2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../libcli/auth/spnego.h"
27 #include "../libcli/auth/ntlmssp.h"
28 #include "ntlmssp_wrap.h"
29 #include "../librpc/gen_ndr/krb5pac.h"
30 #include "libads/kerberos_proto.h"
31 #include "../lib/util/asn1.h"
34 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
35 uint64_t in_session_id
,
36 uint8_t in_security_mode
,
37 DATA_BLOB in_security_buffer
,
38 uint16_t *out_session_flags
,
39 DATA_BLOB
*out_security_buffer
,
40 uint64_t *out_session_id
);
42 NTSTATUS
smbd_smb2_request_process_sesssetup(struct smbd_smb2_request
*smb2req
)
45 const uint8_t *inbody
;
46 int i
= smb2req
->current_idx
;
50 size_t expected_body_size
= 0x19;
52 uint64_t in_session_id
;
53 uint8_t in_security_mode
;
54 uint16_t in_security_offset
;
55 uint16_t in_security_length
;
56 DATA_BLOB in_security_buffer
;
57 uint16_t out_session_flags
;
58 uint64_t out_session_id
;
59 uint16_t out_security_offset
;
60 DATA_BLOB out_security_buffer
;
63 inhdr
= (const uint8_t *)smb2req
->in
.vector
[i
+0].iov_base
;
65 if (smb2req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
66 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
69 inbody
= (const uint8_t *)smb2req
->in
.vector
[i
+1].iov_base
;
71 body_size
= SVAL(inbody
, 0x00);
72 if (body_size
!= expected_body_size
) {
73 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
76 in_security_offset
= SVAL(inbody
, 0x0C);
77 in_security_length
= SVAL(inbody
, 0x0E);
79 if (in_security_offset
!= (SMB2_HDR_BODY
+ (body_size
& 0xFFFFFFFE))) {
80 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
83 if (in_security_length
> smb2req
->in
.vector
[i
+2].iov_len
) {
84 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
87 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
88 in_security_mode
= CVAL(inbody
, 0x03);
89 in_security_buffer
.data
= (uint8_t *)smb2req
->in
.vector
[i
+2].iov_base
;
90 in_security_buffer
.length
= in_security_length
;
92 status
= smbd_smb2_session_setup(smb2req
,
99 if (!NT_STATUS_IS_OK(status
) &&
100 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
101 status
= nt_status_squash(status
);
102 return smbd_smb2_request_error(smb2req
, status
);
105 out_security_offset
= SMB2_HDR_BODY
+ 0x08;
107 outhdr
= (uint8_t *)smb2req
->out
.vector
[i
].iov_base
;
109 outbody
= data_blob_talloc(smb2req
->out
.vector
, NULL
, 0x08);
110 if (outbody
.data
== NULL
) {
111 return smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
114 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, out_session_id
);
116 SSVAL(outbody
.data
, 0x00, 0x08 + 1); /* struct size */
117 SSVAL(outbody
.data
, 0x02,
118 out_session_flags
); /* session flags */
119 SSVAL(outbody
.data
, 0x04,
120 out_security_offset
); /* security buffer offset */
121 SSVAL(outbody
.data
, 0x06,
122 out_security_buffer
.length
); /* security buffer length */
124 outdyn
= out_security_buffer
;
126 return smbd_smb2_request_done_ex(smb2req
, status
, outbody
, &outdyn
,
130 static int smbd_smb2_session_destructor(struct smbd_smb2_session
*session
)
132 if (session
->sconn
== NULL
) {
136 /* first free all tcons */
137 while (session
->tcons
.list
) {
138 talloc_free(session
->tcons
.list
);
141 idr_remove(session
->sconn
->smb2
.sessions
.idtree
, session
->vuid
);
142 DLIST_REMOVE(session
->sconn
->smb2
.sessions
.list
, session
);
143 invalidate_vuid(session
->sconn
, session
->vuid
);
146 session
->status
= NT_STATUS_USER_SESSION_DELETED
;
147 session
->sconn
= NULL
;
152 static NTSTATUS
setup_ntlmssp_session_info(struct smbd_smb2_session
*session
,
155 if (NT_STATUS_IS_OK(status
)) {
156 status
= auth_ntlmssp_steal_session_info(session
,
157 session
->auth_ntlmssp_state
,
