2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
31 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
32 uint64_t in_session_id
,
33 uint8_t in_security_mode
,
34 DATA_BLOB in_security_buffer
,
35 uint16_t *out_session_flags
,
36 DATA_BLOB
*out_security_buffer
,
37 uint64_t *out_session_id
);
39 NTSTATUS
smbd_smb2_request_process_sesssetup(struct smbd_smb2_request
*smb2req
)
42 const uint8_t *inbody
;
43 int i
= smb2req
->current_idx
;
47 uint64_t in_session_id
;
48 uint8_t in_security_mode
;
49 uint16_t in_security_offset
;
50 uint16_t in_security_length
;
51 DATA_BLOB in_security_buffer
;
52 uint16_t out_session_flags
;
53 uint64_t out_session_id
;
54 uint16_t out_security_offset
;
55 DATA_BLOB out_security_buffer
= data_blob_null
;
58 status
= smbd_smb2_request_verify_sizes(smb2req
, 0x19);
59 if (!NT_STATUS_IS_OK(status
)) {
60 return smbd_smb2_request_error(smb2req
, status
);
62 inhdr
= (const uint8_t *)smb2req
->in
.vector
[i
+0].iov_base
;
63 inbody
= (const uint8_t *)smb2req
->in
.vector
[i
+1].iov_base
;
65 in_security_offset
= SVAL(inbody
, 0x0C);
66 in_security_length
= SVAL(inbody
, 0x0E);
68 if (in_security_offset
!= (SMB2_HDR_BODY
+ smb2req
->in
.vector
[i
+1].iov_len
)) {
69 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
72 if (in_security_length
> smb2req
->in
.vector
[i
+2].iov_len
) {
73 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
76 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
77 in_security_mode
= CVAL(inbody
, 0x03);
78 in_security_buffer
.data
= (uint8_t *)smb2req
->in
.vector
[i
+2].iov_base
;
79 in_security_buffer
.length
= in_security_length
;
81 status
= smbd_smb2_session_setup(smb2req
,
88 if (!NT_STATUS_IS_OK(status
) &&
89 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
90 status
= nt_status_squash(status
);
91 return smbd_smb2_request_error(smb2req
, status
);
94 out_security_offset
= SMB2_HDR_BODY
+ 0x08;
96 outhdr
= (uint8_t *)smb2req
->out
.vector
[i
].iov_base
;
98 outbody
= data_blob_talloc(smb2req
->out
.vector
, NULL
, 0x08);
99 if (outbody
.data
== NULL
) {
100 return smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
103 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, out_session_id
);
105 SSVAL(outbody
.data
, 0x00, 0x08 + 1); /* struct size */
106 SSVAL(outbody
.data
, 0x02,
107 out_session_flags
); /* session flags */
108 SSVAL(outbody
.data
, 0x04,
109 out_security_offset
); /* security buffer offset */
110 SSVAL(outbody
.data
, 0x06,
111 out_security_buffer
.length
); /* security buffer length */
113 outdyn
= out_security_buffer
;
115 return smbd_smb2_request_done_ex(smb2req
, status
, outbody
, &outdyn
,
119 static int smbd_smb2_session_destructor(struct smbd_smb2_session
*session
)
121 if (session
->sconn
== NULL
) {
125 /* first free all tcons */
126 while (session
->tcons
.list
) {
127 talloc_free(session
->tcons
.list
);
130 idr_remove(session
->sconn
->smb2
.sessions
.idtree
, session
->vuid
);
131 DLIST_REMOVE(session
->sconn
->smb2
.sessions
.list
, session
);
132 invalidate_vuid(session
->sconn
, session
->vuid
);
135 session
->status
= NT_STATUS_USER_SESSION_DELETED
;
136 session
->sconn
= NULL
;
141 static NTSTATUS
smbd_smb2_auth_generic_return(struct smbd_smb2_session
*session
,
142 struct smbd_smb2_request
*smb2req
,
143 uint8_t in_security_mode
,
144 DATA_BLOB in_security_buffer
,
145 uint16_t *out_session_flags
,
146 uint64_t *out_session_id
)
150 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
151 lp_server_signing() == SMB_SIGNING_REQUIRED
) {
152 session
->do_signing
= true;
155 if (security_session_user_level(session
->session_info
, NULL
) < SECURITY_USER
) {
156 /* we map anonymous to guest internally */
157 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
158 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
159 /* force no signing */
160 session
->do_signing
= false;
164 session
->session_key
= session
->session_info
->session_key
;
166 session
->compat_vuser
= talloc_zero(session
, user_struct
);
167 if (session
->compat_vuser
== NULL
) {
168 TALLOC_FREE(session
);
169 return NT_STATUS_NO_MEMORY
;
171 session
->compat_vuser
->gensec_security
= session
->gensec_security
;
172 session
->compat_vuser
->homes_snum
= -1;
173 session
->compat_vuser
->session_info
= session
->session_info
;
174 session
->compat_vuser
->session_keystr
= NULL
;
175 session
->compat_vuser
->vuid
= session
->vuid
;
176 DLIST_ADD(session
->sconn
->smb1
.sessions
.validated_users
, session
->compat_vuser
);
178 if (security_session_user_level(session
->session_info
, NULL
) >= SECURITY_USER
) {
179 session
->compat_vuser
->homes_snum
=
