?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-rpc_server: Created a per connection spoolss pipe.
[Samba/ekacnet.git] / source3 / smbd / sesssetup.c
blobdf39aed0ed60af7ea3699e03dfbb2cd278eb530e
1 /*
2 Unix SMB/CIFS implementation.
3 handle SMBsessionsetup
4 Copyright (C) Andrew Tridgell 1998-2001
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
7 Copyright (C) Luke Howard 2003
8 Copyright (C) Volker Lendecke 2007
9 Copyright (C) Jeremy Allison 2007
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "smbd/globals.h"
27 #include "../libcli/auth/spnego.h"
28 #include "ntlmssp.h"
29 #include "librpc/gen_ndr/messaging.h"
30
31 /* For split krb5 SPNEGO blobs. */
32 struct pending_auth_data {
33 struct pending_auth_data *prev, *next;
34 uint16 vuid; /* Tag for this entry. */
35 uint16 smbpid; /* Alternate tag for this entry. */
36 size_t needed_len;
37 DATA_BLOB partial_data;
38 };
39
40 /*
41 on a logon error possibly map the error to success if "map to guest"
42 is set approriately
43 */
44 static NTSTATUS do_map_to_guest(NTSTATUS status,
45 struct auth_serversupplied_info **server_info,
46 const char *user, const char *domain)
47 {
48 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
49 if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER) ||
50 (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD)) {
51 DEBUG(3,("No such user %s [%s] - using guest account\n",
52 user, domain));
53 status = make_server_info_guest(NULL, server_info);
54 }
55 }
56
57 if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
58 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD) {
59 DEBUG(3,("Registered username %s for guest access\n",
60 user));
61 status = make_server_info_guest(NULL, server_info);
62 }
63 }
64
65 return status;
66 }
67
68 /****************************************************************************
69 Add the standard 'Samba' signature to the end of the session setup.
70 ****************************************************************************/
71
72 static int push_signature(uint8 **outbuf)
73 {
74 char *lanman;
75 int result, tmp;
76
77 result = 0;
78
79 tmp = message_push_string(outbuf, "Unix", STR_TERMINATE);
80
81 if (tmp == -1) return -1;
82 result += tmp;
83
84 if (asprintf(&lanman, "Samba %s", samba_version_string()) != -1) {
85 tmp = message_push_string(outbuf, lanman, STR_TERMINATE);
86 SAFE_FREE(lanman);
87 }
88 else {
89 tmp = message_push_string(outbuf, "Samba", STR_TERMINATE);
90 }
91
92 if (tmp == -1) return -1;
93 result += tmp;
94
95 tmp = message_push_string(outbuf, lp_workgroup(), STR_TERMINATE);
96
97 if (tmp == -1) return -1;
98 result += tmp;
99
100 return result;
101 }
102
103 /****************************************************************************
104 Send a security blob via a session setup reply.
105 ****************************************************************************/
106
107 static void reply_sesssetup_blob(struct smb_request *req,
108 DATA_BLOB blob,
109 NTSTATUS nt_status)
110 {
111 if (!NT_STATUS_IS_OK(nt_status) &&
112 !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
113 reply_nterror(req, nt_status_squash(nt_status));
114 return;
115 }
116
117 nt_status = nt_status_squash(nt_status);
118 SIVAL(req->outbuf, smb_rcls, NT_STATUS_V(nt_status));
119 SSVAL(req->outbuf, smb_vwv0, 0xFF); /* no chaining possible */
120 SSVAL(req->outbuf, smb_vwv3, blob.length);
121
122 if ((message_push_blob(&req->outbuf, blob) == -1)
123 || (push_signature(&req->outbuf) == -1)) {
124 reply_nterror(req, NT_STATUS_NO_MEMORY);
125 }
126 }
127
128 /****************************************************************************
129 Do a 'guest' logon, getting back the
130 ****************************************************************************/
131
132 static NTSTATUS check_guest_password(struct auth_serversupplied_info **server_info)
133 {
134 struct auth_context *auth_context;
135 struct auth_usersupplied_info *user_info = NULL;
136
137 NTSTATUS nt_status;
138 unsigned char chal[8];
139
140 ZERO_STRUCT(chal);
141
142 DEBUG(3,("Got anonymous request\n"));
143
144 if (!NT_STATUS_IS_OK(nt_status = make_auth_context_fixed(&auth_context,
145 chal))) {
146 return nt_status;
147 }
148
149 if (!make_user_info_guest(&user_info)) {
150 (auth_context->free)(&auth_context);
151 return NT_STATUS_NO_MEMORY;
152 }
153
154 nt_status = auth_context->check_ntlm_password(auth_context,
155 user_info,
156 server_info);
157 (auth_context->free)(&auth_context);
158 free_user_info(&user_info);
159 return nt_status;
160 }
161
162
163 #ifdef HAVE_KRB5
164
165 #if 0
166 /* Experiment that failed. See "only happens with a KDC" comment below. */
167 /****************************************************************************
168 Cerate a clock skew error blob for a Windows client.
169 ****************************************************************************/
170
171 static bool make_krb5_skew_error(DATA_BLOB *pblob_out)
172 {
173 krb5_context context = NULL;
174 krb5_error_code kerr = 0;
175 krb5_data reply;
176 krb5_principal host_princ = NULL;
177 char *host_princ_s = NULL;
178 bool ret = False;
179
180 *pblob_out = data_blob_null;
181
182 initialize_krb5_error_table();
183 kerr = krb5_init_context(&context);
184 if (kerr) {
185 return False;
186 }
187 /* Create server principal. */
188 asprintf(&host_princ_s, "%s$@%s", global_myname(), lp_realm());
189 if (!host_princ_s) {
190 goto out;
191 }
192 strlower_m(host_princ_s);
193
194 kerr = smb_krb5_parse_name(context, host_princ_s, &host_princ);
195 if (kerr) {
196 DEBUG(10,("make_krb5_skew_error: smb_krb5_parse_name failed "
197 "for name %s: Error %s\n",
198 host_princ_s, error_message(kerr) ));
199 goto out;
200 }
201
202 kerr = smb_krb5_mk_error(context, KRB5KRB_AP_ERR_SKEW,
203 host_princ, &reply);
204 if (kerr) {
205 DEBUG(10,("make_krb5_skew_error: smb_krb5_mk_error "
206 "failed: Error %s\n",
207 error_message(kerr) ));
208 goto out;
209 }
210
211 *pblob_out = data_blob(reply.data, reply.length);
212 kerberos_free_data_contents(context,&reply);
213 ret = True;
214
215 out:
216
217 if (host_princ_s) {
218 SAFE_FREE(host_princ_s);
219 }
220 if (host_princ) {
221 krb5_free_principal(context, host_princ);
222 }
223 krb5_free_context(context);
224 return ret;
225 }
226 #endif
227
228 /****************************************************************************
229 Reply to a session setup spnego negotiate packet for kerberos.
230 ****************************************************************************/
231
232 static void reply_spnego_kerberos(struct smb_request *req,
233 DATA_BLOB *secblob,
234 const char *mechOID,
235 uint16 vuid,
236 bool *p_invalidate_vuid)
237 {
238 TALLOC_CTX *mem_ctx;
239 DATA_BLOB ticket;
240 char *client, *p, *domain;
241 fstring netbios_domain_name;
242 struct passwd *pw;
243 fstring user;
244 int sess_vuid = req->vuid;
245 NTSTATUS ret = NT_STATUS_OK;
246 DATA_BLOB ap_rep, ap_rep_wrapped, response;
247 struct auth_serversupplied_info *server_info = NULL;
248 DATA_BLOB session_key = data_blob_null;
249 uint8 tok_id[2];
250 DATA_BLOB nullblob = data_blob_null;
251 fstring real_username;
252 bool map_domainuser_to_guest = False;
253 bool username_was_mapped;
254 struct PAC_LOGON_INFO *logon_info = NULL;
255 struct smbd_server_connection *sconn = smbd_server_conn;
256
257 ZERO_STRUCT(ticket);
258 ZERO_STRUCT(ap_rep);
259 ZERO_STRUCT(ap_rep_wrapped);
260 ZERO_STRUCT(response);
261
262 /* Normally we will always invalidate the intermediate vuid. */
263 *p_invalidate_vuid = True;
264
265 mem_ctx = talloc_init("reply_spnego_kerberos");
266 if (mem_ctx == NULL) {
267 reply_nterror(req, nt_status_squash(NT_STATUS_NO_MEMORY));
268 return;
269 }
270
271 if (!spnego_parse_krb5_wrap(*secblob, &ticket, tok_id)) {
272 talloc_destroy(mem_ctx);
273 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
274 return;
275 }
276
277 ret = ads_verify_ticket(mem_ctx, lp_realm(), 0, &ticket,
278 &client, &logon_info, &ap_rep,
279 &session_key, True);
280
281 data_blob_free(&ticket);
282
283 if (!NT_STATUS_IS_OK(ret)) {
284 #if 0
285 /* Experiment that failed.
