?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'v3-2-test' of ssh://git.samba.org/data/git/samba into v3-2-test
[Samba/gebeck_regimport.git] / source / smbd / sesssetup.c
blobbc298d11f736af104c6213245cfe63bd81885c3e
1 /*
2 Unix SMB/CIFS implementation.
3 handle SMBsessionsetup
4 Copyright (C) Andrew Tridgell 1998-2001
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
7 Copyright (C) Luke Howard 2003
8 Copyright (C) Volker Lendecke 2007
9 Copyright (C) Jeremy Allison 2007
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26
27 extern struct auth_context *negprot_global_auth_context;
28 extern bool global_encrypted_passwords_negotiated;
29 extern bool global_spnego_negotiated;
30 extern enum protocol_types Protocol;
31 extern int max_send;
32
33 uint32 global_client_caps = 0;
34
35 /*
36 on a logon error possibly map the error to success if "map to guest"
37 is set approriately
38 */
39 static NTSTATUS do_map_to_guest(NTSTATUS status,
40 auth_serversupplied_info **server_info,
41 const char *user, const char *domain)
42 {
43 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
44 if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER) ||
45 (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD)) {
46 DEBUG(3,("No such user %s [%s] - using guest account\n",
47 user, domain));
48 status = make_server_info_guest(server_info);
49 }
50 }
51
52 if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
53 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD) {
54 DEBUG(3,("Registered username %s for guest access\n",
55 user));
56 status = make_server_info_guest(server_info);
57 }
58 }
59
60 return status;
61 }
62
63 /****************************************************************************
64 Add the standard 'Samba' signature to the end of the session setup.
65 ****************************************************************************/
66
67 static int push_signature(uint8 **outbuf)
68 {
69 char *lanman;
70 int result, tmp;
71
72 result = 0;
73
74 tmp = message_push_string(outbuf, "Unix", STR_TERMINATE);
75
76 if (tmp == -1) return -1;
77 result += tmp;
78
79 if (asprintf(&lanman, "Samba %s", SAMBA_VERSION_STRING) != -1) {
80 tmp = message_push_string(outbuf, lanman, STR_TERMINATE);
81 SAFE_FREE(lanman);
82 }
83 else {
84 tmp = message_push_string(outbuf, "Samba", STR_TERMINATE);
85 }
86
87 if (tmp == -1) return -1;
88 result += tmp;
89
90 tmp = message_push_string(outbuf, lp_workgroup(), STR_TERMINATE);
91
92 if (tmp == -1) return -1;
93 result += tmp;
94
95 return result;
96 }
97
98 /****************************************************************************
99 Start the signing engine if needed. Don't fail signing here.
100 ****************************************************************************/
101
102 static void sessionsetup_start_signing_engine(
103 const auth_serversupplied_info *server_info,
104 const uint8 *inbuf)
105 {
106 if (!server_info->guest && !srv_signing_started()) {
107 /* We need to start the signing engine
108 * here but a W2K client sends the old
109 * "BSRSPYL " signature instead of the
110 * correct one. Subsequent packets will
111 * be correct.
112 */
113 srv_check_sign_mac((char *)inbuf, False);
114 }
115 }
116
117 /****************************************************************************
118 Send a security blob via a session setup reply.
119 ****************************************************************************/
120
121 static void reply_sesssetup_blob(connection_struct *conn,
122 struct smb_request *req,
123 DATA_BLOB blob,
124 NTSTATUS nt_status)
125 {
126 if (!NT_STATUS_IS_OK(nt_status) &&
127 !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
128 reply_nterror(req, nt_status_squash(nt_status));
129 } else {
130 nt_status = nt_status_squash(nt_status);
131 SIVAL(req->outbuf, smb_rcls, NT_STATUS_V(nt_status));
132 SSVAL(req->outbuf, smb_vwv0, 0xFF); /* no chaining possible */
133 SSVAL(req->outbuf, smb_vwv3, blob.length);
134
135 if ((message_push_blob(&req->outbuf, blob) == -1)
136 || (push_signature(&req->outbuf) == -1)) {
137 reply_nterror(req, NT_STATUS_NO_MEMORY);
138 }
139 }
140
141 show_msg((char *)req->outbuf);
142 send_smb(smbd_server_fd(),(char *)req->outbuf);
143 TALLOC_FREE(req->outbuf);
144 }
145
146 /****************************************************************************
147 Do a 'guest' logon, getting back the
148 ****************************************************************************/
149
150 static NTSTATUS check_guest_password(auth_serversupplied_info **server_info)
151 {
152 struct auth_context *auth_context;
153 auth_usersupplied_info *user_info = NULL;
154
155 NTSTATUS nt_status;
156 unsigned char chal[8];
157
158 ZERO_STRUCT(chal);
159
160 DEBUG(3,("Got anonymous request\n"));
161
162 if (!NT_STATUS_IS_OK(nt_status = make_auth_context_fixed(&auth_context,
163 chal))) {
164 return nt_status;
165 }
166
167 if (!make_user_info_guest(&user_info)) {
168 (auth_context->free)(&auth_context);
169 return NT_STATUS_NO_MEMORY;
170 }
171
172 nt_status = auth_context->check_ntlm_password(auth_context,
173 user_info,
174 server_info);
175 (auth_context->free)(&auth_context);
176 free_user_info(&user_info);
177 return nt_status;
178 }
179
180
181 #ifdef HAVE_KRB5
182
183 #if 0
184 /* Experiment that failed. See "only happens with a KDC" comment below. */
185 /****************************************************************************
186 Cerate a clock skew error blob for a Windows client.
187 ****************************************************************************/
188
189 static bool make_krb5_skew_error(DATA_BLOB *pblob_out)
190 {
191 krb5_context context = NULL;
192 krb5_error_code kerr = 0;
193 krb5_data reply;
194 krb5_principal host_princ = NULL;
195 char *host_princ_s = NULL;
196 bool ret = False;
197
198 *pblob_out = data_blob_null;
199
200 initialize_krb5_error_table();
201 kerr = krb5_init_context(&context);
202 if (kerr) {
203 return False;
204 }
205 /* Create server principal. */
206 asprintf(&host_princ_s, "%s$@%s", global_myname(), lp_realm());
207 if (!host_princ_s) {
208 goto out;
209 }
210 strlower_m(host_princ_s);
211
212 kerr = smb_krb5_parse_name(context, host_princ_s, &host_princ);
213 if (kerr) {
214 DEBUG(10,("make_krb5_skew_error: smb_krb5_parse_name failed "
215 "for name %s: Error %s\n",
216 host_princ_s, error_message(kerr) ));
217 goto out;
218 }
219
220 kerr = smb_krb5_mk_error(context, KRB5KRB_AP_ERR_SKEW,
221 host_princ, &reply);
222 if (kerr) {
223 DEBUG(10,("make_krb5_skew_error: smb_krb5_mk_error "
224 "failed: Error %s\n",
225 error_message(kerr) ));
226 goto out;
227 }
228
229 *pblob_out = data_blob(reply.data, reply.length);
230 kerberos_free_data_contents(context,&reply);
231 ret = True;
232
233 out:
234
235 if (host_princ_s) {
236 SAFE_FREE(host_princ_s);
237 }
238 if (host_princ) {
239 krb5_free_principal(context, host_princ);
240 }
241 krb5_free_context(context);
242 return ret;
243 }
244 #endif
245
246 /****************************************************************************
