source3/smbd/negprot.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    negprot reply code
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "../libcli/auth/spnego.h"
  25 #include "serverid.h"
  26 #include "auth.h"
  27 #include "messages.h"
  28 #include "smbprofile.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "../libcli/smb/smb_signing.h"
  31
  32 extern fstring remote_proto;
  33
  34 static void get_challenge(struct smbd_server_connection *sconn, uint8 buff[8])
  35 {
  36         NTSTATUS nt_status;
  37
  38         /* We might be called more than once, multiple negprots are
  39          * permitted */
  40         if (sconn->smb1.negprot.auth_context) {
  41                 DEBUG(3, ("get challenge: is this a secondary negprot? "
  42                           "sconn->negprot.auth_context is non-NULL!\n"));
  43                         TALLOC_FREE(sconn->smb1.negprot.auth_context);
  44         }
  45
  46         DEBUG(10, ("get challenge: creating negprot_global_auth_context\n"));
  47         nt_status = make_auth4_context(
  48                 sconn, &sconn->smb1.negprot.auth_context);
  49         if (!NT_STATUS_IS_OK(nt_status)) {
  50                 DEBUG(0, ("make_auth_context_subsystem returned %s",
  51                           nt_errstr(nt_status)));
  52                 smb_panic("cannot make_negprot_global_auth_context!");
  53         }
  54         DEBUG(10, ("get challenge: getting challenge\n"));
  55         sconn->smb1.negprot.auth_context->get_ntlm_challenge(
  56                 sconn->smb1.negprot.auth_context, buff);
  57 }
  58
  59 /****************************************************************************
  60  Reply for the lanman 1.0 protocol.
  61 ****************************************************************************/
  62
  63 static void reply_lanman1(struct smb_request *req, uint16 choice)
  64 {
  65         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
  66         int secword=0;
  67         time_t t = time(NULL);
  68         struct smbd_server_connection *sconn = req->sconn;
  69
  70         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
  71
  72         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
  73         if (sconn->smb1.negprot.encrypted_passwords) {
  74                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
  75         }
  76
  77         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
  78
  79         SSVAL(req->outbuf,smb_vwv0,choice);
  80         SSVAL(req->outbuf,smb_vwv1,secword);
  81         /* Create a token value and add it to the outgoing packet. */
  82         if (sconn->smb1.negprot.encrypted_passwords) {
  83                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
  84                 SSVAL(req->outbuf,smb_vwv11, 8);
  85         }
  86
  87         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN1);
  88
  89         /* Reply, SMBlockread, SMBwritelock supported. */
  90         SCVAL(req->outbuf,smb_flg, FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
  91         SSVAL(req->outbuf,smb_vwv2, sconn->smb1.negprot.max_recv);
  92         SSVAL(req->outbuf,smb_vwv3, lp_maxmux()); /* maxmux */
  93         SSVAL(req->outbuf,smb_vwv4, 1);
  94         SSVAL(req->outbuf,smb_vwv5, raw); /* tell redirector we support
  95                 readbraw writebraw (possibly) */
  96         SIVAL(req->outbuf,smb_vwv6, getpid());
  97         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
  98
  99         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 100
 101         return;
 102 }
 103
 104 /****************************************************************************
