s3:smbd: s/struct timed_event/struct tevent_timer
[Samba/gebeck_regimport.git] / source3 / smbd / negprot.c
blobe33350c932b2c106b274472899d4b2479efa1079
1 /*
2 Unix SMB/CIFS implementation.
3 negprot reply code
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2007
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "includes.h"
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/auth/spnego.h"
25 #include "serverid.h"
26 #include "auth.h"
27 #include "messages.h"
28 #include "smbprofile.h"
29 #include "auth/gensec/gensec.h"
30 #include "../libcli/smb/smb_signing.h"
32 extern fstring remote_proto;
34 static void get_challenge(struct smbd_server_connection *sconn, uint8 buff[8])
36 NTSTATUS nt_status;
38 /* We might be called more than once, multiple negprots are
39 * permitted */
40 if (sconn->smb1.negprot.auth_context) {
41 DEBUG(3, ("get challenge: is this a secondary negprot? "
42 "sconn->negprot.auth_context is non-NULL!\n"));
43 TALLOC_FREE(sconn->smb1.negprot.auth_context);
46 DEBUG(10, ("get challenge: creating negprot_global_auth_context\n"));
47 nt_status = make_auth4_context(
48 sconn, &sconn->smb1.negprot.auth_context);
49 if (!NT_STATUS_IS_OK(nt_status)) {
50 DEBUG(0, ("make_auth_context_subsystem returned %s",
51 nt_errstr(nt_status)));
52 smb_panic("cannot make_negprot_global_auth_context!");
54 DEBUG(10, ("get challenge: getting challenge\n"));
55 sconn->smb1.negprot.auth_context->get_ntlm_challenge(
56 sconn->smb1.negprot.auth_context, buff);
59 /****************************************************************************
60 Reply for the lanman 1.0 protocol.
61 ****************************************************************************/
63 static void reply_lanman1(struct smb_request *req, uint16 choice)
65 int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
66 int secword=0;
67 time_t t = time(NULL);
68 struct smbd_server_connection *sconn = req->sconn;
70 sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
72 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
73 if (sconn->smb1.negprot.encrypted_passwords) {
74 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
77 reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
79 SSVAL(req->outbuf,smb_vwv0,choice);
80 SSVAL(req->outbuf,smb_vwv1,secword);
81 /* Create a token value and add it to the outgoing packet. */
82 if (sconn->smb1.negprot.encrypted_passwords) {
83 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
84 SSVAL(req->outbuf,smb_vwv11, 8);
87 smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN1);
89 /* Reply, SMBlockread, SMBwritelock supported. */
90 SCVAL(req->outbuf,smb_flg, FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
91 SSVAL(req->outbuf,smb_vwv2, sconn->smb1.negprot.max_recv);
92 SSVAL(req->outbuf,smb_vwv3, lp_maxmux()); /* maxmux */
93 SSVAL(req->outbuf,smb_vwv4, 1);
94 SSVAL(req->outbuf,smb_vwv5, raw); /* tell redirector we support
95 readbraw writebraw (possibly) */
96 SIVAL(req->outbuf,smb_vwv6, getpid());
97 SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
99 srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
101 return;
104 /****************************************************************************
105 Reply for the lanman 2.0 protocol.
106 ****************************************************************************/
108 static void reply_lanman2(struct smb_request *req, uint16 choice)
110 int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
111 int secword=0;
112 time_t t = time(NULL);
113 struct smbd_server_connection *sconn = req->sconn;
115 sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
117 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
118 if (sconn->smb1.negprot.encrypted_passwords) {
119 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
122 reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
124 SSVAL(req->outbuf,smb_vwv0, choice);
125 SSVAL(req->outbuf,smb_vwv1, secword);
126 SIVAL(req->outbuf,smb_vwv6, getpid());
128 /* Create a token value and add it to the outgoing packet. */
129 if (sconn->smb1.negprot.encrypted_passwords) {
130 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
131 SSVAL(req->outbuf,smb_vwv11, 8);
134 smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN2);
136 /* Reply, SMBlockread, SMBwritelock supported. */
137 SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
138 SSVAL(req->outbuf,smb_vwv2,sconn->smb1.negprot.max_recv);
139 SSVAL(req->outbuf,smb_vwv3,lp_maxmux());
140 SSVAL(req->outbuf,smb_vwv4,1);
141 SSVAL(req->outbuf,smb_vwv5,raw); /* readbraw and/or writebraw */
142 SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
143 srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
146 /****************************************************************************
