source3/smbd/negprot.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    negprot reply code
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23 #include "../libcli/auth/spnego.h"
  24
  25 extern fstring remote_proto;
  26
  27 static void get_challenge(struct smbd_server_connection *sconn, uint8 buff[8])
  28 {
  29         NTSTATUS nt_status;
  30
  31         /* We might be called more than once, multiple negprots are
  32          * permitted */
  33         if (sconn->smb1.negprot.auth_context) {
  34                 DEBUG(3, ("get challenge: is this a secondary negprot? "
  35                           "sconn->negprot.auth_context is non-NULL!\n"));
  36                         TALLOC_FREE(sconn->smb1.negprot.auth_context);
  37         }
  38
  39         DEBUG(10, ("get challenge: creating negprot_global_auth_context\n"));
  40         nt_status = make_auth_context_subsystem(
  41                 sconn, &sconn->smb1.negprot.auth_context);
  42         if (!NT_STATUS_IS_OK(nt_status)) {
  43                 DEBUG(0, ("make_auth_context_subsystem returned %s",
  44                           nt_errstr(nt_status)));
  45                 smb_panic("cannot make_negprot_global_auth_context!");
  46         }
  47         DEBUG(10, ("get challenge: getting challenge\n"));
  48         sconn->smb1.negprot.auth_context->get_ntlm_challenge(
  49                 sconn->smb1.negprot.auth_context, buff);
  50 }
  51
  52 /****************************************************************************
  53  Reply for the core protocol.
  54 ****************************************************************************/
  55
  56 static void reply_corep(struct smb_request *req, uint16 choice)
  57 {
  58         reply_outbuf(req, 1, 0);
  59         SSVAL(req->outbuf, smb_vwv0, choice);
  60
  61         set_Protocol(PROTOCOL_CORE);
  62 }
  63
  64 /****************************************************************************
  65  Reply for the coreplus protocol.
  66 ****************************************************************************/
  67
  68 static void reply_coreplus(struct smb_request *req, uint16 choice)
  69 {
  70         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
  71
  72         reply_outbuf(req, 13, 0);
  73
  74         SSVAL(req->outbuf,smb_vwv0,choice);
  75         SSVAL(req->outbuf,smb_vwv5,raw); /* tell redirector we support
  76                         readbraw and writebraw (possibly) */
  77         /* Reply, SMBlockread, SMBwritelock supported. */
  78         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
  79         SSVAL(req->outbuf,smb_vwv1,0x1); /* user level security, don't
  80                                           * encrypt */
  81         set_Protocol(PROTOCOL_COREPLUS);
  82 }
  83
  84 /****************************************************************************
  85  Reply for the lanman 1.0 protocol.
  86 ****************************************************************************/
  87
  88 static void reply_lanman1(struct smb_request *req, uint16 choice)
  89 {
  90         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
  91         int secword=0;
  92         time_t t = time(NULL);
  93         struct smbd_server_connection *sconn = req->sconn;
  94
  95         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
  96
  97         if (lp_security()>=SEC_USER) {
  98                 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
  99         }
 100         if (sconn->smb1.negprot.encrypted_passwords) {
 101                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 102         }
 103
 104         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
 105
 106         SSVAL(req->outbuf,smb_vwv0,choice);
 107         SSVAL(req->outbuf,smb_vwv1,secword);
 108         /* Create a token value and add it to the outgoing packet. */
 109         if (sconn->smb1.negprot.encrypted_passwords) {
 110                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
 111                 SSVAL(req->outbuf,smb_vwv11, 8);
 112         }
 113
 114         set_Protocol(PROTOCOL_LANMAN1);
 115
 116         /* Reply, SMBlockread, SMBwritelock supported. */
 117         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
 118         SSVAL(req->outbuf,smb_vwv2,sconn->smb1.negprot.max_recv);
 119         SSVAL(req->outbuf,smb_vwv3,lp_maxmux()); /* maxmux */
 120         SSVAL(req->outbuf,smb_vwv4,1);
 121         SSVAL(req->outbuf,smb_vwv5,raw); /* tell redirector we support
 122                 readbraw writebraw (possibly) */
 123         SIVAL(req->outbuf,smb_vwv6,sys_getpid());
 124         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
 125
 126         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 127
 128         return;
 129 }
 130
 131 /****************************************************************************