 105  Reply for the lanman 2.0 protocol.
 106 ****************************************************************************/
 107
 108 static void reply_lanman2(struct smb_request *req, uint16 choice)
 109 {
 110         int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
 111         int secword=0;
 112         time_t t = time(NULL);
 113         struct smbd_server_connection *sconn = req->sconn;
 114
 115         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 116
 117         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 118         if (sconn->smb1.negprot.encrypted_passwords) {
 119                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 120         }
 121
 122         reply_outbuf(req, 13, sconn->smb1.negprot.encrypted_passwords?8:0);
 123
 124         SSVAL(req->outbuf,smb_vwv0, choice);
 125         SSVAL(req->outbuf,smb_vwv1, secword);
 126         SIVAL(req->outbuf,smb_vwv6, getpid());
 127
 128         /* Create a token value and add it to the outgoing packet. */
 129         if (sconn->smb1.negprot.encrypted_passwords) {
 130                 get_challenge(sconn, (uint8 *)smb_buf(req->outbuf));
 131                 SSVAL(req->outbuf,smb_vwv11, 8);
 132         }
 133
 134         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_LANMAN2);
 135
 136         /* Reply, SMBlockread, SMBwritelock supported. */
 137         SCVAL(req->outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
 138         SSVAL(req->outbuf,smb_vwv2,sconn->smb1.negprot.max_recv);
 139         SSVAL(req->outbuf,smb_vwv3,lp_maxmux());
 140         SSVAL(req->outbuf,smb_vwv4,1);
 141         SSVAL(req->outbuf,smb_vwv5,raw); /* readbraw and/or writebraw */
 142         SSVAL(req->outbuf,smb_vwv10, set_server_zone_offset(t)/60);
 143         srv_put_dos_date((char *)req->outbuf,smb_vwv8,t);
 144 }
 145
 146 /****************************************************************************
 147  Generate the spnego negprot reply blob. Return the number of bytes used.
 148 ****************************************************************************/
 149
 150 DATA_BLOB negprot_spnego(TALLOC_CTX *ctx, struct smbd_server_connection *sconn)
 151 {
 152         DATA_BLOB blob = data_blob_null;
 153         DATA_BLOB blob_out = data_blob_null;
 154         nstring dos_name;
 155         fstring unix_name;
 156         NTSTATUS status;
 157 #ifdef DEVELOPER
 158         size_t slen;
 159 #endif
 160         struct gensec_security *gensec_security;
 161
 162         /* See if we can get an SPNEGO blob */
 163         status = auth_generic_prepare(talloc_tos(),
 164                                       sconn->remote_address,
 165                                       &gensec_security);
 166         if (NT_STATUS_IS_OK(status)) {
 167                 status = gensec_start_mech_by_oid(gensec_security, GENSEC_OID_SPNEGO);
 168                 if (NT_STATUS_IS_OK(status)) {
 169                         status = gensec_update(gensec_security, ctx,
 170                                                NULL, data_blob_null, &blob);
 171                         /* If we get the list of OIDs, the 'OK' answer
 172                          * is NT_STATUS_MORE_PROCESSING_REQUIRED */
 173                         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 174                                 DEBUG(0, ("Failed to start SPNEGO handler for negprot OID list!\n"));
 175                                 blob = data_blob_null;
 176                         }
 177                 }
 178                 TALLOC_FREE(gensec_security);
 179         }
 180
 181         sconn->smb1.negprot.spnego = true;
 182
 183         /* strangely enough, NT does not sent the single OID NTLMSSP when
 184            not a ADS member, it sends no OIDs at all
 185
 186            OLD COMMENT : "we can't do this until we teach our sesssion setup parser to know
 187                    about raw NTLMSSP (clients send no ASN.1 wrapping if we do this)"
 188
 189            Our sessionsetup code now handles raw NTLMSSP connects, so we can go
 190            back to doing what W2K3 does here. This is needed to make PocketPC 2003
 191            CIFS connections work with SPNEGO. See bugzilla bugs #1828 and #3133
 192            for details. JRA.
 193
 194         */
 195
 196         if (blob.length == 0 || blob.data == NULL) {
 197                 return data_blob_null;
 198         }
 199
 200         blob_out = data_blob_talloc(ctx, NULL, 16 + blob.length);
 201         if (blob_out.data == NULL) {
 202                 data_blob_free(&blob);
 203                 return data_blob_null;
 204         }
 205
 206         memset(blob_out.data, '\0', 16);
 207
 208         checked_strlcpy(unix_name, lp_netbios_name(), sizeof(unix_name));
 209         strlower_m(unix_name);
 210         push_ascii_nstring(dos_name, unix_name);
 211         strlcpy((char *)blob_out.data, dos_name, 17);
 212
 213 #ifdef DEVELOPER
 214         /* Fix valgrind 'uninitialized bytes' issue. */
 215         slen = strlen(dos_name);
 216         if (slen < 16) {
 217                 memset(blob_out.data+slen, '\0', 16 - slen);
 218         }
 219 #endif
 220
 221         memcpy(&blob_out.data[16], blob.data, blob.length);
 222
 223         data_blob_free(&blob);
 224
 225         return blob_out;
 226 }
 227
 228 /****************************************************************************