158 &session
->session_info
);
160 /* Note that this session_info won't have a session
161 * key. But for map to guest, that's exactly the right
162 * thing - we can't reasonably guess the key the
163 * client wants, as the password was wrong */
164 status
= do_map_to_guest(status
,
165 &session
->session_info
,
166 auth_ntlmssp_get_username(session
->auth_ntlmssp_state
),
167 auth_ntlmssp_get_domain(session
->auth_ntlmssp_state
));
173 static NTSTATUS
smbd_smb2_session_setup_krb5(struct smbd_smb2_session
*session
,
174 struct smbd_smb2_request
*smb2req
,
175 uint8_t in_security_mode
,
176 const DATA_BLOB
*secblob
,
178 uint16_t *out_session_flags
,
179 DATA_BLOB
*out_security_buffer
,
180 uint64_t *out_session_id
)
182 DATA_BLOB ap_rep
= data_blob_null
;
183 DATA_BLOB ap_rep_wrapped
= data_blob_null
;
184 DATA_BLOB ticket
= data_blob_null
;
185 DATA_BLOB session_key
= data_blob_null
;
186 DATA_BLOB secblob_out
= data_blob_null
;
188 struct PAC_LOGON_INFO
*logon_info
= NULL
;
189 char *principal
= NULL
;
192 struct passwd
*pw
= NULL
;
196 bool username_was_mapped
= false;
197 bool map_domainuser_to_guest
= false;
199 if (!spnego_parse_krb5_wrap(talloc_tos(), *secblob
, &ticket
, tok_id
)) {
200 status
= NT_STATUS_LOGON_FAILURE
;
204 status
= ads_verify_ticket(smb2req
, lp_realm(), 0, &ticket
,
205 &principal
, &logon_info
, &ap_rep
,
208 if (!NT_STATUS_IS_OK(status
)) {
209 DEBUG(1,("smb2: Failed to verify incoming ticket with error %s!\n",
211 if (!NT_STATUS_EQUAL(status
, NT_STATUS_TIME_DIFFERENCE_AT_DC
)) {
212 status
= NT_STATUS_LOGON_FAILURE
;
217 status
= get_user_from_kerberos_info(talloc_tos(),
218 smb2req
->sconn
->client_id
.name
,
219 principal
, logon_info
,
220 &username_was_mapped
,
221 &map_domainuser_to_guest
,
223 &real_username
, &pw
);
224 if (!NT_STATUS_IS_OK(status
)) {
228 /* save the PAC data if we have it */
230 netsamlogon_cache_store(user
, &logon_info
->info3
);
233 /* setup the string used by %U */
234 sub_set_smb_name(real_username
);
236 /* reload services so that the new %U is taken into account */
237 reload_services(smb2req
->sconn
->msg_ctx
, smb2req
->sconn
->sock
, true);
239 status
= make_server_info_krb5(session
,
240 user
, domain
, real_username
, pw
,
241 logon_info
, map_domainuser_to_guest
,
242 &session
->session_info
);
243 if (!NT_STATUS_IS_OK(status
)) {
244 DEBUG(1, ("smb2: make_server_info_krb5 failed\n"));
249 session
->session_info
->nss_token
|= username_was_mapped
;
251 /* we need to build the token for the user. make_session_info_guest()
254 if (!session
->session_info
->security_token
) {
255 status
= create_local_token(session
->session_info
);
256 if (!NT_STATUS_IS_OK(status
)) {
257 DEBUG(10,("smb2: failed to create local token: %s\n",
263 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
264 lp_server_signing() == Required
) {
265 session
->do_signing
= true;
268 if (session
->session_info
->guest
) {
269 /* we map anonymous to guest internally */
270 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
271 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
272 /* force no signing */
273 session
->do_signing
= false;
276 data_blob_free(&session
->session_info
->user_session_key
);
277 session
->session_info
->user_session_key
=
279 session
->session_info
,
282 if (session_key
.length
> 0) {
283 if (session
->session_info
->user_session_key
.data
== NULL
) {
284 status
= NT_STATUS_NO_MEMORY
;
288 session
->session_key
= session
->session_info
->user_session_key
;
290 session
->compat_vuser
= talloc_zero(session
, user_struct
);
291 if (session
->compat_vuser
== NULL
) {
292 status
= NT_STATUS_NO_MEMORY
;
295 session
->compat_vuser
->auth_ntlmssp_state
= NULL
;
296 session
