source3/smbd/negprot.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    negprot reply code
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "../libcli/auth/spnego.h"
  25 #include "serverid.h"
  26 #include "auth.h"
  27 #include "messages.h"
  28 #include "smbprofile.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "../libcli/smb/smb_signing.h"
  31
  32 extern fstring remote_proto;
  33
  34 static void get_challenge(struct smbd_server_connection *sconn, uint8 buff[8])
  35 {
  36         NTSTATUS nt_status;
  37
  38         /* We might be called more than once, multiple negprots are
  39          * permitted */
  40         if (sconn->smb1.negprot.auth_context) {
  41                 DEBUG(3, ("get challenge: is this a secondary negprot? "
  42                           "sconn->negprot.auth_context is non-NULL!\n"));
  43                         TALLOC_FREE(sconn->smb1.negprot.auth_context);
  44         }
  45
  46         DEBUG(10, ("get challenge: creating negprot_global_auth_context\n"));
  47         nt_status = make_auth4_context(
  48                 sconn, &sconn->smb1.negprot.auth_context);
  49         if (!NT_STATUS_IS_OK(nt_status)) {
  50                 DEBUG(0, ("make_auth_context_subsystem returned %s",
  51                           nt_errstr(nt_status)));
  52                 smb_panic("cannot make_negprot_global_auth_context!");
  53         }
  54         DEBUG(10, ("get challenge: getting challenge\n"));
  55         sconn->smb1.negprot.auth_context->get_ntlm_challenge(
  56                 sconn->smb1.negprot.auth_context, buff);
  57 }
  58
  59 /****************************************************************************
  60  Reply for the lanman 1.0 protocol.
  61 ****************************************************************************/
  62
  63 static void reply_lanman1(struct smb_request *req, uint16 choice)
  64 {
  65         int secword=0;
  66         time_t t = time(NULL);
  67         struct smbd_server_connection *sconn = req->sconn;
  68         uint16_t raw;
  69         if (lp_async_smb_echo_handler()) {
  70                 raw = 0;
  71         } else {
  72                 raw = (lp_read_raw()?1:0) | (lp_write_raw()?2:0);
  73         }
  74
  75         sconn->smb1.negprot.encrypted_passwords = lp_encrypt_passwords();
  76
  77         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
  78         if (sconn->smb1.negprot.encrypted_passwords) {
  79                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
  80         }
  81
  82         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
  83
  84         SSVAL(req->outbuf,smb_vwv0,choice);
  85         SSVAL(req->outbuf,smb_vwv1,secword);
  86         /* Create a token value and add it to the outgoing packet. */
  87         if (sconn->smb1.negprot.encrypted_passwords) {
  88                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
  89                 SSVAL(req->outbuf,smb_vwv11, 8);
  90         }
  91
  92         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN1);
  93
  94         /* Reply, SMBlockread, SMBwritelock supported. */
  95         SCVAL(req->outbuf,smb_flg, FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
  96         SSVAL(req->outbuf,smb_vwv2, sconn->smb1.negprot.max_recv);
  97         SSVAL(req->outbuf,smb_vwv3, lp_max_mux()); /* maxmux */
  98         SSVAL(req->outbuf,smb_vwv4, 1);
  99         SSVAL(req->outbuf,smb_vwv5, raw); /* tell redirector we support
 100                 readbraw writebraw (possibly) */
 101         SIVAL(req->outbuf,smb_vwv6, getpid());
 102         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
 103
 104         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 105
 106         return;
 107 }
 108
 109 /****************************************************************************
