source3/smbd/sesssetup.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    handle SMBsessionsetup
   4    Copyright (C) Andrew Tridgell 1998-2001
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
   7    Copyright (C) Luke Howard          2003
   8    Copyright (C) Volker Lendecke      2007
   9    Copyright (C) Jeremy Allison       2007
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26
  27 extern struct auth_context *negprot_global_auth_context;
  28 extern BOOL global_encrypted_passwords_negotiated;
  29 extern BOOL global_spnego_negotiated;
  30 extern enum protocol_types Protocol;
  31 extern int max_send;
  32
  33 uint32 global_client_caps = 0;
  34
  35 /*
  36   on a logon error possibly map the error to success if "map to guest"
  37   is set approriately
  38 */
  39 static NTSTATUS do_map_to_guest(NTSTATUS status,
  40                                 auth_serversupplied_info **server_info,
  41                                 const char *user, const char *domain)
  42 {
  43         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
  44                 if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER) ||
  45                     (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD)) {
  46                         DEBUG(3,("No such user %s [%s] - using guest account\n",
  47                                  user, domain));
  48                         status = make_server_info_guest(server_info);
  49                 }
  50         }
  51
  52         if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
  53                 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD) {
  54                         DEBUG(3,("Registered username %s for guest access\n",
  55                                 user));
  56                         status = make_server_info_guest(server_info);
  57                 }
  58         }
  59
  60         return status;
  61 }
  62
  63 /****************************************************************************
  64  Add the standard 'Samba' signature to the end of the session setup.
  65 ****************************************************************************/
  66
  67 static int push_signature(uint8 **outbuf)
  68 {
  69         char *lanman;
  70         int result, tmp;
  71
  72         result = 0;
  73
  74         tmp = message_push_string(outbuf, "Unix", STR_TERMINATE);
  75
  76         if (tmp == -1) return -1;
  77         result += tmp;
  78
  79         if (asprintf(&lanman, "Samba %s", SAMBA_VERSION_STRING) != -1) {
  80                 tmp = message_push_string(outbuf, lanman, STR_TERMINATE);
  81                 SAFE_FREE(lanman);
  82         }
  83         else {
  84                 tmp = message_push_string(outbuf, "Samba", STR_TERMINATE);
  85         }
  86
  87         if (tmp == -1) return -1;
  88         result += tmp;
  89
  90         tmp = message_push_string(outbuf, lp_workgroup(), STR_TERMINATE);
  91
  92         if (tmp == -1) return -1;
  93         result += tmp;
  94
  95         return result;
  96 }
  97
  98 /****************************************************************************
  99  Start the signing engine if needed. Don't fail signing here.
 100 ****************************************************************************/
 101
 102 static void sessionsetup_start_signing_engine(
 103                         const auth_serversupplied_info *server_info,
 104                         const uint8 *inbuf)
 105 {
 106         if (!server_info->guest && !srv_signing_started()) {
 107                 /* We need to start the signing engine
 108                  * here but a W2K client sends the old
 109                  * "BSRSPYL " signature instead of the
 110                  * correct one. Subsequent packets will
 111                  * be correct.
 112                  */
 113                 srv_check_sign_mac((char *)inbuf, False);
 114         }
 115 }
 116
 117 /****************************************************************************
 118  Send a security blob via a session setup reply.
 119 ****************************************************************************/
 120
 121 static void reply_sesssetup_blob(connection_struct *conn,
 122                                  struct smb_request *req,
 123                                  DATA_BLOB blob,
 124                                  NTSTATUS nt_status)
 125 {
 126         if (!NT_STATUS_IS_OK(nt_status) &&
 127             !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 128                 reply_nterror(req, nt_status_squash(nt_status));
 129         } else {
 130                 nt_status = nt_status_squash(nt_status);
 131                 SIVAL(req->outbuf, smb_rcls, NT_STATUS_V(nt_status));
 132                 SSVAL(req->outbuf, smb_vwv0, 0xFF); /* no chaining possible */
 133                 SSVAL(req->outbuf, smb_vwv3, blob.length);
 134
 135                 if ((message_push_blob(&req->outbuf, blob) == -1)
 136                     || (push_signature(&req->outbuf) == -1)) {
 137                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 138                 }
 139         }
 140
 141         show_msg((char *)req->outbuf);
 142         send_smb(smbd_server_fd(),(char *)req->outbuf);
 143         TALLOC_FREE(req->outbuf);
 144 }
 145
 146 /****************************************************************************
 147  Do a 'guest' logon, getting back the
 148 ****************************************************************************/
 149
 150 static NTSTATUS check_guest_password(auth_serversupplied_info **server_info)
 151 {
 152         struct auth_context *auth_context;
 153         auth_usersupplied_info *user_info = NULL;
 154
 155         NTSTATUS nt_status;
 156         unsigned char chal[8];
 157
 158         ZERO_STRUCT(chal);
 159
 160         DEBUG(3,("Got anonymous request\n"));
 161
 162         if (!NT_STATUS_IS_OK(nt_status = make_auth_context_fixed(&auth_context,
 163                                         chal))) {
 164                 return nt_status;
 165         }
 166
 167         if (!make_user_info_guest(&user_info)) {
 168                 (auth_context->free)(&auth_context);
 169                 return NT_STATUS_NO_MEMORY;
 170         }
 171
 172         nt_status = auth_context->check_ntlm_password(auth_context,
 173                                                 user_info,
 174                                                 server_info);
 175         (auth_context->free)(&auth_context);
 176         free_user_info(&user_info);
 177         return nt_status;
 178 }
 179
 180
 181 #ifdef HAVE_KRB5
 182
 183 #if 0
 184 /* Experiment that failed. See "only happens with a KDC" comment below. */
 185 /****************************************************************************
 186  Cerate a clock skew error blob for a Windows client.
 187 ****************************************************************************/
 188
 189 static BOOL make_krb5_skew_error(DATA_BLOB *pblob_out)
 190 {
 191         krb5_context context = NULL;
 192         krb5_error_code kerr = 0;
 193         krb5_data reply;
 194         krb5_principal host_princ = NULL;
 195         char *host_princ_s = NULL;
 196         BOOL ret = False;
 197
 198         *pblob_out = data_blob_null;
 199
 200         initialize_krb5_error_table();
 201         kerr = krb5_init_context(&context);
 202         if (kerr) {
 203                 return False;
 204         }
 205         /* Create server principal. */
 206         asprintf(&host_princ_s, "%s$@%s", global_myname(), lp_realm());
 207         if (!host_princ_s) {
 208                 goto out;
 209         }
 210         strlower_m(host_princ_s);
 211
 212         kerr = smb_krb5_parse_name(context, host_princ_s, &host_princ);
 213         if (kerr) {
 214                 DEBUG(10,("make_krb5_skew_error: smb_krb5_parse_name failed "
 215                         "for name %s: Error %s\n",
 216                         host_princ_s, error_message(kerr) ));
 217                 goto out;
 218         }
 219
 220         kerr = smb_krb5_mk_error(context, KRB5KRB_AP_ERR_SKEW,
 221                         host_princ, &reply);
 222         if (kerr) {
 223                 DEBUG(10,("make_krb5_skew_error: smb_krb5_mk_error "
 224                         "failed: Error %s\n",
 225                         error_message(kerr) ));
 226                 goto out;
 227         }
 228
 229         *pblob_out = data_blob(reply.data, reply.length);
 230         kerberos_free_data_contents(context,&reply);
 231         ret = True;
 232
 233   out:
 234
 235         if (host_princ_s) {
 236                 SAFE_FREE(host_princ_s);
 237         }
 238         if (host_princ) {
 239                 krb5_free_principal(context, host_princ);
 240         }
 241         krb5_free_context(context);
 242         return ret;
 243 }
 244 #endif
 245
 246 /****************************************************************************
