2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../libcli/auth/spnego.h"
26 #include "../libcli/auth/ntlmssp.h"
27 #include "ntlmssp_wrap.h"
28 #include "../librpc/gen_ndr/krb5pac.h"
29 #include "libads/kerberos_proto.h"
31 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
32 uint64_t in_session_id
,
33 uint8_t in_security_mode
,
34 DATA_BLOB in_security_buffer
,
35 uint16_t *out_session_flags
,
36 DATA_BLOB
*out_security_buffer
,
37 uint64_t *out_session_id
);
39 NTSTATUS
smbd_smb2_request_process_sesssetup(struct smbd_smb2_request
*smb2req
)
42 const uint8_t *inbody
;
43 int i
= smb2req
->current_idx
;
47 size_t expected_body_size
= 0x19;
49 uint64_t in_session_id
;
50 uint8_t in_security_mode
;
51 uint16_t in_security_offset
;
52 uint16_t in_security_length
;
53 DATA_BLOB in_security_buffer
;
54 uint16_t out_session_flags
;
55 uint64_t out_session_id
;
56 uint16_t out_security_offset
;
57 DATA_BLOB out_security_buffer
;
60 inhdr
= (const uint8_t *)smb2req
->in
.vector
[i
+0].iov_base
;
62 if (smb2req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
63 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
66 inbody
= (const uint8_t *)smb2req
->in
.vector
[i
+1].iov_base
;
68 body_size
= SVAL(inbody
, 0x00);
69 if (body_size
!= expected_body_size
) {
70 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
73 in_security_offset
= SVAL(inbody
, 0x0C);
74 in_security_length
= SVAL(inbody
, 0x0E);
76 if (in_security_offset
!= (SMB2_HDR_BODY
+ (body_size
& 0xFFFFFFFE))) {
77 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
80 if (in_security_length
> smb2req
->in
.vector
[i
+2].iov_len
) {
81 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
84 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
85 in_security_mode
= CVAL(inbody
, 0x03);
86 in_security_buffer
.data
= (uint8_t *)smb2req
->in
.vector
[i
+2].iov_base
;
87 in_security_buffer
.length
= in_security_length
;
89 status
= smbd_smb2_session_setup(smb2req
,
96 if (!NT_STATUS_IS_OK(status
) &&
97 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
98 status
= nt_status_squash(status
);
99 return smbd_smb2_request_error(smb2req
, status
);
102 out_security_offset
= SMB2_HDR_BODY
+ 0x08;
104 outhdr
= (uint8_t *)smb2req
->out
.vector
[i
].iov_base
;
106 outbody
= data_blob_talloc(smb2req
->out
.vector
, NULL
, 0x08);
107 if (outbody
.data
== NULL
) {
108 return smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
111 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, out_session_id
);
113 SSVAL(outbody
.data
, 0x00, 0x08 + 1); /* struct size */
114 SSVAL(outbody
.data
, 0x02,
115 out_session_flags
); /* session flags */
116 SSVAL(outbody
.data
, 0x04,
117 out_security_offset
); /* security buffer offset */
118 SSVAL(outbody
.data
, 0x06,
119 out_security_buffer
.length
); /* security buffer length */
121 outdyn
= out_security_buffer
;
123 return smbd_smb2_request_done_ex(smb2req
, status
, outbody
, &outdyn
,
127 static int smbd_smb2_session_destructor(struct smbd_smb2_session
*session
)
129 if (session
->sconn
== NULL
) {
133 /* first free all tcons */
134 while (session
->tcons
.list
) {
135 talloc_free(session
->tcons
.list
);
138 idr_remove(session
->sconn
->smb2
.sessions
.idtree
, session
->vuid
);
139 DLIST_REMOVE(session
->sconn
->smb2
.sessions
.list
, session
);
140 invalidate_vuid(session
->sconn
, session
->vuid
);
143 session
->status
= NT_STATUS_USER_SESSION_DELETED
;
144 session
->sconn
= NULL
;
149 static NTSTATUS
setup_ntlmssp_server_info(struct smbd_smb2_session
*session
,
152 if (NT_STATUS_IS_OK(status
)) {
153 status
= auth_ntlmssp_steal_server_info(session
,
154 session
->auth_ntlmssp_state
,
155 &session
->server_info
