2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../libcli/auth/spnego.h"
26 #include "../libcli/auth/ntlmssp.h"
27 #include "ntlmssp_wrap.h"
28 #include "../librpc/gen_ndr/krb5pac.h"
29 #include "libads/kerberos_proto.h"
31 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
32 uint64_t in_session_id
,
33 uint8_t in_security_mode
,
34 DATA_BLOB in_security_buffer
,
35 uint16_t *out_session_flags
,
36 DATA_BLOB
*out_security_buffer
,
37 uint64_t *out_session_id
);
39 NTSTATUS
smbd_smb2_request_process_sesssetup(struct smbd_smb2_request
*smb2req
)
42 const uint8_t *inbody
;
43 int i
= smb2req
->current_idx
;
47 size_t expected_body_size
= 0x19;
49 uint64_t in_session_id
;
50 uint8_t in_security_mode
;
51 uint16_t in_security_offset
;
52 uint16_t in_security_length
;
53 DATA_BLOB in_security_buffer
;
54 uint16_t out_session_flags
;
55 uint64_t out_session_id
;
56 uint16_t out_security_offset
;
57 DATA_BLOB out_security_buffer
;
60 inhdr
= (const uint8_t *)smb2req
->in
.vector
[i
+0].iov_base
;
62 if (smb2req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
63 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
66 inbody
= (const uint8_t *)smb2req
->in
.vector
[i
+1].iov_base
;
68 body_size
= SVAL(inbody
, 0x00);
69 if (body_size
!= expected_body_size
) {
70 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
73 in_security_offset
= SVAL(inbody
, 0x0C);
74 in_security_length
= SVAL(inbody
, 0x0E);
76 if (in_security_offset
!= (SMB2_HDR_BODY
+ (body_size
& 0xFFFFFFFE))) {
77 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
80 if (in_security_length
> smb2req
->in
.vector
[i
+2].iov_len
) {
81 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
84 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
85 in_security_mode
= CVAL(inbody
, 0x03);
86 in_security_buffer
.data
= (uint8_t *)smb2req
->in
.vector
[i
+2].iov_base
;
87 in_security_buffer
.length
= in_security_length
;
89 status
= smbd_smb2_session_setup(smb2req
,
96 if (!NT_STATUS_IS_OK(status
) &&
97 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
98 status
= nt_status_squash(status
);
99 return smbd_smb2_request_error(smb2req
, status
);
102 out_security_offset
= SMB2_HDR_BODY
+ 0x08;
104 outhdr
= (uint8_t *)smb2req
->out
.vector
[i
].iov_base
;
106 outbody
= data_blob_talloc(smb2req
->out
.vector
, NULL
, 0x08);
107 if (outbody
.data
== NULL
) {
108 return smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
111 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, out_session_id
);
113 SSVAL(outbody
.data
, 0x00, 0x08 + 1); /* struct size */
114 SSVAL(outbody
.data
, 0x02,
115 out_session_flags
); /* session flags */
116 SSVAL(outbody
.data
, 0x04,
117 out_security_offset
); /* security buffer offset */
118 SSVAL(outbody
.data
, 0x06,
119 out_security_buffer
.length
); /* security buffer length */
121 outdyn
= out_security_buffer
;
123 return smbd_smb2_request_done_ex(smb2req
, status
, outbody
, &outdyn
,
127 static int smbd_smb2_session_destructor(struct smbd_smb2_session
*session
)
129 if (session
->sconn
== NULL
) {
133 /* first free all tcons */
134 while (session
->tcons
.list
) {
135 talloc_free(session
->tcons
.list
);
138 idr_remove(session
->sconn
->smb2
.sessions
.idtree
, session
->vuid
);
139 DLIST_REMOVE(session
->sconn
->smb2
.sessions
.list
, session
);
140 invalidate_vuid(session
->sconn
, session
->vuid
);
143 session
->status
= NT_STATUS_USER_SESSION_DELETED