 247  Reply to a session setup spnego negotiate packet for kerberos.
 248 ****************************************************************************/
 249
 250 static void reply_spnego_kerberos(connection_struct *conn,
 251                                   struct smb_request *req,
 252                                   DATA_BLOB *secblob,
 253                                   uint16 vuid,
 254                                   BOOL *p_invalidate_vuid)
 255 {
 256         TALLOC_CTX *mem_ctx;
 257         DATA_BLOB ticket;
 258         char *client, *p, *domain;
 259         fstring netbios_domain_name;
 260         struct passwd *pw;
 261         fstring user;
 262         int sess_vuid = req->vuid;
 263         NTSTATUS ret = NT_STATUS_OK;
 264         PAC_DATA *pac_data;
 265         DATA_BLOB ap_rep, ap_rep_wrapped, response;
 266         auth_serversupplied_info *server_info = NULL;
 267         DATA_BLOB session_key = data_blob_null;
 268         uint8 tok_id[2];
 269         DATA_BLOB nullblob = data_blob_null;
 270         fstring real_username;
 271         BOOL map_domainuser_to_guest = False;
 272         BOOL username_was_mapped;
 273         PAC_LOGON_INFO *logon_info = NULL;
 274
 275         ZERO_STRUCT(ticket);
 276         ZERO_STRUCT(pac_data);
 277         ZERO_STRUCT(ap_rep);
 278         ZERO_STRUCT(ap_rep_wrapped);
 279         ZERO_STRUCT(response);
 280
 281         /* Normally we will always invalidate the intermediate vuid. */
 282         *p_invalidate_vuid = True;
 283
 284         mem_ctx = talloc_init("reply_spnego_kerberos");
 285         if (mem_ctx == NULL) {
 286                 reply_nterror(req, nt_status_squash(NT_STATUS_NO_MEMORY));
 287                 return;
 288         }
 289
 290         if (!spnego_parse_krb5_wrap(*secblob, &ticket, tok_id)) {
 291                 talloc_destroy(mem_ctx);
 292                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
 293                 return;
 294         }
 295
 296         ret = ads_verify_ticket(mem_ctx, lp_realm(), 0, &ticket,
 297                                 &client, &pac_data, &ap_rep,
 298                                 &session_key, True);
 299
 300         data_blob_free(&ticket);
 301
 302         if (!NT_STATUS_IS_OK(ret)) {
 303 #if 0
 304                 /* Experiment that failed.
 305                  * See "only happens with a KDC" comment below. */
 306
 307                 if (NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
 308
 309                         /*
 310                          * Windows in this case returns
 311                          * NT_STATUS_MORE_PROCESSING_REQUIRED
 312                          * with a negTokenTarg blob containing an krb5_error
 313                          * struct ASN1 encoded containing KRB5KRB_AP_ERR_SKEW.
 314                          * The client then fixes its clock and continues rather
 315                          * than giving an error. JRA.
 316                          * -- Looks like this only happens with a KDC. JRA.
 317                          */
 318
 319                         BOOL ok = make_krb5_skew_error(&ap_rep);
 320                         if (!ok) {
 321                                 talloc_destroy(mem_ctx);
 322                                 return ERROR_NT(nt_status_squash(
 323                                                 NT_STATUS_LOGON_FAILURE));
 324                         }
 325                         ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
 326                                         TOK_ID_KRB_ERROR);
 327                         response = spnego_gen_auth_response(&ap_rep_wrapped,
 328                                         ret, OID_KERBEROS5_OLD);
 329                         reply_sesssetup_blob(conn, inbuf, outbuf, response,
 330                                         NT_STATUS_MORE_PROCESSING_REQUIRED);
 331
 332                         /*
 333                          * In this one case we don't invalidate the
 334                          * intermediate vuid as we're expecting the client
 335                          * to re-use it for the next sessionsetupX packet. JRA.
 336                          */
 337
 338                         *p_invalidate_vuid = False;
 339
 340                         data_blob_free(&ap_rep);
 341                         data_blob_free(&ap_rep_wrapped);
 342                         data_blob_free(&response);
 343                         talloc_destroy(mem_ctx);
 344                         return -1; /* already replied */
 345                 }
 346 #else
 347                 if (!NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
 348                         ret = NT_STATUS_LOGON_FAILURE;
 349                 }
 350 #endif
 351                 DEBUG(1,("Failed to verify incoming ticket with error %s!\n",
 352                                 nt_errstr(ret)));
 353                 talloc_destroy(mem_ctx);
 354                 reply_nterror(req, nt_status_squash(ret));
 355                 return;
 356         }
 357
 358         DEBUG(3,("Ticket name is [%s]\n", client));
 359
 360         p = strchr_m(client, '@');
 361         if (!p) {
 362                 DEBUG(3,("Doesn't look like a valid principal\n"));
 363                 data_blob_free(&ap_rep);
 364                 data_blob_free(&session_key);
 365                 SAFE_FREE(client);
 366                 talloc_destroy(mem_ctx);
 367                 reply_nterror(req,nt_status_squash(NT_STATUS_LOGON_FAILURE));
 368                 return;
 369         }
 370
 371         *p = 0;
 372
 373         /* save the PAC data if we have it */
 374
 375         if (pac_data) {
 376                 logon_info = get_logon_info_from_pac(pac_data);
 377                 if (logon_info) {
 378                         netsamlogon_cache_store( client, &logon_info->info3 );
 379                 }
 380         }
 381
 382         if (!strequal(p+1, lp_realm())) {
 383                 DEBUG(3,("Ticket for foreign realm %s@%s\n", client, p+1));
 384                 if (!lp_allow_trusted_domains()) {
 385                         data_blob_free(&ap_rep);
 386                         data_blob_free(&session_key);
 387                         SAFE_FREE(client);
 388                         talloc_destroy(mem_ctx);
 389                         reply_nterror(req, nt_status_squash(
 390                                               NT_STATUS_LOGON_FAILURE));
 391                         return;
 392                 }
 393         }
 394
 395         /* this gives a fully qualified user name (ie. with full realm).
 396            that leads to very long usernames, but what else can we do? */
 397
 398         domain = p+1;
 399
 400         if (logon_info && logon_info->info3.hdr_logon_dom.uni_str_len) {
 401                 unistr2_to_ascii(netbios_domain_name,
 402                                 &logon_info->info3.uni_logon_dom,
 403                                 -1);
 404                 domain = netbios_domain_name;
 405                 DEBUG(10, ("Mapped to [%s] (using PAC)\n", domain));
 406
 407         } else {
 408
 409                 /* If we have winbind running, we can (and must) shorten the
 410                    username by using the short netbios name. Otherwise we will
 411                    have inconsistent user names. With Kerberos, we get the
 412                    fully qualified realm, with ntlmssp we get the short
 413                    name. And even w2k3 does use ntlmssp if you for example
 414                    connect to an ip address. */
 415
 416                 struct winbindd_request wb_request;
 417                 struct winbindd_response wb_response;
 418                 NSS_STATUS wb_result;
 419
 420                 ZERO_STRUCT(wb_request);
 421                 ZERO_STRUCT(wb_response);
 422
 423                 DEBUG(10, ("Mapping [%s] to short name\n", domain));
 424
 425                 fstrcpy(wb_request.domain_name, domain);
 426
 427                 wb_result = winbindd_request_response(WINBINDD_DOMAIN_INFO,
 428                                              &wb_request, &wb_response);
 429
 430                 if (wb_result == NSS_STATUS_SUCCESS) {
 431
 432                         fstrcpy(netbios_domain_name,
 433                                 wb_response.data.domain_info.name);
 434                         domain = netbios_domain_name;
 435
 436                         DEBUG(10, ("Mapped to [%s] (using Winbind)\n", domain));
 437                 } else {
 438                         DEBUG(3, ("Could not find short name -- winbind "
 439                                   "not running?\n"));
 440                 }
 441         }
 442
 443         fstr_sprintf(user, "%s%c%s", domain, *lp_winbind_separator(), client);
 444
 445         /* lookup the passwd struct, create a new user if necessary */
 446
 447         username_was_mapped = map_username( user );
 448
 449         pw = smb_getpwnam( mem_ctx, user, real_username, True );
 450
 451         if (pw) {
 452                 /* if a real user check pam account restrictions */
 453                 /* only really perfomed if "obey pam restriction" is true */
 454                 /* do this before an eventual mappign to guest occurs */
 455                 ret = smb_pam_accountcheck(pw->pw_name);
 456                 if (  !NT_STATUS_IS_OK(ret)) {
 457                         DEBUG(1,("PAM account restriction "
 458                                 "prevents user login\n"));
 459                         data_blob_free(&ap_rep);
 460                         data_blob_free(&session_key);
 461                         TALLOC_FREE(mem_ctx);
 462                         reply_nterror(req, nt_status_squash(ret));
 463                         return;
 464                 }
 465         }
 466
 467         if (!pw) {
 468
 469                 /* this was originally the behavior of Samba 2.2, if a user
 470                    did not have a local uid but has been authenticated, then
 471                    map them to a guest account */
 472
 473                 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID){
 474                         map_domainuser_to_guest = True;
 475                         fstrcpy(user,lp_guestaccount());
