From 1ecdc8588da2eddfe673f736f519d37eac4be911 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 15 May 2009 11:20:34 +0200 Subject: [PATCH] s3:smbd: implement SMB2 Session Setup with raw NTLMSSP metze --- source3/Makefile.in | 1 + source3/smbd/globals.h | 22 ++++ source3/smbd/smb2_server.c | 9 +- source3/smbd/smb2_sesssetup.c | 190 ++++++++++++++++++++++++++++++++++ 4 files changed, 221 insertions(+), 1 deletion(-) create mode 100644 source3/smbd/smb2_sesssetup.c diff --git a/source3/Makefile.in b/source3/Makefile.in index f5074e3a784..fdcd86a0886 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -749,6 +749,7 @@ SMBD_OBJ_SRV = smbd/files.o smbd/chgpasswd.o smbd/connection.o \ smbd/file_access.o \ smbd/dnsregister.o smbd/globals.o \ smbd/smb2_server.o smbd/smb2_negprot.o \ + smbd/smb2_sesssetup.o \ smbd/smb2_keepalive.o \ $(MANGLE_OBJ) @VFS_STATIC@ diff --git a/source3/smbd/globals.h b/source3/smbd/globals.h index 93075ad9017..5a7ad7d9e32 100644 --- a/source3/smbd/globals.h +++ b/source3/smbd/globals.h @@ -221,6 +221,7 @@ NTSTATUS smbd_smb2_request_done(struct smbd_smb2_request *req, DATA_BLOB body, DATA_BLOB *dyn); NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req); +NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *req); NTSTATUS smbd_smb2_request_process_keepalive(struct smbd_smb2_request *req); struct smbd_smb2_request { @@ -276,6 +277,16 @@ struct smbd_smb2_request { } out; }; +struct smbd_server_connection; + +struct smbd_smb2_session { + struct smbd_smb2_session *prev, *next; + struct smbd_server_connection *conn; + NTSTATUS status; + uint64_t vuid; + AUTH_NTLMSSP_STATE *auth_ntlmssp_state; +}; + struct smbd_server_connection { struct fd_event *fde; uint64_t num_requests; @@ -286,6 +297,17 @@ struct smbd_server_connection { struct tevent_queue *recv_queue; struct tevent_queue *send_queue; struct tstream_context *stream; + struct { + /* an id tree used to allocate vuids */ + /* this holds info on session vuids that are already + * validated for this VC */ + struct idr_context *idtree; + + /* this is the limit of vuid values for this connection */ + uint64_t limit; + + struct smbd_smb2_session *list; + } sessions; } smb2; }; diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c index 68c812b37ff..6d8961eebb1 100644 --- a/source3/smbd/smb2_server.c +++ b/source3/smbd/smb2_server.c @@ -55,6 +55,13 @@ static NTSTATUS smbd_initialize_smb2(struct smbd_server_connection *conn) return NT_STATUS_NO_MEMORY; } + conn->smb2.sessions.idtree = idr_init(conn); + if (conn->smb2.sessions.idtree == NULL) { + return NT_STATUS_NO_MEMORY; + } + conn->smb2.sessions.limit = 0x0000FFFF; + conn->smb2.sessions.list = NULL; + ret = tstream_bsd_existing_socket(conn, smbd_server_fd(), &conn->smb2.stream); if (ret == -1) { @@ -293,7 +300,7 @@ static NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) return smbd_smb2_request_process_negprot(req); case SMB2_OP_SESSSETUP: - return smbd_smb2_request_error(req, NT_STATUS_NOT_IMPLEMENTED); + return smbd_smb2_request_process_sesssetup(req); case SMB2_OP_LOGOFF: return smbd_smb2_request_error(req, NT_STATUS_NOT_IMPLEMENTED); diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c new file mode 100644 index 00000000000..6c4da393e17 --- /dev/null +++ b/source3/smbd/smb2_sesssetup.c @@ -0,0 +1,190 @@ +/* + Unix SMB/CIFS implementation. + Core SMB2 server + + Copyright (C) Stefan Metzmacher 2009 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "smbd/globals.h" +#include "../source4/libcli/smb2/smb2_constants.h" + +static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *req, + uint64_t in_session_id, + DATA_BLOB in_security_buffer, + DATA_BLOB *out_security_buffer, + uint64_t *out_session_id); + +NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *req) +{ + const uint8_t *inhdr; + const uint8_t *inbody; + int i = req->current_idx; + uint8_t *outhdr; + DATA_BLOB outbody; + DATA_BLOB outdyn; + size_t expected_body_size = 0x19; + size_t body_size; + uint64_t in_session_id; + uint16_t in_security_offset; + uint16_t in_security_length; + DATA_BLOB in_security_buffer; + uint64_t