source3/smbd/negprot.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    negprot reply code
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "../libcli/auth/spnego.h"
  25 #include "serverid.h"
  26 #include "auth.h"
  27 #include "messages.h"
  28 #include "smbprofile.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "../libcli/smb/smb_signing.h"
  31
  32 extern fstring remote_proto;
  33
  34 static void get_challenge(struct smbd_server_connection *sconn, uint8 buff[8])
  35 {
  36         NTSTATUS nt_status;
  37
  38         /* We might be called more than once, multiple negprots are
  39          * permitted */
  40         if (sconn->smb1.negprot.auth_context) {
  41                 DEBUG(3, ("get challenge: is this a secondary negprot? "
  42                           "sconn->negprot.auth_context is non-NULL!\n"));
  43                         TALLOC_FREE(sconn->smb1.negprot.auth_context);
  44         }
  45
  46         DEBUG(10, ("get challenge: creating negprot_global_auth_context\n"));
  47         nt_status = make_auth4_context(
  48                 sconn, &sconn->smb1.negprot.auth_context);
  49         if (!NT_STATUS_IS_OK(nt_status)) {
  50                 DEBUG(0, ("make_auth_context_subsystem returned %s",
  51                           nt_errstr(nt_status)));
  52                 smb_panic("cannot make_negprot_global_auth_context!");
  53         }
  54         DEBUG(10, ("get challenge: getting challenge\n"));
  55         sconn->smb1.negprot.auth_context->get_ntlm_challenge(
  56                 sconn->smb1.negprot.auth_context, buff);
  57 }
  58
  59 /****************************************************************************
  60  Reply for the lanman 1.0 protocol.
  61 ****************************************************************************/
  62
  63 static void reply_lanman1(struct smb_request *req, uint16 choice)
  64 {
  65         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
  66         int secword=0;
  67         time_t t = time(NULL);
  68         struct smbd_server_connection *sconn = req->sconn;
  69
  70         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
  71
  72         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
  73         if (sconn->smb1.negprot.encrypted_passwords) {
  74                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
  75         }
  76
  77         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
  78
  79         SSVAL(req->outbuf,smb_vwv0,choice);
  80         SSVAL(req->outbuf,smb_vwv1,secword);
  81         /* Create a token value and add it to the outgoing packet. */
  82         if (sconn->smb1.negprot.encrypted_passwords) {
  83                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
  84                 SSVAL(req->outbuf,smb_vwv11, 8);
  85         }
  86
  87         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN1);
  88
  89         /* Reply, SMBlockread, SMBwritelock supported. */
  90         SCVAL(req->outbuf,smb_flg, FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
  91         SSVAL(req->outbuf,smb_vwv2, sconn->smb1.negprot.max_recv);
  92         SSVAL(req->outbuf,smb_vwv3, lp_maxmux()); /* maxmux */
  93         SSVAL(req->outbuf,smb_vwv4, 1);
  94         SSVAL(req->outbuf,smb_vwv5, raw); /* tell redirector we support
  95                 readbraw writebraw (possibly) */
  96         SIVAL(req->outbuf,smb_vwv6, getpid());
  97         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
  98
  99         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 100
 101         return;
 102 }
 103
 104 /****************************************************************************
