source3/smbd/sesssetup.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    handle SMBsessionsetup
   4    Copyright (C) Andrew Tridgell 1998-2001
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
   7    Copyright (C) Luke Howard          2003
   8    Copyright (C) Volker Lendecke      2007
   9    Copyright (C) Jeremy Allison       2007
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "smbd/globals.h"
  27 #include "../libcli/auth/spnego.h"
  28 #include "../libcli/auth/ntlmssp.h"
  29 #include "ntlmssp_wrap.h"
  30 #include "librpc/gen_ndr/messaging.h"
  31 #include "../librpc/gen_ndr/krb5pac.h"
  32 #include "libads/kerberos_proto.h"
  33
  34 /* For split krb5 SPNEGO blobs. */
  35 struct pending_auth_data {
  36         struct pending_auth_data *prev, *next;
  37         uint16 vuid; /* Tag for this entry. */
  38         uint16 smbpid; /* Alternate tag for this entry. */
  39         size_t needed_len;
  40         DATA_BLOB partial_data;
  41 };
  42
  43 /*
  44   on a logon error possibly map the error to success if "map to guest"
  45   is set approriately
  46 */
  47 NTSTATUS do_map_to_guest(NTSTATUS status,
  48                         struct auth_serversupplied_info **server_info,
  49                         const char *user, const char *domain)
  50 {
  51         user = user ? user : "";
  52         domain = domain ? domain : "";
  53
  54         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
  55                 if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER) ||
  56                     (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD)) {
  57                         DEBUG(3,("No such user %s [%s] - using guest account\n",
  58                                  user, domain));
  59                         status = make_server_info_guest(NULL, server_info);
  60                 }
  61         }
  62
  63         if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
  64                 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD) {
  65                         DEBUG(3,("Registered username %s for guest access\n",
  66                                 user));
  67                         status = make_server_info_guest(NULL, server_info);
  68                 }
  69         }
  70
  71         return status;
  72 }
  73
  74 /****************************************************************************
  75  Add the standard 'Samba' signature to the end of the session setup.
  76 ****************************************************************************/
  77
  78 static int push_signature(uint8 **outbuf)
  79 {
  80         char *lanman;
  81         int result, tmp;
  82
  83         result = 0;
  84
  85         tmp = message_push_string(outbuf, "Unix", STR_TERMINATE);
  86
  87         if (tmp == -1) return -1;
  88         result += tmp;
  89
  90         if (asprintf(&lanman, "Samba %s", samba_version_string()) != -1) {
  91                 tmp = message_push_string(outbuf, lanman, STR_TERMINATE);
  92                 SAFE_FREE(lanman);
  93         }
  94         else {
  95                 tmp = message_push_string(outbuf, "Samba", STR_TERMINATE);
  96         }
  97
  98         if (tmp == -1) return -1;
  99         result += tmp;
 100
 101         tmp = message_push_string(outbuf, lp_workgroup(), STR_TERMINATE);
 102
 103         if (tmp == -1) return -1;
 104         result += tmp;
 105
 106         return result;
 107 }
 108
 109 /****************************************************************************
