source3/smbd/negprot.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    negprot reply code
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "../libcli/auth/spnego.h"
  25 #include "serverid.h"
  26 #include "auth.h"
  27 #include "messages.h"
  28 #include "smbprofile.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "../libcli/smb/smb_signing.h"
  31
  32 extern fstring remote_proto;
  33
  34 static void get_challenge(struct smbd_server_connection *sconn, uint8 buff[8])
  35 {
  36         NTSTATUS nt_status;
  37
  38         /* We might be called more than once, multiple negprots are
  39          * permitted */
  40         if (sconn->smb1.negprot.auth_context) {
  41                 DEBUG(3, ("get challenge: is this a secondary negprot? "
  42                           "sconn->negprot.auth_context is non-NULL!\n"));
  43                         TALLOC_FREE(sconn->smb1.negprot.auth_context);
  44         }
  45
  46         DEBUG(10, ("get challenge: creating negprot_global_auth_context\n"));
  47         nt_status = make_auth4_context(
  48                 sconn, &sconn->smb1.negprot.auth_context);
  49         if (!NT_STATUS_IS_OK(nt_status)) {
  50                 DEBUG(0, ("make_auth_context_subsystem returned %s",
  51                           nt_errstr(nt_status)));
  52                 smb_panic("cannot make_negprot_global_auth_context!");
  53         }
  54         DEBUG(10, ("get challenge: getting challenge\n"));
  55         sconn->smb1.negprot.auth_context->get_ntlm_challenge(
  56                 sconn->smb1.negprot.auth_context, buff);
  57 }
  58
  59 /****************************************************************************
  60  Reply for the lanman 1.0 protocol.
  61 ****************************************************************************/
  62
  63 static void reply_lanman1(struct smb_request *req, uint16 choice)
  64 {
  65         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
  66         int secword=0;
  67         time_t t = time(NULL);
  68         struct smbd_server_connection *sconn = req->sconn;
  69
  70         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
  71
  72         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
  73         if (sconn->smb1.negprot.encrypted_passwords) {
  74                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
  75         }
  76
  77         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
  78
  79         SSVAL(req->outbuf,smb_vwv0,choice);
  80         SSVAL(req->outbuf,smb_vwv1,secword);
  81         /* Create a token value and add it to the outgoing packet. */
  82         if (sconn->smb1.negprot.encrypted_passwords) {
  83                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
  84                 SSVAL(req->outbuf,smb_vwv11, 8);
  85         }
  86
  87         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN1);
  88
  89         /* Reply, SMBlockread, SMBwritelock supported. */
  90         SCVAL(req->outbuf,smb_flg, FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
  91         SSVAL(req->outbuf,smb_vwv2, sconn->smb1.negprot.max_recv);
  92         SSVAL(req->outbuf,smb_vwv3, lp_maxmux()); /* maxmux */
  93         SSVAL(req->outbuf,smb_vwv4, 1);
  94         SSVAL(req->outbuf,smb_vwv5, raw); /* tell redirector we support
  95                 readbraw writebraw (possibly) */
  96         SIVAL(req->outbuf,smb_vwv6, getpid());
  97         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
  98
  99         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 100
 101         return;
 102 }
 103
 104 /****************************************************************************
