2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
31 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
32 uint64_t in_session_id
,
33 uint8_t in_security_mode
,
34 DATA_BLOB in_security_buffer
,
35 uint16_t *out_session_flags
,
36 DATA_BLOB
*out_security_buffer
,
37 uint64_t *out_session_id
);
39 NTSTATUS
smbd_smb2_request_process_sesssetup(struct smbd_smb2_request
*smb2req
)
42 const uint8_t *inbody
;
43 int i
= smb2req
->current_idx
;
47 uint64_t in_session_id
;
48 uint8_t in_security_mode
;
49 uint16_t in_security_offset
;
50 uint16_t in_security_length
;
51 DATA_BLOB in_security_buffer
;
52 uint16_t out_session_flags
;
53 uint64_t out_session_id
;
54 uint16_t out_security_offset
;
55 DATA_BLOB out_security_buffer
= data_blob_null
;
58 status
= smbd_smb2_request_verify_sizes(smb2req
, 0x19);
59 if (!NT_STATUS_IS_OK(status
)) {
60 return smbd_smb2_request_error(smb2req
, status
);
62 inhdr
= (const uint8_t *)smb2req
->in
.vector
[i
+0].iov_base
;
63 inbody
= (const uint8_t *)smb2req
->in
.vector
[i
+1].iov_base
;
65 in_security_offset
= SVAL(inbody
, 0x0C);
66 in_security_length
= SVAL(inbody
, 0x0E);
68 if (in_security_offset
!= (SMB2_HDR_BODY
+ smb2req
->in
.vector
[i
+1].iov_len
)) {
69 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
72 if (in_security_length
> smb2req
->in
.vector
[i
+2].iov_len
) {
73 return smbd_smb2_request_error(smb2req
, NT_STATUS_INVALID_PARAMETER
);
76 in_session_id
= BVAL(inhdr
, SMB2_HDR_SESSION_ID
);
77 in_security_mode
= CVAL(inbody
, 0x03);
78 in_security_buffer
.data
= (uint8_t *)smb2req
->in
.vector
[i
+2].iov_base
;
79 in_security_buffer
.length
= in_security_length
;
81 status
= smbd_smb2_session_setup(smb2req
,
88 if (!NT_STATUS_IS_OK(status
) &&
89 !NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
90 status
= nt_status_squash(status
);
91 return smbd_smb2_request_error(smb2req
, status
);
94 out_security_offset
= SMB2_HDR_BODY
+ 0x08;
96 outhdr
= (uint8_t *)smb2req
->out
.vector
[i
].iov_base
;
98 outbody
= data_blob_talloc(smb2req
->out
.vector
, NULL
, 0x08);
99 if (outbody
.data
== NULL
) {
100 return smbd_smb2_request_error(smb2req
, NT_STATUS_NO_MEMORY
);
103 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
, out_session_id
);
105 SSVAL(outbody
.data
, 0x00, 0x08 + 1); /* struct size */
106 SSVAL(outbody
.data
, 0x02,
107 out_session_flags
); /* session flags */
108 SSVAL(outbody
.data
, 0x04,
109 out_security_offset
); /* security buffer offset */
110 SSVAL(outbody
.data
, 0x06,
111 out_security_buffer
.length
); /* security buffer length */
113 outdyn
= out_security_buffer
;
115 return smbd_smb2_request_done_ex(smb2req
, status
, outbody
, &outdyn
,
119 static int smbd_smb2_session_destructor(struct smbd_smb2_session
*session
)
121 if (session
->sconn
== NULL
) {
125 /* first free all tcons */
126 while (session
->tcons
.list
) {
127 talloc_free(session
->tcons
.list
);
130 idr_remove(session
->sconn
->smb2
.sessions
.idtree
, session
->vuid
);
131 DLIST_REMOVE(session
->sconn
->smb2
.sessions
.list
, session
);
132 invalidate_vuid(session
->sconn
, session
->vuid
);
135 session
->status
= NT_STATUS_USER_SESSION_DELETED
;
136 session
->sconn
= NULL
;
141 static NTSTATUS
smbd_smb2_common_ntlmssp_auth_return(struct smbd_smb2_session
*session
,
142 struct smbd_smb2_request
*smb2req
,
143 uint8_t in_security_mode
,
144 DATA_BLOB in_security_buffer
,
145 uint16_t *out_session_flags
,
146 uint64_t *out_session_id
)
150 if ((in_security_mode
& SMB2_NEGOTIATE_SIGNING_REQUIRED
) ||
151 lp_server_signing() == SMB_SIGNING_REQUIRED
) {
152 session
->do_signing
= true;
155 if (security_session_user_level(session
->session_info
, NULL
) < SECURITY_USER
) {
156 /* we map anonymous to guest internally */
157 *out_session_flags
|= SMB2_SESSION_FLAG_IS_GUEST
;
158 *out_session_flags
|= SMB2_SESSION_FLAG_IS_NULL
;
159 /* force no signing */
160 session
->do_signing
= false;
164 session
->session_key
= session
->session_info
->session_key
;
166 session
->compat_vuser
= talloc_zero(session
, user_struct
);
167 if (session
->compat_vuser
== NULL
) {
168 TALLOC_FREE(session
);
169 return NT_STATUS_NO_MEMORY
;
171 session
->compat_vuser
->gensec_security
= session
->gensec_security
;
172 session
->compat_vuser
->homes_snum
= -1;
173 session
->compat_vuser
->session_info
= session
->session_info
;
174 session
->compat_vuser
->session_keystr
= NULL
;
175 session
->compat_vuser
->vuid
= session
->vuid
;
176 DLIST_ADD(session
->sconn
->smb1
.sessions
.validated_users
, session
->compat_vuser
);
178 if (security_session_user_level(session
->session_info
, NULL
) >= SECURITY_USER
) {
179 session
->compat_vuser
->homes_snum
=
