s4-auth: Log SMB authorization for bare NTLM (NTLMSSP/krb5 already done)

gensec_session_info() is not called for bare NTLM, so we have to log manually

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz>
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>

diff --git a/source4/smb_server/smb/sesssetup.c b/source4/smb_server/smb/sesssetup.c
index 4dee6d0c026fdb2684a8e20b700410481e6576e3..594efd0c02d9eaf5f82ecca54fc90df2737966ea 100644 (file)
--- a/source4/smb_server/smb/sesssetup.c
+++ b/source4/smb_server/smb/sesssetup.c
@@ -38,6 +38,33 @@ struct sesssetup_context {
        struct smbsrv_request *req;
 };
 
+/*
+ * Log the SMB authentication, as by not calling GENSEC we won't log
+ * it during the gensec_session_info().
+ */
+void smbsrv_not_spengo_sesssetup_authz_log(struct smbsrv_request *req,
+                                              struct auth_session_info *session_info)
+{
+       struct tsocket_address *local_address;
+       struct tsocket_address *remote_address;
+       TALLOC_CTX *frame = talloc_stackframe();
+
+       remote_address = socket_get_remote_addr(req->smb_conn->connection->socket,
+                                               frame);
+       local_address = socket_get_local_addr(req->smb_conn->connection->socket,
+                                             frame);
+
+       log_successful_authz_event(remote_address,
+                                  local_address,
+                                  "SMB",
+                                  "bare-NTLM",
+                                  session_info);
+
+       talloc_free(frame);
+       return;
+}
+
+
 /*
   setup the OS, Lanman and domain portions of a session setup reply
 */
@@ -98,6 +125,8 @@ static void sesssetup_old_send(struct tevent_req *subreq)
                goto failed;
        }
 
+       smbsrv_not_spengo_sesssetup_authz_log(req, session_info);
+
        /* Ensure this is marked as a 'real' vuid, not one
         * simply valid for the session setup leg */
        status = smbsrv_session_sesssetup_finished(smb_sess, session_info);
@@ -240,6 +269,8 @@ static void sesssetup_nt1_send(struct tevent_req *subreq)
                goto failed;
        }
 
+       smbsrv_not_spengo_sesssetup_authz_log(req, session_info);
+
        /* Ensure this is marked as a 'real' vuid, not one
         * simply valid for the session setup leg */
        status = smbsrv_session_sesssetup_finished(smb_sess, session_info);
@@ -339,6 +370,7 @@ static void sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *sess)
        if (!user_info) goto nomem;
 
        user_info->service_description = "SMB";
+       user_info->auth_description = "bare-NTLM";
 
        user_info->mapped_state = false;
        user_info->logon_parameters = 0;