);
157 /* Note that this server_info won't have a session
158 * key. But for map to guest, that's exactly the right
159 * thing - we can't reasonably guess the key the
160 * client wants, as the password was wrong */
161 status
= do_map_to_guest(status
,
162 &session
->server_info
,
163 auth_ntlmssp_get_username(session
->auth_ntlmssp_state
),
164 auth_ntlmssp_get_domain(session
->auth_ntlmssp_state
));
170 static NTSTATUS
smbd_smb2_session_setup_krb5(struct smbd_smb2_session
*session
,
171 struct smbd_smb2_request
*smb2req
,
172 uint8_t in_security_mode
,
173 const DATA_BLOB
*secblob
,
175 uint16_t *out_session_flags
,
176 DATA_BLOB
*out_security_buffer
,
177 uint64_t *out_session_id
)
179 DATA_BLOB ap_rep
= data_blob_null
;
180 DATA_BLOB ap_rep_wrapped
= data_blob_null
;
181 DATA_BLOB ticket
= data_blob_null
;
182 DATA_BLOB session_key
= data_blob_null
;
183 DATA_BLOB secblob_out
= data_blob_null
;
185 struct PAC_LOGON_INFO
*logon_info
= NULL
;
186 char *principal
= NULL
;
189 struct passwd
*pw
= NULL
;
193 bool username_was_mapped
= false;
194 bool map_domainuser_to_guest
= false;
196 if (!spnego_parse_krb5_wrap(talloc_tos(), *secblob
, &ticket
, tok_id
)) {
197 status
= NT_STATUS_LOGON_FAILURE
;
201 status
= ads_verify_ticket(smb2req
, lp_realm(), 0, &ticket
,
202 &principal
, &logon_info
, &ap_rep
,
205 if (!NT_STATUS_IS_OK(status
)) {
206 DEBUG(1,("smb2: Failed to verify incoming ticket with error %s!\n",
208 if (!NT_STATUS_EQUAL(status
, NT_STATUS_TIME_DIFFERENCE_AT_DC
)) {
209 status
= NT_STATUS_LOGON_FAILURE
;
214 status
= get_user_from_kerberos_info(talloc_tos(),
215 smb2req
->sconn
->client_id
.name
,
216 principal
, logon_info
,
217 &username_was_mapped
,
218 &map_domainuser_to_guest
,
220 &real_username
, &pw
);
221 if (!NT_STATUS_IS_OK(status
)) {
225 /* save the PAC data if we have it */
227 netsamlogon_cache_store(user
, &logon_info
->info3
);
230 /* setup the string used by %U */
231 sub_set_smb_name(real_username
);
233 /* reload services so that the new %U is taken into account */
234 reload_services(smb2req
->sconn
->msg_ctx
, smb2req
->sconn
->sock
, true);
236 status
= make_server_info_krb5(session
,
237 user
, domain
, real_username
, pw
,
238 logon_info
, map_domainuser_to_guest
,
239 &session
->server_info
);
240 if (!NT_STATUS_IS_OK(status
)) {
241 DEBUG(1, ("smb2: make_server_info_krb5 failed\n"));
246 session
->server_info
->nss_token
|= username_was_mapped
;
248 /* we need to build the token for the user. make_server_info_guest()
251 if (!session
->server_info
->security_token
) {
252 status
= create_local_token(session
->server_info
);
253 if (!NT_STATUS_IS_OK(status
)) {
254 DEBUG(10,("smb2: failed to create local token: %s\n",
260 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
261 lp_server_signing() == Required
) {
262 session
->do_signing
= true;
265 if (session
->server_info
->guest
) {
266 /* we map anonymous to guest internally */
267 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
268 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
269 /* force no signing */
270 session
->do_signing
= false;
273 data_blob_free(&session
->server_info
->user_session_key
);
274 session
->server_info
->user_session_key
=
276 session
->server_info
,
279 if (session_key
.length
> 0) {
280 if (session
->server_info
->user_session_key
.data
== NULL
) {
281 status
= NT_STATUS_NO_MEMORY
;
285 session
->session_key
= session
->server_info
->user_session_key
;
287 session
->compat_vuser
= talloc_zero(session
, user_struct
);
288 if (session
->compat_vuser
== NULL
) {
289 status
= NT_STATUS_NO_MEMORY
;
292 session
->compat_vuser
->auth_ntlmssp_state
= NULL
;
293 session
->compat_vuser
->homes_snum