;
144 session
->sconn
= NULL
;
149 static NTSTATUS
setup_ntlmssp_server_info(struct smbd_smb2_session
*session
,
152 if (NT_STATUS_IS_OK(status
)) {
153 status
= auth_ntlmssp_steal_server_info(session
,
154 session
->auth_ntlmssp_state
,
155 &session
->server_info
);
157 /* Note that this server_info won't have a session
158 * key. But for map to guest, that's exactly the right
159 * thing - we can't reasonably guess the key the
160 * client wants, as the password was wrong */
161 status
= do_map_to_guest(status
,
162 &session
->server_info
,
163 auth_ntlmssp_get_username(session
->auth_ntlmssp_state
),
164 auth_ntlmssp_get_domain(session
->auth_ntlmssp_state
));
170 static NTSTATUS
smbd_smb2_session_setup_krb5(struct smbd_smb2_session
*session
,
171 struct smbd_smb2_request
*smb2req
,
172 uint8_t in_security_mode
,
173 const DATA_BLOB
*secblob
,
175 uint16_t *out_session_flags
,
176 DATA_BLOB
*out_security_buffer
,
177 uint64_t *out_session_id
)
179 DATA_BLOB ap_rep
= data_blob_null
;
180 DATA_BLOB ap_rep_wrapped
= data_blob_null
;
181 DATA_BLOB ticket
= data_blob_null
;
182 DATA_BLOB session_key
= data_blob_null
;
183 DATA_BLOB secblob_out
= data_blob_null
;
185 struct PAC_LOGON_INFO
*logon_info
= NULL
;
186 char *principal
= NULL
;
189 struct passwd
*pw
= NULL
;
193 bool username_was_mapped
= false;
194 bool map_domainuser_to_guest
= false;
196 if (!spnego_parse_krb5_wrap(talloc_tos(), *secblob
, &ticket
, tok_id
)) {
197 status
= NT_STATUS_LOGON_FAILURE
;
201 status
= ads_verify_ticket(smb2req
, lp_realm(), 0, &ticket
,
202 &principal
, &logon_info
, &ap_rep
,
205 if (!NT_STATUS_IS_OK(status
)) {
206 DEBUG(1,("smb2: Failed to verify incoming ticket with error %s!\n",
208 if (!NT_STATUS_EQUAL(status
, NT_STATUS_TIME_DIFFERENCE_AT_DC
)) {
209 status
= NT_STATUS_LOGON_FAILURE
;
214 status
= get_user_from_kerberos_info(talloc_tos(),
215 smb2req
->sconn
->client_id
.name
,
216 principal
, logon_info
,
217 &username_was_mapped
,
218 &map_domainuser_to_guest
,
220 &real_username
, &pw
);
221 if (!NT_STATUS_IS_OK(status
)) {
225 /* save the PAC data if we have it */
227 netsamlogon_cache_store(user
, &logon_info
->info3
);
230 /* setup the string used by %U */
231 sub_set_smb_name(real_username
);
233 /* reload services so that the new %U is taken into account */
234 reload_services(smb2req
->sconn
->msg_ctx
, smb2req
->sconn
->sock
, true);
236 if (map_domainuser_to_guest
) {
237 status
= make_server_info_guest(session
,
238 &session
->server_info
);
239 if (!NT_STATUS_IS_OK(status
) ) {
240 DEBUG(1,("smb2: make_server_info_guest failed: %s!\n",
245 } else if (logon_info
) {
246 /* pass the unmapped username here since map_username()
247 will be called again in make_server_info_info3() */
249 status
= make_server_info_info3(session
,
251 &session
->server_info
,
253 if (!NT_STATUS_IS_OK(status
) ) {
254 DEBUG(1,("smb2: make_server_info_info3 failed: %s!\n",
261 * We didn't get a PAC, we have to make up the user
262 * ourselves. Try to ask the pdb backend to provide
263 * SID consistency with ntlmssp session setup
265 struct samu
*sampass
;
266 /* The stupid make_server_info_XX functions here
267 don't take a talloc context. */
268 struct auth_serversupplied_info
*tmp_server_info
= NULL
;
270 sampass
= samu_new(talloc_tos());
271 if (sampass
== NULL
) {
272 status
= NT_STATUS_NO_MEMORY
;
276 if (pdb_getsampwnam(sampass
, real_username
