?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
nfs4acls: Use talloc_realloc()
[Samba.git] / source3 / smbd / sesssetup.c
blob6c31958e448a615fd897058931c99ad0ba9013fa
1 /*
2 Unix SMB/CIFS implementation.
3 handle SMBsessionsetup
4 Copyright (C) Andrew Tridgell 1998-2001
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
7 Copyright (C) Luke Howard 2003
8 Copyright (C) Volker Lendecke 2007
9 Copyright (C) Jeremy Allison 2007
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "smbd/smbd.h"
28 #include "smbd/globals.h"
29 #include "../libcli/auth/spnego.h"
30 #include "../auth/ntlmssp/ntlmssp.h"
31 #include "../librpc/gen_ndr/krb5pac.h"
32 #include "libads/kerberos_proto.h"
33 #include "../lib/util/asn1.h"
34 #include "auth.h"
35 #include "messages.h"
36 #include "smbprofile.h"
37 #include "../libcli/security/security.h"
38 #include "auth/gensec/gensec.h"
39 #include "lib/conn_tdb.h"
40
41 /****************************************************************************
42 Add the standard 'Samba' signature to the end of the session setup.
43 ****************************************************************************/
44
45 static int push_signature(uint8_t **outbuf)
46 {
47 char *lanman;
48 int result, tmp;
49 fstring native_os;
50
51 result = 0;
52
53 fstr_sprintf(native_os, "Windows %d.%d", SAMBA_MAJOR_NBT_ANNOUNCE_VERSION,
54 SAMBA_MINOR_NBT_ANNOUNCE_VERSION);
55
56 tmp = message_push_string(outbuf, native_os, STR_TERMINATE);
57
58 if (tmp == -1) return -1;
59 result += tmp;
60
61 if (asprintf(&lanman, "Samba %s", samba_version_string()) != -1) {
62 tmp = message_push_string(outbuf, lanman, STR_TERMINATE);
63 SAFE_FREE(lanman);
64 }
65 else {
66 tmp = message_push_string(outbuf, "Samba", STR_TERMINATE);
67 }
68
69 if (tmp == -1) return -1;
70 result += tmp;
71
72 tmp = message_push_string(outbuf, lp_workgroup(), STR_TERMINATE);
73
74 if (tmp == -1) return -1;
75 result += tmp;
76
77 return result;
78 }
79
80 /****************************************************************************
81 Do a 'guest' logon, getting back the
82 ****************************************************************************/
83
84 static NTSTATUS check_guest_password(const struct tsocket_address *remote_address,
85 TALLOC_CTX *mem_ctx,
86 struct auth_session_info **session_info)
87 {
88 struct auth4_context *auth_context;
89 struct auth_usersupplied_info *user_info = NULL;
90 uint8_t chal[8];
91 NTSTATUS nt_status;
92
93 DEBUG(3,("Got anonymous request\n"));
94
95 nt_status = make_auth4_context(talloc_tos(), &auth_context);
96 if (!NT_STATUS_IS_OK(nt_status)) {
97 return nt_status;
98 }
99
100 auth_context->get_ntlm_challenge(auth_context,
101 chal);
102
103 if (!make_user_info_guest(talloc_tos(), remote_address, &user_info)) {
104 TALLOC_FREE(auth_context);
105 return NT_STATUS_NO_MEMORY;
106 }
107
108 nt_status = auth_check_password_session_info(auth_context,
109 mem_ctx, user_info, session_info);
110 TALLOC_FREE(user_info);
111 TALLOC_FREE(auth_context);
112 return nt_status;
113 }
114
115 /****************************************************************************
116 Reply to a session setup command.
117 conn POINTER CAN BE NULL HERE !
