2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
31 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
32 uint64_t in_session_id
,
33 uint8_t in_security_mode
,
34 DATA_BLOB in_security_buffer
,
35 uint16_t *out_session_flags
,
36 DATA_BLOB
*out_security_buffer
,
37 uint64_t *out_session_id
);
39 NTSTATUS
smbd_smb2_request_process_sesssetup(struct smbd_smb2_request
*smb2req
)
42 const uint8_t *inbody
;
43 int i
= smb2req
->current_idx
;
47 uint64_t in_session_id
;
48 uint8_t in_security_mode
;
49 uint16_t in_security_offset
;
50 uint16_t in_security_length
;
51 DATA_BLOB in_security_buffer
;
52 uint16_t out_session_flags
;
53 uint64_t out_session_id
;
54 uint16_t out_security_offset
;
55 DATA_BLOB out_security_buffer
= data_blob_null
;
58 status
= smbd_smb2_request_verify_sizes(smb2req
, 0x19);
59 if (!NT_STATUS_IS_OK(status
)) {
60 return smbd_smb2_request_error(smb2req
, status
);
62 inhdr
= (const uint8_t *)smb2req
->in
.vector
[i
+0].iov_base
;
63 inbody
= (const uint8_t *)smb2req
->in
.vector
[i
+1].iov_base
;
65 in_security_offset
= SVAL(inbody
, 0x0C);
66 in_security_length
= SVAL(inbody
, 0x0E);
68 if (in_security_offset
!= (SMB2_HDR_BODY
+ smb2req
->in
.vector
[i
+1].iov_len
)) {
69 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
72 if (in_security_length
> smb2req
->in
.vector
[i
+2].iov_len
) {
73 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
76 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
77 in_security_mode
= CVAL(inbody
, 0x03);
78 in_security_buffer
.data
= (uint8_t *)smb2req
->in
.vector
[i
+2].iov_base
;
79 in_security_buffer
.length
= in_security_length
;
81 status
= smbd_smb2_session_setup(smb2req
,
88 if (!NT_STATUS_IS_OK(status
) &&
89 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
90 status
= nt_status_squash(status
);
91 return smbd_smb2_request_error(smb2req
, status
);
94 out_security_offset
= SMB2_HDR_BODY
+ 0x08;
96 outhdr
= (uint8_t *)smb2req
->out
.vector
[i
].iov_base
;
98 outbody
= data_blob_talloc(smb2req
->out
.vector
, NULL
, 0x08);
99 if (outbody
.data
== NULL
) {
100 return smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
103 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, out_session_id
);
105 SSVAL(outbody
.data
, 0x00, 0x08 + 1); /* struct size */
106 SSVAL(outbody
.data
, 0x02,
107 out_session_flags
); /* session flags */
108 SSVAL(outbody
.data
, 0x04,
109 out_security_offset
); /* security buffer offset */
110 SSVAL(outbody
.data
, 0x06,
111 out_security_buffer
.length
); /* security buffer length */
113 outdyn
= out_security_buffer
;
115 return smbd_smb2_request_done_ex(smb2req
, status
, outbody
, &outdyn
,
119 static int smbd_smb2_session_destructor(struct smbd_smb2_session
*session
)
121 if (session
->sconn
== NULL
) {
125 file_close_user(session
->sconn
, session
->vuid
);
127 /* first free all tcons */
128 while (session
->tcons
.list
) {
129 talloc_free(session
->tcons
.list
);
132 idr_remove(session
->sconn
->smb2
.sessions
.idtree
, session
->vuid
);
133 DLIST_REMOVE(session
->sconn
->smb2
.sessions
.list
, session
);
134 invalidate_vuid(session
->sconn
, session
->vuid
);
137 session
->status
= NT_STATUS_USER_SESSION_DELETED
;
138 session
->sconn
= NULL
;
143 static NTSTATUS
smbd_smb2_auth_generic_return(struct smbd_smb2_session
*session
,
144 struct smbd_smb2_request
*smb2req
,
145 uint8_t in_security_mode
,
146 DATA_BLOB in_security_buffer
,
147 uint16_t *out_session_flags
,
148 uint64_t *out_session_id
)
152 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
153 lp_server_signing() == SMB_SIGNING_REQUIRED
) {
154 session
->do_signing
= true;
157 if (security_session_user_level(session
->session_info
, NULL
) < SECURITY_USER
) {
158 /* we map anonymous to guest internally */
159 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
160 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
161 /* force no signing */
162 session
->do_signing
= false;
166 session
->session_key
= session
->session_info
->session_key
;
168 session
->compat_vuser
= talloc_zero(session
, user_struct
);
169 if (session
->compat_vuser
== NULL
) {
170 TALLOC_FREE(session
);
171 return NT_STATUS_NO_MEMORY
;
173 session
->compat_vuser
->gensec_security
= session
->gensec_security
;
174 session
->compat_vuser
->homes_snum
= -1;
175 session
->compat_vuser
->session_info
= session
->session_info
;
176 session
->compat_vuser
->session_keystr
= NULL
;
177 session
->compat_vuser
->vuid
= session
->vuid
;
178 DLIST_ADD(session
->sconn
->users
, session
->compat_vuser
);
179 session
->sconn
->num_users
++;
181 if (security_session_user_level(session
->session_info
, NULL
) >= SECURITY_USER
) {
182 session
