 0)
goto done;
/*
* default parameters (level=0)
*/
/*
* If we don't have a server name, we can't read any of the
* [server...] sections.
*/
goto done;
/*
* SERVER parameters.
*/
/*
* If we don't have a user name, we can't read any of the
* [server:user...] sections.
*/
goto done;
/*
* SERVER:USER parameters
*/
/*
* If we don't have a share name, we can't read any of the
* [server:user:share] sections.
*/
/*
* SERVER:USER:SHARE parameters
*/
}
done:
if (smb_debug)
return (0);
}