 132  Reply for the lanman 2.0 protocol.
 133 ****************************************************************************/
 134
 135 static void reply_lanman2(struct smb_request *req, uint16 choice)
 136 {
 137         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
 138         int secword=0;
 139         time_t t = time(NULL);
 140         struct smbd_server_connection *sconn = req->sconn;
 141
 142         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 143
 144         if (lp_security()>=SEC_USER) {
 145                 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 146         }
 147         if (sconn->smb1.negprot.encrypted_passwords) {
 148                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 149         }
 150
 151         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
 152
 153         SSVAL(req->outbuf,smb_vwv0,choice);
 154         SSVAL(req->outbuf,smb_vwv1,secword);
 155         SIVAL(req->outbuf,smb_vwv6,sys_getpid());
 156
 157         /* Create a token value and add it to the outgoing packet. */
 158         if (sconn->smb1.negprot.encrypted_passwords) {
 159                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
 160                 SSVAL(req->outbuf,smb_vwv11, 8);
 161         }
 162
 163         set_Protocol(PROTOCOL_LANMAN2);
 164
 165         /* Reply, SMBlockread, SMBwritelock supported. */
 166         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
 167         SSVAL(req->outbuf,smb_vwv2,sconn->smb1.negprot.max_recv);
 168         SSVAL(req->outbuf,smb_vwv3,lp_maxmux());
 169         SSVAL(req->outbuf,smb_vwv4,1);
 170         SSVAL(req->outbuf,smb_vwv5,raw); /* readbraw and/or writebraw */
 171         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
 172         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 173 }
 174
 175 /****************************************************************************
 176  Generate the spnego negprot reply blob. Return the number of bytes used.
 177 ****************************************************************************/
 178
 179 DATA_BLOB negprot_spnego(TALLOC_CTX *ctx, struct smbd_server_connection *sconn)
 180 {
 181         DATA_BLOB blob = data_blob_null;
 182         DATA_BLOB blob_out = data_blob_null;
 183         nstring dos_name;
 184         fstring unix_name;
 185 #ifdef DEVELOPER
 186         size_t slen;
 187 #endif
 188         const char *OIDs_krb5[] = {OID_KERBEROS5,
 189                                    OID_KERBEROS5_OLD,
 190                                    OID_NTLMSSP,
 191                                    NULL};
 192         const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
 193
 194         sconn->smb1.negprot.spnego = true;
 195         /* strangely enough, NT does not sent the single OID NTLMSSP when
 196            not a ADS member, it sends no OIDs at all
 197
 198            OLD COMMENT : "we can't do this until we teach our sesssion setup parser to know
 199                    about raw NTLMSSP (clients send no ASN.1 wrapping if we do this)"
 200
 201            Our sessionsetup code now handles raw NTLMSSP connects, so we can go
 202            back to doing what W2K3 does here. This is needed to make PocketPC 2003
 203            CIFS connections work with SPNEGO. See bugzilla bugs #1828 and #3133
 204            for details. JRA.