118 ****************************************************************************/
119
120 static void reply_sesssetup_and_X_spnego(struct smb_request *req)
121 {
122 const uint8_t *p;
123 DATA_BLOB in_blob;
124 DATA_BLOB out_blob = data_blob_null;
125 size_t bufrem;
126 char *tmp;
127 const char *native_os;
128 const char *native_lanman;
129 const char *primary_domain;
130 uint16_t data_blob_len = SVAL(req->vwv+7, 0);
131 enum remote_arch_types ra_type = get_remote_arch();
132 uint64_t vuid = req->vuid;
133 NTSTATUS status = NT_STATUS_OK;
134 struct smbXsrv_connection *xconn = req->xconn;
135 struct smbd_server_connection *sconn = req->sconn;
136 uint16_t action = 0;
137 NTTIME now = timeval_to_nttime(&req->request_time);
138 struct smbXsrv_session *session = NULL;
139 uint16_t smb_bufsize = SVAL(req->vwv+2, 0);
140 uint32_t client_caps = IVAL(req->vwv+10, 0);
141 struct smbXsrv_session_auth0 *auth;
142
143 DEBUG(3,("Doing spnego session setup\n"));
144
145 if (!xconn->smb1.sessions.done_sesssetup) {
146 global_client_caps = client_caps;
147
148 if (!(global_client_caps & CAP_STATUS32)) {
149 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
150 }
151 }
152
153 p = req->buf;
154
155 if (data_blob_len == 0) {
156 /* an invalid request */
157 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
158 return;
159 }
160
161 bufrem = smbreq_bufrem(req, p);
162 /* pull the spnego blob */
163 in_blob = data_blob_const(p, MIN(bufrem, data_blob_len));
164
165 #if 0
166 file_save("negotiate.dat", in_blob.data, in_blob.length);
167 #endif
168
169 p = req->buf + in_blob.length;
170
171 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
172 STR_TERMINATE);
173 native_os = tmp ? tmp : "";
174
175 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
176 STR_TERMINATE);
177 native_lanman = tmp ? tmp : "";
178
179 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
180 STR_TERMINATE);
181 primary_domain = tmp ? tmp : "";
182
183 DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
184 native_os, native_lanman, primary_domain));
185
186 if ( ra_type == RA_WIN2K ) {
187 /* Vista sets neither the OS or lanman strings */
188
189 if ( !strlen(native_os) && !strlen(native_lanman) )
190 set_remote_arch(RA_VISTA);
191
192 /* Windows 2003 doesn't set the native lanman string,
193 but does set primary domain which is a bug I think */
194
195 if ( !strlen(native_lanman) ) {
196 ra_lanman_string( primary_domain );
197 } else {
198 ra_lanman_string( native_lanman );
199 }
200 } else if ( ra_type == RA_VISTA ) {
201 if ( strncmp(native_os, "Mac OS X", 8) == 0 ) {
202 set_remote_arch(RA_OSX);
203 }
204 }
205
206 if (vuid != 0) {
207 status = smb1srv_session_lookup(xconn,
208 vuid, now,
209 &session);
210 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
211 reply_force_doserror(req, ERRSRV, ERRbaduid);
212 return;
213 }
214 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
215 status = NT_STATUS_OK;
216 }
217 if (NT_STATUS_IS_OK(status)) {
218 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
219 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
220 TALLOC_FREE(session->pending_auth);
221 }
222 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
223 reply_nterror(req, nt_status_squash(status));
224 return;
225 }
226 }
227
228 if (session == NULL) {
229 /* create a new session */
230 status = smbXsrv_session_create(xconn,
231 now, &session);
232 if (!NT_STATUS_IS_OK(status)) {
233 reply_nterror(req, nt_status_squash(status));
234 return;
235 }
236 }
237
238 status = smbXsrv_session_find_auth(session, xconn, now, &auth);
239 if (!NT_STATUS_IS_OK(status)) {
240 status = smbXsrv_session_create_auth(session, xconn, now,
241 0, /* flags */
242 0, /* security */
243 &auth);
244 if (!NT_STATUS_IS_OK(status)) {
245 reply_nterror(req, nt_status_squash(status));
246 return;
247 }
248 }
249
250 if (auth->gensec == NULL) {
251 status = auth_generic_prepare(session, xconn->remote_address,
252 &auth->gensec);
253 if (!NT_STATUS_IS_OK(status)) {
254 TALLOC_FREE(session);
255 reply_nterror(req, nt_status_squash(status));
256 return;
257 }
258
259 gensec_want_feature(auth->gensec, GENSEC_FEATURE_SESSION_KEY);
260 gensec_want_feature(auth->gensec, GENSEC_FEATURE_UNIX_TOKEN);
261
262 status = gensec_start_mech_by_oid(auth->gensec,
263 GENSEC_OID_SPNEGO);
264 if (!NT_STATUS_IS_OK(status)) {
265 DEBUG(0, ("Failed to start SPNEGO handler!\n"));
266 TALLOC_FREE(session);;
267 reply_nterror(req, nt_status_squash(status));
268 return;
269 }
270 }
271
272 become_root();
273 status = gensec_update(auth->gensec,
274 talloc_tos(),
275 in_blob, &out_blob);
276 unbecome_root();
277 if (!NT_STATUS_IS_OK(status) &&
278 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
279 TALLOC_FREE(session);
280 reply_nterror(req, nt_status_squash(status));
281 return;
282 }
283
284 if (NT_STATUS_IS_OK(status) && session->global->auth_session_info == NULL) {
285 struct auth_session_info *session_info = NULL;
286
287 status = gensec_session_info(auth->gensec,
288 session,
289 &session_info);
290 if (!NT_STATUS_IS_OK(status)) {
291 DEBUG(1,("Failed to generate session_info "
292 "(user and group token) for session setup: %s\n",
293 nt_errstr(status)));
294 data_blob_free(&out_blob);
295 TALLOC_FREE(session);
296 reply_nterror(req, nt_status_squash(status));
297 return;
298 }
299
300 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
301 action = 1;
302 }
303
304 if (session_info->session_key.length > 0) {
305 struct smbXsrv_session *x = session;
306
307 /*
308 * Note: the SMB1 signing key is not truncated to 16 byte!