->compat_vuser
->homes_snum
= -1;
297 session
->compat_vuser
->session_info
= session
->session_info
;
298 session
->compat_vuser
->session_keystr
= NULL
;
299 session
->compat_vuser
->vuid
= session
->vuid
;
300 DLIST_ADD(session
->sconn
->smb1
.sessions
.validated_users
, session
->compat_vuser
);
302 /* This is a potentially untrusted username */
303 alpha_strcpy(tmp
, user
, ". _-$", sizeof(tmp
));
304 session
->session_info
->sanitized_username
=
305 talloc_strdup(session
->session_info
, tmp
);
307 if (!session
->session_info
->guest
) {
308 session
->compat_vuser
->homes_snum
=
309 register_homes_share(session
->session_info
->unix_name
);
312 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
313 DEBUG(1, ("smb2: Failed to claim session "
315 session
->compat_vuser
->vuid
));
319 session
->status
= NT_STATUS_OK
;
322 * we attach the session to the request
323 * so that the response can be signed
325 smb2req
->session
= session
;
326 if (session
->do_signing
) {
327 smb2req
->do_signing
= true;
330 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
331 status
= NT_STATUS_OK
;
333 /* wrap that up in a nice GSS-API wrapping */
334 ap_rep_wrapped
= spnego_gen_krb5_wrap(talloc_tos(), ap_rep
,
337 secblob_out
= spnego_gen_auth_response(
343 *out_security_buffer
= data_blob_talloc(smb2req
,
346 if (secblob_out
.data
&& out_security_buffer
->data
== NULL
) {
347 status
= NT_STATUS_NO_MEMORY
;
351 data_blob_free(&ap_rep
);
352 data_blob_free(&ap_rep_wrapped
);
353 data_blob_free(&ticket
);
354 data_blob_free(&session_key
);
355 data_blob_free(&secblob_out
);
357 *out_session_id
= session
->vuid
;
363 data_blob_free(&ap_rep
);
364 data_blob_free(&ap_rep_wrapped
);
365 data_blob_free(&ticket
);
366 data_blob_free(&session_key
);
367 data_blob_free(&secblob_out
);
369 ap_rep_wrapped
= data_blob_null
;
370 secblob_out
= spnego_gen_auth_response(
376 *out_security_buffer
= data_blob_talloc(smb2req
,
379 data_blob_free(&secblob_out
);
384 static NTSTATUS
smbd_smb2_spnego_negotiate(struct smbd_smb2_session
*session
,
385 struct smbd_smb2_request
*smb2req
,
386 uint8_t in_security_mode
,
387 DATA_BLOB in_security_buffer
,
388 uint16_t *out_session_flags
,
389 DATA_BLOB
*out_security_buffer
,
390 uint64_t *out_session_id
)
392 DATA_BLOB secblob_in
= data_blob_null
;
393 DATA_BLOB chal_out
= data_blob_null
;
394 char *kerb_mech
= NULL
;
397 /* Ensure we have no old NTLM state around. */
398 TALLOC_FREE(session
->auth_ntlmssp_state
);
400 status
= parse_spnego_mechanisms(talloc_tos(), in_security_buffer
,
401 &secblob_in
, &kerb_mech
);
402 if (!NT_STATUS_IS_OK(status
)) {
407 if (kerb_mech
&& ((lp_security()==SEC_ADS
) ||
408 USE_KERBEROS_KEYTAB
) ) {
409 status
= smbd_smb2_session_setup_krb5(session
,
423 /* The mechtoken is a krb5 ticket, but
424 * we need to fall back to NTLM. */
426 DEBUG(3,("smb2: Got krb5 ticket in SPNEGO "
427 "but set to downgrade to NTLMSSP\n"));
429 status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
431 /* Fall back to NTLMSSP. */
432 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
433 if (!NT_STATUS_IS_OK(status
)) {
437 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
442 if (!NT_STATUS_IS_OK(status
) &&
443 !NT_STATUS_EQUAL(status
,
444 NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
448 *out_security_buffer
= spnego_gen_auth_response(smb2req
,
452 if (out_security_buffer
->data
== NULL
) {
453 status
= NT_STATUS_NO_MEMORY
;
456 *out_session_id
= session
->vuid
;
460 data_blob_free(&secblob_in
);
461 data_blob_free(&chal_out
);
462 TALLOC_FREE(kerb_mech
);
463 if (!NT_STATUS_IS_OK(status
) &&
464 !NT_STATUS_EQUAL(status
,
465 NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