->compat_vuser
->homes_snum
=
183 register_homes_share(session
->session_info
->unix_info
->unix_name
);
186 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
187 DEBUG(1, ("smb2: Failed to claim session "
189 session
->compat_vuser
->vuid
));
190 TALLOC_FREE(session
);
191 return NT_STATUS_LOGON_FAILURE
;
194 set_current_user_info(session
->session_info
->unix_info
->sanitized_username
,
195 session
->session_info
->unix_info
->unix_name
,
196 session
->session_info
->info
->domain_name
);
198 reload_services(smb2req
->sconn
, conn_snum_used
, true);
200 session
->status
= NT_STATUS_OK
;
203 * we attach the session to the request
204 * so that the response can be signed
206 smb2req
->session
= session
;
208 smb2req
->do_signing
= true;
211 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
213 *out_session_id
= session
->vuid
;
218 static NTSTATUS
smbd_smb2_auth_generic(struct smbd_smb2_session
*session
,
219 struct smbd_smb2_request
*smb2req
,
220 uint8_t in_security_mode
,
221 DATA_BLOB in_security_buffer
,
222 uint16_t *out_session_flags
,
223 DATA_BLOB
*out_security_buffer
,
224 uint64_t *out_session_id
)
228 *out_security_buffer
= data_blob_null
;
230 if (session
->gensec_security
== NULL
) {
231 status
= auth_generic_prepare(session
, session
->sconn
->remote_address
,
232 &session
->gensec_security
);
233 if (!NT_STATUS_IS_OK(status
)) {
234 TALLOC_FREE(session
);
238 gensec_want_feature(session
->gensec_security
, GENSEC_FEATURE_SESSION_KEY
);
239 gensec_want_feature(session
->gensec_security
, GENSEC_FEATURE_UNIX_TOKEN
);
241 status
= gensec_start_mech_by_oid(session
->gensec_security
, GENSEC_OID_SPNEGO
);
242 if (!NT_STATUS_IS_OK(status
)) {
243 TALLOC_FREE(session
);
249 status
= gensec_update(session
->gensec_security
,
252 out_security_buffer
);
254 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
) &&
255 !NT_STATUS_IS_OK(status
)) {
256 TALLOC_FREE(session
);
257 return nt_status_squash(status
);
260 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
261 *out_session_id
= session
->vuid
;
265 status
= gensec_session_info(session
->gensec_security
,
267 &session
->session_info
);
269 if (!NT_STATUS_IS_OK(status
)) {
270 TALLOC_FREE(session
);
273 *out_session_id
= session
->vuid
;
275 return smbd_smb2_auth_generic_return(session
,
283 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
284 uint64_t in_session_id
,
285 uint8_t in_security_mode
,
286 DATA_BLOB in_security_buffer
,
287 uint16_t *out_session_flags
,
288 DATA_BLOB
*out_security_buffer
,
289 uint64_t *out_session_id
)
291 struct smbd_smb2_session
*session
;
293 *out_session_flags
= 0;
296 if (in_session_id
== 0) {
299 /* create a new session */
300 session
= talloc_zero(smb2req
->sconn
, struct smbd_smb2_session
);
301 if (session
== NULL
) {
302 return NT_STATUS_NO_MEMORY
;
304 session
->status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
305 id
= idr_get_new_random(smb2req
->sconn
->smb2
.sessions
.idtree
,
307 smb2req
->sconn
->smb2
.sessions
.limit
);
309 return NT_STATUS_INSUFFICIENT_RESOURCES
;
313 session
->tcons
.idtree
= idr_init(session
);
314 if (session
->tcons
.idtree
== NULL
) {
315 return NT_STATUS_NO_MEMORY
;
317 session
->tcons
.limit
= 0x0000FFFE;
318 session
->tcons
.list
= NULL
;
320 DLIST_ADD_END(smb2req
->sconn
->smb2
.sessions
.list
, session
,
321 struct smbd_smb2_session
*);
322 session
->sconn
= smb2req
->sconn
;
323 talloc_set_destructor(session
, smbd_smb2_session_destructor
);
327 /* lookup an existing session */
328 p
= idr_find(smb2req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
330 return NT_STATUS_USER_SESSION_DELETED
;
332 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
335 if (NT_STATUS_IS_OK(session
->status
)) {
336 return NT_STATUS_REQUEST_NOT_ACCEPTED
;
339 return smbd_smb2_auth_generic(session
,
348 NTSTATUS
smbd_smb2_request_process_logoff(struct smbd_smb2_request
*req
)
353 status
= smbd_smb2_request_verify_sizes(req
, 0x04);
354 if (!NT_STATUS_IS_OK(status
)) {
355 return smbd_smb2_request_error(req
, status
);
359 * TODO: cancel all outstanding requests on the session
360 * and delete all tree connections.
362 smbd_smb2_session_destructor(req
->session
);
364 * we may need to sign the response, so we need to keep
365 * the session until the response is sent to the wire.
367 talloc_steal(req
, req
->session
);
369 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x04);
370 if (outbody
.data
== NULL
) {
371 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
374 SSVAL(outbody
.data
, 0x00, 0x04); /* struct size */
375 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
377 return smbd_smb2_request_done(req
, outbody
, NULL
);