286 * See "only happens with a KDC" comment below. */
287
288 if (NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
289
290 /*
291 * Windows in this case returns
292 * NT_STATUS_MORE_PROCESSING_REQUIRED
293 * with a negTokenTarg blob containing an krb5_error
294 * struct ASN1 encoded containing KRB5KRB_AP_ERR_SKEW.
295 * The client then fixes its clock and continues rather
296 * than giving an error. JRA.
297 * -- Looks like this only happens with a KDC. JRA.
298 */
299
300 bool ok = make_krb5_skew_error(&ap_rep);
301 if (!ok) {
302 talloc_destroy(mem_ctx);
303 return ERROR_NT(nt_status_squash(
304 NT_STATUS_LOGON_FAILURE));
305 }
306 ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
307 TOK_ID_KRB_ERROR);
308 response = spnego_gen_auth_response(&ap_rep_wrapped,
309 ret, OID_KERBEROS5_OLD);
310 reply_sesssetup_blob(conn, inbuf, outbuf, response,
311 NT_STATUS_MORE_PROCESSING_REQUIRED);
312
313 /*
314 * In this one case we don't invalidate the
315 * intermediate vuid as we're expecting the client
316 * to re-use it for the next sessionsetupX packet. JRA.
317 */
318
319 *p_invalidate_vuid = False;
320
321 data_blob_free(&ap_rep);
322 data_blob_free(&ap_rep_wrapped);
323 data_blob_free(&response);
324 talloc_destroy(mem_ctx);
325 return -1; /* already replied */
326 }
327 #else
328 if (!NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
329 ret = NT_STATUS_LOGON_FAILURE;
330 }
331 #endif
332 DEBUG(1,("Failed to verify incoming ticket with error %s!\n",
333 nt_errstr(ret)));
334 talloc_destroy(mem_ctx);
335 reply_nterror(req, nt_status_squash(ret));
336 return;
337 }
338
339 DEBUG(3,("Ticket name is [%s]\n", client));
340
341 p = strchr_m(client, '@');
342 if (!p) {
343 DEBUG(3,("Doesn't look like a valid principal\n"));
344 data_blob_free(&ap_rep);
345 data_blob_free(&session_key);
346 talloc_destroy(mem_ctx);
347 reply_nterror(req,nt_status_squash(NT_STATUS_LOGON_FAILURE));
348 return;
349 }
350
351 *p = 0;
352
353 /* save the PAC data if we have it */
354
355 if (logon_info) {
356 netsamlogon_cache_store( client, &logon_info->info3 );
357 }
358
359 if (!strequal(p+1, lp_realm())) {
360 DEBUG(3,("Ticket for foreign realm %s@%s\n", client, p+1));
361 if (!lp_allow_trusted_domains()) {
362 data_blob_free(&ap_rep);
363 data_blob_free(&session_key);
364 talloc_destroy(mem_ctx);
365 reply_nterror(req, nt_status_squash(
366 NT_STATUS_LOGON_FAILURE));
367 return;
368 }
369 }
370
371 /* this gives a fully qualified user name (ie. with full realm).
372 that leads to very long usernames, but what else can we do? */
373
374 domain = p+1;
375
376 if (logon_info && logon_info->info3.base.domain.string) {
377 fstrcpy(netbios_domain_name,
378 logon_info->info3.base.domain.string);
379 domain = netbios_domain_name;
380 DEBUG(10, ("Mapped to [%s] (using PAC)\n", domain));
381
382 } else {
383
384 /* If we have winbind running, we can (and must) shorten the
385 username by using the short netbios name. Otherwise we will
386 have inconsistent user names. With Kerberos, we get the
387 fully qualified realm, with ntlmssp we get the short
388 name. And even w2k3 does use ntlmssp if you for example
389 connect to an ip address. */
390
391 wbcErr wbc_status;
392 struct wbcDomainInfo *info = NULL;
393
394 DEBUG(10, ("Mapping [%s] to short name\n", domain));
395
396 wbc_status = wbcDomainInfo(domain, &info);
397
398 if (WBC_ERROR_IS_OK(wbc_status)) {
399
400 fstrcpy(netbios_domain_name,
401 info->short_name);
402
403 wbcFreeMemory(info);
404 domain = netbios_domain_name;
405 DEBUG(10, ("Mapped to [%s] (using Winbind)\n", domain));
406 } else {
407 DEBUG(3, ("Could not find short name: %s\n",
408 wbcErrorString(wbc_status)));
409 }
410 }
411
412 fstr_sprintf(user, "%s%c%s", domain, *lp_winbind_separator(), client);
413
414 /* lookup the passwd struct, create a new user if necessary */
415
416 username_was_mapped = map_username(sconn, user);
417
418 pw = smb_getpwnam( mem_ctx, user, real_username, True );
419
420 if (pw) {
421 /* if a real user check pam account restrictions */
422 /* only really perfomed if "obey pam restriction" is true */
423 /* do this before an eventual mapping to guest occurs */
424 ret = smb_pam_accountcheck(pw->pw_name);
425 if ( !NT_STATUS_IS_OK(ret)) {
426 DEBUG(1,("PAM account restriction "
427 "prevents user login\n"));
428 data_blob_free(&ap_rep);
429 data_blob_free(&session_key);
430 TALLOC_FREE(mem_ctx);
431 reply_nterror(req, nt_status_squash(ret));
432 return;
433 }
434 }
435
436 if (!pw) {
437
438 /* this was originally the behavior of Samba 2.2, if a user
439 did not have a local uid but has been authenticated, then
440 map them to a guest account */
441
442 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID){
443 map_domainuser_to_guest = True;
444 fstrcpy(user,lp_guestaccount());
445 pw = smb_getpwnam( mem_ctx, user, real_username, True );
446 }
447
448 /* extra sanity check that the guest account is valid */
449
450 if ( !pw ) {
451 DEBUG(1,("Username %s is invalid on this system\n",
452 user));
453 data_blob_free(&ap_rep);
454 data_blob_free(&session_key);
455 TALLOC_FREE(mem_ctx);
456 reply_nterror(req, nt_status_squash(
457 NT_STATUS_LOGON_FAILURE));
458 return;
459 }
460 }
461
462 /* setup the string used by %U */
463
464 sub_set_smb_name( real_username );
465 reload_services(True);
466
467 if ( map_domainuser_to_guest ) {
468 make_server_info_guest(NULL, &server_info);
469 } else if (logon_info) {
470 /* pass the unmapped username here since map_username()
471 will be called again from inside make_server_info_info3() */
472
473 ret = make_server_info_info3(mem_ctx, client, domain,
474 &server_info, &logon_info->info3);
475 if ( !NT_STATUS_IS_OK(ret) ) {
476 DEBUG(1,("make_server_info_info3 failed: %s!\n",
477 nt_errstr(ret)));
478 data_blob_free(&ap_rep);
479 data_blob_free(&session_key);
480 TALLOC_FREE(mem_ctx);
481 reply_nterror(req, nt_status_squash(ret));
482 return;
483 }
484
485 } else {
486 /*
487 * We didn't get a PAC, we have to make up the user
488 * ourselves. Try to ask the pdb backend to provide
489 * SID consistency with ntlmssp session setup
490 */
491 struct samu *sampass;
492
493 sampass = samu_new(talloc_tos());
494 if (sampass == NULL) {
495 ret = NT_STATUS_NO_MEMORY;
496 data_blob_free(&ap_rep);
497 data_blob_free(&session_key);
498 TALLOC_FREE(mem_ctx);
499 reply_nterror(req, nt_status_squash(ret));
500 return;
501 }
502
503 if (pdb_getsampwnam(sampass, real_username)) {
504 DEBUG(10, ("found user %s in passdb, calling "
505 "make_server_info_sam\n", real_username));
