source: vendor/3.6.0/source3/smbd/smb2_sesssetup.c

Last change on this file was 740, checked in by Silvan Scherrer, 13 years ago

Samba Server: update vendor to 3.6.0
File size: 25.7 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22#include "includes.h"
23#include "smbd/smbd.h"
24#include "smbd/globals.h"
25#include "../libcli/smb/smb_common.h"
26#include "../libcli/auth/spnego.h"
27#include "../libcli/auth/ntlmssp.h"
28#include "ntlmssp_wrap.h"
29#include "../librpc/gen_ndr/krb5pac.h"
30#include "libads/kerberos_proto.h"
31#include "../lib/util/asn1.h"
32#include "auth.h"
33
34static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *smb2req,
35 uint64_t in_session_id,
36 uint8_t in_security_mode,
37 DATA_BLOB in_security_buffer,
38 uint16_t *out_session_flags,
39 DATA_BLOB *out_security_buffer,
40 uint64_t *out_session_id);
41
42NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *smb2req)
43{
44 const uint8_t *inhdr;
45 const uint8_t *inbody;
46 int i = smb2req->current_idx;
47 uint8_t *outhdr;
48 DATA_BLOB outbody;
49 DATA_BLOB outdyn;
50 size_t expected_body_size = 0x19;
51 size_t body_size;
52 uint64_t in_session_id;
53 uint8_t in_security_mode;
54 uint16_t in_security_offset;
55 uint16_t in_security_length;
56 DATA_BLOB in_security_buffer;
57 uint16_t out_session_flags;
58 uint64_t out_session_id;
59 uint16_t out_security_offset;
60 DATA_BLOB out_security_buffer;
61 NTSTATUS status;
62
63 inhdr = (const uint8_t *)smb2req->in.vector[i+0].iov_base;
64
65 if (smb2req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
66 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
67 }
68
69 inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
70
71 body_size = SVAL(inbody, 0x00);
72 if (body_size != expected_body_size) {
73 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
74 }
75
76 in_security_offset = SVAL(inbody, 0x0C);
77 in_security_length = SVAL(inbody, 0x0E);
78
79 if (in_security_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
80 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
81 }
82
83 if (in_security_length > smb2req->in.vector[i+2].iov_len) {
84 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
85 }
86
87 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
88 in_security_mode = CVAL(inbody, 0x03);
89 in_security_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base;
90 in_security_buffer.length = in_security_length;
91
92 status = smbd_smb2_session_setup(smb2req,
93 in_session_id,
94 in_security_mode,
95 in_security_buffer,
96 &out_session_flags,
97 &out_security_buffer,
98 &out_session_id);
99 if (!NT_STATUS_IS_OK(status) &&
100 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
101 status = nt_status_squash(status);
102 return smbd_smb2_request_error(smb2req, status);
103 }
104
105 out_security_offset = SMB2_HDR_BODY + 0x08;
106
107 outhdr = (uint8_t *)smb2req->out.vector[i].iov_base;
108
109 outbody = data_blob_talloc(smb2req->out.vector, NULL, 0x08);
110 if (outbody.data == NULL) {
111 return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
112 }
113
114 SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id);
115
116 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
117 SSVAL(outbody.data, 0x02,
118 out_session_flags); /* session flags */
119 SSVAL(outbody.data, 0x04,
120 out_security_offset); /* security buffer offset */
121 SSVAL(outbody.data, 0x06,
122 out_security_buffer.length); /* security buffer length */
123
124 outdyn = out_security_buffer;
125
126 return smbd_smb2_request_done_ex(smb2req, status, outbody, &outdyn,
127 __location__);
128}
129
130static int smbd_smb2_session_destructor(struct smbd_smb2_session *session)
131{
132 if (session->sconn == NULL) {
133 return 0;
134 }
135
136 /* first free all tcons */