)) {
277 DEBUG(10, ("smb2: found user %s in passdb, calling "
278 "make_server_info_sam\n", real_username
));
279 status
= make_server_info_sam(&tmp_server_info
, sampass
);
280 TALLOC_FREE(sampass
);
283 * User not in passdb, make it up artificially
285 TALLOC_FREE(sampass
);
286 DEBUG(10, ("smb2: didn't find user %s in passdb, calling "
287 "make_server_info_pw\n", real_username
));
288 status
= make_server_info_pw(&tmp_server_info
,
292 if (!NT_STATUS_IS_OK(status
)) {
293 DEBUG(1,("smb2: make_server_info_[sam|pw] failed: %s!\n",
298 /* Steal tmp_server_info into the session->server_info
300 session
->server_info
= talloc_move(session
, &tmp_server_info
);
302 /* make_server_info_pw does not set the domain. Without this
303 * we end up with the local netbios name in substitutions for
306 if (session
->server_info
->info3
!= NULL
) {
307 session
->server_info
->info3
->base
.domain
.string
=
308 talloc_strdup(session
->server_info
->info3
, domain
);
313 session
->server_info
->nss_token
|= username_was_mapped
;
315 /* we need to build the token for the user. make_server_info_guest()
318 if (!session
->server_info
->ptok
) {
319 status
= create_local_token(session
->server_info
);
320 if (!NT_STATUS_IS_OK(status
)) {
321 DEBUG(10,("smb2: failed to create local token: %s\n",
327 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
328 lp_server_signing() == Required
) {
329 session
->do_signing
= true;
332 if (session
->server_info
->guest
) {
333 /* we map anonymous to guest internally */
334 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
335 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
336 /* force no signing */
337 session
->do_signing
= false;
340 data_blob_free(&session
->server_info
->user_session_key
);
341 session
->server_info
->user_session_key
=
343 session
->server_info
,
346 if (session_key
.length
> 0) {
347 if (session
->server_info
->user_session_key
.data
== NULL
) {
348 status
= NT_STATUS_NO_MEMORY
;
352 session
->session_key
= session
->server_info
->user_session_key
;
354 session
->compat_vuser
= talloc_zero(session
, user_struct
);
355 if (session
->compat_vuser
== NULL
) {
356 status
= NT_STATUS_NO_MEMORY
;
359 session
->compat_vuser
->auth_ntlmssp_state
= NULL
;
360 session
->compat_vuser
->homes_snum
= -1;
361 session
->compat_vuser
->server_info
= session
->server_info
;
362 session
->compat_vuser
->session_keystr
= NULL
;
363 session
->compat_vuser
->vuid
= session
->vuid
;
364 DLIST_ADD(session
->sconn
->smb1
.sessions
.validated_users
, session
->compat_vuser
);
366 /* This is a potentially untrusted username */
367 alpha_strcpy(tmp
, user
, ". _-$", sizeof(tmp
));
368 session
->server_info
->sanitized_username
=
369 talloc_strdup(session
->server_info
, tmp
);
371 if (!session
->server_info
->guest
) {
372 session
->compat_vuser
->homes_snum
=
373 register_homes_share(session
->server_info
->unix_name
);
376 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
377 DEBUG(1, ("smb2: Failed to claim session "
379 session
->compat_vuser
->vuid
));
383 session
->status
= NT_STATUS_OK
;
386 * we attach the session to the request
387 * so that the response can be signed
389 smb2req
->session
= session
;
390 if (session
->do_signing
) {
391 smb2req
->do_signing
= true;
394 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
395 status
= NT_STATUS_OK
;
397 /* wrap that up in a nice GSS-API wrapping */
