2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/globals.h"
23 #include "../libcli/smb/smb_common.h"
24 #include "../libcli/auth/spnego.h"
26 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*req
,
27 uint64_t in_session_id
,
28 uint8_t in_security_mode
,
29 DATA_BLOB in_security_buffer
,
30 uint16_t *out_session_flags
,
31 DATA_BLOB
*out_security_buffer
,
32 uint64_t *out_session_id
);
34 NTSTATUS
smbd_smb2_request_process_sesssetup(struct smbd_smb2_request
*req
)
37 const uint8_t *inbody
;
38 int i
= req
->current_idx
;
42 size_t expected_body_size
= 0x19;
44 uint64_t in_session_id
;
45 uint8_t in_security_mode
;
46 uint16_t in_security_offset
;
47 uint16_t in_security_length
;
48 DATA_BLOB in_security_buffer
;
49 uint16_t out_session_flags
;
50 uint64_t out_session_id
;
51 uint16_t out_security_offset
;
52 DATA_BLOB out_security_buffer
;
55 inhdr
= (const uint8_t *)req
->in
.vector
[i
+0].iov_base
;
57 if (req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
58 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
61 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
63 body_size
= SVAL(inbody
, 0x00);
64 if (body_size
!= expected_body_size
) {
65 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
68 in_security_offset
= SVAL(inbody
, 0x0C);
69 in_security_length
= SVAL(inbody
, 0x0E);
71 if (in_security_offset
!= (SMB2_HDR_BODY
+ (body_size
& 0xFFFFFFFE))) {
72 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
75 if (in_security_length
> req
->in
.vector
[i
+2].iov_len
) {
76 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
79 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
80 in_security_mode
= CVAL(inbody
, 0x03);
81 in_security_buffer
.data
= (uint8_t *)req
->in
.vector
[i
+2].iov_base
;
82 in_security_buffer
.length
= in_security_length
;
84 status
= smbd_smb2_session_setup(req
,
91 if (!NT_STATUS_IS_OK(status
) &&
92 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
93 status
= nt_status_squash(status
);
94 return smbd_smb2_request_error(req
, status
);
97 out_security_offset
= SMB2_HDR_BODY
+ 0x08;
99 outhdr
= (uint8_t *)req
->out
.vector
[i
].iov_base
;
101 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x08);
102 if (outbody
.data
== NULL
) {
103 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
106 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, out_session_id
);
108 SSVAL(outbody
.data
, 0x00, 0x08 + 1); /* struct size */
109 SSVAL(outbody
.data
, 0x02,
110 out_session_flags
); /* session flags */
111 SSVAL(outbody
.data
, 0x04,
112 out_security_offset
); /* security buffer offset */
113 SSVAL(outbody
.data
, 0x06,
114 out_security_buffer
.length
); /* security buffer length */
116 outdyn
= out_security_buffer
;
118 return smbd_smb2_request_done_ex(req
, status
, outbody
, &outdyn
,
122 static int smbd_smb2_session_destructor(struct smbd_smb2_session
*session
)
124 if (session
->sconn
== NULL
) {
128 /* first free all tcons */
129 while (session
->tcons
.list
) {
130 talloc_free(session
->tcons
.list
);
133 idr_remove(session
->sconn
->smb2
.sessions
.idtree
, session
->vuid
);
134 DLIST_REMOVE(session
->sconn
->smb2
.sessions
.list
, session
);
135 invalidate_vuid(session
->sconn
, session
->vuid
);
138 session
->status
= NT_STATUS_USER_SESSION_DELETED
;
139 session
->sconn
= NULL
;
144 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*req
,
145 uint64_t in_session_id
,
146 uint8_t in_security_mode
,
147 DATA_BLOB in_security_buffer
,
148 uint16_t *out_session_flags
,
149 DATA_BLOB
*out_security_buffer
,
150 uint64_t *out_session_id
)