137 while (session->tcons.list) {
138 talloc_free(session->tcons.list);
139 }
140
141 idr_remove(session->sconn->smb2.sessions.idtree, session->vuid);
142 DLIST_REMOVE(session->sconn->smb2.sessions.list, session);
143 invalidate_vuid(session->sconn, session->vuid);
144
145 session->vuid = 0;
146 session->status = NT_STATUS_USER_SESSION_DELETED;
147 session->sconn = NULL;
148
149 return 0;
150}
151
152static NTSTATUS setup_ntlmssp_session_info(struct smbd_smb2_session *session,
153 NTSTATUS status)
154{
155 if (NT_STATUS_IS_OK(status)) {
156 status = auth_ntlmssp_steal_session_info(session,
157 session->auth_ntlmssp_state,
158 &session->session_info);
159 } else {
160 /* Note that this session_info won't have a session
161 * key. But for map to guest, that's exactly the right
162 * thing - we can't reasonably guess the key the
163 * client wants, as the password was wrong */
164 status = do_map_to_guest(status,
165 &session->session_info,
166 auth_ntlmssp_get_username(session->auth_ntlmssp_state),
167 auth_ntlmssp_get_domain(session->auth_ntlmssp_state));
168 }
169 return status;
170}
171
172#ifdef HAVE_KRB5
173static NTSTATUS smbd_smb2_session_setup_krb5(struct smbd_smb2_session *session,
174 struct smbd_smb2_request *smb2req,
175 uint8_t in_security_mode,
176 const DATA_BLOB *secblob,
177 const char *mechOID,
178 uint16_t *out_session_flags,
179 DATA_BLOB *out_security_buffer,
180 uint64_t *out_session_id)
181{
182 DATA_BLOB ap_rep = data_blob_null;
183 DATA_BLOB ap_rep_wrapped = data_blob_null;
184 DATA_BLOB ticket = data_blob_null;
185 DATA_BLOB session_key = data_blob_null;
186 DATA_BLOB secblob_out = data_blob_null;
187 uint8 tok_id[2];
188 struct PAC_LOGON_INFO *logon_info = NULL;
189 char *principal = NULL;
190 char *user = NULL;
191 char *domain = NULL;
192 struct passwd *pw = NULL;
193 NTSTATUS status;
194 char *real_username;
195 fstring tmp;
196 bool username_was_mapped = false;
197 bool map_domainuser_to_guest = false;
198
199 if (!spnego_parse_krb5_wrap(talloc_tos(), *secblob, &ticket, tok_id)) {
200 status = NT_STATUS_LOGON_FAILURE;
201 goto fail;
202 }
203
204 status = ads_verify_ticket(smb2req, lp_realm(), 0, &ticket,
205 &principal, &logon_info, &ap_rep,
206 &session_key, true);
207
208 if (!NT_STATUS_IS_OK(status)) {
209 DEBUG(1,("smb2: Failed to verify incoming ticket with error %s!\n",
210 nt_errstr(status)));
211 if (!NT_STATUS_EQUAL(status, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
212 status = NT_STATUS_LOGON_FAILURE;
213 }
214 goto fail;
215 }
216
217 status = get_user_from_kerberos_info(talloc_tos(),
218 smb2req->sconn->client_id.name,
219 principal, logon_info,
220 &username_was_mapped,
221 &map_domainuser_to_guest,
222 &user, &domain,
223 &real_username, &pw);
224 if (!NT_STATUS_IS_OK(status)) {
225 goto fail;
226 }
227
228 /* save the PAC data if we have it */
229 if (logon_info) {
230 netsamlogon_cache_store(user, &logon_info->info3);
231 }
232
233 /* setup the string used by %U */
234 sub_set_smb_name(real_username);
235
236 /* reload services so that the new %U is taken into account */
237 reload_services(smb2req->sconn->msg_ctx, smb2req->sconn->sock, true);
238
239 status = make_server_info_krb5(session,
240 user, domain, real_username, pw,
241 logon_info, map_domainuser_to_guest,
242 &session->session_info);
243 if (!NT_STATUS_IS_OK(status)) {
244 DEBUG(1, ("smb2: make_server_info_krb5 failed\n"));
245 goto fail;
246 }
247
248
249 session->session_info->nss_token |= username_was_mapped;
250
251 /* we need to build the token for the user. make_session_info_guest()
252 already does this */
253
254 if (!session->session_info->security_token ) {
255 status = create_local_token(session->session_info);
256 if (!NT_STATUS_IS_OK(status)) {