398 ap_rep_wrapped
= spnego_gen_krb5_wrap(talloc_tos(), ap_rep
,
401 secblob_out
= spnego_gen_auth_response(
407 *out_security_buffer
= data_blob_talloc(smb2req
,
410 if (secblob_out
.data
&& out_security_buffer
->data
== NULL
) {
411 status
= NT_STATUS_NO_MEMORY
;
415 data_blob_free(&ap_rep
);
416 data_blob_free(&ap_rep_wrapped
);
417 data_blob_free(&ticket
);
418 data_blob_free(&session_key
);
419 data_blob_free(&secblob_out
);
421 *out_session_id
= session
->vuid
;
427 data_blob_free(&ap_rep
);
428 data_blob_free(&ap_rep_wrapped
);
429 data_blob_free(&ticket
);
430 data_blob_free(&session_key
);
431 data_blob_free(&secblob_out
);
433 ap_rep_wrapped
= data_blob_null
;
434 secblob_out
= spnego_gen_auth_response(
440 *out_security_buffer
= data_blob_talloc(smb2req
,
443 data_blob_free(&secblob_out
);
448 static NTSTATUS
smbd_smb2_spnego_negotiate(struct smbd_smb2_session
*session
,
449 struct smbd_smb2_request
*smb2req
,
450 uint8_t in_security_mode
,
451 DATA_BLOB in_security_buffer
,
452 uint16_t *out_session_flags
,
453 DATA_BLOB
*out_security_buffer
,
454 uint64_t *out_session_id
)
456 DATA_BLOB secblob_in
= data_blob_null
;
457 DATA_BLOB chal_out
= data_blob_null
;
458 char *kerb_mech
= NULL
;
461 /* Ensure we have no old NTLM state around. */
462 TALLOC_FREE(session
->auth_ntlmssp_state
);
464 status
= parse_spnego_mechanisms(talloc_tos(), in_security_buffer
,
465 &secblob_in
, &kerb_mech
);
466 if (!NT_STATUS_IS_OK(status
)) {
471 if (kerb_mech
&& ((lp_security()==SEC_ADS
) ||
472 USE_KERBEROS_KEYTAB
) ) {
473 status
= smbd_smb2_session_setup_krb5(session
,
487 /* The mechtoken is a krb5 ticket, but
488 * we need to fall back to NTLM. */
490 DEBUG(3,("smb2: Got krb5 ticket in SPNEGO "
491 "but set to downgrade to NTLMSSP\n"));
493 status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
495 /* Fall back to NTLMSSP. */
496 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
497 if (!NT_STATUS_IS_OK(status
)) {
501 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
506 if (!NT_STATUS_IS_OK(status
) &&
507 !NT_STATUS_EQUAL(status
,
508 NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
512 *out_security_buffer
= spnego_gen_auth_response(smb2req
,
516 if (out_security_buffer
->data
== NULL
) {
517 status
= NT_STATUS_NO_MEMORY
;
520 *out_session_id
= session
->vuid
;
524 data_blob_free(&secblob_in
);
525 data_blob_free(&chal_out
);
526 TALLOC_FREE(kerb_mech
);
527 if (!NT_STATUS_IS_OK(status
) &&
528 !NT_STATUS_EQUAL(status
,
529 NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
530 TALLOC_FREE(session
->auth_ntlmssp_state
);
531 TALLOC_FREE(session
);
536 static NTSTATUS
smbd_smb2_common_ntlmssp_auth_return(struct smbd_smb2_session
*session
,
537 struct smbd_smb2_request
*smb2req
,
538 uint8_t in_security_mode
,
539 DATA_BLOB in_security_buffer
,
540 uint16_t *out_session_flags
,
541 uint64_t *out_session_id
)
545 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
546 lp_server_signing() == Required
) {
547 session
->do_signing
= true;
550 if (session
->server_info
->guest
) {
551 /* we map anonymous to guest internally */
552 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
553 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
554 /* force no signing */
555 session
->do_signing
= false;
558 session
->session_key
= session
->server_info
->user_session_key
;
560 session
->compat_vuser
= talloc_zero(session
, user_struct
);