 105  Reply for the lanman 2.0 protocol.
 106 ****************************************************************************/
 107
 108 static void reply_lanman2(struct smb_request *req, uint16 choice)
 109 {
 110         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
 111         int secword=0;
 112         time_t t = time(NULL);
 113         struct smbd_server_connection *sconn = req->sconn;
 114
 115         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 116
 117         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 118         if (sconn->smb1.negprot.encrypted_passwords) {
 119                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 120         }
 121
 122         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
 123
 124         SSVAL(req->outbuf,smb_vwv0, choice);
 125         SSVAL(req->outbuf,smb_vwv1, secword);
 126         SIVAL(req->outbuf,smb_vwv6, getpid());
 127
 128         /* Create a token value and add it to the outgoing packet. */
 129         if (sconn->smb1.negprot.encrypted_passwords) {
 130                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
 131                 SSVAL(req->outbuf,smb_vwv11, 8);
 132         }
 133
 134         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN2);
 135
 136         /* Reply, SMBlockread, SMBwritelock supported. */
 137         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
 138         SSVAL(req->outbuf,smb_vwv2,sconn->smb1.negprot.max_recv);
 139         SSVAL(req->outbuf,smb_vwv3,lp_maxmux());
 140         SSVAL(req->outbuf,smb_vwv4,1);
 141         SSVAL(req->outbuf,smb_vwv5,raw); /* readbraw and/or writebraw */
 142         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
 143         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 144 }
 145
 146 /****************************************************************************
 147  Generate the spnego negprot reply blob. Return the number of bytes used.
 148 ****************************************************************************/
 149
 150 DATA_BLOB negprot_spnego(TALLOC_CTX *ctx, struct smbd_server_connection *sconn)
 151 {
 152         DATA_BLOB blob = data_blob_null;
 153         DATA_BLOB blob_out = data_blob_null;
 154         nstring dos_name;
 155         fstring unix_name;
 156         NTSTATUS status;
 157 #ifdef DEVELOPER
 158         size_t slen;
 159 #endif
 160         struct gensec_security *gensec_security;
 161
 162         /* See if we can get an SPNEGO blob */
 163         status = auth_generic_prepare(talloc_tos(),
 164                                       sconn->remote_address,
 165                                       &gensec_security);
 166         if (NT_STATUS_IS_OK(status)) {
 167                 status = gensec_start_mech_by_oid(gensec_security, GENSEC_OID_SPNEGO);
 168                 if (NT_STATUS_IS_OK(status)) {
 169                         status = gensec_update(gensec_security, ctx,
 170                                                NULL, data_blob_null, &blob);
 171                         /* If we get the list of OIDs, the 'OK' answer
 172                          * is NT_STATUS_MORE_PROCESSING_REQUIRED */
 173                         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 174                                 DEBUG(0, ("Failed to start SPNEGO handler for negprot OID list!\n"));
 175                                 blob = data_blob_null;
 176                         }
 177                 }
 178                 TALLOC_FREE(gensec_security);
 179         }
 180
 181         sconn->smb1.negprot.spnego = true;
 182
 183         /* strangely enough, NT does not sent the single OID NTLMSSP when
 184            not a ADS member, it sends no OIDs at all
 185
 186            OLD COMMENT : "we can't do this until we teach our sesssion setup parser to know
 187                    about raw NTLMSSP (clients send no ASN.1 wrapping if we do this)"
 188
 189            Our sessionsetup code now handles raw NTLMSSP connects, so we can go
 190            back to doing what W2K3 does here. This is needed to make PocketPC 2003
 191            CIFS connections work with SPNEGO. See bugzilla bugs #1828 and #3133
 192            for details. JRA.
 193
 194         */
 195
 196         if (blob.length == 0 || blob.data == NULL) {
 197                 return data_blob_null;
 198         }
 199
 200         blob_out = data_blob_talloc(ctx, NULL, 16 + blob.length);
 201         if (blob_out.data == NULL) {
 202                 data_blob_free(&blob);
 203                 return data_blob_null;
 204         }
 205
 206         memset(blob_out.data, '\0', 16);
 207
 208         checked_strlcpy(unix_name, lp_netbios_name(), sizeof(unix_name));
 209         (void)strlower_m(unix_name);
 210         push_ascii_nstring(dos_name, unix_name);
 211         strlcpy((char *)blob_out.data, dos_name, 17);
 212
 213 #ifdef DEVELOPER
 214         /* Fix valgrind 'uninitialized bytes' issue. */
 215         slen = strlen(dos_name);
 216         if (slen < 16) {
 217                 memset(blob_out.data+slen, '\0', 16 - slen);
 218         }
 219 #endif
 220
 221         memcpy(&blob_out.data[16], blob.data, blob.length);
 222
 223         data_blob_free(&blob);
 224
 225         return blob_out;
 226 }
 227
 228 /****************************************************************************
