2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/tevent_ntstatus.h"
31 #include "lib/crypto/sha512.h"
32 #include "lib/crypto/aes.h"
33 #include "lib/crypto/aes_ccm_128.h"
34 #include "lib/crypto/aes_gcm_128.h"
36 static struct tevent_req
*smbd_smb2_session_setup_wrap_send(TALLOC_CTX
*mem_ctx
,
37 struct tevent_context
*ev
,
38 struct smbd_smb2_request
*smb2req
,
39 uint64_t in_session_id
,
41 uint8_t in_security_mode
,
42 uint64_t in_previous_session_id
,
43 DATA_BLOB in_security_buffer
);
44 static NTSTATUS
smbd_smb2_session_setup_wrap_recv(struct tevent_req
*req
,
45 uint16_t *out_session_flags
,
47 DATA_BLOB
*out_security_buffer
,
48 uint64_t *out_session_id
);
50 static void smbd_smb2_request_sesssetup_done(struct tevent_req
*subreq
);
52 NTSTATUS
smbd_smb2_request_process_sesssetup(struct smbd_smb2_request
*smb2req
)
55 const uint8_t *inbody
;
56 uint64_t in_session_id
;
58 uint8_t in_security_mode
;
59 uint64_t in_previous_session_id
;
60 uint16_t in_security_offset
;
61 uint16_t in_security_length
;
62 DATA_BLOB in_security_buffer
;
64 struct tevent_req
*subreq
;
66 status
= smbd_smb2_request_verify_sizes(smb2req
, 0x19);
67 if (!NT_STATUS_IS_OK(status
)) {
68 return smbd_smb2_request_error(smb2req
, status
);
70 inhdr
= SMBD_SMB2_IN_HDR_PTR(smb2req
);
71 inbody
= SMBD_SMB2_IN_BODY_PTR(smb2req
);
73 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
75 in_flags
= CVAL(inbody
, 0x02);
76 in_security_mode
= CVAL(inbody
, 0x03);
77 /* Capabilities = IVAL(inbody, 0x04) */
78 /* Channel = IVAL(inbody, 0x08) */
79 in_security_offset
= SVAL(inbody
, 0x0C);
80 in_security_length
= SVAL(inbody
, 0x0E);
81 in_previous_session_id
= BVAL(inbody
, 0x10);
83 if (in_security_offset
!= (SMB2_HDR_BODY
+ SMBD_SMB2_IN_BODY_LEN(smb2req
))) {
84 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
87 if (in_security_length
> SMBD_SMB2_IN_DYN_LEN(smb2req
)) {
88 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
91 in_security_buffer
.data
= SMBD_SMB2_IN_DYN_PTR(smb2req
);
92 in_security_buffer
.length
= in_security_length
;
94 subreq
= smbd_smb2_session_setup_wrap_send(smb2req
,
95 smb2req
->sconn
->ev_ctx
,
100 in_previous_session_id
,
102 if (subreq
== NULL
) {
103 return smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
105 tevent_req_set_callback(subreq
, smbd_smb2_request_sesssetup_done
, smb2req
);
107 return smbd_smb2_request_pending_queue(smb2req
, subreq
, 500);
110 static void smbd_smb2_request_sesssetup_done(struct tevent_req
*subreq
)
112 struct smbd_smb2_request
*smb2req
=
113 tevent_req_callback_data(subreq
,
114 struct smbd_smb2_request
);
118 uint16_t out_session_flags
= 0;
119 uint64_t out_session_id
= 0;
120 uint16_t out_security_offset
;
121 DATA_BLOB out_security_buffer
= data_blob_null
;
123 NTSTATUS error
; /* transport error */
125 status
= smbd_smb2_session_setup_wrap_recv(subreq
,
128 &out_security_buffer
,
131 if (!NT_STATUS_IS_OK(status
) &&
132 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
133 status
= nt_status_squash(status
);
134 error
= smbd_smb2_request_error(smb2req
, status
);
135 if (!NT_STATUS_IS_OK(error
)) {
136 smbd_server_connection_terminate(smb2req
->xconn
,
143 out_security_offset
= SMB2_HDR_BODY
+ 0x08;
145 outhdr
= SMBD_SMB2_OUT_HDR_PTR(smb2req
);
147 outbody
= smbd_smb2_generate_outbody(smb2req
, 0x08);
148 if (outbody
.data
== NULL
) {
149 error
= smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
150 if (!NT_STATUS_IS_OK(error
)) {
151 smbd_server_connection_terminate(smb2req
->xconn
,
158 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, out_session_id
);
160 SSVAL(outbody
.data
, 0x00, 0x08 + 1); /* struct size */
161 SSVAL(outbody
.data
, 0x02,
162 out_session_flags
); /* session flags */
163 SSVAL(outbody
.data
, 0x04,
164 out_security_offset
); /* security buffer offset */
165 SSVAL(outbody
.data
, 0x06,
166 out_security_buffer
.length
); /* security buffer length */
