2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
31 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
32 uint64_t in_session_id
,
33 uint8_t in_security_mode
,
34 DATA_BLOB in_security_buffer
,
35 uint16_t *out_session_flags
,
36 DATA_BLOB
*out_security_buffer
,
37 uint64_t *out_session_id
);
39 NTSTATUS
smbd_smb2_request_process_sesssetup(struct smbd_smb2_request
*smb2req
)
42 const uint8_t *inbody
;
43 int i
= smb2req
->current_idx
;
47 uint64_t in_session_id
;
48 uint8_t in_security_mode
;
49 uint16_t in_security_offset
;
50 uint16_t in_security_length
;
51 DATA_BLOB in_security_buffer
;
52 uint16_t out_session_flags
;
53 uint64_t out_session_id
;
54 uint16_t out_security_offset
;
55 DATA_BLOB out_security_buffer
= data_blob_null
;
58 status
= smbd_smb2_request_verify_sizes(smb2req
, 0x19);
59 if (!NT_STATUS_IS_OK(status
)) {
60 return smbd_smb2_request_error(smb2req
, status
);
62 inhdr
= (const uint8_t *)smb2req
->in
.vector
[i
+0].iov_base
;
63 inbody
= (const uint8_t *)smb2req
->in
.vector
[i
+1].iov_base
;
65 in_security_offset
= SVAL(inbody
, 0x0C);
66 in_security_length
= SVAL(inbody
, 0x0E);
68 if (in_security_offset
!= (SMB2_HDR_BODY
+ smb2req
->in
.vector
[i
+1].iov_len
)) {
69 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
72 if (in_security_length
> smb2req
->in
.vector
[i
+2].iov_len
) {
73 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
76 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
77 in_security_mode
= CVAL(inbody
, 0x03);
78 in_security_buffer
.data
= (uint8_t *)smb2req
->in
.vector
[i
+2].iov_base
;
79 in_security_buffer
.length
= in_security_length
;
81 status
= smbd_smb2_session_setup(smb2req
,
88 if (!NT_STATUS_IS_OK(status
) &&
89 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
90 status
= nt_status_squash(status
);
91 return smbd_smb2_request_error(smb2req
, status
);
94 out_security_offset
= SMB2_HDR_BODY
+ 0x08;
96 outhdr
= (uint8_t *)smb2req
->out
.vector
[i
].iov_base
;
98 outbody
= data_blob_talloc(smb2req
->out
.vector
, NULL
, 0x08);
99 if (outbody
.data
== NULL
) {
100 return smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
103 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, out_session_id
);
105 SSVAL(outbody
.data
, 0x00, 0x08 + 1); /* struct size */
106 SSVAL(outbody
.data
, 0x02,
107 out_session_flags
); /* session flags */
108 SSVAL(outbody
.data
, 0x04,
109 out_security_offset
); /* security buffer offset */
110 SSVAL(outbody
.data
, 0x06,
111 out_security_buffer
.length
); /* security buffer length */
113 outdyn
= out_security_buffer
;
115 return smbd_smb2_request_done_ex(smb2req
, status
, outbody
, &outdyn
,
119 static int smbd_smb2_session_destructor(struct smbd_smb2_session
*session
)
121 if (session
->sconn
== NULL
) {
125 /* first free all tcons */
126 while (session
->tcons
.list
) {
127 talloc_free(session
->tcons
.list
);
130 idr_remove(session
->sconn
->smb2
.sessions
.idtree
, session
->vuid
);
131 DLIST_REMOVE(session
->sconn
->smb2
.sessions
.list
, session
);
132 invalidate_vuid(session
->sconn
, session
->vuid
);
135 session
->status
= NT_STATUS_USER_SESSION_DELETED
;
136 session
->sconn
= NULL
;
141 static NTSTATUS
smbd_smb2_auth_generic_return(struct smbd_smb2_session
*session
,
142 struct smbd_smb2_request
*smb2req
,
143 uint8_t in_security_mode
,
144 DATA_BLOB in_security_buffer
,
145 uint16_t *out_session_flags
,
146 uint64_t *out_session_id
)
150 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
151 lp_server_signing() == SMB_SIGNING_REQUIRED
) {
152 session
->do_signing
= true;
155 if (security_session_user_level(session
->session_info
, NULL
) < SECURITY_USER
) {
156 /* we map anonymous to guest internally */
157 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
158 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
159 /* force no signing */
160 session
->do_signing
= false;
164 session
->session_key
= session
->session_info
->session_key
;
166 session
->compat_vuser
= talloc_zero(session
, user_struct
);
167 if (session
->compat_vuser
== NULL
) {
168 TALLOC_FREE(session
);
169 return NT_STATUS_NO_MEMORY
;
171 session
->compat_vuser
->gensec_security
= session
->gensec_security
;
172 session
->compat_vuser
->homes_snum
= -1;
173 session
->compat_vuser
->session_info
= session
->session_info
;
174 session
->compat_vuser
->session_keystr
= NULL
;
175 session
->compat_vuser
->vuid
= session
->vuid
;
176 DLIST_ADD(session
->sconn
->users
, session
->compat_vuser
);
177 session
->sconn
->num_users
++;
179 if (security_session_user_level(session
->session_info
, NULL
) >= SECURITY_USER
) {
180 session
->compat_vuser
->homes_snum
=