 229  Reply for the nt protocol.
 230 ****************************************************************************/
 231
 232 static void reply_nt1(struct smb_request *req, uint16 choice)
 233 {
 234         /* dual names + lock_and_read + nt SMBs + remote API calls */
 235         int capabilities = CAP_NT_FIND|CAP_LOCK_AND_READ|
 236                 CAP_LEVEL_II_OPLOCKS;
 237
 238         int secword=0;
 239         bool negotiate_spnego = False;
 240         struct timespec ts;
 241         ssize_t ret;
 242         struct smbd_server_connection *sconn = req->sconn;
 243         bool signing_enabled = false;
 244         bool signing_required = false;
 245
 246         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 247
 248         /* Check the flags field to see if this is Vista.
 249            WinXP sets it and Vista does not. But we have to
 250            distinguish from NT which doesn't set it either. */
 251
 252         if ( (req->flags2 & FLAGS2_EXTENDED_SECURITY) &&
 253                 ((req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) == 0) )
 254         {
 255                 if (get_remote_arch() != RA_SAMBA) {
 256                         set_remote_arch( RA_VISTA );
 257                 }
 258         }
 259
 260         reply_outbuf(req,17,0);
 261
 262         /* do spnego in user level security if the client
 263            supports it and we can do encrypted passwords */
 264
 265         if (sconn->smb1.negprot.encrypted_passwords &&
 266             lp_use_spnego() &&
 267             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
 268                 negotiate_spnego = True;
 269                 capabilities |= CAP_EXTENDED_SECURITY;
 270                 add_to_common_flags2(FLAGS2_EXTENDED_SECURITY);
 271                 /* Ensure FLAGS2_EXTENDED_SECURITY gets set in this reply
 272                    (already partially constructed. */
 273                 SSVAL(req->outbuf, smb_flg2,
 274                       req->flags2 | FLAGS2_EXTENDED_SECURITY);
 275         }
 276
 277         capabilities |= CAP_NT_SMBS|CAP_RPC_REMOTE_APIS;
 278
 279         if (lp_unicode()) {
 280                 capabilities |= CAP_UNICODE;
 281         }
 282
 283         if (lp_unix_extensions()) {
 284                 capabilities |= CAP_UNIX;
 285         }
 286
 287         if (lp_large_readwrite())
 288                 capabilities |= CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_W2K_SMBS;
 289
 290         capabilities |= CAP_LARGE_FILES;
 291
 292         if (lp_readraw() && lp_writeraw())
 293                 capabilities |= CAP_RAW_MODE;
 294
 295         if (lp_nt_status_support())
 296                 capabilities |= CAP_STATUS32;
 297
 298         if (lp_host_msdfs())
 299                 capabilities |= CAP_DFS;
 300
 301         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 302         if (sconn->smb1.negprot.encrypted_passwords) {
 303                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 304         }
 305
 306         signing_enabled = smb_signing_is_allowed(req->sconn->smb1.signing_state);
 307         signing_required = smb_signing_is_mandatory(req->sconn->smb1.signing_state);
 308
 309         if (signing_enabled) {
 310                 secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
 311                 /* No raw mode with smb signing. */
 312                 capabilities &= ~CAP_RAW_MODE;
 313                 if (signing_required) {
 314                         secword |=NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
 315                 }
 316         }
 317
 318         SSVAL(req->outbuf,smb_vwv0,choice);
 319         SCVAL(req->outbuf,smb_vwv1,secword);
 320
 321         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_NT1);
 322
 323         SSVAL(req->outbuf,smb_vwv1+1, lp_maxmux()); /* maxmpx */
 324         SSVAL(req->outbuf,smb_vwv2+1, 1); /* num vcs */
 325         SIVAL(req->outbuf,smb_vwv3+1,
 326               sconn->smb1.negprot.max_recv); /* max buffer. LOTS! */
 327         SIVAL(req->outbuf,smb_vwv5+1, 0x10000); /* raw size. full 64k */
 328         SIVAL(req->outbuf,smb_vwv7+1, getpid()); /* session key */
 329         SIVAL(req->outbuf,smb_vwv9+1, capabilities); /* capabilities */