 205
 206         */
 207
 208         if (lp_security() != SEC_ADS && !USE_KERBEROS_KEYTAB) {
 209 #if 0
 210                 /* Code for PocketPC client */
 211                 blob = data_blob(guid, 16);
 212 #else
 213                 /* Code for standalone WXP client */
 214                 blob = spnego_gen_negTokenInit(ctx, OIDs_ntlm, NULL, "NONE");
 215 #endif
 216         } else if (!lp_send_spnego_principal()) {
 217                 /* By default, Windows 2008 and later sends not_defined_in_RFC4178@please_ignore */
 218                 blob = spnego_gen_negTokenInit(ctx, OIDs_krb5, NULL, ADS_IGNORE_PRINCIPAL);
 219         } else {
 220                 fstring myname;
 221                 char *host_princ_s = NULL;
 222                 name_to_fqdn(myname, global_myname());
 223                 strlower_m(myname);
 224                 if (asprintf(&host_princ_s, "cifs/%s@%s", myname, lp_realm())
 225                     == -1) {
 226                         return data_blob_null;
 227                 }
 228                 blob = spnego_gen_negTokenInit(ctx, OIDs_krb5, NULL, host_princ_s);
 229                 SAFE_FREE(host_princ_s);
 230         }
 231
 232         blob_out = data_blob_talloc(ctx, NULL, 16 + blob.length);
 233         if (blob_out.data == NULL) {
 234                 data_blob_free(&blob);
 235                 return data_blob_null;
 236         }
 237
 238         memset(blob_out.data, '\0', 16);
 239
 240         safe_strcpy(unix_name, global_myname(), sizeof(unix_name)-1);
 241         strlower_m(unix_name);
 242         push_ascii_nstring(dos_name, unix_name);
 243         safe_strcpy((char *)blob_out.data, dos_name, 16);
 244
 245 #ifdef DEVELOPER
 246         /* Fix valgrind 'uninitialized bytes' issue. */
 247         slen = strlen(dos_name);
 248         if (slen < 16) {
 249                 memset(blob_out.data+slen, '\0', 16 - slen);
 250         }
 251 #endif
 252
 253         memcpy(&blob_out.data[16], blob.data, blob.length);
 254
 255         data_blob_free(&blob);
 256
 257         return blob_out;
 258 }
 259
 260 /****************************************************************************
 261  Reply for the nt protocol.
 262 ****************************************************************************/
 263
 264 static void reply_nt1(struct smb_request *req, uint16 choice)
 265 {
 266         /* dual names + lock_and_read + nt SMBs + remote API calls */
 267         int capabilities = CAP_NT_FIND|CAP_LOCK_AND_READ|
 268                 CAP_LEVEL_II_OPLOCKS;
 269
 270         int secword=0;
 271         bool negotiate_spnego = False;
 272         struct timespec ts;
 273         ssize_t ret;
 274         struct smbd_server_connection *sconn = req->sconn;
 275
 276         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 277
 278         /* Check the flags field to see if this is Vista.
 279            WinXP sets it and Vista does not. But we have to
 280            distinguish from NT which doesn't set it either. */
 281
 282         if ( (req->flags2 & FLAGS2_EXTENDED_SECURITY) &&
 283                 ((req->flags2 & FLAGS2_UNKNOWN_BIT4) == 0) )
 284         {
 285                 if (get_remote_arch() != RA_SAMBA) {
 286                         set_remote_arch( RA_VISTA );
 287                 }
 288         }
 289
 290         reply_outbuf(req,17,0);
 291
 292         /* do spnego in user level security if the client
 293            supports it and we can do encrypted passwords */
 294
 295         if (sconn->smb1.negprot.encrypted_passwords &&
 296             (lp_security() != SEC_SHARE) &&
 297             lp_use_spnego() &&
 298             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
 299                 negotiate_spnego = True;
 300                 capabilities |= CAP_EXTENDED_SECURITY;
 301                 add_to_common_flags2(FLAGS2_EXTENDED_SECURITY);
 302                 /* Ensure FLAGS2_EXTENDED_SECURITY gets set in this reply
 303                    (already partially constructed. */
 304                 SSVAL(req->outbuf, smb_flg2,
 305                       req->flags2 | FLAGS2_EXTENDED_SECURITY);
 306         }
 307
 308         capabilities |= CAP_NT_SMBS|CAP_RPC_REMOTE_APIS|CAP_UNICODE;
 309
 310         if (lp_unix_extensions()) {
 311                 capabilities |= CAP_UNIX;
 312         }
 313
 314         if (lp_large_readwrite() && (SMB_OFF_T_BITS == 64))
 315                 capabilities |= CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_W2K_SMBS;
 316
 317         if (SMB_OFF_T_BITS == 64)