181 register_homes_share(session
->session_info
->unix_info
->unix_name
);
184 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
185 DEBUG(1, ("smb2: Failed to claim session "
187 session
->compat_vuser
->vuid
));
188 TALLOC_FREE(session
);
189 return NT_STATUS_LOGON_FAILURE
;
192 set_current_user_info(session
->session_info
->unix_info
->sanitized_username
,
193 session
->session_info
->unix_info
->unix_name
,
194 session
->session_info
->info
->domain_name
);
196 reload_services(smb2req
->sconn
, conn_snum_used
, true);
198 session
->status
= NT_STATUS_OK
;
201 * we attach the session to the request
202 * so that the response can be signed
204 smb2req
->session
= session
;
206 smb2req
->do_signing
= true;
209 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
211 *out_session_id
= session
->vuid
;
216 static NTSTATUS
smbd_smb2_auth_generic(struct smbd_smb2_session
*session
,
217 struct smbd_smb2_request
*smb2req
,
218 uint8_t in_security_mode
,
219 DATA_BLOB in_security_buffer
,
220 uint16_t *out_session_flags
,
221 DATA_BLOB
*out_security_buffer
,
222 uint64_t *out_session_id
)
226 *out_security_buffer
= data_blob_null
;
228 if (session
->gensec_security
== NULL
) {
229 status
= auth_generic_prepare(session
, session
->sconn
->remote_address
,
230 &session
->gensec_security
);
231 if (!NT_STATUS_IS_OK(status
)) {
232 TALLOC_FREE(session
);
236 gensec_want_feature(session
->gensec_security
, GENSEC_FEATURE_SESSION_KEY
);
237 gensec_want_feature(session
->gensec_security
, GENSEC_FEATURE_UNIX_TOKEN
);
239 status
= gensec_start_mech_by_oid(session
->gensec_security
, GENSEC_OID_SPNEGO
);
240 if (!NT_STATUS_IS_OK(status
)) {
241 TALLOC_FREE(session
);
247 status
= gensec_update(session
->gensec_security
,
250 out_security_buffer
);
252 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
) &&
253 !NT_STATUS_IS_OK(status
)) {
254 TALLOC_FREE(session
);
255 return nt_status_squash(status
);
258 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
259 *out_session_id
= session
->vuid
;
263 status
= gensec_session_info(session
->gensec_security
,
265 &session
->session_info
);
267 if (!NT_STATUS_IS_OK(status
)) {
268 TALLOC_FREE(session
);
271 *out_session_id
= session
->vuid
;
273 return smbd_smb2_auth_generic_return(session
,
281 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
282 uint64_t in_session_id
,
283 uint8_t in_security_mode
,
284 DATA_BLOB in_security_buffer
,
285 uint16_t *out_session_flags
,
286 DATA_BLOB
*out_security_buffer
,
287 uint64_t *out_session_id
)
289 struct smbd_smb2_session
*session
;
291 *out_session_flags
= 0;
294 if (in_session_id
== 0) {
297 /* create a new session */
298 session
= talloc_zero(smb2req
->sconn
, struct smbd_smb2_session
);
299 if (session
== NULL
) {
300 return NT_STATUS_NO_MEMORY
;
302 session
->status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
303 id
= idr_get_new_random(smb2req
->sconn
->smb2
.sessions
.idtree
,
305 smb2req
->sconn
->smb2
.sessions
.limit
);
307 return NT_STATUS_INSUFFICIENT_RESOURCES
;
311 session
->tcons
.idtree
= idr_init(session
);
312 if (session
->tcons
.idtree
== NULL
) {
313 return NT_STATUS_NO_MEMORY
;
315 session
->tcons
.limit
= 0x0000FFFE;
316 session
->tcons
.list
= NULL
;
318 DLIST_ADD_END(smb2req
->sconn
->smb2
.sessions
.list
, session
,
319 struct smbd_smb2_session
*);
320 session
->sconn
= smb2req
->sconn
;
321 talloc_set_destructor(session
, smbd_smb2_session_destructor
);
325 /* lookup an existing session */
326 p
= idr_find(smb2req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
328 return NT_STATUS_USER_SESSION_DELETED
;
330 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
333 if (NT_STATUS_IS_OK(session
->status
)) {
334 return NT_STATUS_REQUEST_NOT_ACCEPTED
;
337 return smbd_smb2_auth_generic(session
,
346 NTSTATUS
smbd_smb2_request_process_logoff(struct smbd_smb2_request
*req
)
351 status
= smbd_smb2_request_verify_sizes(req
, 0x04);
352 if (!NT_STATUS_IS_OK(status
)) {
353 return smbd_smb2_request_error(req
, status
);
357 * TODO: cancel all outstanding requests on the session
358 * and delete all tree connections.
360 smbd_smb2_session_destructor(req
->session
);
362 * we may need to sign the response, so we need to keep
363 * the session until the response is sent to the wire.
365 talloc_steal(req
, req
->session
);
367 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x04);
368 if (outbody
.data
== NULL
) {
369 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
372 SSVAL(outbody
.data
, 0x00, 0x04); /* struct size */
373 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
375 return smbd_smb2_request_done(req
, outbody
, NULL
);