147 Generate the spnego negprot reply blob. Return the number of bytes used.
148 ****************************************************************************/
150 DATA_BLOB negprot_spnego(TALLOC_CTX *ctx, struct smbd_server_connection *sconn)
152 DATA_BLOB blob = data_blob_null;
153 DATA_BLOB blob_out = data_blob_null;
154 nstring dos_name;
155 fstring unix_name;
156 NTSTATUS status;
157 #ifdef DEVELOPER
158 size_t slen;
159 #endif
160 struct gensec_security *gensec_security;
162 /* See if we can get an SPNEGO blob */
163 status = auth_generic_prepare(talloc_tos(),
164 sconn->remote_address,
165 &gensec_security);
166 if (NT_STATUS_IS_OK(status)) {
167 status = gensec_start_mech_by_oid(gensec_security, GENSEC_OID_SPNEGO);
168 if (NT_STATUS_IS_OK(status)) {
169 status = gensec_update(gensec_security, ctx,
170 NULL, data_blob_null, &blob);
171 /* If we get the list of OIDs, the 'OK' answer
172 * is NT_STATUS_MORE_PROCESSING_REQUIRED */
173 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
174 DEBUG(0, ("Failed to start SPNEGO handler for negprot OID list!\n"));
175 blob = data_blob_null;
178 TALLOC_FREE(gensec_security);
181 sconn->smb1.negprot.spnego = true;
183 /* strangely enough, NT does not sent the single OID NTLMSSP when
184 not a ADS member, it sends no OIDs at all
186 OLD COMMENT : "we can't do this until we teach our sesssion setup parser to know
187 about raw NTLMSSP (clients send no ASN.1 wrapping if we do this)"
189 Our sessionsetup code now handles raw NTLMSSP connects, so we can go
190 back to doing what W2K3 does here. This is needed to make PocketPC 2003
191 CIFS connections work with SPNEGO. See bugzilla bugs #1828 and #3133
192 for details. JRA.
196 if (blob.length == 0 || blob.data == NULL) {
197 return data_blob_null;
200 blob_out = data_blob_talloc(ctx, NULL, 16 + blob.length);
201 if (blob_out.data == NULL) {
202 data_blob_free(&blob);
203 return data_blob_null;
206 memset(blob_out.data, '\0', 16);
208 checked_strlcpy(unix_name, lp_netbios_name(), sizeof(unix_name));
209 (void)strlower_m(unix_name);
210 push_ascii_nstring(dos_name, unix_name);
211 strlcpy((char *)blob_out.data, dos_name, 17);
213 #ifdef DEVELOPER
214 /* Fix valgrind 'uninitialized bytes' issue. */
215 slen = strlen(dos_name);
216 if (slen < 16) {
217 memset(blob_out.data+slen, '\0', 16 - slen);
219 #endif
221 memcpy(&blob_out.data[16], blob.data, blob.length);
223 data_blob_free(&blob);
225 return blob_out;
228 /****************************************************************************
229 Reply for the nt protocol.
230 ****************************************************************************/
232 static void reply_nt1(struct smb_request *req, uint16 choice)
234 /* dual names + lock_and_read + nt SMBs + remote API calls */
235 int capabilities = CAP_NT_FIND|CAP_LOCK_AND_READ|
236 CAP_LEVEL_II_OPLOCKS;
238 int secword=0;
239 bool negotiate_spnego = False;
240 struct timespec ts;
241 ssize_t ret;
242 struct smbd_server_connection *sconn = req->sconn;
243 bool signing_enabled = false;
244 bool signing_required = false;
246 sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
248 /* Check the flags field to see if this is Vista.