 318                 capabilities |= CAP_LARGE_FILES;
 319
 320         if (lp_readraw() && lp_writeraw())
 321                 capabilities |= CAP_RAW_MODE;
 322
 323         if (lp_nt_status_support())
 324                 capabilities |= CAP_STATUS32;
 325
 326         if (lp_host_msdfs())
 327                 capabilities |= CAP_DFS;
 328
 329         if (lp_security() >= SEC_USER) {
 330                 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 331         }
 332         if (sconn->smb1.negprot.encrypted_passwords) {
 333                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 334         }
 335
 336         if (lp_server_signing()) {
 337                 if (lp_security() >= SEC_USER) {
 338                         secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
 339                         /* No raw mode with smb signing. */
 340                         capabilities &= ~CAP_RAW_MODE;
 341                         if (lp_server_signing() == Required)
 342                                 secword |=NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
 343                         srv_set_signing_negotiated(sconn);
 344                 } else {
 345                         DEBUG(0,("reply_nt1: smb signing is incompatible with share level security !\n"));
 346                         if (lp_server_signing() == Required) {
 347                                 exit_server_cleanly("reply_nt1: smb signing required and share level security selected.");
 348                         }
 349                 }
 350         }
 351
 352         SSVAL(req->outbuf,smb_vwv0,choice);
 353         SCVAL(req->outbuf,smb_vwv1,secword);
 354
 355         set_Protocol(PROTOCOL_NT1);
 356
 357         SSVAL(req->outbuf,smb_vwv1+1,lp_maxmux()); /* maxmpx */
 358         SSVAL(req->outbuf,smb_vwv2+1,1); /* num vcs */
 359         SIVAL(req->outbuf,smb_vwv3+1,
 360               sconn->smb1.negprot.max_recv); /* max buffer. LOTS! */
 361         SIVAL(req->outbuf,smb_vwv5+1,0x10000); /* raw size. full 64k */
 362         SIVAL(req->outbuf,smb_vwv7+1,sys_getpid()); /* session key */
 363         SIVAL(req->outbuf,smb_vwv9+1,capabilities); /* capabilities */
 364         clock_gettime(CLOCK_REALTIME,&ts);
 365         put_long_date_timespec(TIMESTAMP_SET_NT_OR_BETTER,(char *)req->outbuf+smb_vwv11+1,ts);
 366         SSVALS(req->outbuf,smb_vwv15+1,set_server_zone_offset(ts.tv_sec)/60);
 367
 368         if (!negotiate_spnego) {
 369                 /* Create a token value and add it to the outgoing packet. */
 370                 if (sconn->smb1.negprot.encrypted_passwords) {
 371                         uint8 chal[8];
 372                         /* note that we do not send a challenge at all if
 373                            we are using plaintext */
 374                         get_challenge(sconn, chal);
 375                         ret = message_push_blob(
 376                                 &req->outbuf, data_blob_const(chal, sizeof(chal)));
 377                         if (ret == -1) {
 378                                 DEBUG(0, ("Could not push challenge\n"));
 379                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 380                                 return;
 381                         }
 382                         SCVAL(req->outbuf, smb_vwv16+1, ret);
 383                 }
 384                 ret = message_push_string(&req->outbuf, lp_workgroup(),
 385                                           STR_UNICODE|STR_TERMINATE
 386                                           |STR_NOALIGN);
 387                 if (ret == -1) {
 388                         DEBUG(0, ("Could not push workgroup string\n"));
 389                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 390                         return;
 391                 }
 392                 DEBUG(3,("not using SPNEGO\n"));
 393         } else {
 394                 DATA_BLOB spnego_blob = negprot_spnego(req, req->sconn);
 395
 396                 if (spnego_blob.data == NULL) {
 397                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 398                         return;
 399                 }
 400
 401                 ret = message_push_blob(&req->outbuf, spnego_blob);
 402                 if (ret == -1) {
 403                         DEBUG(0, ("Could not push spnego blob\n"));
 404                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 405                         return;
 406                 }
 407                 data_blob_free(&spnego_blob);
 408
 409                 SCVAL(req->outbuf,smb_vwv16+1, 0);