257 DEBUG(10,("smb2: failed to create local token: %s\n",
258 nt_errstr(status)));
259 goto fail;
260 }
261 }
262
263 if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
264 lp_server_signing() == Required) {
265 session->do_signing = true;
266 }
267
268 if (session->session_info->guest) {
269 /* we map anonymous to guest internally */
270 *out_session_flags |= SMB2_SESSION_FLAG_IS_GUEST;
271 *out_session_flags |= SMB2_SESSION_FLAG_IS_NULL;
272 /* force no signing */
273 session->do_signing = false;
274 }
275
276 data_blob_free(&session->session_info->user_session_key);
277 session->session_info->user_session_key =
278 data_blob_talloc(
279 session->session_info,
280 session_key.data,
281 session_key.length);
282 if (session_key.length > 0) {
283 if (session->session_info->user_session_key.data == NULL) {
284 status = NT_STATUS_NO_MEMORY;
285 goto fail;
286 }
287 }
288 session->session_key = session->session_info->user_session_key;
289
290 session->compat_vuser = talloc_zero(session, user_struct);
291 if (session->compat_vuser == NULL) {
292 status = NT_STATUS_NO_MEMORY;
293 goto fail;
294 }
295 session->compat_vuser->auth_ntlmssp_state = NULL;
296 session->compat_vuser->homes_snum = -1;
297 session->compat_vuser->session_info = session->session_info;
298 session->compat_vuser->session_keystr = NULL;
299 session->compat_vuser->vuid = session->vuid;
300 DLIST_ADD(session->sconn->smb1.sessions.validated_users, session->compat_vuser);
301
302 /* This is a potentially untrusted username */
303 alpha_strcpy(tmp, user, ". _-$", sizeof(tmp));
304 session->session_info->sanitized_username =
305 talloc_strdup(session->session_info, tmp);
306
307 if (!session->session_info->guest) {
308 session->compat_vuser->homes_snum =
309 register_homes_share(session->session_info->unix_name);
310 }
311
312 if (!session_claim(session->sconn, session->compat_vuser)) {
313 DEBUG(1, ("smb2: Failed to claim session "
314 "for vuid=%d\n",
315 session->compat_vuser->vuid));
316 goto fail;
317 }
318
319 session->status = NT_STATUS_OK;
320
321 /*
322 * we attach the session to the request
323 * so that the response can be signed
324 */
325 smb2req->session = session;
326 if (session->do_signing) {
327 smb2req->do_signing = true;
328 }
329
330 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
331 status = NT_STATUS_OK;
332
333 /* wrap that up in a nice GSS-API wrapping */
334 ap_rep_wrapped = spnego_gen_krb5_wrap(talloc_tos(), ap_rep,
335 TOK_ID_KRB_AP_REP);
336
337 secblob_out = spnego_gen_auth_response(
338 talloc_tos(),
339 &ap_rep_wrapped,
340 status,
341 mechOID);
342
343 *out_security_buffer = data_blob_talloc(smb2req,
344 secblob_out.data,
345 secblob_out.length);
346 if (secblob_out.data && out_security_buffer->data == NULL) {
347 status = NT_STATUS_NO_MEMORY;
348 goto fail;
349 }
350
351 data_blob_free(&ap_rep);
352 data_blob_free(&ap_rep_wrapped);
353 data_blob_free(&ticket);
354 data_blob_free(&session_key);
355 data_blob_free(&secblob_out);
356
357 *out_session_id = session->vuid;
358
359 return NT_STATUS_OK;
360
361 fail:
362
363 data_blob_free(&ap_rep);
364 data_blob_free(&ap_rep_wrapped);
365 data_blob_free(&ticket);
366 data_blob_free(&session_key);
367 data_blob_free(&secblob_out);
368
369 ap_rep_wrapped = data_blob_null;
370 secblob_out = spnego_gen_auth_response(
371 talloc_tos(),
372 &ap_rep_wrapped,
373 status,
374 mechOID);
375
376 *out_security_buffer = data_blob_talloc(smb2req,
377 secblob_out.data,
378 secblob_out.length);
379 data_blob_free(&secblob_out);
380 return status;
381}
382#endif
383
384static NTSTATUS smbd_smb2_spnego_negotiate(struct smbd_smb2_session *session,
385 struct smbd_smb2_request *smb2req,
386 uint8_t in_security_mode,
387 DATA_BLOB in_security_buffer,
388 uint16_t *out_session_flags,