466 TALLOC_FREE(session
->auth_ntlmssp_state
);
467 TALLOC_FREE(session
);
472 static NTSTATUS
smbd_smb2_common_ntlmssp_auth_return(struct smbd_smb2_session
*session
,
473 struct smbd_smb2_request
*smb2req
,
474 uint8_t in_security_mode
,
475 DATA_BLOB in_security_buffer
,
476 uint16_t *out_session_flags
,
477 uint64_t *out_session_id
)
481 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
482 lp_server_signing() == Required
) {
483 session
->do_signing
= true;
486 if (session
->session_info
->guest
) {
487 /* we map anonymous to guest internally */
488 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
489 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
490 /* force no signing */
491 session
->do_signing
= false;
494 session
->session_key
= session
->session_info
->user_session_key
;
496 session
->compat_vuser
= talloc_zero(session
, user_struct
);
497 if (session
->compat_vuser
== NULL
) {
498 TALLOC_FREE(session
->auth_ntlmssp_state
);
499 TALLOC_FREE(session
);
500 return NT_STATUS_NO_MEMORY
;
502 session
->compat_vuser
->auth_ntlmssp_state
= session
->auth_ntlmssp_state
;
503 session
->compat_vuser
->homes_snum
= -1;
504 session
->compat_vuser
->session_info
= session
->session_info
;
505 session
->compat_vuser
->session_keystr
= NULL
;
506 session
->compat_vuser
->vuid
= session
->vuid
;
507 DLIST_ADD(session
->sconn
->smb1
.sessions
.validated_users
, session
->compat_vuser
);
509 /* This is a potentially untrusted username */
511 auth_ntlmssp_get_username(session
->auth_ntlmssp_state
),
514 session
->session_info
->sanitized_username
= talloc_strdup(
515 session
->session_info
, tmp
);
517 if (!session
->compat_vuser
->session_info
->guest
) {
518 session
->compat_vuser
->homes_snum
=
519 register_homes_share(session
->session_info
->unix_name
);
522 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
523 DEBUG(1, ("smb2: Failed to claim session "
525 session
->compat_vuser
->vuid
));
526 TALLOC_FREE(session
->auth_ntlmssp_state
);
527 TALLOC_FREE(session
);
528 return NT_STATUS_LOGON_FAILURE
;
532 session
->status
= NT_STATUS_OK
;
535 * we attach the session to the request
536 * so that the response can be signed
538 smb2req
->session
= session
;
539 if (session
->do_signing
) {
540 smb2req
->do_signing
= true;
543 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
545 *out_session_id
= session
->vuid
;
550 static NTSTATUS
smbd_smb2_spnego_auth(struct smbd_smb2_session
*session
,
551 struct smbd_smb2_request
*smb2req
,
552 uint8_t in_security_mode
,
553 DATA_BLOB in_security_buffer
,
554 uint16_t *out_session_flags
,
555 DATA_BLOB
*out_security_buffer
,
556 uint64_t *out_session_id
)
558 DATA_BLOB auth
= data_blob_null
;
559 DATA_BLOB auth_out
= data_blob_null
;
562 if (!spnego_parse_auth(talloc_tos(), in_security_buffer
, &auth
)) {
563 TALLOC_FREE(session
);
564 return NT_STATUS_LOGON_FAILURE
;
567 if (auth
.data
[0] == ASN1_APPLICATION(0)) {
568 /* Might be a second negTokenTarg packet */
569 DATA_BLOB secblob_in
= data_blob_null
;
570 char *kerb_mech
= NULL
;
572 status
= parse_spnego_mechanisms(talloc_tos(),
574 &secblob_in
, &kerb_mech
);
575 if (!NT_STATUS_IS_OK(status
)) {
576 TALLOC_FREE(session
);
581 if (kerb_mech
&& ((lp_security()==SEC_ADS
) ||
582 USE_KERBEROS_KEYTAB
) ) {
583 status
= smbd_smb2_session_setup_krb5(session
,
592 data_blob_free(&secblob_in
);
593 TALLOC_FREE(kerb_mech
);
594 if (!NT_STATUS_IS_OK(status
)) {
595 TALLOC_FREE(session
);
601 /* Can't blunder into NTLMSSP auth if we have
605 DEBUG(3,("smb2: network "
606 "misconfiguration, client sent us a "
607 "krb5 ticket and kerberos security "
609 TALLOC_FREE(session
);
610 data_blob_free(&secblob_in
);
611 TALLOC_FREE(kerb_mech