 476                         pw = smb_getpwnam( mem_ctx, user, real_username, True );
 477                 }
 478
 479                 /* extra sanity check that the guest account is valid */
 480
 481                 if ( !pw ) {
 482                         DEBUG(1,("Username %s is invalid on this system\n",
 483                                 user));
 484                         SAFE_FREE(client);
 485                         data_blob_free(&ap_rep);
 486                         data_blob_free(&session_key);
 487                         TALLOC_FREE(mem_ctx);
 488                         reply_nterror(req, nt_status_squash(
 489                                               NT_STATUS_LOGON_FAILURE));
 490                         return;
 491                 }
 492         }
 493
 494         /* setup the string used by %U */
 495
 496         sub_set_smb_name( real_username );
 497         reload_services(True);
 498
 499         if ( map_domainuser_to_guest ) {
 500                 make_server_info_guest(&server_info);
 501         } else if (logon_info) {
 502                 /* pass the unmapped username here since map_username()
 503                    will be called again from inside make_server_info_info3() */
 504
 505                 ret = make_server_info_info3(mem_ctx, client, domain,
 506                                              &server_info, &logon_info->info3);
 507                 if ( !NT_STATUS_IS_OK(ret) ) {
 508                         DEBUG(1,("make_server_info_info3 failed: %s!\n",
 509                                  nt_errstr(ret)));
 510                         SAFE_FREE(client);
 511                         data_blob_free(&ap_rep);
 512                         data_blob_free(&session_key);
 513                         TALLOC_FREE(mem_ctx);
 514                         reply_nterror(req, nt_status_squash(ret));
 515                         return;
 516                 }
 517
 518         } else {
 519                 ret = make_server_info_pw(&server_info, real_username, pw);
 520
 521                 if ( !NT_STATUS_IS_OK(ret) ) {
 522                         DEBUG(1,("make_server_info_pw failed: %s!\n",
 523                                  nt_errstr(ret)));
 524                         SAFE_FREE(client);
 525                         data_blob_free(&ap_rep);
 526                         data_blob_free(&session_key);
 527                         TALLOC_FREE(mem_ctx);
 528                         reply_nterror(req, nt_status_squash(ret));
 529                         return;
 530                 }
 531
 532                 /* make_server_info_pw does not set the domain. Without this
 533                  * we end up with the local netbios name in substitutions for
 534                  * %D. */
 535
 536                 if (server_info->sam_account != NULL) {
 537                         pdb_set_domain(server_info->sam_account,
 538                                         domain, PDB_SET);
 539                 }
 540         }
 541
 542         server_info->was_mapped |= username_was_mapped;
 543
 544         /* we need to build the token for the user. make_server_info_guest()
 545            already does this */
 546
 547         if ( !server_info->ptok ) {
 548                 ret = create_local_token( server_info );
 549                 if ( !NT_STATUS_IS_OK(ret) ) {
 550                         SAFE_FREE(client);
 551                         data_blob_free(&ap_rep);
 552                         data_blob_free(&session_key);
 553                         TALLOC_FREE( mem_ctx );
 554                         TALLOC_FREE( server_info );
 555                         reply_nterror(req, nt_status_squash(ret));
 556                         return;
 557                 }
 558         }
 559
 560         /* register_existing_vuid keeps the server info */
 561         /* register_existing_vuid takes ownership of session_key on success,
 562          * no need to free after this on success. A better interface would copy
 563          * it.... */
 564
 565         if (!is_partial_auth_vuid(sess_vuid)) {
 566                 sess_vuid = register_initial_vuid();
 567         }
 568         sess_vuid = register_existing_vuid(sess_vuid,
 569                                         server_info,
 570                                         session_key,
 571                                         nullblob,
 572                                         client);
 573
 574         SAFE_FREE(client);
 575
 576         reply_outbuf(req, 4, 0);
 577         SSVAL(req->outbuf,smb_uid,sess_vuid);
 578
 579         if (sess_vuid == UID_FIELD_INVALID ) {
 580                 ret = NT_STATUS_LOGON_FAILURE;
 581                 data_blob_free(&session_key);
 582         } else {
 583                 /* current_user_info is changed on new vuid */
 584                 reload_services( True );
 585
 586                 SSVAL(req->outbuf, smb_vwv3, 0);
 587
 588                 if (server_info->guest) {
 589                         SSVAL(req->outbuf,smb_vwv2,1);
 590                 }
 591
 592                 SSVAL(req->outbuf, smb_uid, sess_vuid);
 593
 594                 sessionsetup_start_signing_engine(server_info, req->inbuf);
 595                 /* Successful logon. Keep this vuid. */
 596                 *p_invalidate_vuid = False;
 597         }
 598
 599         /* wrap that up in a nice GSS-API wrapping */
 600         if (NT_STATUS_IS_OK(ret)) {
 601                 ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
 602                                 TOK_ID_KRB_AP_REP);
 603         } else {
 604                 ap_rep_wrapped = data_blob_null;
 605         }
 606         response = spnego_gen_auth_response(&ap_rep_wrapped, ret,
 607                         OID_KERBEROS5_OLD);
 608         reply_sesssetup_blob(conn, req, response, ret);
 609
 610         data_blob_free(&ap_rep);
 611         data_blob_free(&ap_rep_wrapped);
 612         data_blob_free(&response);
 613         TALLOC_FREE(mem_ctx);
 614 }
 615
 616 #endif
 617
 618 /****************************************************************************
 619  Send a session setup reply, wrapped in SPNEGO.
 620  Get vuid and check first.
 621  End the NTLMSSP exchange context if we are OK/complete fail
 622  This should be split into two functions, one to handle each
 623  leg of the NTLM auth steps.
 624 ***************************************************************************/
 625
 626 static void reply_spnego_ntlmssp(connection_struct *conn,
 627                                  struct smb_request *req,
 628                                  uint16 vuid,
 629                                  AUTH_NTLMSSP_STATE **auth_ntlmssp_state,
 630                                  DATA_BLOB *ntlmssp_blob, NTSTATUS nt_status,
 631                                  BOOL wrap)
 632 {
 633         DATA_BLOB response;
 634         struct auth_serversupplied_info *server_info = NULL;
 635
 636         if (NT_STATUS_IS_OK(nt_status)) {
 637                 server_info = (*auth_ntlmssp_state)->server_info;
 638         } else {
 639                 nt_status = do_map_to_guest(nt_status,
 640                             &server_info,
 641                             (*auth_ntlmssp_state)->ntlmssp_state->user,
 642                             (*auth_ntlmssp_state)->ntlmssp_state->domain);
 643         }
 644
 645         reply_outbuf(req, 4, 0);
 646
 647         SSVAL(req->outbuf, smb_uid, vuid);
 648
 649         if (NT_STATUS_IS_OK(nt_status)) {
 650                 DATA_BLOB nullblob = data_blob_null;
 651                 DATA_BLOB session_key =
 652                         data_blob(
 653                         (*auth_ntlmssp_state)->ntlmssp_state->session_key.data,
 654                         (*auth_ntlmssp_state)->ntlmssp_state->session_key.length);
 655
 656                 if (!is_partial_auth_vuid(vuid)) {
 657                         data_blob_free(&session_key);
 658                         nt_status = NT_STATUS_LOGON_FAILURE;
 659                         goto out;
 660                 }
 661                 /* register_existing_vuid keeps the server info */
 662                 if (register_existing_vuid(vuid,
 663                                 server_info,
 664                                 session_key, nullblob,
 665                                 (*auth_ntlmssp_state)->ntlmssp_state->user) !=
 666                                         vuid) {
 667                         data_blob_free(&session_key);
 668                         nt_status = NT_STATUS_LOGON_FAILURE;
 669                         goto out;
 670                 }
 671
 672                 (*auth_ntlmssp_state)->server_info = NULL;
 673
 674                 /* current_user_info is changed on new vuid */
 675                 reload_services( True );
 676
 677                 SSVAL(req->outbuf, smb_vwv3, 0);
 678
 679                 if (server_info->guest) {
 680                         SSVAL(req->outbuf,smb_vwv2,1);
 681                 }
 682
 683                 sessionsetup_start_signing_engine(server_info,
 684                                                   (uint8 *)req->inbuf);
 685         }
 686
 687   out:
 688
 689         if (wrap) {
 690                 response = spnego_gen_auth_response(ntlmssp_blob,
 691                                 nt_status, OID_NTLMSSP);
 692         } else {
 693                 response = *ntlmssp_blob;
 694         }
 695
 696         reply_sesssetup_blob(conn, req, response, nt_status);
 697         if (wrap) {
 698                 data_blob_free(&response);
 699         }
 700
 701         /* NT_STATUS_MORE_PROCESSING_REQUIRED from our NTLMSSP code tells us,
 702            and the other end, that we are not finished yet. */
 703
 704         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 705                 /* NB. This is *NOT* an error case. JRA */
 706                 auth_ntlmssp_end(auth_ntlmssp_state);
 707                 if (!NT_STATUS_IS_OK(nt_status)) {
 708                         /* Kill the intermediate vuid */
 709                         invalidate_vuid(vuid);
 710                 }
 711         }
 712 }
 713
 714 /****************************************************************************