 110  Reply for the lanman 2.0 protocol.
 111 ****************************************************************************/
 112
 113 static void reply_lanman2(struct smb_request *req, uint16 choice)
 114 {
 115         int secword=0;
 116         time_t t = time(NULL);
 117         struct smbd_server_connection *sconn = req->sconn;
 118         uint16_t raw;
 119         if (lp_async_smb_echo_handler()) {
 120                 raw = 0;
 121         } else {
 122                 raw = (lp_read_raw()?1:0) | (lp_write_raw()?2:0);
 123         }
 124
 125         sconn->smb1.negprot.encrypted_passwords = lp_encrypt_passwords();
 126
 127         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 128         if (sconn->smb1.negprot.encrypted_passwords) {
 129                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 130         }
 131
 132         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
 133
 134         SSVAL(req->outbuf,smb_vwv0, choice);
 135         SSVAL(req->outbuf,smb_vwv1, secword);
 136         SIVAL(req->outbuf,smb_vwv6, getpid());
 137
 138         /* Create a token value and add it to the outgoing packet. */
 139         if (sconn->smb1.negprot.encrypted_passwords) {
 140                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
 141                 SSVAL(req->outbuf,smb_vwv11, 8);
 142         }
 143
 144         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN2);
 145
 146         /* Reply, SMBlockread, SMBwritelock supported. */
 147         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
 148         SSVAL(req->outbuf,smb_vwv2,sconn->smb1.negprot.max_recv);
 149         SSVAL(req->outbuf,smb_vwv3,lp_max_mux());
 150         SSVAL(req->outbuf,smb_vwv4,1);
 151         SSVAL(req->outbuf,smb_vwv5,raw); /* readbraw and/or writebraw */
 152         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
 153         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 154 }
 155
 156 /****************************************************************************
 157  Generate the spnego negprot reply blob. Return the number of bytes used.
 158 ****************************************************************************/
 159
 160 DATA_BLOB negprot_spnego(TALLOC_CTX *ctx, struct smbd_server_connection *sconn)
 161 {
 162         DATA_BLOB blob = data_blob_null;
 163         DATA_BLOB blob_out = data_blob_null;
 164         nstring dos_name;
 165         fstring unix_name;
 166         NTSTATUS status;
 167 #ifdef DEVELOPER
 168         size_t slen;
 169 #endif
 170         struct gensec_security *gensec_security;
 171
 172         /* See if we can get an SPNEGO blob */
 173         status = auth_generic_prepare(talloc_tos(),
 174                                       sconn->remote_address,
 175                                       &gensec_security);
 176         if (NT_STATUS_IS_OK(status)) {
 177                 status = gensec_start_mech_by_oid(gensec_security, GENSEC_OID_SPNEGO);
 178                 if (NT_STATUS_IS_OK(status)) {
 179                         status = gensec_update(gensec_security, ctx,
 180                                                data_blob_null, &blob);
 181                         /* If we get the list of OIDs, the 'OK' answer
 182                          * is NT_STATUS_MORE_PROCESSING_REQUIRED */
 183                         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 184                                 DEBUG(0, ("Failed to start SPNEGO handler for negprot OID list!\n"));
 185                                 blob = data_blob_null;
 186                         }
 187                 }
 188                 TALLOC_FREE(gensec_security);
 189         }
 190
 191         sconn->smb1.negprot.spnego = true;
 192
 193         /* strangely enough, NT does not sent the single OID NTLMSSP when
 194            not a ADS member, it sends no OIDs at all
 195
 196            OLD COMMENT : "we can't do this until we teach our sesssion setup parser to know
 197                    about raw NTLMSSP (clients send no ASN.1 wrapping if we do this)"
 198
 199            Our sessionsetup code now handles raw NTLMSSP connects, so we can go
 200            back to doing what W2K3 does here. This is needed to make PocketPC 2003
 201            CIFS connections work with SPNEGO. See bugzilla bugs #1828 and #3133
 202            for details. JRA.
 203
 204         */
 205
 206         if (blob.length == 0 || blob.data == NULL) {
 207                 return data_blob_null;
 208         }
 209
 210         blob_out = data_blob_talloc(ctx, NULL, 16 + blob.length);
 211         if (blob_out.data == NULL) {
 212                 data_blob_free(&blob);
 213                 return data_blob_null;
 214         }
 215
 216         memset(blob_out.data, '\0', 16);
 217
 218         checked_strlcpy(unix_name, lp_netbios_name(), sizeof(unix_name));
 219         (void)strlower_m(unix_name);
 220         push_ascii_nstring(dos_name, unix_name);
 221         strlcpy((char *)blob_out.data, dos_name, 17);
 222
 223 #ifdef DEVELOPER
 224         /* Fix valgrind 'uninitialized bytes' issue. */
 225         slen = strlen(dos_name);
 226         if (slen < 16) {
 227                 memset(blob_out.data+slen, '\0', 16 - slen);
 228         }
 229 #endif
 230
 231         memcpy(&blob_out.data[16], blob.data, blob.length);
 232
 233         data_blob_free(&blob);
 234
 235         return blob_out;
 236 }
 237
 238 /****************************************************************************