247 Reply to a session setup spnego negotiate packet for kerberos.
248 ****************************************************************************/
249
250 static void reply_spnego_kerberos(connection_struct *conn,
251 struct smb_request *req,
252 DATA_BLOB *secblob,
253 uint16 vuid,
254 bool *p_invalidate_vuid)
255 {
256 TALLOC_CTX *mem_ctx;
257 DATA_BLOB ticket;
258 char *client, *p, *domain;
259 fstring netbios_domain_name;
260 struct passwd *pw;
261 fstring user;
262 int sess_vuid = req->vuid;
263 NTSTATUS ret = NT_STATUS_OK;
264 PAC_DATA *pac_data;
265 DATA_BLOB ap_rep, ap_rep_wrapped, response;
266 auth_serversupplied_info *server_info = NULL;
267 DATA_BLOB session_key = data_blob_null;
268 uint8 tok_id[2];
269 DATA_BLOB nullblob = data_blob_null;
270 fstring real_username;
271 bool map_domainuser_to_guest = False;
272 bool username_was_mapped;
273 PAC_LOGON_INFO *logon_info = NULL;
274
275 ZERO_STRUCT(ticket);
276 ZERO_STRUCT(pac_data);
277 ZERO_STRUCT(ap_rep);
278 ZERO_STRUCT(ap_rep_wrapped);
279 ZERO_STRUCT(response);
280
281 /* Normally we will always invalidate the intermediate vuid. */
282 *p_invalidate_vuid = True;
283
284 mem_ctx = talloc_init("reply_spnego_kerberos");
285 if (mem_ctx == NULL) {
286 reply_nterror(req, nt_status_squash(NT_STATUS_NO_MEMORY));
287 return;
288 }
289
290 if (!spnego_parse_krb5_wrap(*secblob, &ticket, tok_id)) {
291 talloc_destroy(mem_ctx);
292 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
293 return;
294 }
295
296 ret = ads_verify_ticket(mem_ctx, lp_realm(), 0, &ticket,
297 &client, &pac_data, &ap_rep,
298 &session_key, True);
299
300 data_blob_free(&ticket);
301
302 if (!NT_STATUS_IS_OK(ret)) {
303 #if 0
304 /* Experiment that failed.
305 * See "only happens with a KDC" comment below. */
306
307 if (NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
308
309 /*
310 * Windows in this case returns
311 * NT_STATUS_MORE_PROCESSING_REQUIRED
312 * with a negTokenTarg blob containing an krb5_error
313 * struct ASN1 encoded containing KRB5KRB_AP_ERR_SKEW.
314 * The client then fixes its clock and continues rather
315 * than giving an error. JRA.
316 * -- Looks like this only happens with a KDC. JRA.
317 */
318
319 bool ok = make_krb5_skew_error(&ap_rep);
320 if (!ok) {
321 talloc_destroy(mem_ctx);
322 return ERROR_NT(nt_status_squash(
323 NT_STATUS_LOGON_FAILURE));
324 }
325 ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
326 TOK_ID_KRB_ERROR);
327 response = spnego_gen_auth_response(&ap_rep_wrapped,
328 ret, OID_KERBEROS5_OLD);
329 reply_sesssetup_blob(conn, inbuf, outbuf, response,
330 NT_STATUS_MORE_PROCESSING_REQUIRED);
331
332 /*
333 * In this one case we don't invalidate the
334 * intermediate vuid as we're expecting the client
335 * to re-use it for the next sessionsetupX packet. JRA.
336 */
337
338 *p_invalidate_vuid = False;
339
340 data_blob_free(&ap_rep);
341 data_blob_free(&ap_rep_wrapped);
342 data_blob_free(&response);
343 talloc_destroy(mem_ctx);
344 return -1; /* already replied */
345 }
346 #else
347 if (!NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
348 ret = NT_STATUS_LOGON_FAILURE;
349 }
350 #endif
351 DEBUG(1,("Failed to verify incoming ticket with error %s!\n",
352 nt_errstr(ret)));
353 talloc_destroy(mem_ctx);
354 reply_nterror(req, nt_status_squash(ret));
355 return;
356 }
357
358 DEBUG(3,("Ticket name is [%s]\n", client));
359
360 p = strchr_m(client, '@');
361 if (!p) {
362 DEBUG(3,("Doesn't look like a valid principal\n"));
363 data_blob_free(&ap_rep);
364 data_blob_free(&session_key);
365 SAFE_FREE(client);
366 talloc_destroy(mem_ctx);
367 reply_nterror(req,nt_status_squash(NT_STATUS_LOGON_FAILURE));
368 return;
369 }
370
371 *p = 0;
372
373 /* save the PAC data if we have it */
374
375 if (pac_data) {
376 logon_info = get_logon_info_from_pac(pac_data);
377 if (logon_info) {
378 netsamlogon_cache_store( client, &logon_info->info3 );
379 }
380 }
381
382 if (!strequal(p+1, lp_realm())) {
383 DEBUG(3,("Ticket for foreign realm %s@%s\n", client, p+1));
384 if (!lp_allow_trusted_domains()) {
385 data_blob_free(&ap_rep);
386 data_blob_free(&session_key);
387 SAFE_FREE(client);
388 talloc_destroy(mem_ctx);
389 reply_nterror(req, nt_status_squash(
390 NT_STATUS_LOGON_FAILURE));
391 return;
392 }
393 }
394
395 /* this gives a fully qualified user name (ie. with full realm).
396 that leads to very long usernames, but what else can we do? */
397
398 domain = p+1;
399
400 if (logon_info && logon_info->info3.hdr_logon_dom.uni_str_len) {
401 unistr2_to_ascii(netbios_domain_name,
402 &logon_info->info3.uni_logon_dom,
403 sizeof(netbios_domain_name));
404 domain = netbios_domain_name;
405 DEBUG(10, ("Mapped to [%s] (using PAC)\n", domain));
406
407 } else {
408
409 /* If we have winbind running, we can (and must) shorten the
410 username by using the short netbios name. Otherwise we will
411 have inconsistent user names. With Kerberos, we get the
412 fully qualified realm, with ntlmssp we get the short
413 name. And even w2k3 does use ntlmssp if you for example
414 connect to an ip address. */
415
416 struct winbindd_request wb_request;
417 struct winbindd_response wb_response;
418 NSS_STATUS wb_result;
419
420 ZERO_STRUCT(wb_request);
421 ZERO_STRUCT(wb_response);
422
423 DEBUG(10, ("Mapping [%s] to short name\n", domain));
424
425 fstrcpy(wb_request.domain_name, domain);
426
427 wb_result = winbindd_request_response(WINBINDD_DOMAIN_INFO,
428 &wb_request, &wb_response);
429
430 if (wb_result == NSS_STATUS_SUCCESS) {
431
432 fstrcpy(netbios_domain_name,
433 wb_response.data.domain_info.name);
434 domain = netbios_domain_name;
435
436 DEBUG(10, ("Mapped to [%s] (using Winbind)\n", domain));
437 } else {
438 DEBUG(3, ("Could not find short name -- winbind "
439 "not running?\n"));
440 }
441 }
442
443 fstr_sprintf(user, "%s%c%s", domain, *lp_winbind_separator(), client);
444
445 /* lookup the passwd struct, create a new user if necessary */
446
447 username_was_mapped = map_username( user );
448
449 pw = smb_getpwnam( mem_ctx, user, real_username, True );
450
451 if (pw) {
452 /* if a real user check pam account restrictions */
453 /* only really perfomed if "obey pam restriction" is true */
454 /* do this before an eventual mappign to guest occurs */
455 ret = smb_pam_accountcheck(pw->pw_name);
456 if ( !NT_STATUS_IS_OK(ret)) {
457 DEBUG(1,("PAM account restriction "
458 "prevents user login\n"));
459 data_blob_free(&ap_rep);
460 data_blob_free(&session_key);
461 TALLOC_FREE(mem_ctx);
462 reply_nterror(req, nt_status_squash(ret));
463 return;
464 }
465 }
466
467 if (!pw) {
468
469 /* this was originally the behavior of Samba 2.2, if a user
470 did not have a local uid but has been authenticated, then
471 map them to a guest account */
472
473 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID){
