source3/smbd/negprot.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    negprot reply code
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23 #include "../libcli/auth/spnego.h"
  24
  25 extern fstring remote_proto;
  26 extern enum protocol_types Protocol;
  27
  28 static void get_challenge(uint8 buff[8])
  29 {
  30         NTSTATUS nt_status;
  31         struct smbd_server_connection *sconn = smbd_server_conn;
  32
  33         /* We might be called more than once, multiple negprots are
  34          * permitted */
  35         if (sconn->smb1.negprot.auth_context) {
  36                 DEBUG(3, ("get challenge: is this a secondary negprot? "
  37                           "sconn->negprot.auth_context is non-NULL!\n"));
  38                         sconn->smb1.negprot.auth_context->free(
  39                                 &sconn->smb1.negprot.auth_context);
  40         }
  41
  42         DEBUG(10, ("get challenge: creating negprot_global_auth_context\n"));
  43         nt_status = make_auth_context_subsystem(
  44                 &sconn->smb1.negprot.auth_context);
  45         if (!NT_STATUS_IS_OK(nt_status)) {
  46                 DEBUG(0, ("make_auth_context_subsystem returned %s",
  47                           nt_errstr(nt_status)));
  48                 smb_panic("cannot make_negprot_global_auth_context!");
  49         }
  50         DEBUG(10, ("get challenge: getting challenge\n"));
  51         sconn->smb1.negprot.auth_context->get_ntlm_challenge(
  52                 sconn->smb1.negprot.auth_context, buff);
  53 }
  54
  55 /****************************************************************************
  56  Reply for the core protocol.
  57 ****************************************************************************/
  58
  59 static void reply_corep(struct smb_request *req, uint16 choice)
  60 {
  61         reply_outbuf(req, 1, 0);
  62         SSVAL(req->outbuf, smb_vwv0, choice);
  63
  64         Protocol = PROTOCOL_CORE;
  65 }
  66
  67 /****************************************************************************
  68  Reply for the coreplus protocol.
  69 ****************************************************************************/
  70
  71 static void reply_coreplus(struct smb_request *req, uint16 choice)
  72 {
  73         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
  74
  75         reply_outbuf(req, 13, 0);
  76
  77         SSVAL(req->outbuf,smb_vwv0,choice);
  78         SSVAL(req->outbuf,smb_vwv5,raw); /* tell redirector we support
  79                         readbraw and writebraw (possibly) */
  80         /* Reply, SMBlockread, SMBwritelock supported. */
  81         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
  82         SSVAL(req->outbuf,smb_vwv1,0x1); /* user level security, don't
  83                                           * encrypt */
  84         Protocol = PROTOCOL_COREPLUS;
  85 }
  86
  87 /****************************************************************************
  88  Reply for the lanman 1.0 protocol.
  89 ****************************************************************************/
  90
  91 static void reply_lanman1(struct smb_request *req, uint16 choice)
  92 {
  93         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
  94         int secword=0;
  95         time_t t = time(NULL);
  96         struct smbd_server_connection *sconn = smbd_server_conn;
  97
  98         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
  99
 100         if (lp_security()>=SEC_USER) {
 101                 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 102         }
 103         if (sconn->smb1.negprot.encrypted_passwords) {
 104                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 105         }
 106
 107         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
 108
 109         SSVAL(req->outbuf,smb_vwv0,choice);
 110         SSVAL(req->outbuf,smb_vwv1,secword);
 111         /* Create a token value and add it to the outgoing packet. */
 112         if (sconn->smb1.negprot.encrypted_passwords) {
 113                 get_challenge((uint8 *)smb_buf(req->outbuf));
 114                 SSVAL(req->outbuf,smb_vwv11, 8);
 115         }
 116
 117         Protocol = PROTOCOL_LANMAN1;
 118
 119         /* Reply, SMBlockread, SMBwritelock supported. */
 120         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
 121         SSVAL(req->outbuf,smb_vwv2,sconn->smb1.negprot.max_recv);
 122         SSVAL(req->outbuf,smb_vwv3,lp_maxmux()); /* maxmux */
 123         SSVAL(req->outbuf,smb_vwv4,1);
 124         SSVAL(req->outbuf,smb_vwv5,raw); /* tell redirector we support
 125                 readbraw writebraw (possibly) */
 126         SIVAL(req->outbuf,smb_vwv6,sys_getpid());
 127         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
 128
 129         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 130
 131         return;
 132 }
 133
 134 /****************************************************************************