168 outdyn
= out_security_buffer
;
170 error
= smbd_smb2_request_done_ex(smb2req
, status
, outbody
, &outdyn
,
172 if (!NT_STATUS_IS_OK(error
)) {
173 smbd_server_connection_terminate(smb2req
->xconn
,
179 static NTSTATUS
smbd_smb2_auth_generic_return(struct smbXsrv_session
*session
,
180 struct smbXsrv_session_auth0
**_auth
,
181 struct smbd_smb2_request
*smb2req
,
182 uint8_t in_security_mode
,
183 struct auth_session_info
*session_info
,
184 uint16_t *out_session_flags
,
185 uint64_t *out_session_id
)
189 uint8_t session_key
[16];
190 struct smbXsrv_session
*x
= session
;
191 struct smbXsrv_session_auth0
*auth
= *_auth
;
192 struct smbXsrv_connection
*xconn
= smb2req
->xconn
;
199 struct _derivation signing
;
200 struct _derivation encryption
;
201 struct _derivation decryption
;
202 struct _derivation application
;
207 if (xconn
->protocol
>= PROTOCOL_SMB3_10
) {
208 struct smbXsrv_preauth
*preauth
;
209 struct _derivation
*d
;
211 struct hc_sha512state sctx
;
213 preauth
= talloc_move(smb2req
, &auth
->preauth
);
215 samba_SHA512_Init(&sctx
);
216 samba_SHA512_Update(&sctx
, preauth
->sha512_value
,
217 sizeof(preauth
->sha512_value
));
218 for (i
= 1; i
< smb2req
->in
.vector_count
; i
++) {
219 samba_SHA512_Update(&sctx
,
220 smb2req
->in
.vector
[i
].iov_base
,
221 smb2req
->in
.vector
[i
].iov_len
);
223 samba_SHA512_Final(preauth
->sha512_value
, &sctx
);
225 p
= data_blob_const(preauth
->sha512_value
,
226 sizeof(preauth
->sha512_value
));
228 d
= &derivation
.signing
;
229 d
->label
= data_blob_string_const_null("SMBSigningKey");
232 d
= &derivation
.decryption
;
233 d
->label
= data_blob_string_const_null("SMBC2SCipherKey");
236 d
= &derivation
.encryption
;
237 d
->label
= data_blob_string_const_null("SMBS2CCipherKey");
240 d
= &derivation
.application
;
241 d
->label
= data_blob_string_const_null("SMBAppKey");
244 } else if (xconn
->protocol
>= PROTOCOL_SMB2_24
) {
245 struct _derivation
*d
;
247 d
= &derivation
.signing
;
248 d
->label
= data_blob_string_const_null("SMB2AESCMAC");
249 d
->context
= data_blob_string_const_null("SmbSign");
251 d
= &derivation
.decryption
;
252 d
->label
= data_blob_string_const_null("SMB2AESCCM");
253 d
->context
= data_blob_string_const_null("ServerIn ");
255 d
= &derivation
.encryption
;
256 d
->label
= data_blob_string_const_null("SMB2AESCCM");
257 d
->context
= data_blob_string_const_null("ServerOut");
259 d
= &derivation
.application
;
260 d
->label
= data_blob_string_const_null("SMB2APP");
261 d
->context
= data_blob_string_const_null("SmbRpc");
264 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
265 lp_server_signing() == SMB_SIGNING_REQUIRED
) {
266 x
->global
->signing_required
= true;
269 if ((lp_smb_encrypt(-1) >= SMB_SIGNING_DESIRED
) &&
270 (xconn
->smb2
.client
.capabilities
& SMB2_CAP_ENCRYPTION
)) {
271 x
->encryption_desired
= true;
274 if (lp_smb_encrypt(-1) == SMB_SIGNING_REQUIRED
) {
275 x
->encryption_desired
= true;
276 x
->global
->encryption_required
= true;
279 if (security_session_user_level(session_info
, NULL
) < SECURITY_USER
) {
280 /* we map anonymous to guest internally */
281 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
282 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
283 /* force no signing */
284 x
->global
->signing_required
= false;
288 if (guest
&& x
->global
->encryption_required
) {
289 DEBUG(1,("reject guest session as encryption is required\n"));
290 return NT_STATUS_ACCESS_DENIED
;
293 if (xconn
->smb2
.server
.cipher
== 0) {
294 if (x
->global
->encryption_required
) {
295 DEBUG(1,("reject session with dialect[0x%04X] "
296 "as encryption is required\n",
297 xconn
->smb2
.server
.dialect
));
298 return NT_STATUS_ACCESS_DENIED
;
302 if (x
->encryption_desired
) {
303 *out_session_flags
|= SMB2_SESSION_FLAG_ENCRYPT_DATA
;
306 ZERO_STRUCT(session_key
);
307 memcpy(session_key
, session_info
->session_key