 229  Reply for the nt protocol.
 230 ****************************************************************************/
 231
 232 static void reply_nt1(struct smb_request *req, uint16 choice)
 233 {
 234         /* dual names + lock_and_read + nt SMBs + remote API calls */
 235         int capabilities = CAP_NT_FIND|CAP_LOCK_AND_READ|
 236                 CAP_LEVEL_II_OPLOCKS;
 237
 238         int secword=0;
 239         bool negotiate_spnego = False;
 240         struct timespec ts;
 241         ssize_t ret;
 242         struct smbd_server_connection *sconn = req->sconn;
 243         bool signing_enabled = false;
 244         bool signing_required = false;
 245
 246         sconn->smb1.negprot.encrypted_passwords = lp_encrypted_passwords();
 247
 248         /* Check the flags field to see if this is Vista.
 249            WinXP sets it and Vista does not. But we have to
 250            distinguish from NT which doesn't set it either. */
 251
 252         if ( (req->flags2 & FLAGS2_EXTENDED_SECURITY) &&
 253                 ((req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) == 0) )
 254         {
 255                 if (get_remote_arch() != RA_SAMBA) {
 256                         set_remote_arch( RA_VISTA );
 257                 }
 258         }
 259
 260         reply_outbuf(req,17,0);
 261
 262         /* do spnego in user level security if the client
 263            supports it and we can do encrypted passwords */
 264
 265         if (sconn->smb1.negprot.encrypted_passwords &&
 266             lp_use_spnego() &&
 267             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
 268                 negotiate_spnego = True;
 269                 capabilities |= CAP_EXTENDED_SECURITY;
 270                 add_to_common_flags2(FLAGS2_EXTENDED_SECURITY);
 271                 /* Ensure FLAGS2_EXTENDED_SECURITY gets set in this reply
 272                    (already partially constructed. */
 273                 SSVAL(req->outbuf, smb_flg2,
 274                       req->flags2 | FLAGS2_EXTENDED_SECURITY);
 275         }
 276
 277         capabilities |= CAP_NT_SMBS|CAP_RPC_REMOTE_APIS|CAP_UNICODE;
 278
 279         if (lp_unix_extensions()) {
 280                 capabilities |= CAP_UNIX;
 281         }
 282
 283         if (lp_large_readwrite() && (SMB_OFF_T_BITS == 64))
 284                 capabilities |= CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_W2K_SMBS;
 285
 286         if (SMB_OFF_T_BITS == 64)
 287                 capabilities |= CAP_LARGE_FILES;
 288
 289         if (lp_readraw() && lp_writeraw())
 290                 capabilities |= CAP_RAW_MODE;
 291
 292         if (lp_nt_status_support())
 293                 capabilities |= CAP_STATUS32;
 294
 295         if (lp_host_msdfs())
 296                 capabilities |= CAP_DFS;
 297
 298         secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 299         if (sconn->smb1.negprot.encrypted_passwords) {
 300                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 301         }
 302
 303         signing_enabled = smb_signing_is_allowed(req->sconn->smb1.signing_state);
 304         signing_required = smb_signing_is_mandatory(req->sconn->smb1.signing_state);
 305
 306         if (signing_enabled) {
 307                 secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
 308                 /* No raw mode with smb signing. */
 309                 capabilities &= ~CAP_RAW_MODE;
 310                 if (signing_required) {
 311                         secword |=NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
 312                 }
 313         }
 314
 315         SSVAL(req->outbuf,smb_vwv0,choice);
 316         SCVAL(req->outbuf,smb_vwv1,secword);
 317
 318         smbXsrv_connection_init_tables(req->sconn->conn, PROTOCOL_NT1);
 319
 320         SSVAL(req->outbuf,smb_vwv1+1, lp_maxmux()); /* maxmpx */
 321         SSVAL(req->outbuf,smb_vwv2+1, 1); /* num vcs */
 322         SIVAL(req->outbuf,smb_vwv3+1,
 323               sconn->smb1.negprot.max_recv); /* max buffer. LOTS! */
 324         SIVAL(req->outbuf,smb_vwv5+1, 0x10000); /* raw size. full 64k */
 325         SIVAL(req->outbuf,smb_vwv7+1, getpid()); /* session key */
 326         SIVAL(req->outbuf,smb_vwv9+1, capabilities); /* capabilities */