 410                 DEBUG(3,("using SPNEGO\n"));
 411         }
 412
 413         return;
 414 }
 415
 416 /* these are the protocol lists used for auto architecture detection:
 417
 418 WinNT 3.51:
 419 protocol [PC NETWORK PROGRAM 1.0]
 420 protocol [XENIX CORE]
 421 protocol [MICROSOFT NETWORKS 1.03]
 422 protocol [LANMAN1.0]
 423 protocol [Windows for Workgroups 3.1a]
 424 protocol [LM1.2X002]
 425 protocol [LANMAN2.1]
 426 protocol [NT LM 0.12]
 427
 428 Win95:
 429 protocol [PC NETWORK PROGRAM 1.0]
 430 protocol [XENIX CORE]
 431 protocol [MICROSOFT NETWORKS 1.03]
 432 protocol [LANMAN1.0]
 433 protocol [Windows for Workgroups 3.1a]
 434 protocol [LM1.2X002]
 435 protocol [LANMAN2.1]
 436 protocol [NT LM 0.12]
 437
 438 Win2K:
 439 protocol [PC NETWORK PROGRAM 1.0]
 440 protocol [LANMAN1.0]
 441 protocol [Windows for Workgroups 3.1a]
 442 protocol [LM1.2X002]
 443 protocol [LANMAN2.1]
 444 protocol [NT LM 0.12]
 445
 446 Vista:
 447 protocol [PC NETWORK PROGRAM 1.0]
 448 protocol [LANMAN1.0]
 449 protocol [Windows for Workgroups 3.1a]
 450 protocol [LM1.2X002]
 451 protocol [LANMAN2.1]
 452 protocol [NT LM 0.12]
 453 protocol [SMB 2.001]
 454
 455 OS/2:
 456 protocol [PC NETWORK PROGRAM 1.0]
 457 protocol [XENIX CORE]
 458 protocol [LANMAN1.0]
 459 protocol [LM1.2X002]
 460 protocol [LANMAN2.1]
 461 */
 462
 463 /*
 464   * Modified to recognize the architecture of the remote machine better.
 465   *
 466   * This appears to be the matrix of which protocol is used by which
 467   * MS product.
 468        Protocol                       WfWg    Win95   WinNT  Win2K  OS/2 Vista
 469        PC NETWORK PROGRAM 1.0          1       1       1      1      1     1
 470        XENIX CORE                                      2             2
 471        MICROSOFT NETWORKS 3.0          2       2
 472        DOS LM1.2X002                   3       3
 473        MICROSOFT NETWORKS 1.03                         3
 474        DOS LANMAN2.1                   4       4
 475        LANMAN1.0                                       4      2      3     2
 476        Windows for Workgroups 3.1a     5       5       5      3            3
 477        LM1.2X002                                       6      4      4     4
 478        LANMAN2.1                                       7      5      5     5
 479        NT LM 0.12                              6       8      6            6
 480        SMB 2.001                                                           7
 481   *
 482   *  tim@fsg.com 09/29/95
 483   *  Win2K added by matty 17/7/99
 484   */
 485
 486 #define ARCH_WFWG     0x3      /* This is a fudge because WfWg is like Win95 */
 487 #define ARCH_WIN95    0x2
 488 #define ARCH_WINNT    0x4
 489 #define ARCH_WIN2K    0xC      /* Win2K is like NT */
 490 #define ARCH_OS2      0x14     /* Again OS/2 is like NT */
 491 #define ARCH_SAMBA    0x20
 492 #define ARCH_CIFSFS   0x40
 493 #define ARCH_VISTA    0x8C     /* Vista is like XP/2K */
 494
 495 #define ARCH_ALL      0x7F
 496
 497 /* List of supported protocols, most desired first */
 498 static const struct {
 499         const char *proto_name;
 500         const char *short_name;
 501         void (*proto_reply_fn)(struct smb_request *req, uint16 choice);
 502         int protocol_level;
 503 } supported_protocols[] = {
 504         {"SMB 2.002",               "SMB2",     reply_smb2002,  PROTOCOL_SMB2},
 505         {"NT LANMAN 1.0",           "NT1",      reply_nt1,      PROTOCOL_NT1},
 506         {"NT LM 0.12",              "NT1",      reply_nt1,      PROTOCOL_NT1},
 507         {"POSIX 2",                 "NT1",      reply_nt1,      PROTOCOL_NT1},
 508         {"LANMAN2.1",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 509         {"LM1.2X002",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 510         {"Samba",                   "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 511         {"DOS LM1.2X002",           "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 512         {"LANMAN1.0",               "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 513         {"MICROSOFT NETWORKS 3.0",  "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 514         {"MICROSOFT NETWORKS 1.03", "COREPLUS", reply_coreplus, PROTOCOL_COREPLUS},
 515         {"PC NETWORK PROGRAM 1.0",  "CORE",     reply_corep,    PROTOCOL_CORE},
 516         {NULL,NULL,NULL,0},
 517 };
 518
 519 /****************************************************************************
 520  Reply to a negprot.
 521  conn POINTER CAN BE NULL HERE !