506 ret = make_server_info_sam(&server_info, sampass);
507 } else {
508 /*
509 * User not in passdb, make it up artificially
510 */
511 TALLOC_FREE(sampass);
512 DEBUG(10, ("didn't find user %s in passdb, calling "
513 "make_server_info_pw\n", real_username));
514 ret = make_server_info_pw(&server_info, real_username,
515 pw);
516 }
517
518 if ( !NT_STATUS_IS_OK(ret) ) {
519 DEBUG(1,("make_server_info_[sam|pw] failed: %s!\n",
520 nt_errstr(ret)));
521 data_blob_free(&ap_rep);
522 data_blob_free(&session_key);
523 TALLOC_FREE(mem_ctx);
524 reply_nterror(req, nt_status_squash(ret));
525 return;
526 }
527
528 /* make_server_info_pw does not set the domain. Without this
529 * we end up with the local netbios name in substitutions for
530 * %D. */
531
532 if (server_info->sam_account != NULL) {
533 pdb_set_domain(server_info->sam_account,
534 domain, PDB_SET);
535 }
536 }
537
538 server_info->nss_token |= username_was_mapped;
539
540 /* we need to build the token for the user. make_server_info_guest()
541 already does this */
542
543 if ( !server_info->ptok ) {
544 ret = create_local_token( server_info );
545 if ( !NT_STATUS_IS_OK(ret) ) {
546 DEBUG(10,("failed to create local token: %s\n",
547 nt_errstr(ret)));
548 data_blob_free(&ap_rep);
549 data_blob_free(&session_key);
550 TALLOC_FREE( mem_ctx );
551 TALLOC_FREE( server_info );
552 reply_nterror(req, nt_status_squash(ret));
553 return;
554 }
555 }
556
557 if (!is_partial_auth_vuid(sconn, sess_vuid)) {
558 sess_vuid = register_initial_vuid(sconn);
559 }
560
561 data_blob_free(&server_info->user_session_key);
562 server_info->user_session_key = session_key;
563 session_key = data_blob_null;
564
565 /* register_existing_vuid keeps the server info */
566 /* register_existing_vuid takes ownership of session_key on success,
567 * no need to free after this on success. A better interface would copy
568 * it.... */
569
570 sess_vuid = register_existing_vuid(sconn,
571 sess_vuid,
572 server_info,
573 nullblob,
574 client);
575
576 reply_outbuf(req, 4, 0);
577 SSVAL(req->outbuf,smb_uid,sess_vuid);
578
579 if (sess_vuid == UID_FIELD_INVALID ) {
580 ret = NT_STATUS_LOGON_FAILURE;
581 } else {
582 /* current_user_info is changed on new vuid */
583 reload_services( True );
584
585 SSVAL(req->outbuf, smb_vwv3, 0);
586
587 if (server_info->guest) {
588 SSVAL(req->outbuf,smb_vwv2,1);
589 }
590
591 SSVAL(req->outbuf, smb_uid, sess_vuid);
592
593 /* Successful logon. Keep this vuid. */
594 *p_invalidate_vuid = False;
595 }
596
597 /* wrap that up in a nice GSS-API wrapping */
598 if (NT_STATUS_IS_OK(ret)) {
599 ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
600 TOK_ID_KRB_AP_REP);
601 } else {
602 ap_rep_wrapped = data_blob_null;
603 }
604 response = spnego_gen_auth_response(&ap_rep_wrapped, ret,
605 mechOID);
606 reply_sesssetup_blob(req, response, ret);
607
608 data_blob_free(&ap_rep);
609 data_blob_free(&ap_rep_wrapped);
610 data_blob_free(&response);
611 TALLOC_FREE(mem_ctx);
612 }
613
614 #endif
615
616 /****************************************************************************
617 Send a session setup reply, wrapped in SPNEGO.
618 Get vuid and check first.
619 End the NTLMSSP exchange context if we are OK/complete fail
620 This should be split into two functions, one to handle each
621 leg of the NTLM auth steps.
622 ***************************************************************************/
623
624 static void reply_spnego_ntlmssp(struct smb_request *req,
625 uint16 vuid,
626 AUTH_NTLMSSP_STATE **auth_ntlmssp_state,
627 DATA_BLOB *ntlmssp_blob, NTSTATUS nt_status,
628 const char *OID,
629 bool wrap)
630 {
631 DATA_BLOB response;
632 struct auth_serversupplied_info *server_info = NULL;
633 struct smbd_server_connection *sconn = smbd_server_conn;
634
635 if (NT_STATUS_IS_OK(nt_status)) {
636 server_info = (*auth_ntlmssp_state)->server_info;
637 } else {
638 nt_status = do_map_to_guest(nt_status,
639 &server_info,
640 (*auth_ntlmssp_state)->ntlmssp_state->user,
641 (*auth_ntlmssp_state)->ntlmssp_state->domain);
642 }
643
644 reply_outbuf(req, 4, 0);
645
646 SSVAL(req->outbuf, smb_uid, vuid);
647
648 if (NT_STATUS_IS_OK(nt_status)) {
649 DATA_BLOB nullblob = data_blob_null;
650
651 if (!is_partial_auth_vuid(sconn, vuid)) {
652 nt_status = NT_STATUS_LOGON_FAILURE;
653 goto out;
654 }
655
656 data_blob_free(&server_info->user_session_key);
657 server_info->user_session_key =
658 data_blob_talloc(
659 server_info,
660 (*auth_ntlmssp_state)->ntlmssp_state->session_key.data,
661 (*auth_ntlmssp_state)->ntlmssp_state->session_key.length);
662
663 /* register_existing_vuid keeps the server info */
664 if (register_existing_vuid(sconn, vuid,
665 server_info, nullblob,
666 (*auth_ntlmssp_state)->ntlmssp_state->user) !=
667 vuid) {
668 nt_status = NT_STATUS_LOGON_FAILURE;
669 goto out;
670 }
671
672 (*auth_ntlmssp_state)->server_info = NULL;
673
674 /* current_user_info is changed on new vuid */
675 reload_services( True );
676
677 SSVAL(req->outbuf, smb_vwv3, 0);
678
679 if (server_info->guest) {
680 SSVAL(req->outbuf,smb_vwv2,1);
681 }
682 }
683
684 out:
685
686 if (wrap) {
687 response = spnego_gen_auth_response(ntlmssp_blob,
688 nt_status, OID);
689 } else {
690 response = *ntlmssp_blob;
691 }
692
693 reply_sesssetup_blob(req, response, nt_status);
694 if (wrap) {
695 data_blob_free(&response);
696 }
697
698 /* NT_STATUS_MORE_PROCESSING_REQUIRED from our NTLMSSP code tells us,
699 and the other end, that we are not finished yet. */
700
701 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
702 /* NB. This is *NOT* an error case. JRA */
703 auth_ntlmssp_end(auth_ntlmssp_state);
704 if (!NT_STATUS_IS_OK(nt_status)) {
705 /* Kill the intermediate vuid */
706 invalidate_vuid(sconn, vuid);
707 }
708 }
709 }
710
711 /****************************************************************************
712 Is this a krb5 mechanism ?
713 ****************************************************************************/
714
715 NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in,
716 DATA_BLOB *pblob_out,
717 char **kerb_mechOID)
718 {
719 char *OIDs[ASN1_MAX_OIDS];
720 int i;
721 NTSTATUS ret = NT_STATUS_OK;
722
723 *kerb_mechOID = NULL;
724
725 /* parse out the OIDs and the first sec blob */
726 if (!parse_negTokenTarg(blob_in, OIDs, pblob_out)) {
727 return NT_STATUS_LOGON_FAILURE;
728 }
729
730 /* only look at the first OID for determining the mechToken --
731 according to RFC2478, we should choose the one we want
732 and renegotiate, but i smell a client bug here..