309 */
310 x->global->signing_key =
311 data_blob_dup_talloc(x->global,
312 session_info->session_key);
313 if (x->global->signing_key.data == NULL) {
314 data_blob_free(&out_blob);
315 TALLOC_FREE(session);
316 reply_nterror(req, NT_STATUS_NO_MEMORY);
317 return;
318 }
319
320 /*
321 * clear the session key
322 * the first tcon will add setup the application key
323 */
324 data_blob_clear_free(&session_info->session_key);
325 }
326
327 session->compat = talloc_zero(session, struct user_struct);
328 if (session->compat == NULL) {
329 data_blob_free(&out_blob);
330 TALLOC_FREE(session);
331 reply_nterror(req, NT_STATUS_NO_MEMORY);
332 return;
333 }
334 session->compat->session = session;
335 session->compat->homes_snum = -1;
336 session->compat->session_info = session_info;
337 session->compat->session_keystr = NULL;
338 session->compat->vuid = session->global->session_wire_id;
339 DLIST_ADD(sconn->users, session->compat);
340 sconn->num_users++;
341
342 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
343 session->compat->homes_snum =
344 register_homes_share(session_info->unix_info->unix_name);
345 }
346
347 if (srv_is_signing_negotiated(xconn) &&
348 action == 0 &&
349 session->global->signing_key.length > 0)
350 {
351 /*
352 * Try and turn on server signing on the first non-guest
353 * sessionsetup.
354 */
355 srv_set_signing(xconn,
356 session->global->signing_key,
357 data_blob_null);
358 }
359
360 set_current_user_info(session_info->unix_info->sanitized_username,
361 session_info->unix_info->unix_name,
362 session_info->info->domain_name);
363
364 session->status = NT_STATUS_OK;
365 session->global->auth_session_info = talloc_move(session->global,
366 &session_info);
367 session->global->auth_session_info_seqnum += 1;
368 session->global->channels[0].auth_session_info_seqnum =
369 session->global->auth_session_info_seqnum;
370 session->global->auth_time = now;
371 if (client_caps & CAP_DYNAMIC_REAUTH) {
372 session->global->expiration_time =
373 gensec_expire_time(auth->gensec);
374 } else {
375 session->global->expiration_time =
376 GENSEC_EXPIRE_TIME_INFINITY;
377 }
378
379 if (!session_claim(session)) {
380 DEBUG(1, ("smb1: Failed to claim session for vuid=%llu\n",
381 (unsigned long long)session->compat->vuid));
382 data_blob_free(&out_blob);
383 TALLOC_FREE(session);
384 reply_nterror(req, NT_STATUS_LOGON_FAILURE);
385 return;
386 }
387
388 status = smbXsrv_session_update(session);
389 if (!NT_STATUS_IS_OK(status)) {
390 DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
391 (unsigned long long)session->compat->vuid,
392 nt_errstr(status)));
393 data_blob_free(&out_blob);
394 TALLOC_FREE(session);
395 reply_nterror(req, NT_STATUS_LOGON_FAILURE);
396 return;
397 }
398
399 if (!xconn->smb1.sessions.done_sesssetup) {
400 if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
401 reply_force_doserror(req, ERRSRV, ERRerror);
402 return;
403 }
404 xconn->smb1.sessions.max_send = smb_bufsize;
405 xconn->smb1.sessions.done_sesssetup = true;
406 }
407
408 /* current_user_info is changed on new vuid */
409 reload_services(sconn, conn_snum_used, true);
410 } else if (NT_STATUS_IS_OK(status)) {
411 struct auth_session_info *session_info = NULL;
412
413 status = gensec_session_info(auth->gensec,
414 session,
415 &session_info);
416 if (!NT_STATUS_IS_OK(status)) {
417 DEBUG(1,("Failed to generate session_info "
418 "(user and group token) for session setup: %s\n",
419 nt_errstr(status)));
420 data_blob_free(&out_blob);
421 TALLOC_FREE(session);
422 reply_nterror(req, nt_status_squash(status));
423 return;
424 }
425
426 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
427 action = 1;
428 }
429
430 /*
431 * Keep the application key
432 */
433 data_blob_clear_free(&session_info->session_key);
434 session_info->session_key =
435 session->global->auth_session_info->session_key;
436 talloc_steal(session_info, session_info->session_key.data);
437 TALLOC_FREE(session->global->auth_session_info);
438
439 session->compat->session_info = session_info;
440
441 session->compat->vuid = session->global->session_wire_id;
442
443 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
444 session->compat->homes_snum =
445 register_homes_share(session_info->unix_info->unix_name);
446 }
447