 239  Reply for the nt protocol.
 240 ****************************************************************************/
 241
 242 static void reply_nt1(struct smb_request *req, uint16 choice)
 243 {
 244         /* dual names + lock_and_read + nt SMBs + remote API calls */
 245         int capabilities = CAP_NT_FIND|CAP_LOCK_AND_READ|
 246                 CAP_LEVEL_II_OPLOCKS;
 247
 248         int secword=0;
 249         bool negotiate_spnego = False;
 250         struct timespec ts;
 251         ssize_t ret;
 252         struct smbd_server_connection *sconn = req->sconn;
 253         bool signing_desired = false;
 254         bool signing_required = false;
 255
 256         sconn->smb1.negprot.encrypted_passwords = lp_encrypt_passwords();
 257
 258         /* Check the flags field to see if this is Vista.
 259            WinXP sets it and Vista does not. But we have to
 260            distinguish from NT which doesn't set it either. */
 261
 262         if ( (req->flags2 & FLAGS2_EXTENDED_SECURITY) &&
 263                 ((req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) == 0) )
 264         {
 265                 if (get_remote_arch() != RA_SAMBA) {
 266                         set_remote_arch( RA_VISTA );
 267                 }
 268         }
 269
 270         reply_outbuf(req,17,0);
 271
 272         /* do spnego in user level security if the client
 273            supports it and we can do encrypted passwords */
 274
 275         if (sconn->smb1.negprot.encrypted_passwords &&
 276             lp_use_spnego() &&
 277             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
 278                 negotiate_spnego = True;
 279                 capabilities |= CAP_EXTENDED_SECURITY;
 280                 add_to_common_flags2(FLAGS2_EXTENDED_SECURITY);
 281                 /* Ensure FLAGS2_EXTENDED_SECURITY gets set in this reply
 282                    (already partially constructed. */
 283                 SSVAL(req->outbuf, smb_flg2,
 284                       req->flags2 | FLAGS2_EXTENDED_SECURITY);
 285         }
 286
 287         capabilities |= CAP_NT_SMBS|CAP_RPC_REMOTE_APIS;
 288
 289         if (lp_unicode()) {
 290                 capabilities |= CAP_UNICODE;
 291         }
 292
 293         if (lp_unix_extensions()) {
 294                 capabilities |= CAP_UNIX;
 295         }
 296
 297         if (lp_large_readwrite())
 298                 capabilities |= CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_W2K_SMBS;
 299
 300         capabilities |= CAP_LARGE_FILES;
 301
 302         if (!lp_async_smb_echo_handler() && lp_read_raw() && lp_write_raw())
 303                 capabilities |= CAP_RAW_MODE;
 304
 305         if (lp_nt_status_support())
 306                 capabilities |= CAP_STATUS32;
 307
 308         if (lp_host_msdfs())
 309                 capabilities |= CAP_DFS;
 310
 311         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 312         if (sconn->smb1.negprot.encrypted_passwords) {
 313                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 314         }
 315
 316         signing_desired = smb_signing_is_desired(req->sconn->smb1.signing_state);
 317         signing_required = smb_signing_is_mandatory(req->sconn->smb1.signing_state);
 318
 319         if (signing_desired) {
 320                 secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
 321                 /* No raw mode with smb signing. */
 322                 capabilities &= ~CAP_RAW_MODE;
 323                 if (signing_required) {
 324                         secword |=NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
 325                 }
 326         }
 327
 328         SSVAL(req->outbuf,smb_vwv0,choice);
 329         SCVAL(req->outbuf,smb_vwv1,secword);
 330
 331         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_NT1);
 332
 333         SSVAL(req->outbuf,smb_vwv1+1, lp_max_mux()); /* maxmpx */
 334         SSVAL(req->outbuf,smb_vwv2+1, 1); /* num vcs */
 335         SIVAL(req->outbuf,smb_vwv3+1,
 336               sconn->smb1.negprot.max_recv); /* max buffer. LOTS! */
 337         SIVAL(req->outbuf,smb_vwv5+1, 0x10000); /* raw size. full 64k */
 338         SIVAL(req->outbuf,smb_vwv7+1, getpid()); /* session key */
 339         SIVAL(req->outbuf,smb_vwv9+1, capabilities); /* capabilities */