 327         clock_gettime(CLOCK_REALTIME,&ts);
 328         put_long_date_timespec(TIMESTAMP_SET_NT_OR_BETTER,(char *)req->outbuf+smb_vwv11+1,ts);
 329         SSVALS(req->outbuf,smb_vwv15+1,set_server_zone_offset(ts.tv_sec)/60);
 330
 331         if (!negotiate_spnego) {
 332                 /* Create a token value and add it to the outgoing packet. */
 333                 if (sconn->smb1.negprot.encrypted_passwords) {
 334                         uint8 chal[8];
 335                         /* note that we do not send a challenge at all if
 336                            we are using plaintext */
 337                         get_challenge(sconn, chal);
 338                         ret = message_push_blob(
 339                                 &req->outbuf, data_blob_const(chal, sizeof(chal)));
 340                         if (ret == -1) {
 341                                 DEBUG(0, ("Could not push challenge\n"));
 342                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 343                                 return;
 344                         }
 345                         SCVAL(req->outbuf, smb_vwv16+1, ret);
 346                 }
 347                 ret = message_push_string(&req->outbuf, lp_workgroup(),
 348                                           STR_UNICODE|STR_TERMINATE
 349                                           |STR_NOALIGN);
 350                 if (ret == -1) {
 351                         DEBUG(0, ("Could not push workgroup string\n"));
 352                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 353                         return;
 354                 }
 355                 ret = message_push_string(&req->outbuf, lp_netbios_name(),
 356                                           STR_UNICODE|STR_TERMINATE
 357                                           |STR_NOALIGN);
 358                 if (ret == -1) {
 359                         DEBUG(0, ("Could not push netbios name string\n"));
 360                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 361                         return;
 362                 }
 363                 DEBUG(3,("not using SPNEGO\n"));
 364         } else {
 365                 DATA_BLOB spnego_blob = negprot_spnego(req, req->sconn);
 366
 367                 if (spnego_blob.data == NULL) {
 368                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 369                         return;
 370                 }
 371
 372                 ret = message_push_blob(&req->outbuf, spnego_blob);
 373                 if (ret == -1) {
 374                         DEBUG(0, ("Could not push spnego blob\n"));
 375                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 376                         return;
 377                 }
 378                 data_blob_free(&spnego_blob);
 379
 380                 SCVAL(req->outbuf,smb_vwv16+1, 0);
 381                 DEBUG(3,("using SPNEGO\n"));
 382         }
 383
 384         return;
 385 }
 386
 387 /* these are the protocol lists used for auto architecture detection:
 388
 389 WinNT 3.51:
 390 protocol [PC NETWORK PROGRAM 1.0]
 391 protocol [XENIX CORE]
 392 protocol [MICROSOFT NETWORKS 1.03]
 393 protocol [LANMAN1.0]
 394 protocol [Windows for Workgroups 3.1a]
 395 protocol [LM1.2X002]
 396 protocol [LANMAN2.1]
 397 protocol [NT LM 0.12]
 398
 399 Win95:
 400 protocol [PC NETWORK PROGRAM 1.0]
 401 protocol [XENIX CORE]
 402 protocol [MICROSOFT NETWORKS 1.03]
 403 protocol [LANMAN1.0]
 404 protocol [Windows for Workgroups 3.1a]
 405 protocol [LM1.2X002]
 406 protocol [LANMAN2.1]
 407 protocol [NT LM 0.12]
 408
 409 Win2K:
 410 protocol [PC NETWORK PROGRAM 1.0]
 411 protocol [LANMAN1.0]
 412 protocol [Windows for Workgroups 3.1a]
 413 protocol [LM1.2X002]
 414 protocol [LANMAN2.1]
 415 protocol [NT LM 0.12]
 416
 417 Vista:
 418 protocol [PC NETWORK PROGRAM 1.0]
 419 protocol [LANMAN1.0]
 420 protocol [Windows for Workgroups 3.1a]
 421 protocol [LM1.2X002]
 422 protocol [LANMAN2.1]
 423 protocol [NT LM 0.12]
 424 protocol [SMB 2.001]
 425
 426 OS/2:
 427 protocol [PC NETWORK PROGRAM 1.0]
 428 protocol [XENIX CORE]
 429 protocol [LANMAN1.0]
 430 protocol [LM1.2X002]
 431 protocol [LANMAN2.1]
 432 */
 433
 434 /*
 435   * Modified to recognize the architecture of the remote machine better.