733
734 Problem observed when connecting to a member (samba box)
735 of an AD domain as a user in a Samba domain. Samba member
736 server sent back krb5/mskrb5/ntlmssp as mechtypes, but the
737 client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an
738 NTLMSSP mechtoken. --jerry */
739
740 #ifdef HAVE_KRB5
741 if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 ||
742 strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
743 *kerb_mechOID = SMB_STRDUP(OIDs[0]);
744 if (*kerb_mechOID == NULL) {
745 ret = NT_STATUS_NO_MEMORY;
746 }
747 }
748 #endif
749
750 for (i=0;OIDs[i];i++) {
751 DEBUG(5,("parse_spnego_mechanisms: Got OID %s\n", OIDs[i]));
752 talloc_free(OIDs[i]);
753 }
754 return ret;
755 }
756
757 /****************************************************************************
758 Fall back from krb5 to NTLMSSP.
759 ****************************************************************************/
760
761 static void reply_spnego_downgrade_to_ntlmssp(struct smb_request *req,
762 uint16 vuid)
763 {
764 DATA_BLOB response;
765
766 reply_outbuf(req, 4, 0);
767 SSVAL(req->outbuf,smb_uid,vuid);
768
769 DEBUG(3,("reply_spnego_downgrade_to_ntlmssp: Got krb5 ticket in SPNEGO "
770 "but set to downgrade to NTLMSSP\n"));
771
772 response = spnego_gen_auth_response(NULL,
773 NT_STATUS_MORE_PROCESSING_REQUIRED,
774 OID_NTLMSSP);
775 reply_sesssetup_blob(req, response, NT_STATUS_MORE_PROCESSING_REQUIRED);
776 data_blob_free(&response);
777 }
778
779 /****************************************************************************
780 Reply to a session setup spnego negotiate packet.
781 ****************************************************************************/
782
783 static void reply_spnego_negotiate(struct smb_request *req,
784 uint16 vuid,
785 DATA_BLOB blob1,
786 AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
787 {
788 DATA_BLOB secblob;
789 DATA_BLOB chal;
790 char *kerb_mech = NULL;
791 NTSTATUS status;
792 struct smbd_server_connection *sconn = smbd_server_conn;
793
794 status = parse_spnego_mechanisms(blob1, &secblob, &kerb_mech);
795 if (!NT_STATUS_IS_OK(status)) {
796 /* Kill the intermediate vuid */
797 invalidate_vuid(sconn, vuid);
798 reply_nterror(req, nt_status_squash(status));
799 return;
800 }
801
802 DEBUG(3,("reply_spnego_negotiate: Got secblob of size %lu\n",
803 (unsigned long)secblob.length));
804
805 #ifdef HAVE_KRB5
806 if (kerb_mech && ((lp_security()==SEC_ADS) ||
807 USE_KERBEROS_KEYTAB) ) {
808 bool destroy_vuid = True;
809 reply_spnego_kerberos(req, &secblob, kerb_mech,
810 vuid, &destroy_vuid);
811 data_blob_free(&secblob);
812 if (destroy_vuid) {
813 /* Kill the intermediate vuid */
814 invalidate_vuid(sconn, vuid);
815 }
816 SAFE_FREE(kerb_mech);
817 return;
818 }
819 #endif
820
821 if (*auth_ntlmssp_state) {
822 auth_ntlmssp_end(auth_ntlmssp_state);
823 }
824
825 if (kerb_mech) {
826 data_blob_free(&secblob);
827 /* The mechtoken is a krb5 ticket, but
828 * we need to fall back to NTLM. */
829 reply_spnego_downgrade_to_ntlmssp(req, vuid);
830 SAFE_FREE(kerb_mech);
831 return;
832 }
833
834 status = auth_ntlmssp_start(auth_ntlmssp_state);
835 if (!NT_STATUS_IS_OK(status)) {
836 /* Kill the intermediate vuid */
837 invalidate_vuid(sconn, vuid);
838 reply_nterror(req, nt_status_squash(status));
839 return;
840 }
841
842 status = auth_ntlmssp_update(*auth_ntlmssp_state,
843 secblob, &chal);
844
845 data_blob_free(&secblob);
846
847 reply_spnego_ntlmssp(req, vuid, auth_ntlmssp_state,
848 &chal, status, OID_NTLMSSP, true);
849
850 data_blob_free(&chal);
851
852 /* already replied */
853 return;
854 }
855
856 /****************************************************************************
857 Reply to a session setup spnego auth packet.
858 ****************************************************************************/
859
860 static void reply_spnego_auth(struct smb_request *req,
861 uint16 vuid,
862 DATA_BLOB blob1,
863 AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
864 {
865 DATA_BLOB auth = data_blob_null;
866 DATA_BLOB auth_reply = data_blob_null;
867 DATA_BLOB secblob = data_blob_null;
868 NTSTATUS status = NT_STATUS_LOGON_FAILURE;
869 struct smbd_server_connection *sconn = smbd_server_conn;
870
871 if (!spnego_parse_auth(blob1, &auth)) {
872 #if 0
873 file_save("auth.dat", blob1.data, blob1.length);
874 #endif
875 /* Kill the intermediate vuid */
876 invalidate_vuid(sconn, vuid);
877
878 reply_nterror(req, nt_status_squash(
879 NT_STATUS_LOGON_FAILURE));
880 return;
881 }
882
883 if (auth.data[0] == ASN1_APPLICATION(0)) {
884 /* Might be a second negTokenTarg packet */
885 char *kerb_mech = NULL;
886
887 status = parse_spnego_mechanisms(auth, &secblob, &kerb_mech);
888
889 if (!NT_STATUS_IS_OK(status)) {
890 /* Kill the intermediate vuid */
891 invalidate_vuid(sconn, vuid);
892 reply_nterror(req, nt_status_squash(status));
893 return;
894 }
895
896 DEBUG(3,("reply_spnego_auth: Got secblob of size %lu\n",
897 (unsigned long)secblob.length));
898 #ifdef HAVE_KRB5
899 if (kerb_mech && ((lp_security()==SEC_ADS) ||
900 USE_KERBEROS_KEYTAB)) {
901 bool destroy_vuid = True;
902 reply_spnego_kerberos(req, &secblob, kerb_mech,
903 vuid, &destroy_vuid);
904 data_blob_free(&secblob);
905 data_blob_free(&auth);
906 if (destroy_vuid) {
907 /* Kill the intermediate vuid */
908 invalidate_vuid(sconn, vuid);
909 }
910 SAFE_FREE(kerb_mech);
911 return;
912 }
913 #endif
914 /* Can't blunder into NTLMSSP auth if we have
915 * a krb5 ticket. */
916
917 if (kerb_mech) {
918 /* Kill the intermediate vuid */
919 invalidate_vuid(sconn, vuid);
920 DEBUG(3,("reply_spnego_auth: network "
921 "misconfiguration, client sent us a "
922 "krb5 ticket and kerberos security "
923 "not enabled\n"));
924 reply_nterror(req, nt_status_squash(
925 NT_STATUS_LOGON_FAILURE));
926 SAFE_FREE(kerb_mech);
927 }
928 }
929
930 /* If we get here it wasn't a negTokenTarg auth packet. */
931 data_blob_free(&secblob);
932
933 if (!*auth_ntlmssp_state) {
934 status = auth_ntlmssp_start(auth_ntlmssp_state);
935 if (!NT_STATUS_IS_OK(status)) {
936 /* Kill the intermediate vuid */
937 invalidate_vuid(sconn, vuid);
938 reply_nterror(req, nt_status_squash(status));
939 return;
940 }
941 }
942
943 status = auth_ntlmssp_update(*auth_ntlmssp_state,
944 auth, &auth_reply);
945
946 data_blob_free(&auth);
947
948 /* Don't send the mechid as we've already sent this (RFC4178). */
949
950 reply_spnego_ntlmssp(req, vuid,
951 auth_ntlmssp_state,
952 &auth_reply, status, NULL, true);
953
954 data_blob_free(&auth_reply);
955
956 /* and tell smbd that we have already replied to this packet */
957 return;
958 }
959
960 /****************************************************************************
961 Delete an entry on the list.
962 ****************************************************************************/
963
964 static void delete_partial_auth(struct smbd_server_connection *sconn,
965 struct pending_auth_data *pad)
966 {
967 if (!pad) {
968 return;
969 }
970 DLIST_REMOVE(sconn->smb1.pd_list, pad);
971 data_blob_free(&pad->partial_data);
972 SAFE_FREE(pad);
973 }
974
975 /****************************************************************************
976 Search for a partial SPNEGO auth fragment matching an smbpid.
977 ****************************************************************************/
978
979 static struct pending_auth_data *get_pending_auth_data(
980 struct smbd_server_connection *sconn,
981 uint16_t smbpid)
982 {
983 struct pending_auth_data *pad;
984 /*
985 * NOTE: using the smbpid here is completely wrong...