249 WinXP sets it and Vista does not. But we have to
250 distinguish from NT which doesn't set it either. */
252 if ( (req->flags2 & FLAGS2_EXTENDED_SECURITY) &&
253 ((req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) == 0) )
255 if (get_remote_arch() != RA_SAMBA) {
256 set_remote_arch( RA_VISTA );
260 reply_outbuf(req,17,0);
262 /* do spnego in user level security if the client
263 supports it and we can do encrypted passwords */
265 if (sconn->smb1.negprot.encrypted_passwords &&
266 lp_use_spnego() &&
267 (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
268 negotiate_spnego = True;
269 capabilities |= CAP_EXTENDED_SECURITY;
270 add_to_common_flags2(FLAGS2_EXTENDED_SECURITY);
271 /* Ensure FLAGS2_EXTENDED_SECURITY gets set in this reply
272 (already partially constructed. */
273 SSVAL(req->outbuf, smb_flg2,
274 req->flags2 | FLAGS2_EXTENDED_SECURITY);
277 capabilities |= CAP_NT_SMBS|CAP_RPC_REMOTE_APIS;
279 if (lp_unicode()) {
280 capabilities |= CAP_UNICODE;
283 if (lp_unix_extensions()) {
284 capabilities |= CAP_UNIX;
287 if (lp_large_readwrite() && (SMB_OFF_T_BITS == 64))
288 capabilities |= CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_W2K_SMBS;
290 if (SMB_OFF_T_BITS == 64)
291 capabilities |= CAP_LARGE_FILES;
293 if (lp_readraw() && lp_writeraw())
294 capabilities |= CAP_RAW_MODE;
296 if (lp_nt_status_support())
297 capabilities |= CAP_STATUS32;
299 if (lp_host_msdfs())
300 capabilities |= CAP_DFS;
302 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
303 if (sconn->smb1.negprot.encrypted_passwords) {
304 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
307 signing_enabled = smb_signing_is_allowed(req->sconn->smb1.signing_state);
308 signing_required = smb_signing_is_mandatory(req->sconn->smb1.signing_state);
310 if (signing_enabled) {
311 secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
312 /* No raw mode with smb signing. */
313 capabilities &= ~CAP_RAW_MODE;
314 if (signing_required) {
315 secword |=NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
319 SSVAL(req->outbuf,smb_vwv0,choice);
320 SCVAL(req->outbuf,smb_vwv1,secword);
322 smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_NT1);
324 SSVAL(req->outbuf,smb_vwv1+1, lp_maxmux()); /* maxmpx */
325 SSVAL(req->outbuf,smb_vwv2+1, 1); /* num vcs */
326 SIVAL(req->outbuf,smb_vwv3+1,
327 sconn->smb1.negprot.max_recv); /* max buffer. LOTS! */
328 SIVAL(req->outbuf,smb_vwv5+1, 0x10000); /* raw size. full 64k */
329 SIVAL(req->outbuf,smb_vwv7+1, getpid()); /* session key */
330 SIVAL(req->outbuf,smb_vwv9+1, capabilities); /* capabilities */
331 clock_gettime(CLOCK_REALTIME,&ts);
332 put_long_date_timespec(TIMESTAMP_SET_NT_OR_BETTER,(char *)req->outbuf+smb_vwv11+1,ts);
333 SSVALS(req->outbuf,smb_vwv15+1,set_server_zone_offset(ts.tv_sec)/60);
335 if (!negotiate_spnego) {
336 /* Create a token value and add it to the outgoing packet. */
337 if (sconn->smb1.negprot.encrypted_passwords) {
338 uint8 chal[8];
339 /* note that we do not send a challenge at all if
340 we are using plaintext */
341 get_challenge(sconn, chal);
342 ret = message_push_blob(
343 &req->outbuf, data_blob_const(chal, sizeof(chal)));
344 if (ret == -1) {
345 DEBUG(0, ("Could not push challenge\n"));
346 reply_nterror(req, NT_STATUS_NO_MEMORY);
347 return;
349 SCVAL(req->outbuf, smb_vwv16+1, ret);
351 ret = message_push_string(&req->outbuf, lp_workgroup(),
352 STR_UNICODE|STR_TERMINATE
353 |STR_NOALIGN);
354 if (ret == -1) {
355 DEBUG(0, ("Could not push workgroup string\n"));
356 reply_nterror(req, NT_STATUS_NO_MEMORY);
357 return;
359 ret = message_push_string(&req->outbuf, lp_netbios_name(),
360 STR_UNICODE|STR_TERMINATE
361 |STR_NOALIGN);
362 if (ret == -1) {
363 DEBUG(0, ("Could not push netbios name string\n"));
