?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-kdc_kpasswd: split out some code to a KPASSWD_GLUE subsystem.
[Samba.git] / source3 / smbd / smb2_sesssetup.c
blob11d381fcdb46f188f0f57e32bf137d3a4d22a59d
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
27 #include "auth.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/tevent_ntstatus.h"
31 #include "lib/crypto/sha512.h"
32 #include "lib/crypto/aes.h"
33 #include "lib/crypto/aes_ccm_128.h"
34 #include "lib/crypto/aes_gcm_128.h"
35
36 static struct tevent_req *smbd_smb2_session_setup_wrap_send(TALLOC_CTX *mem_ctx,
37 struct tevent_context *ev,
38 struct smbd_smb2_request *smb2req,
39 uint64_t in_session_id,
40 uint8_t in_flags,
41 uint8_t in_security_mode,
42 uint64_t in_previous_session_id,
43 DATA_BLOB in_security_buffer);
44 static NTSTATUS smbd_smb2_session_setup_wrap_recv(struct tevent_req *req,
45 uint16_t *out_session_flags,
46 TALLOC_CTX *mem_ctx,
47 DATA_BLOB *out_security_buffer,
48 uint64_t *out_session_id);
49
50 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq);
51
52 NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *smb2req)
53 {
54 const uint8_t *inhdr;
55 const uint8_t *inbody;
56 uint64_t in_session_id;
57 uint8_t in_flags;
58 uint8_t in_security_mode;
59 uint64_t in_previous_session_id;
60 uint16_t in_security_offset;
61 uint16_t in_security_length;
62 DATA_BLOB in_security_buffer;
63 NTSTATUS status;
64 struct tevent_req *subreq;
65
66 status = smbd_smb2_request_verify_sizes(smb2req, 0x19);
67 if (!NT_STATUS_IS_OK(status)) {
68 return smbd_smb2_request_error(smb2req, status);
69 }
70 inhdr = SMBD_SMB2_IN_HDR_PTR(smb2req);
71 inbody = SMBD_SMB2_IN_BODY_PTR(smb2req);
72
73 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
74
75 in_flags = CVAL(inbody, 0x02);
76 in_security_mode = CVAL(inbody, 0x03);
77 /* Capabilities = IVAL(inbody, 0x04) */
78 /* Channel = IVAL(inbody, 0x08) */
79 in_security_offset = SVAL(inbody, 0x0C);
80 in_security_length = SVAL(inbody, 0x0E);
81 in_previous_session_id = BVAL(inbody, 0x10);
82
83 if (in_security_offset != (SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(smb2req))) {
84 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
85 }
86
87 if (in_security_length > SMBD_SMB2_IN_DYN_LEN(smb2req)) {
88 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
89 }
90
91 in_security_buffer.data = SMBD_SMB2_IN_DYN_PTR(smb2req);
92 in_security_buffer.length = in_security_length;
93
94 subreq = smbd_smb2_session_setup_wrap_send(smb2req,
95 smb2req->sconn->ev_ctx,
96 smb2req,
97 in_session_id,
98 in_flags,
99 in_security_mode,
100 in_previous_session_id,
101 in_security_buffer);
102 if (subreq == NULL) {
103 return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
104 }
105 tevent_req_set_callback(subreq, smbd_smb2_request_sesssetup_done, smb2req);
106
107 return smbd_smb2_request_pending_queue(smb2req, subreq, 500);
108 }
109
110 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq)
111 {
112 struct smbd_smb2_request *smb2req =
113 tevent_req_callback_data(subreq,
114 struct smbd_smb2_request);
115 uint8_t *outhdr;
116 DATA_BLOB outbody;
117 DATA_BLOB outdyn;
118 uint16_t out_session_flags = 0;
119 uint64_t out_session_id = 0;
120 uint16_t out_security_offset;
121 DATA_BLOB out_security_buffer = data_blob_null;
122 NTSTATUS status;
123 NTSTATUS error; /* transport error */
124
125 status = smbd_smb2_session_setup_wrap_recv(subreq,
126 &out_session_flags,
127 smb2req,
128 &out_security_buffer,
129 &out_session_id);
130 TALLOC_FREE(subreq);
131 if (!NT_STATUS_IS_OK(status) &&
132 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
133 status = nt_status_squash(status);
134 error = smbd_smb2_request_error(smb2req, status);
135 if (!NT_STATUS_IS_OK(error)) {
136 smbd_server_connection_terminate(smb2req->xconn,
137 nt_errstr(error));
138 return;
139 }
140 return;
141 }
142
143 out_security_offset = SMB2_HDR_BODY + 0x08;
144
145 outhdr = SMBD_SMB2_OUT_HDR_PTR(smb2req);
146
147 outbody = smbd_smb2_generate_outbody(smb2req, 0x08);
148 if (outbody.data == NULL) {
149 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
150 if (!NT_STATUS_IS_OK(error)) {