389 DATA_BLOB *out_security_buffer,
390 uint64_t *out_session_id)
391{
392 DATA_BLOB secblob_in = data_blob_null;
393 DATA_BLOB chal_out = data_blob_null;
394 char *kerb_mech = NULL;
395 NTSTATUS status;
396
397 /* Ensure we have no old NTLM state around. */
398 TALLOC_FREE(session->auth_ntlmssp_state);
399
400 status = parse_spnego_mechanisms(talloc_tos(), in_security_buffer,
401 &secblob_in, &kerb_mech);
402 if (!NT_STATUS_IS_OK(status)) {
403 goto out;
404 }
405
406#ifdef HAVE_KRB5
407 if (kerb_mech && ((lp_security()==SEC_ADS) ||
408 USE_KERBEROS_KEYTAB) ) {
409 status = smbd_smb2_session_setup_krb5(session,
410 smb2req,
411 in_security_mode,
412 &secblob_in,
413 kerb_mech,
414 out_session_flags,
415 out_security_buffer,
416 out_session_id);
417
418 goto out;
419 }
420#endif
421
422 if (kerb_mech) {
423 /* The mechtoken is a krb5 ticket, but
424 * we need to fall back to NTLM. */
425
426 DEBUG(3,("smb2: Got krb5 ticket in SPNEGO "
427 "but set to downgrade to NTLMSSP\n"));
428
429 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
430 } else {
431 /* Fall back to NTLMSSP. */
432 status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
433 if (!NT_STATUS_IS_OK(status)) {
434 goto out;
435 }
436
437 status = auth_ntlmssp_update(session->auth_ntlmssp_state,
438 secblob_in,
439 &chal_out);
440 }
441
442 if (!NT_STATUS_IS_OK(status) &&
443 !NT_STATUS_EQUAL(status,
444 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
445 goto out;
446 }
447
448 *out_security_buffer = spnego_gen_auth_response(smb2req,
449 &chal_out,
450 status,
451 OID_NTLMSSP);
452 if (out_security_buffer->data == NULL) {
453 status = NT_STATUS_NO_MEMORY;
454 goto out;
455 }
456 *out_session_id = session->vuid;
457
458 out:
459
460 data_blob_free(&secblob_in);
461 data_blob_free(&chal_out);
462 TALLOC_FREE(kerb_mech);
463 if (!NT_STATUS_IS_OK(status) &&
464 !NT_STATUS_EQUAL(status,
465 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
466 TALLOC_FREE(session->auth_ntlmssp_state);
467 TALLOC_FREE(session);
468 }
469 return status;
470}
471
472static NTSTATUS smbd_smb2_common_ntlmssp_auth_return(struct smbd_smb2_session *session,
473 struct smbd_smb2_request *smb2req,
474 uint8_t in_security_mode,
475 DATA_BLOB in_security_buffer,
476 uint16_t *out_session_flags,
477 uint64_t *out_session_id)
478{
479 fstring tmp;
480
481 if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
482 lp_server_signing() == Required) {
483 session->do_signing = true;
484 }
485
486 if (session->session_info->guest) {
487 /* we map anonymous to guest internally */
488 *out_session_flags |= SMB2_SESSION_FLAG_IS_GUEST;
489 *out_session_flags |= SMB2_SESSION_FLAG_IS_NULL;
490 /* force no signing */
491 session->do_signing = false;
492 }
493
494 session->session_key = session->session_info->user_session_key;
495
496 session->compat_vuser = talloc_zero(session, user_struct);
497 if (session->compat_vuser == NULL) {
498 TALLOC_FREE(session->auth_ntlmssp_state);
499 TALLOC_FREE(session);
500 return NT_STATUS_NO_MEMORY;
501 }
502 session->compat_vuser->auth_ntlmssp_state = session->auth_ntlmssp_state;
503 session->compat_vuser->homes_snum = -1;
504 session->compat_vuser->session_info = session->session_info;
505 session->compat_vuser->session_keystr = NULL;
506 session->compat_vuser->vuid = session->vuid;
507 DLIST_ADD(session->sconn->smb1.sessions.validated_users, session->compat_vuser);
508
509 /* This is a potentially untrusted username */
510 alpha_strcpy(tmp,
511 auth_ntlmssp_get_username(session->auth_ntlmssp_state),
512 ". _-$",
513 sizeof(tmp));
514 session->session_info->sanitized_username = talloc_strdup(
515 session->session_info, tmp);
516
517 if (!session->compat_vuser->session_info->guest) {
518 session->compat_vuser->homes_snum =