364 reply_nterror(req, NT_STATUS_NO_MEMORY);
365 return;
367 DEBUG(3,("not using SPNEGO\n"));
368 } else {
369 DATA_BLOB spnego_blob = negprot_spnego(req, req->sconn);
371 if (spnego_blob.data == NULL) {
372 reply_nterror(req, NT_STATUS_NO_MEMORY);
373 return;
376 ret = message_push_blob(&req->outbuf, spnego_blob);
377 if (ret == -1) {
378 DEBUG(0, ("Could not push spnego blob\n"));
379 reply_nterror(req, NT_STATUS_NO_MEMORY);
380 return;
382 data_blob_free(&spnego_blob);
384 SCVAL(req->outbuf,smb_vwv16+1, 0);
385 DEBUG(3,("using SPNEGO\n"));
388 return;
391 /* these are the protocol lists used for auto architecture detection:
393 WinNT 3.51:
394 protocol [PC NETWORK PROGRAM 1.0]
395 protocol [XENIX CORE]
396 protocol [MICROSOFT NETWORKS 1.03]
397 protocol [LANMAN1.0]
398 protocol [Windows for Workgroups 3.1a]
399 protocol [LM1.2X002]
400 protocol [LANMAN2.1]
401 protocol [NT LM 0.12]
403 Win95:
404 protocol [PC NETWORK PROGRAM 1.0]
405 protocol [XENIX CORE]
406 protocol [MICROSOFT NETWORKS 1.03]
407 protocol [LANMAN1.0]
408 protocol [Windows for Workgroups 3.1a]
409 protocol [LM1.2X002]
410 protocol [LANMAN2.1]
411 protocol [NT LM 0.12]
413 Win2K:
414 protocol [PC NETWORK PROGRAM 1.0]
415 protocol [LANMAN1.0]
416 protocol [Windows for Workgroups 3.1a]
417 protocol [LM1.2X002]
418 protocol [LANMAN2.1]
419 protocol [NT LM 0.12]
421 Vista:
422 protocol [PC NETWORK PROGRAM 1.0]
423 protocol [LANMAN1.0]
424 protocol [Windows for Workgroups 3.1a]
425 protocol [LM1.2X002]
426 protocol [LANMAN2.1]
427 protocol [NT LM 0.12]
428 protocol [SMB 2.001]
430 OS/2:
431 protocol [PC NETWORK PROGRAM 1.0]
432 protocol [XENIX CORE]
433 protocol [LANMAN1.0]
434 protocol [LM1.2X002]
435 protocol [LANMAN2.1]
439 * Modified to recognize the architecture of the remote machine better.
441 * This appears to be the matrix of which protocol is used by which
442 * MS product.
443 Protocol WfWg Win95 WinNT Win2K OS/2 Vista
444 PC NETWORK PROGRAM 1.0 1 1 1 1 1 1
445 XENIX CORE 2 2
446 MICROSOFT NETWORKS 3.0 2 2
447 DOS LM1.2X002 3 3
448 MICROSOFT NETWORKS 1.03 3
449 DOS LANMAN2.1 4 4
450 LANMAN1.0 4 2 3 2
451 Windows for Workgroups 3.1a 5 5 5 3 3
452 LM1.2X002 6 4 4 4
453 LANMAN2.1 7 5 5 5
454 NT LM 0.12 6 8 6 6
455 SMB 2.001 7
457 * tim@fsg.com 09/29/95
458 * Win2K added by matty 17/7/99
461 #define ARCH_WFWG 0x3 /* This is a fudge because WfWg is like Win95 */
462 #define ARCH_WIN95 0x2
463 #define ARCH_WINNT 0x4
464 #define ARCH_WIN2K 0xC /* Win2K is like NT */
465 #define ARCH_OS2 0x14 /* Again OS/2 is like NT */
466 #define ARCH_SAMBA 0x20
467 #define ARCH_CIFSFS 0x40
468 #define ARCH_VISTA 0x8C /* Vista is like XP/2K */
470 #define ARCH_ALL 0x7F
472 /* List of supported protocols, most desired first */
473 static const struct {
474 const char *proto_name;
475 const char *short_name;
476 void (*proto_reply_fn)(struct smb_request *req, uint16 choice);
477 int protocol_level;
478 } supported_protocols[] = {
479 {"SMB 2.???", "SMB2_FF", reply_smb20ff, PROTOCOL_SMB2_10},
480 {"SMB 2.002", "SMB2_02", reply_smb2002, PROTOCOL_SMB2_02},
481 {"NT LANMAN 1.0", "NT1", reply_nt1, PROTOCOL_NT1},
482 {"NT LM 0.12", "NT1", reply_nt1, PROTOCOL_NT1},
483 {"POSIX 2", "NT1", reply_nt1, PROTOCOL_NT1},
484 {"LANMAN2.1", "LANMAN2", reply_lanman2, PROTOCOL_LANMAN2},
485 {"LM1.2X002", "LANMAN2", reply_lanman2, PROTOCOL_LANMAN2},
486 {"Samba", "LANMAN2", reply_lanman2, PROTOCOL_LANMAN2},
487 {"DOS LM1.2X002", "LANMAN2", reply_lanman2, PROTOCOL_LANMAN2},
488 {"LANMAN1.0", "LANMAN1", reply_lanman1, PROTOCOL_LANMAN1},
489 {"MICROSOFT NETWORKS 3.0", "LANMAN1", reply_lanman1, PROTOCOL_LANMAN1},
490 {NULL,NULL,NULL,0},
493 /****************************************************************************