 105  Reply for the lanman 2.0 protocol.
 106 ****************************************************************************/
 107
 108 static void reply_lanman2(struct smb_request *req, uint16 choice)
 109 {
 110         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
 111         int secword=0;
 112         time_t t = time(NULL);
 113         struct smbd_server_connection *sconn = req->sconn;
 114
 115         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 116
 117         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 118         if (sconn->smb1.negprot.encrypted_passwords) {
 119                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 120         }
 121
 122         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
 123
 124         SSVAL(req->outbuf,smb_vwv0, choice);
 125         SSVAL(req->outbuf,smb_vwv1, secword);
 126         SIVAL(req->outbuf,smb_vwv6, getpid());
 127
 128         /* Create a token value and add it to the outgoing packet. */
 129         if (sconn->smb1.negprot.encrypted_passwords) {
 130                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
 131                 SSVAL(req->outbuf,smb_vwv11, 8);
 132         }
 133
 134         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN2);
 135
 136         /* Reply, SMBlockread, SMBwritelock supported. */
 137         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
 138         SSVAL(req->outbuf,smb_vwv2,sconn->smb1.negprot.max_recv);
 139         SSVAL(req->outbuf,smb_vwv3,lp_maxmux());
 140         SSVAL(req->outbuf,smb_vwv4,1);
 141         SSVAL(req->outbuf,smb_vwv5,raw); /* readbraw and/or writebraw */
 142         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
 143         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 144 }
 145
 146 /****************************************************************************
 147  Generate the spnego negprot reply blob. Return the number of bytes used.
 148 ****************************************************************************/
 149
 150 DATA_BLOB negprot_spnego(TALLOC_CTX *ctx, struct smbd_server_connection *sconn)
 151 {
 152         DATA_BLOB blob = data_blob_null;
 153         DATA_BLOB blob_out = data_blob_null;
 154         nstring dos_name;
 155         fstring unix_name;
 156         NTSTATUS status;
 157 #ifdef DEVELOPER
 158         size_t slen;
 159 #endif
 160         struct gensec_security *gensec_security;
 161
 162         /* See if we can get an SPNEGO blob */
 163         status = auth_generic_prepare(talloc_tos(),
 164                                       sconn->remote_address,
 165                                       &gensec_security);
 166         if (NT_STATUS_IS_OK(status)) {
 167                 status = gensec_start_mech_by_oid(gensec_security, GENSEC_OID_SPNEGO);
 168                 if (NT_STATUS_IS_OK(status)) {
 169                         status = gensec_update(gensec_security, ctx,
 170                                                NULL, data_blob_null, &blob);
 171                         /* If we get the list of OIDs, the 'OK' answer
 172                          * is NT_STATUS_MORE_PROCESSING_REQUIRED */
 173                         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 174                                 DEBUG(0, ("Failed to start SPNEGO handler for negprot OID list!\n"));
 175                                 blob = data_blob_null;
 176                         }
 177                 }
 178                 TALLOC_FREE(gensec_security);
 179         }
 180
 181         sconn->smb1.negprot.spnego = true;
 182
 183         /* strangely enough, NT does not sent the single OID NTLMSSP when
 184            not a ADS member, it sends no OIDs at all
 185
 186            OLD COMMENT : "we can't do this until we teach our sesssion setup parser to know
 187                    about raw NTLMSSP (clients send no ASN.1 wrapping if we do this)"
 188
 189            Our sessionsetup code now handles raw NTLMSSP connects, so we can go
 190            back to doing what W2K3 does here. This is needed to make PocketPC 2003
 191            CIFS connections work with SPNEGO. See bugzilla bugs #1828 and #3133
 192            for details. JRA.
 193
 194         */
 195
 196         if (blob.length == 0 || blob.data == NULL) {
 197                 return data_blob_null;
 198         }
 199
 200         blob_out = data_blob_talloc(ctx, NULL, 16 + blob.length);
 201         if (blob_out.data == NULL) {
 202                 data_blob_free(&blob);
 203                 return data_blob_null;
 204         }
 205
 206         memset(blob_out.data, '\0', 16);
 207
 208         checked_strlcpy(unix_name, lp_netbios_name(), sizeof(unix_name));
 209         (void)strlower_m(unix_name);
 210         push_ascii_nstring(dos_name, unix_name);
 211         strlcpy((char *)blob_out.data, dos_name, 17);
 212
 213 #ifdef DEVELOPER
 214         /* Fix valgrind 'uninitialized bytes' issue. */
 215         slen = strlen(dos_name);
 216         if (slen < 16) {
 217                 memset(blob_out.data+slen, '\0', 16 - slen);
 218         }
 219 #endif
 220
 221         memcpy(&blob_out.data[16], blob.data, blob.length);
 222
 223         data_blob_free(&blob);
 224
 225         return blob_out;
 226 }
 227
 228 /****************************************************************************