151 smbd_server_connection_terminate(smb2req->xconn,
152 nt_errstr(error));
153 return;
154 }
155 return;
156 }
157
158 SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id);
159
160 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
161 SSVAL(outbody.data, 0x02,
162 out_session_flags); /* session flags */
163 SSVAL(outbody.data, 0x04,
164 out_security_offset); /* security buffer offset */
165 SSVAL(outbody.data, 0x06,
166 out_security_buffer.length); /* security buffer length */
167
168 outdyn = out_security_buffer;
169
170 error = smbd_smb2_request_done_ex(smb2req, status, outbody, &outdyn,
171 __location__);
172 if (!NT_STATUS_IS_OK(error)) {
173 smbd_server_connection_terminate(smb2req->xconn,
174 nt_errstr(error));
175 return;
176 }
177 }
178
179 static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
180 struct smbd_smb2_request *smb2req,
181 uint8_t in_security_mode,
182 struct auth_session_info *session_info,
183 uint16_t *out_session_flags,
184 uint64_t *out_session_id)
185 {
186 NTSTATUS status;
187 bool guest = false;
188 uint8_t session_key[16];
189 struct smbXsrv_session *x = session;
190 struct smbXsrv_connection *xconn = smb2req->xconn;
191 struct _derivation {
192 DATA_BLOB label;
193 DATA_BLOB context;
194 };
195 struct {
196 struct _derivation signing;
197 struct _derivation encryption;
198 struct _derivation decryption;
199 struct _derivation application;
200 } derivation = { };
201
202 if (xconn->protocol >= PROTOCOL_SMB3_10) {
203 struct smbXsrv_preauth *preauth;
204 struct _derivation *d;
205 DATA_BLOB p;
206 struct hc_sha512state sctx;
207 size_t i;
208
209 preauth = talloc_move(smb2req, &session->preauth);
210
211 samba_SHA512_Init(&sctx);
212 samba_SHA512_Update(&sctx, preauth->sha512_value,
213 sizeof(preauth->sha512_value));
214 for (i = 1; i < smb2req->in.vector_count; i++) {
215 samba_SHA512_Update(&sctx,
216 smb2req->in.vector[i].iov_base,
217 smb2req->in.vector[i].iov_len);
218 }
219 samba_SHA512_Final(preauth->sha512_value, &sctx);
220
221 p = data_blob_const(preauth->sha512_value,
222 sizeof(preauth->sha512_value));
223
224 d = &derivation.signing;
225 d->label = data_blob_string_const_null("SMBSigningKey");
226 d->context = p;
227
228 d = &derivation.decryption;
229 d->label = data_blob_string_const_null("SMBC2SCipherKey");
230 d->context = p;
231
232 d = &derivation.encryption;
233 d->label = data_blob_string_const_null("SMBS2CCipherKey");
234 d->context = p;
235
236 d = &derivation.application;
237 d->label = data_blob_string_const_null("SMBAppKey");
238 d->context = p;
239
240 } else if (xconn->protocol >= PROTOCOL_SMB2_24) {
241 struct _derivation *d;
242
243 d = &derivation.signing;
244 d->label = data_blob_string_const_null("SMB2AESCMAC");
245 d->context = data_blob_string_const_null("SmbSign");
246
247 d = &derivation.decryption;
248 d->label = data_blob_string_const_null("SMB2AESCCM");
249 d->context = data_blob_string_const_null("ServerIn ");
250
251 d = &derivation.encryption;
252 d->label = data_blob_string_const_null("SMB2AESCCM");
253 d->context = data_blob_string_const_null("ServerOut");
254
255 d = &derivation.application;
256 d->label = data_blob_string_const_null("SMB2APP");
257 d->context = data_blob_string_const_null("SmbRpc");
258 }
259
260 if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
261 lp_server_signing() == SMB_SIGNING_REQUIRED) {
262 x->global->signing_required = true;
263 }
264
265 if ((lp_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) &&
266 (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) {
267 x->encryption_desired = true;
268 }
269
270 if (lp_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) {
271 x->encryption_desired = true;
272 x->global->encryption_required = true;
273 }
274
275 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
276 /* we map anonymous to guest internally */
277 *out_session_flags |= SMB2_SESSION_FLAG_IS_GUEST;
278 *out_session_flags |= SMB2_SESSION_FLAG_IS_NULL;
279 /* force no signing */
280 x->global->signing_required = false;
281 guest = true;
282 }
283
284 if (guest && x->global->encryption_required) {
285 DEBUG(1,("reject guest session as encryption is required\n"));
286 return NT_STATUS_ACCESS_DENIED;