494 Reply to a negprot.
495 conn POINTER CAN BE NULL HERE !
496 ****************************************************************************/
498 void reply_negprot(struct smb_request *req)
500 int choice= -1;
501 int protocol;
502 const char *p;
503 int arch = ARCH_ALL;
504 int num_cliprotos;
505 char **cliprotos;
506 int i;
507 size_t converted_size;
508 struct smbd_server_connection *sconn = req->sconn;
510 START_PROFILE(SMBnegprot);
512 if (sconn->smb1.negprot.done) {
513 END_PROFILE(SMBnegprot);
514 exit_server_cleanly("multiple negprot's are not permitted");
516 sconn->smb1.negprot.done = true;
518 if (req->buflen == 0) {
519 DEBUG(0, ("negprot got no protocols\n"));
520 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
521 END_PROFILE(SMBnegprot);
522 return;
525 if (req->buf[req->buflen-1] != '\0') {
526 DEBUG(0, ("negprot protocols not 0-terminated\n"));
527 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
528 END_PROFILE(SMBnegprot);
529 return;
532 p = (const char *)req->buf + 1;
534 num_cliprotos = 0;
535 cliprotos = NULL;
537 while (smbreq_bufrem(req, p) > 0) {
539 char **tmp;
541 tmp = talloc_realloc(talloc_tos(), cliprotos, char *,
542 num_cliprotos+1);
543 if (tmp == NULL) {
544 DEBUG(0, ("talloc failed\n"));
545 TALLOC_FREE(cliprotos);
546 reply_nterror(req, NT_STATUS_NO_MEMORY);
547 END_PROFILE(SMBnegprot);
548 return;
551 cliprotos = tmp;
553 if (!pull_ascii_talloc(cliprotos, &cliprotos[num_cliprotos], p,
554 &converted_size)) {
555 DEBUG(0, ("pull_ascii_talloc failed\n"));
556 TALLOC_FREE(cliprotos);
557 reply_nterror(req, NT_STATUS_NO_MEMORY);
558 END_PROFILE(SMBnegprot);
559 return;
562 DEBUG(3, ("Requested protocol [%s]\n",
563 cliprotos[num_cliprotos]));
565 num_cliprotos += 1;
566 p += strlen(p) + 2;
569 for (i=0; i<num_cliprotos; i++) {
570 if (strcsequal(cliprotos[i], "Windows for Workgroups 3.1a"))
571 arch &= ( ARCH_WFWG | ARCH_WIN95 | ARCH_WINNT
572 | ARCH_WIN2K );
573 else if (strcsequal(cliprotos[i], "DOS LM1.2X002"))
574 arch &= ( ARCH_WFWG | ARCH_WIN95 );
575 else if (strcsequal(cliprotos[i], "DOS LANMAN2.1"))
576 arch &= ( ARCH_WFWG | ARCH_WIN95 );
577 else if (strcsequal(cliprotos[i], "NT LM 0.12"))
578 arch &= ( ARCH_WIN95 | ARCH_WINNT | ARCH_WIN2K
579 | ARCH_CIFSFS);
580 else if (strcsequal(cliprotos[i], "SMB 2.001"))
581 arch = ARCH_VISTA;
582 else if (strcsequal(cliprotos[i], "LANMAN2.1"))
583 arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
584 else if (strcsequal(cliprotos[i], "LM1.2X002"))
585 arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
586 else if (strcsequal(cliprotos[i], "MICROSOFT NETWORKS 1.03"))
587 arch &= ARCH_WINNT;
588 else if (strcsequal(cliprotos[i], "XENIX CORE"))
589 arch &= ( ARCH_WINNT | ARCH_OS2 );
590 else if (strcsequal(cliprotos[i], "Samba")) {