= -1;
294 session
->compat_vuser
->server_info
= session
->server_info
;
295 session
->compat_vuser
->session_keystr
= NULL
;
296 session
->compat_vuser
->vuid
= session
->vuid
;
297 DLIST_ADD(session
->sconn
->smb1
.sessions
.validated_users
, session
->compat_vuser
);
299 /* This is a potentially untrusted username */
300 alpha_strcpy(tmp
, user
, ". _-$", sizeof(tmp
));
301 session
->server_info
->sanitized_username
=
302 talloc_strdup(session
->server_info
, tmp
);
304 if (!session
->server_info
->guest
) {
305 session
->compat_vuser
->homes_snum
=
306 register_homes_share(session
->server_info
->unix_name
);
309 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
310 DEBUG(1, ("smb2: Failed to claim session "
312 session
->compat_vuser
->vuid
));
316 session
->status
= NT_STATUS_OK
;
319 * we attach the session to the request
320 * so that the response can be signed
322 smb2req
->session
= session
;
323 if (session
->do_signing
) {
324 smb2req
->do_signing
= true;
327 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
328 status
= NT_STATUS_OK
;
330 /* wrap that up in a nice GSS-API wrapping */
331 ap_rep_wrapped
= spnego_gen_krb5_wrap(talloc_tos(), ap_rep
,
334 secblob_out
= spnego_gen_auth_response(
340 *out_security_buffer
= data_blob_talloc(smb2req
,
343 if (secblob_out
.data
&& out_security_buffer
->data
== NULL
) {
344 status
= NT_STATUS_NO_MEMORY
;
348 data_blob_free(&ap_rep
);
349 data_blob_free(&ap_rep_wrapped
);
350 data_blob_free(&ticket
);
351 data_blob_free(&session_key
);
352 data_blob_free(&secblob_out
);
354 *out_session_id
= session
->vuid
;
360 data_blob_free(&ap_rep
);
361 data_blob_free(&ap_rep_wrapped
);
362 data_blob_free(&ticket
);
363 data_blob_free(&session_key
);
364 data_blob_free(&secblob_out
);
366 ap_rep_wrapped
= data_blob_null
;
367 secblob_out
= spnego_gen_auth_response(
373 *out_security_buffer
= data_blob_talloc(smb2req
,
376 data_blob_free(&secblob_out
);
381 static NTSTATUS
smbd_smb2_spnego_negotiate(struct smbd_smb2_session
*session
,
382 struct smbd_smb2_request
*smb2req
,
383 uint8_t in_security_mode
,
384 DATA_BLOB in_security_buffer
,
385 uint16_t *out_session_flags
,
386 DATA_BLOB
*out_security_buffer
,
387 uint64_t *out_session_id
)
389 DATA_BLOB secblob_in
= data_blob_null
;
390 DATA_BLOB chal_out
= data_blob_null
;
391 char *kerb_mech
= NULL
;
394 /* Ensure we have no old NTLM state around. */
395 TALLOC_FREE(session
->auth_ntlmssp_state
);
397 status
= parse_spnego_mechanisms(talloc_tos(), in_security_buffer
,
398 &secblob_in
, &kerb_mech
);
399 if (!NT_STATUS_IS_OK(status
)) {
404 if (kerb_mech
&& ((lp_security()==SEC_ADS
) ||
405 USE_KERBEROS_KEYTAB
) ) {
406 status
= smbd_smb2_session_setup_krb5(session
,
420 /* The mechtoken is a krb5 ticket, but
421 * we need to fall back to NTLM. */
423 DEBUG(3,("smb2: Got krb5 ticket in SPNEGO "
424 "but set to downgrade to NTLMSSP\n"));
426 status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
428 /* Fall back to NTLMSSP. */
429 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
430 if (!NT_STATUS_IS_OK(status
)) {
434 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
439 if (!NT_STATUS_IS_OK(status
) &&
440 !NT_STATUS_EQUAL(status
,
441 NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
445 *out_security_buffer
= spnego_gen_auth_response(smb2req
,
449 if (out_security_buffer
->data
== NULL
) {
450 status
= NT_STATUS_NO_MEMORY
;
453 *out_session_id
= session
->vuid
;
457 data_blob_free(&secblob_in
);
458 data_blob_free(&chal_out
);
459 TALLOC_FREE(kerb_mech
);
460 if (!NT_STATUS_IS_OK(status
) &&
461 !NT_STATUS_EQUAL(status
,
462 NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
463 TALLOC_FREE(session