 715  Is this a krb5 mechanism ?
 716 ****************************************************************************/
 717
 718 NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, DATA_BLOB *pblob_out,
 719                 BOOL *p_is_krb5)
 720 {
 721         char *OIDs[ASN1_MAX_OIDS];
 722         int i;
 723
 724         *p_is_krb5 = False;
 725
 726         /* parse out the OIDs and the first sec blob */
 727         if (!parse_negTokenTarg(blob_in, OIDs, pblob_out)) {
 728                 return NT_STATUS_LOGON_FAILURE;
 729         }
 730
 731         /* only look at the first OID for determining the mechToken --
 732            according to RFC2478, we should choose the one we want
 733            and renegotiate, but i smell a client bug here..
 734
 735            Problem observed when connecting to a member (samba box)
 736            of an AD domain as a user in a Samba domain.  Samba member
 737            server sent back krb5/mskrb5/ntlmssp as mechtypes, but the
 738            client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an
 739            NTLMSSP mechtoken.                 --jerry              */
 740
 741 #ifdef HAVE_KRB5
 742         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 ||
 743             strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
 744                 *p_is_krb5 = True;
 745         }
 746 #endif
 747
 748         for (i=0;OIDs[i];i++) {
 749                 DEBUG(5,("parse_spnego_mechanisms: Got OID %s\n", OIDs[i]));
 750                 free(OIDs[i]);
 751         }
 752         return NT_STATUS_OK;
 753 }
 754
 755 /****************************************************************************
 756  Reply to a session setup spnego negotiate packet.
 757 ****************************************************************************/
 758
 759 static void reply_spnego_negotiate(connection_struct *conn,
 760                                    struct smb_request *req,
 761                                    uint16 vuid,
 762                                    DATA_BLOB blob1,
 763                                    AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
 764 {
 765         DATA_BLOB secblob;
 766         DATA_BLOB chal;
 767         BOOL got_kerberos_mechanism = False;
 768         NTSTATUS status;
 769
 770         status = parse_spnego_mechanisms(blob1, &secblob,
 771                         &got_kerberos_mechanism);
 772         if (!NT_STATUS_IS_OK(status)) {
 773                 /* Kill the intermediate vuid */
 774                 invalidate_vuid(vuid);
 775                 reply_nterror(req, nt_status_squash(status));
 776                 return;
 777         }
 778
 779         DEBUG(3,("reply_spnego_negotiate: Got secblob of size %lu\n",
 780                                 (unsigned long)secblob.length));
 781
 782 #ifdef HAVE_KRB5
 783         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) ||
 784                                 lp_use_kerberos_keytab()) ) {
 785                 BOOL destroy_vuid = True;
 786                 reply_spnego_kerberos(conn, req, &secblob, vuid,
 787                                       &destroy_vuid);
 788                 data_blob_free(&secblob);
 789                 if (destroy_vuid) {
 790                         /* Kill the intermediate vuid */
 791                         invalidate_vuid(vuid);
 792                 }
 793                 return;
 794         }
 795 #endif
 796
 797         if (*auth_ntlmssp_state) {
 798                 auth_ntlmssp_end(auth_ntlmssp_state);
 799         }
 800
 801         status = auth_ntlmssp_start(auth_ntlmssp_state);
 802         if (!NT_STATUS_IS_OK(status)) {
 803                 /* Kill the intermediate vuid */
 804                 invalidate_vuid(vuid);
 805                 reply_nterror(req, nt_status_squash(status));
 806                 return;
 807         }
 808
 809         status = auth_ntlmssp_update(*auth_ntlmssp_state,
 810                                         secblob, &chal);
 811
 812         data_blob_free(&secblob);
 813
 814         reply_spnego_ntlmssp(conn, req, vuid, auth_ntlmssp_state,
 815                              &chal, status, True);
 816
 817         data_blob_free(&chal);
 818
 819         /* already replied */
 820         return;
 821 }
 822
 823 /****************************************************************************
 824  Reply to a session setup spnego auth packet.
 825 ****************************************************************************/
 826
 827 static void reply_spnego_auth(connection_struct *conn,
 828                               struct smb_request *req,
 829                               uint16 vuid,
 830                               DATA_BLOB blob1,
 831                               AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
 832 {
 833         DATA_BLOB auth = data_blob_null;
 834         DATA_BLOB auth_reply = data_blob_null;
 835         DATA_BLOB secblob = data_blob_null;
 836         NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
 837
 838         if (!spnego_parse_auth(blob1, &auth)) {
 839 #if 0
 840                 file_save("auth.dat", blob1.data, blob1.length);
 841 #endif
 842                 /* Kill the intermediate vuid */
 843                 invalidate_vuid(vuid);
 844
 845                 reply_nterror(req, nt_status_squash(
 846                                       NT_STATUS_INVALID_PARAMETER));
 847                 return;
 848         }
 849
 850         if (auth.data[0] == ASN1_APPLICATION(0)) {
 851                 /* Might be a second negTokenTarg packet */
 852
 853                 BOOL got_krb5_mechanism = False;
 854                 status = parse_spnego_mechanisms(auth, &secblob,
 855                                 &got_krb5_mechanism);
 856                 if (NT_STATUS_IS_OK(status)) {
 857                         DEBUG(3,("reply_spnego_auth: Got secblob of size %lu\n",
 858                                         (unsigned long)secblob.length));
 859 #ifdef HAVE_KRB5
 860                         if ( got_krb5_mechanism && ((lp_security()==SEC_ADS) ||
 861                                                 lp_use_kerberos_keytab()) ) {
 862                                 BOOL destroy_vuid = True;
 863                                 reply_spnego_kerberos(conn, req, &secblob,
 864                                                       vuid, &destroy_vuid);
 865                                 data_blob_free(&secblob);
 866                                 data_blob_free(&auth);
 867                                 if (destroy_vuid) {
 868                                         /* Kill the intermediate vuid */
 869                                         invalidate_vuid(vuid);
 870                                 }
 871                                 return;
 872                         }
 873 #endif
 874                 }
 875         }
 876
 877         /* If we get here it wasn't a negTokenTarg auth packet. */
 878         data_blob_free(&secblob);
 879
 880         if (!*auth_ntlmssp_state) {
 881                 /* Kill the intermediate vuid */
 882                 invalidate_vuid(vuid);
 883
 884                 /* auth before negotiatiate? */
 885                 reply_nterror(req, nt_status_squash(
 886                                       NT_STATUS_INVALID_PARAMETER));
 887                 return;
 888         }
 889
 890         status = auth_ntlmssp_update(*auth_ntlmssp_state,
 891                                         auth, &auth_reply);
 892
 893         data_blob_free(&auth);
 894
 895         reply_spnego_ntlmssp(conn, req, vuid,
 896                              auth_ntlmssp_state,
 897                              &auth_reply, status, True);
 898
 899         data_blob_free(&auth_reply);
 900
 901         /* and tell smbd that we have already replied to this packet */
 902         return;
 903 }
 904
 905 /****************************************************************************