448 set_current_user_info(session_info->unix_info->sanitized_username,
449 session_info->unix_info->unix_name,
450 session_info->info->domain_name);
451
452 session->status = NT_STATUS_OK;
453 session->global->auth_session_info = talloc_move(session->global,
454 &session_info);
455 session->global->auth_session_info_seqnum += 1;
456 session->global->channels[0].auth_session_info_seqnum =
457 session->global->auth_session_info_seqnum;
458 session->global->auth_time = now;
459 if (client_caps & CAP_DYNAMIC_REAUTH) {
460 session->global->expiration_time =
461 gensec_expire_time(auth->gensec);
462 } else {
463 session->global->expiration_time =
464 GENSEC_EXPIRE_TIME_INFINITY;
465 }
466
467 status = smbXsrv_session_update(session);
468 if (!NT_STATUS_IS_OK(status)) {
469 DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
470 (unsigned long long)session->compat->vuid,
471 nt_errstr(status)));
472 data_blob_free(&out_blob);
473 TALLOC_FREE(session);
474 reply_nterror(req, NT_STATUS_LOGON_FAILURE);
475 return;
476 }
477
478 conn_clear_vuid_caches(sconn, session->compat->vuid);
479
480 /* current_user_info is changed on new vuid */
481 reload_services(sconn, conn_snum_used, true);
482 }
483
484 vuid = session->global->session_wire_id;
485
486 reply_outbuf(req, 4, 0);
487
488 SSVAL(req->outbuf, smb_uid, vuid);
489 SIVAL(req->outbuf, smb_rcls, NT_STATUS_V(status));
490 SSVAL(req->outbuf, smb_vwv0, 0xFF); /* no chaining possible */
491 SSVAL(req->outbuf, smb_vwv2, action);
492 SSVAL(req->outbuf, smb_vwv3, out_blob.length);
493
494 if (message_push_blob(&req->outbuf, out_blob) == -1) {
495 data_blob_free(&out_blob);
496 TALLOC_FREE(session);
497 reply_nterror(req, NT_STATUS_NO_MEMORY);
498 return;
499 }
500 data_blob_free(&out_blob);
501
502 if (push_signature(&req->outbuf) == -1) {
503 TALLOC_FREE(session);
504 reply_nterror(req, NT_STATUS_NO_MEMORY);
505 return;
506 }
507 }
508
509 /****************************************************************************
510 On new VC == 0, shutdown *all* old connections and users.
511 It seems that only NT4.x does this. At W2K and above (XP etc.).
512 a new session setup with VC==0 is ignored.
513 ****************************************************************************/
514
515 struct shutdown_state {
516 const char *ip;
517 struct messaging_context *msg_ctx;
518 };
519
520 static int shutdown_other_smbds(struct smbXsrv_session_global0 *session,
521 void *private_data)
522 {
523 struct shutdown_state *state = (struct shutdown_state *)private_data;
524 struct server_id self_pid = messaging_server_id(state->msg_ctx);
525 struct server_id pid = session->channels[0].server_id;
526 const char *addr = session->channels[0].remote_address;
527 struct server_id_buf tmp;
528
529 DEBUG(10, ("shutdown_other_smbds: %s, %s\n",
530 server_id_str_buf(pid, &tmp), addr));
531
532 if (!process_exists(pid)) {
533 DEBUG(10, ("process does not exist\n"));
534 return 0;
535 }
536
537 if (serverid_equal(&pid, &self_pid)) {
538 DEBUG(10, ("It's me\n"));
539 return 0;
540 }
541
542 /*
543 * here we use strstr() because 'addr'
544 * (session->channels[0].remote_address)
545 * contains a string like:
546 * 'ipv4:127.0.0.1:48163'
547 */
548 if (strstr(addr, state->ip) == NULL) {
549 DEBUG(10, ("%s does not match %s\n", state->ip, addr));
550 return 0;
551 }
552
553 DEBUG(1, ("shutdown_other_smbds: shutting down pid %u "
554 "(IP %s)\n", (unsigned int)procid_to_pid(&pid),
555 state->ip));
556
557 messaging_send(state->msg_ctx, pid, MSG_SHUTDOWN,
558 &data_blob_null);
559 return 0;
560 }
561
562 static void setup_new_vc_session(struct smbd_server_connection *sconn)
563 {
564 DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x "
565 "compatible we would close all old resources.\n"));
566 #if 0
567 conn_close_all();
568 invalidate_all_vuids();
569 #endif
570 if (lp_reset_on_zero_vc()) {
571 char *addr;
572 struct shutdown_state state;
573
574 addr = tsocket_address_inet_addr_string(
575 sconn->remote_address, talloc_tos());
576 if (addr == NULL) {
577 return;
578 }
579 state.ip = addr;
580 state.msg_ctx = sconn->msg_ctx;
581 smbXsrv_session_global_traverse(shutdown_other_smbds, &state);
582 TALLOC_FREE(addr);
583 }
584 }
585
586 /****************************************************************************