287 }
288
289 if (xconn->smb2.server.cipher == 0) {
290 if (x->global->encryption_required) {
291 DEBUG(1,("reject session with dialect[0x%04X] "
292 "as encryption is required\n",
293 xconn->smb2.server.dialect));
294 return NT_STATUS_ACCESS_DENIED;
295 }
296 }
297
298 if (x->encryption_desired) {
299 *out_session_flags |= SMB2_SESSION_FLAG_ENCRYPT_DATA;
300 }
301
302 ZERO_STRUCT(session_key);
303 memcpy(session_key, session_info->session_key.data,
304 MIN(session_info->session_key.length, sizeof(session_key)));
305
306 x->global->signing_key = data_blob_talloc(x->global,
307 session_key,
308 sizeof(session_key));
309 if (x->global->signing_key.data == NULL) {
310 ZERO_STRUCT(session_key);
311 return NT_STATUS_NO_MEMORY;
312 }
313
314 if (xconn->protocol >= PROTOCOL_SMB2_24) {
315 struct _derivation *d = &derivation.signing;
316
317 smb2_key_derivation(session_key, sizeof(session_key),
318 d->label.data, d->label.length,
319 d->context.data, d->context.length,
320 x->global->signing_key.data);
321 }
322
323 if (xconn->protocol >= PROTOCOL_SMB2_24) {
324 struct _derivation *d = &derivation.decryption;
325
326 x->global->decryption_key = data_blob_talloc(x->global,
327 session_key,
328 sizeof(session_key));
329 if (x->global->decryption_key.data == NULL) {
330 ZERO_STRUCT(session_key);
331 return NT_STATUS_NO_MEMORY;
332 }
333
334 smb2_key_derivation(session_key, sizeof(session_key),
335 d->label.data, d->label.length,
336 d->context.data, d->context.length,
337 x->global->decryption_key.data);
338 }
339
340 if (xconn->protocol >= PROTOCOL_SMB2_24) {
341 struct _derivation *d = &derivation.encryption;
342 size_t nonce_size;
343
344 x->global->encryption_key = data_blob_talloc(x->global,
345 session_key,
346 sizeof(session_key));
347 if (x->global->encryption_key.data == NULL) {
348 ZERO_STRUCT(session_key);
349 return NT_STATUS_NO_MEMORY;
350 }
351
352 smb2_key_derivation(session_key, sizeof(session_key),
353 d->label.data, d->label.length,
354 d->context.data, d->context.length,
355 x->global->encryption_key.data);
356
357 /*
358 * CCM and GCM algorithms must never have their
359 * nonce wrap, or the security of the whole
360 * communication and the keys is destroyed.
361 * We must drop the connection once we have
362 * transfered too much data.
363 *
364 * NOTE: We assume nonces greater than 8 bytes.
365 */
366 generate_random_buffer((uint8_t *)&x->nonce_high_random,
367 sizeof(x->nonce_high_random));
368 switch (xconn->smb2.server.cipher) {
369 case SMB2_ENCRYPTION_AES128_CCM:
370 nonce_size = AES_CCM_128_NONCE_SIZE;
371 break;
372 case SMB2_ENCRYPTION_AES128_GCM:
373 nonce_size = AES_GCM_128_IV_SIZE;
374 break;
375 default:
376 nonce_size = 0;
377 break;
378 }
379 x->nonce_high_max = SMB2_NONCE_HIGH_MAX(nonce_size);
380 x->nonce_high = 0;
381 x->nonce_low = 0;
382 }
383
384 x->global->application_key = data_blob_dup_talloc(x->global,
385 x->global->signing_key);
386 if (x->global->application_key.data == NULL) {
387 ZERO_STRUCT(session_key);
388 return NT_STATUS_NO_MEMORY;
389 }
390
391 if (xconn->protocol >= PROTOCOL_SMB2_24) {
392 struct _derivation *d = &derivation.application;
393
394 smb2_key_derivation(session_key, sizeof(session_key),
395 d->label.data, d->label.length,
396 d->context.data, d->context.length,
397 x->global->application_key.data);
398 }
399 ZERO_STRUCT(session_key);
400
401 x->global->channels[0].signing_key = data_blob_dup_talloc(x->global->channels,
402 x->global->signing_key);
403 if (x->global->channels[0].signing_key.data == NULL) {
404 return NT_STATUS_NO_MEMORY;
405 }
406
407 data_blob_clear_free(&session_info->session_key);
408 session_info->session_key = data_blob_dup_talloc(session_info,
409 x->global->application_key);
410 if (session_info->session_key.data == NULL) {
411 return NT_STATUS_NO_MEMORY;
412 }
413
414 session->compat = talloc_zero(session, struct user_struct);
415 if (session->compat == NULL) {
416 return NT_STATUS_NO_MEMORY;
417 }
418 session->compat->session = session;
419 session->compat->homes_snum = -1;
420 session->compat->session_info = session_info;
421 session->compat->session_keystr = NULL;
422 session->compat->vuid = session->global->session_wire_id;