474 map_domainuser_to_guest = True;
475 fstrcpy(user,lp_guestaccount());
476 pw = smb_getpwnam( mem_ctx, user, real_username, True );
477 }
478
479 /* extra sanity check that the guest account is valid */
480
481 if ( !pw ) {
482 DEBUG(1,("Username %s is invalid on this system\n",
483 user));
484 SAFE_FREE(client);
485 data_blob_free(&ap_rep);
486 data_blob_free(&session_key);
487 TALLOC_FREE(mem_ctx);
488 reply_nterror(req, nt_status_squash(
489 NT_STATUS_LOGON_FAILURE));
490 return;
491 }
492 }
493
494 /* setup the string used by %U */
495
496 sub_set_smb_name( real_username );
497 reload_services(True);
498
499 if ( map_domainuser_to_guest ) {
500 make_server_info_guest(&server_info);
501 } else if (logon_info) {
502 /* pass the unmapped username here since map_username()
503 will be called again from inside make_server_info_info3() */
504
505 ret = make_server_info_info3(mem_ctx, client, domain,
506 &server_info, &logon_info->info3);
507 if ( !NT_STATUS_IS_OK(ret) ) {
508 DEBUG(1,("make_server_info_info3 failed: %s!\n",
509 nt_errstr(ret)));
510 SAFE_FREE(client);
511 data_blob_free(&ap_rep);
512 data_blob_free(&session_key);
513 TALLOC_FREE(mem_ctx);
514 reply_nterror(req, nt_status_squash(ret));
515 return;
516 }
517
518 } else {
519 ret = make_server_info_pw(&server_info, real_username, pw);
520
521 if ( !NT_STATUS_IS_OK(ret) ) {
522 DEBUG(1,("make_server_info_pw failed: %s!\n",
523 nt_errstr(ret)));
524 SAFE_FREE(client);
525 data_blob_free(&ap_rep);
526 data_blob_free(&session_key);
527 TALLOC_FREE(mem_ctx);
528 reply_nterror(req, nt_status_squash(ret));
529 return;
530 }
531
532 /* make_server_info_pw does not set the domain. Without this
533 * we end up with the local netbios name in substitutions for
534 * %D. */
535
536 if (server_info->sam_account != NULL) {
537 pdb_set_domain(server_info->sam_account,
538 domain, PDB_SET);
539 }
540 }
541
542 server_info->was_mapped |= username_was_mapped;
543
544 /* we need to build the token for the user. make_server_info_guest()
545 already does this */
546
547 if ( !server_info->ptok ) {
548 ret = create_local_token( server_info );
549 if ( !NT_STATUS_IS_OK(ret) ) {
550 SAFE_FREE(client);
551 data_blob_free(&ap_rep);
552 data_blob_free(&session_key);
553 TALLOC_FREE( mem_ctx );
554 TALLOC_FREE( server_info );
555 reply_nterror(req, nt_status_squash(ret));
556 return;
557 }
558 }
559
560 /* register_existing_vuid keeps the server info */
561 /* register_existing_vuid takes ownership of session_key on success,
562 * no need to free after this on success. A better interface would copy
563 * it.... */
564
565 if (!is_partial_auth_vuid(sess_vuid)) {
566 sess_vuid = register_initial_vuid();
567 }
568 sess_vuid = register_existing_vuid(sess_vuid,
569 server_info,
570 session_key,
571 nullblob,
572 client);
573
574 SAFE_FREE(client);
575
576 reply_outbuf(req, 4, 0);
577 SSVAL(req->outbuf,smb_uid,sess_vuid);
578
579 if (sess_vuid == UID_FIELD_INVALID ) {
580 ret = NT_STATUS_LOGON_FAILURE;
581 data_blob_free(&session_key);
582 } else {
583 /* current_user_info is changed on new vuid */
584 reload_services( True );
585
586 SSVAL(req->outbuf, smb_vwv3, 0);
587
588 if (server_info->guest) {
589 SSVAL(req->outbuf,smb_vwv2,1);
590 }
591
592 SSVAL(req->outbuf, smb_uid, sess_vuid);
593
594 sessionsetup_start_signing_engine(server_info, req->inbuf);
595 /* Successful logon. Keep this vuid. */
596 *p_invalidate_vuid = False;
597 }
598
599 /* wrap that up in a nice GSS-API wrapping */
600 if (NT_STATUS_IS_OK(ret)) {
601 ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
602 TOK_ID_KRB_AP_REP);
603 } else {
604 ap_rep_wrapped = data_blob_null;
605 }
606 response = spnego_gen_auth_response(&ap_rep_wrapped, ret,
607 OID_KERBEROS5_OLD);
608 reply_sesssetup_blob(conn, req, response, ret);
609
610 data_blob_free(&ap_rep);
611 data_blob_free(&ap_rep_wrapped);
612 data_blob_free(&response);
613 TALLOC_FREE(mem_ctx);
614 }
615
616 #endif
617
618 /****************************************************************************
619 Send a session setup reply, wrapped in SPNEGO.
620 Get vuid and check first.
621 End the NTLMSSP exchange context if we are OK/complete fail
622 This should be split into two functions, one to handle each
623 leg of the NTLM auth steps.
624 ***************************************************************************/
625
626 static void reply_spnego_ntlmssp(connection_struct *conn,
627 struct smb_request *req,
628 uint16 vuid,
629 AUTH_NTLMSSP_STATE **auth_ntlmssp_state,
630 DATA_BLOB *ntlmssp_blob, NTSTATUS nt_status,
631 bool wrap)
632 {
633 DATA_BLOB response;
634 struct auth_serversupplied_info *server_info = NULL;
635
636 if (NT_STATUS_IS_OK(nt_status)) {
637 server_info = (*auth_ntlmssp_state)->server_info;
638 } else {
639 nt_status = do_map_to_guest(nt_status,
640 &server_info,
641 (*auth_ntlmssp_state)->ntlmssp_state->user,
642 (*auth_ntlmssp_state)->ntlmssp_state->domain);
643 }
644
645 reply_outbuf(req, 4, 0);
646
647 SSVAL(req->outbuf, smb_uid, vuid);
648
649 if (NT_STATUS_IS_OK(nt_status)) {
650 DATA_BLOB nullblob = data_blob_null;
651 DATA_BLOB session_key =
652 data_blob(
653 (*auth_ntlmssp_state)->ntlmssp_state->session_key.data,
654 (*auth_ntlmssp_state)->ntlmssp_state->session_key.length);
655
656 if (!is_partial_auth_vuid(vuid)) {
657 data_blob_free(&session_key);
658 nt_status = NT_STATUS_LOGON_FAILURE;
659 goto out;
660 }
661 /* register_existing_vuid keeps the server info */
662 if (register_existing_vuid(vuid,
663 server_info,
664 session_key, nullblob,
665 (*auth_ntlmssp_state)->ntlmssp_state->user) !=
666 vuid) {
667 data_blob_free(&session_key);
668 nt_status = NT_STATUS_LOGON_FAILURE;
669 goto out;
670 }
671
672 (*auth_ntlmssp_state)->server_info = NULL;
673
674 /* current_user_info is changed on new vuid */
675 reload_services( True );
676
677 SSVAL(req->outbuf, smb_vwv3, 0);
678
679 if (server_info->guest) {
680 SSVAL(req->outbuf,smb_vwv2,1);
681 }
682
683 sessionsetup_start_signing_engine(server_info,
684 (uint8 *)req->inbuf);
685 }
686
687 out:
688
689 if (wrap) {
690 response = spnego_gen_auth_response(ntlmssp_blob,
691 nt_status, OID_NTLMSSP);
692 } else {
693 response = *ntlmssp_blob;
694 }
695
696 reply_sesssetup_blob(conn, req, response, nt_status);
697 if (wrap) {
698 data_blob_free(&response);
699 }
700
701 /* NT_STATUS_MORE_PROCESSING_REQUIRED from our NTLMSSP code tells us,
702 and the other end, that we are not finished yet. */
703
704 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
705 /* NB. This is *NOT* an error case. JRA */
706 auth_ntlmssp_end(auth_ntlmssp_state);
707 if (!NT_STATUS_IS_OK(nt_status)) {
708 /* Kill the intermediate vuid */
709 invalidate_vuid(vuid);
710 }
711 }
712 }
713
714 /****************************************************************************