->auth_ntlmssp_state
);
464 TALLOC_FREE(session
);
469 static NTSTATUS
smbd_smb2_common_ntlmssp_auth_return(struct smbd_smb2_session
*session
,
470 struct smbd_smb2_request
*smb2req
,
471 uint8_t in_security_mode
,
472 DATA_BLOB in_security_buffer
,
473 uint16_t *out_session_flags
,
474 uint64_t *out_session_id
)
478 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
479 lp_server_signing() == Required
) {
480 session
->do_signing
= true;
483 if (session
->server_info
->guest
) {
484 /* we map anonymous to guest internally */
485 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
486 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
487 /* force no signing */
488 session
->do_signing
= false;
491 session
->session_key
= session
->server_info
->user_session_key
;
493 session
->compat_vuser
= talloc_zero(session
, user_struct
);
494 if (session
->compat_vuser
== NULL
) {
495 TALLOC_FREE(session
->auth_ntlmssp_state
);
496 TALLOC_FREE(session
);
497 return NT_STATUS_NO_MEMORY
;
499 session
->compat_vuser
->auth_ntlmssp_state
= session
->auth_ntlmssp_state
;
500 session
->compat_vuser
->homes_snum
= -1;
501 session
->compat_vuser
->server_info
= session
->server_info
;
502 session
->compat_vuser
->session_keystr
= NULL
;
503 session
->compat_vuser
->vuid
= session
->vuid
;
504 DLIST_ADD(session
->sconn
->smb1
.sessions
.validated_users
, session
->compat_vuser
);
506 /* This is a potentially untrusted username */
508 auth_ntlmssp_get_username(session
->auth_ntlmssp_state
),
511 session
->server_info
->sanitized_username
= talloc_strdup(
512 session
->server_info
, tmp
);
514 if (!session
->compat_vuser
->server_info
->guest
) {
515 session
->compat_vuser
->homes_snum
=
516 register_homes_share(session
->server_info
->unix_name
);
519 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
520 DEBUG(1, ("smb2: Failed to claim session "
522 session
->compat_vuser
->vuid
));
523 TALLOC_FREE(session
->auth_ntlmssp_state
);
524 TALLOC_FREE(session
);
525 return NT_STATUS_LOGON_FAILURE
;
529 session
->status
= NT_STATUS_OK
;
532 * we attach the session to the request
533 * so that the response can be signed
535 smb2req
->session
= session
;
536 if (session
->do_signing
) {
537 smb2req
->do_signing
= true;
540 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
542 *out_session_id
= session
->vuid
;
547 static NTSTATUS
smbd_smb2_spnego_auth(struct smbd_smb2_session
*session
,
548 struct smbd_smb2_request
*smb2req
,
549 uint8_t in_security_mode
,
550 DATA_BLOB in_security_buffer
,
551 uint16_t *out_session_flags
,
552 DATA_BLOB
*out_security_buffer
,
553 uint64_t *out_session_id
)
555 DATA_BLOB auth
= data_blob_null
;
556 DATA_BLOB auth_out
= data_blob_null
;
559 if (!spnego_parse_auth(talloc_tos(), in_security_buffer
, &auth
)) {
560 TALLOC_FREE(session
);
561 return NT_STATUS_LOGON_FAILURE
;
564 if (auth
.data
[0] == ASN1_APPLICATION(0)) {
565 /* Might be a second negTokenTarg packet */
566 DATA_BLOB secblob_in
= data_blob_null
;
567 char *kerb_mech
= NULL
;
569 status
= parse_spnego_mechanisms(talloc_tos(),
571 &secblob_in
, &kerb_mech
);
572 if (!NT_STATUS_IS_OK(status
)) {
573 TALLOC_FREE(session
);
578 if (kerb_mech
&& ((lp_security()==SEC_ADS
) ||
579 USE_KERBEROS_KEYTAB
) ) {
580 status
= smbd_smb2_session_setup_krb5(session
,
589 data_blob_free(&secblob_in
);
590 TALLOC_FREE(kerb_mech
);
591 if (!NT_STATUS_IS_OK(status
)) {
592 TALLOC_FREE(session
);
598 /* Can't blunder into NTLMSSP auth if we have
602 DEBUG(3,("smb2: network "
603 "misconfiguration, client sent us a "
604 "krb5 ticket and kerberos security "
606 TALLOC_FREE(session
);
607 data_blob_free(&secblob_in
);
608 TALLOC_FREE(kerb_mech
);
609 return NT_STATUS_LOGON_FAILURE