);
612 return NT_STATUS_LOGON_FAILURE
;
615 data_blob_free(&secblob_in
);
618 if (session
->auth_ntlmssp_state
== NULL
) {
619 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
620 if (!NT_STATUS_IS_OK(status
)) {
621 data_blob_free(&auth
);
622 TALLOC_FREE(session
);
627 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
630 /* We need to call setup_ntlmssp_session_info() if status==NT_STATUS_OK,
631 or if status is anything except NT_STATUS_MORE_PROCESSING_REQUIRED,
632 as this can trigger map to guest. */
633 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
634 status
= setup_ntlmssp_session_info(session
, status
);
637 if (!NT_STATUS_IS_OK(status
) &&
638 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
639 TALLOC_FREE(session
->auth_ntlmssp_state
);
640 data_blob_free(&auth
);
641 TALLOC_FREE(session
);
645 data_blob_free(&auth
);
647 *out_security_buffer
= spnego_gen_auth_response(smb2req
,
648 &auth_out
, status
, NULL
);
650 if (out_security_buffer
->data
== NULL
) {
651 TALLOC_FREE(session
->auth_ntlmssp_state
);
652 TALLOC_FREE(session
);
653 return NT_STATUS_NO_MEMORY
;
656 *out_session_id
= session
->vuid
;
658 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
659 return NT_STATUS_MORE_PROCESSING_REQUIRED
;
662 /* We're done - claim the session. */
663 return smbd_smb2_common_ntlmssp_auth_return(session
,
671 static NTSTATUS
smbd_smb2_raw_ntlmssp_auth(struct smbd_smb2_session
*session
,
672 struct smbd_smb2_request
*smb2req
,
673 uint8_t in_security_mode
,
674 DATA_BLOB in_security_buffer
,
675 uint16_t *out_session_flags
,
676 DATA_BLOB
*out_security_buffer
,
677 uint64_t *out_session_id
)
680 DATA_BLOB secblob_out
= data_blob_null
;
682 if (session
->auth_ntlmssp_state
== NULL
) {
683 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
684 if (!NT_STATUS_IS_OK(status
)) {
685 TALLOC_FREE(session
);
691 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
695 if (NT_STATUS_IS_OK(status
) ||
696 NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
697 *out_security_buffer
= data_blob_talloc(smb2req
,
700 if (secblob_out
.data
&& out_security_buffer
->data
== NULL
) {
701 TALLOC_FREE(session
->auth_ntlmssp_state
);
702 TALLOC_FREE(session
);
703 return NT_STATUS_NO_MEMORY
;
707 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
708 *out_session_id
= session
->vuid
;
712 status
= setup_ntlmssp_session_info(session
, status
);
714 if (!NT_STATUS_IS_OK(status
)) {
715 TALLOC_FREE(session
->auth_ntlmssp_state
);
716 TALLOC_FREE(session
);
719 *out_session_id
= session
->vuid
;
721 return smbd_smb2_common_ntlmssp_auth_return(session
,
729 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
730 uint64_t in_session_id
,
731 uint8_t in_security_mode
,
732 DATA_BLOB in_security_buffer
,
733 uint16_t *out_session_flags
,
734 DATA_BLOB
*out_security_buffer
,
735 uint64_t *out_session_id
)
737 struct smbd_smb2_session
*session
;
739 *out_session_flags
= 0;
742 if (in_session_id
== 0) {
745 /* create a new session */
746 session
= talloc_zero(smb2req
->sconn
, struct smbd_smb2_session
);
747 if (session
== NULL
) {
748 return NT_STATUS_NO_MEMORY
;
750 session
->status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
751 id
= idr_get_new_random(smb2req
->sconn
->smb2
.sessions
.idtree
,
753 smb2req
->sconn
->smb2
.sessions
.limit
);
755 return NT_STATUS_INSUFFICIENT_RESOURCES
;
759 session
->tcons
.idtree
= idr_init(session
);
760 if (session
->tcons
.idtree
== NULL
) {
761 return NT_STATUS_NO_MEMORY
;
763 session
->tcons
.limit
= 0x0000FFFE;
764 session
->tcons
.list
= NULL
;
766 DLIST_ADD_END(smb2req
->sconn
->smb2
.sessions
.list
, session
,
767 struct smbd_smb2_session
*);
768 session
->sconn
= smb2req