423 DLIST_ADD(smb2req->sconn->users, session->compat);
424 smb2req->sconn->num_users++;
425
426 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
427 session->compat->homes_snum =
428 register_homes_share(session_info->unix_info->unix_name);
429 }
430
431 set_current_user_info(session_info->unix_info->sanitized_username,
432 session_info->unix_info->unix_name,
433 session_info->info->domain_name);
434
435 reload_services(smb2req->sconn, conn_snum_used, true);
436
437 session->status = NT_STATUS_OK;
438 session->global->auth_session_info = session_info;
439 session->global->auth_session_info_seqnum += 1;
440 session->global->channels[0].auth_session_info_seqnum =
441 session->global->auth_session_info_seqnum;
442 session->global->auth_time = timeval_to_nttime(&smb2req->request_time);
443 session->global->expiration_time = gensec_expire_time(session->gensec);
444
445 if (!session_claim(session)) {
446 DEBUG(1, ("smb2: Failed to claim session "
447 "for vuid=%llu\n",
448 (unsigned long long)session->compat->vuid));
449 return NT_STATUS_LOGON_FAILURE;
450 }
451
452 status = smbXsrv_session_update(session);
453 if (!NT_STATUS_IS_OK(status)) {
454 DEBUG(0, ("smb2: Failed to update session for vuid=%llu - %s\n",
455 (unsigned long long)session->compat->vuid,
456 nt_errstr(status)));
457 return NT_STATUS_LOGON_FAILURE;
458 }
459
460 /*
461 * we attach the session to the request
462 * so that the response can be signed
463 */
464 if (!guest) {
465 smb2req->do_signing = true;
466 }
467
468 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
469
470 *out_session_id = session->global->session_wire_id;
471
472 return NT_STATUS_OK;
473 }
474
475 static NTSTATUS smbd_smb2_reauth_generic_return(struct smbXsrv_session *session,
476 struct smbd_smb2_request *smb2req,
477 struct auth_session_info *session_info,
478 uint16_t *out_session_flags,
479 uint64_t *out_session_id)
480 {
481 NTSTATUS status;
482 struct smbXsrv_session *x = session;
483
484 data_blob_clear_free(&session_info->session_key);
485 session_info->session_key = data_blob_dup_talloc(session_info,
486 x->global->application_key);
487 if (session_info->session_key.data == NULL) {
488 return NT_STATUS_NO_MEMORY;
489 }
490
491 session->compat->session_info = session_info;
492 session->compat->vuid = session->global->session_wire_id;
493
494 session->compat->homes_snum =
495 register_homes_share(session_info->unix_info->unix_name);
496
497 set_current_user_info(session_info->unix_info->sanitized_username,
498 session_info->unix_info->unix_name,
499 session_info->info->domain_name);
500
501 reload_services(smb2req->sconn, conn_snum_used, true);
502
503 session->status = NT_STATUS_OK;
504 TALLOC_FREE(session->global->auth_session_info);
505 session->global->auth_session_info = session_info;
506 session->global->auth_session_info_seqnum += 1;
507 session->global->channels[0].auth_session_info_seqnum =
508 session->global->auth_session_info_seqnum;
509 session->global->auth_time = timeval_to_nttime(&smb2req->request_time);
510 session->global->expiration_time = gensec_expire_time(session->gensec);
511
512 status = smbXsrv_session_update(session);
513 if (!NT_STATUS_IS_OK(status)) {
514 DEBUG(0, ("smb2: Failed to update session for vuid=%llu - %s\n",
515 (unsigned long long)session->compat->vuid,
516 nt_errstr(status)));
517 return NT_STATUS_LOGON_FAILURE;
518 }
519
520 conn_clear_vuid_caches(smb2req->sconn, session->compat->vuid);
521
522 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
523 smb2req->do_signing = true;
524 }
525
526 *out_session_id = session->global->session_wire_id;
527
528 return NT_STATUS_OK;
529 }
530
531 struct smbd_smb2_session_setup_state {
532 struct tevent_context *ev;
533 struct smbd_smb2_request *smb2req;
534 uint64_t in_session_id;
535 uint8_t in_flags;
536 uint8_t in_security_mode;
537 uint64_t in_previous_session_id;
538 DATA_BLOB in_security_buffer;
539 struct smbXsrv_session *session;
540 struct auth_session_info *session_info;
541 uint16_t out_session_flags;
542 DATA_BLOB out_security_buffer;
543 uint64_t out_session_id;
544 };
545
546 static void smbd_smb2_session_setup_gensec_done(struct tevent_req *subreq);