.data
,
308 MIN(session_info
->session_key
.length
, sizeof(session_key
)));
310 x
->global
->signing_key
= data_blob_talloc(x
->global
,
312 sizeof(session_key
));
313 if (x
->global
->signing_key
.data
== NULL
) {
314 ZERO_STRUCT(session_key
);
315 return NT_STATUS_NO_MEMORY
;
318 if (xconn
->protocol
>= PROTOCOL_SMB2_24
) {
319 struct _derivation
*d
= &derivation
.signing
;
321 smb2_key_derivation(session_key
, sizeof(session_key
),
322 d
->label
.data
, d
->label
.length
,
323 d
->context
.data
, d
->context
.length
,
324 x
->global
->signing_key
.data
);
327 if (xconn
->protocol
>= PROTOCOL_SMB2_24
) {
328 struct _derivation
*d
= &derivation
.decryption
;
330 x
->global
->decryption_key
= data_blob_talloc(x
->global
,
332 sizeof(session_key
));
333 if (x
->global
->decryption_key
.data
== NULL
) {
334 ZERO_STRUCT(session_key
);
335 return NT_STATUS_NO_MEMORY
;
338 smb2_key_derivation(session_key
, sizeof(session_key
),
339 d
->label
.data
, d
->label
.length
,
340 d
->context
.data
, d
->context
.length
,
341 x
->global
->decryption_key
.data
);
344 if (xconn
->protocol
>= PROTOCOL_SMB2_24
) {
345 struct _derivation
*d
= &derivation
.encryption
;
348 x
->global
->encryption_key
= data_blob_talloc(x
->global
,
350 sizeof(session_key
));
351 if (x
->global
->encryption_key
.data
== NULL
) {
352 ZERO_STRUCT(session_key
);
353 return NT_STATUS_NO_MEMORY
;
356 smb2_key_derivation(session_key
, sizeof(session_key
),
357 d
->label
.data
, d
->label
.length
,
358 d
->context
.data
, d
->context
.length
,
359 x
->global
->encryption_key
.data
);
362 * CCM and GCM algorithms must never have their
363 * nonce wrap, or the security of the whole
364 * communication and the keys is destroyed.
365 * We must drop the connection once we have
366 * transfered too much data.
368 * NOTE: We assume nonces greater than 8 bytes.
370 generate_random_buffer((uint8_t *)&x
->nonce_high_random
,
371 sizeof(x
->nonce_high_random
));
372 switch (xconn
->smb2
.server
.cipher
) {
373 case SMB2_ENCRYPTION_AES128_CCM
:
374 nonce_size
= AES_CCM_128_NONCE_SIZE
;
376 case SMB2_ENCRYPTION_AES128_GCM
:
377 nonce_size
= AES_GCM_128_IV_SIZE
;
383 x
->nonce_high_max
= SMB2_NONCE_HIGH_MAX(nonce_size
);
388 x
->global
->application_key
= data_blob_dup_talloc(x
->global
,
389 x
->global
->signing_key
);
390 if (x
->global
->application_key
.data
== NULL
) {
391 ZERO_STRUCT(session_key
);
392 return NT_STATUS_NO_MEMORY
;
395 if (xconn
->protocol
>= PROTOCOL_SMB2_24
) {
396 struct _derivation
*d
= &derivation
.application
;
398 smb2_key_derivation(session_key
, sizeof(session_key
),
399 d
->label
.data
, d
->label
.length
,
400 d
->context
.data
, d
->context
.length
,
401 x
->global
->application_key
.data
);
403 ZERO_STRUCT(session_key
);
405 x
->global
->channels
[0].signing_key
= data_blob_dup_talloc(x
->global
->channels
,
406 x
->global
->signing_key
);
407 if (x
->global
->channels
[0].signing_key
.data
== NULL
) {
408 return NT_STATUS_NO_MEMORY
;
411 data_blob_clear_free(&session_info
->session_key
);
412 session_info
->session_key
= data_blob_dup_talloc(session_info
,
413 x
->global
->application_key
);
414 if (session_info
->session_key
.data
== NULL
) {
415 return NT_STATUS_NO_MEMORY
;
418 session
->compat
= talloc_zero(session
, struct user_struct
);
419 if (session
->compat
== NULL
) {
420 return NT_STATUS_NO_MEMORY
;
422 session
->compat
->session
= session
;
423 session
->compat
->homes_snum
= -1;
424 session
->compat
->session_info
= session_info
;
425 session
->compat
->session_keystr
= NULL
;
426 session
->compat
->vuid
= session
->global
->session_wire_id
;
427 DLIST_ADD(smb2req
->sconn
->users
, session
->compat
);
428 smb2req
->sconn
->num_users
++;
430 if (security_session_user_level(session_info
, NULL
) >= SECURITY_USER
) {
431 session
->compat
->homes_snum
=
432 register_homes_share(session_info
->unix_info
->unix_name
);
435 set_current_user_info(session_info