 229  Reply for the nt protocol.
 230 ****************************************************************************/
 231
 232 static void reply_nt1(struct smb_request *req, uint16 choice)
 233 {
 234         /* dual names + lock_and_read + nt SMBs + remote API calls */
 235         int capabilities = CAP_NT_FIND|CAP_LOCK_AND_READ|
 236                 CAP_LEVEL_II_OPLOCKS;
 237
 238         int secword=0;
 239         bool negotiate_spnego = False;
 240         struct timespec ts;
 241         ssize_t ret;
 242         struct smbd_server_connection *sconn = req->sconn;
 243         bool signing_enabled = false;
 244         bool signing_required = false;
 245
 246         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 247
 248         /* Check the flags field to see if this is Vista.
 249            WinXP sets it and Vista does not. But we have to
 250            distinguish from NT which doesn't set it either. */
 251
 252         if ( (req->flags2 & FLAGS2_EXTENDED_SECURITY) &&
 253                 ((req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) == 0) )
 254         {
 255                 if ((get_remote_arch() != RA_SAMBA) &&
 256                                 (get_remote_arch() != RA_CIFSFS)) {
 257                         set_remote_arch( RA_VISTA );
 258                 }
 259         }
 260
 261         reply_outbuf(req,17,0);
 262
 263         /* do spnego in user level security if the client
 264            supports it and we can do encrypted passwords */
 265
 266         if (sconn->smb1.negprot.encrypted_passwords &&
 267             lp_use_spnego() &&
 268             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
 269                 negotiate_spnego = True;
 270                 capabilities |= CAP_EXTENDED_SECURITY;
 271                 add_to_common_flags2(FLAGS2_EXTENDED_SECURITY);
 272                 /* Ensure FLAGS2_EXTENDED_SECURITY gets set in this reply
 273                    (already partially constructed. */
 274                 SSVAL(req->outbuf, smb_flg2,
 275                       req->flags2 | FLAGS2_EXTENDED_SECURITY);
 276         }
 277
 278         capabilities |= CAP_NT_SMBS|CAP_RPC_REMOTE_APIS;
 279
 280         if (lp_unicode()) {
 281                 capabilities |= CAP_UNICODE;
 282         }
 283
 284         if (lp_unix_extensions()) {
 285                 capabilities |= CAP_UNIX;
 286         }
 287
 288         if (lp_large_readwrite())
 289                 capabilities |= CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_W2K_SMBS;
 290
 291         capabilities |= CAP_LARGE_FILES;
 292
 293         if (lp_readraw() && lp_writeraw())
 294                 capabilities |= CAP_RAW_MODE;
 295
 296         if (lp_nt_status_support())
 297                 capabilities |= CAP_STATUS32;
 298
 299         if (lp_host_msdfs())
 300                 capabilities |= CAP_DFS;
 301
 302         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 303         if (sconn->smb1.negprot.encrypted_passwords) {
 304                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 305         }
 306
 307         signing_enabled = smb_signing_is_allowed(req->sconn->smb1.signing_state);
 308         signing_required = smb_signing_is_mandatory(req->sconn->smb1.signing_state);
 309
 310         if (signing_enabled) {
 311                 secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
 312                 /* No raw mode with smb signing. */
 313                 capabilities &= ~CAP_RAW_MODE;
 314                 if (signing_required) {
 315                         secword |=NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
 316                 }
 317         }
 318
 319         SSVAL(req->outbuf,smb_vwv0,choice);
 320         SCVAL(req->outbuf,smb_vwv1,secword);
 321
 322         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_NT1);
 323
 324         SSVAL(req->outbuf,smb_vwv1+1, lp_maxmux()); /* maxmpx */
 325         SSVAL(req->outbuf,smb_vwv2+1, 1); /* num vcs */
 326         SIVAL(req->outbuf,smb_vwv3+1,
 327               sconn->smb1.negprot.max_recv); /* max buffer. LOTS! */
 328         SIVAL(req->outbuf,smb_vwv5+1, 0x10000); /* raw size. full 64k */
 329         SIVAL(req->outbuf,smb_vwv7+1, getpid()); /* session key */
 330         SIVAL(req->outbuf,smb_vwv9+1, capabilities); /* capabilities */