547 static void smbd_smb2_session_setup_previous_done(struct tevent_req *subreq);
548 static void smbd_smb2_session_setup_auth_return(struct tevent_req *req);
549
550 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
551 struct tevent_context *ev,
552 struct smbd_smb2_request *smb2req,
553 uint64_t in_session_id,
554 uint8_t in_flags,
555 uint8_t in_security_mode,
556 uint64_t in_previous_session_id,
557 DATA_BLOB in_security_buffer)
558 {
559 struct tevent_req *req;
560 struct smbd_smb2_session_setup_state *state;
561 NTSTATUS status;
562 NTTIME now = timeval_to_nttime(&smb2req->request_time);
563 struct tevent_req *subreq;
564
565 req = tevent_req_create(mem_ctx, &state,
566 struct smbd_smb2_session_setup_state);
567 if (req == NULL) {
568 return NULL;
569 }
570 state->ev = ev;
571 state->smb2req = smb2req;
572 state->in_session_id = in_session_id;
573 state->in_flags = in_flags;
574 state->in_security_mode = in_security_mode;
575 state->in_previous_session_id = in_previous_session_id;
576 state->in_security_buffer = in_security_buffer;
577
578 if (in_flags & SMB2_SESSION_FLAG_BINDING) {
579 if (smb2req->xconn->protocol < PROTOCOL_SMB2_22) {
580 tevent_req_nterror(req, NT_STATUS_REQUEST_NOT_ACCEPTED);
581 return tevent_req_post(req, ev);
582 }
583
584 /*
585 * We do not support multi channel.
586 */
587 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
588 return tevent_req_post(req, ev);
589 }
590
591 if (state->in_session_id == 0) {
592 /* create a new session */
593 status = smbXsrv_session_create(state->smb2req->xconn,
594 now, &state->session);
595 if (tevent_req_nterror(req, status)) {
596 return tevent_req_post(req, ev);
597 }
598 smb2req->session = state->session;
599 } else {
600 if (smb2req->session == NULL) {
601 tevent_req_nterror(req, NT_STATUS_USER_SESSION_DELETED);
602 return tevent_req_post(req, ev);
603 }
604
605 state->session = smb2req->session;
606 status = state->session->status;
607 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
608 status = NT_STATUS_OK;
609 }
610 if (NT_STATUS_IS_OK(status)) {
611 state->session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
612 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
613 TALLOC_FREE(state->session->gensec);
614 }
615 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
616 tevent_req_nterror(req, status);
617 return tevent_req_post(req, ev);
618 }
619 }
620
621 if (state->session->gensec == NULL) {
622 status = auth_generic_prepare(state->session,
623 state->smb2req->xconn->remote_address,
624 &state->session->gensec);
625 if (tevent_req_nterror(req, status)) {
626 return tevent_req_post(req, ev);
627 }
628
629 gensec_want_feature(state->session->gensec, GENSEC_FEATURE_SESSION_KEY);
630 gensec_want_feature(state->session->gensec, GENSEC_FEATURE_UNIX_TOKEN);
631
632 status = gensec_start_mech_by_oid(state->session->gensec,
633 GENSEC_OID_SPNEGO);
634 if (tevent_req_nterror(req, status)) {
635 return tevent_req_post(req, ev);
636 }
637 }
638
639 become_root();
640 subreq = gensec_update_send(state, state->ev,
641 state->session->gensec,
642 state->in_security_buffer);
643 unbecome_root();
644 if (tevent_req_nomem(subreq, req)) {
645 return tevent_req_post(req, ev);
646 }
647 tevent_req_set_callback(subreq, smbd_smb2_session_setup_gensec_done, req);
648
649 return req;
650 }
651
652 static void smbd_smb2_session_setup_gensec_done(struct tevent_req *subreq)
653 {
654 struct tevent_req *req =
655 tevent_req_callback_data(subreq,
656 struct tevent_req);
657 struct smbd_smb2_session_setup_state *state =
658 tevent_req_data(req,
659 struct smbd_smb2_session_setup_state);
660 NTSTATUS status;
661
662 become_root();
663 status = gensec_update_recv(subreq, state,
664 &state->out_security_buffer);
665 unbecome_root();
666 TALLOC_FREE(subreq);
667 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
668 !NT_STATUS_IS_OK(status)) {
669 tevent_req_nterror(req, status);
670 return;
671 }
672
673 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
674 state->out_session_id = state->session->global->session_wire_id;
675 state->smb2req->preauth = state->session->preauth;
676 tevent_req_nterror(req, status);