519 register_homes_share(session->session_info->unix_name);
520 }
521
522 if (!session_claim(session->sconn, session->compat_vuser)) {
523 DEBUG(1, ("smb2: Failed to claim session "
524 "for vuid=%d\n",
525 session->compat_vuser->vuid));
526 TALLOC_FREE(session->auth_ntlmssp_state);
527 TALLOC_FREE(session);
528 return NT_STATUS_LOGON_FAILURE;
529 }
530
531
532 session->status = NT_STATUS_OK;
533
534 /*
535 * we attach the session to the request
536 * so that the response can be signed
537 */
538 smb2req->session = session;
539 if (session->do_signing) {
540 smb2req->do_signing = true;
541 }
542
543 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
544
545 *out_session_id = session->vuid;
546
547 return NT_STATUS_OK;
548}
549
550static NTSTATUS smbd_smb2_spnego_auth(struct smbd_smb2_session *session,
551 struct smbd_smb2_request *smb2req,
552 uint8_t in_security_mode,
553 DATA_BLOB in_security_buffer,
554 uint16_t *out_session_flags,
555 DATA_BLOB *out_security_buffer,
556 uint64_t *out_session_id)
557{
558 DATA_BLOB auth = data_blob_null;
559 DATA_BLOB auth_out = data_blob_null;
560 NTSTATUS status;
561
562 if (!spnego_parse_auth(talloc_tos(), in_security_buffer, &auth)) {
563 TALLOC_FREE(session);
564 return NT_STATUS_LOGON_FAILURE;
565 }
566
567 if (auth.data[0] == ASN1_APPLICATION(0)) {
568 /* Might be a second negTokenTarg packet */
569 DATA_BLOB secblob_in = data_blob_null;
570 char *kerb_mech = NULL;
571
572 status = parse_spnego_mechanisms(talloc_tos(),
573 in_security_buffer,
574 &secblob_in, &kerb_mech);
575 if (!NT_STATUS_IS_OK(status)) {
576 TALLOC_FREE(session);
577 return status;
578 }
579
580#ifdef HAVE_KRB5
581 if (kerb_mech && ((lp_security()==SEC_ADS) ||
582 USE_KERBEROS_KEYTAB) ) {
583 status = smbd_smb2_session_setup_krb5(session,
584 smb2req,
585 in_security_mode,
586 &secblob_in,
587 kerb_mech,
588 out_session_flags,
589 out_security_buffer,
590 out_session_id);
591
592 data_blob_free(&secblob_in);
593 TALLOC_FREE(kerb_mech);
594 if (!NT_STATUS_IS_OK(status)) {
595 TALLOC_FREE(session);
596 }
597 return status;
598 }
599#endif
600
601 /* Can't blunder into NTLMSSP auth if we have
602 * a krb5 ticket. */
603
604 if (kerb_mech) {
605 DEBUG(3,("smb2: network "
606 "misconfiguration, client sent us a "
607 "krb5 ticket and kerberos security "
608 "not enabled\n"));
609 TALLOC_FREE(session);
610 data_blob_free(&secblob_in);
611 TALLOC_FREE(kerb_mech);
612 return NT_STATUS_LOGON_FAILURE;
613 }
614
615 data_blob_free(&secblob_in);
616 }
617
618 if (session->auth_ntlmssp_state == NULL) {
619 status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
620 if (!NT_STATUS_IS_OK(status)) {
621 data_blob_free(&auth);
622 TALLOC_FREE(session);
623 return status;
624 }
625 }
626
627 status = auth_ntlmssp_update(session->auth_ntlmssp_state,
628 auth,
629 &auth_out);
630 /* We need to call setup_ntlmssp_session_info() if status==NT_STATUS_OK,
631 or if status is anything except NT_STATUS_MORE_PROCESSING_REQUIRED,
632 as this can trigger map to guest. */
633 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
634 status = setup_ntlmssp_session_info(session, status);
635 }
636
637 if (!NT_STATUS_IS_OK(status) &&
638 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
639 TALLOC_FREE(session->auth_ntlmssp_state);
640 data_blob_free(&auth);
641 TALLOC_FREE(session);
642 return status;
643 }
644
645 data_blob_free(&auth);
646
647 *out_security_buffer = spnego_gen_auth_response(smb2req,
648 &auth_out, status, NULL);
649
650 if (out_security_buffer->data == NULL) {
651 TALLOC_FREE(session->auth_ntlmssp_state);
652 TALLOC_FREE(session);
653 return NT_STATUS_NO_MEMORY;
654 }
655
656 *out_session_id = session->vuid;
657
658 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