 340         clock_gettime(CLOCK_REALTIME,&ts);
 341         put_long_date_timespec(TIMESTAMP_SET_NT_OR_BETTER,(char *)req->outbuf+smb_vwv11+1,ts);
 342         SSVALS(req->outbuf,smb_vwv15+1,set_server_zone_offset(ts.tv_sec)/60);
 343
 344         if (!negotiate_spnego) {
 345                 /* Create a token value and add it to the outgoing packet. */
 346                 if (sconn->smb1.negprot.encrypted_passwords) {
 347                         uint8 chal[8];
 348                         /* note that we do not send a challenge at all if
 349                            we are using plaintext */
 350                         get_challenge(sconn, chal);
 351                         ret = message_push_blob(
 352                                 &req->outbuf, data_blob_const(chal, sizeof(chal)));
 353                         if (ret == -1) {
 354                                 DEBUG(0, ("Could not push challenge\n"));
 355                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 356                                 return;
 357                         }
 358                         SCVAL(req->outbuf, smb_vwv16+1, ret);
 359                 }
 360                 ret = message_push_string(&req->outbuf, lp_workgroup(),
 361                                           STR_UNICODE|STR_TERMINATE
 362                                           |STR_NOALIGN);
 363                 if (ret == -1) {
 364                         DEBUG(0, ("Could not push workgroup string\n"));
 365                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 366                         return;
 367                 }
 368                 ret = message_push_string(&req->outbuf, lp_netbios_name(),
 369                                           STR_UNICODE|STR_TERMINATE
 370                                           |STR_NOALIGN);
 371                 if (ret == -1) {
 372                         DEBUG(0, ("Could not push netbios name string\n"));
 373                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 374                         return;
 375                 }
 376                 DEBUG(3,("not using SPNEGO\n"));
 377         } else {
 378                 DATA_BLOB spnego_blob = negprot_spnego(req, req->sconn);
 379
 380                 if (spnego_blob.data == NULL) {
 381                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 382                         return;
 383                 }
 384
 385                 ret = message_push_blob(&req->outbuf, spnego_blob);
 386                 if (ret == -1) {
 387                         DEBUG(0, ("Could not push spnego blob\n"));
 388                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 389                         return;
 390                 }
 391                 data_blob_free(&spnego_blob);
 392
 393                 SCVAL(req->outbuf,smb_vwv16+1, 0);
 394                 DEBUG(3,("using SPNEGO\n"));
 395         }
 396
 397         return;
 398 }
 399
 400 /* these are the protocol lists used for auto architecture detection:
 401
 402 WinNT 3.51:
 403 protocol [PC NETWORK PROGRAM 1.0]
 404 protocol [XENIX CORE]
 405 protocol [MICROSOFT NETWORKS 1.03]
 406 protocol [LANMAN1.0]
 407 protocol [Windows for Workgroups 3.1a]
 408 protocol [LM1.2X002]
 409 protocol [LANMAN2.1]
 410 protocol [NT LM 0.12]
 411
 412 Win95:
 413 protocol [PC NETWORK PROGRAM 1.0]
 414 protocol [XENIX CORE]
 415 protocol [MICROSOFT NETWORKS 1.03]
 416 protocol [LANMAN1.0]
 417 protocol [Windows for Workgroups 3.1a]
 418 protocol [LM1.2X002]
 419 protocol [LANMAN2.1]
 420 protocol [NT LM 0.12]
 421
 422 Win2K:
 423 protocol [PC NETWORK PROGRAM 1.0]
 424 protocol [LANMAN1.0]
 425 protocol [Windows for Workgroups 3.1a]
 426 protocol [LM1.2X002]
 427 protocol [LANMAN2.1]
 428 protocol [NT LM 0.12]
 429
 430 Vista:
 431 protocol [PC NETWORK PROGRAM 1.0]
 432 protocol [LANMAN1.0]
 433 protocol [Windows for Workgroups 3.1a]
 434 protocol [LM1.2X002]
 435 protocol [LANMAN2.1]
 436 protocol [NT LM 0.12]
 437 protocol [SMB 2.001]
 438
 439 OS/2:
 440 protocol [PC NETWORK PROGRAM 1.0]
 441 protocol [XENIX CORE]
 442 protocol [LANMAN1.0]
 443 protocol [LM1.2X002]
 444 protocol [LANMAN2.1]
 445 */
 446
 447 /*
 448   * Modified to recognize the architecture of the remote machine better.