 436   *
 437   * This appears to be the matrix of which protocol is used by which
 438   * MS product.
 439        Protocol                       WfWg    Win95   WinNT  Win2K  OS/2 Vista
 440        PC NETWORK PROGRAM 1.0          1       1       1      1      1     1
 441        XENIX CORE                                      2             2
 442        MICROSOFT NETWORKS 3.0          2       2
 443        DOS LM1.2X002                   3       3
 444        MICROSOFT NETWORKS 1.03                         3
 445        DOS LANMAN2.1                   4       4
 446        LANMAN1.0                                       4      2      3     2
 447        Windows for Workgroups 3.1a     5       5       5      3            3
 448        LM1.2X002                                       6      4      4     4
 449        LANMAN2.1                                       7      5      5     5
 450        NT LM 0.12                              6       8      6            6
 451        SMB 2.001                                                           7
 452   *
 453   *  tim@fsg.com 09/29/95
 454   *  Win2K added by matty 17/7/99
 455   */
 456
 457 #define ARCH_WFWG     0x3      /* This is a fudge because WfWg is like Win95 */
 458 #define ARCH_WIN95    0x2
 459 #define ARCH_WINNT    0x4
 460 #define ARCH_WIN2K    0xC      /* Win2K is like NT */
 461 #define ARCH_OS2      0x14     /* Again OS/2 is like NT */
 462 #define ARCH_SAMBA    0x20
 463 #define ARCH_CIFSFS   0x40
 464 #define ARCH_VISTA    0x8C     /* Vista is like XP/2K */
 465
 466 #define ARCH_ALL      0x7F
 467
 468 /* List of supported protocols, most desired first */
 469 static const struct {
 470         const char *proto_name;
 471         const char *short_name;
 472         void (*proto_reply_fn)(struct smb_request *req, uint16 choice);
 473         int protocol_level;
 474 } supported_protocols[] = {
 475         {"SMB 2.???",               "SMB2_FF",  reply_smb20ff,  PROTOCOL_SMB2_10},
 476         {"SMB 2.002",               "SMB2_02",  reply_smb2002,  PROTOCOL_SMB2_02},
 477         {"NT LANMAN 1.0",           "NT1",      reply_nt1,      PROTOCOL_NT1},
 478         {"NT LM 0.12",              "NT1",      reply_nt1,      PROTOCOL_NT1},
 479         {"POSIX 2",                 "NT1",      reply_nt1,      PROTOCOL_NT1},
 480         {"LANMAN2.1",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 481         {"LM1.2X002",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 482         {"Samba",                   "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 483         {"DOS LM1.2X002",           "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 484         {"LANMAN1.0",               "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 485         {"MICROSOFT NETWORKS 3.0",  "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 486         {NULL,NULL,NULL,0},
 487 };
 488
 489 /****************************************************************************
 490  Reply to a negprot.
 491  conn POINTER CAN BE NULL HERE !