180 register_homes_share(session
->session_info
->unix_info
->unix_name
);
183 if (!session_claim(session
->sconn
, session
->compat_vuser
)) {
184 DEBUG(1, ("smb2: Failed to claim session "
186 session
->compat_vuser
->vuid
));
187 TALLOC_FREE(session
);
188 return NT_STATUS_LOGON_FAILURE
;
191 set_current_user_info(session
->session_info
->unix_info
->sanitized_username
,
192 session
->session_info
->unix_info
->unix_name
,
193 session
->session_info
->info
->domain_name
);
195 reload_services(smb2req
->sconn
, conn_snum_used
, true);
197 session
->status
= NT_STATUS_OK
;
200 * we attach the session to the request
201 * so that the response can be signed
203 smb2req
->session
= session
;
205 smb2req
->do_signing
= true;
208 global_client_caps
|= (CAP_LEVEL_II_OPLOCKS
|CAP_STATUS32
);
210 *out_session_id
= session
->vuid
;
215 static NTSTATUS
smbd_smb2_raw_ntlmssp_auth(struct smbd_smb2_session
*session
,
216 struct smbd_smb2_request
*smb2req
,
217 uint8_t in_security_mode
,
218 DATA_BLOB in_security_buffer
,
219 uint16_t *out_session_flags
,
220 DATA_BLOB
*out_security_buffer
,
221 uint64_t *out_session_id
)
225 *out_security_buffer
= data_blob_null
;
227 if (session
->gensec_security
== NULL
) {
228 status
= auth_generic_prepare(session
, session
->sconn
->remote_address
,
229 &session
->gensec_security
);
230 if (!NT_STATUS_IS_OK(status
)) {
231 TALLOC_FREE(session
);
235 gensec_want_feature(session
->gensec_security
, GENSEC_FEATURE_SESSION_KEY
);
236 gensec_want_feature(session
->gensec_security
, GENSEC_FEATURE_UNIX_TOKEN
);
238 if (session
->sconn
->use_gensec_hook
) {
239 status
= gensec_start_mech_by_oid(session
->gensec_security
, GENSEC_OID_SPNEGO
);
241 status
= gensec_start_mech_by_oid(session
->gensec_security
, GENSEC_OID_NTLMSSP
);
243 if (!NT_STATUS_IS_OK(status
)) {
244 TALLOC_FREE(session
);
250 status
= gensec_update(session
->gensec_security
,
253 out_security_buffer
);
255 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
256 *out_session_id
= session
->vuid
;
260 status
= gensec_session_info(session
->gensec_security
,
262 &session
->session_info
);
264 if (!NT_STATUS_IS_OK(status
)) {
265 TALLOC_FREE(session
);
268 *out_session_id
= session
->vuid
;
270 return smbd_smb2_common_ntlmssp_auth_return(session
,
278 static NTSTATUS
smbd_smb2_session_setup(struct smbd_smb2_request
*smb2req
,
279 uint64_t in_session_id
,
280 uint8_t in_security_mode
,
281 DATA_BLOB in_security_buffer
,
282 uint16_t *out_session_flags
,
283 DATA_BLOB
*out_security_buffer
,
284 uint64_t *out_session_id
)
286 struct smbd_smb2_session
*session
;
288 *out_session_flags
= 0;
291 if (in_session_id
== 0) {
294 /* create a new session */
295 session
= talloc_zero(smb2req
->sconn
, struct smbd_smb2_session
);
296 if (session
== NULL
) {
297 return NT_STATUS_NO_MEMORY
;
299 session
->status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
300 id
= idr_get_new_random(smb2req
->sconn
->smb2
.sessions
.idtree
,
302 smb2req
->sconn
->smb2
.sessions
.limit
);
304 return NT_STATUS_INSUFFICIENT_RESOURCES
;
308 session
->tcons
.idtree
= idr_init(session
);
309 if (session
->tcons
.idtree
== NULL
) {
310 return NT_STATUS_NO_MEMORY
;
312 session
->tcons
.limit
= 0x0000FFFE;
313 session
->tcons
.list
= NULL
;
315 DLIST_ADD_END(smb2req
->sconn
->smb2
.sessions
.list
, session
,
316 struct smbd_smb2_session
*);
317 session
->sconn
= smb2req
->sconn
;
318 talloc_set_destructor(session
, smbd_smb2_session_destructor
);
322 /* lookup an existing session */
323 p
= idr_find(smb2req
->sconn
->smb2
.sessions
.idtree
, in_session_id
);
325 return NT_STATUS_USER_SESSION_DELETED
;
327 session
= talloc_get_type_abort(p
, struct smbd_smb2_session
);
330 if (NT_STATUS_IS_OK(session
->status
)) {
331 return NT_STATUS_REQUEST_NOT_ACCEPTED
;
334 return smbd_smb2_raw_ntlmssp_auth(session
,
343 NTSTATUS
smbd_smb2_request_process_logoff(struct smbd_smb2_request
*req
)
348 status
= smbd_smb2_request_verify_sizes(req
, 0x04);
349 if (!NT_STATUS_IS_OK(status
)) {
350 return smbd_smb2_request_error(req
, status
);
354 * TODO: cancel all outstanding requests on the session
355 * and delete all tree connections.
357 smbd_smb2_session_destructor(req
->session
);
359 * we may need to sign the response, so we need to keep
360 * the session until the response is sent to the wire.
362 talloc_steal(req
, req
->session
);
364 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x04);
365 if (outbody
.data
== NULL
) {
366 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
369 SSVAL(outbody
.data
, 0x00, 0x04); /* struct size */
370 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
372 return smbd_smb2_request_done(req
, outbody
, NULL
);