561 if (session
->compat_vuser
== NULL
) {
562 TALLOC_FREE(session
->auth_ntlmssp_state
);
563 TALLOC_FREE(session
);
564 return NT_STATUS_NO_MEMORY
;
566 session
->compat_vuser
->auth_ntlmssp_state
= session
->auth_ntlmssp_state
;
567 session
->compat_vuser
->homes_snum
= -1;
568 session
->compat_vuser
->server_info
= session
->server_info
;
569 session
->compat_vuser
->session_keystr
= NULL
;
570 session
->compat_vuser
->vuid
= session
->vuid
;
571 DLIST_ADD(session
->sconn
->smb1
.sessions
.validated_users
, session
->compat_vuser
);
573 /* This is a potentially untrusted username */
575 auth_ntlmssp_get_username(session
->auth_ntlmssp_state
),
578 session
->server_info
->sanitized_username
= talloc_strdup(
579 session
->server_info
, tmp
);
581 if (!session
->compat_vuser
->server_info
->guest
) {
582 session
->compat_vuser
->homes_snum
=
583 register_homes_share(session
->server_info
->unix_name
);
586 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
587 DEBUG(1, ("smb2: Failed to claim session "
589 session
->compat_vuser
->vuid
));
590 TALLOC_FREE(session
->auth_ntlmssp_state
);
591 TALLOC_FREE(session
);
592 return NT_STATUS_LOGON_FAILURE
;
596 session
->status
= NT_STATUS_OK
;
599 * we attach the session to the request
600 * so that the response can be signed
602 smb2req
->session
= session
;
603 if (session
->do_signing
) {
604 smb2req
->do_signing
= true;
607 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
609 *out_session_id
= session
->vuid
;
614 static NTSTATUS
smbd_smb2_spnego_auth(struct smbd_smb2_session
*session
,
615 struct smbd_smb2_request
*smb2req
,
616 uint8_t in_security_mode
,
617 DATA_BLOB in_security_buffer
,
618 uint16_t *out_session_flags
,
619 DATA_BLOB
*out_security_buffer
,
620 uint64_t *out_session_id
)
622 DATA_BLOB auth
= data_blob_null
;
623 DATA_BLOB auth_out
= data_blob_null
;
626 if (!spnego_parse_auth(talloc_tos(), in_security_buffer
, &auth
)) {
627 TALLOC_FREE(session
);
628 return NT_STATUS_LOGON_FAILURE
;
631 if (auth
.data
[0] == ASN1_APPLICATION(0)) {
632 /* Might be a second negTokenTarg packet */
633 DATA_BLOB secblob_in
= data_blob_null
;
634 char *kerb_mech
= NULL
;
636 status
= parse_spnego_mechanisms(talloc_tos(),
638 &secblob_in
, &kerb_mech
);
639 if (!NT_STATUS_IS_OK(status
)) {
640 TALLOC_FREE(session
);
645 if (kerb_mech
&& ((lp_security()==SEC_ADS
) ||
646 USE_KERBEROS_KEYTAB
) ) {
647 status
= smbd_smb2_session_setup_krb5(session
,
656 data_blob_free(&secblob_in
);
657 TALLOC_FREE(kerb_mech
);
658 if (!NT_STATUS_IS_OK(status
)) {
659 TALLOC_FREE(session
);
665 /* Can't blunder into NTLMSSP auth if we have
669 DEBUG(3,("smb2: network "
670 "misconfiguration, client sent us a "
671 "krb5 ticket and kerberos security "
673 TALLOC_FREE(session
);
674 data_blob_free(&secblob_in
);
675 TALLOC_FREE(kerb_mech
);
676 return NT_STATUS_LOGON_FAILURE
;
679 data_blob_free(&secblob_in
);
682 if (session
->auth_ntlmssp_state
== NULL
) {
683 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
684 if (!NT_STATUS_IS_OK(status
)) {
685 data_blob_free(&auth
);
686 TALLOC_FREE(session
);
691 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
694 /* We need to call setup_ntlmssp_server_info() if status==NT_STATUS_OK,
695 or if status is anything except NT_STATUS_MORE_PROCESSING_REQUIRED,
696 as this can trigger map to guest. */
697 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
698 status