 906  List to store partial SPNEGO auth fragments.
 907 ****************************************************************************/
 908
 909 static struct pending_auth_data *pd_list;
 910
 911 /****************************************************************************
 912  Delete an entry on the list.
 913 ****************************************************************************/
 914
 915 static void delete_partial_auth(struct pending_auth_data *pad)
 916 {
 917         if (!pad) {
 918                 return;
 919         }
 920         DLIST_REMOVE(pd_list, pad);
 921         data_blob_free(&pad->partial_data);
 922         SAFE_FREE(pad);
 923 }
 924
 925 /****************************************************************************
 926  Search for a partial SPNEGO auth fragment matching an smbpid.
 927 ****************************************************************************/
 928
 929 static struct pending_auth_data *get_pending_auth_data(uint16 smbpid)
 930 {
 931         struct pending_auth_data *pad;
 932
 933         for (pad = pd_list; pad; pad = pad->next) {
 934                 if (pad->smbpid == smbpid) {
 935                         break;
 936                 }
 937         }
 938         return pad;
 939 }
 940
 941 /****************************************************************************
 942  Check the size of an SPNEGO blob. If we need more return
 943  NT_STATUS_MORE_PROCESSING_REQUIRED, else return NT_STATUS_OK. Don't allow
 944  the blob to be more than 64k.
 945 ****************************************************************************/
 946
 947 static NTSTATUS check_spnego_blob_complete(uint16 smbpid, uint16 vuid,
 948                 DATA_BLOB *pblob)
 949 {
 950         struct pending_auth_data *pad = NULL;
 951         ASN1_DATA data;
 952         size_t needed_len = 0;
 953
 954         pad = get_pending_auth_data(smbpid);
 955
 956         /* Ensure we have some data. */
 957         if (pblob->length == 0) {
 958                 /* Caller can cope. */
 959                 DEBUG(2,("check_spnego_blob_complete: zero blob length !\n"));
 960                 delete_partial_auth(pad);
 961                 return NT_STATUS_OK;
 962         }
 963
 964         /* Were we waiting for more data ? */
 965         if (pad) {
 966                 DATA_BLOB tmp_blob;
 967                 size_t copy_len = MIN(65536, pblob->length);
 968
 969                 /* Integer wrap paranoia.... */
 970
 971                 if (pad->partial_data.length + copy_len <
 972                                 pad->partial_data.length ||
 973                     pad->partial_data.length + copy_len < copy_len) {
 974
 975                         DEBUG(2,("check_spnego_blob_complete: integer wrap "
 976                                 "pad->partial_data.length = %u, "
 977                                 "copy_len = %u\n",
 978                                 (unsigned int)pad->partial_data.length,
 979                                 (unsigned int)copy_len ));
 980
 981                         delete_partial_auth(pad);
 982                         return NT_STATUS_INVALID_PARAMETER;
 983                 }
 984
 985                 DEBUG(10,("check_spnego_blob_complete: "
 986                         "pad->partial_data.length = %u, "
 987                         "pad->needed_len = %u, "
 988                         "copy_len = %u, "
 989                         "pblob->length = %u,\n",
 990                         (unsigned int)pad->partial_data.length,
 991                         (unsigned int)pad->needed_len,
 992                         (unsigned int)copy_len,
 993                         (unsigned int)pblob->length ));
 994
 995                 tmp_blob = data_blob(NULL,
 996                                 pad->partial_data.length + copy_len);
 997
 998                 /* Concatenate the two (up to copy_len) bytes. */
 999                 memcpy(tmp_blob.data,
1000                         pad->partial_data.data,
1001                         pad->partial_data.length);
1002                 memcpy(tmp_blob.data + pad->partial_data.length,
1003                         pblob->data,
1004                         copy_len);
1005
1006                 /* Replace the partial data. */
1007                 data_blob_free(&pad->partial_data);
1008                 pad->partial_data = tmp_blob;
1009                 ZERO_STRUCT(tmp_blob);
1010
1011                 /* Are we done ? */
1012                 if (pblob->length >= pad->needed_len) {
1013                         /* Yes, replace pblob. */
1014                         data_blob_free(pblob);
1015                         *pblob = pad->partial_data;
1016                         ZERO_STRUCT(pad->partial_data);
1017                         delete_partial_auth(pad);
1018                         return NT_STATUS_OK;
1019                 }
1020
1021                 /* Still need more data. */
1022                 pad->needed_len -= copy_len;
1023                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1024         }
1025
1026         if ((pblob->data[0] != ASN1_APPLICATION(0)) &&
1027             (pblob->data[0] != ASN1_CONTEXT(1))) {
1028                 /* Not something we can determine the
1029                  * length of.
1030                  */
1031                 return NT_STATUS_OK;
1032         }
1033
1034         /* This is a new SPNEGO sessionsetup - see if
1035          * the data given in this blob is enough.
1036          */
1037
1038         asn1_load(&data, *pblob);
1039         asn1_start_tag(&data, pblob->data[0]);
1040         if (data.has_error || data.nesting == NULL) {
1041                 asn1_free(&data);
1042                 /* Let caller catch. */
1043                 return NT_STATUS_OK;
1044         }
1045
1046         /* Integer wrap paranoia.... */
1047
1048         if (data.nesting->taglen + data.nesting->start < data.nesting->taglen ||
1049             data.nesting->taglen + data.nesting->start < data.nesting->start) {
1050
1051                 DEBUG(2,("check_spnego_blob_complete: integer wrap "
1052                         "data.nesting->taglen = %u, "
1053                         "data.nesting->start = %u\n",
1054                         (unsigned int)data.nesting->taglen,
1055                         (unsigned int)data.nesting->start ));
1056
1057                 asn1_free(&data);
1058                 return NT_STATUS_INVALID_PARAMETER;
1059         }
1060
1061         /* Total length of the needed asn1 is the tag length
1062          * plus the current offset. */
1063
1064         needed_len = data.nesting->taglen + data.nesting->start;
1065         asn1_free(&data);
1066
1067         DEBUG(10,("check_spnego_blob_complete: needed_len = %u, "
1068                 "pblob->length = %u\n",
1069                 (unsigned int)needed_len,
1070                 (unsigned int)pblob->length ));
1071
1072         if (needed_len <= pblob->length) {
1073                 /* Nothing to do - blob is complete. */
1074                 return NT_STATUS_OK;
1075         }
1076
1077         /* Refuse the blob if it's bigger than 64k. */
1078         if (needed_len > 65536) {
1079                 DEBUG(2,("check_spnego_blob_complete: needed_len "
1080                         "too large (%u)\n",
1081                         (unsigned int)needed_len ));
1082                 return NT_STATUS_INVALID_PARAMETER;
1083         }
1084
1085         /* We must store this blob until complete. */
1086         if (!(pad = SMB_MALLOC_P(struct pending_auth_data))) {
1087                 return NT_STATUS_NO_MEMORY;
1088         }
1089         pad->needed_len = needed_len - pblob->length;
1090         pad->partial_data = data_blob(pblob->data, pblob->length);
1091         if (pad->partial_data.data == NULL) {
1092                 SAFE_FREE(pad);
1093                 return NT_STATUS_NO_MEMORY;
1094         }
1095         pad->smbpid = smbpid;
1096         pad->vuid = vuid;
1097         DLIST_ADD(pd_list, pad);
1098
1099         return NT_STATUS_MORE_PROCESSING_REQUIRED;
1100 }
1101
1102 /****************************************************************************
1103  Reply to a session setup command.
1104  conn POINTER CAN BE NULL HERE !