 110  Send a security blob via a session setup reply.
 111 ****************************************************************************/
 112
 113 static void reply_sesssetup_blob(struct smb_request *req,
 114                                  DATA_BLOB blob,
 115                                  NTSTATUS nt_status)
 116 {
 117         if (!NT_STATUS_IS_OK(nt_status) &&
 118             !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 119                 reply_nterror(req, nt_status_squash(nt_status));
 120                 return;
 121         }
 122
 123         nt_status = nt_status_squash(nt_status);
 124         SIVAL(req->outbuf, smb_rcls, NT_STATUS_V(nt_status));
 125         SSVAL(req->outbuf, smb_vwv0, 0xFF); /* no chaining possible */
 126         SSVAL(req->outbuf, smb_vwv3, blob.length);
 127
 128         if ((message_push_blob(&req->outbuf, blob) == -1)
 129             || (push_signature(&req->outbuf) == -1)) {
 130                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 131         }
 132 }
 133
 134 /****************************************************************************
 135  Do a 'guest' logon, getting back the
 136 ****************************************************************************/
 137
 138 static NTSTATUS check_guest_password(struct auth_serversupplied_info **server_info)
 139 {
 140         struct auth_context *auth_context;
 141         struct auth_usersupplied_info *user_info = NULL;
 142
 143         NTSTATUS nt_status;
 144         unsigned char chal[8];
 145
 146         ZERO_STRUCT(chal);
 147
 148         DEBUG(3,("Got anonymous request\n"));
 149
 150         if (!NT_STATUS_IS_OK(nt_status = make_auth_context_fixed(&auth_context,
 151                                         chal))) {
 152                 return nt_status;
 153         }
 154
 155         if (!make_user_info_guest(&user_info)) {
 156                 TALLOC_FREE(auth_context);
 157                 return NT_STATUS_NO_MEMORY;
 158         }
 159
 160         nt_status = auth_context->check_ntlm_password(auth_context,
 161                                                 user_info,
 162                                                 server_info);
 163         TALLOC_FREE(auth_context);
 164         free_user_info(&user_info);
 165         return nt_status;
 166 }
 167
 168
 169 #ifdef HAVE_KRB5
 170
 171 #if 0
 172 /* Experiment that failed. See "only happens with a KDC" comment below. */
 173 /****************************************************************************
 174  Cerate a clock skew error blob for a Windows client.
 175 ****************************************************************************/
 176
 177 static bool make_krb5_skew_error(DATA_BLOB *pblob_out)
 178 {
 179         krb5_context context = NULL;
 180         krb5_error_code kerr = 0;
 181         krb5_data reply;
 182         krb5_principal host_princ = NULL;
 183         char *host_princ_s = NULL;
 184         bool ret = False;
 185
 186         *pblob_out = data_blob_null;
 187
 188         initialize_krb5_error_table();
 189         kerr = krb5_init_context(&context);
 190         if (kerr) {
 191                 return False;
 192         }
 193         /* Create server principal. */
 194         asprintf(&host_princ_s, "%s$@%s", global_myname(), lp_realm());
 195         if (!host_princ_s) {
 196                 goto out;
 197         }
 198         strlower_m(host_princ_s);
 199
 200         kerr = smb_krb5_parse_name(context, host_princ_s, &host_princ);
 201         if (kerr) {
 202                 DEBUG(10,("make_krb5_skew_error: smb_krb5_parse_name failed "
 203                         "for name %s: Error %s\n",
 204                         host_princ_s, error_message(kerr) ));
 205                 goto out;
 206         }
 207
 208         kerr = smb_krb5_mk_error(context, KRB5KRB_AP_ERR_SKEW,
 209                         host_princ, &reply);
 210         if (kerr) {
 211                 DEBUG(10,("make_krb5_skew_error: smb_krb5_mk_error "
 212                         "failed: Error %s\n",
 213                         error_message(kerr) ));
 214                 goto out;
 215         }
 216
 217         *pblob_out = data_blob(reply.data, reply.length);
 218         kerberos_free_data_contents(context,&reply);
 219         ret = True;
 220
 221   out:
 222
 223         if (host_princ_s) {
 224                 SAFE_FREE(host_princ_s);
 225         }
 226         if (host_princ) {
 227                 krb5_free_principal(context, host_princ);
 228         }
 229         krb5_free_context(context);
 230         return ret;
 231 }
 232 #endif
 233
 234 /****************************************************************************