659 return NT_STATUS_MORE_PROCESSING_REQUIRED;
660 }
661
662 /* We're done - claim the session. */
663 return smbd_smb2_common_ntlmssp_auth_return(session,
664 smb2req,
665 in_security_mode,
666 in_security_buffer,
667 out_session_flags,
668 out_session_id);
669}
670
671static NTSTATUS smbd_smb2_raw_ntlmssp_auth(struct smbd_smb2_session *session,
672 struct smbd_smb2_request *smb2req,
673 uint8_t in_security_mode,
674 DATA_BLOB in_security_buffer,
675 uint16_t *out_session_flags,
676 DATA_BLOB *out_security_buffer,
677 uint64_t *out_session_id)
678{
679 NTSTATUS status;
680 DATA_BLOB secblob_out = data_blob_null;
681
682 if (session->auth_ntlmssp_state == NULL) {
683 status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
684 if (!NT_STATUS_IS_OK(status)) {
685 TALLOC_FREE(session);
686 return status;
687 }
688 }
689
690 /* RAW NTLMSSP */
691 status = auth_ntlmssp_update(session->auth_ntlmssp_state,
692 in_security_buffer,
693 &secblob_out);
694
695 if (NT_STATUS_IS_OK(status) ||
696 NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
697 *out_security_buffer = data_blob_talloc(smb2req,
698 secblob_out.data,
699 secblob_out.length);
700 if (secblob_out.data && out_security_buffer->data == NULL) {
701 TALLOC_FREE(session->auth_ntlmssp_state);
702 TALLOC_FREE(session);
703 return NT_STATUS_NO_MEMORY;
704 }
705 }
706
707 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
708 *out_session_id = session->vuid;
709 return status;
710 }
711
712 status = setup_ntlmssp_session_info(session, status);
713
714 if (!NT_STATUS_IS_OK(status)) {
715 TALLOC_FREE(session->auth_ntlmssp_state);
716 TALLOC_FREE(session);
717 return status;
718 }
719 *out_session_id = session->vuid;
720
721 return smbd_smb2_common_ntlmssp_auth_return(session,
722 smb2req,
723 in_security_mode,
724 in_security_buffer,
725 out_session_flags,
726 out_session_id);
727}
728
729static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *smb2req,
730 uint64_t in_session_id,
731 uint8_t in_security_mode,
732 DATA_BLOB in_security_buffer,
733 uint16_t *out_session_flags,
734 DATA_BLOB *out_security_buffer,
735 uint64_t *out_session_id)
736{
737 struct smbd_smb2_session *session;
738
739 *out_session_flags = 0;
740 *out_session_id = 0;
741
742 if (in_session_id == 0) {
743 int id;
744
745 /* create a new session */
746 session = talloc_zero(smb2req->sconn, struct smbd_smb2_session);
747 if (session == NULL) {
748 return NT_STATUS_NO_MEMORY;
749 }
750 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
751 id = idr_get_new_random(smb2req->sconn->smb2.sessions.idtree,
752 session,
753 smb2req->sconn->smb2.sessions.limit);
754 if (id == -1) {
755 return NT_STATUS_INSUFFICIENT_RESOURCES;
756 }
757 session->vuid = id;
758
759 session->tcons.idtree = idr_init(session);
760 if (session->tcons.idtree == NULL) {
761 return NT_STATUS_NO_MEMORY;
762 }
763 session->tcons.limit = 0x0000FFFE;
764 session->tcons.list = NULL;
765
766 DLIST_ADD_END(smb2req->sconn->smb2.sessions.list, session,
767 struct smbd_smb2_session *);
768 session->sconn = smb2req->sconn;
769 talloc_set_destructor(session, smbd_smb2_session_destructor);
770 } else {
771 void *p;
772
773 /* lookup an existing session */
774 p = idr_find(smb2req->sconn->smb2.sessions.idtree, in_session_id);
775 if (p == NULL) {
776 return NT_STATUS_USER_SESSION_DELETED;
777 }
778 session = talloc_get_type_abort(p, struct smbd_smb2_session);
779 }
780
781 if (NT_STATUS_IS_OK(session->status)) {
782 return NT_STATUS_REQUEST_NOT_ACCEPTED;
783 }
784
785 if (in_security_buffer.data[0] == ASN1_APPLICATION(0)) {
786 return smbd_smb2_spnego_negotiate(session,
787 smb2req,
788 in_security_mode,
789 in_security_buffer,
790 out_session_flags,
791 out_security_buffer,
792 out_session_id);