1105 ****************************************************************************/
1106
1107 static void reply_sesssetup_and_X_spnego(connection_struct *conn,
1108                                          struct smb_request *req)
1109 {
1110         uint8 *p;
1111         DATA_BLOB blob1;
1112         size_t bufrem;
1113         fstring native_os, native_lanman, primary_domain;
1114         const char *p2;
1115         uint16 data_blob_len = SVAL(req->inbuf, smb_vwv7);
1116         enum remote_arch_types ra_type = get_remote_arch();
1117         int vuid = SVAL(req->inbuf,smb_uid);
1118         user_struct *vuser = NULL;
1119         NTSTATUS status = NT_STATUS_OK;
1120         uint16 smbpid = req->smbpid;
1121         uint16 smb_flag2 = req->flags2;
1122
1123         DEBUG(3,("Doing spnego session setup\n"));
1124
1125         if (global_client_caps == 0) {
1126                 global_client_caps = IVAL(req->inbuf,smb_vwv10);
1127
1128                 if (!(global_client_caps & CAP_STATUS32)) {
1129                         remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1130                 }
1131
1132         }
1133
1134         p = (uint8 *)smb_buf(req->inbuf);
1135
1136         if (data_blob_len == 0) {
1137                 /* an invalid request */
1138                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1139                 return;
1140         }
1141
1142         bufrem = smb_bufrem(req->inbuf, p);
1143         /* pull the spnego blob */
1144         blob1 = data_blob(p, MIN(bufrem, data_blob_len));
1145
1146 #if 0
1147         file_save("negotiate.dat", blob1.data, blob1.length);
1148 #endif
1149
1150         p2 = (char *)req->inbuf + smb_vwv13 + data_blob_len;
1151         p2 += srvstr_pull_buf(req->inbuf, smb_flag2, native_os, p2,
1152                               sizeof(native_os), STR_TERMINATE);
1153         p2 += srvstr_pull_buf(req->inbuf, smb_flag2, native_lanman, p2,
1154                               sizeof(native_lanman), STR_TERMINATE);
1155         p2 += srvstr_pull_buf(req->inbuf, smb_flag2, primary_domain, p2,
1156                               sizeof(primary_domain), STR_TERMINATE);
1157         DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
1158                 native_os, native_lanman, primary_domain));
1159
1160         if ( ra_type == RA_WIN2K ) {
1161                 /* Vista sets neither the OS or lanman strings */
1162
1163                 if ( !strlen(native_os) && !strlen(native_lanman) )
1164                         set_remote_arch(RA_VISTA);
1165
1166                 /* Windows 2003 doesn't set the native lanman string,
1167                    but does set primary domain which is a bug I think */
1168
1169                 if ( !strlen(native_lanman) ) {
1170                         ra_lanman_string( primary_domain );
1171                 } else {
1172                         ra_lanman_string( native_lanman );
1173                 }
1174         }
1175
1176         /* Did we get a valid vuid ? */
1177         if (!is_partial_auth_vuid(vuid)) {
1178                 /* No, then try and see if this is an intermediate sessionsetup
1179                  * for a large SPNEGO packet. */
1180                 struct pending_auth_data *pad = get_pending_auth_data(smbpid);
1181                 if (pad) {
1182                         DEBUG(10,("reply_sesssetup_and_X_spnego: found "
1183                                 "pending vuid %u\n",
1184                                 (unsigned int)pad->vuid ));
1185                         vuid = pad->vuid;
1186                 }
1187         }
1188
1189         /* Do we have a valid vuid now ? */
1190         if (!is_partial_auth_vuid(vuid)) {
1191                 /* No, start a new authentication setup. */
1192                 vuid = register_initial_vuid();
1193                 if (vuid == UID_FIELD_INVALID) {
1194                         data_blob_free(&blob1);
1195                         reply_nterror(req, nt_status_squash(
1196                                               NT_STATUS_INVALID_PARAMETER));
1197                         return;
1198                 }
1199         }
1200
1201         vuser = get_partial_auth_user_struct(vuid);
1202         /* This MUST be valid. */
1203         if (!vuser) {
1204                 smb_panic("reply_sesssetup_and_X_spnego: invalid vuid.");
1205         }
1206
1207         /* Large (greater than 4k) SPNEGO blobs are split into multiple
1208          * sessionsetup requests as the Windows limit on the security blob
1209          * field is 4k. Bug #4400. JRA.
1210          */
1211
1212         status = check_spnego_blob_complete(smbpid, vuid, &blob1);
1213         if (!NT_STATUS_IS_OK(status)) {
1214                 if (!NT_STATUS_EQUAL(status,
1215                                 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1216                         /* Real error - kill the intermediate vuid */
1217                         invalidate_vuid(vuid);
1218                 }
1219                 data_blob_free(&blob1);
1220                 reply_nterror(req, nt_status_squash(status));
1221                 return;
1222         }
1223
1224         if (blob1.data[0] == ASN1_APPLICATION(0)) {
1225
1226                 /* its a negTokenTarg packet */
1227
1228                 reply_spnego_negotiate(conn, req, vuid, blob1,
1229                                        &vuser->auth_ntlmssp_state);
1230                 data_blob_free(&blob1);
1231                 return;
1232         }
1233
1234         if (blob1.data[0] == ASN1_CONTEXT(1)) {
1235
1236                 /* its a auth packet */
1237
1238                 reply_spnego_auth(conn, req, vuid, blob1,
1239                                   &vuser->auth_ntlmssp_state);
1240                 data_blob_free(&blob1);
1241                 return;
1242         }
1243
1244         if (strncmp((char *)(blob1.data), "NTLMSSP", 7) == 0) {
1245                 DATA_BLOB chal;
1246
1247                 if (!vuser->auth_ntlmssp_state) {
1248                         status = auth_ntlmssp_start(&vuser->auth_ntlmssp_state);
1249                         if (!NT_STATUS_IS_OK(status)) {
1250                                 /* Kill the intermediate vuid */
1251                                 invalidate_vuid(vuid);
1252                                 data_blob_free(&blob1);
1253                                 reply_nterror(req, nt_status_squash(status));
1254                                 return;
1255                         }
1256                 }
1257
1258                 status = auth_ntlmssp_update(vuser->auth_ntlmssp_state,
1259                                                 blob1, &chal);
1260
1261                 data_blob_free(&blob1);
1262
1263                 reply_spnego_ntlmssp(conn, req, vuid,
1264                                      &vuser->auth_ntlmssp_state,
1265                                      &chal, status, False);
1266                 data_blob_free(&chal);
1267                 return;
1268         }
1269
1270         /* what sort of packet is this? */
1271         DEBUG(1,("Unknown packet in reply_sesssetup_and_X_spnego\n"));
1272
1273         data_blob_free(&blob1);
1274
1275         reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1276 }
1277
1278 /****************************************************************************
1279  On new VC == 0, shutdown *all* old connections and users.
1280  It seems that only NT4.x does this. At W2K and above (XP etc.).
1281  a new session setup with VC==0 is ignored.
1282 ****************************************************************************/
1283
1284 static int shutdown_other_smbds(struct db_record *rec,
1285                                 const struct connections_key *key,
1286                                 const struct connections_data *crec,
1287                                 void *private_data)
1288 {
1289         const char *ip = (const char *)private_data;
1290
1291         if (!process_exists(crec->pid)) {
1292                 return 0;
1293         }
1294
1295         if (procid_is_me(&crec->pid)) {
1296                 return 0;
1297         }
1298
1299         if (strcmp(ip, crec->addr) != 0) {
1300                 return 0;
1301         }
1302
1303         messaging_send(smbd_messaging_context(), crec->pid, MSG_SHUTDOWN,
1304                        &data_blob_null);
1305         return 0;
1306 }
1307
1308 static void setup_new_vc_session(void)
1309 {
1310         DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x "
1311                 "compatible we would close all old resources.\n"));
1312 #if 0
1313         conn_close_all();
1314         invalidate_all_vuids();
1315 #endif
1316         if (lp_reset_on_zero_vc()) {
1317                 connections_forall(shutdown_other_smbds, client_addr());
1318         }
1319 }
1320
1321 /****************************************************************************