->sconn
;
769 talloc_set_destructor(session
, smbd_smb2_session_destructor
);
773 /* lookup an existing session */
774 p
= idr_find(smb2req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
776 return NT_STATUS_USER_SESSION_DELETED
;
778 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
781 if (NT_STATUS_IS_OK(session
->status
)) {
782 return NT_STATUS_REQUEST_NOT_ACCEPTED
;
785 if (in_security_buffer
.data
[0] == ASN1_APPLICATION(0)) {
786 return smbd_smb2_spnego_negotiate(session
,
793 } else if (in_security_buffer
.data
[0] == ASN1_CONTEXT(1)) {
794 return smbd_smb2_spnego_auth(session
,
801 } else if (strncmp((char *)(in_security_buffer
.data
), "NTLMSSP", 7) == 0) {
802 return smbd_smb2_raw_ntlmssp_auth(session
,
811 /* Unknown packet type. */
812 DEBUG(1,("Unknown packet type %u in smb2 sessionsetup\n",
813 (unsigned int)in_security_buffer
.data
[0] ));
814 TALLOC_FREE(session
->auth_ntlmssp_state
);
815 TALLOC_FREE(session
);
816 return NT_STATUS_LOGON_FAILURE
;
819 NTSTATUS
smbd_smb2_request_check_session(struct smbd_smb2_request
*req
)
821 const uint8_t *inhdr
;
822 const uint8_t *outhdr
;
823 int i
= req
->current_idx
;
824 uint64_t in_session_id
;
826 struct smbd_smb2_session
*session
;
827 bool chained_fixup
= false;
829 inhdr
= (const uint8_t *)req
->in
.vector
[i
+0].iov_base
;
831 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
833 if (in_session_id
== (0xFFFFFFFFFFFFFFFFLL
)) {
836 * async request - fill in session_id from
837 * already setup request out.vector[].iov_base.
839 outhdr
= (const uint8_t *)req
->out
.vector
[i
].iov_base
;
840 in_session_id
= BVAL(outhdr
, SMB2_HDR_SESSION_ID
);
843 * Chained request - fill in session_id from
844 * the previous request out.vector[].iov_base.
846 outhdr
= (const uint8_t *)req
->out
.vector
[i
-3].iov_base
;
847 in_session_id
= BVAL(outhdr
, SMB2_HDR_SESSION_ID
);
848 chained_fixup
= true;
852 /* lookup an existing session */
853 p
= idr_find(req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
855 return NT_STATUS_USER_SESSION_DELETED
;
857 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
859 if (!NT_STATUS_IS_OK(session
->status
)) {
860 return NT_STATUS_ACCESS_DENIED
;
863 set_current_user_info(session
->session_info
->sanitized_username
,
864 session
->session_info
->unix_name
,
865 session
->session_info
->info3
->base
.domain
.string
);
867 req
->session
= session
;
870 /* Fix up our own outhdr. */
871 outhdr
= (const uint8_t *)req
->out
.vector
[i
].iov_base
;
872 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, in_session_id
);
877 NTSTATUS
smbd_smb2_request_process_logoff(struct smbd_smb2_request
*req
)
879 const uint8_t *inbody
;
880 int i
= req
->current_idx
;
882 size_t expected_body_size
= 0x04;
885 if (req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
886 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
889 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
891 body_size
= SVAL(inbody
, 0x00);
892 if (body_size
!= expected_body_size
) {
893 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
897 * TODO: cancel all outstanding requests on the session
898 * and delete all tree connections.
900 smbd_smb2_session_destructor(req
->session
);
902 * we may need to sign the response, so we need to keep
903 * the session until the response is sent to the wire.
905 talloc_steal(req
, req
->session
);
907 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x04);
908 if (outbody
.data
== NULL
) {
909 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
912 SSVAL(outbody
.data
, 0x00, 0x04); /* struct size */
913 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
915 return smbd_smb2_request_done(req
, outbody
, NULL
);