587 Reply to a session setup command.
588 ****************************************************************************/
589
590 void reply_sesssetup_and_X(struct smb_request *req)
591 {
592 uint64_t sess_vuid;
593 uint16_t smb_bufsize;
594 DATA_BLOB lm_resp;
595 DATA_BLOB nt_resp;
596 DATA_BLOB plaintext_password;
597 char *tmp;
598 const char *user;
599 fstring sub_user; /* Sanitised username for substituion */
600 const char *domain;
601 const char *native_os;
602 const char *native_lanman;
603 const char *primary_domain;
604 struct auth_usersupplied_info *user_info = NULL;
605 struct auth_session_info *session_info = NULL;
606 uint16_t smb_flag2 = req->flags2;
607 uint16_t action = 0;
608 NTTIME now = timeval_to_nttime(&req->request_time);
609 struct smbXsrv_session *session = NULL;
610 NTSTATUS nt_status;
611 struct smbXsrv_connection *xconn = req->xconn;
612 struct smbd_server_connection *sconn = req->sconn;
613 bool doencrypt = xconn->smb1.negprot.encrypted_passwords;
614 bool signing_allowed = false;
615 bool signing_mandatory = false;
616
617 START_PROFILE(SMBsesssetupX);
618
619 ZERO_STRUCT(lm_resp);
620 ZERO_STRUCT(nt_resp);
621 ZERO_STRUCT(plaintext_password);
622
623 DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
624
625 if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES) {
626 signing_allowed = true;
627 }
628 if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) {
629 signing_mandatory = true;
630 }
631
632 /*
633 * We can call srv_set_signing_negotiated() each time.
634 * It finds out when it needs to turn into a noop
635 * itself.
636 */
637 srv_set_signing_negotiated(xconn,
638 signing_allowed,
639 signing_mandatory);
640
641 /* a SPNEGO session setup has 12 command words, whereas a normal
642 NT1 session setup has 13. See the cifs spec. */
643 if (req->wct == 12 &&
644 (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
645
646 if (!xconn->smb1.negprot.spnego) {
647 DEBUG(0,("reply_sesssetup_and_X: Rejecting attempt "
648 "at SPNEGO session setup when it was not "
649 "negotiated.\n"));
650 reply_nterror(req, nt_status_squash(
651 NT_STATUS_LOGON_FAILURE));
652 END_PROFILE(SMBsesssetupX);
653 return;
654 }
655
656 if (SVAL(req->vwv+4, 0) == 0) {
657 setup_new_vc_session(req->sconn);
658 }
659
660 reply_sesssetup_and_X_spnego(req);
661 END_PROFILE(SMBsesssetupX);
662 return;
663 }
664
665 smb_bufsize = SVAL(req->vwv+2, 0);
666
667 if (get_Protocol() < PROTOCOL_NT1) {
668 uint16_t passlen1 = SVAL(req->vwv+7, 0);
669
670 /* Never do NT status codes with protocols before NT1 as we
671 * don't get client caps. */
672 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
673
674 if ((passlen1 > MAX_PASS_LEN) || (passlen1 > req->buflen)) {
675 reply_nterror(req, nt_status_squash(
676 NT_STATUS_INVALID_PARAMETER));
677 END_PROFILE(SMBsesssetupX);
678 return;
679 }
680
681 if (doencrypt) {
682 lm_resp = data_blob(req->buf, passlen1);
683 } else {
684 plaintext_password = data_blob(req->buf, passlen1+1);
685 /* Ensure null termination */
686 plaintext_password.data[passlen1] = 0;
687 }
688
689 srvstr_pull_req_talloc(talloc_tos(), req, &tmp,
690 req->buf + passlen1, STR_TERMINATE);
691 user = tmp ? tmp : "";
692
693 domain = "";
694
695 } else {
696 uint16_t passlen1 = SVAL(req->vwv+7, 0);
697 uint16_t passlen2 = SVAL(req->vwv+8, 0);
698 enum remote_arch_types ra_type = get_remote_arch();
699 const uint8_t *p = req->buf;
700 const uint8_t *save_p = req->buf;
701 uint16_t byte_count;
702
703 if (!xconn->smb1.sessions.done_sesssetup) {
704 global_client_caps = IVAL(req->vwv+11, 0);
705
706 if (!(global_client_caps & CAP_STATUS32)) {
707 remove_from_common_flags2(
708 FLAGS2_32_BIT_ERROR_CODES);
709 }
710
711 /* client_caps is used as final determination if
712 * client is NT or Win95. This is needed to return
713 * the correct error codes in some circumstances.