1322  Reply to a session setup command.
1323 ****************************************************************************/
1324
1325 void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
1326 {
1327         int sess_vuid;
1328         int smb_bufsize;
1329         DATA_BLOB lm_resp;
1330         DATA_BLOB nt_resp;
1331         DATA_BLOB plaintext_password;
1332         fstring user;
1333         fstring sub_user; /* Sainitised username for substituion */
1334         fstring domain;
1335         fstring native_os;
1336         fstring native_lanman;
1337         fstring primary_domain;
1338         static BOOL done_sesssetup = False;
1339         auth_usersupplied_info *user_info = NULL;
1340         auth_serversupplied_info *server_info = NULL;
1341         uint16 smb_flag2 = req->flags2;
1342
1343         NTSTATUS nt_status;
1344
1345         BOOL doencrypt = global_encrypted_passwords_negotiated;
1346
1347         DATA_BLOB session_key;
1348
1349         START_PROFILE(SMBsesssetupX);
1350
1351         ZERO_STRUCT(lm_resp);
1352         ZERO_STRUCT(nt_resp);
1353         ZERO_STRUCT(plaintext_password);
1354
1355         DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
1356
1357         /* a SPNEGO session setup has 12 command words, whereas a normal
1358            NT1 session setup has 13. See the cifs spec. */
1359         if (req->wct == 12 &&
1360             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
1361
1362                 if (!global_spnego_negotiated) {
1363                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
1364                                  "at SPNEGO session setup when it was not "
1365                                  "negotiated.\n"));
1366                         reply_nterror(req, nt_status_squash(
1367                                               NT_STATUS_LOGON_FAILURE));
1368                         END_PROFILE(SMBsesssetupX);
1369                         return;
1370                 }
1371
1372                 if (SVAL(req->inbuf,smb_vwv4) == 0) {
1373                         setup_new_vc_session();
1374                 }
1375
1376                 reply_sesssetup_and_X_spnego(conn, req);
1377                 END_PROFILE(SMBsesssetupX);
1378                 return;
1379         }
1380
1381         smb_bufsize = SVAL(req->inbuf,smb_vwv2);
1382
1383         if (Protocol < PROTOCOL_NT1) {
1384                 uint16 passlen1 = SVAL(req->inbuf,smb_vwv7);
1385
1386                 /* Never do NT status codes with protocols before NT1 as we
1387                  * don't get client caps. */
1388                 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1389
1390                 if ((passlen1 > MAX_PASS_LEN)
1391                     || (passlen1 > smb_bufrem(req->inbuf,
1392                                               smb_buf(req->inbuf)))) {
1393                         reply_nterror(req, nt_status_squash(
1394                                               NT_STATUS_INVALID_PARAMETER));
1395                         END_PROFILE(SMBsesssetupX);
1396                         return;
1397                 }
1398
1399                 if (doencrypt) {
1400                         lm_resp = data_blob(smb_buf(req->inbuf), passlen1);
1401                 } else {
1402                         plaintext_password = data_blob(smb_buf(req->inbuf),
1403                                                        passlen1+1);
1404                         /* Ensure null termination */
1405                         plaintext_password.data[passlen1] = 0;
1406                 }
1407
1408                 srvstr_pull_buf(req->inbuf, req->flags2, user,
1409                                 smb_buf(req->inbuf)+passlen1, sizeof(user),
1410                                 STR_TERMINATE);
1411                 *domain = 0;
1412
1413         } else {
1414                 uint16 passlen1 = SVAL(req->inbuf,smb_vwv7);
1415                 uint16 passlen2 = SVAL(req->inbuf,smb_vwv8);
1416                 enum remote_arch_types ra_type = get_remote_arch();
1417                 char *p = smb_buf(req->inbuf);
1418                 char *save_p = smb_buf(req->inbuf);
1419                 uint16 byte_count;
1420
1421
1422                 if(global_client_caps == 0) {
1423                         global_client_caps = IVAL(req->inbuf,smb_vwv11);
1424
1425                         if (!(global_client_caps & CAP_STATUS32)) {
1426                                 remove_from_common_flags2(
1427                                                 FLAGS2_32_BIT_ERROR_CODES);
1428                         }
1429
1430                         /* client_caps is used as final determination if
1431                          * client is NT or Win95. This is needed to return
1432                          * the correct error codes in some circumstances.
1433                         */
1434
1435                         if(ra_type == RA_WINNT || ra_type == RA_WIN2K ||
1436                                         ra_type == RA_WIN95) {
1437                                 if(!(global_client_caps & (CAP_NT_SMBS|
1438                                                         CAP_STATUS32))) {
1439                                         set_remote_arch( RA_WIN95);
1440                                 }
1441                         }
1442                 }
1443
1444                 if (!doencrypt) {
1445                         /* both Win95 and WinNT stuff up the password
1446                          * lengths for non-encrypting systems. Uggh.
1447
1448                            if passlen1==24 its a win95 system, and its setting
1449                            the password length incorrectly. Luckily it still
1450                            works with the default code because Win95 will null
1451                            terminate the password anyway
1452
1453                            if passlen1>0 and passlen2>0 then maybe its a NT box
1454                            and its setting passlen2 to some random value which
1455                            really stuffs things up. we need to fix that one.  */
1456
1457                         if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 &&
1458                                         passlen2 != 1) {
1459                                 passlen2 = 0;
1460                         }
1461                 }
1462
1463                 /* check for nasty tricks */
1464                 if (passlen1 > MAX_PASS_LEN
1465                     || passlen1 > smb_bufrem(req->inbuf, p)) {
1466                         reply_nterror(req, nt_status_squash(
1467                                               NT_STATUS_INVALID_PARAMETER));
1468                         END_PROFILE(SMBsesssetupX);
1469                         return;
1470                 }
1471
1472                 if (passlen2 > MAX_PASS_LEN
1473                     || passlen2 > smb_bufrem(req->inbuf, p+passlen1)) {
1474                         reply_nterror(req, nt_status_squash(
1475                                               NT_STATUS_INVALID_PARAMETER));
1476                         END_PROFILE(SMBsesssetupX);
1477                         return;
1478                 }
1479
1480                 /* Save the lanman2 password and the NT md4 password. */
1481
1482                 if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
1483                         doencrypt = False;
1484                 }
1485
1486                 if (doencrypt) {
1487                         lm_resp = data_blob(p, passlen1);
1488                         nt_resp = data_blob(p+passlen1, passlen2);
1489                 } else {
1490                         pstring pass;
1491                         BOOL unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
1492
1493 #if 0
1494                         /* This was the previous fix. Not sure if it's still
1495                          * valid. JRA. */
1496                         if ((ra_type == RA_WINNT) && (passlen2 == 0)
1497                                         && unic && passlen1) {
1498                                 /* NT4.0 stuffs up plaintext unicode password
1499                                  * lengths... */
1500                                 srvstr_pull(inbuf, pass, smb_buf(inbuf) + 1,
1501                                         sizeof(pass), passlen1, STR_TERMINATE);
1502 #endif
1503
1504                         if (unic && (passlen2 == 0) && passlen1) {
1505                                 /* Only a ascii plaintext password was sent. */
1506                                 srvstr_pull(req->inbuf, req->flags2, pass,
1507                                             smb_buf(req->inbuf), sizeof(pass),
1508                                             passlen1, STR_TERMINATE|STR_ASCII);
1509                         } else {
1510                                 srvstr_pull(req->inbuf, req->flags2, pass,
1511                                             smb_buf(req->inbuf), sizeof(pass),
1512                                             unic ? passlen2 : passlen1,
1513                                             STR_TERMINATE);
1514                         }
1515                         plaintext_password = data_blob(pass, strlen(pass)+1);
1516                 }
1517
1518                 p += passlen1 + passlen2;
1519                 p += srvstr_pull_buf(req->inbuf, req->flags2, user, p,
1520                                      sizeof(user), STR_TERMINATE);
1521                 p += srvstr_pull_buf(req->inbuf, req->flags2, domain, p,
1522                                      sizeof(domain), STR_TERMINATE);
1523                 p += srvstr_pull_buf(req->inbuf, req->flags2, native_os,
1524                                      p, sizeof(native_os), STR_TERMINATE);
1525                 p += srvstr_pull_buf(req->inbuf, req->flags2,
1526                                      native_lanman, p, sizeof(native_lanman),
1527                                      STR_TERMINATE);
1528
1529                 /* not documented or decoded by Ethereal but there is one more
1530                  * string in the extra bytes which is the same as the
1531                  * PrimaryDomain when using extended security.  Windows NT 4
1532                  * and 2003 use this string to store the native lanman string.