715 Is this a krb5 mechanism ?
716 ****************************************************************************/
717
718 NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, DATA_BLOB *pblob_out,
719 bool *p_is_krb5)
720 {
721 char *OIDs[ASN1_MAX_OIDS];
722 int i;
723
724 *p_is_krb5 = False;
725
726 /* parse out the OIDs and the first sec blob */
727 if (!parse_negTokenTarg(blob_in, OIDs, pblob_out)) {
728 return NT_STATUS_LOGON_FAILURE;
729 }
730
731 /* only look at the first OID for determining the mechToken --
732 according to RFC2478, we should choose the one we want
733 and renegotiate, but i smell a client bug here..
734
735 Problem observed when connecting to a member (samba box)
736 of an AD domain as a user in a Samba domain. Samba member
737 server sent back krb5/mskrb5/ntlmssp as mechtypes, but the
738 client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an
739 NTLMSSP mechtoken. --jerry */
740
741 #ifdef HAVE_KRB5
742 if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 ||
743 strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
744 *p_is_krb5 = True;
745 }
746 #endif
747
748 for (i=0;OIDs[i];i++) {
749 DEBUG(5,("parse_spnego_mechanisms: Got OID %s\n", OIDs[i]));
750 free(OIDs[i]);
751 }
752 return NT_STATUS_OK;
753 }
754
755 /****************************************************************************
756 Reply to a session setup spnego negotiate packet.
757 ****************************************************************************/
758
759 static void reply_spnego_negotiate(connection_struct *conn,
760 struct smb_request *req,
761 uint16 vuid,
762 DATA_BLOB blob1,
763 AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
764 {
765 DATA_BLOB secblob;
766 DATA_BLOB chal;
767 bool got_kerberos_mechanism = False;
768 NTSTATUS status;
769
770 status = parse_spnego_mechanisms(blob1, &secblob,
771 &got_kerberos_mechanism);
772 if (!NT_STATUS_IS_OK(status)) {
773 /* Kill the intermediate vuid */
774 invalidate_vuid(vuid);
775 reply_nterror(req, nt_status_squash(status));
776 return;
777 }
778
779 DEBUG(3,("reply_spnego_negotiate: Got secblob of size %lu\n",
780 (unsigned long)secblob.length));
781
782 #ifdef HAVE_KRB5
783 if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) ||
784 lp_use_kerberos_keytab()) ) {
785 bool destroy_vuid = True;
786 reply_spnego_kerberos(conn, req, &secblob, vuid,
787 &destroy_vuid);
788 data_blob_free(&secblob);
789 if (destroy_vuid) {
790 /* Kill the intermediate vuid */
791 invalidate_vuid(vuid);
792 }
793 return;
794 }
795 #endif
796
797 if (*auth_ntlmssp_state) {
798 auth_ntlmssp_end(auth_ntlmssp_state);
799 }
800
801 status = auth_ntlmssp_start(auth_ntlmssp_state);
802 if (!NT_STATUS_IS_OK(status)) {
803 /* Kill the intermediate vuid */
804 invalidate_vuid(vuid);
805 reply_nterror(req, nt_status_squash(status));
806 return;
807 }
808
809 status = auth_ntlmssp_update(*auth_ntlmssp_state,
810 secblob, &chal);
811
812 data_blob_free(&secblob);
813
814 reply_spnego_ntlmssp(conn, req, vuid, auth_ntlmssp_state,
815 &chal, status, True);
816
817 data_blob_free(&chal);
818
819 /* already replied */
820 return;
821 }
822
823 /****************************************************************************
824 Reply to a session setup spnego auth packet.
825 ****************************************************************************/
826
827 static void reply_spnego_auth(connection_struct *conn,
828 struct smb_request *req,
829 uint16 vuid,
830 DATA_BLOB blob1,
831 AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
832 {
833 DATA_BLOB auth = data_blob_null;
834 DATA_BLOB auth_reply = data_blob_null;
835 DATA_BLOB secblob = data_blob_null;
836 NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
837
838 if (!spnego_parse_auth(blob1, &auth)) {
839 #if 0
840 file_save("auth.dat", blob1.data, blob1.length);
841 #endif
842 /* Kill the intermediate vuid */
843 invalidate_vuid(vuid);
844
845 reply_nterror(req, nt_status_squash(
846 NT_STATUS_INVALID_PARAMETER));
847 return;
848 }
849
850 if (auth.data[0] == ASN1_APPLICATION(0)) {
851 /* Might be a second negTokenTarg packet */
852
853 bool got_krb5_mechanism = False;
854 status = parse_spnego_mechanisms(auth, &secblob,
855 &got_krb5_mechanism);
856 if (NT_STATUS_IS_OK(status)) {
857 DEBUG(3,("reply_spnego_auth: Got secblob of size %lu\n",
858 (unsigned long)secblob.length));
859 #ifdef HAVE_KRB5
860 if ( got_krb5_mechanism && ((lp_security()==SEC_ADS) ||
861 lp_use_kerberos_keytab()) ) {
862 bool destroy_vuid = True;
863 reply_spnego_kerberos(conn, req, &secblob,
864 vuid, &destroy_vuid);
865 data_blob_free(&secblob);
866 data_blob_free(&auth);
867 if (destroy_vuid) {
868 /* Kill the intermediate vuid */
869 invalidate_vuid(vuid);
870 }
871 return;
872 }
873 #endif
874 }
875 }
876
877 /* If we get here it wasn't a negTokenTarg auth packet. */
878 data_blob_free(&secblob);
879
880 if (!*auth_ntlmssp_state) {
881 /* Kill the intermediate vuid */
882 invalidate_vuid(vuid);
883
884 /* auth before negotiatiate? */
885 reply_nterror(req, nt_status_squash(
886 NT_STATUS_INVALID_PARAMETER));
887 return;
888 }
889
890 status = auth_ntlmssp_update(*auth_ntlmssp_state,
891 auth, &auth_reply);
892
893 data_blob_free(&auth);
894
895 reply_spnego_ntlmssp(conn, req, vuid,
896 auth_ntlmssp_state,
897 &auth_reply, status, True);
898
899 data_blob_free(&auth_reply);
900
901 /* and tell smbd that we have already replied to this packet */
902 return;
903 }
904
905 /****************************************************************************
906 List to store partial SPNEGO auth fragments.
907 ****************************************************************************/
908
909 static struct pending_auth_data *pd_list;
910
911 /****************************************************************************
912 Delete an entry on the list.
913 ****************************************************************************/
914
915 static void delete_partial_auth(struct pending_auth_data *pad)
916 {
917 if (!pad) {
918 return;
919 }
920 DLIST_REMOVE(pd_list, pad);
921 data_blob_free(&pad->partial_data);
922 SAFE_FREE(pad);
923 }
924
925 /****************************************************************************
926 Search for a partial SPNEGO auth fragment matching an smbpid.
927 ****************************************************************************/
928
929 static struct pending_auth_data *get_pending_auth_data(uint16 smbpid)
930 {
931 struct pending_auth_data *pad;
932
933 for (pad = pd_list; pad; pad = pad->next) {
934 if (pad->smbpid == smbpid) {
935 break;
936 }
937 }
938 return pad;
939 }
940
941 /****************************************************************************
942 Check the size of an SPNEGO blob. If we need more return
943 NT_STATUS_MORE_PROCESSING_REQUIRED, else return NT_STATUS_OK. Don't allow
944 the blob to be more than 64k.