677 return;
678 }
679
680 status = gensec_session_info(state->session->gensec,
681 state->session->global,
682 &state->session_info);
683 if (tevent_req_nterror(req, status)) {
684 return;
685 }
686
687 if ((state->in_previous_session_id != 0) &&
688 (state->session->global->session_wire_id !=
689 state->in_previous_session_id))
690 {
691 subreq = smb2srv_session_close_previous_send(state, state->ev,
692 state->smb2req->xconn,
693 state->session_info,
694 state->in_previous_session_id,
695 state->session->global->session_wire_id);
696 if (tevent_req_nomem(subreq, req)) {
697 return;
698 }
699 tevent_req_set_callback(subreq,
700 smbd_smb2_session_setup_previous_done,
701 req);
702 return;
703 }
704
705 smbd_smb2_session_setup_auth_return(req);
706 }
707
708 static void smbd_smb2_session_setup_previous_done(struct tevent_req *subreq)
709 {
710 struct tevent_req *req =
711 tevent_req_callback_data(subreq,
712 struct tevent_req);
713 NTSTATUS status;
714
715 status = smb2srv_session_close_previous_recv(subreq);
716 TALLOC_FREE(subreq);
717 if (tevent_req_nterror(req, status)) {
718 return;
719 }
720
721 smbd_smb2_session_setup_auth_return(req);
722 }
723
724 static void smbd_smb2_session_setup_auth_return(struct tevent_req *req)
725 {
726 struct smbd_smb2_session_setup_state *state =
727 tevent_req_data(req,
728 struct smbd_smb2_session_setup_state);
729 NTSTATUS status;
730
731 if (state->session->global->auth_session_info != NULL) {
732 status = smbd_smb2_reauth_generic_return(state->session,
733 state->smb2req,
734 state->session_info,
735 &state->out_session_flags,
736 &state->out_session_id);
737 if (tevent_req_nterror(req, status)) {
738 return;
739 }
740 tevent_req_done(req);
741 return;
742 }
743
744 status = smbd_smb2_auth_generic_return(state->session,
745 state->smb2req,
746 state->in_security_mode,
747 state->session_info,
748 &state->out_session_flags,
749 &state->out_session_id);
750 if (tevent_req_nterror(req, status)) {
751 return;
752 }
753
754 tevent_req_done(req);
755 return;
756 }
757
758 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
759 uint16_t *out_session_flags,
760 TALLOC_CTX *mem_ctx,
761 DATA_BLOB *out_security_buffer,
762 uint64_t *out_session_id)
763 {
764 struct smbd_smb2_session_setup_state *state =
765 tevent_req_data(req,
766 struct smbd_smb2_session_setup_state);
767 NTSTATUS status;
768
769 if (tevent_req_is_nterror(req, &status)) {
770 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
771 tevent_req_received(req);
772 return nt_status_squash(status);
773 }
774 } else {
775 status = NT_STATUS_OK;
776 }
777
778 *out_session_flags = state->out_session_flags;
779 *out_security_buffer = state->out_security_buffer;
780 *out_session_id = state->out_session_id;
781
782 talloc_steal(mem_ctx, out_security_buffer->data);
783 tevent_req_received(req);
784 return status;
785 }
786
787 struct smbd_smb2_session_setup_wrap_state {
788 struct tevent_context *ev;
789 struct smbd_smb2_request *smb2req;
790 uint64_t in_session_id;
791 uint8_t in_flags;
792 uint8_t in_security_mode;
793 uint64_t in_previous_session_id;
794 DATA_BLOB in_security_buffer;
795 uint16_t out_session_flags;
796 DATA_BLOB out_security_buffer;
797 uint64_t out_session_id;
798 NTSTATUS error;
799 };
800
801 static void smbd_smb2_session_setup_wrap_setup_done(struct tevent_req *subreq);
802 static void smbd_smb2_session_setup_wrap_shutdown_done(struct tevent_req *subreq);
803
804 static struct tevent_req *smbd_smb2_session_setup_wrap_send(TALLOC_CTX *mem_ctx,
805 struct tevent_context *ev,
806 struct smbd_smb2_request *smb2req,
807 uint64_t in_session_id,
808 uint8_t in_flags,
809 uint8_t in_security_mode,
810 uint64_t in_previous_session_id,
811 DATA_BLOB in_security_buffer)
812 {
813 struct tevent_req *req;
814 struct smbd_smb2_session_setup_wrap_state *state;
815 struct tevent_req *subreq;
816
817 req = tevent_req_create(mem_ctx, &state,
818 struct smbd_smb2_session_setup_wrap_state);
819 if (req == NULL) {
820 return NULL;
821 }
822 state->ev = ev;
823 state->smb2req = smb2req;
824 state->in_session_id = in_session_id;
825 state->in_flags = in_flags;
826 state->in_security_mode = in_security_mode;