 235  Reply to a session setup spnego negotiate packet for kerberos.
 236 ****************************************************************************/
 237
 238 static void reply_spnego_kerberos(struct smb_request *req,
 239                                   DATA_BLOB *secblob,
 240                                   const char *mechOID,
 241                                   uint16 vuid,
 242                                   bool *p_invalidate_vuid)
 243 {
 244         TALLOC_CTX *mem_ctx;
 245         DATA_BLOB ticket;
 246         char *client, *p, *domain;
 247         fstring netbios_domain_name;
 248         struct passwd *pw;
 249         fstring user;
 250         int sess_vuid = req->vuid;
 251         NTSTATUS ret = NT_STATUS_OK;
 252         DATA_BLOB ap_rep, ap_rep_wrapped, response;
 253         struct auth_serversupplied_info *server_info = NULL;
 254         DATA_BLOB session_key = data_blob_null;
 255         uint8 tok_id[2];
 256         DATA_BLOB nullblob = data_blob_null;
 257         fstring real_username;
 258         bool map_domainuser_to_guest = False;
 259         bool username_was_mapped;
 260         struct PAC_LOGON_INFO *logon_info = NULL;
 261         struct smbd_server_connection *sconn = req->sconn;
 262
 263         ZERO_STRUCT(ticket);
 264         ZERO_STRUCT(ap_rep);
 265         ZERO_STRUCT(ap_rep_wrapped);
 266         ZERO_STRUCT(response);
 267
 268         /* Normally we will always invalidate the intermediate vuid. */
 269         *p_invalidate_vuid = True;
 270
 271         mem_ctx = talloc_init("reply_spnego_kerberos");
 272         if (mem_ctx == NULL) {
 273                 reply_nterror(req, nt_status_squash(NT_STATUS_NO_MEMORY));
 274                 return;
 275         }
 276
 277         if (!spnego_parse_krb5_wrap(mem_ctx, *secblob, &ticket, tok_id)) {
 278                 talloc_destroy(mem_ctx);
 279                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
 280                 return;
 281         }
 282
 283         ret = ads_verify_ticket(mem_ctx, lp_realm(), 0, &ticket,
 284                                 &client, &logon_info, &ap_rep,
 285                                 &session_key, True);
 286
 287         data_blob_free(&ticket);
 288
 289         if (!NT_STATUS_IS_OK(ret)) {
 290 #if 0
 291                 /* Experiment that failed.
 292                  * See "only happens with a KDC" comment below. */
 293
 294                 if (NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
 295
 296                         /*
 297                          * Windows in this case returns
 298                          * NT_STATUS_MORE_PROCESSING_REQUIRED
 299                          * with a negTokenTarg blob containing an krb5_error
 300                          * struct ASN1 encoded containing KRB5KRB_AP_ERR_SKEW.
 301                          * The client then fixes its clock and continues rather
 302                          * than giving an error. JRA.
 303                          * -- Looks like this only happens with a KDC. JRA.
 304                          */
 305
 306                         bool ok = make_krb5_skew_error(&ap_rep);
 307                         if (!ok) {
 308                                 talloc_destroy(mem_ctx);
 309                                 return ERROR_NT(nt_status_squash(
 310                                                 NT_STATUS_LOGON_FAILURE));
 311                         }
 312                         ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
 313                                         TOK_ID_KRB_ERROR);
 314                         response = spnego_gen_auth_response(&ap_rep_wrapped,
 315                                         ret, OID_KERBEROS5_OLD);
 316                         reply_sesssetup_blob(conn, inbuf, outbuf, response,
 317                                         NT_STATUS_MORE_PROCESSING_REQUIRED);
 318
 319                         /*
 320                          * In this one case we don't invalidate the
 321                          * intermediate vuid as we're expecting the client
 322                          * to re-use it for the next sessionsetupX packet. JRA.