 135  Reply for the lanman 2.0 protocol.
 136 ****************************************************************************/
 137
 138 static void reply_lanman2(struct smb_request *req, uint16 choice)
 139 {
 140         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
 141         int secword=0;
 142         time_t t = time(NULL);
 143         struct smbd_server_connection *sconn = smbd_server_conn;
 144
 145         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 146
 147         if (lp_security()>=SEC_USER) {
 148                 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 149         }
 150         if (sconn->smb1.negprot.encrypted_passwords) {
 151                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 152         }
 153
 154         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
 155
 156         SSVAL(req->outbuf,smb_vwv0,choice);
 157         SSVAL(req->outbuf,smb_vwv1,secword);
 158         SIVAL(req->outbuf,smb_vwv6,sys_getpid());
 159
 160         /* Create a token value and add it to the outgoing packet. */
 161         if (sconn->smb1.negprot.encrypted_passwords) {
 162                 get_challenge((uint8 *)smb_buf(req->outbuf));
 163                 SSVAL(req->outbuf,smb_vwv11, 8);
 164         }
 165
 166         Protocol = PROTOCOL_LANMAN2;
 167
 168         /* Reply, SMBlockread, SMBwritelock supported. */
 169         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
 170         SSVAL(req->outbuf,smb_vwv2,sconn->smb1.negprot.max_recv);
 171         SSVAL(req->outbuf,smb_vwv3,lp_maxmux());
 172         SSVAL(req->outbuf,smb_vwv4,1);
 173         SSVAL(req->outbuf,smb_vwv5,raw); /* readbraw and/or writebraw */
 174         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
 175         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 176 }
 177
 178 /****************************************************************************
 179  Generate the spnego negprot reply blob. Return the number of bytes used.
 180 ****************************************************************************/
 181
 182 DATA_BLOB negprot_spnego(void)
 183 {
 184         DATA_BLOB blob;
 185         nstring dos_name;
 186         fstring unix_name;
 187 #ifdef DEVELOPER
 188         size_t slen;
 189 #endif
 190         char guid[17];
 191         const char *OIDs_krb5[] = {OID_KERBEROS5,
 192                                    OID_KERBEROS5_OLD,
 193                                    OID_NTLMSSP,
 194                                    NULL};
 195         const char *OIDs_plain[] = {OID_NTLMSSP, NULL};
 196         struct smbd_server_connection *sconn = smbd_server_conn;
 197
 198         sconn->smb1.negprot.spnego = true;
 199
 200         memset(guid, '\0', sizeof(guid));
 201
 202         safe_strcpy(unix_name, global_myname(), sizeof(unix_name)-1);
 203         strlower_m(unix_name);
 204         push_ascii_nstring(dos_name, unix_name);
 205         safe_strcpy(guid, dos_name, sizeof(guid)-1);
 206
 207 #ifdef DEVELOPER
 208         /* Fix valgrind 'uninitialized bytes' issue. */
 209         slen = strlen(dos_name);
 210         if (slen < sizeof(guid)) {
 211                 memset(guid+slen, '\0', sizeof(guid) - slen);
 212         }
 213 #endif
 214
 215         /* strangely enough, NT does not sent the single OID NTLMSSP when
 216            not a ADS member, it sends no OIDs at all
 217
 218            OLD COMMENT : "we can't do this until we teach our sesssion setup parser to know
 219                    about raw NTLMSSP (clients send no ASN.1 wrapping if we do this)"
 220
 221            Our sessionsetup code now handles raw NTLMSSP connects, so we can go
 222            back to doing what W2K3 does here. This is needed to make PocketPC 2003
 223            CIFS connections work with SPNEGO. See bugzilla bugs #1828 and #3133
 224            for details. JRA.