= setup_ntlmssp_server_info(session
, status
);
701 if (!NT_STATUS_IS_OK(status
) &&
702 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
703 TALLOC_FREE(session
->auth_ntlmssp_state
);
704 data_blob_free(&auth
);
705 TALLOC_FREE(session
);
709 data_blob_free(&auth
);
711 *out_security_buffer
= spnego_gen_auth_response(smb2req
,
712 &auth_out
, status
, NULL
);
714 if (out_security_buffer
->data
== NULL
) {
715 TALLOC_FREE(session
->auth_ntlmssp_state
);
716 TALLOC_FREE(session
);
717 return NT_STATUS_NO_MEMORY
;
720 *out_session_id
= session
->vuid
;
722 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
723 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
726 /* We're done - claim the session. */
727 return smbd_smb2_common_ntlmssp_auth_return(session
,
735 static NTSTATUS
smbd_smb2_raw_ntlmssp_auth(struct smbd_smb2_session
*session
,
736 struct smbd_smb2_request
*smb2req
,
737 uint8_t in_security_mode
,
738 DATA_BLOB in_security_buffer
,
739 uint16_t *out_session_flags
,
740 DATA_BLOB
*out_security_buffer
,
741 uint64_t *out_session_id
)
744 DATA_BLOB secblob_out
= data_blob_null
;
746 if (session
->auth_ntlmssp_state
== NULL
) {
747 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
748 if (!NT_STATUS_IS_OK(status
)) {
749 TALLOC_FREE(session
);
755 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
759 if (NT_STATUS_IS_OK(status
) ||
760 NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
761 *out_security_buffer
= data_blob_talloc(smb2req
,
764 if (secblob_out
.data
&& out_security_buffer
->data
== NULL
) {
765 TALLOC_FREE(session
->auth_ntlmssp_state
);
766 TALLOC_FREE(session
);
767 return NT_STATUS_NO_MEMORY
;
771 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
772 *out_session_id
= session
->vuid
;
776 status
= setup_ntlmssp_server_info(session
, status
);
778 if (!NT_STATUS_IS_OK(status
)) {
779 TALLOC_FREE(session
->auth_ntlmssp_state
);
780 TALLOC_FREE(session
);
783 *out_session_id
= session
->vuid
;
785 return smbd_smb2_common_ntlmssp_auth_return(session
,
793 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
794 uint64_t in_session_id
,
795 uint8_t in_security_mode
,
796 DATA_BLOB in_security_buffer
,
797 uint16_t *out_session_flags
,
798 DATA_BLOB
*out_security_buffer
,
799 uint64_t *out_session_id
)
801 struct smbd_smb2_session
*session
;
803 *out_session_flags
= 0;
806 if (in_session_id
== 0) {
809 /* create a new session */
810 session
= talloc_zero(smb2req
->sconn
, struct smbd_smb2_session
);
811 if (session
== NULL
) {
812 return NT_STATUS_NO_MEMORY
;
814 session
->status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
815 id
= idr_get_new_random(smb2req
->sconn
->smb2
.sessions
.idtree
,
817 smb2req
->sconn
->smb2
.sessions
.limit
);
819 return NT_STATUS_INSUFFICIENT_RESOURCES
;
823 session
->tcons
.idtree
= idr_init(session
);
824 if (session
->tcons
.idtree
== NULL
) {
825 return NT_STATUS_NO_MEMORY
;
827 session
->tcons
.limit
= 0x0000FFFE;
828 session
->tcons
.list
= NULL
;
830 DLIST_ADD_END(smb2req
->sconn
->smb2
.sessions
.list
, session
,
831 struct smbd_smb2_session
*);
832 session
->sconn
= smb2req
->sconn
;
833 talloc_set_destructor(session
, smbd_smb2_session_destructor
);
837 /* lookup an existing session */
838 p
= idr_find(smb2req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
840 return NT_STATUS_USER_SESSION_DELETED
;
842 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