 449   *
 450   * This appears to be the matrix of which protocol is used by which
 451   * MS product.
 452        Protocol                       WfWg    Win95   WinNT  Win2K  OS/2 Vista
 453        PC NETWORK PROGRAM 1.0          1       1       1      1      1     1
 454        XENIX CORE                                      2             2
 455        MICROSOFT NETWORKS 3.0          2       2
 456        DOS LM1.2X002                   3       3
 457        MICROSOFT NETWORKS 1.03                         3
 458        DOS LANMAN2.1                   4       4
 459        LANMAN1.0                                       4      2      3     2
 460        Windows for Workgroups 3.1a     5       5       5      3            3
 461        LM1.2X002                                       6      4      4     4
 462        LANMAN2.1                                       7      5      5     5
 463        NT LM 0.12                              6       8      6            6
 464        SMB 2.001                                                           7
 465   *
 466   *  tim@fsg.com 09/29/95
 467   *  Win2K added by matty 17/7/99
 468   */
 469
 470 #define ARCH_WFWG     0x3      /* This is a fudge because WfWg is like Win95 */
 471 #define ARCH_WIN95    0x2
 472 #define ARCH_WINNT    0x4
 473 #define ARCH_WIN2K    0xC      /* Win2K is like NT */
 474 #define ARCH_OS2      0x14     /* Again OS/2 is like NT */
 475 #define ARCH_SAMBA    0x20
 476 #define ARCH_CIFSFS   0x40
 477 #define ARCH_VISTA    0x8C     /* Vista is like XP/2K */
 478
 479 #define ARCH_ALL      0x7F
 480
 481 /* List of supported protocols, most desired first */
 482 static const struct {
 483         const char *proto_name;
 484         const char *short_name;
 485         void (*proto_reply_fn)(struct smb_request *req, uint16 choice);
 486         int protocol_level;
 487 } supported_protocols[] = {
 488         {"SMB 2.???",               "SMB2_FF",  reply_smb20ff,  PROTOCOL_SMB2_10},
 489         {"SMB 2.002",               "SMB2_02",  reply_smb2002,  PROTOCOL_SMB2_02},
 490         {"NT LANMAN 1.0",           "NT1",      reply_nt1,      PROTOCOL_NT1},
 491         {"NT LM 0.12",              "NT1",      reply_nt1,      PROTOCOL_NT1},
 492         {"POSIX 2",                 "NT1",      reply_nt1,      PROTOCOL_NT1},
 493         {"LANMAN2.1",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 494         {"LM1.2X002",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 495         {"Samba",                   "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 496         {"DOS LM1.2X002",           "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 497         {"LANMAN1.0",               "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 498         {"MICROSOFT NETWORKS 3.0",  "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 499         {NULL,NULL,NULL,0},
 500 };
 501
 502 /****************************************************************************
 503  Reply to a negprot.
 504  conn POINTER CAN BE NULL HERE !