out_session_id; + uint16_t out_security_offset; + DATA_BLOB out_security_buffer; + NTSTATUS status; + + inhdr = (const uint8_t *)req->in.vector[i+0].iov_base; + + if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) { + return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); + } + + inbody = (const uint8_t *)req->in.vector[i+1].iov_base; + + body_size = SVAL(inbody, 0x00); + if (body_size != expected_body_size) { + return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); + } + + in_security_offset = SVAL(inbody, 0x0C); + in_security_length = SVAL(inbody, 0x0E); + + if (in_security_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) { + return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); + } + + if (in_security_length > req->in.vector[i+2].iov_len) { + return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); + } + + in_session_id = SVAL(inhdr, SMB2_HDR_SESSION_ID); + in_security_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base; + in_security_buffer.length = in_security_length; + + status = smbd_smb2_session_setup(req, + in_session_id, + in_security_buffer, + &out_security_buffer, + &out_session_id); + if (!NT_STATUS_IS_OK(status) && + !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + status = nt_status_squash(status); + return smbd_smb2_request_error(req, status); + } + + out_security_offset = SMB2_HDR_BODY + 0x08; + + outhdr = (uint8_t *)req->out.vector[i].iov_base; + + outbody = data_blob_talloc(req->out.vector, NULL, 0x08); + if (outbody.data == NULL) { + return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY); + } + + SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id); + + SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */ + SSVAL(outbody.data, 0x02, 0); /* session flags */ + SSVAL(outbody.data, 0x04, + out_security_offset); /* security buffer offset */ + SSVAL(outbody.data, 0x06, + out_security_buffer.length); /* security buffer length */ + + outdyn = out_security_buffer; + + return smbd_smb2_request_done_ex(req, status, outbody, &outdyn); +} + +static int smbd_smb2_session_destructor(struct smbd_smb2_session *session) +{ + if (session->conn == NULL) { + return 0; + } + + idr_remove(session->conn->smb2.sessions.idtree, session->vuid); + DLIST_REMOVE(session->conn->smb2.sessions.list, session); + + return 0; +} + +static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *req, + uint64_t in_session_id, + DATA_BLOB in_security_buffer, + DATA_BLOB *out_security_buffer, + uint64_t *out_session_id) +{ + struct smbd_smb2_session *session; + NTSTATUS status; + + if (in_session_id == 0) { + int id; + + /* create a new session */ + session = talloc_zero(req->conn, struct smbd_smb2_session); + if (session == NULL) { + return NT_STATUS_NO_MEMORY; + } + session->status = NT_STATUS_MORE_PROCESSING_REQUIRED; + id = idr_get_new_random(req->conn->smb2.sessions.idtree, + session, + req->conn->smb2.sessions.limit); + if (id == -1) { + return NT_STATUS_INSUFFICIENT_RESOURCES; + } + session->vuid = id; + DLIST_ADD_END(req->conn->smb2.sessions.list, session, + struct smbd_smb2_session *); + session->conn = req->conn; + talloc_set_destructor(session, smbd_smb2_session_destructor); + } else { + void *p; + + /* lookup an existing session */ + p = idr_find(req->conn->smb2.sessions.idtree, in_session_id); + if (p == NULL) { + return NT_STATUS_USER_SESSION_DELETED; + } + session = talloc_get_type_abort(p, struct smbd_smb2_session); + } + + if (NT_STATUS_IS_OK(session->status)) { + return NT_STATUS_REQUEST_NOT_ACCEPTED; + } + + if (session->auth_ntlmssp_state == NULL) { + status = auth_ntlmssp_start(&session->auth_ntlmssp_state); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + } + + status = auth_ntlmssp_update(session->auth_ntlmssp_state, + in_security_buffer, + out_security_buffer); + if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + /* nothing to do */ + } else if (NT_STATUS_IS_OK(status)) { + /* TODO: setup session key for signing */ + session->status = NT_STATUS_OK; + } else { + return status; + } + + *out_session_id = session->vuid; + return status; +} + -- 2.34.1