 225
 226         */
 227
 228         if (lp_security() != SEC_ADS && !USE_KERBEROS_KEYTAB) {
 229 #if 0
 230                 /* Code for PocketPC client */
 231                 blob = data_blob(guid, 16);
 232 #else
 233                 /* Code for standalone WXP client */
 234                 blob = spnego_gen_negTokenInit(guid, OIDs_plain, "NONE");
 235 #endif
 236         } else {
 237                 fstring myname;
 238                 char *host_princ_s = NULL;
 239                 name_to_fqdn(myname, global_myname());
 240                 strlower_m(myname);
 241                 if (asprintf(&host_princ_s, "cifs/%s@%s", myname, lp_realm())
 242                     == -1) {
 243                         return data_blob_null;
 244                 }
 245                 blob = spnego_gen_negTokenInit(guid, OIDs_krb5, host_princ_s);
 246                 SAFE_FREE(host_princ_s);
 247         }
 248
 249         return blob;
 250 }
 251
 252 /****************************************************************************
 253  Reply for the nt protocol.
 254 ****************************************************************************/
 255
 256 static void reply_nt1(struct smb_request *req, uint16 choice)
 257 {
 258         /* dual names + lock_and_read + nt SMBs + remote API calls */
 259         int capabilities = CAP_NT_FIND|CAP_LOCK_AND_READ|
 260                 CAP_LEVEL_II_OPLOCKS;
 261
 262         int secword=0;
 263         char *p, *q;
 264         bool negotiate_spnego = False;
 265         time_t t = time(NULL);
 266         ssize_t ret;
 267         struct smbd_server_connection *sconn = smbd_server_conn;
 268
 269         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 270
 271         /* Check the flags field to see if this is Vista.
 272            WinXP sets it and Vista does not. But we have to
 273            distinguish from NT which doesn't set it either. */
 274
 275         if ( (req->flags2 & FLAGS2_EXTENDED_SECURITY) &&
 276                 ((req->flags2 & FLAGS2_UNKNOWN_BIT4) == 0) )
 277         {
 278                 if (get_remote_arch() != RA_SAMBA) {
 279                         set_remote_arch( RA_VISTA );
 280                 }
 281         }
 282
 283         reply_outbuf(req,17,0);
 284
 285         /* do spnego in user level security if the client
 286            supports it and we can do encrypted passwords */
 287
 288         if (sconn->smb1.negprot.encrypted_passwords &&
 289             (lp_security() != SEC_SHARE) &&
 290             lp_use_spnego() &&
 291             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
 292                 negotiate_spnego = True;
 293                 capabilities |= CAP_EXTENDED_SECURITY;
 294                 add_to_common_flags2(FLAGS2_EXTENDED_SECURITY);
 295                 /* Ensure FLAGS2_EXTENDED_SECURITY gets set in this reply
 296                    (already partially constructed. */
 297                 SSVAL(req->outbuf, smb_flg2,
 298                       req->flags2 | FLAGS2_EXTENDED_SECURITY);
 299         }
 300
 301         capabilities |= CAP_NT_SMBS|CAP_RPC_REMOTE_APIS|CAP_UNICODE;
 302
 303         if (lp_unix_extensions()) {
 304                 capabilities |= CAP_UNIX;
 305         }
 306
 307         if (lp_large_readwrite() && (SMB_OFF_T_BITS == 64))
 308                 capabilities |= CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_W2K_SMBS;
 309
 310         if (SMB_OFF_T_BITS == 64)
 311                 capabilities |= CAP_LARGE_FILES;
 312
 313         if (lp_readraw() && lp_writeraw())
 314                 capabilities |= CAP_RAW_MODE;
 315
 316         if (lp_nt_status_support())
 317                 capabilities |= CAP_STATUS32;
 318
 319         if (lp_host_msdfs())
 320                 capabilities |= CAP_DFS;
 321
 322         if (lp_security() >= SEC_USER) {
 323                 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 324         }
 325         if (sconn->smb1.negprot.encrypted_passwords) {
 326                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 327         }
 328
 329         if (lp_server_signing()) {
 330                 if (lp_security() >= SEC_USER) {
 331                         secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