 492 ****************************************************************************/
 493
 494 void reply_negprot(struct smb_request *req)
 495 {
 496         int choice= -1;
 497         int protocol;
 498         const char *p;
 499         int arch = ARCH_ALL;
 500         int num_cliprotos;
 501         char **cliprotos;
 502         int i;
 503         size_t converted_size;
 504         struct smbd_server_connection *sconn = req->sconn;
 505
 506         START_PROFILE(SMBnegprot);
 507
 508         if (sconn->smb1.negprot.done) {
 509                 END_PROFILE(SMBnegprot);
 510                 exit_server_cleanly("multiple negprot's are not permitted");
 511         }
 512         sconn->smb1.negprot.done = true;
 513
 514         if (req->buflen == 0) {
 515                 DEBUG(0, ("negprot got no protocols\n"));
 516                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 517                 END_PROFILE(SMBnegprot);
 518                 return;
 519         }
 520
 521         if (req->buf[req->buflen-1] != '\0') {
 522                 DEBUG(0, ("negprot protocols not 0-terminated\n"));
 523                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 524                 END_PROFILE(SMBnegprot);
 525                 return;
 526         }
 527
 528         p = (const char *)req->buf + 1;
 529
 530         num_cliprotos = 0;
 531         cliprotos = NULL;
 532
 533         while (smbreq_bufrem(req, p) > 0) {
 534
 535                 char **tmp;
 536
 537                 tmp = talloc_realloc(talloc_tos(), cliprotos, char *,
 538                                            num_cliprotos+1);
 539                 if (tmp == NULL) {
 540                         DEBUG(0, ("talloc failed\n"));
 541                         TALLOC_FREE(cliprotos);
 542                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 543                         END_PROFILE(SMBnegprot);
 544                         return;
 545                 }
 546
 547                 cliprotos = tmp;
 548
 549                 if (!pull_ascii_talloc(cliprotos, &cliprotos[num_cliprotos], p,
 550                                        &converted_size)) {
 551                         DEBUG(0, ("pull_ascii_talloc failed\n"));
 552                         TALLOC_FREE(cliprotos);
 553                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 554                         END_PROFILE(SMBnegprot);
 555                         return;
 556                 }
 557
 558                 DEBUG(3, ("Requested protocol [%s]\n",
 559                           cliprotos[num_cliprotos]));
 560
 561                 num_cliprotos += 1;
 562                 p += strlen(p) + 2;
 563         }
 564
 565         for (i=0; i<num_cliprotos; i++) {
 566                 if (strcsequal(cliprotos[i], "Windows for Workgroups 3.1a"))
 567                         arch &= ( ARCH_WFWG | ARCH_WIN95 | ARCH_WINNT
 568                                   | ARCH_WIN2K );
 569                 else if (strcsequal(cliprotos[i], "DOS LM1.2X002"))
 570                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 571                 else if (strcsequal(cliprotos[i], "DOS LANMAN2.1"))
 572                         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 573                 else if (strcsequal(cliprotos[i], "NT LM 0.12"))
 574                         arch &= ( ARCH_WIN95 | ARCH_WINNT | ARCH_WIN2K
 575                                   | ARCH_CIFSFS);
 576                 else if (strcsequal(cliprotos[i], "SMB 2.001"))
 577                         arch = ARCH_VISTA;
 578                 else if (strcsequal(cliprotos[i], "LANMAN2.1"))
 579                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 580                 else if (strcsequal(cliprotos[i], "LM1.2X002"))
 581                         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 582                 else if (strcsequal(cliprotos[i], "MICROSOFT NETWORKS 1.03"))
 583                         arch &= ARCH_WINNT;
 584                 else if (strcsequal(cliprotos[i], "XENIX CORE"))
 585                         arch &= ( ARCH_WINNT | ARCH_OS2 );
 586                 else if (strcsequal(cliprotos[i], "Samba")) {
 587                         arch = ARCH_SAMBA;
 588                         break;
 589                 } else if (strcsequal(cliprotos[i], "POSIX 2")) {
 590                         arch = ARCH_CIFSFS;