714 */
715
716 if(ra_type == RA_WINNT || ra_type == RA_WIN2K ||
717 ra_type == RA_WIN95) {
718 if(!(global_client_caps & (CAP_NT_SMBS|
719 CAP_STATUS32))) {
720 set_remote_arch( RA_WIN95);
721 }
722 }
723 }
724
725 if (!doencrypt) {
726 /* both Win95 and WinNT stuff up the password
727 * lengths for non-encrypting systems. Uggh.
728
729 if passlen1==24 its a win95 system, and its setting
730 the password length incorrectly. Luckily it still
731 works with the default code because Win95 will null
732 terminate the password anyway
733
734 if passlen1>0 and passlen2>0 then maybe its a NT box
735 and its setting passlen2 to some random value which
736 really stuffs things up. we need to fix that one. */
737
738 if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 &&
739 passlen2 != 1) {
740 passlen2 = 0;
741 }
742 }
743
744 /* check for nasty tricks */
745 if (passlen1 > MAX_PASS_LEN
746 || passlen1 > smbreq_bufrem(req, p)) {
747 reply_nterror(req, nt_status_squash(
748 NT_STATUS_INVALID_PARAMETER));
749 END_PROFILE(SMBsesssetupX);
750 return;
751 }
752
753 if (passlen2 > MAX_PASS_LEN
754 || passlen2 > smbreq_bufrem(req, p+passlen1)) {
755 reply_nterror(req, nt_status_squash(
756 NT_STATUS_INVALID_PARAMETER));
757 END_PROFILE(SMBsesssetupX);
758 return;
759 }
760
761 /* Save the lanman2 password and the NT md4 password. */
762
763 if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
764 doencrypt = False;
765 }
766
767 if (doencrypt) {
768 lm_resp = data_blob(p, passlen1);
769 nt_resp = data_blob(p+passlen1, passlen2);
770 } else {
771 char *pass = NULL;
772 bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
773
774 if (unic && (passlen2 == 0) && passlen1) {
775 /* Only a ascii plaintext password was sent. */
776 (void)srvstr_pull_talloc(talloc_tos(),
777 req->inbuf,
778 req->flags2,
779 &pass,
780 req->buf,
781 passlen1,
782 STR_TERMINATE|STR_ASCII);
783 } else {
784 (void)srvstr_pull_talloc(talloc_tos(),
785 req->inbuf,
786 req->flags2,
787 &pass,
788 req->buf,
789 unic ? passlen2 : passlen1,
790 STR_TERMINATE);
791 }
792 if (!pass) {
793 reply_nterror(req, nt_status_squash(
794 NT_STATUS_INVALID_PARAMETER));
795 END_PROFILE(SMBsesssetupX);
796 return;
797 }
798 plaintext_password = data_blob(pass, strlen(pass)+1);
799 }
800
801 p += passlen1 + passlen2;
802
803 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
804 STR_TERMINATE);
805 user = tmp ? tmp : "";
806
807 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
808 STR_TERMINATE);
809 domain = tmp ? tmp : "";
810
811 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
812 STR_TERMINATE);
813 native_os = tmp ? tmp : "";
814
815 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
816 STR_TERMINATE);
817 native_lanman = tmp ? tmp : "";
818
819 /* not documented or decoded by Ethereal but there is one more
820 * string in the extra bytes which is the same as the
821 * PrimaryDomain when using extended security. Windows NT 4
822 * and 2003 use this string to store the native lanman string.