 330         clock_gettime(CLOCK_REALTIME,&ts);
 331         put_long_date_timespec(TIMESTAMP_SET_NT_OR_BETTER,(char *)req->outbuf+smb_vwv11+1,ts);
 332         SSVALS(req->outbuf,smb_vwv15+1,set_server_zone_offset(ts.tv_sec)/60);
 333
 334         if (!negotiate_spnego) {
 335                 /* Create a token value and add it to the outgoing packet. */
 336                 if (sconn->smb1.negprot.encrypted_passwords) {
 337                         uint8 chal[8];
 338                         /* note that we do not send a challenge at all if
 339                            we are using plaintext */
 340                         get_challenge(sconn, chal);
 341                         ret = message_push_blob(
 342                                 &req->outbuf, data_blob_const(chal, sizeof(chal)));
 343                         if (ret == -1) {
 344                                 DEBUG(0, ("Could not push challenge\n"));
 345                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 346                                 return;
 347                         }
 348                         SCVAL(req->outbuf, smb_vwv16+1, ret);
 349                 }
 350                 ret = message_push_string(&req->outbuf, lp_workgroup(),
 351                                           STR_UNICODE|STR_TERMINATE
 352                                           |STR_NOALIGN);
 353                 if (ret == -1) {
 354                         DEBUG(0, ("Could not push workgroup string\n"));
 355                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 356                         return;
 357                 }
 358                 ret = message_push_string(&req->outbuf, lp_netbios_name(),
 359                                           STR_UNICODE|STR_TERMINATE
 360                                           |STR_NOALIGN);
 361                 if (ret == -1) {
 362                         DEBUG(0, ("Could not push netbios name string\n"));
 363                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 364                         return;
 365                 }
 366                 DEBUG(3,("not using SPNEGO\n"));
 367         } else {
 368                 DATA_BLOB spnego_blob = negprot_spnego(req, req->sconn);
 369
 370                 if (spnego_blob.data == NULL) {
 371                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 372                         return;
 373                 }
 374
 375                 ret = message_push_blob(&req->outbuf, spnego_blob);
 376                 if (ret == -1) {
 377                         DEBUG(0, ("Could not push spnego blob\n"));
 378                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 379                         return;
 380                 }
 381                 data_blob_free(&spnego_blob);
 382
 383                 SCVAL(req->outbuf,smb_vwv16+1, 0);
 384                 DEBUG(3,("using SPNEGO\n"));
 385         }
 386
 387         return;
 388 }
 389
 390 /* these are the protocol lists used for auto architecture detection:
 391
 392 WinNT 3.51:
 393 protocol [PC NETWORK PROGRAM 1.0]
 394 protocol [XENIX CORE]
 395 protocol [MICROSOFT NETWORKS 1.03]
 396 protocol [LANMAN1.0]
 397 protocol [Windows for Workgroups 3.1a]
 398 protocol [LM1.2X002]
 399 protocol [LANMAN2.1]
 400 protocol [NT LM 0.12]
 401
 402 Win95:
 403 protocol [PC NETWORK PROGRAM 1.0]
 404 protocol [XENIX CORE]
 405 protocol [MICROSOFT NETWORKS 1.03]
 406 protocol [LANMAN1.0]
 407 protocol [Windows for Workgroups 3.1a]
 408 protocol [LM1.2X002]
 409 protocol [LANMAN2.1]
 410 protocol [NT LM 0.12]
 411
 412 Win2K:
 413 protocol [PC NETWORK PROGRAM 1.0]
 414 protocol [LANMAN1.0]
 415 protocol [Windows for Workgroups 3.1a]
 416 protocol [LM1.2X002]
 417 protocol [LANMAN2.1]
 418 protocol [NT LM 0.12]
 419
 420 Vista:
 421 protocol [PC NETWORK PROGRAM 1.0]
 422 protocol [LANMAN1.0]
 423 protocol [Windows for Workgroups 3.1a]
 424 protocol [LM1.2X002]
 425 protocol [LANMAN2.1]
 426 protocol [NT LM 0.12]
 427 protocol [SMB 2.001]
 428
 429 OS/2:
 430 protocol [PC NETWORK PROGRAM 1.0]
 431 protocol [XENIX CORE]
 432 protocol [LANMAN1.0]
 433 protocol [LM1.2X002]
 434 protocol [LANMAN2.1]
 435 */
 436
 437 /*
 438   * Modified to recognize the architecture of the remote machine better.