793 } else if (in_security_buffer.data[0] == ASN1_CONTEXT(1)) {
794 return smbd_smb2_spnego_auth(session,
795 smb2req,
796 in_security_mode,
797 in_security_buffer,
798 out_session_flags,
799 out_security_buffer,
800 out_session_id);
801 } else if (strncmp((char *)(in_security_buffer.data), "NTLMSSP", 7) == 0) {
802 return smbd_smb2_raw_ntlmssp_auth(session,
803 smb2req,
804 in_security_mode,
805 in_security_buffer,
806 out_session_flags,
807 out_security_buffer,
808 out_session_id);
809 }
810
811 /* Unknown packet type. */
812 DEBUG(1,("Unknown packet type %u in smb2 sessionsetup\n",
813 (unsigned int)in_security_buffer.data[0] ));
814 TALLOC_FREE(session->auth_ntlmssp_state);
815 TALLOC_FREE(session);
816 return NT_STATUS_LOGON_FAILURE;
817}
818
819NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
820{
821 const uint8_t *inhdr;
822 const uint8_t *outhdr;
823 int i = req->current_idx;
824 uint64_t in_session_id;
825 void *p;
826 struct smbd_smb2_session *session;
827 bool chained_fixup = false;
828
829 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
830
831 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
832
833 if (in_session_id == (0xFFFFFFFFFFFFFFFFLL)) {
834 if (req->async) {
835 /*
836 * async request - fill in session_id from
837 * already setup request out.vector[].iov_base.
838 */
839 outhdr = (const uint8_t *)req->out.vector[i].iov_base;
840 in_session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
841 } else if (i > 2) {
842 /*
843 * Chained request - fill in session_id from
844 * the previous request out.vector[].iov_base.
845 */
846 outhdr = (const uint8_t *)req->out.vector[i-3].iov_base;
847 in_session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
848 chained_fixup = true;
849 }
850 }
851
852 /* lookup an existing session */
853 p = idr_find(req->sconn->smb2.sessions.idtree, in_session_id);
854 if (p == NULL) {
855 return NT_STATUS_USER_SESSION_DELETED;
856 }
857 session = talloc_get_type_abort(p, struct smbd_smb2_session);
858
859 if (!NT_STATUS_IS_OK(session->status)) {
860 return NT_STATUS_ACCESS_DENIED;
861 }
862
863 set_current_user_info(session->session_info->sanitized_username,
864 session->session_info->unix_name,
865 session->session_info->info3->base.domain.string);
866
867 req->session = session;
868
869 if (chained_fixup) {
870 /* Fix up our own outhdr. */
871 outhdr = (const uint8_t *)req->out.vector[i].iov_base;
872 SBVAL(outhdr, SMB2_HDR_SESSION_ID, in_session_id);
873 }
874 return NT_STATUS_OK;
875}
876
877NTSTATUS smbd_smb2_request_process_logoff(struct smbd_smb2_request *req)
878{
879 const uint8_t *inbody;
880 int i = req->current_idx;
881 DATA_BLOB outbody;
882 size_t expected_body_size = 0x04;
883 size_t body_size;
884
885 if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
886 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
887 }
888
889 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
890
891 body_size = SVAL(inbody, 0x00);
892 if (body_size != expected_body_size) {
893 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
894 }
895
896 /*
897 * TODO: cancel all outstanding requests on the session
898 * and delete all tree connections.
899 */
900 smbd_smb2_session_destructor(req->session);
901 /*
902 * we may need to sign the response, so we need to keep
903 * the session until the response is sent to the wire.
904 */
905 talloc_steal(req, req->session);
906
907 outbody = data_blob_talloc(req->out.vector, NULL, 0x04);
908 if (outbody.data == NULL) {
909 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
910 }
911
912 SSVAL(outbody.data, 0x00, 0x04); /* struct size */
913 SSVAL(outbody.data, 0x02, 0); /* reserved */
914
915 return smbd_smb2_request_done(req, outbody, NULL);
916}
Note: See TracBrowser for help on using the repository browser.