986 * see [MS-SMB]
987 * 3.3.5.3 Receiving an SMB_COM_SESSION_SETUP_ANDX Request
988 */
989 for (pad = sconn->smb1.pd_list; pad; pad = pad->next) {
990 if (pad->smbpid == smbpid) {
991 break;
992 }
993 }
994 return pad;
995 }
996
997 /****************************************************************************
998 Check the size of an SPNEGO blob. If we need more return
999 NT_STATUS_MORE_PROCESSING_REQUIRED, else return NT_STATUS_OK. Don't allow
1000 the blob to be more than 64k.
1001 ****************************************************************************/
1002
1003 static NTSTATUS check_spnego_blob_complete(struct smbd_server_connection *sconn,
1004 uint16 smbpid, uint16 vuid,
1005 DATA_BLOB *pblob)
1006 {
1007 struct pending_auth_data *pad = NULL;
1008 ASN1_DATA *data;
1009 size_t needed_len = 0;
1010
1011 pad = get_pending_auth_data(sconn, smbpid);
1012
1013 /* Ensure we have some data. */
1014 if (pblob->length == 0) {
1015 /* Caller can cope. */
1016 DEBUG(2,("check_spnego_blob_complete: zero blob length !\n"));
1017 delete_partial_auth(sconn, pad);
1018 return NT_STATUS_OK;
1019 }
1020
1021 /* Were we waiting for more data ? */
1022 if (pad) {
1023 DATA_BLOB tmp_blob;
1024 size_t copy_len = MIN(65536, pblob->length);
1025
1026 /* Integer wrap paranoia.... */
1027
1028 if (pad->partial_data.length + copy_len <
1029 pad->partial_data.length ||
1030 pad->partial_data.length + copy_len < copy_len) {
1031
1032 DEBUG(2,("check_spnego_blob_complete: integer wrap "
1033 "pad->partial_data.length = %u, "
1034 "copy_len = %u\n",
1035 (unsigned int)pad->partial_data.length,
1036 (unsigned int)copy_len ));
1037
1038 delete_partial_auth(sconn, pad);
1039 return NT_STATUS_INVALID_PARAMETER;
1040 }
1041
1042 DEBUG(10,("check_spnego_blob_complete: "
1043 "pad->partial_data.length = %u, "
1044 "pad->needed_len = %u, "
1045 "copy_len = %u, "
1046 "pblob->length = %u,\n",
1047 (unsigned int)pad->partial_data.length,
1048 (unsigned int)pad->needed_len,
1049 (unsigned int)copy_len,
1050 (unsigned int)pblob->length ));
1051
1052 tmp_blob = data_blob(NULL,
1053 pad->partial_data.length + copy_len);
1054
1055 /* Concatenate the two (up to copy_len) bytes. */
1056 memcpy(tmp_blob.data,
1057 pad->partial_data.data,
1058 pad->partial_data.length);
1059 memcpy(tmp_blob.data + pad->partial_data.length,
1060 pblob->data,
1061 copy_len);
1062
1063 /* Replace the partial data. */
1064 data_blob_free(&pad->partial_data);
1065 pad->partial_data = tmp_blob;
1066 ZERO_STRUCT(tmp_blob);
1067
1068 /* Are we done ? */
1069 if (pblob->length >= pad->needed_len) {
1070 /* Yes, replace pblob. */
1071 data_blob_free(pblob);
1072 *pblob = pad->partial_data;
1073 ZERO_STRUCT(pad->partial_data);
1074 delete_partial_auth(sconn, pad);
1075 return NT_STATUS_OK;
1076 }
1077
1078 /* Still need more data. */
1079 pad->needed_len -= copy_len;
1080 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1081 }
1082
1083 if ((pblob->data[0] != ASN1_APPLICATION(0)) &&
1084 (pblob->data[0] != ASN1_CONTEXT(1))) {
1085 /* Not something we can determine the
1086 * length of.
1087 */
1088 return NT_STATUS_OK;
1089 }
1090
1091 /* This is a new SPNEGO sessionsetup - see if
1092 * the data given in this blob is enough.
1093 */
1094
1095 data = asn1_init(NULL);
1096 if (data == NULL) {
1097 return NT_STATUS_NO_MEMORY;
1098 }
1099
1100 asn1_load(data, *pblob);
1101 asn1_start_tag(data, pblob->data[0]);
1102 if (data->has_error || data->nesting == NULL) {
1103 asn1_free(data);
1104 /* Let caller catch. */
1105 return NT_STATUS_OK;
1106 }
1107
1108 /* Integer wrap paranoia.... */
1109
1110 if (data->nesting->taglen + data->nesting->start < data->nesting->taglen ||
1111 data->nesting->taglen + data->nesting->start < data->nesting->start) {
1112
1113 DEBUG(2,("check_spnego_blob_complete: integer wrap "
1114 "data.nesting->taglen = %u, "
1115 "data.nesting->start = %u\n",
1116 (unsigned int)data->nesting->taglen,
1117 (unsigned int)data->nesting->start ));
1118
1119 asn1_free(data);
1120 return NT_STATUS_INVALID_PARAMETER;
1121 }
1122
1123 /* Total length of the needed asn1 is the tag length
1124 * plus the current offset. */
1125
1126 needed_len = data->nesting->taglen + data->nesting->start;
1127 asn1_free(data);
1128
1129 DEBUG(10,("check_spnego_blob_complete: needed_len = %u, "
1130 "pblob->length = %u\n",
1131 (unsigned int)needed_len,
1132 (unsigned int)pblob->length ));
1133
1134 if (needed_len <= pblob->length) {
1135 /* Nothing to do - blob is complete. */
1136 return NT_STATUS_OK;
1137 }
1138
1139 /* Refuse the blob if it's bigger than 64k. */
1140 if (needed_len > 65536) {
1141 DEBUG(2,("check_spnego_blob_complete: needed_len "
1142 "too large (%u)\n",
1143 (unsigned int)needed_len ));
1144 return NT_STATUS_INVALID_PARAMETER;
1145 }
1146
1147 /* We must store this blob until complete. */
1148 if (!(pad = SMB_MALLOC_P(struct pending_auth_data))) {
1149 return NT_STATUS_NO_MEMORY;
1150 }
1151 pad->needed_len = needed_len - pblob->length;
1152 pad->partial_data = data_blob(pblob->data, pblob->length);
1153 if (pad->partial_data.data == NULL) {
1154 SAFE_FREE(pad);
1155 return NT_STATUS_NO_MEMORY;
1156 }
1157 pad->smbpid = smbpid;
1158 pad->vuid = vuid;
1159 DLIST_ADD(sconn->smb1.pd_list, pad);
1160
1161 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1162 }
1163
1164 /****************************************************************************
1165 Reply to a session setup command.
1166 conn POINTER CAN BE NULL HERE !