945 ****************************************************************************/
946
947 static NTSTATUS check_spnego_blob_complete(uint16 smbpid, uint16 vuid,
948 DATA_BLOB *pblob)
949 {
950 struct pending_auth_data *pad = NULL;
951 ASN1_DATA data;
952 size_t needed_len = 0;
953
954 pad = get_pending_auth_data(smbpid);
955
956 /* Ensure we have some data. */
957 if (pblob->length == 0) {
958 /* Caller can cope. */
959 DEBUG(2,("check_spnego_blob_complete: zero blob length !\n"));
960 delete_partial_auth(pad);
961 return NT_STATUS_OK;
962 }
963
964 /* Were we waiting for more data ? */
965 if (pad) {
966 DATA_BLOB tmp_blob;
967 size_t copy_len = MIN(65536, pblob->length);
968
969 /* Integer wrap paranoia.... */
970
971 if (pad->partial_data.length + copy_len <
972 pad->partial_data.length ||
973 pad->partial_data.length + copy_len < copy_len) {
974
975 DEBUG(2,("check_spnego_blob_complete: integer wrap "
976 "pad->partial_data.length = %u, "
977 "copy_len = %u\n",
978 (unsigned int)pad->partial_data.length,
979 (unsigned int)copy_len ));
980
981 delete_partial_auth(pad);
982 return NT_STATUS_INVALID_PARAMETER;
983 }
984
985 DEBUG(10,("check_spnego_blob_complete: "
986 "pad->partial_data.length = %u, "
987 "pad->needed_len = %u, "
988 "copy_len = %u, "
989 "pblob->length = %u,\n",
990 (unsigned int)pad->partial_data.length,
991 (unsigned int)pad->needed_len,
992 (unsigned int)copy_len,
993 (unsigned int)pblob->length ));
994
995 tmp_blob = data_blob(NULL,
996 pad->partial_data.length + copy_len);
997
998 /* Concatenate the two (up to copy_len) bytes. */
999 memcpy(tmp_blob.data,
1000 pad->partial_data.data,
1001 pad->partial_data.length);
1002 memcpy(tmp_blob.data + pad->partial_data.length,
1003 pblob->data,
1004 copy_len);
1005
1006 /* Replace the partial data. */
1007 data_blob_free(&pad->partial_data);
1008 pad->partial_data = tmp_blob;
1009 ZERO_STRUCT(tmp_blob);
1010
1011 /* Are we done ? */
1012 if (pblob->length >= pad->needed_len) {
1013 /* Yes, replace pblob. */
1014 data_blob_free(pblob);
1015 *pblob = pad->partial_data;
1016 ZERO_STRUCT(pad->partial_data);
1017 delete_partial_auth(pad);
1018 return NT_STATUS_OK;
1019 }
1020
1021 /* Still need more data. */
1022 pad->needed_len -= copy_len;
1023 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1024 }
1025
1026 if ((pblob->data[0] != ASN1_APPLICATION(0)) &&
1027 (pblob->data[0] != ASN1_CONTEXT(1))) {
1028 /* Not something we can determine the
1029 * length of.
1030 */
1031 return NT_STATUS_OK;
1032 }
1033
1034 /* This is a new SPNEGO sessionsetup - see if
1035 * the data given in this blob is enough.
1036 */
1037
1038 asn1_load(&data, *pblob);
1039 asn1_start_tag(&data, pblob->data[0]);
1040 if (data.has_error || data.nesting == NULL) {
1041 asn1_free(&data);
1042 /* Let caller catch. */
1043 return NT_STATUS_OK;
1044 }
1045
1046 /* Integer wrap paranoia.... */
1047
1048 if (data.nesting->taglen + data.nesting->start < data.nesting->taglen ||
1049 data.nesting->taglen + data.nesting->start < data.nesting->start) {
1050
1051 DEBUG(2,("check_spnego_blob_complete: integer wrap "
1052 "data.nesting->taglen = %u, "
1053 "data.nesting->start = %u\n",
1054 (unsigned int)data.nesting->taglen,
1055 (unsigned int)data.nesting->start ));
1056
1057 asn1_free(&data);
1058 return NT_STATUS_INVALID_PARAMETER;
1059 }
1060
1061 /* Total length of the needed asn1 is the tag length
1062 * plus the current offset. */
1063
1064 needed_len = data.nesting->taglen + data.nesting->start;
1065 asn1_free(&data);
1066
1067 DEBUG(10,("check_spnego_blob_complete: needed_len = %u, "
1068 "pblob->length = %u\n",
1069 (unsigned int)needed_len,
1070 (unsigned int)pblob->length ));
1071
1072 if (needed_len <= pblob->length) {
1073 /* Nothing to do - blob is complete. */
1074 return NT_STATUS_OK;
1075 }
1076
1077 /* Refuse the blob if it's bigger than 64k. */
1078 if (needed_len > 65536) {
1079 DEBUG(2,("check_spnego_blob_complete: needed_len "
1080 "too large (%u)\n",
1081 (unsigned int)needed_len ));
1082 return NT_STATUS_INVALID_PARAMETER;
1083 }
1084
1085 /* We must store this blob until complete. */
1086 if (!(pad = SMB_MALLOC_P(struct pending_auth_data))) {
1087 return NT_STATUS_NO_MEMORY;
1088 }
1089 pad->needed_len = needed_len - pblob->length;
1090 pad->partial_data = data_blob(pblob->data, pblob->length);
1091 if (pad->partial_data.data == NULL) {
1092 SAFE_FREE(pad);
1093 return NT_STATUS_NO_MEMORY;
1094 }
1095 pad->smbpid = smbpid;
1096 pad->vuid = vuid;
1097 DLIST_ADD(pd_list, pad);
1098
1099 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1100 }
1101
1102 /****************************************************************************
1103 Reply to a session setup command.
1104 conn POINTER CAN BE NULL HERE !