;
612 data_blob_free(&secblob_in
);
615 if (session
->auth_ntlmssp_state
== NULL
) {
616 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
617 if (!NT_STATUS_IS_OK(status
)) {
618 data_blob_free(&auth
);
619 TALLOC_FREE(session
);
624 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
627 /* We need to call setup_ntlmssp_server_info() if status==NT_STATUS_OK,
628 or if status is anything except NT_STATUS_MORE_PROCESSING_REQUIRED,
629 as this can trigger map to guest. */
630 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
631 status
= setup_ntlmssp_server_info(session
, status
);
634 if (!NT_STATUS_IS_OK(status
) &&
635 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
636 TALLOC_FREE(session
->auth_ntlmssp_state
);
637 data_blob_free(&auth
);
638 TALLOC_FREE(session
);
642 data_blob_free(&auth
);
644 *out_security_buffer
= spnego_gen_auth_response(smb2req
,
645 &auth_out
, status
, NULL
);
647 if (out_security_buffer
->data
== NULL
) {
648 TALLOC_FREE(session
->auth_ntlmssp_state
);
649 TALLOC_FREE(session
);
650 return NT_STATUS_NO_MEMORY
;
653 *out_session_id
= session
->vuid
;
655 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
656 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
659 /* We're done - claim the session. */
660 return smbd_smb2_common_ntlmssp_auth_return(session
,
668 static NTSTATUS
smbd_smb2_raw_ntlmssp_auth(struct smbd_smb2_session
*session
,
669 struct smbd_smb2_request
*smb2req
,
670 uint8_t in_security_mode
,
671 DATA_BLOB in_security_buffer
,
672 uint16_t *out_session_flags
,
673 DATA_BLOB
*out_security_buffer
,
674 uint64_t *out_session_id
)
677 DATA_BLOB secblob_out
= data_blob_null
;
679 if (session
->auth_ntlmssp_state
== NULL
) {
680 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
681 if (!NT_STATUS_IS_OK(status
)) {
682 TALLOC_FREE(session
);
688 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
692 if (NT_STATUS_IS_OK(status
) ||
693 NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
694 *out_security_buffer
= data_blob_talloc(smb2req
,
697 if (secblob_out
.data
&& out_security_buffer
->data
== NULL
) {
698 TALLOC_FREE(session
->auth_ntlmssp_state
);
699 TALLOC_FREE(session
);
700 return NT_STATUS_NO_MEMORY
;
704 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
705 *out_session_id
= session
->vuid
;
709 status
= setup_ntlmssp_server_info(session
, status
);
711 if (!NT_STATUS_IS_OK(status
)) {
712 TALLOC_FREE(session
->auth_ntlmssp_state
);
713 TALLOC_FREE(session
);
716 *out_session_id
= session
->vuid
;
718 return smbd_smb2_common_ntlmssp_auth_return(session
,
726 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
727 uint64_t in_session_id
,
728 uint8_t in_security_mode
,
729 DATA_BLOB in_security_buffer
,
730 uint16_t *out_session_flags
,
731 DATA_BLOB
*out_security_buffer
,
732 uint64_t *out_session_id
)
734 struct smbd_smb2_session
*session
;
736 *out_session_flags
= 0;
739 if (in_session_id
== 0) {
742 /* create a new session */
743 session
= talloc_zero(smb2req
->sconn
, struct smbd_smb2_session
);
744 if (session
== NULL
) {
745 return NT_STATUS_NO_MEMORY
;
747 session
->status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
748 id
= idr_get_new_random(smb2req
->sconn
->smb2
.sessions
.idtree
,
750 smb2req
->sconn
->smb2
.sessions
.limit
);
752 return NT_STATUS_INSUFFICIENT_RESOURCES
;
756 session
->tcons
.idtree
= idr_init(session
);
757 if (session
->tcons
.idtree
== NULL
) {
758 return NT_STATUS_NO_MEMORY
;
760 session
->tcons
.limit
= 0x0000FFFE;
761 session
->tcons
.list
= NULL
;
763 DLIST_ADD_END(smb2req
->sconn
->smb2
.sessions
.list
, session
,
764 struct smbd_smb2_session
*);
765 session
->sconn
= smb2req