591 arch = ARCH_SAMBA;
592 break;
593 } else if (strcsequal(cliprotos[i], "POSIX 2")) {
594 arch = ARCH_CIFSFS;
595 break;
599 /* CIFSFS can send one arch only, NT LM 0.12. */
600 if (i == 1 && (arch & ARCH_CIFSFS)) {
601 arch = ARCH_CIFSFS;
604 switch ( arch ) {
605 case ARCH_CIFSFS:
606 set_remote_arch(RA_CIFSFS);
607 break;
608 case ARCH_SAMBA:
609 set_remote_arch(RA_SAMBA);
610 break;
611 case ARCH_WFWG:
612 set_remote_arch(RA_WFWG);
613 break;
614 case ARCH_WIN95:
615 set_remote_arch(RA_WIN95);
616 break;
617 case ARCH_WINNT:
618 if(req->flags2 == FLAGS2_WIN2K_SIGNATURE)
619 set_remote_arch(RA_WIN2K);
620 else
621 set_remote_arch(RA_WINNT);
622 break;
623 case ARCH_WIN2K:
624 /* Vista may have been set in the negprot so don't
625 override it here */
626 if ( get_remote_arch() != RA_VISTA )
627 set_remote_arch(RA_WIN2K);
628 break;
629 case ARCH_VISTA:
630 set_remote_arch(RA_VISTA);
631 break;
632 case ARCH_OS2:
633 set_remote_arch(RA_OS2);
634 break;
635 default:
636 set_remote_arch(RA_UNKNOWN);
637 break;
640 /* possibly reload - change of architecture */
641 reload_services(sconn, conn_snum_used, true);
643 /* moved from the netbios session setup code since we don't have that
644 when the client connects to port 445. Of course there is a small
645 window where we are listening to messages -- jerry */
647 serverid_register(messaging_server_id(sconn->msg_ctx),
648 FLAG_MSG_GENERAL|FLAG_MSG_SMBD
649 |FLAG_MSG_PRINT_GENERAL);
651 /* Check for protocols, most desirable first */
652 for (protocol = 0; supported_protocols[protocol].proto_name; protocol++) {
653 i = 0;
654 if ((supported_protocols[protocol].protocol_level <= lp_srv_maxprotocol()) &&
655 (supported_protocols[protocol].protocol_level >= lp_srv_minprotocol()))
656 while (i < num_cliprotos) {
657 if (strequal(cliprotos[i],supported_protocols[protocol].proto_name))
658 choice = i;
659 i++;
661 if(choice != -1)
662 break;
665 if(choice != -1) {
666 fstrcpy(remote_proto,supported_protocols[protocol].short_name);
667 reload_services(sconn, conn_snum_used, true);
668 supported_protocols[protocol].proto_reply_fn(req, choice);
669 DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
670 } else {
671 DEBUG(0,("No protocol supported !\n"));
672 reply_outbuf(req, 1, 0);
673 SSVAL(req->outbuf, smb_vwv0, choice);
676 DEBUG( 5, ( "negprot index=%d\n", choice ) );
678 if ((lp_server_signing() == SMB_SIGNING_REQUIRED)
679 && (get_Protocol() < PROTOCOL_NT1)) {
680 exit_server_cleanly("SMB signing is required and "
681 "client negotiated a downlevel protocol");
684 TALLOC_FREE(cliprotos);
686 if (lp_async_smb_echo_handler() && (get_Protocol() < PROTOCOL_SMB2_02) &&
687 !fork_echo_handler(sconn)) {
688 exit_server("Failed to fork echo handler");
691 END_PROFILE(SMBnegprot);
692 return;