827 state->in_previous_session_id = in_previous_session_id;
828 state->in_security_buffer = in_security_buffer;
829
830 subreq = smbd_smb2_session_setup_send(state, state->ev,
831 state->smb2req,
832 state->in_session_id,
833 state->in_flags,
834 state->in_security_mode,
835 state->in_previous_session_id,
836 state->in_security_buffer);
837 if (tevent_req_nomem(subreq, req)) {
838 return tevent_req_post(req, ev);
839 }
840 tevent_req_set_callback(subreq,
841 smbd_smb2_session_setup_wrap_setup_done, req);
842
843 return req;
844 }
845
846 static void smbd_smb2_session_setup_wrap_setup_done(struct tevent_req *subreq)
847 {
848 struct tevent_req *req =
849 tevent_req_callback_data(subreq,
850 struct tevent_req);
851 struct smbd_smb2_session_setup_wrap_state *state =
852 tevent_req_data(req,
853 struct smbd_smb2_session_setup_wrap_state);
854 NTSTATUS status;
855
856 status = smbd_smb2_session_setup_recv(subreq,
857 &state->out_session_flags,
858 state,
859 &state->out_security_buffer,
860 &state->out_session_id);
861 TALLOC_FREE(subreq);
862 if (NT_STATUS_IS_OK(status)) {
863 tevent_req_done(req);
864 return;
865 }
866 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
867 tevent_req_nterror(req, status);
868 return;
869 }
870
871 if (state->smb2req->session == NULL) {
872 tevent_req_nterror(req, status);
873 return;
874 }
875
876 state->error = status;
877
878 subreq = smb2srv_session_shutdown_send(state, state->ev,
879 state->smb2req->session,
880 state->smb2req);
881 if (tevent_req_nomem(subreq, req)) {
882 return;
883 }
884 tevent_req_set_callback(subreq,
885 smbd_smb2_session_setup_wrap_shutdown_done,
886 req);
887 }
888
889 static void smbd_smb2_session_setup_wrap_shutdown_done(struct tevent_req *subreq)
890 {
891 struct tevent_req *req =
892 tevent_req_callback_data(subreq,
893 struct tevent_req);
894 struct smbd_smb2_session_setup_wrap_state *state =
895 tevent_req_data(req,
896 struct smbd_smb2_session_setup_wrap_state);
897 NTSTATUS status;
898
899 status = smb2srv_session_shutdown_recv(subreq);
900 TALLOC_FREE(subreq);
901 if (tevent_req_nterror(req, status)) {
902 return;
903 }
904
905 /*
906 * we may need to sign the response, so we need to keep
907 * the session until the response is sent to the wire.
908 */
909 talloc_steal(state->smb2req, state->smb2req->session);
910
911 tevent_req_nterror(req, state->error);
912 }
913
914 static NTSTATUS smbd_smb2_session_setup_wrap_recv(struct tevent_req *req,
915 uint16_t *out_session_flags,
916 TALLOC_CTX *mem_ctx,
917 DATA_BLOB *out_security_buffer,
918 uint64_t *out_session_id)
919 {
920 struct smbd_smb2_session_setup_wrap_state *state =
921 tevent_req_data(req,
922 struct smbd_smb2_session_setup_wrap_state);
923 NTSTATUS status;
924
925 if (tevent_req_is_nterror(req, &status)) {
926 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
927 tevent_req_received(req);
928 return nt_status_squash(status);
929 }
930 } else {
931 status = NT_STATUS_OK;
932 }
933
934 *out_session_flags = state->out_session_flags;
935 *out_security_buffer = state->out_security_buffer;
936 *out_session_id = state->out_session_id;
937
938 talloc_steal(mem_ctx, out_security_buffer->data);
939 tevent_req_received(req);
940 return status;
941 }
942
943 static struct tevent_req *smbd_smb2_logoff_send(TALLOC_CTX *mem_ctx,
944 struct tevent_context *ev,
945 struct smbd_smb2_request *smb2req);
946 static NTSTATUS smbd_smb2_logoff_recv(struct tevent_req *req);
947 static void smbd_smb2_request_logoff_done(struct tevent_req *subreq);
948
949 NTSTATUS smbd_smb2_request_process_logoff(struct smbd_smb2_request *req)
950 {
951 NTSTATUS status;
952 struct tevent_req *subreq = NULL;
953
954 status = smbd_smb2_request_verify_sizes(req, 0x04);
955 if (!NT_STATUS_IS_OK(status)) {
956 return smbd_smb2_request_error(req, status);
957 }
958
959 subreq = smbd_smb2_logoff_send(req, req->sconn->ev_ctx, req);
960 if (subreq == NULL) {
961 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
962 }
963 tevent_req_set_callback(subreq, smbd_smb2_request_logoff_done, req);
964
965 /*
966 * Wait a long time before going async on this to allow
967 * requests we're waiting on to finish. Set timeout to 10 secs.