 331         clock_gettime(CLOCK_REALTIME,&ts);
 332         put_long_date_timespec(TIMESTAMP_SET_NT_OR_BETTER,(char *)req->outbuf+smb_vwv11+1,ts);
 333         SSVALS(req->outbuf,smb_vwv15+1,set_server_zone_offset(ts.tv_sec)/60);
 334
 335         if (!negotiate_spnego) {
 336                 /* Create a token value and add it to the outgoing packet. */
 337                 if (sconn->smb1.negprot.encrypted_passwords) {
 338                         uint8 chal[8];
 339                         /* note that we do not send a challenge at all if
 340                            we are using plaintext */
 341                         get_challenge(sconn, chal);
 342                         ret = message_push_blob(
 343                                 &req->outbuf, data_blob_const(chal, sizeof(chal)));
 344                         if (ret == -1) {
 345                                 DEBUG(0, ("Could not push challenge\n"));
 346                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 347                                 return;
 348                         }
 349                         SCVAL(req->outbuf, smb_vwv16+1, ret);
 350                 }
 351                 ret = message_push_string(&req->outbuf, lp_workgroup(),
 352                                           STR_UNICODE|STR_TERMINATE
 353                                           |STR_NOALIGN);
 354                 if (ret == -1) {
 355                         DEBUG(0, ("Could not push workgroup string\n"));
 356                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 357                         return;
 358                 }
 359                 ret = message_push_string(&req->outbuf, lp_netbios_name(),
 360                                           STR_UNICODE|STR_TERMINATE
 361                                           |STR_NOALIGN);
 362                 if (ret == -1) {
 363                         DEBUG(0, ("Could not push netbios name string\n"));
 364                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 365                         return;
 366                 }
 367                 DEBUG(3,("not using SPNEGO\n"));
 368         } else {
 369                 DATA_BLOB spnego_blob = negprot_spnego(req, req->sconn);
 370
 371                 if (spnego_blob.data == NULL) {
 372                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 373                         return;
 374                 }
 375
 376                 ret = message_push_blob(&req->outbuf, spnego_blob);
 377                 if (ret == -1) {
 378                         DEBUG(0, ("Could not push spnego blob\n"));
 379                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 380                         return;
 381                 }
 382                 data_blob_free(&spnego_blob);
 383
 384                 SCVAL(req->outbuf,smb_vwv16+1, 0);
 385                 DEBUG(3,("using SPNEGO\n"));
 386         }
 387
 388         return;
 389 }
 390
 391 /* these are the protocol lists used for auto architecture detection:
 392
 393 WinNT 3.51:
 394 protocol [PC NETWORK PROGRAM 1.0]
 395 protocol [XENIX CORE]
 396 protocol [MICROSOFT NETWORKS 1.03]
 397 protocol [LANMAN1.0]
 398 protocol [Windows for Workgroups 3.1a]
 399 protocol [LM1.2X002]
 400 protocol [LANMAN2.1]
 401 protocol [NT LM 0.12]
 402
 403 Win95:
 404 protocol [PC NETWORK PROGRAM 1.0]
 405 protocol [XENIX CORE]
 406 protocol [MICROSOFT NETWORKS 1.03]
 407 protocol [LANMAN1.0]
 408 protocol [Windows for Workgroups 3.1a]
 409 protocol [LM1.2X002]
 410 protocol [LANMAN2.1]
 411 protocol [NT LM 0.12]
 412
 413 Win2K:
 414 protocol [PC NETWORK PROGRAM 1.0]
 415 protocol [LANMAN1.0]
 416 protocol [Windows for Workgroups 3.1a]
 417 protocol [LM1.2X002]
 418 protocol [LANMAN2.1]
 419 protocol [NT LM 0.12]
 420
 421 Vista:
 422 protocol [PC NETWORK PROGRAM 1.0]
 423 protocol [LANMAN1.0]
 424 protocol [Windows for Workgroups 3.1a]
 425 protocol [LM1.2X002]
 426 protocol [LANMAN2.1]
 427 protocol [NT LM 0.12]
 428 protocol [SMB 2.001]
 429
 430 OS/2:
 431 protocol [PC NETWORK PROGRAM 1.0]
 432 protocol [XENIX CORE]
 433 protocol [LANMAN1.0]
 434 protocol [LM1.2X002]
 435 protocol [LANMAN2.1]
 436 */
 437
 438 /*
 439   * Modified to recognize the architecture of the remote machine better.