1105 ****************************************************************************/
1106
1107 static void reply_sesssetup_and_X_spnego(connection_struct *conn,
1108 struct smb_request *req)
1109 {
1110 uint8 *p;
1111 DATA_BLOB blob1;
1112 size_t bufrem;
1113 fstring native_os, native_lanman, primary_domain;
1114 const char *p2;
1115 uint16 data_blob_len = SVAL(req->inbuf, smb_vwv7);
1116 enum remote_arch_types ra_type = get_remote_arch();
1117 int vuid = SVAL(req->inbuf,smb_uid);
1118 user_struct *vuser = NULL;
1119 NTSTATUS status = NT_STATUS_OK;
1120 uint16 smbpid = req->smbpid;
1121 uint16 smb_flag2 = req->flags2;
1122
1123 DEBUG(3,("Doing spnego session setup\n"));
1124
1125 if (global_client_caps == 0) {
1126 global_client_caps = IVAL(req->inbuf,smb_vwv10);
1127
1128 if (!(global_client_caps & CAP_STATUS32)) {
1129 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1130 }
1131
1132 }
1133
1134 p = (uint8 *)smb_buf(req->inbuf);
1135
1136 if (data_blob_len == 0) {
1137 /* an invalid request */
1138 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1139 return;
1140 }
1141
1142 bufrem = smb_bufrem(req->inbuf, p);
1143 /* pull the spnego blob */
1144 blob1 = data_blob(p, MIN(bufrem, data_blob_len));
1145
1146 #if 0
1147 file_save("negotiate.dat", blob1.data, blob1.length);
1148 #endif
1149
1150 p2 = (char *)req->inbuf + smb_vwv13 + data_blob_len;
1151 p2 += srvstr_pull_buf(req->inbuf, smb_flag2, native_os, p2,
1152 sizeof(native_os), STR_TERMINATE);
1153 p2 += srvstr_pull_buf(req->inbuf, smb_flag2, native_lanman, p2,
1154 sizeof(native_lanman), STR_TERMINATE);
1155 p2 += srvstr_pull_buf(req->inbuf, smb_flag2, primary_domain, p2,
1156 sizeof(primary_domain), STR_TERMINATE);
1157 DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
1158 native_os, native_lanman, primary_domain));
1159
1160 if ( ra_type == RA_WIN2K ) {
1161 /* Vista sets neither the OS or lanman strings */
1162
1163 if ( !strlen(native_os) && !strlen(native_lanman) )
1164 set_remote_arch(RA_VISTA);
1165
1166 /* Windows 2003 doesn't set the native lanman string,
1167 but does set primary domain which is a bug I think */
1168
1169 if ( !strlen(native_lanman) ) {
1170 ra_lanman_string( primary_domain );
1171 } else {
1172 ra_lanman_string( native_lanman );
1173 }
1174 }
1175
1176 /* Did we get a valid vuid ? */
1177 if (!is_partial_auth_vuid(vuid)) {
1178 /* No, then try and see if this is an intermediate sessionsetup
1179 * for a large SPNEGO packet. */
1180 struct pending_auth_data *pad = get_pending_auth_data(smbpid);
1181 if (pad) {
1182 DEBUG(10,("reply_sesssetup_and_X_spnego: found "
1183 "pending vuid %u\n",
1184 (unsigned int)pad->vuid ));
1185 vuid = pad->vuid;
1186 }
1187 }
1188
1189 /* Do we have a valid vuid now ? */
1190 if (!is_partial_auth_vuid(vuid)) {
1191 /* No, start a new authentication setup. */
1192 vuid = register_initial_vuid();
1193 if (vuid == UID_FIELD_INVALID) {
1194 data_blob_free(&blob1);
1195 reply_nterror(req, nt_status_squash(
1196 NT_STATUS_INVALID_PARAMETER));
1197 return;
1198 }
1199 }
1200
1201 vuser = get_partial_auth_user_struct(vuid);
1202 /* This MUST be valid. */
1203 if (!vuser) {
1204 smb_panic("reply_sesssetup_and_X_spnego: invalid vuid.");
1205 }
1206
1207 /* Large (greater than 4k) SPNEGO blobs are split into multiple
1208 * sessionsetup requests as the Windows limit on the security blob
1209 * field is 4k. Bug #4400. JRA.
1210 */
1211
1212 status = check_spnego_blob_complete(smbpid, vuid, &blob1);
1213 if (!NT_STATUS_IS_OK(status)) {
1214 if (!NT_STATUS_EQUAL(status,
1215 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1216 /* Real error - kill the intermediate vuid */
1217 invalidate_vuid(vuid);
1218 }
1219 data_blob_free(&blob1);
1220 reply_nterror(req, nt_status_squash(status));
1221 return;
1222 }
1223
1224 if (blob1.data[0] == ASN1_APPLICATION(0)) {
1225
1226 /* its a negTokenTarg packet */
1227
1228 reply_spnego_negotiate(conn, req, vuid, blob1,
1229 &vuser->auth_ntlmssp_state);
1230 data_blob_free(&blob1);
1231 return;
1232 }
1233
1234 if (blob1.data[0] == ASN1_CONTEXT(1)) {
1235
1236 /* its a auth packet */
1237
1238 reply_spnego_auth(conn, req, vuid, blob1,
1239 &vuser->auth_ntlmssp_state);
1240 data_blob_free(&blob1);
1241 return;
1242 }
1243
1244 if (strncmp((char *)(blob1.data), "NTLMSSP", 7) == 0) {
1245 DATA_BLOB chal;
1246
1247 if (!vuser->auth_ntlmssp_state) {
1248 status = auth_ntlmssp_start(&vuser->auth_ntlmssp_state);
1249 if (!NT_STATUS_IS_OK(status)) {
1250 /* Kill the intermediate vuid */
1251 invalidate_vuid(vuid);
1252 data_blob_free(&blob1);
1253 reply_nterror(req, nt_status_squash(status));
1254 return;
1255 }
1256 }
1257
1258 status = auth_ntlmssp_update(vuser->auth_ntlmssp_state,
1259 blob1, &chal);
1260
1261 data_blob_free(&blob1);
1262
1263 reply_spnego_ntlmssp(conn, req, vuid,
1264 &vuser->auth_ntlmssp_state,
1265 &chal, status, False);
1266 data_blob_free(&chal);
1267 return;
1268 }
1269
1270 /* what sort of packet is this? */
1271 DEBUG(1,("Unknown packet in reply_sesssetup_and_X_spnego\n"));
1272
1273 data_blob_free(&blob1);
1274
1275 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1276 }
1277
1278 /****************************************************************************
1279 On new VC == 0, shutdown *all* old connections and users.
1280 It seems that only NT4.x does this. At W2K and above (XP etc.).
1281 a new session setup with VC==0 is ignored.
1282 ****************************************************************************/
1283
1284 static int shutdown_other_smbds(struct db_record *rec,
1285 const struct connections_key *key,
1286 const struct connections_data *crec,
1287 void *private_data)
1288 {
1289 const char *ip = (const char *)private_data;
1290
1291 if (!process_exists(crec->pid)) {
1292 return 0;
1293 }
1294
1295 if (procid_is_me(&crec->pid)) {
1296 return 0;
1297 }
1298
1299 if (strcmp(ip, crec->addr) != 0) {
1300 return 0;
1301 }
1302
1303 messaging_send(smbd_messaging_context(), crec->pid, MSG_SHUTDOWN,
1304 &data_blob_null);
1305 return 0;
1306 }
1307
1308 static void setup_new_vc_session(void)
1309 {
1310 DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x "
1311 "compatible we would close all old resources.\n"));
1312 #if 0
1313 conn_close_all();
1314 invalidate_all_vuids();
1315 #endif
1316 if (lp_reset_on_zero_vc()) {
1317 connections_forall(shutdown_other_smbds,
1318 CONST_DISCARD(void *,client_addr()));
1319 }
1320 }
1321
1322 /****************************************************************************