 439   *
 440   * This appears to be the matrix of which protocol is used by which
 441   * MS product.
 442        Protocol                       WfWg    Win95   WinNT  Win2K  OS/2 Vista
 443        PC NETWORK PROGRAM 1.0          1       1       1      1      1     1
 444        XENIX CORE                                      2             2
 445        MICROSOFT NETWORKS 3.0          2       2
 446        DOS LM1.2X002                   3       3
 447        MICROSOFT NETWORKS 1.03                         3
 448        DOS LANMAN2.1                   4       4
 449        LANMAN1.0                                       4      2      3     2
 450        Windows for Workgroups 3.1a     5       5       5      3            3
 451        LM1.2X002                                       6      4      4     4
 452        LANMAN2.1                                       7      5      5     5
 453        NT LM 0.12                              6       8      6            6
 454        SMB 2.001                                                           7
 455   *
 456   *  tim@fsg.com 09/29/95
 457   *  Win2K added by matty 17/7/99
 458   */
 459
 460 #define ARCH_WFWG     0x3      /* This is a fudge because WfWg is like Win95 */
 461 #define ARCH_WIN95    0x2
 462 #define ARCH_WINNT    0x4
 463 #define ARCH_WIN2K    0xC      /* Win2K is like NT */
 464 #define ARCH_OS2      0x14     /* Again OS/2 is like NT */
 465 #define ARCH_SAMBA    0x20
 466 #define ARCH_CIFSFS   0x40
 467 #define ARCH_VISTA    0x8C     /* Vista is like XP/2K */
 468
 469 #define ARCH_ALL      0x7F
 470
 471 /* List of supported protocols, most desired first */
 472 static const struct {
 473         const char *proto_name;
 474         const char *short_name;
 475         void (*proto_reply_fn)(struct smb_request *req, uint16 choice);
 476         int protocol_level;
 477 } supported_protocols[] = {
 478         {"SMB 2.???",               "SMB2_FF",  reply_smb20ff,  PROTOCOL_SMB2_10},
 479         {"SMB 2.002",               "SMB2_02",  reply_smb2002,  PROTOCOL_SMB2_02},
 480         {"NT LANMAN 1.0",           "NT1",      reply_nt1,      PROTOCOL_NT1},
 481         {"NT LM 0.12",              "NT1",      reply_nt1,      PROTOCOL_NT1},
 482         {"POSIX 2",                 "NT1",      reply_nt1,      PROTOCOL_NT1},
 483         {"LANMAN2.1",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 484         {"LM1.2X002",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 485         {"Samba",                   "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 486         {"DOS LM1.2X002",           "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 487         {"LANMAN1.0",               "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 488         {"MICROSOFT NETWORKS 3.0",  "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 489         {NULL,NULL,NULL,0},
 490 };
 491
 492 /****************************************************************************
 493  Reply to a negprot.
 494  conn POINTER CAN BE NULL HERE !