->sconn
;
766 talloc_set_destructor(session
, smbd_smb2_session_destructor
);
770 /* lookup an existing session */
771 p
= idr_find(smb2req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
773 return NT_STATUS_USER_SESSION_DELETED
;
775 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
778 if (NT_STATUS_IS_OK(session
->status
)) {
779 return NT_STATUS_REQUEST_NOT_ACCEPTED
;
782 if (in_security_buffer
.data
[0] == ASN1_APPLICATION(0)) {
783 return smbd_smb2_spnego_negotiate(session
,
790 } else if (in_security_buffer
.data
[0] == ASN1_CONTEXT(1)) {
791 return smbd_smb2_spnego_auth(session
,
798 } else if (strncmp((char *)(in_security_buffer
.data
), "NTLMSSP", 7) == 0) {
799 return smbd_smb2_raw_ntlmssp_auth(session
,
808 /* Unknown packet type. */
809 DEBUG(1,("Unknown packet type %u in smb2 sessionsetup\n",
810 (unsigned int)in_security_buffer
.data
[0] ));
811 TALLOC_FREE(session
->auth_ntlmssp_state
);
812 TALLOC_FREE(session
);
813 return NT_STATUS_LOGON_FAILURE
;
816 NTSTATUS
smbd_smb2_request_check_session(struct smbd_smb2_request
*req
)
818 const uint8_t *inhdr
;
819 const uint8_t *outhdr
;
820 int i
= req
->current_idx
;
821 uint64_t in_session_id
;
823 struct smbd_smb2_session
*session
;
824 bool chained_fixup
= false;
826 inhdr
= (const uint8_t *)req
->in
.vector
[i
+0].iov_base
;
828 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
830 if (in_session_id
== (0xFFFFFFFFFFFFFFFFLL
)) {
833 * async request - fill in session_id from
834 * already setup request out.vector[].iov_base.
836 outhdr
= (const uint8_t *)req
->out
.vector
[i
].iov_base
;
837 in_session_id
= BVAL(outhdr
, SMB2_HDR_SESSION_ID
);
840 * Chained request - fill in session_id from
841 * the previous request out.vector[].iov_base.
843 outhdr
= (const uint8_t *)req
->out
.vector
[i
-3].iov_base
;
844 in_session_id
= BVAL(outhdr
, SMB2_HDR_SESSION_ID
);
845 chained_fixup
= true;
849 /* lookup an existing session */
850 p
= idr_find(req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
852 return NT_STATUS_USER_SESSION_DELETED
;
854 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
856 if (!NT_STATUS_IS_OK(session
->status
)) {
857 return NT_STATUS_ACCESS_DENIED
;
860 set_current_user_info(session
->server_info
->sanitized_username
,
861 session
->server_info
->unix_name
,
862 session
->server_info
->info3
->base
.domain
.string
);
864 req
->session
= session
;
867 /* Fix up our own outhdr. */
868 outhdr
= (const uint8_t *)req
->out
.vector
[i
].iov_base
;
869 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, in_session_id
);
874 NTSTATUS
smbd_smb2_request_process_logoff(struct smbd_smb2_request
*req
)
876 const uint8_t *inbody
;
877 int i
= req
->current_idx
;
879 size_t expected_body_size
= 0x04;
882 if (req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
883 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
886 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
888 body_size
= SVAL(inbody
, 0x00);
889 if (body_size
!= expected_body_size
) {
890 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
894 * TODO: cancel all outstanding requests on the session
895 * and delete all tree connections.
897 smbd_smb2_session_destructor(req
->session
);
899 * we may need to sign the response, so we need to keep
900 * the session until the response is sent to the wire.
902 talloc_steal(req
, req
->session
);
904 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x04);
905 if (outbody
.data
== NULL
) {
906 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
909 SSVAL(outbody
.data
, 0x00, 0x04); /* struct size */
910 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
912 return smbd_smb2_request_done(req
, outbody
, NULL
);