 440   *
 441   * This appears to be the matrix of which protocol is used by which
 442   * MS product.
 443        Protocol                       WfWg    Win95   WinNT  Win2K  OS/2 Vista
 444        PC NETWORK PROGRAM 1.0          1       1       1      1      1     1
 445        XENIX CORE                                      2             2
 446        MICROSOFT NETWORKS 3.0          2       2
 447        DOS LM1.2X002                   3       3
 448        MICROSOFT NETWORKS 1.03                         3
 449        DOS LANMAN2.1                   4       4
 450        LANMAN1.0                                       4      2      3     2
 451        Windows for Workgroups 3.1a     5       5       5      3            3
 452        LM1.2X002                                       6      4      4     4
 453        LANMAN2.1                                       7      5      5     5
 454        NT LM 0.12                              6       8      6            6
 455        SMB 2.001                                                           7
 456   *
 457   *  tim@fsg.com 09/29/95
 458   *  Win2K added by matty 17/7/99
 459   */
 460
 461 #define ARCH_WFWG     0x3      /* This is a fudge because WfWg is like Win95 */
 462 #define ARCH_WIN95    0x2
 463 #define ARCH_WINNT    0x4
 464 #define ARCH_WIN2K    0xC      /* Win2K is like NT */
 465 #define ARCH_OS2      0x14     /* Again OS/2 is like NT */
 466 #define ARCH_SAMBA    0x20
 467 #define ARCH_CIFSFS   0x40
 468 #define ARCH_VISTA    0x8C     /* Vista is like XP/2K */
 469
 470 #define ARCH_ALL      0x7F
 471
 472 /* List of supported protocols, most desired first */
 473 static const struct {
 474         const char *proto_name;
 475         const char *short_name;
 476         void (*proto_reply_fn)(struct smb_request *req, uint16 choice);
 477         int protocol_level;
 478 } supported_protocols[] = {
 479         {"SMB 2.???",               "SMB2_FF",  reply_smb20ff,  PROTOCOL_SMB2_10},
 480         {"SMB 2.002",               "SMB2_02",  reply_smb2002,  PROTOCOL_SMB2_02},
 481         {"NT LANMAN 1.0",           "NT1",      reply_nt1,      PROTOCOL_NT1},
 482         {"NT LM 0.12",              "NT1",      reply_nt1,      PROTOCOL_NT1},
 483         {"POSIX 2",                 "NT1",      reply_nt1,      PROTOCOL_NT1},
 484         {"LANMAN2.1",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 485         {"LM1.2X002",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 486         {"Samba",                   "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 487         {"DOS LM1.2X002",           "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 488         {"LANMAN1.0",               "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 489         {"MICROSOFT NETWORKS 3.0",  "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 490         {NULL,NULL,NULL,0},
 491 };
 492
 493 /****************************************************************************
 494  Reply to a negprot.
 495  conn POINTER CAN BE NULL HERE !