->unix_info
->sanitized_username
,
436 session_info
->unix_info
->unix_name
,
437 session_info
->info
->domain_name
);
439 reload_services(smb2req
->sconn
, conn_snum_used
, true);
441 session
->status
= NT_STATUS_OK
;
442 session
->global
->auth_session_info
= talloc_move(session
->global
,
444 session
->global
->auth_session_info_seqnum
+= 1;
445 for (i
=0; i
< session
->global
->num_channels
; i
++) {
446 struct smbXsrv_channel_global0
*_c
=
447 &session
->global
->channels
[i
];
449 _c
->auth_session_info_seqnum
=
450 session
->global
->auth_session_info_seqnum
;
452 session
->global
->auth_time
= timeval_to_nttime(&smb2req
->request_time
);
453 session
->global
->expiration_time
= gensec_expire_time(auth
->gensec
);
455 if (!session_claim(session
)) {
456 DEBUG(1, ("smb2: Failed to claim session "
458 (unsigned long long)session
->compat
->vuid
));
459 return NT_STATUS_LOGON_FAILURE
;
463 status
= smbXsrv_session_update(session
);
464 if (!NT_STATUS_IS_OK(status
)) {
465 DEBUG(0, ("smb2: Failed to update session for vuid=%llu - %s\n",
466 (unsigned long long)session
->compat
->vuid
,
468 return NT_STATUS_LOGON_FAILURE
;
472 * we attach the session to the request
473 * so that the response can be signed
476 smb2req
->do_signing
= true;
479 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
481 *out_session_id
= session
->global
->session_wire_id
;
486 static NTSTATUS
smbd_smb2_reauth_generic_return(struct smbXsrv_session
*session
,
487 struct smbXsrv_session_auth0
**_auth
,
488 struct smbd_smb2_request
*smb2req
,
489 struct auth_session_info
*session_info
,
490 uint16_t *out_session_flags
,
491 uint64_t *out_session_id
)
494 struct smbXsrv_session
*x
= session
;
495 struct smbXsrv_session_auth0
*auth
= *_auth
;
500 data_blob_clear_free(&session_info
->session_key
);
501 session_info
->session_key
= data_blob_dup_talloc(session_info
,
502 x
->global
->application_key
);
503 if (session_info
->session_key
.data
== NULL
) {
504 return NT_STATUS_NO_MEMORY
;
507 session
->compat
->session_info
= session_info
;
508 session
->compat
->vuid
= session
->global
->session_wire_id
;
510 session
->compat
->homes_snum
=
511 register_homes_share(session_info
->unix_info
->unix_name
);
513 set_current_user_info(session_info
->unix_info
->sanitized_username
,
514 session_info
->unix_info
->unix_name
,
515 session_info
->info
->domain_name
);
517 reload_services(smb2req
->sconn
, conn_snum_used
, true);
519 session
->status
= NT_STATUS_OK
;
520 TALLOC_FREE(session
->global
->auth_session_info
);
521 session
->global
->auth_session_info
= talloc_move(session
->global
,
523 session
->global
->auth_session_info_seqnum
+= 1;
524 for (i
=0; i
< session
->global
->num_channels
; i
++) {
525 struct smbXsrv_channel_global0
*_c
=
526 &session
->global
->channels
[i
];
528 _c
->auth_session_info_seqnum
=
529 session
->global
->auth_session_info_seqnum
;
531 session
->global
->auth_time
= timeval_to_nttime(&smb2req
->request_time
);
532 session
->global
->expiration_time
= gensec_expire_time(auth
->gensec
);
535 status
= smbXsrv_session_update(session
);
536 if (!NT_STATUS_IS_OK(status
)) {
537 DEBUG(0, ("smb2: Failed to update session for vuid=%llu - %s\n",
538 (unsigned long long)session
->compat
->vuid
,
540 return NT_STATUS_LOGON_FAILURE
;
543 conn_clear_vuid_caches(smb2req
->sconn
, session
->compat
->vuid
);
545 if (security_session_user_level(session_info
, NULL
) >= SECURITY_USER
) {
546 smb2req
->do_signing
= true;
549 *out_session_id
= session
->global
->session_wire_id
;
554 struct smbd_smb2_session_setup_state
{
555 struct tevent_context
*ev
;
556 struct smbd_smb2_request
*smb2req
;
557 uint64_t in_session_id
;
559 uint8_t in_security_mode
;
560 uint64_t in_previous_session_id
;
561 DATA_BLOB in_security_buffer
;
562 struct smbXsrv_session
*session
;
563 struct smbXsrv_session_auth0
*auth
;
564 struct auth_session_info