1167 ****************************************************************************/
1168
1169 static void reply_sesssetup_and_X_spnego(struct smb_request *req)
1170 {
1171 const uint8 *p;
1172 DATA_BLOB blob1;
1173 size_t bufrem;
1174 char *tmp;
1175 const char *native_os;
1176 const char *native_lanman;
1177 const char *primary_domain;
1178 const char *p2;
1179 uint16 data_blob_len = SVAL(req->vwv+7, 0);
1180 enum remote_arch_types ra_type = get_remote_arch();
1181 int vuid = req->vuid;
1182 user_struct *vuser = NULL;
1183 NTSTATUS status = NT_STATUS_OK;
1184 uint16 smbpid = req->smbpid;
1185 struct smbd_server_connection *sconn = smbd_server_conn;
1186
1187 DEBUG(3,("Doing spnego session setup\n"));
1188
1189 if (global_client_caps == 0) {
1190 global_client_caps = IVAL(req->vwv+10, 0);
1191
1192 if (!(global_client_caps & CAP_STATUS32)) {
1193 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1194 }
1195
1196 }
1197
1198 p = req->buf;
1199
1200 if (data_blob_len == 0) {
1201 /* an invalid request */
1202 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1203 return;
1204 }
1205
1206 bufrem = smbreq_bufrem(req, p);
1207 /* pull the spnego blob */
1208 blob1 = data_blob(p, MIN(bufrem, data_blob_len));
1209
1210 #if 0
1211 file_save("negotiate.dat", blob1.data, blob1.length);
1212 #endif
1213
1214 p2 = (char *)req->buf + blob1.length;
1215
1216 p2 += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p2,
1217 STR_TERMINATE);
1218 native_os = tmp ? tmp : "";
1219
1220 p2 += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p2,
1221 STR_TERMINATE);
1222 native_lanman = tmp ? tmp : "";
1223
1224 p2 += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p2,
1225 STR_TERMINATE);
1226 primary_domain = tmp ? tmp : "";
1227
1228 DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
1229 native_os, native_lanman, primary_domain));
1230
1231 if ( ra_type == RA_WIN2K ) {
1232 /* Vista sets neither the OS or lanman strings */
1233
1234 if ( !strlen(native_os) && !strlen(native_lanman) )
1235 set_remote_arch(RA_VISTA);
1236
1237 /* Windows 2003 doesn't set the native lanman string,
1238 but does set primary domain which is a bug I think */
1239
1240 if ( !strlen(native_lanman) ) {
1241 ra_lanman_string( primary_domain );
1242 } else {
1243 ra_lanman_string( native_lanman );
1244 }
1245 }
1246
1247 /* Did we get a valid vuid ? */
1248 if (!is_partial_auth_vuid(sconn, vuid)) {
1249 /* No, then try and see if this is an intermediate sessionsetup
1250 * for a large SPNEGO packet. */
1251 struct pending_auth_data *pad;
1252 pad = get_pending_auth_data(sconn, smbpid);
1253 if (pad) {
1254 DEBUG(10,("reply_sesssetup_and_X_spnego: found "
1255 "pending vuid %u\n",
1256 (unsigned int)pad->vuid ));
1257 vuid = pad->vuid;
1258 }
1259 }
1260
1261 /* Do we have a valid vuid now ? */
1262 if (!is_partial_auth_vuid(sconn, vuid)) {
1263 /* No, start a new authentication setup. */
1264 vuid = register_initial_vuid(sconn);
1265 if (vuid == UID_FIELD_INVALID) {
1266 data_blob_free(&blob1);
1267 reply_nterror(req, nt_status_squash(
1268 NT_STATUS_INVALID_PARAMETER));
1269 return;
1270 }
1271 }
1272
1273 vuser = get_partial_auth_user_struct(sconn, vuid);
1274 /* This MUST be valid. */
1275 if (!vuser) {
1276 smb_panic("reply_sesssetup_and_X_spnego: invalid vuid.");
1277 }
1278
1279 /* Large (greater than 4k) SPNEGO blobs are split into multiple
1280 * sessionsetup requests as the Windows limit on the security blob
1281 * field is 4k. Bug #4400. JRA.
1282 */
1283
1284 status = check_spnego_blob_complete(sconn, smbpid, vuid, &blob1);
1285 if (!NT_STATUS_IS_OK(status)) {
1286 if (!NT_STATUS_EQUAL(status,
1287 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1288 /* Real error - kill the intermediate vuid */
1289 invalidate_vuid(sconn, vuid);
1290 }
1291 data_blob_free(&blob1);
1292 reply_nterror(req, nt_status_squash(status));
1293 return;
1294 }
1295
1296 if (blob1.data[0] == ASN1_APPLICATION(0)) {
1297
1298 /* its a negTokenTarg packet */
1299
1300 reply_spnego_negotiate(req, vuid, blob1,
1301 &vuser->auth_ntlmssp_state);
1302 data_blob_free(&blob1);
1303 return;
1304 }
1305
1306 if (blob1.data[0] == ASN1_CONTEXT(1)) {
1307
1308 /* its a auth packet */
1309
1310 reply_spnego_auth(req, vuid, blob1,
1311 &vuser->auth_ntlmssp_state);
1312 data_blob_free(&blob1);
1313 return;
1314 }
1315
1316 if (strncmp((char *)(blob1.data), "NTLMSSP", 7) == 0) {
1317 DATA_BLOB chal;
1318
1319 if (!vuser->auth_ntlmssp_state) {
1320 status = auth_ntlmssp_start(&vuser->auth_ntlmssp_state);
1321 if (!NT_STATUS_IS_OK(status)) {
1322 /* Kill the intermediate vuid */
1323 invalidate_vuid(sconn, vuid);
1324 data_blob_free(&blob1);
1325 reply_nterror(req, nt_status_squash(status));
1326 return;
1327 }
1328 }
1329
1330 status = auth_ntlmssp_update(vuser->auth_ntlmssp_state,
1331 blob1, &chal);
1332
1333 data_blob_free(&blob1);
1334
1335 reply_spnego_ntlmssp(req, vuid,
1336 &vuser->auth_ntlmssp_state,
1337 &chal, status, OID_NTLMSSP, false);
1338 data_blob_free(&chal);
1339 return;
1340 }
1341
1342 /* what sort of packet is this? */
1343 DEBUG(1,("Unknown packet in reply_sesssetup_and_X_spnego\n"));
1344
1345 data_blob_free(&blob1);
1346
1347 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1348 }
1349
1350 /****************************************************************************
1351 On new VC == 0, shutdown *all* old connections and users.
1352 It seems that only NT4.x does this. At W2K and above (XP etc.).
1353 a new session setup with VC==0 is ignored.
1354 ****************************************************************************/
1355
1356 static int shutdown_other_smbds(const struct connections_key *key,
1357 const struct connections_data *crec,
1358 void *private_data)
1359 {
1360 const char *ip = (const char *)private_data;
1361
1362 if (!process_exists(crec->pid)) {
1363 return 0;
1364 }
1365
1366 if (procid_is_me(&crec->pid)) {
1367 return 0;
1368 }
1369
1370 if (strcmp(ip, crec->addr) != 0) {
1371 return 0;
1372 }
1373
1374 DEBUG(0,("shutdown_other_smbds: shutting down pid %u "
1375 "(IP %s)\n", (unsigned int)procid_to_pid(&crec->pid), ip));
1376
1377 messaging_send(smbd_messaging_context(), crec->pid, MSG_SHUTDOWN,
1378 &data_blob_null);
1379 return 0;
1380 }
1381
1382 static void setup_new_vc_session(void)
1383 {
1384 char addr[INET6_ADDRSTRLEN];
1385
1386 DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x "
1387 "compatible we would close all old resources.\n"));
1388 #if 0
1389 conn_close_all();
1390 invalidate_all_vuids();
1391 #endif
1392 if (lp_reset_on_zero_vc()) {
1393 connections_forall_read(shutdown_other_smbds,
1394 CONST_DISCARD(void *,
1395 client_addr(get_client_fd(),addr,sizeof(addr))));
1396 }
1397 }
1398
1399 /****************************************************************************