823 * Windows 9x does not include a string here at all so we have
824 * to check if we have any extra bytes left */
825
826 byte_count = SVAL(req->vwv+13, 0);
827 if ( PTR_DIFF(p, save_p) < byte_count) {
828 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
829 STR_TERMINATE);
830 primary_domain = tmp ? tmp : "";
831 } else {
832 primary_domain = talloc_strdup(talloc_tos(), "null");
833 }
834
835 DEBUG(3,("Domain=[%s] NativeOS=[%s] NativeLanMan=[%s] "
836 "PrimaryDomain=[%s]\n",
837 domain, native_os, native_lanman, primary_domain));
838
839 if ( ra_type == RA_WIN2K ) {
840 if ( strlen(native_lanman) == 0 )
841 ra_lanman_string( primary_domain );
842 else
843 ra_lanman_string( native_lanman );
844 }
845
846 }
847
848 if (SVAL(req->vwv+4, 0) == 0) {
849 setup_new_vc_session(req->sconn);
850 }
851
852 DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
853 domain, user, get_remote_machine_name()));
854
855 if (*user) {
856 if (xconn->smb1.negprot.spnego) {
857
858 /* This has to be here, because this is a perfectly
859 * valid behaviour for guest logons :-( */
860
861 DEBUG(0,("reply_sesssetup_and_X: Rejecting attempt "
862 "at 'normal' session setup after "
863 "negotiating spnego.\n"));
864 reply_nterror(req, nt_status_squash(
865 NT_STATUS_LOGON_FAILURE));
866 END_PROFILE(SMBsesssetupX);
867 return;
868 }
869 fstrcpy(sub_user, user);
870 } else {
871 fstrcpy(sub_user, "");
872 }
873
874 sub_set_smb_name(sub_user);
875
876 reload_services(sconn, conn_snum_used, true);
877
878 if (!*user) {
879
880 nt_status = check_guest_password(sconn->remote_address, req, &session_info);
881
882 } else if (doencrypt) {
883 struct auth4_context *negprot_auth_context = NULL;
884 negprot_auth_context = xconn->smb1.negprot.auth_context;
885 if (!negprot_auth_context) {
886 DEBUG(0, ("reply_sesssetup_and_X: Attempted encrypted "
887 "session setup without negprot denied!\n"));
888 reply_nterror(req, nt_status_squash(
889 NT_STATUS_LOGON_FAILURE));
890 END_PROFILE(SMBsesssetupX);
891 return;
892 }
893 nt_status = make_user_info_for_reply_enc(talloc_tos(),
894 &user_info, user,
895 domain,
896 sconn->remote_address,
897 lm_resp, nt_resp);
898 if (NT_STATUS_IS_OK(nt_status)) {
899 nt_status = auth_check_password_session_info(negprot_auth_context,
900 req, user_info, &session_info);
901 }
902 } else {
903 struct auth4_context *plaintext_auth_context = NULL;
904
905 nt_status = make_auth4_context(
906 talloc_tos(), &plaintext_auth_context);
907
908 if (NT_STATUS_IS_OK(nt_status)) {
909 uint8_t chal[8];
910
911 plaintext_auth_context->get_ntlm_challenge(
912 plaintext_auth_context, chal);
913
914 if (!make_user_info_for_reply(talloc_tos(),
915 &user_info,
916 user, domain,
917 sconn->remote_address,
918 chal,
919 plaintext_password)) {
920 nt_status = NT_STATUS_NO_MEMORY;
921 }
922
923 if (NT_STATUS_IS_OK(nt_status)) {
924 nt_status = auth_check_password_session_info(plaintext_auth_context,
925 req, user_info, &session_info);
926 }
927 TALLOC_FREE(plaintext_auth_context);
928 }
929 }
930
931 TALLOC_FREE(user_info);
932
933 if (!NT_STATUS_IS_OK(nt_status)) {
934 data_blob_free(&nt_resp);
935 data_blob_free(&lm_resp);
936 data_blob_clear_free(&plaintext_password);
937 reply_nterror(req, nt_status_squash(nt_status));
938 END_PROFILE(SMBsesssetupX);
939 return;
940 }
941
942 data_blob_clear_free(&plaintext_password);
943
944 /* it's ok - setup a reply */
945 reply_outbuf(req, 3, 0);
946 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
947 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
948
949 if (get_Protocol() >= PROTOCOL_NT1) {
950 push_signature(&req->outbuf);
951 /* perhaps grab OS version here?? */
952 }
953
954 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
955 action = 1;
956 }
957
958 /* register the name and uid as being validated, so further connections
959 to a uid can get through without a password, on the same VC */
960
961 nt_status = smbXsrv_session_create(xconn,
962 now, &session);
963 if (!NT_STATUS_IS_OK(nt_status)) {
964 data_blob_free(&nt_resp);
965 data_blob_free(&lm_resp);
966 reply_nterror(req, nt_status_squash(nt_status));
967 END_PROFILE(SMBsesssetupX);
968 return;
969 }
970
971 if (session_info->session_key.length > 0) {
972 uint8_t session_key[16];
973
974 /*
975 * Note: the SMB1 signing key is not truncated to 16 byte!