180 register_homes_share(session
->session_info
->unix_info
->unix_name
);
183 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
184 DEBUG(1, ("smb2: Failed to claim session "
186 session
->compat_vuser
->vuid
));
187 TALLOC_FREE(session
);
188 return NT_STATUS_LOGON_FAILURE
;
191 set_current_user_info(session
->session_info
->unix_info
->sanitized_username
,
192 session
->session_info
->unix_info
->unix_name
,
193 session
->session_info
->info
->domain_name
);
195 reload_services(smb2req
->sconn
, conn_snum_used
, true);
197 session
->status
= NT_STATUS_OK
;
200 * we attach the session to the request
201 * so that the response can be signed
203 smb2req
->session
= session
;
205 smb2req
->do_signing
= true;
208 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
210 *out_session_id
= session
->vuid
;
215 static NTSTATUS
smbd_smb2_auth_generic(struct smbd_smb2_session
*session
,
216 struct smbd_smb2_request
*smb2req
,
217 uint8_t in_security_mode
,
218 DATA_BLOB in_security_buffer
,
219 uint16_t *out_session_flags
,
220 DATA_BLOB
*out_security_buffer
,
221 uint64_t *out_session_id
)
225 *out_security_buffer
= data_blob_null
;
227 if (session
->gensec_security
== NULL
) {
228 status
= auth_generic_prepare(session
, session
->sconn
->remote_address
,
229 &session
->gensec_security
);
230 if (!NT_STATUS_IS_OK(status
)) {
231 TALLOC_FREE(session
);
235 gensec_want_feature(session
->gensec_security
, GENSEC_FEATURE_SESSION_KEY
);
236 gensec_want_feature(session
->gensec_security
, GENSEC_FEATURE_UNIX_TOKEN
);
238 status
= gensec_start_mech_by_oid(session
->gensec_security
, GENSEC_OID_SPNEGO
);
239 if (!NT_STATUS_IS_OK(status
)) {
240 TALLOC_FREE(session
);
246 status
= gensec_update(session
->gensec_security
,
249 out_security_buffer
);
251 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
) &&
252 !NT_STATUS_IS_OK(status
)) {
253 TALLOC_FREE(session
);
254 return nt_status_squash(status
);
257 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
258 *out_session_id
= session
->vuid
;
262 status
= gensec_session_info(session
->gensec_security
,
264 &session
->session_info
);
266 if (!NT_STATUS_IS_OK(status
)) {
267 TALLOC_FREE(session
);
270 *out_session_id
= session
->vuid
;
272 return smbd_smb2_auth_generic_return(session
,
280 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
281 uint64_t in_session_id
,
282 uint8_t in_security_mode
,
283 DATA_BLOB in_security_buffer
,
284 uint16_t *out_session_flags
,
285 DATA_BLOB
*out_security_buffer
,
286 uint64_t *out_session_id
)
288 struct smbd_smb2_session
*session
;
290 *out_session_flags
= 0;
293 if (in_session_id
== 0) {
296 /* create a new session */
297 session
= talloc_zero(smb2req
->sconn
, struct smbd_smb2_session
);
298 if (session
== NULL
) {
299 return NT_STATUS_NO_MEMORY
;
301 session
->status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
302 id
= idr_get_new_random(smb2req
->sconn
->smb2
.sessions
.idtree
,
304 smb2req
->sconn
->smb2
.sessions
.limit
);
306 return NT_STATUS_INSUFFICIENT_RESOURCES
;
310 session
->tcons
.idtree
= idr_init(session
);
311 if (session
->tcons
.idtree
== NULL
) {
312 return NT_STATUS_NO_MEMORY
;
314 session
->tcons
.limit
= 0x0000FFFE;
315 session
->tcons
.list
= NULL
;
317 DLIST_ADD_END(smb2req
->sconn
->smb2
.sessions
.list
, session
,
318 struct smbd_smb2_session
*);
319 session
->sconn
= smb2req
->sconn
;
320 talloc_set_destructor(session
, smbd_smb2_session_destructor
);
324 /* lookup an existing session */
325 p
= idr_find(smb2req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
327 return NT_STATUS_USER_SESSION_DELETED
;
329 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
332 if (NT_STATUS_IS_OK(session
->status
)) {
333 return NT_STATUS_REQUEST_NOT_ACCEPTED
;
336 return smbd_smb2_auth_generic(session
,
345 NTSTATUS
smbd_smb2_request_process_logoff(struct smbd_smb2_request
*req
)
350 status
= smbd_smb2_request_verify_sizes(req
, 0x04);
351 if (!NT_STATUS_IS_OK(status
)) {
352 return smbd_smb2_request_error(req
, status
);
356 * TODO: cancel all outstanding requests on the session
357 * and delete all tree connections.
359 smbd_smb2_session_destructor(req
->session
);
361 * we may need to sign the response, so we need to keep
362 * the session until the response is sent to the wire.
364 talloc_steal(req
, req
->session
);
366 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x04);
367 if (outbody
.data
== NULL
) {
368 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
371 SSVAL(outbody
.data
, 0x00, 0x04); /* struct size */
372 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
374 return smbd_smb2_request_done(req
, outbody
, NULL
);