845 if (NT_STATUS_IS_OK(session
->status
)) {
846 return NT_STATUS_REQUEST_NOT_ACCEPTED
;
849 if (in_security_buffer
.data
[0] == ASN1_APPLICATION(0)) {
850 return smbd_smb2_spnego_negotiate(session
,
857 } else if (in_security_buffer
.data
[0] == ASN1_CONTEXT(1)) {
858 return smbd_smb2_spnego_auth(session
,
865 } else if (strncmp((char *)(in_security_buffer
.data
), "NTLMSSP", 7) == 0) {
866 return smbd_smb2_raw_ntlmssp_auth(session
,
875 /* Unknown packet type. */
876 DEBUG(1,("Unknown packet type %u in smb2 sessionsetup\n",
877 (unsigned int)in_security_buffer
.data
[0] ));
878 TALLOC_FREE(session
->auth_ntlmssp_state
);
879 TALLOC_FREE(session
);
880 return NT_STATUS_LOGON_FAILURE
;
883 NTSTATUS
smbd_smb2_request_check_session(struct smbd_smb2_request
*req
)
885 const uint8_t *inhdr
;
886 const uint8_t *outhdr
;
887 int i
= req
->current_idx
;
888 uint64_t in_session_id
;
890 struct smbd_smb2_session
*session
;
891 bool chained_fixup
= false;
893 inhdr
= (const uint8_t *)req
->in
.vector
[i
+0].iov_base
;
895 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
897 if (in_session_id
== (0xFFFFFFFFFFFFFFFFLL
)) {
900 * async request - fill in session_id from
901 * already setup request out.vector[].iov_base.
903 outhdr
= (const uint8_t *)req
->out
.vector
[i
].iov_base
;
904 in_session_id
= BVAL(outhdr
, SMB2_HDR_SESSION_ID
);
907 * Chained request - fill in session_id from
908 * the previous request out.vector[].iov_base.
910 outhdr
= (const uint8_t *)req
->out
.vector
[i
-3].iov_base
;
911 in_session_id
= BVAL(outhdr
, SMB2_HDR_SESSION_ID
);
912 chained_fixup
= true;
916 /* lookup an existing session */
917 p
= idr_find(req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
919 return NT_STATUS_USER_SESSION_DELETED
;
921 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
923 if (!NT_STATUS_IS_OK(session
->status
)) {
924 return NT_STATUS_ACCESS_DENIED
;
927 set_current_user_info(session
->server_info
->sanitized_username
,
928 session
->server_info
->unix_name
,
929 session
->server_info
->info3
->base
.domain
.string
);
931 req
->session
= session
;
934 /* Fix up our own outhdr. */
935 outhdr
= (const uint8_t *)req
->out
.vector
[i
].iov_base
;
936 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, in_session_id
);
941 NTSTATUS
smbd_smb2_request_process_logoff(struct smbd_smb2_request
*req
)
943 const uint8_t *inbody
;
944 int i
= req
->current_idx
;
946 size_t expected_body_size
= 0x04;
949 if (req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
950 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
953 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
955 body_size
= SVAL(inbody
, 0x00);
956 if (body_size
!= expected_body_size
) {
957 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
961 * TODO: cancel all outstanding requests on the session
962 * and delete all tree connections.
964 smbd_smb2_session_destructor(req
->session
);
966 * we may need to sign the response, so we need to keep
967 * the session until the response is sent to the wire.
969 talloc_steal(req
, req
->session
);
971 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x04);
972 if (outbody
.data
== NULL
) {
973 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
976 SSVAL(outbody
.data
, 0x00, 0x04); /* struct size */
977 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
979 return smbd_smb2_request_done(req
, outbody
, NULL
);