976 */
977 session->global->signing_key =
978 data_blob_dup_talloc(session->global,
979 session_info->session_key);
980 if (session->global->signing_key.data == NULL) {
981 data_blob_free(&nt_resp);
982 data_blob_free(&lm_resp);
983 TALLOC_FREE(session);
984 reply_nterror(req, NT_STATUS_NO_MEMORY);
985 END_PROFILE(SMBsesssetupX);
986 return;
987 }
988
989 /*
990 * The application key is truncated/padded to 16 bytes
991 */
992 ZERO_STRUCT(session_key);
993 memcpy(session_key, session->global->signing_key.data,
994 MIN(session->global->signing_key.length,
995 sizeof(session_key)));
996 session->global->application_key =
997 data_blob_talloc(session->global,
998 session_key,
999 sizeof(session_key));
1000 ZERO_STRUCT(session_key);
1001 if (session->global->application_key.data == NULL) {
1002 data_blob_free(&nt_resp);
1003 data_blob_free(&lm_resp);
1004 TALLOC_FREE(session);
1005 reply_nterror(req, NT_STATUS_NO_MEMORY);
1006 END_PROFILE(SMBsesssetupX);
1007 return;
1008 }
1009
1010 /*
1011 * Place the application key into the session_info
1012 */
1013 data_blob_clear_free(&session_info->session_key);
1014 session_info->session_key = data_blob_dup_talloc(session_info,
1015 session->global->application_key);
1016 if (session_info->session_key.data == NULL) {
1017 data_blob_free(&nt_resp);
1018 data_blob_free(&lm_resp);
1019 TALLOC_FREE(session);
1020 reply_nterror(req, NT_STATUS_NO_MEMORY);
1021 END_PROFILE(SMBsesssetupX);
1022 return;
1023 }
1024 }
1025
1026 session->compat = talloc_zero(session, struct user_struct);
1027 if (session->compat == NULL) {
1028 data_blob_free(&nt_resp);
1029 data_blob_free(&lm_resp);
1030 TALLOC_FREE(session);
1031 reply_nterror(req, NT_STATUS_NO_MEMORY);
1032 END_PROFILE(SMBsesssetupX);
1033 return;
1034 }
1035 session->compat->session = session;
1036 session->compat->homes_snum = -1;
1037 session->compat->session_info = session_info;
1038 session->compat->session_keystr = NULL;
1039 session->compat->vuid = session->global->session_wire_id;
1040 DLIST_ADD(sconn->users, session->compat);
1041 sconn->num_users++;
1042
1043 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
1044 session->compat->homes_snum =
1045 register_homes_share(session_info->unix_info->unix_name);
1046 }
1047
1048 if (srv_is_signing_negotiated(xconn) &&
1049 action == 0 &&
1050 session->global->signing_key.length > 0)
1051 {
1052 /*
1053 * Try and turn on server signing on the first non-guest
1054 * sessionsetup.
1055 */
1056 srv_set_signing(xconn,
1057 session->global->signing_key,
1058 nt_resp.data ? nt_resp : lm_resp);
1059 }
1060
1061 set_current_user_info(session_info->unix_info->sanitized_username,
1062 session_info->unix_info->unix_name,
1063 session_info->info->domain_name);
1064
1065 session->status = NT_STATUS_OK;
1066 session->global->auth_session_info = talloc_move(session->global,
1067 &session_info);
1068 session->global->auth_session_info_seqnum += 1;
1069 session->global->channels[0].auth_session_info_seqnum =
1070 session->global->auth_session_info_seqnum;
1071 session->global->auth_time = now;
1072 session->global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1073
1074 nt_status = smbXsrv_session_update(session);
1075 if (!NT_STATUS_IS_OK(nt_status)) {
1076 DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
1077 (unsigned long long)session->compat->vuid,
1078 nt_errstr(nt_status)));
1079 data_blob_free(&nt_resp);
1080 data_blob_free(&lm_resp);
1081 TALLOC_FREE(session);
1082 reply_nterror(req, nt_status_squash(nt_status));
1083 END_PROFILE(SMBsesssetupX);
1084 return;
1085 }
1086
1087 if (!session_claim(session)) {
1088 DEBUG(1, ("smb1: Failed to claim session for vuid=%llu\n",
1089 (unsigned long long)session->compat->vuid));
1090 data_blob_free(&nt_resp);
1091 data_blob_free(&lm_resp);
1092 TALLOC_FREE(session);
1093 reply_nterror(req, NT_STATUS_LOGON_FAILURE);
1094 END_PROFILE(SMBsesssetupX);
1095 return;
1096 }
1097
1098 /* current_user_info is changed on new vuid */
1099 reload_services(sconn, conn_snum_used, true);
1100
1101 sess_vuid = session->global->session_wire_id;
1102
1103 data_blob_free(&nt_resp);
1104 data_blob_free(&lm_resp);
1105
1106 SSVAL(req->outbuf,smb_vwv2,action);
1107 SSVAL(req->outbuf,smb_uid,sess_vuid);
1108 SSVAL(discard_const_p(char, req->inbuf),smb_uid,sess_vuid);
1109 req->vuid = sess_vuid;
1110
1111 if (!xconn->smb1.sessions.done_sesssetup) {
1112 if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
1113 reply_force_doserror(req, ERRSRV, ERRerror);
1114 END_PROFILE(SMBsesssetupX);
1115 return;
1116 }
1117 xconn->smb1.sessions.max_send = smb_bufsize;
1118 xconn->smb1.sessions.done_sesssetup = true;
1119 }
1120
1121 END_PROFILE(SMBsesssetupX);
1122 }
Samba GIT mirror