 332                         /* No raw mode with smb signing. */
 333                         capabilities &= ~CAP_RAW_MODE;
 334                         if (lp_server_signing() == Required)
 335                                 secword |=NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
 336                         srv_set_signing_negotiated(smbd_server_conn);
 337                 } else {
 338                         DEBUG(0,("reply_nt1: smb signing is incompatible with share level security !\n"));
 339                         if (lp_server_signing() == Required) {
 340                                 exit_server_cleanly("reply_nt1: smb signing required and share level security selected.");
 341                         }
 342                 }
 343         }
 344
 345         SSVAL(req->outbuf,smb_vwv0,choice);
 346         SCVAL(req->outbuf,smb_vwv1,secword);
 347
 348         Protocol = PROTOCOL_NT1;
 349
 350         SSVAL(req->outbuf,smb_vwv1+1,lp_maxmux()); /* maxmpx */
 351         SSVAL(req->outbuf,smb_vwv2+1,1); /* num vcs */
 352         SIVAL(req->outbuf,smb_vwv3+1,
 353               sconn->smb1.negprot.max_recv); /* max buffer. LOTS! */
 354         SIVAL(req->outbuf,smb_vwv5+1,0x10000); /* raw size. full 64k */
 355         SIVAL(req->outbuf,smb_vwv7+1,sys_getpid()); /* session key */
 356         SIVAL(req->outbuf,smb_vwv9+1,capabilities); /* capabilities */
 357         put_long_date((char *)req->outbuf+smb_vwv11+1,t);
 358         SSVALS(req->outbuf,smb_vwv15+1,set_server_zone_offset(t)/60);
 359
 360         p = q = smb_buf(req->outbuf);
 361         if (!negotiate_spnego) {
 362                 /* Create a token value and add it to the outgoing packet. */
 363                 if (sconn->smb1.negprot.encrypted_passwords) {
 364                         uint8 chal[8];
 365                         /* note that we do not send a challenge at all if
 366                            we are using plaintext */
 367                         get_challenge(chal);
 368                         ret = message_push_blob(
 369                                 &req->outbuf, data_blob_const(chal, sizeof(chal)));
 370                         if (ret == -1) {
 371                                 DEBUG(0, ("Could not push challenge\n"));
 372                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 373                                 return;
 374                         }
 375                         SCVAL(req->outbuf, smb_vwv16+1, ret);
 376                         p += ret;
 377                 }
 378                 ret = message_push_string(&req->outbuf, lp_workgroup(),
 379                                           STR_UNICODE|STR_TERMINATE
 380                                           |STR_NOALIGN);
 381                 if (ret == -1) {
 382                         DEBUG(0, ("Could not push challenge\n"));
 383                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 384                         return;
 385                 }
 386                 DEBUG(3,("not using SPNEGO\n"));
 387         } else {
 388                 DATA_BLOB spnego_blob = negprot_spnego();
 389
 390                 if (spnego_blob.data == NULL) {
 391                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 392                         return;
 393                 }
 394
 395                 ret = message_push_blob(&req->outbuf, spnego_blob);
 396                 if (ret == -1) {
 397                         DEBUG(0, ("Could not push spnego blob\n"));
 398                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 399                         return;
 400                 }
 401                 p += ret;
 402                 data_blob_free(&spnego_blob);
 403
 404                 SCVAL(req->outbuf,smb_vwv16+1, 0);
 405                 DEBUG(3,("using SPNEGO\n"));
 406         }
 407
 408         SSVAL(req->outbuf,smb_vwv17, p - q); /* length of challenge+domain
 409                                               * strings */
 410
 411         return;
 412 }
 413
 414 /* these are the protocol lists used for auto architecture detection:
 415
 416 WinNT 3.51:
 417 protocol [PC NETWORK PROGRAM 1.0]
 418 protocol [XENIX CORE]
 419 protocol [MICROSOFT NETWORKS 1.03]