 496 ****************************************************************************/
 497
 498 void reply_negprot(struct smb_request *req)
 499 {
 500         int choice= -1;
 501         int chosen_level = -1;
 502         int protocol;
 503         const char *p;
 504         int arch = ARCH_ALL;
 505         int num_cliprotos;
 506         char **cliprotos;
 507         int i;
 508         size_t converted_size;
 509         struct smbd_server_connection *sconn = req->sconn;
 510
 511         START_PROFILE(SMBnegprot);
 512
 513         if (sconn->smb1.negprot.done) {
 514                 END_PROFILE(SMBnegprot);
 515                 exit_server_cleanly("multiple negprot's are not permitted");
 516         }
 517         sconn->smb1.negprot.done = true;
 518
 519         if (req->buflen == 0) {
 520                 DEBUG(0, ("negprot got no protocols\n"));
 521                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 522                 END_PROFILE(SMBnegprot);
 523                 return;
 524         }
 525
 526         if (req->buf[req->buflen-1] != '\0') {
 527                 DEBUG(0, ("negprot protocols not 0-terminated\n"));
 528                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 529                 END_PROFILE(SMBnegprot);
 530                 return;
 531         }
 532
 533         p = (const char *)req->buf + 1;
 534
 535         num_cliprotos = 0;
 536         cliprotos = NULL;
 537
 538         while (smbreq_bufrem(req, p) > 0) {
 539
 540                 char **tmp;
 541
 542                 tmp = talloc_realloc(talloc_tos(), cliprotos, char *,
 543                                            num_cliprotos+1);
 544                 if (tmp == NULL) {
 545                         DEBUG(0, ("talloc failed\n"));
 546                         TALLOC_FREE(cliprotos);
 547                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 548                         END_PROFILE(SMBnegprot);
 549                         return;
 550                 }
 551
 552                 cliprotos = tmp;
 553
 554                 if (!pull_ascii_talloc(cliprotos, &cliprotos[num_cliprotos], p,
 555                                        &converted_size)) {
 556                         DEBUG(0, ("pull_ascii_talloc failed\n"));
 557                         TALLOC_FREE(cliprotos);
 558                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 559                         END_PROFILE(SMBnegprot);
 560                         return;
 561                 }
 562
 563                 DEBUG(3, ("Requested protocol [%s]\n",
 564                           cliprotos[num_cliprotos]));
 565
 566                 num_cliprotos += 1;
 567                 p += strlen(p) + 2;
 568         }
 569
 570         for (i=0; i<num_cliprotos; i++) {
 571                 if (strcsequal(cliprotos[i], "Windows for Workgroups 3.1a"))
 572                         arch &= ( ARCH_WFWG | ARCH_WIN95 | ARCH_WINNT
 573                                   | ARCH_WIN2K );
 574                 else if (strcsequal(cliprotos[i], "DOS LM1.2X002"))
 575                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 576                 else if (strcsequal(cliprotos[i], "DOS LANMAN2.1"))
 577                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 578                 else if (strcsequal(cliprotos[i], "NT LM 0.12"))
 579                         arch &= ( ARCH_WIN95 | ARCH_WINNT | ARCH_WIN2K
 580                                   | ARCH_CIFSFS);
 581                 else if (strcsequal(cliprotos[i], "SMB 2.001"))
 582                         arch = ARCH_VISTA;
 583                 else if (strcsequal(cliprotos[i], "LANMAN2.1"))
 584                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 585                 else if (strcsequal(cliprotos[i], "LM1.2X002"))
 586                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 587                 else if (strcsequal(cliprotos[i], "MICROSOFT NETWORKS 1.03"))
 588                         arch &= ARCH_WINNT;
 589                 else if (strcsequal(cliprotos[i], "XENIX CORE"))
 590                         arch &= ( ARCH_WINNT | ARCH_OS2 );
 591                 else if (strcsequal(cliprotos[i], "Samba")) {
 592                         arch = ARCH_SAMBA;
 593                         break;
 594                 } else if (strcsequal(cliprotos[i], "POSIX 2")) {
 595                         arch = ARCH_CIFSFS;
 596                         break;