 495 ****************************************************************************/
 496
 497 void reply_negprot(struct smb_request *req)
 498 {
 499         int choice= -1;
 500         int protocol;
 501         const char *p;
 502         int arch = ARCH_ALL;
 503         int num_cliprotos;
 504         char **cliprotos;
 505         int i;
 506         size_t converted_size;
 507         struct smbd_server_connection *sconn = req->sconn;
 508
 509         START_PROFILE(SMBnegprot);
 510
 511         if (sconn->smb1.negprot.done) {
 512                 END_PROFILE(SMBnegprot);
 513                 exit_server_cleanly("multiple negprot's are not permitted");
 514         }
 515         sconn->smb1.negprot.done = true;
 516
 517         if (req->buflen == 0) {
 518                 DEBUG(0, ("negprot got no protocols\n"));
 519                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 520                 END_PROFILE(SMBnegprot);
 521                 return;
 522         }
 523
 524         if (req->buf[req->buflen-1] != '\0') {
 525                 DEBUG(0, ("negprot protocols not 0-terminated\n"));
 526                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 527                 END_PROFILE(SMBnegprot);
 528                 return;
 529         }
 530
 531         p = (const char *)req->buf + 1;
 532
 533         num_cliprotos = 0;
 534         cliprotos = NULL;
 535
 536         while (smbreq_bufrem(req, p) > 0) {
 537
 538                 char **tmp;
 539
 540                 tmp = talloc_realloc(talloc_tos(), cliprotos, char *,
 541                                            num_cliprotos+1);
 542                 if (tmp == NULL) {
 543                         DEBUG(0, ("talloc failed\n"));
 544                         TALLOC_FREE(cliprotos);
 545                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 546                         END_PROFILE(SMBnegprot);
 547                         return;
 548                 }
 549
 550                 cliprotos = tmp;
 551
 552                 if (!pull_ascii_talloc(cliprotos, &cliprotos[num_cliprotos], p,
 553                                        &converted_size)) {
 554                         DEBUG(0, ("pull_ascii_talloc failed\n"));
 555                         TALLOC_FREE(cliprotos);
 556                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 557                         END_PROFILE(SMBnegprot);
 558                         return;
 559                 }
 560
 561                 DEBUG(3, ("Requested protocol [%s]\n",
 562                           cliprotos[num_cliprotos]));
 563
 564                 num_cliprotos += 1;
 565                 p += strlen(p) + 2;
 566         }
 567
 568         for (i=0; i<num_cliprotos; i++) {
 569                 if (strcsequal(cliprotos[i], "Windows for Workgroups 3.1a"))
 570                         arch &= ( ARCH_WFWG | ARCH_WIN95 | ARCH_WINNT
 571                                   | ARCH_WIN2K );
 572                 else if (strcsequal(cliprotos[i], "DOS LM1.2X002"))
 573                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 574                 else if (strcsequal(cliprotos[i], "DOS LANMAN2.1"))
 575                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 576                 else if (strcsequal(cliprotos[i], "NT LM 0.12"))
 577                         arch &= ( ARCH_WIN95 | ARCH_WINNT | ARCH_WIN2K
 578                                   | ARCH_CIFSFS);
 579                 else if (strcsequal(cliprotos[i], "SMB 2.001"))
 580                         arch = ARCH_VISTA;
 581                 else if (strcsequal(cliprotos[i], "LANMAN2.1"))
 582                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 583                 else if (strcsequal(cliprotos[i], "LM1.2X002"))
 584                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 585                 else if (strcsequal(cliprotos[i], "MICROSOFT NETWORKS 1.03"))
 586                         arch &= ARCH_WINNT;
 587                 else if (strcsequal(cliprotos[i], "XENIX CORE"))
 588                         arch &= ( ARCH_WINNT | ARCH_OS2 );
 589                 else if (strcsequal(cliprotos[i], "Samba")) {
 590                         arch = ARCH_SAMBA;
 591                         break;
 592                 } else if (strcsequal(cliprotos[i], "POSIX 2")) {
 593                         arch = ARCH_CIFSFS;