 591                         break;
 592                 }
 593         }
 594
 595         /* CIFSFS can send one arch only, NT LM 0.12. */
 596         if (i == 1 && (arch & ARCH_CIFSFS)) {
 597                 arch = ARCH_CIFSFS;
 598         }
 599
 600         switch ( arch ) {
 601                 case ARCH_CIFSFS:
 602                         set_remote_arch(RA_CIFSFS);
 603                         break;
 604                 case ARCH_SAMBA:
 605                         set_remote_arch(RA_SAMBA);
 606                         break;
 607                 case ARCH_WFWG:
 608                         set_remote_arch(RA_WFWG);
 609                         break;
 610                 case ARCH_WIN95:
 611                         set_remote_arch(RA_WIN95);
 612                         break;
 613                 case ARCH_WINNT:
 614                         if(req->flags2 == FLAGS2_WIN2K_SIGNATURE)
 615                                 set_remote_arch(RA_WIN2K);
 616                         else
 617                                 set_remote_arch(RA_WINNT);
 618                         break;
 619                 case ARCH_WIN2K:
 620                         /* Vista may have been set in the negprot so don't
 621                            override it here */
 622                         if ( get_remote_arch() != RA_VISTA )
 623                                 set_remote_arch(RA_WIN2K);
 624                         break;
 625                 case ARCH_VISTA:
 626                         set_remote_arch(RA_VISTA);
 627                         break;
 628                 case ARCH_OS2:
 629                         set_remote_arch(RA_OS2);
 630                         break;
 631                 default:
 632                         set_remote_arch(RA_UNKNOWN);
 633                 break;
 634         }
 635
 636         /* possibly reload - change of architecture */
 637         reload_services(sconn, conn_snum_used, true);
 638
 639         /* moved from the netbios session setup code since we don't have that
 640            when the client connects to port 445.  Of course there is a small
 641            window where we are listening to messages   -- jerry */
 642
 643         serverid_register(messaging_server_id(sconn->msg_ctx),
 644                           FLAG_MSG_GENERAL|FLAG_MSG_SMBD
 645                           |FLAG_MSG_PRINT_GENERAL);
 646
 647         /* Check for protocols, most desirable first */
 648         for (protocol = 0; supported_protocols[protocol].proto_name; protocol++) {
 649                 i = 0;
 650                 if ((supported_protocols[protocol].protocol_level <= lp_srv_maxprotocol()) &&
 651                                 (supported_protocols[protocol].protocol_level >= lp_srv_minprotocol()))
 652                         while (i < num_cliprotos) {
 653                                 if (strequal(cliprotos[i],supported_protocols[protocol].proto_name))
 654                                         choice = i;
 655                                 i++;
 656                         }
 657                 if(choice != -1)
 658                         break;
 659         }
 660
 661         if(choice != -1) {
 662                 fstrcpy(remote_proto,supported_protocols[protocol].short_name);
 663                 reload_services(sconn, conn_snum_used, true);
 664                 supported_protocols[protocol].proto_reply_fn(req, choice);
 665                 DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
 666         } else {
 667                 DEBUG(0,("No protocol supported !\n"));
 668                 reply_outbuf(req, 1, 0);
 669                 SSVAL(req->outbuf, smb_vwv0, choice);
 670         }
 671
 672         DEBUG( 5, ( "negprot index=%d\n", choice ) );
 673
 674         if ((lp_server_signing() == SMB_SIGNING_REQUIRED)
 675             && (get_Protocol() < PROTOCOL_NT1)) {
 676                 exit_server_cleanly("SMB signing is required and "
 677                         "client negotiated a downlevel protocol");
 678         }
 679
 680         TALLOC_FREE(cliprotos);
 681
 682         if (lp_async_smb_echo_handler() && (get_Protocol() < PROTOCOL_SMB2_02) &&
 683             !fork_echo_handler(sconn)) {
 684                 exit_server("Failed to fork echo handler");
 685         }
 686
 687         END_PROFILE(SMBnegprot);
 688         return;
 689 }