1400 Reply to a session setup command.
1401 ****************************************************************************/
1402
1403 void reply_sesssetup_and_X(struct smb_request *req)
1404 {
1405 int sess_vuid;
1406 int smb_bufsize;
1407 DATA_BLOB lm_resp;
1408 DATA_BLOB nt_resp;
1409 DATA_BLOB plaintext_password;
1410 char *tmp;
1411 const char *user;
1412 fstring sub_user; /* Sainitised username for substituion */
1413 const char *domain;
1414 const char *native_os;
1415 const char *native_lanman;
1416 const char *primary_domain;
1417 struct auth_usersupplied_info *user_info = NULL;
1418 struct auth_serversupplied_info *server_info = NULL;
1419 uint16 smb_flag2 = req->flags2;
1420
1421 NTSTATUS nt_status;
1422 struct smbd_server_connection *sconn = smbd_server_conn;
1423
1424 bool doencrypt = sconn->smb1.negprot.encrypted_passwords;
1425
1426 START_PROFILE(SMBsesssetupX);
1427
1428 ZERO_STRUCT(lm_resp);
1429 ZERO_STRUCT(nt_resp);
1430 ZERO_STRUCT(plaintext_password);
1431
1432 DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
1433
1434 /* a SPNEGO session setup has 12 command words, whereas a normal
1435 NT1 session setup has 13. See the cifs spec. */
1436 if (req->wct == 12 &&
1437 (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
1438
1439 if (!sconn->smb1.negprot.spnego) {
1440 DEBUG(0,("reply_sesssetup_and_X: Rejecting attempt "
1441 "at SPNEGO session setup when it was not "
1442 "negotiated.\n"));
1443 reply_nterror(req, nt_status_squash(
1444 NT_STATUS_LOGON_FAILURE));
1445 END_PROFILE(SMBsesssetupX);
1446 return;
1447 }
1448
1449 if (SVAL(req->vwv+4, 0) == 0) {
1450 setup_new_vc_session();
1451 }
1452
1453 reply_sesssetup_and_X_spnego(req);
1454 END_PROFILE(SMBsesssetupX);
1455 return;
1456 }
1457
1458 smb_bufsize = SVAL(req->vwv+2, 0);
1459
1460 if (get_Protocol() < PROTOCOL_NT1) {
1461 uint16 passlen1 = SVAL(req->vwv+7, 0);
1462
1463 /* Never do NT status codes with protocols before NT1 as we
1464 * don't get client caps. */
1465 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1466
1467 if ((passlen1 > MAX_PASS_LEN) || (passlen1 > req->buflen)) {
1468 reply_nterror(req, nt_status_squash(
1469 NT_STATUS_INVALID_PARAMETER));
1470 END_PROFILE(SMBsesssetupX);
1471 return;
1472 }
1473
1474 if (doencrypt) {
1475 lm_resp = data_blob(req->buf, passlen1);
1476 } else {
1477 plaintext_password = data_blob(req->buf, passlen1+1);
1478 /* Ensure null termination */
1479 plaintext_password.data[passlen1] = 0;
1480 }
1481
1482 srvstr_pull_req_talloc(talloc_tos(), req, &tmp,
1483 req->buf + passlen1, STR_TERMINATE);
1484 user = tmp ? tmp : "";
1485
1486 domain = "";
1487
1488 } else {
1489 uint16 passlen1 = SVAL(req->vwv+7, 0);
1490 uint16 passlen2 = SVAL(req->vwv+8, 0);
1491 enum remote_arch_types ra_type = get_remote_arch();
1492 const uint8_t *p = req->buf;
1493 const uint8_t *save_p = req->buf;
1494 uint16 byte_count;
1495
1496
1497 if(global_client_caps == 0) {
1498 global_client_caps = IVAL(req->vwv+11, 0);
1499
1500 if (!(global_client_caps & CAP_STATUS32)) {
1501 remove_from_common_flags2(
1502 FLAGS2_32_BIT_ERROR_CODES);
1503 }
1504
1505 /* client_caps is used as final determination if
1506 * client is NT or Win95. This is needed to return
1507 * the correct error codes in some circumstances.
1508 */
1509
1510 if(ra_type == RA_WINNT || ra_type == RA_WIN2K ||
1511 ra_type == RA_WIN95) {
1512 if(!(global_client_caps & (CAP_NT_SMBS|
1513 CAP_STATUS32))) {
1514 set_remote_arch( RA_WIN95);
1515 }
1516 }
1517 }
1518
1519 if (!doencrypt) {
1520 /* both Win95 and WinNT stuff up the password
1521 * lengths for non-encrypting systems. Uggh.
1522
1523 if passlen1==24 its a win95 system, and its setting
1524 the password length incorrectly. Luckily it still
1525 works with the default code because Win95 will null
1526 terminate the password anyway
1527
1528 if passlen1>0 and passlen2>0 then maybe its a NT box
1529 and its setting passlen2 to some random value which
1530 really stuffs things up. we need to fix that one. */
1531
1532 if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 &&
1533 passlen2 != 1) {
1534 passlen2 = 0;
1535 }
1536 }
1537
1538 /* check for nasty tricks */
1539 if (passlen1 > MAX_PASS_LEN
1540 || passlen1 > smbreq_bufrem(req, p)) {
1541 reply_nterror(req, nt_status_squash(
1542 NT_STATUS_INVALID_PARAMETER));
1543 END_PROFILE(SMBsesssetupX);
1544 return;
1545 }
1546
1547 if (passlen2 > MAX_PASS_LEN
1548 || passlen2 > smbreq_bufrem(req, p+passlen1)) {
1549 reply_nterror(req, nt_status_squash(
1550 NT_STATUS_INVALID_PARAMETER));
1551 END_PROFILE(SMBsesssetupX);
1552 return;
1553 }
1554
1555 /* Save the lanman2 password and the NT md4 password. */
1556
1557 if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
1558 doencrypt = False;
1559 }
1560
1561 if (doencrypt) {
1562 lm_resp = data_blob(p, passlen1);
1563 nt_resp = data_blob(p+passlen1, passlen2);
1564 } else if (lp_security() != SEC_SHARE) {
1565 /*
1566 * In share level we should ignore any passwords, so
1567 * only read them if we're not.
1568 */
1569 char *pass = NULL;
1570 bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
1571
1572 if (unic && (passlen2 == 0) && passlen1) {
1573 /* Only a ascii plaintext password was sent. */
1574 (void)srvstr_pull_talloc(talloc_tos(),
1575 req->inbuf,
1576 req->flags2,
1577 &pass,
1578 req->buf,
1579 passlen1,
1580 STR_TERMINATE|STR_ASCII);
1581 } else {
1582 (void)srvstr_pull_talloc(talloc_tos(),
1583 req->inbuf,
1584 req->flags2,
1585 &pass,
1586 req->buf,
1587 unic ? passlen2 : passlen1,
1588 STR_TERMINATE);
1589 }
1590 if (!pass) {
1591 reply_nterror(req, nt_status_squash(
1592 NT_STATUS_INVALID_PARAMETER));
1593 END_PROFILE(SMBsesssetupX);
1594 return;
1595 }
1596 plaintext_password = data_blob(pass, strlen(pass)+1);
1597 }
1598
1599 p += passlen1 + passlen2;
1600
1601 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1602 STR_TERMINATE);
1603 user = tmp ? tmp : "";
1604
1605 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1606 STR_TERMINATE);
1607 domain = tmp ? tmp : "";
1608
1609 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1610 STR_TERMINATE);
1611 native_os = tmp ? tmp : "";
1612
1613 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1614 STR_TERMINATE);
1615 native_lanman = tmp ? tmp : "";
1616
1617 /* not documented or decoded by Ethereal but there is one more
1618 * string in the extra bytes which is the same as the
1619 * PrimaryDomain when using extended security. Windows NT 4
1620 * and 2003 use this string to store the native lanman string.