1323 Reply to a session setup command.
1324 ****************************************************************************/
1325
1326 void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
1327 {
1328 int sess_vuid;
1329 int smb_bufsize;
1330 DATA_BLOB lm_resp;
1331 DATA_BLOB nt_resp;
1332 DATA_BLOB plaintext_password;
1333 fstring user;
1334 fstring sub_user; /* Sainitised username for substituion */
1335 fstring domain;
1336 fstring native_os;
1337 fstring native_lanman;
1338 fstring primary_domain;
1339 static bool done_sesssetup = False;
1340 auth_usersupplied_info *user_info = NULL;
1341 auth_serversupplied_info *server_info = NULL;
1342 uint16 smb_flag2 = req->flags2;
1343
1344 NTSTATUS nt_status;
1345
1346 bool doencrypt = global_encrypted_passwords_negotiated;
1347
1348 DATA_BLOB session_key;
1349
1350 START_PROFILE(SMBsesssetupX);
1351
1352 ZERO_STRUCT(lm_resp);
1353 ZERO_STRUCT(nt_resp);
1354 ZERO_STRUCT(plaintext_password);
1355
1356 DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
1357
1358 /* a SPNEGO session setup has 12 command words, whereas a normal
1359 NT1 session setup has 13. See the cifs spec. */
1360 if (req->wct == 12 &&
1361 (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
1362
1363 if (!global_spnego_negotiated) {
1364 DEBUG(0,("reply_sesssetup_and_X: Rejecting attempt "
1365 "at SPNEGO session setup when it was not "
1366 "negotiated.\n"));
1367 reply_nterror(req, nt_status_squash(
1368 NT_STATUS_LOGON_FAILURE));
1369 END_PROFILE(SMBsesssetupX);
1370 return;
1371 }
1372
1373 if (SVAL(req->inbuf,smb_vwv4) == 0) {
1374 setup_new_vc_session();
1375 }
1376
1377 reply_sesssetup_and_X_spnego(conn, req);
1378 END_PROFILE(SMBsesssetupX);
1379 return;
1380 }
1381
1382 smb_bufsize = SVAL(req->inbuf,smb_vwv2);
1383
1384 if (Protocol < PROTOCOL_NT1) {
1385 uint16 passlen1 = SVAL(req->inbuf,smb_vwv7);
1386
1387 /* Never do NT status codes with protocols before NT1 as we
1388 * don't get client caps. */
1389 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1390
1391 if ((passlen1 > MAX_PASS_LEN)
1392 || (passlen1 > smb_bufrem(req->inbuf,
1393 smb_buf(req->inbuf)))) {
1394 reply_nterror(req, nt_status_squash(
1395 NT_STATUS_INVALID_PARAMETER));
1396 END_PROFILE(SMBsesssetupX);
1397 return;
1398 }
1399
1400 if (doencrypt) {
1401 lm_resp = data_blob(smb_buf(req->inbuf), passlen1);
1402 } else {
1403 plaintext_password = data_blob(smb_buf(req->inbuf),
1404 passlen1+1);
1405 /* Ensure null termination */
1406 plaintext_password.data[passlen1] = 0;
1407 }
1408
1409 srvstr_pull_buf(req->inbuf, req->flags2, user,
1410 smb_buf(req->inbuf)+passlen1, sizeof(user),
1411 STR_TERMINATE);
1412 *domain = 0;
1413
1414 } else {
1415 uint16 passlen1 = SVAL(req->inbuf,smb_vwv7);
1416 uint16 passlen2 = SVAL(req->inbuf,smb_vwv8);
1417 enum remote_arch_types ra_type = get_remote_arch();
1418 char *p = smb_buf(req->inbuf);
1419 char *save_p = smb_buf(req->inbuf);
1420 uint16 byte_count;
1421
1422
1423 if(global_client_caps == 0) {
1424 global_client_caps = IVAL(req->inbuf,smb_vwv11);
1425
1426 if (!(global_client_caps & CAP_STATUS32)) {
1427 remove_from_common_flags2(
1428 FLAGS2_32_BIT_ERROR_CODES);
1429 }
1430
1431 /* client_caps is used as final determination if
1432 * client is NT or Win95. This is needed to return
1433 * the correct error codes in some circumstances.
1434 */
1435
1436 if(ra_type == RA_WINNT || ra_type == RA_WIN2K ||
1437 ra_type == RA_WIN95) {
1438 if(!(global_client_caps & (CAP_NT_SMBS|
1439 CAP_STATUS32))) {
1440 set_remote_arch( RA_WIN95);
1441 }
1442 }
1443 }
1444
1445 if (!doencrypt) {
1446 /* both Win95 and WinNT stuff up the password
1447 * lengths for non-encrypting systems. Uggh.
1448
1449 if passlen1==24 its a win95 system, and its setting
1450 the password length incorrectly. Luckily it still
1451 works with the default code because Win95 will null
1452 terminate the password anyway
1453
1454 if passlen1>0 and passlen2>0 then maybe its a NT box
1455 and its setting passlen2 to some random value which
1456 really stuffs things up. we need to fix that one. */
1457
1458 if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 &&
1459 passlen2 != 1) {
1460 passlen2 = 0;
1461 }
1462 }
1463
1464 /* check for nasty tricks */
1465 if (passlen1 > MAX_PASS_LEN
1466 || passlen1 > smb_bufrem(req->inbuf, p)) {
1467 reply_nterror(req, nt_status_squash(
1468 NT_STATUS_INVALID_PARAMETER));
1469 END_PROFILE(SMBsesssetupX);
1470 return;
1471 }
1472
1473 if (passlen2 > MAX_PASS_LEN
1474 || passlen2 > smb_bufrem(req->inbuf, p+passlen1)) {
1475 reply_nterror(req, nt_status_squash(
1476 NT_STATUS_INVALID_PARAMETER));
1477 END_PROFILE(SMBsesssetupX);
1478 return;
1479 }
1480
1481 /* Save the lanman2 password and the NT md4 password. */
1482
1483 if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
1484 doencrypt = False;
1485 }
1486
1487 if (doencrypt) {
1488 lm_resp = data_blob(p, passlen1);
1489 nt_resp = data_blob(p+passlen1, passlen2);
1490 } else {
1491 pstring pass;
1492 bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
1493
1494 #if 0
1495 /* This was the previous fix. Not sure if it's still
1496 * valid. JRA. */
1497 if ((ra_type == RA_WINNT) && (passlen2 == 0)
1498 && unic && passlen1) {
1499 /* NT4.0 stuffs up plaintext unicode password
1500 * lengths... */
1501 srvstr_pull(inbuf, pass, smb_buf(inbuf) + 1,
1502 sizeof(pass), passlen1, STR_TERMINATE);
1503 #endif
1504
1505 if (unic && (passlen2 == 0) && passlen1) {
1506 /* Only a ascii plaintext password was sent. */
1507 srvstr_pull(req->inbuf, req->flags2, pass,
1508 smb_buf(req->inbuf), sizeof(pass),
1509 passlen1, STR_TERMINATE|STR_ASCII);
1510 } else {
1511 srvstr_pull(req->inbuf, req->flags2, pass,
1512 smb_buf(req->inbuf), sizeof(pass),
1513 unic ? passlen2 : passlen1,
1514 STR_TERMINATE);
1515 }
1516 plaintext_password = data_blob(pass, strlen(pass)+1);
1517 }
1518
1519 p += passlen1 + passlen2;
1520 p += srvstr_pull_buf(req->inbuf, req->flags2, user, p,
1521 sizeof(user), STR_TERMINATE);
1522 p += srvstr_pull_buf(req->inbuf, req->flags2, domain, p,
1523 sizeof(domain), STR_TERMINATE);
1524 p += srvstr_pull_buf(req->inbuf, req->flags2, native_os,
1525 p, sizeof(native_os), STR_TERMINATE);
1526 p += srvstr_pull_buf(req->inbuf, req->flags2,
1527 native_lanman, p, sizeof(native_lanman),
1528 STR_TERMINATE);
1529
1530 /* not documented or decoded by Ethereal but there is one more
1531 * string in the extra bytes which is the same as the
1532 * PrimaryDomain when using extended security. Windows NT 4
1533 * and 2003 use this string to store the native lanman string.