 420 protocol [LANMAN1.0]
 421 protocol [Windows for Workgroups 3.1a]
 422 protocol [LM1.2X002]
 423 protocol [LANMAN2.1]
 424 protocol [NT LM 0.12]
 425
 426 Win95:
 427 protocol [PC NETWORK PROGRAM 1.0]
 428 protocol [XENIX CORE]
 429 protocol [MICROSOFT NETWORKS 1.03]
 430 protocol [LANMAN1.0]
 431 protocol [Windows for Workgroups 3.1a]
 432 protocol [LM1.2X002]
 433 protocol [LANMAN2.1]
 434 protocol [NT LM 0.12]
 435
 436 Win2K:
 437 protocol [PC NETWORK PROGRAM 1.0]
 438 protocol [LANMAN1.0]
 439 protocol [Windows for Workgroups 3.1a]
 440 protocol [LM1.2X002]
 441 protocol [LANMAN2.1]
 442 protocol [NT LM 0.12]
 443
 444 Vista:
 445 protocol [PC NETWORK PROGRAM 1.0]
 446 protocol [LANMAN1.0]
 447 protocol [Windows for Workgroups 3.1a]
 448 protocol [LM1.2X002]
 449 protocol [LANMAN2.1]
 450 protocol [NT LM 0.12]
 451 protocol [SMB 2.001]
 452
 453 OS/2:
 454 protocol [PC NETWORK PROGRAM 1.0]
 455 protocol [XENIX CORE]
 456 protocol [LANMAN1.0]
 457 protocol [LM1.2X002]
 458 protocol [LANMAN2.1]
 459 */
 460
 461 /*
 462   * Modified to recognize the architecture of the remote machine better.
 463   *
 464   * This appears to be the matrix of which protocol is used by which
 465   * MS product.
 466        Protocol                       WfWg    Win95   WinNT  Win2K  OS/2 Vista
 467        PC NETWORK PROGRAM 1.0          1       1       1      1      1     1
 468        XENIX CORE                                      2             2
 469        MICROSOFT NETWORKS 3.0          2       2
 470        DOS LM1.2X002                   3       3
 471        MICROSOFT NETWORKS 1.03                         3
 472        DOS LANMAN2.1                   4       4
 473        LANMAN1.0                                       4      2      3     2
 474        Windows for Workgroups 3.1a     5       5       5      3            3
 475        LM1.2X002                                       6      4      4     4
 476        LANMAN2.1                                       7      5      5     5
 477        NT LM 0.12                              6       8      6            6
 478        SMB 2.001                                                           7
 479   *
 480   *  tim@fsg.com 09/29/95
 481   *  Win2K added by matty 17/7/99
 482   */
 483
 484 #define ARCH_WFWG     0x3      /* This is a fudge because WfWg is like Win95 */
 485 #define ARCH_WIN95    0x2
 486 #define ARCH_WINNT    0x4
 487 #define ARCH_WIN2K    0xC      /* Win2K is like NT */
 488 #define ARCH_OS2      0x14     /* Again OS/2 is like NT */
 489 #define ARCH_SAMBA    0x20
 490 #define ARCH_CIFSFS   0x40
 491 #define ARCH_VISTA    0x8C     /* Vista is like XP/2K */
 492
 493 #define ARCH_ALL      0x7F
 494
 495 /* List of supported protocols, most desired first */
 496 static const struct {
 497         const char *proto_name;
 498         const char *short_name;
 499         void (*proto_reply_fn)(struct smb_request *req, uint16 choice);
 500         int protocol_level;
 501 } supported_protocols[] = {
 502         {"SMB 2.002",               "SMB2",     reply_smb2002,  PROTOCOL_SMB2},
 503         {"NT LANMAN 1.0",           "NT1",      reply_nt1,      PROTOCOL_NT1},
 504         {"NT LM 0.12",              "NT1",      reply_nt1,      PROTOCOL_NT1},
 505         {"POSIX 2",                 "NT1",      reply_nt1,      PROTOCOL_NT1},
 506         {"LANMAN2.1",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 507         {"LM1.2X002",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 508         {"Samba",                   "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 509         {"DOS LM1.2X002",           "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 510         {"LANMAN1.0",               "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 511         {"MICROSOFT NETWORKS 3.0",  "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 512         {"MICROSOFT NETWORKS 1.03", "COREPLUS", reply_coreplus, PROTOCOL_COREPLUS},
 513         {"PC NETWORK PROGRAM 1.0",  "CORE",     reply_corep,    PROTOCOL_CORE},
 514         {NULL,NULL,NULL,0},
 515 };
 516
 517 /****************************************************************************
 518  Reply to a negprot.
 519  conn POINTER CAN BE NULL HERE !