1621 * Windows 9x does not include a string here at all so we have
1622 * to check if we have any extra bytes left */
1623
1624 byte_count = SVAL(req->vwv+13, 0);
1625 if ( PTR_DIFF(p, save_p) < byte_count) {
1626 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1627 STR_TERMINATE);
1628 primary_domain = tmp ? tmp : "";
1629 } else {
1630 primary_domain = talloc_strdup(talloc_tos(), "null");
1631 }
1632
1633 DEBUG(3,("Domain=[%s] NativeOS=[%s] NativeLanMan=[%s] "
1634 "PrimaryDomain=[%s]\n",
1635 domain, native_os, native_lanman, primary_domain));
1636
1637 if ( ra_type == RA_WIN2K ) {
1638 if ( strlen(native_lanman) == 0 )
1639 ra_lanman_string( primary_domain );
1640 else
1641 ra_lanman_string( native_lanman );
1642 }
1643
1644 }
1645
1646 if (SVAL(req->vwv+4, 0) == 0) {
1647 setup_new_vc_session();
1648 }
1649
1650 DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
1651 domain, user, get_remote_machine_name()));
1652
1653 if (*user) {
1654 if (sconn->smb1.negprot.spnego) {
1655
1656 /* This has to be here, because this is a perfectly
1657 * valid behaviour for guest logons :-( */
1658
1659 DEBUG(0,("reply_sesssetup_and_X: Rejecting attempt "
1660 "at 'normal' session setup after "
1661 "negotiating spnego.\n"));
1662 reply_nterror(req, nt_status_squash(
1663 NT_STATUS_LOGON_FAILURE));
1664 END_PROFILE(SMBsesssetupX);
1665 return;
1666 }
1667 fstrcpy(sub_user, user);
1668 } else {
1669 fstrcpy(sub_user, lp_guestaccount());
1670 }
1671
1672 sub_set_smb_name(sub_user);
1673
1674 reload_services(True);
1675
1676 if (lp_security() == SEC_SHARE) {
1677 /* In share level we should ignore any passwords */
1678
1679 data_blob_free(&lm_resp);
1680 data_blob_free(&nt_resp);
1681 data_blob_clear_free(&plaintext_password);
1682
1683 map_username(sconn, sub_user);
1684 add_session_user(sconn, sub_user);
1685 add_session_workgroup(sconn, domain);
1686 /* Then force it to null for the benfit of the code below */
1687 user = "";
1688 }
1689
1690 if (!*user) {
1691
1692 nt_status = check_guest_password(&server_info);
1693
1694 } else if (doencrypt) {
1695 struct auth_context *negprot_auth_context = NULL;
1696 negprot_auth_context = sconn->smb1.negprot.auth_context;
1697 if (!negprot_auth_context) {
1698 DEBUG(0, ("reply_sesssetup_and_X: Attempted encrypted "
1699 "session setup without negprot denied!\n"));
1700 reply_nterror(req, nt_status_squash(
1701 NT_STATUS_LOGON_FAILURE));
1702 END_PROFILE(SMBsesssetupX);
1703 return;
1704 }
1705 nt_status = make_user_info_for_reply_enc(&user_info, user,
1706 domain,
1707 lm_resp, nt_resp);
1708 if (NT_STATUS_IS_OK(nt_status)) {
1709 nt_status = negprot_auth_context->check_ntlm_password(
1710 negprot_auth_context,
1711 user_info,
1712 &server_info);
1713 }
1714 } else {
1715 struct auth_context *plaintext_auth_context = NULL;
1716
1717 nt_status = make_auth_context_subsystem(
1718 &plaintext_auth_context);
1719
1720 if (NT_STATUS_IS_OK(nt_status)) {
1721 uint8_t chal[8];
1722
1723 plaintext_auth_context->get_ntlm_challenge(
1724 plaintext_auth_context, chal);
1725
1726 if (!make_user_info_for_reply(&user_info,
1727 user, domain, chal,
1728 plaintext_password)) {
1729 nt_status = NT_STATUS_NO_MEMORY;
1730 }
1731
1732 if (NT_STATUS_IS_OK(nt_status)) {
1733 nt_status = plaintext_auth_context->check_ntlm_password(
1734 plaintext_auth_context,
1735 user_info,
1736 &server_info);
1737
1738 (plaintext_auth_context->free)(
1739 &plaintext_auth_context);
1740 }
1741 }
1742 }
1743
1744 free_user_info(&user_info);
1745
1746 if (!NT_STATUS_IS_OK(nt_status)) {
1747 nt_status = do_map_to_guest(nt_status, &server_info,
1748 user, domain);
1749 }
1750
1751 if (!NT_STATUS_IS_OK(nt_status)) {
1752 data_blob_free(&nt_resp);
1753 data_blob_free(&lm_resp);
1754 data_blob_clear_free(&plaintext_password);
1755 reply_nterror(req, nt_status_squash(nt_status));
1756 END_PROFILE(SMBsesssetupX);
1757 return;
1758 }
1759
1760 /* Ensure we can't possible take a code path leading to a
1761 * null defref. */
1762 if (!server_info) {
1763 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1764 END_PROFILE(SMBsesssetupX);
1765 return;
1766 }
1767
1768 if (!server_info->ptok) {
1769 nt_status = create_local_token(server_info);
1770
1771 if (!NT_STATUS_IS_OK(nt_status)) {
1772 DEBUG(10, ("create_local_token failed: %s\n",
1773 nt_errstr(nt_status)));
1774 data_blob_free(&nt_resp);
1775 data_blob_free(&lm_resp);
1776 data_blob_clear_free(&plaintext_password);
1777 reply_nterror(req, nt_status_squash(nt_status));
1778 END_PROFILE(SMBsesssetupX);
1779 return;
1780 }
1781 }
1782
1783 data_blob_clear_free(&plaintext_password);
1784
1785 /* it's ok - setup a reply */
1786 reply_outbuf(req, 3, 0);
1787 if (get_Protocol() >= PROTOCOL_NT1) {
1788 push_signature(&req->outbuf);
1789 /* perhaps grab OS version here?? */
1790 }
1791
1792 if (server_info->guest) {
1793 SSVAL(req->outbuf,smb_vwv2,1);
1794 }
1795
1796 /* register the name and uid as being validated, so further connections
1797 to a uid can get through without a password, on the same VC */
1798
1799 if (lp_security() == SEC_SHARE) {
1800 sess_vuid = UID_FIELD_INVALID;
1801 TALLOC_FREE(server_info);
1802 } else {
1803 /* Ignore the initial vuid. */
1804 sess_vuid = register_initial_vuid(sconn);
1805 if (sess_vuid == UID_FIELD_INVALID) {
1806 data_blob_free(&nt_resp);
1807 data_blob_free(&lm_resp);
1808 reply_nterror(req, nt_status_squash(
1809 NT_STATUS_LOGON_FAILURE));
1810 END_PROFILE(SMBsesssetupX);
1811 return;
1812 }
1813 /* register_existing_vuid keeps the server info */
1814 sess_vuid = register_existing_vuid(sconn, sess_vuid,
1815 server_info,
1816 nt_resp.data ? nt_resp : lm_resp,
1817 sub_user);
1818 if (sess_vuid == UID_FIELD_INVALID) {
1819 data_blob_free(&nt_resp);
1820 data_blob_free(&lm_resp);
1821 reply_nterror(req, nt_status_squash(
1822 NT_STATUS_LOGON_FAILURE));
1823 END_PROFILE(SMBsesssetupX);
1824 return;
1825 }
1826
1827 /* current_user_info is changed on new vuid */
1828 reload_services( True );
1829 }
1830
1831 data_blob_free(&nt_resp);
1832 data_blob_free(&lm_resp);
1833
1834 SSVAL(req->outbuf,smb_uid,sess_vuid);
1835 SSVAL(req->inbuf,smb_uid,sess_vuid);
1836 req->vuid = sess_vuid;
1837
1838 if (!sconn->smb1.sessions.done_sesssetup) {
1839 sconn->smb1.sessions.max_send =
1840 MIN(sconn->smb1.sessions.max_send,smb_bufsize);
1841 }
1842 sconn->smb1.sessions.done_sesssetup = true;
1843
1844 END_PROFILE(SMBsesssetupX);
1845 chain_reply(req);
1846 return;
1847 }