1534 * Windows 9x does not include a string here at all so we have
1535 * to check if we have any extra bytes left */
1536
1537 byte_count = SVAL(req->inbuf, smb_vwv13);
1538 if ( PTR_DIFF(p, save_p) < byte_count) {
1539 p += srvstr_pull_buf(req->inbuf, req->flags2,
1540 primary_domain, p,
1541 sizeof(primary_domain),
1542 STR_TERMINATE);
1543 } else {
1544 fstrcpy( primary_domain, "null" );
1545 }
1546
1547 DEBUG(3,("Domain=[%s] NativeOS=[%s] NativeLanMan=[%s] "
1548 "PrimaryDomain=[%s]\n",
1549 domain, native_os, native_lanman, primary_domain));
1550
1551 if ( ra_type == RA_WIN2K ) {
1552 if ( strlen(native_lanman) == 0 )
1553 ra_lanman_string( primary_domain );
1554 else
1555 ra_lanman_string( native_lanman );
1556 }
1557
1558 }
1559
1560 if (SVAL(req->inbuf,smb_vwv4) == 0) {
1561 setup_new_vc_session();
1562 }
1563
1564 DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
1565 domain, user, get_remote_machine_name()));
1566
1567 if (*user) {
1568 if (global_spnego_negotiated) {
1569
1570 /* This has to be here, because this is a perfectly
1571 * valid behaviour for guest logons :-( */
1572
1573 DEBUG(0,("reply_sesssetup_and_X: Rejecting attempt "
1574 "at 'normal' session setup after "
1575 "negotiating spnego.\n"));
1576 reply_nterror(req, nt_status_squash(
1577 NT_STATUS_LOGON_FAILURE));
1578 END_PROFILE(SMBsesssetupX);
1579 return;
1580 }
1581 fstrcpy(sub_user, user);
1582 } else {
1583 fstrcpy(sub_user, lp_guestaccount());
1584 }
1585
1586 sub_set_smb_name(sub_user);
1587
1588 reload_services(True);
1589
1590 if (lp_security() == SEC_SHARE) {
1591 /* in share level we should ignore any passwords */
1592
1593 data_blob_free(&lm_resp);
1594 data_blob_free(&nt_resp);
1595 data_blob_clear_free(&plaintext_password);
1596
1597 map_username(sub_user);
1598 add_session_user(sub_user);
1599 add_session_workgroup(domain);
1600 /* Then force it to null for the benfit of the code below */
1601 *user = 0;
1602 }
1603
1604 if (!*user) {
1605
1606 nt_status = check_guest_password(&server_info);
1607
1608 } else if (doencrypt) {
1609 if (!negprot_global_auth_context) {
1610 DEBUG(0, ("reply_sesssetup_and_X: Attempted encrypted "
1611 "session setup without negprot denied!\n"));
1612 reply_nterror(req, nt_status_squash(
1613 NT_STATUS_LOGON_FAILURE));
1614 END_PROFILE(SMBsesssetupX);
1615 return;
1616 }
1617 nt_status = make_user_info_for_reply_enc(&user_info, user,
1618 domain,
1619 lm_resp, nt_resp);
1620 if (NT_STATUS_IS_OK(nt_status)) {
1621 nt_status = negprot_global_auth_context->check_ntlm_password(
1622 negprot_global_auth_context,
1623 user_info,
1624 &server_info);
1625 }
1626 } else {
1627 struct auth_context *plaintext_auth_context = NULL;
1628 const uint8 *chal;
1629
1630 nt_status = make_auth_context_subsystem(
1631 &plaintext_auth_context);
1632
1633 if (NT_STATUS_IS_OK(nt_status)) {
1634 chal = plaintext_auth_context->get_ntlm_challenge(
1635 plaintext_auth_context);
1636
1637 if (!make_user_info_for_reply(&user_info,
1638 user, domain, chal,
1639 plaintext_password)) {
1640 nt_status = NT_STATUS_NO_MEMORY;
1641 }
1642
1643 if (NT_STATUS_IS_OK(nt_status)) {
1644 nt_status = plaintext_auth_context->check_ntlm_password(
1645 plaintext_auth_context,
1646 user_info,
1647 &server_info);
1648
1649 (plaintext_auth_context->free)(
1650 &plaintext_auth_context);
1651 }
1652 }
1653 }
1654
1655 free_user_info(&user_info);
1656
1657 if (!NT_STATUS_IS_OK(nt_status)) {
1658 nt_status = do_map_to_guest(nt_status, &server_info,
1659 user, domain);
1660 }
1661
1662 if (!NT_STATUS_IS_OK(nt_status)) {
1663 data_blob_free(&nt_resp);
1664 data_blob_free(&lm_resp);
1665 data_blob_clear_free(&plaintext_password);
1666 reply_nterror(req, nt_status_squash(nt_status));
1667 END_PROFILE(SMBsesssetupX);
1668 return;
1669 }
1670
1671 /* Ensure we can't possible take a code path leading to a
1672 * null defref. */
1673 if (!server_info) {
1674 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1675 END_PROFILE(SMBsesssetupX);
1676 return;
1677 }
1678
1679 nt_status = create_local_token(server_info);
1680 if (!NT_STATUS_IS_OK(nt_status)) {
1681 DEBUG(10, ("create_local_token failed: %s\n",
1682 nt_errstr(nt_status)));
1683 data_blob_free(&nt_resp);
1684 data_blob_free(&lm_resp);
1685 data_blob_clear_free(&plaintext_password);
1686 reply_nterror(req, nt_status_squash(nt_status));
1687 END_PROFILE(SMBsesssetupX);
1688 return;
1689 }
1690
1691 if (server_info->user_session_key.data) {
1692 session_key = data_blob(server_info->user_session_key.data,
1693 server_info->user_session_key.length);
1694 } else {
1695 session_key = data_blob_null;
1696 }
1697
1698 data_blob_clear_free(&plaintext_password);
1699
1700 /* it's ok - setup a reply */
1701 reply_outbuf(req, 3, 0);
1702 if (Protocol >= PROTOCOL_NT1) {
1703 push_signature(&req->outbuf);
1704 /* perhaps grab OS version here?? */
1705 }
1706
1707 if (server_info->guest) {
1708 SSVAL(req->outbuf,smb_vwv2,1);
1709 }
1710
1711 /* register the name and uid as being validated, so further connections
1712 to a uid can get through without a password, on the same VC */
1713
1714 if (lp_security() == SEC_SHARE) {
1715 sess_vuid = UID_FIELD_INVALID;
1716 data_blob_free(&session_key);
1717 TALLOC_FREE(server_info);
1718 } else {
1719 /* Ignore the initial vuid. */
1720 sess_vuid = register_initial_vuid();
1721 if (sess_vuid == UID_FIELD_INVALID) {
1722 data_blob_free(&nt_resp);
1723 data_blob_free(&lm_resp);
1724 data_blob_free(&session_key);
1725 reply_nterror(req, nt_status_squash(
1726 NT_STATUS_LOGON_FAILURE));
1727 END_PROFILE(SMBsesssetupX);
1728 return;
1729 }
1730 /* register_existing_vuid keeps the server info */
1731 sess_vuid = register_existing_vuid(sess_vuid,
1732 server_info,
1733 session_key,
1734 nt_resp.data ? nt_resp : lm_resp,
1735 sub_user);
1736 if (sess_vuid == UID_FIELD_INVALID) {
1737 data_blob_free(&nt_resp);
1738 data_blob_free(&lm_resp);
1739 data_blob_free(&session_key);
1740 reply_nterror(req, nt_status_squash(
1741 NT_STATUS_LOGON_FAILURE));
1742 END_PROFILE(SMBsesssetupX);
1743 return;
1744 }
1745
1746 /* current_user_info is changed on new vuid */
1747 reload_services( True );
1748
1749 sessionsetup_start_signing_engine(server_info, req->inbuf);
1750 }
1751
1752 data_blob_free(&nt_resp);
1753 data_blob_free(&lm_resp);
1754
1755 SSVAL(req->outbuf,smb_uid,sess_vuid);
1756 SSVAL(req->inbuf,smb_uid,sess_vuid);
1757
1758 if (!done_sesssetup)
1759 max_send = MIN(max_send,smb_bufsize);
1760
1761 done_sesssetup = True;
1762
1763 END_PROFILE(SMBsesssetupX);
1764 chain_reply(req);
1765 return;
1766 }
reg import