*session_info
;
565 uint16_t out_session_flags
;
566 DATA_BLOB out_security_buffer
;
567 uint64_t out_session_id
;
570 static void smbd_smb2_session_setup_gensec_done(struct tevent_req
*subreq
);
571 static void smbd_smb2_session_setup_previous_done(struct tevent_req
*subreq
);
572 static void smbd_smb2_session_setup_auth_return(struct tevent_req
*req
);
574 static struct tevent_req
*smbd_smb2_session_setup_send(TALLOC_CTX
*mem_ctx
,
575 struct tevent_context
*ev
,
576 struct smbd_smb2_request
*smb2req
,
577 uint64_t in_session_id
,
579 uint8_t in_security_mode
,
580 uint64_t in_previous_session_id
,
581 DATA_BLOB in_security_buffer
)
583 struct tevent_req
*req
;
584 struct smbd_smb2_session_setup_state
*state
;
586 NTTIME now
= timeval_to_nttime(&smb2req
->request_time
);
587 struct tevent_req
*subreq
;
588 struct smbXsrv_channel_global0
*c
= NULL
;
590 req
= tevent_req_create(mem_ctx
, &state
,
591 struct smbd_smb2_session_setup_state
);
596 state
->smb2req
= smb2req
;
597 state
->in_session_id
= in_session_id
;
598 state
->in_flags
= in_flags
;
599 state
->in_security_mode
= in_security_mode
;
600 state
->in_previous_session_id
= in_previous_session_id
;
601 state
->in_security_buffer
= in_security_buffer
;
603 if (in_flags
& SMB2_SESSION_FLAG_BINDING
) {
604 if (smb2req
->xconn
->protocol
< PROTOCOL_SMB2_22
) {
605 tevent_req_nterror(req
, NT_STATUS_REQUEST_NOT_ACCEPTED
);
606 return tevent_req_post(req
, ev
);
610 * We do not support multi channel.
612 tevent_req_nterror(req
, NT_STATUS_NOT_SUPPORTED
);
613 return tevent_req_post(req
, ev
);
616 if (state
->in_session_id
== 0) {
617 /* create a new session */
618 status
= smbXsrv_session_create(state
->smb2req
->xconn
,
619 now
, &state
->session
);
620 if (tevent_req_nterror(req
, status
)) {
621 return tevent_req_post(req
, ev
);
623 smb2req
->session
= state
->session
;
625 if (smb2req
->session
== NULL
) {
626 tevent_req_nterror(req
, NT_STATUS_USER_SESSION_DELETED
);
627 return tevent_req_post(req
, ev
);
630 state
->session
= smb2req
->session
;
631 status
= state
->session
->status
;
632 if (NT_STATUS_EQUAL(status
, NT_STATUS_NETWORK_SESSION_EXPIRED
)) {
633 status
= NT_STATUS_OK
;
635 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
636 status
= NT_STATUS_OK
;
638 if (tevent_req_nterror(req
, status
)) {
639 return tevent_req_post(req
, ev
);
641 if (!(in_flags
& SMB2_SESSION_FLAG_BINDING
)) {
642 state
->session
->status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
646 status
= smbXsrv_session_find_channel(smb2req
->session
,
648 if (!NT_STATUS_IS_OK(status
)) {
649 tevent_req_nterror(req
, status
);
650 return tevent_req_post(req
, ev
);
653 status
= smbXsrv_session_find_auth(state
->session
, smb2req
->xconn
,
655 if (!NT_STATUS_IS_OK(status
)) {
656 status
= smbXsrv_session_create_auth(state
->session
,
658 in_flags
, in_security_mode
,
660 if (tevent_req_nterror(req
, status
)) {
661 return tevent_req_post(req
, ev
);
665 if (state
->auth
->gensec
== NULL
) {
666 status
= auth_generic_prepare(state
->auth
,
667 state
->smb2req
->xconn
->remote_address
,
668 &state
->auth
->gensec
);
669 if (tevent_req_nterror(req
, status
)) {
670 return tevent_req_post(req
, ev
);
673 gensec_want_feature(state
->auth
->gensec
, GENSEC_FEATURE_SESSION_KEY
);
674 gensec_want_feature(state
->auth
->gensec
, GENSEC_FEATURE_UNIX_TOKEN
);
676 status
= gensec_start_mech_by_oid(state
->auth
->gensec
,
678 if (tevent_req_nterror(req
, status
)) {
679 return tevent_req_post(req
, ev
);
683 status
= smbXsrv_session_update(state
->session
);
684 if (tevent_req_nterror(req
, status
)) {
685 return tevent_req_post(req
, ev
);
689 subreq
= gensec_update_send(state
, state
->ev
,
691 state
->in_security_buffer
);
693 if (tevent_req_nomem(subreq
, req
)) {
694 return tevent_req_post(req
, ev
);
696 tevent_req_set_callback(subreq
, smbd_smb2_session_setup_gensec_done
, req
);