152 struct smbd_smb2_session
*session
;
155 *out_session_flags
= 0;
158 if (in_session_id
== 0) {
161 /* create a new session */
162 session
= talloc_zero(req
->sconn
, struct smbd_smb2_session
);
163 if (session
== NULL
) {
164 return NT_STATUS_NO_MEMORY
;
166 session
->status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
167 id
= idr_get_new_random(req
->sconn
->smb2
.sessions
.idtree
,
169 req
->sconn
->smb2
.sessions
.limit
);
171 return NT_STATUS_INSUFFICIENT_RESOURCES
;
175 session
->tcons
.idtree
= idr_init(session
);
176 if (session
->tcons
.idtree
== NULL
) {
177 return NT_STATUS_NO_MEMORY
;
179 session
->tcons
.limit
= 0x0000FFFE;
180 session
->tcons
.list
= NULL
;
182 DLIST_ADD_END(req
->sconn
->smb2
.sessions
.list
, session
,
183 struct smbd_smb2_session
*);
184 session
->sconn
= req
->sconn
;
185 talloc_set_destructor(session
, smbd_smb2_session_destructor
);
189 /* lookup an existing session */
190 p
= idr_find(req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
192 return NT_STATUS_USER_SESSION_DELETED
;
194 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
197 if (NT_STATUS_IS_OK(session
->status
)) {
198 return NT_STATUS_REQUEST_NOT_ACCEPTED
;
201 if (session
->auth_ntlmssp_state
== NULL
) {
202 status
= auth_ntlmssp_start(&session
->auth_ntlmssp_state
);
203 if (!NT_STATUS_IS_OK(status
)) {
204 TALLOC_FREE(session
);
209 if (in_security_buffer
.data
[0] == ASN1_APPLICATION(0)) {
210 DATA_BLOB secblob_in
;
212 char *kerb_mech
= NULL
;
214 status
= parse_spnego_mechanisms(in_security_buffer
,
215 &secblob_in
, &kerb_mech
);
216 if (!NT_STATUS_IS_OK(status
)) {
217 TALLOC_FREE(session
);
218 return nt_status_squash(status
);
221 /* For now, just SPNEGO NTLMSSP - krb5 goes here later.. */
222 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
226 if (!NT_STATUS_IS_OK(status
) &&
227 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
228 auth_ntlmssp_end(&session
->auth_ntlmssp_state
);
229 TALLOC_FREE(session
);
230 return nt_status_squash(status
);
233 *out_security_buffer
= spnego_gen_auth_response(&chal_out
,
234 status
, OID_NTLMSSP
);
236 *out_session_id
= session
->vuid
;
238 } else if (in_security_buffer
.data
[0] == ASN1_CONTEXT(1)) {
239 DATA_BLOB auth
= data_blob_null
;
240 DATA_BLOB auth_out
= data_blob_null
;
242 /* its an auth packet */
243 if (!spnego_parse_auth(in_security_buffer
, &auth
)) {
244 TALLOC_FREE(session
);
245 return NT_STATUS_LOGON_FAILURE
;
247 /* For now, just SPNEGO NTLMSSP - krb5 goes here later.. */
248 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
251 if (!NT_STATUS_IS_OK(status
)) {
252 auth_ntlmssp_end(&session
->auth_ntlmssp_state
);
253 TALLOC_FREE(session
);
254 return nt_status_squash(status
);
257 *out_security_buffer
= spnego_gen_auth_response(&auth_out
,
260 *out_session_id
= session
->vuid
;
261 } else if (strncmp((char *)(in_security_buffer
.data
), "NTLMSSP", 7) == 0) {
264 status
= auth_ntlmssp_update(session
->auth_ntlmssp_state
,
266 out_security_buffer
);
268 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
269 *out_session_id
= session
->vuid
;
272 if (!NT_STATUS_IS_OK(status
)) {
273 auth_ntlmssp_end(&session
->auth_ntlmssp_state
);
274 TALLOC_FREE(session
);
275 return nt_status_squash(status
);
277 *out_session_id
= session
->vuid
;
280 /* TODO: setup session key for signing */
282 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
283 lp_server_signing() == Required
) {
284 session
->do_signing
= true;
287 if (session
->auth_ntlmssp_state
->server_info
->guest
) {
288 /* we map anonymous to guest internally */