 522 ****************************************************************************/
 523
 524 void reply_negprot(struct smb_request *req)
 525 {
 526         int choice= -1;
 527         int protocol;
 528         const char *p;
 529         int arch = ARCH_ALL;
 530         int num_cliprotos;
 531         char **cliprotos;
 532         int i;
 533         size_t converted_size;
 534         struct smbd_server_connection *sconn = req->sconn;
 535
 536         START_PROFILE(SMBnegprot);
 537
 538         if (sconn->smb1.negprot.done) {
 539                 END_PROFILE(SMBnegprot);
 540                 exit_server_cleanly("multiple negprot's are not permitted");
 541         }
 542         sconn->smb1.negprot.done = true;
 543
 544         if (req->buflen == 0) {
 545                 DEBUG(0, ("negprot got no protocols\n"));
 546                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 547                 END_PROFILE(SMBnegprot);
 548                 return;
 549         }
 550
 551         if (req->buf[req->buflen-1] != '\0') {
 552                 DEBUG(0, ("negprot protocols not 0-terminated\n"));
 553                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 554                 END_PROFILE(SMBnegprot);
 555                 return;
 556         }
 557
 558         p = (const char *)req->buf + 1;
 559
 560         num_cliprotos = 0;
 561         cliprotos = NULL;
 562
 563         while (smbreq_bufrem(req, p) > 0) {
 564
 565                 char **tmp;
 566
 567                 tmp = TALLOC_REALLOC_ARRAY(talloc_tos(), cliprotos, char *,
 568                                            num_cliprotos+1);
 569                 if (tmp == NULL) {
 570                         DEBUG(0, ("talloc failed\n"));
 571                         TALLOC_FREE(cliprotos);
 572                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 573                         END_PROFILE(SMBnegprot);
 574                         return;
 575                 }
 576
 577                 cliprotos = tmp;
 578
 579                 if (!pull_ascii_talloc(cliprotos, &cliprotos[num_cliprotos], p,
 580                                        &converted_size)) {
 581                         DEBUG(0, ("pull_ascii_talloc failed\n"));
 582                         TALLOC_FREE(cliprotos);
 583                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 584                         END_PROFILE(SMBnegprot);
 585                         return;
 586                 }
 587
 588                 DEBUG(3, ("Requested protocol [%s]\n",
 589                           cliprotos[num_cliprotos]));
 590
 591                 num_cliprotos += 1;
 592                 p += strlen(p) + 2;
 593         }
 594
 595         for (i=0; i<num_cliprotos; i++) {
 596                 if (strcsequal(cliprotos[i], "Windows for Workgroups 3.1a"))
 597                         arch &= ( ARCH_WFWG | ARCH_WIN95 | ARCH_WINNT
 598                                   | ARCH_WIN2K );
 599                 else if (strcsequal(cliprotos[i], "DOS LM1.2X002"))
 600                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 601                 else if (strcsequal(cliprotos[i], "DOS LANMAN2.1"))
 602                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 603                 else if (strcsequal(cliprotos[i], "NT LM 0.12"))
 604                         arch &= ( ARCH_WIN95 | ARCH_WINNT | ARCH_WIN2K
 605                                   | ARCH_CIFSFS);
 606                 else if (strcsequal(cliprotos[i], "SMB 2.001"))
 607                         arch = ARCH_VISTA;
 608                 else if (strcsequal(cliprotos[i], "LANMAN2.1"))
 609                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 610                 else if (strcsequal(cliprotos[i], "LM1.2X002"))
 611                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 612                 else if (strcsequal(cliprotos[i], "MICROSOFT NETWORKS 1.03"))
 613                         arch &= ARCH_WINNT;
 614                 else if (strcsequal(cliprotos[i], "XENIX CORE"))
 615                         arch &= ( ARCH_WINNT | ARCH_OS2 );
 616                 else if (strcsequal(cliprotos[i], "Samba")) {
 617                         arch = ARCH_SAMBA;