1533                  * Windows 9x does not include a string here at all so we have
1534                  * to check if we have any extra bytes left */
1535
1536                 byte_count = SVAL(req->inbuf, smb_vwv13);
1537                 if ( PTR_DIFF(p, save_p) < byte_count) {
1538                         p += srvstr_pull_buf(req->inbuf, req->flags2,
1539                                              primary_domain, p,
1540                                              sizeof(primary_domain),
1541                                              STR_TERMINATE);
1542                 } else {
1543                         fstrcpy( primary_domain, "null" );
1544                 }
1545
1546                 DEBUG(3,("Domain=[%s]  NativeOS=[%s] NativeLanMan=[%s] "
1547                         "PrimaryDomain=[%s]\n",
1548                         domain, native_os, native_lanman, primary_domain));
1549
1550                 if ( ra_type == RA_WIN2K ) {
1551                         if ( strlen(native_lanman) == 0 )
1552                                 ra_lanman_string( primary_domain );
1553                         else
1554                                 ra_lanman_string( native_lanman );
1555                 }
1556
1557         }
1558
1559         if (SVAL(req->inbuf,smb_vwv4) == 0) {
1560                 setup_new_vc_session();
1561         }
1562
1563         DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
1564                                 domain, user, get_remote_machine_name()));
1565
1566         if (*user) {
1567                 if (global_spnego_negotiated) {
1568
1569                         /* This has to be here, because this is a perfectly
1570                          * valid behaviour for guest logons :-( */
1571
1572                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
1573                                 "at 'normal' session setup after "
1574                                 "negotiating spnego.\n"));
1575                         reply_nterror(req, nt_status_squash(
1576                                               NT_STATUS_LOGON_FAILURE));
1577                         END_PROFILE(SMBsesssetupX);
1578                         return;
1579                 }
1580                 fstrcpy(sub_user, user);
1581         } else {
1582                 fstrcpy(sub_user, lp_guestaccount());
1583         }
1584
1585         sub_set_smb_name(sub_user);
1586
1587         reload_services(True);
1588
1589         if (lp_security() == SEC_SHARE) {
1590                 /* in share level we should ignore any passwords */
1591
1592                 data_blob_free(&lm_resp);
1593                 data_blob_free(&nt_resp);
1594                 data_blob_clear_free(&plaintext_password);
1595
1596                 map_username(sub_user);
1597                 add_session_user(sub_user);
1598                 add_session_workgroup(domain);
1599                 /* Then force it to null for the benfit of the code below */
1600                 *user = 0;
1601         }
1602
1603         if (!*user) {
1604
1605                 nt_status = check_guest_password(&server_info);
1606
1607         } else if (doencrypt) {
1608                 if (!negprot_global_auth_context) {
1609                         DEBUG(0, ("reply_sesssetup_and_X:  Attempted encrypted "
1610                                 "session setup without negprot denied!\n"));
1611                         reply_nterror(req, nt_status_squash(
1612                                               NT_STATUS_LOGON_FAILURE));
1613                         END_PROFILE(SMBsesssetupX);
1614                         return;
1615                 }
1616                 nt_status = make_user_info_for_reply_enc(&user_info, user,
1617                                                 domain,
1618                                                 lm_resp, nt_resp);
1619                 if (NT_STATUS_IS_OK(nt_status)) {
1620                         nt_status = negprot_global_auth_context->check_ntlm_password(
1621                                         negprot_global_auth_context,
1622                                         user_info,
1623                                         &server_info);
1624                 }
1625         } else {
1626                 struct auth_context *plaintext_auth_context = NULL;
1627                 const uint8 *chal;
1628
1629                 nt_status = make_auth_context_subsystem(
1630                                 &plaintext_auth_context);
1631
1632                 if (NT_STATUS_IS_OK(nt_status)) {
1633                         chal = plaintext_auth_context->get_ntlm_challenge(
1634                                         plaintext_auth_context);
1635
1636                         if (!make_user_info_for_reply(&user_info,
1637                                                       user, domain, chal,
1638                                                       plaintext_password)) {
1639                                 nt_status = NT_STATUS_NO_MEMORY;
1640                         }
1641
1642                         if (NT_STATUS_IS_OK(nt_status)) {
1643                                 nt_status = plaintext_auth_context->check_ntlm_password(
1644                                                 plaintext_auth_context,
1645                                                 user_info,
1646                                                 &server_info);
1647
1648                                 (plaintext_auth_context->free)(
1649                                                 &plaintext_auth_context);
1650                         }
1651                 }
1652         }
1653
1654         free_user_info(&user_info);
1655
1656         if (!NT_STATUS_IS_OK(nt_status)) {
1657                 nt_status = do_map_to_guest(nt_status, &server_info,
1658                                 user, domain);
1659         }
1660
1661         if (!NT_STATUS_IS_OK(nt_status)) {
1662                 data_blob_free(&nt_resp);
1663                 data_blob_free(&lm_resp);
1664                 data_blob_clear_free(&plaintext_password);
1665                 reply_nterror(req, nt_status_squash(nt_status));
1666                 END_PROFILE(SMBsesssetupX);
1667                 return;
1668         }
1669
1670         /* Ensure we can't possible take a code path leading to a
1671          * null defref. */
1672         if (!server_info) {
1673                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1674                 END_PROFILE(SMBsesssetupX);
1675                 return;
1676         }
1677
1678         nt_status = create_local_token(server_info);
1679         if (!NT_STATUS_IS_OK(nt_status)) {
1680                 DEBUG(10, ("create_local_token failed: %s\n",
1681                            nt_errstr(nt_status)));
1682                 data_blob_free(&nt_resp);
1683                 data_blob_free(&lm_resp);
1684                 data_blob_clear_free(&plaintext_password);
1685                 reply_nterror(req, nt_status_squash(nt_status));
1686                 END_PROFILE(SMBsesssetupX);
1687                 return;
1688         }
1689
1690         if (server_info->user_session_key.data) {
1691                 session_key = data_blob(server_info->user_session_key.data,
1692                                 server_info->user_session_key.length);
1693         } else {
1694                 session_key = data_blob_null;
1695         }
1696
1697         data_blob_clear_free(&plaintext_password);
1698
1699         /* it's ok - setup a reply */
1700         reply_outbuf(req, 3, 0);
1701         if (Protocol >= PROTOCOL_NT1) {
1702                 push_signature(&req->outbuf);
1703                 /* perhaps grab OS version here?? */
1704         }
1705
1706         if (server_info->guest) {
1707                 SSVAL(req->outbuf,smb_vwv2,1);
1708         }
1709
1710         /* register the name and uid as being validated, so further connections
1711            to a uid can get through without a password, on the same VC */
1712
1713         if (lp_security() == SEC_SHARE) {
1714                 sess_vuid = UID_FIELD_INVALID;
1715                 data_blob_free(&session_key);
1716                 TALLOC_FREE(server_info);
1717         } else {
1718                 /* Ignore the initial vuid. */
1719                 sess_vuid = register_initial_vuid();
1720                 if (sess_vuid == UID_FIELD_INVALID) {
1721                         data_blob_free(&nt_resp);
1722                         data_blob_free(&lm_resp);
1723                         data_blob_free(&session_key);
1724                         reply_nterror(req, nt_status_squash(
1725                                               NT_STATUS_LOGON_FAILURE));
1726                         END_PROFILE(SMBsesssetupX);
1727                         return;
1728                 }
1729                 /* register_existing_vuid keeps the server info */
1730                 sess_vuid = register_existing_vuid(sess_vuid,
1731                                         server_info,
1732                                         session_key,
1733                                         nt_resp.data ? nt_resp : lm_resp,
1734                                         sub_user);
1735                 if (sess_vuid == UID_FIELD_INVALID) {
1736                         data_blob_free(&nt_resp);
1737                         data_blob_free(&lm_resp);
1738                         data_blob_free(&session_key);
1739                         reply_nterror(req, nt_status_squash(
1740                                               NT_STATUS_LOGON_FAILURE));
1741                         END_PROFILE(SMBsesssetupX);
1742                         return;
1743                 }
1744
1745                 /* current_user_info is changed on new vuid */
1746                 reload_services( True );
1747
1748                 sessionsetup_start_signing_engine(server_info, req->inbuf);
1749         }
1750
1751         data_blob_free(&nt_resp);
1752         data_blob_free(&lm_resp);
1753
1754         SSVAL(req->outbuf,smb_uid,sess_vuid);
1755         SSVAL(req->inbuf,smb_uid,sess_vuid);
1756
1757         if (!done_sesssetup)
1758                 max_send = MIN(max_send,smb_bufsize);
1759
1760         done_sesssetup = True;
1761
1762         END_PROFILE(SMBsesssetupX);
1763         chain_reply(req);
1764         return;
1765 }