289 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
290 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
291 /* force no signing */
292 session
->do_signing
= false;
295 session
->server_info
= session
->auth_ntlmssp_state
->server_info
;
296 data_blob_free(&session
->server_info
->user_session_key
);
297 session
->server_info
->user_session_key
=
299 session
->server_info
,
300 session
->auth_ntlmssp_state
->ntlmssp_state
->session_key
.data
,
301 session
->auth_ntlmssp_state
->ntlmssp_state
->session_key
.length
);
302 if (session
->auth_ntlmssp_state
->ntlmssp_state
->session_key
.length
> 0) {
303 if (session
->server_info
->user_session_key
.data
== NULL
) {
304 TALLOC_FREE(session
);
305 return NT_STATUS_NO_MEMORY
;
308 session
->session_key
= session
->server_info
->user_session_key
;
310 session
->compat_vuser
= talloc_zero(session
, user_struct
);
311 if (session
->compat_vuser
== NULL
) {
312 TALLOC_FREE(session
);
313 return NT_STATUS_NO_MEMORY
;
315 session
->compat_vuser
->auth_ntlmssp_state
= session
->auth_ntlmssp_state
;
316 session
->compat_vuser
->homes_snum
= -1;
317 session
->compat_vuser
->server_info
= session
->server_info
;
318 session
->compat_vuser
->session_keystr
= NULL
;
319 session
->compat_vuser
->vuid
= session
->vuid
;
320 DLIST_ADD(session
->sconn
->smb1
.sessions
.validated_users
, session
->compat_vuser
);
322 session
->status
= NT_STATUS_OK
;
325 * we attach the session to the request
326 * so that the response can be signed
328 req
->session
= session
;
329 if (session
->do_signing
) {
330 req
->do_signing
= true;
333 *out_session_id
= session
->vuid
;
337 NTSTATUS
smbd_smb2_request_check_session(struct smbd_smb2_request
*req
)
339 const uint8_t *inhdr
;
340 int i
= req
->current_idx
;
341 uint64_t in_session_id
;
343 struct smbd_smb2_session
*session
;
345 inhdr
= (const uint8_t *)req
->in
.vector
[i
+0].iov_base
;
347 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
349 /* lookup an existing session */
350 p
= idr_find(req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
352 return NT_STATUS_USER_SESSION_DELETED
;
354 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
356 if (!NT_STATUS_IS_OK(session
->status
)) {
357 return NT_STATUS_ACCESS_DENIED
;
360 set_current_user_info(session
->server_info
->sanitized_username
,
361 session
->server_info
->unix_name
,
362 pdb_get_domain(session
->server_info
->sam_account
));
364 req
->session
= session
;
368 NTSTATUS
smbd_smb2_request_process_logoff(struct smbd_smb2_request
*req
)
370 const uint8_t *inbody
;
371 int i
= req
->current_idx
;
373 size_t expected_body_size
= 0x04;
376 if (req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
377 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
380 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
382 body_size
= SVAL(inbody
, 0x00);
383 if (body_size
!= expected_body_size
) {
384 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
388 * TODO: cancel all outstanding requests on the session
389 * and delete all tree connections.
391 smbd_smb2_session_destructor(req
->session
);
393 * we may need to sign the response, so we need to keep
394 * the session until the response is sent to the wire.
396 talloc_steal(req
, req
->session
);
398 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x04);
399 if (outbody
.data
== NULL
) {
400 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
403 SSVAL(outbody
.data
, 0x00, 0x04); /* struct size */
404 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
406 return smbd_smb2_request_done(req
, outbody
, NULL
);