 597                 }
 598         }
 599
 600         /* CIFSFS can send one arch only, NT LM 0.12. */
 601         if (i == 1 && (arch & ARCH_CIFSFS)) {
 602                 arch = ARCH_CIFSFS;
 603         }
 604
 605         switch ( arch ) {
 606                 case ARCH_CIFSFS:
 607                         set_remote_arch(RA_CIFSFS);
 608                         break;
 609                 case ARCH_SAMBA:
 610                         set_remote_arch(RA_SAMBA);
 611                         break;
 612                 case ARCH_WFWG:
 613                         set_remote_arch(RA_WFWG);
 614                         break;
 615                 case ARCH_WIN95:
 616                         set_remote_arch(RA_WIN95);
 617                         break;
 618                 case ARCH_WINNT:
 619                         if(req->flags2 == FLAGS2_WIN2K_SIGNATURE)
 620                                 set_remote_arch(RA_WIN2K);
 621                         else
 622                                 set_remote_arch(RA_WINNT);
 623                         break;
 624                 case ARCH_WIN2K:
 625                         /* Vista may have been set in the negprot so don't
 626                            override it here */
 627                         if ( get_remote_arch() != RA_VISTA )
 628                                 set_remote_arch(RA_WIN2K);
 629                         break;
 630                 case ARCH_VISTA:
 631                         set_remote_arch(RA_VISTA);
 632                         break;
 633                 case ARCH_OS2:
 634                         set_remote_arch(RA_OS2);
 635                         break;
 636                 default:
 637                         set_remote_arch(RA_UNKNOWN);
 638                 break;
 639         }
 640
 641         /* possibly reload - change of architecture */
 642         reload_services(sconn, conn_snum_used, true);
 643
 644         /* moved from the netbios session setup code since we don't have that
 645            when the client connects to port 445.  Of course there is a small
 646            window where we are listening to messages   -- jerry */
 647
 648         serverid_register(messaging_server_id(sconn->msg_ctx),
 649                           FLAG_MSG_GENERAL|FLAG_MSG_SMBD
 650                           |FLAG_MSG_PRINT_GENERAL);
 651
 652         /* Check for protocols, most desirable first */
 653         for (protocol = 0; supported_protocols[protocol].proto_name; protocol++) {
 654                 i = 0;
 655                 if ((supported_protocols[protocol].protocol_level <= lp_srv_maxprotocol()) &&
 656                                 (supported_protocols[protocol].protocol_level >= lp_srv_minprotocol()))
 657                         while (i < num_cliprotos) {
 658                                 if (strequal(cliprotos[i],supported_protocols[protocol].proto_name)) {
 659                                         choice = i;
 660                                         chosen_level = supported_protocols[protocol].protocol_level;
 661                                 }
 662                                 i++;
 663                         }
 664                 if(choice != -1)
 665                         break;
 666         }
 667
 668         if(choice != -1) {
 669                 fstrcpy(remote_proto,supported_protocols[protocol].short_name);
 670                 reload_services(sconn, conn_snum_used, true);
 671                 supported_protocols[protocol].proto_reply_fn(req, choice);
 672                 DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
 673         } else {
 674                 DEBUG(0,("No protocol supported !\n"));
 675                 reply_outbuf(req, 1, 0);
 676                 SSVAL(req->outbuf, smb_vwv0, choice);
 677         }
 678
 679         DEBUG( 5, ( "negprot index=%d\n", choice ) );
 680
 681         if ((lp_server_signing() == SMB_SIGNING_REQUIRED)
 682             && (chosen_level < PROTOCOL_NT1)) {
 683                 exit_server_cleanly("SMB signing is required and "
 684                         "client negotiated a downlevel protocol");
 685         }
 686
 687         TALLOC_FREE(cliprotos);
 688
 689         if (lp_async_smb_echo_handler() && (chosen_level < PROTOCOL_SMB2_02) &&
 690             !fork_echo_handler(sconn)) {
 691                 exit_server("Failed to fork echo handler");
 692         }
 693
 694         END_PROFILE(SMBnegprot);
 695         return;
 696 }