968 */
969 return smbd_smb2_request_pending_queue(req, subreq, 10000000);
970 }
971
972 static void smbd_smb2_request_logoff_done(struct tevent_req *subreq)
973 {
974 struct smbd_smb2_request *smb2req =
975 tevent_req_callback_data(subreq,
976 struct smbd_smb2_request);
977 DATA_BLOB outbody;
978 NTSTATUS status;
979 NTSTATUS error;
980
981 status = smbd_smb2_logoff_recv(subreq);
982 TALLOC_FREE(subreq);
983 if (!NT_STATUS_IS_OK(status)) {
984 error = smbd_smb2_request_error(smb2req, status);
985 if (!NT_STATUS_IS_OK(error)) {
986 smbd_server_connection_terminate(smb2req->xconn,
987 nt_errstr(error));
988 return;
989 }
990 return;
991 }
992
993 outbody = smbd_smb2_generate_outbody(smb2req, 0x04);
994 if (outbody.data == NULL) {
995 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
996 if (!NT_STATUS_IS_OK(error)) {
997 smbd_server_connection_terminate(smb2req->xconn,
998 nt_errstr(error));
999 return;
1000 }
1001 return;
1002 }
1003
1004 SSVAL(outbody.data, 0x00, 0x04); /* struct size */
1005 SSVAL(outbody.data, 0x02, 0); /* reserved */
1006
1007 error = smbd_smb2_request_done(smb2req, outbody, NULL);
1008 if (!NT_STATUS_IS_OK(error)) {
1009 smbd_server_connection_terminate(smb2req->xconn,
1010 nt_errstr(error));
1011 return;
1012 }
1013 }
1014
1015 struct smbd_smb2_logoff_state {
1016 struct smbd_smb2_request *smb2req;
1017 };
1018
1019 static void smbd_smb2_logoff_shutdown_done(struct tevent_req *subreq);
1020
1021 static struct tevent_req *smbd_smb2_logoff_send(TALLOC_CTX *mem_ctx,
1022 struct tevent_context *ev,
1023 struct smbd_smb2_request *smb2req)
1024 {
1025 struct tevent_req *req;
1026 struct smbd_smb2_logoff_state *state;
1027 struct tevent_req *subreq;
1028
1029 req = tevent_req_create(mem_ctx, &state,
1030 struct smbd_smb2_logoff_state);
1031 if (req == NULL) {
1032 return NULL;
1033 }
1034 state->smb2req = smb2req;
1035
1036 subreq = smb2srv_session_shutdown_send(state, ev,
1037 smb2req->session,
1038 smb2req);
1039 if (tevent_req_nomem(subreq, req)) {
1040 return tevent_req_post(req, ev);
1041 }
1042 tevent_req_set_callback(subreq, smbd_smb2_logoff_shutdown_done, req);
1043
1044 return req;
1045 }
1046
1047 static void smbd_smb2_logoff_shutdown_done(struct tevent_req *subreq)
1048 {
1049 struct tevent_req *req = tevent_req_callback_data(
1050 subreq, struct tevent_req);
1051 struct smbd_smb2_logoff_state *state = tevent_req_data(
1052 req, struct smbd_smb2_logoff_state);
1053 NTSTATUS status;
1054
1055 status = smb2srv_session_shutdown_recv(subreq);
1056 if (tevent_req_nterror(req, status)) {
1057 return;
1058 }
1059 TALLOC_FREE(subreq);
1060
1061 /*
1062 * As we've been awoken, we may have changed
1063 * uid in the meantime. Ensure we're still
1064 * root (SMB2_OP_LOGOFF has .as_root = true).
1065 */
1066 change_to_root_user();
1067
1068 status = smbXsrv_session_logoff(state->smb2req->session);
1069 if (tevent_req_nterror(req, status)) {
1070 return;
1071 }
1072
1073 /*
1074 * we may need to sign the response, so we need to keep
1075 * the session until the response is sent to the wire.
1076 */
1077 talloc_steal(state->smb2req, state->smb2req->session);
1078
1079 tevent_req_done(req);
1080 }
1081
1082 static NTSTATUS smbd_smb2_logoff_recv(struct tevent_req *req)
1083 {
1084 return tevent_req_simple_recv_ntstatus(req);
1085 }
Samba GIT mirror