 323                          */
 324
 325                         *p_invalidate_vuid = False;
 326
 327                         data_blob_free(&ap_rep);
 328                         data_blob_free(&ap_rep_wrapped);
 329                         data_blob_free(&response);
 330                         talloc_destroy(mem_ctx);
 331                         return -1; /* already replied */
 332                 }
 333 #else
 334                 if (!NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
 335                         ret = NT_STATUS_LOGON_FAILURE;
 336                 }
 337 #endif
 338                 DEBUG(1,("Failed to verify incoming ticket with error %s!\n",
 339                                 nt_errstr(ret)));
 340                 talloc_destroy(mem_ctx);
 341                 reply_nterror(req, nt_status_squash(ret));
 342                 return;
 343         }
 344
 345         DEBUG(3,("Ticket name is [%s]\n", client));
 346
 347         p = strchr_m(client, '@');
 348         if (!p) {
 349                 DEBUG(3,("Doesn't look like a valid principal\n"));
 350                 data_blob_free(&ap_rep);
 351                 data_blob_free(&session_key);
 352                 talloc_destroy(mem_ctx);
 353                 reply_nterror(req,nt_status_squash(NT_STATUS_LOGON_FAILURE));
 354                 return;
 355         }
 356
 357         *p = 0;
 358
 359         /* save the PAC data if we have it */
 360
 361         if (logon_info) {
 362                 netsamlogon_cache_store( client, &logon_info->info3 );
 363         }
 364
 365         if (!strequal(p+1, lp_realm())) {
 366                 DEBUG(3,("Ticket for foreign realm %s@%s\n", client, p+1));
 367                 if (!lp_allow_trusted_domains()) {
 368                         data_blob_free(&ap_rep);
 369                         data_blob_free(&session_key);
 370                         talloc_destroy(mem_ctx);
 371                         reply_nterror(req, nt_status_squash(
 372                                               NT_STATUS_LOGON_FAILURE));
 373                         return;
 374                 }
 375         }
 376
 377         /* this gives a fully qualified user name (ie. with full realm).
 378            that leads to very long usernames, but what else can we do? */
 379
 380         domain = p+1;
 381
 382         if (logon_info && logon_info->info3.base.domain.string) {
 383                 fstrcpy(netbios_domain_name,
 384                         logon_info->info3.base.domain.string);
 385                 domain = netbios_domain_name;
 386                 DEBUG(10, ("Mapped to [%s] (using PAC)\n", domain));
 387
 388         } else {
 389
 390                 /* If we have winbind running, we can (and must) shorten the
 391                    username by using the short netbios name. Otherwise we will
 392                    have inconsistent user names. With Kerberos, we get the
 393                    fully qualified realm, with ntlmssp we get the short
 394                    name. And even w2k3 does use ntlmssp if you for example
 395                    connect to an ip address. */
 396
 397                 wbcErr wbc_status;
 398                 struct wbcDomainInfo *info = NULL;
 399
 400                 DEBUG(10, ("Mapping [%s] to short name\n", domain));
 401
 402                 wbc_status = wbcDomainInfo(domain, &info);
 403
 404                 if (WBC_ERROR_IS_OK(wbc_status)) {
 405
 406                         fstrcpy(netbios_domain_name,
 407                                 info->short_name);
 408
 409                         wbcFreeMemory(info);
 410                         domain = netbios_domain_name;
 411                         DEBUG(10, ("Mapped to [%s] (using Winbind)\n", domain));
 412                 } else {
 413                         DEBUG(3, ("Could not find short name: %s\n",
 414                                 wbcErrorString(wbc_status)));
 415                 }
 416         }
 417
 418         fstr_sprintf(user, "%s%c%s", domain, *lp_winbind_separator(), client);
 419
 420         /* lookup the passwd struct, create a new user if necessary */
 421
 422         username_was_mapped = map_username(user);
 423
 424         pw = smb_getpwnam( mem_ctx, user, real_username, True );
 425
 426         if (pw) {
 427                 /* if a real user check pam account restrictions */
 428                 /* only really perfomed if "obey pam restriction" is true */
 429                 /* do this before an eventual mapping to guest occurs */
 430                 ret = smb_pam_accountcheck(pw->pw_name, sconn->client_id.name);
 431                 if (  !NT_STATUS_IS_OK(ret)) {
 432                         DEBUG(1,("PAM account restriction "
 433                                 "prevents user login\n"));
 434                         data_blob_free(&ap_rep);
 435                         data_blob_free(&session_key);
 436                         TALLOC_FREE(mem_ctx);
 437                         reply_nterror(req, nt_status_squash(ret));
 438                         return;
 439                 }
 440         }
 441
 442         if (!pw) {
 443
 444                 /* this was originally the behavior of Samba 2.2, if a user