 520 ****************************************************************************/
 521
 522 void reply_negprot(struct smb_request *req)
 523 {
 524         int choice= -1;
 525         int protocol;
 526         const char *p;
 527         int arch = ARCH_ALL;
 528         int num_cliprotos;
 529         char **cliprotos;
 530         int i;
 531         size_t converted_size;
 532         struct smbd_server_connection *sconn = smbd_server_conn;
 533
 534         START_PROFILE(SMBnegprot);
 535
 536         if (sconn->smb1.negprot.done) {
 537                 END_PROFILE(SMBnegprot);
 538                 exit_server_cleanly("multiple negprot's are not permitted");
 539         }
 540         sconn->smb1.negprot.done = true;
 541
 542         if (req->buflen == 0) {
 543                 DEBUG(0, ("negprot got no protocols\n"));
 544                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 545                 END_PROFILE(SMBnegprot);
 546                 return;
 547         }
 548
 549         if (req->buf[req->buflen-1] != '\0') {
 550                 DEBUG(0, ("negprot protocols not 0-terminated\n"));
 551                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 552                 END_PROFILE(SMBnegprot);
 553                 return;
 554         }
 555
 556         p = (const char *)req->buf + 1;
 557
 558         num_cliprotos = 0;
 559         cliprotos = NULL;
 560
 561         while (smbreq_bufrem(req, p) > 0) {
 562
 563                 char **tmp;
 564
 565                 tmp = TALLOC_REALLOC_ARRAY(talloc_tos(), cliprotos, char *,
 566                                            num_cliprotos+1);
 567                 if (tmp == NULL) {
 568                         DEBUG(0, ("talloc failed\n"));
 569                         TALLOC_FREE(cliprotos);
 570                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 571                         END_PROFILE(SMBnegprot);
 572                         return;
 573                 }
 574
 575                 cliprotos = tmp;
 576
 577                 if (!pull_ascii_talloc(cliprotos, &cliprotos[num_cliprotos], p,
 578                                        &converted_size)) {
 579                         DEBUG(0, ("pull_ascii_talloc failed\n"));
 580                         TALLOC_FREE(cliprotos);
 581                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 582                         END_PROFILE(SMBnegprot);
 583                         return;
 584                 }
 585
 586                 DEBUG(3, ("Requested protocol [%s]\n",
 587                           cliprotos[num_cliprotos]));
 588
 589                 num_cliprotos += 1;
 590                 p += strlen(p) + 2;
 591         }
 592
 593         for (i=0; i<num_cliprotos; i++) {
 594                 if (strcsequal(cliprotos[i], "Windows for Workgroups 3.1a"))
 595                         arch &= ( ARCH_WFWG | ARCH_WIN95 | ARCH_WINNT
 596                                   | ARCH_WIN2K );
 597                 else if (strcsequal(cliprotos[i], "DOS LM1.2X002"))
 598                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 599                 else if (strcsequal(cliprotos[i], "DOS LANMAN2.1"))
 600                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 601                 else if (strcsequal(cliprotos[i], "NT LM 0.12"))
 602                         arch &= ( ARCH_WIN95 | ARCH_WINNT | ARCH_WIN2K
 603                                   | ARCH_CIFSFS);
 604                 else if (strcsequal(cliprotos[i], "SMB 2.001"))
 605                         arch = ARCH_VISTA;
 606                 else if (strcsequal(cliprotos[i], "LANMAN2.1"))
 607                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 608                 else if (strcsequal(cliprotos[i], "LM1.2X002"))
 609                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 610                 else if (strcsequal(cliprotos[i], "MICROSOFT NETWORKS 1.03"))
 611                         arch &= ARCH_WINNT;
 612                 else if (strcsequal(cliprotos[i], "XENIX CORE"))
 613                         arch &= ( ARCH_WINNT | ARCH_OS2 );
 614                 else if (strcsequal(cliprotos[i], "Samba")) {