 505 ****************************************************************************/
 506
 507 void reply_negprot(struct smb_request *req)
 508 {
 509         int choice= -1;
 510         int chosen_level = -1;
 511         int protocol;
 512         const char *p;
 513         int arch = ARCH_ALL;
 514         int num_cliprotos;
 515         char **cliprotos;
 516         int i;
 517         size_t converted_size;
 518         struct smbd_server_connection *sconn = req->sconn;
 519
 520         START_PROFILE(SMBnegprot);
 521
 522         if (sconn->smb1.negprot.done) {
 523                 END_PROFILE(SMBnegprot);
 524                 exit_server_cleanly("multiple negprot's are not permitted");
 525         }
 526         sconn->smb1.negprot.done = true;
 527
 528         if (req->buflen == 0) {
 529                 DEBUG(0, ("negprot got no protocols\n"));
 530                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 531                 END_PROFILE(SMBnegprot);
 532                 return;
 533         }
 534
 535         if (req->buf[req->buflen-1] != '\0') {
 536                 DEBUG(0, ("negprot protocols not 0-terminated\n"));
 537                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 538                 END_PROFILE(SMBnegprot);
 539                 return;
 540         }
 541
 542         p = (const char *)req->buf + 1;
 543
 544         num_cliprotos = 0;
 545         cliprotos = NULL;
 546
 547         while (smbreq_bufrem(req, p) > 0) {
 548
 549                 char **tmp;
 550
 551                 tmp = talloc_realloc(talloc_tos(), cliprotos, char *,
 552                                            num_cliprotos+1);
 553                 if (tmp == NULL) {
 554                         DEBUG(0, ("talloc failed\n"));
 555                         TALLOC_FREE(cliprotos);
 556                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 557                         END_PROFILE(SMBnegprot);
 558                         return;
 559                 }
 560
 561                 cliprotos = tmp;
 562
 563                 if (!pull_ascii_talloc(cliprotos, &cliprotos[num_cliprotos], p,
 564                                        &converted_size)) {
 565                         DEBUG(0, ("pull_ascii_talloc failed\n"));
 566                         TALLOC_FREE(cliprotos);
 567                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 568                         END_PROFILE(SMBnegprot);
 569                         return;
 570                 }
 571
 572                 DEBUG(3, ("Requested protocol [%s]\n",
 573                           cliprotos[num_cliprotos]));
 574
 575                 num_cliprotos += 1;
 576                 p += strlen(p) + 2;
 577         }
 578
 579         for (i=0; i<num_cliprotos; i++) {
 580                 if (strcsequal(cliprotos[i], "Windows for Workgroups 3.1a"))
 581                         arch &= ( ARCH_WFWG | ARCH_WIN95 | ARCH_WINNT
 582                                   | ARCH_WIN2K );
 583                 else if (strcsequal(cliprotos[i], "DOS LM1.2X002"))
 584                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 585                 else if (strcsequal(cliprotos[i], "DOS LANMAN2.1"))
 586                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 587                 else if (strcsequal(cliprotos[i], "NT LM 0.12"))
 588                         arch &= ( ARCH_WIN95 | ARCH_WINNT | ARCH_WIN2K
 589                                   | ARCH_CIFSFS);
 590                 else if (strcsequal(cliprotos[i], "SMB 2.001"))
 591                         arch = ARCH_VISTA;
 592                 else if (strcsequal(cliprotos[i], "LANMAN2.1"))
 593                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 594                 else if (strcsequal(cliprotos[i], "LM1.2X002"))
 595                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 596                 else if (strcsequal(cliprotos[i], "MICROSOFT NETWORKS 1.03"))
 597                         arch &= ARCH_WINNT;
 598                 else if (strcsequal(cliprotos[i], "XENIX CORE"))
 599                         arch &= ( ARCH_WINNT | ARCH_OS2 );
 600                 else if (strcsequal(cliprotos[i], "Samba")) {
 601                         arch = ARCH_SAMBA;
 602                         break;
 603                 } else if (strcsequal(cliprotos[i], "POSIX 2")) {
 604                         arch = ARCH_CIFSFS;
 605                         break;