701 static void smbd_smb2_session_setup_gensec_done(struct tevent_req
*subreq
)
703 struct tevent_req
*req
=
704 tevent_req_callback_data(subreq
,
706 struct smbd_smb2_session_setup_state
*state
=
708 struct smbd_smb2_session_setup_state
);
712 status
= gensec_update_recv(subreq
, state
,
713 &state
->out_security_buffer
);
716 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
) &&
717 !NT_STATUS_IS_OK(status
)) {
718 tevent_req_nterror(req
, status
);
722 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
723 state
->out_session_id
= state
->session
->global
->session_wire_id
;
724 state
->smb2req
->preauth
= state
->auth
->preauth
;
725 tevent_req_nterror(req
, status
);
729 status
= gensec_session_info(state
->auth
->gensec
,
731 &state
->session_info
);
732 if (tevent_req_nterror(req
, status
)) {
736 if ((state
->in_previous_session_id
!= 0) &&
737 (state
->session
->global
->session_wire_id
!=
738 state
->in_previous_session_id
))
740 subreq
= smb2srv_session_close_previous_send(state
, state
->ev
,
741 state
->smb2req
->xconn
,
743 state
->in_previous_session_id
,
744 state
->session
->global
->session_wire_id
);
745 if (tevent_req_nomem(subreq
, req
)) {
748 tevent_req_set_callback(subreq
,
749 smbd_smb2_session_setup_previous_done
,
754 smbd_smb2_session_setup_auth_return(req
);
757 static void smbd_smb2_session_setup_previous_done(struct tevent_req
*subreq
)
759 struct tevent_req
*req
=
760 tevent_req_callback_data(subreq
,
764 status
= smb2srv_session_close_previous_recv(subreq
);
766 if (tevent_req_nterror(req
, status
)) {
770 smbd_smb2_session_setup_auth_return(req
);
773 static void smbd_smb2_session_setup_auth_return(struct tevent_req
*req
)
775 struct smbd_smb2_session_setup_state
*state
=
777 struct smbd_smb2_session_setup_state
);
780 if (state
->session
->global
->auth_session_info
!= NULL
) {
781 status
= smbd_smb2_reauth_generic_return(state
->session
,
785 &state
->out_session_flags
,
786 &state
->out_session_id
);
787 if (tevent_req_nterror(req
, status
)) {
790 tevent_req_done(req
);
794 status
= smbd_smb2_auth_generic_return(state
->session
,
797 state
->in_security_mode
,
799 &state
->out_session_flags
,
800 &state
->out_session_id
);
801 if (tevent_req_nterror(req
, status
)) {
805 tevent_req_done(req
);
809 static NTSTATUS
smbd_smb2_session_setup_recv(struct tevent_req
*req
,
810 uint16_t *out_session_flags
,
812 DATA_BLOB
*out_security_buffer
,
813 uint64_t *out_session_id
)
815 struct smbd_smb2_session_setup_state
*state
=
817 struct smbd_smb2_session_setup_state
);
820 if (tevent_req_is_nterror(req
, &status
)) {
821 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
822 tevent_req_received(req
);
823 return nt_status_squash(status
);
826 status
= NT_STATUS_OK
;
829 *out_session_flags
= state
->out_session_flags
;
830 *out_security_buffer
= state
->out_security_buffer
;
831 *out_session_id
= state
->out_session_id
;
833 talloc_steal(mem_ctx
, out_security_buffer
->data
);
834 tevent_req_received(req
);
838 struct smbd_smb2_session_setup_wrap_state
{
839 struct tevent_context
*ev
;
840 struct smbd_smb2_request
*smb2req
;
841 uint64_t in_session_id
;
843 uint8_t in_security_mode
;
844 uint64_t in_previous_session_id
;
845 DATA_BLOB in_security_buffer
;
846 uint16_t out_session_flags
;
847 DATA_BLOB out_security_buffer
;
848 uint64_t out_session_id
;
852 static void smbd_smb2_session_setup_wrap_setup_done(struct tevent_req
*subreq
);
853 static void smbd_smb2_session_setup_wrap_shutdown_done(struct tevent_req
*subreq
);
855 static struct tevent_req
*smbd_smb2_session_setup_wrap_send(TALLOC_CTX
*mem_ctx
,
856 struct tevent_context
*ev
,
857 struct smbd_smb2_request
*smb2req
,
858 uint64_t in_session_id
,
860 uint8_t in_security_mode
,
861 uint64_t in_previous_session_id
,
862 DATA_BLOB in_security_buffer
)
864 struct tevent_req
*req
;
865 struct smbd_smb2_session_setup_wrap_state
*state
;