 615                         arch = ARCH_SAMBA;
 616                         break;
 617                 } else if (strcsequal(cliprotos[i], "POSIX 2")) {
 618                         arch = ARCH_CIFSFS;
 619                         break;
 620                 }
 621         }
 622
 623         /* CIFSFS can send one arch only, NT LM 0.12. */
 624         if (i == 1 && (arch & ARCH_CIFSFS)) {
 625                 arch = ARCH_CIFSFS;
 626         }
 627
 628         switch ( arch ) {
 629                 case ARCH_CIFSFS:
 630                         set_remote_arch(RA_CIFSFS);
 631                         break;
 632                 case ARCH_SAMBA:
 633                         set_remote_arch(RA_SAMBA);
 634                         break;
 635                 case ARCH_WFWG:
 636                         set_remote_arch(RA_WFWG);
 637                         break;
 638                 case ARCH_WIN95:
 639                         set_remote_arch(RA_WIN95);
 640                         break;
 641                 case ARCH_WINNT:
 642                         if(req->flags2 == FLAGS2_WIN2K_SIGNATURE)
 643                                 set_remote_arch(RA_WIN2K);
 644                         else
 645                                 set_remote_arch(RA_WINNT);
 646                         break;
 647                 case ARCH_WIN2K:
 648                         /* Vista may have been set in the negprot so don't
 649                            override it here */
 650                         if ( get_remote_arch() != RA_VISTA )
 651                                 set_remote_arch(RA_WIN2K);
 652                         break;
 653                 case ARCH_VISTA:
 654                         set_remote_arch(RA_VISTA);
 655                         break;
 656                 case ARCH_OS2:
 657                         set_remote_arch(RA_OS2);
 658                         break;
 659                 default:
 660                         set_remote_arch(RA_UNKNOWN);
 661                 break;
 662         }
 663
 664         /* possibly reload - change of architecture */
 665         reload_services(True);
 666
 667         /* moved from the netbios session setup code since we don't have that
 668            when the client connects to port 445.  Of course there is a small
 669            window where we are listening to messages   -- jerry */
 670
 671         claim_connection(
 672                 NULL,"",FLAG_MSG_GENERAL|FLAG_MSG_SMBD|FLAG_MSG_PRINT_GENERAL);
 673
 674         /* Check for protocols, most desirable first */
 675         for (protocol = 0; supported_protocols[protocol].proto_name; protocol++) {
 676                 i = 0;
 677                 if ((supported_protocols[protocol].protocol_level <= lp_maxprotocol()) &&
 678                                 (supported_protocols[protocol].protocol_level >= lp_minprotocol()))
 679                         while (i < num_cliprotos) {
 680                                 if (strequal(cliprotos[i],supported_protocols[protocol].proto_name))
 681                                         choice = i;
 682                                 i++;
 683                         }
 684                 if(choice != -1)
 685                         break;
 686         }
 687
 688         if(choice != -1) {
 689                 fstrcpy(remote_proto,supported_protocols[protocol].short_name);
 690                 reload_services(True);
 691                 supported_protocols[protocol].proto_reply_fn(req, choice);
 692                 DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
 693         } else {
 694                 DEBUG(0,("No protocol supported !\n"));
 695                 reply_outbuf(req, 1, 0);
 696                 SSVAL(req->outbuf, smb_vwv0, choice);
 697         }
 698
 699         DEBUG( 5, ( "negprot index=%d\n", choice ) );
 700
 701         if ((lp_server_signing() == Required) && (Protocol < PROTOCOL_NT1)) {
 702                 exit_server_cleanly("SMB signing is required and "
 703                         "client negotiated a downlevel protocol");
 704         }
 705
 706         TALLOC_FREE(cliprotos);
 707         END_PROFILE(SMBnegprot);
 708         return;
 709 }