 618                         break;
 619                 } else if (strcsequal(cliprotos[i], "POSIX 2")) {
 620                         arch = ARCH_CIFSFS;
 621                         break;
 622                 }
 623         }
 624
 625         /* CIFSFS can send one arch only, NT LM 0.12. */
 626         if (i == 1 && (arch & ARCH_CIFSFS)) {
 627                 arch = ARCH_CIFSFS;
 628         }
 629
 630         switch ( arch ) {
 631                 case ARCH_CIFSFS:
 632                         set_remote_arch(RA_CIFSFS);
 633                         break;
 634                 case ARCH_SAMBA:
 635                         set_remote_arch(RA_SAMBA);
 636                         break;
 637                 case ARCH_WFWG:
 638                         set_remote_arch(RA_WFWG);
 639                         break;
 640                 case ARCH_WIN95:
 641                         set_remote_arch(RA_WIN95);
 642                         break;
 643                 case ARCH_WINNT:
 644                         if(req->flags2 == FLAGS2_WIN2K_SIGNATURE)
 645                                 set_remote_arch(RA_WIN2K);
 646                         else
 647                                 set_remote_arch(RA_WINNT);
 648                         break;
 649                 case ARCH_WIN2K:
 650                         /* Vista may have been set in the negprot so don't
 651                            override it here */
 652                         if ( get_remote_arch() != RA_VISTA )
 653                                 set_remote_arch(RA_WIN2K);
 654                         break;
 655                 case ARCH_VISTA:
 656                         set_remote_arch(RA_VISTA);
 657                         break;
 658                 case ARCH_OS2:
 659                         set_remote_arch(RA_OS2);
 660                         break;
 661                 default:
 662                         set_remote_arch(RA_UNKNOWN);
 663                 break;
 664         }
 665
 666         /* possibly reload - change of architecture */
 667         reload_services(sconn->msg_ctx, sconn->sock, True);
 668
 669         /* moved from the netbios session setup code since we don't have that
 670            when the client connects to port 445.  Of course there is a small
 671            window where we are listening to messages   -- jerry */
 672
 673         serverid_register(sconn_server_id(sconn),
 674                           FLAG_MSG_GENERAL|FLAG_MSG_SMBD
 675                           |FLAG_MSG_PRINT_GENERAL);
 676
 677         /* Check for protocols, most desirable first */
 678         for (protocol = 0; supported_protocols[protocol].proto_name; protocol++) {
 679                 i = 0;
 680                 if ((supported_protocols[protocol].protocol_level <= lp_maxprotocol()) &&
 681                                 (supported_protocols[protocol].protocol_level >= lp_minprotocol()))
 682                         while (i < num_cliprotos) {
 683                                 if (strequal(cliprotos[i],supported_protocols[protocol].proto_name))
 684                                         choice = i;
 685                                 i++;
 686                         }
 687                 if(choice != -1)
 688                         break;
 689         }
 690
 691         if(choice != -1) {
 692                 fstrcpy(remote_proto,supported_protocols[protocol].short_name);
 693                 reload_services(sconn->msg_ctx, sconn->sock, True);
 694                 supported_protocols[protocol].proto_reply_fn(req, choice);
 695                 DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
 696         } else {
 697                 DEBUG(0,("No protocol supported !\n"));
 698                 reply_outbuf(req, 1, 0);
 699                 SSVAL(req->outbuf, smb_vwv0, choice);
 700         }
 701
 702         DEBUG( 5, ( "negprot index=%d\n", choice ) );
 703
 704         if ((lp_server_signing() == Required) && (get_Protocol() < PROTOCOL_NT1)) {
 705                 exit_server_cleanly("SMB signing is required and "
 706                         "client negotiated a downlevel protocol");
 707         }
 708
 709         TALLOC_FREE(cliprotos);
 710         END_PROFILE(SMBnegprot);
 711         return;
 712 }