 606                 }
 607         }
 608
 609         /* CIFSFS can send one arch only, NT LM 0.12. */
 610         if (i == 1 && (arch & ARCH_CIFSFS)) {
 611                 arch = ARCH_CIFSFS;
 612         }
 613
 614         switch ( arch ) {
 615                 case ARCH_CIFSFS:
 616                         set_remote_arch(RA_CIFSFS);
 617                         break;
 618                 case ARCH_SAMBA:
 619                         set_remote_arch(RA_SAMBA);
 620                         break;
 621                 case ARCH_WFWG:
 622                         set_remote_arch(RA_WFWG);
 623                         break;
 624                 case ARCH_WIN95:
 625                         set_remote_arch(RA_WIN95);
 626                         break;
 627                 case ARCH_WINNT:
 628                         if(req->flags2 == FLAGS2_WIN2K_SIGNATURE)
 629                                 set_remote_arch(RA_WIN2K);
 630                         else
 631                                 set_remote_arch(RA_WINNT);
 632                         break;
 633                 case ARCH_WIN2K:
 634                         /* Vista may have been set in the negprot so don't
 635                            override it here */
 636                         if ( get_remote_arch() != RA_VISTA )
 637                                 set_remote_arch(RA_WIN2K);
 638                         break;
 639                 case ARCH_VISTA:
 640                         set_remote_arch(RA_VISTA);
 641                         break;
 642                 case ARCH_OS2:
 643                         set_remote_arch(RA_OS2);
 644                         break;
 645                 default:
 646                         set_remote_arch(RA_UNKNOWN);
 647                 break;
 648         }
 649
 650         /* possibly reload - change of architecture */
 651         reload_services(sconn, conn_snum_used, true);
 652
 653         /* moved from the netbios session setup code since we don't have that
 654            when the client connects to port 445.  Of course there is a small
 655            window where we are listening to messages   -- jerry */
 656
 657         serverid_register(messaging_server_id(sconn->msg_ctx),
 658                           FLAG_MSG_GENERAL|FLAG_MSG_SMBD
 659                           |FLAG_MSG_PRINT_GENERAL);
 660
 661         /* Check for protocols, most desirable first */
 662         for (protocol = 0; supported_protocols[protocol].proto_name; protocol++) {
 663                 i = 0;
 664                 if ((supported_protocols[protocol].protocol_level <= lp_server_max_protocol()) &&
 665                                 (supported_protocols[protocol].protocol_level >= lp_server_min_protocol()))
 666                         while (i < num_cliprotos) {
 667                                 if (strequal(cliprotos[i],supported_protocols[protocol].proto_name)) {
 668                                         choice = i;
 669                                         chosen_level = supported_protocols[protocol].protocol_level;
 670                                 }
 671                                 i++;
 672                         }
 673                 if(choice != -1)
 674                         break;
 675         }
 676
 677         if(choice != -1) {
 678                 fstrcpy(remote_proto,supported_protocols[protocol].short_name);
 679                 reload_services(sconn, conn_snum_used, true);
 680                 supported_protocols[protocol].proto_reply_fn(req, choice);
 681                 DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
 682         } else {
 683                 DEBUG(0,("No protocol supported !\n"));
 684                 reply_outbuf(req, 1, 0);
 685                 SSVAL(req->outbuf, smb_vwv0, choice);
 686         }
 687
 688         DEBUG( 5, ( "negprot index=%d\n", choice ) );
 689
 690         if ((lp_server_signing() == SMB_SIGNING_REQUIRED)
 691             && (chosen_level < PROTOCOL_NT1)) {
 692                 exit_server_cleanly("SMB signing is required and "
 693                         "client negotiated a downlevel protocol");
 694         }
 695
 696         TALLOC_FREE(cliprotos);
 697
 698         if (lp_async_smb_echo_handler() && (chosen_level < PROTOCOL_SMB2_02) &&
 699             !fork_echo_handler(sconn)) {
 700                 exit_server("Failed to fork echo handler");
 701         }
 702
 703         END_PROFILE(SMBnegprot);
 704         return;
 705 }