866 struct tevent_req
*subreq
;
868 req
= tevent_req_create(mem_ctx
, &state
,
869 struct smbd_smb2_session_setup_wrap_state
);
874 state
->smb2req
= smb2req
;
875 state
->in_session_id
= in_session_id
;
876 state
->in_flags
= in_flags
;
877 state
->in_security_mode
= in_security_mode
;
878 state
->in_previous_session_id
= in_previous_session_id
;
879 state
->in_security_buffer
= in_security_buffer
;
881 subreq
= smbd_smb2_session_setup_send(state
, state
->ev
,
883 state
->in_session_id
,
885 state
->in_security_mode
,
886 state
->in_previous_session_id
,
887 state
->in_security_buffer
);
888 if (tevent_req_nomem(subreq
, req
)) {
889 return tevent_req_post(req
, ev
);
891 tevent_req_set_callback(subreq
,
892 smbd_smb2_session_setup_wrap_setup_done
, req
);
897 static void smbd_smb2_session_setup_wrap_setup_done(struct tevent_req
*subreq
)
899 struct tevent_req
*req
=
900 tevent_req_callback_data(subreq
,
902 struct smbd_smb2_session_setup_wrap_state
*state
=
904 struct smbd_smb2_session_setup_wrap_state
);
907 status
= smbd_smb2_session_setup_recv(subreq
,
908 &state
->out_session_flags
,
910 &state
->out_security_buffer
,
911 &state
->out_session_id
);
913 if (NT_STATUS_IS_OK(status
)) {
914 tevent_req_done(req
);
917 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
918 tevent_req_nterror(req
, status
);
922 if (state
->smb2req
->session
== NULL
) {
923 tevent_req_nterror(req
, status
);
927 state
->error
= status
;
929 subreq
= smb2srv_session_shutdown_send(state
, state
->ev
,
930 state
->smb2req
->session
,
932 if (tevent_req_nomem(subreq
, req
)) {
935 tevent_req_set_callback(subreq
,
936 smbd_smb2_session_setup_wrap_shutdown_done
,
940 static void smbd_smb2_session_setup_wrap_shutdown_done(struct tevent_req
*subreq
)
942 struct tevent_req
*req
=
943 tevent_req_callback_data(subreq
,
945 struct smbd_smb2_session_setup_wrap_state
*state
=
947 struct smbd_smb2_session_setup_wrap_state
);
950 status
= smb2srv_session_shutdown_recv(subreq
);
952 if (tevent_req_nterror(req
, status
)) {
957 * we may need to sign the response, so we need to keep
958 * the session until the response is sent to the wire.
960 talloc_steal(state
->smb2req
, state
->smb2req
->session
);
962 tevent_req_nterror(req
, state
->error
);
965 static NTSTATUS
smbd_smb2_session_setup_wrap_recv(struct tevent_req
*req
,
966 uint16_t *out_session_flags
,
968 DATA_BLOB
*out_security_buffer
,
969 uint64_t *out_session_id
)
971 struct smbd_smb2_session_setup_wrap_state
*state
=
973 struct smbd_smb2_session_setup_wrap_state
);
976 if (tevent_req_is_nterror(req
, &status
)) {
977 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
978 tevent_req_received(req
);
979 return nt_status_squash(status
);
982 status
= NT_STATUS_OK
;
985 *out_session_flags
= state
->out_session_flags
;
986 *out_security_buffer
= state
->out_security_buffer
;
987 *out_session_id
= state
->out_session_id
;
989 talloc_steal(mem_ctx
, out_security_buffer
->data
);
990 tevent_req_received(req
);
994 static struct tevent_req
*smbd_smb2_logoff_send(TALLOC_CTX
*mem_ctx
,
995 struct tevent_context
*ev
,
996 struct smbd_smb2_request
*smb2req
);
997 static NTSTATUS
smbd_smb2_logoff_recv(struct tevent_req
*req
);
998 static void smbd_smb2_request_logoff_done(struct tevent_req
*subreq
);
1000 NTSTATUS
smbd_smb2_request_process_logoff(struct smbd_smb2_request
*req
)
1003 struct tevent_req
*subreq
= NULL
;
1005 status
= smbd_smb2_request_verify_sizes(req
, 0x04);
1006 if (!NT_STATUS_IS_OK(status
)) {
1007 return smbd_smb2_request_error(req
, status
);
1010 subreq
= smbd_smb2_logoff_send(req
, req
->sconn
->ev_ctx
, req
);
1011 if (subreq
== NULL
) {
1012 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
1014 tevent_req_set_callback(subreq
, smbd_smb2_request_logoff_done
, req
);
1017 * Wait a long time before going async on this to allow
1018 * requests we're waiting on to finish. Set timeout to 10 secs.