 594                         break;
 595                 }
 596         }
 597
 598         /* CIFSFS can send one arch only, NT LM 0.12. */
 599         if (i == 1 && (arch & ARCH_CIFSFS)) {
 600                 arch = ARCH_CIFSFS;
 601         }
 602
 603         switch ( arch ) {
 604                 case ARCH_CIFSFS:
 605                         set_remote_arch(RA_CIFSFS);
 606                         break;
 607                 case ARCH_SAMBA:
 608                         set_remote_arch(RA_SAMBA);
 609                         break;
 610                 case ARCH_WFWG:
 611                         set_remote_arch(RA_WFWG);
 612                         break;
 613                 case ARCH_WIN95:
 614                         set_remote_arch(RA_WIN95);
 615                         break;
 616                 case ARCH_WINNT:
 617                         if(req->flags2 == FLAGS2_WIN2K_SIGNATURE)
 618                                 set_remote_arch(RA_WIN2K);
 619                         else
 620                                 set_remote_arch(RA_WINNT);
 621                         break;
 622                 case ARCH_WIN2K:
 623                         /* Vista may have been set in the negprot so don't
 624                            override it here */
 625                         if ( get_remote_arch() != RA_VISTA )
 626                                 set_remote_arch(RA_WIN2K);
 627                         break;
 628                 case ARCH_VISTA:
 629                         set_remote_arch(RA_VISTA);
 630                         break;
 631                 case ARCH_OS2:
 632                         set_remote_arch(RA_OS2);
 633                         break;
 634                 default:
 635                         set_remote_arch(RA_UNKNOWN);
 636                 break;
 637         }
 638
 639         /* possibly reload - change of architecture */
 640         reload_services(sconn, conn_snum_used, true);
 641
 642         /* moved from the netbios session setup code since we don't have that
 643            when the client connects to port 445.  Of course there is a small
 644            window where we are listening to messages   -- jerry */
 645
 646         serverid_register(messaging_server_id(sconn->msg_ctx),
 647                           FLAG_MSG_GENERAL|FLAG_MSG_SMBD
 648                           |FLAG_MSG_PRINT_GENERAL);
 649
 650         /* Check for protocols, most desirable first */
 651         for (protocol = 0; supported_protocols[protocol].proto_name; protocol++) {
 652                 i = 0;
 653                 if ((supported_protocols[protocol].protocol_level <= lp_srv_maxprotocol()) &&
 654                                 (supported_protocols[protocol].protocol_level >= lp_srv_minprotocol()))
 655                         while (i < num_cliprotos) {
 656                                 if (strequal(cliprotos[i],supported_protocols[protocol].proto_name))
 657                                         choice = i;
 658                                 i++;
 659                         }
 660                 if(choice != -1)
 661                         break;
 662         }
 663
 664         if(choice != -1) {
 665                 fstrcpy(remote_proto,supported_protocols[protocol].short_name);
 666                 reload_services(sconn, conn_snum_used, true);
 667                 supported_protocols[protocol].proto_reply_fn(req, choice);
 668                 DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
 669         } else {
 670                 DEBUG(0,("No protocol supported !\n"));
 671                 reply_outbuf(req, 1, 0);
 672                 SSVAL(req->outbuf, smb_vwv0, choice);
 673         }
 674
 675         DEBUG( 5, ( "negprot index=%d\n", choice ) );
 676
 677         if ((lp_server_signing() == SMB_SIGNING_REQUIRED)
 678             && (get_Protocol() < PROTOCOL_NT1)) {
 679                 exit_server_cleanly("SMB signing is required and "
 680                         "client negotiated a downlevel protocol");
 681         }
 682
 683         TALLOC_FREE(cliprotos);
 684
 685         if (lp_async_smb_echo_handler() && (get_Protocol() < PROTOCOL_SMB2_02) &&
 686             !fork_echo_handler(sconn)) {
 687                 exit_server("Failed to fork echo handler");
 688         }
 689
 690         END_PROFILE(SMBnegprot);
 691         return;
 692 }