1020 return smbd_smb2_request_pending_queue(req
, subreq
, 10000000);
1023 static void smbd_smb2_request_logoff_done(struct tevent_req
*subreq
)
1025 struct smbd_smb2_request
*smb2req
=
1026 tevent_req_callback_data(subreq
,
1027 struct smbd_smb2_request
);
1032 status
= smbd_smb2_logoff_recv(subreq
);
1033 TALLOC_FREE(subreq
);
1034 if (!NT_STATUS_IS_OK(status
)) {
1035 error
= smbd_smb2_request_error(smb2req
, status
);
1036 if (!NT_STATUS_IS_OK(error
)) {
1037 smbd_server_connection_terminate(smb2req
->xconn
,
1044 outbody
= smbd_smb2_generate_outbody(smb2req
, 0x04);
1045 if (outbody
.data
== NULL
) {
1046 error
= smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
1047 if (!NT_STATUS_IS_OK(error
)) {
1048 smbd_server_connection_terminate(smb2req
->xconn
,
1055 SSVAL(outbody
.data
, 0x00, 0x04); /* struct size */
1056 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
1058 error
= smbd_smb2_request_done(smb2req
, outbody
, NULL
);
1059 if (!NT_STATUS_IS_OK(error
)) {
1060 smbd_server_connection_terminate(smb2req
->xconn
,
1066 struct smbd_smb2_logoff_state
{
1067 struct smbd_smb2_request
*smb2req
;
1070 static void smbd_smb2_logoff_shutdown_done(struct tevent_req
*subreq
);
1072 static struct tevent_req
*smbd_smb2_logoff_send(TALLOC_CTX
*mem_ctx
,
1073 struct tevent_context
*ev
,
1074 struct smbd_smb2_request
*smb2req
)
1076 struct tevent_req
*req
;
1077 struct smbd_smb2_logoff_state
*state
;
1078 struct tevent_req
*subreq
;
1080 req
= tevent_req_create(mem_ctx
, &state
,
1081 struct smbd_smb2_logoff_state
);
1085 state
->smb2req
= smb2req
;
1087 subreq
= smb2srv_session_shutdown_send(state
, ev
,
1090 if (tevent_req_nomem(subreq
, req
)) {
1091 return tevent_req_post(req
, ev
);
1093 tevent_req_set_callback(subreq
, smbd_smb2_logoff_shutdown_done
, req
);
1098 static void smbd_smb2_logoff_shutdown_done(struct tevent_req
*subreq
)
1100 struct tevent_req
*req
= tevent_req_callback_data(
1101 subreq
, struct tevent_req
);
1102 struct smbd_smb2_logoff_state
*state
= tevent_req_data(
1103 req
, struct smbd_smb2_logoff_state
);
1106 status
= smb2srv_session_shutdown_recv(subreq
);
1107 if (tevent_req_nterror(req
, status
)) {
1110 TALLOC_FREE(subreq
);
1113 * As we've been awoken, we may have changed
1114 * uid in the meantime. Ensure we're still
1115 * root (SMB2_OP_LOGOFF has .as_root = true).
1117 change_to_root_user();
1119 status
= smbXsrv_session_logoff(state
->smb2req
->session
);
1120 if (tevent_req_nterror(req
, status
)) {
1125 * we may need to sign the response, so we need to keep
1126 * the session until the response is sent to the wire.
1128 talloc_steal(state
->smb2req
, state
->smb2req
->session
);
1130 tevent_req_done(req
);
1133 static NTSTATUS
smbd_smb2_logoff_recv(struct tevent_req
*req
)
1135 return tevent_req_simple_recv_ntstatus(req
);