 445                    did not have a local uid but has been authenticated, then
 446                    map them to a guest account */
 447
 448                 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID){
 449                         map_domainuser_to_guest = True;
 450                         fstrcpy(user,lp_guestaccount());
 451                         pw = smb_getpwnam( mem_ctx, user, real_username, True );
 452                 }
 453
 454                 /* extra sanity check that the guest account is valid */
 455
 456                 if ( !pw ) {
 457                         DEBUG(1,("Username %s is invalid on this system\n",
 458                                 user));
 459                         data_blob_free(&ap_rep);
 460                         data_blob_free(&session_key);
 461                         TALLOC_FREE(mem_ctx);
 462                         reply_nterror(req, nt_status_squash(
 463                                               NT_STATUS_LOGON_FAILURE));
 464                         return;
 465                 }
 466         }
 467
 468         /* setup the string used by %U */
 469
 470         sub_set_smb_name( real_username );
 471         reload_services(sconn->msg_ctx, sconn->sock, True);
 472
 473         if ( map_domainuser_to_guest ) {
 474                 make_server_info_guest(NULL, &server_info);
 475         } else if (logon_info) {
 476                 /* pass the unmapped username here since map_username()
 477                    will be called again from inside make_server_info_info3() */
 478
 479                 ret = make_server_info_info3(mem_ctx, client, domain,
 480                                              &server_info, &logon_info->info3);
 481                 if ( !NT_STATUS_IS_OK(ret) ) {
 482                         DEBUG(1,("make_server_info_info3 failed: %s!\n",
 483                                  nt_errstr(ret)));
 484                         data_blob_free(&ap_rep);
 485                         data_blob_free(&session_key);
 486                         TALLOC_FREE(mem_ctx);
 487                         reply_nterror(req, nt_status_squash(ret));
 488                         return;
 489                 }
 490
 491         } else {
 492                 /*
 493                  * We didn't get a PAC, we have to make up the user
 494                  * ourselves. Try to ask the pdb backend to provide
 495                  * SID consistency with ntlmssp session setup
 496                  */
 497                 struct samu *sampass;
 498
 499                 sampass = samu_new(talloc_tos());
 500                 if (sampass == NULL) {
 501                         ret = NT_STATUS_NO_MEMORY;
 502                         data_blob_free(&ap_rep);
 503                         data_blob_free(&session_key);
 504                         TALLOC_FREE(mem_ctx);
 505                         reply_nterror(req, nt_status_squash(ret));
 506                         return;
 507                 }
 508
 509                 if (pdb_getsampwnam(sampass, real_username)) {
 510                         DEBUG(10, ("found user %s in passdb, calling "
 511                                    "make_server_info_sam\n", real_username));
 512                         ret = make_server_info_sam(&server_info, sampass);
 513                         TALLOC_FREE(sampass);
 514                 } else {
 515                         /*
 516                          * User not in passdb, make it up artificially
 517                          */
 518                         TALLOC_FREE(sampass);
 519                         DEBUG(10, ("didn't find user %s in passdb, calling "
 520                                    "make_server_info_pw\n", real_username));
 521                         ret = make_server_info_pw(&server_info, real_username,
 522                                                   pw);
 523                 }
 524
 525                 if ( !NT_STATUS_IS_OK(ret) ) {
 526                         DEBUG(1,("make_server_info_[sam|pw] failed: %s!\n",
 527                                  nt_errstr(ret)));
 528                         data_blob_free(&ap_rep);
 529                         data_blob_free(&session_key);
 530                         TALLOC_FREE(mem_ctx);
 531                         reply_nterror(req, nt_status_squash(ret));
 532                         return;
 533                 }
 534
 535                 /* make_server_info_pw does not set the domain. Without this
 536                  * we end up with the local netbios name in substitutions for
 537                  * %D. */
 538
 539                 if (server_info->info3 != NULL) {
 540                         server_info->info3->base.domain.string =
 541                                 talloc_strdup(server_info->info3, domain);
 542                 }
 543         }
 544
 545         server_info->nss_token |= username_was_mapped;
 546
 547         /* we need to build the token for the user. make_server_info_guest()
 548            already does this */
 549
 550         if ( !server_info->ptok ) {
 551                 ret = create_local_token( server_info );
 552                 if ( !NT_STATUS_IS_OK(ret) ) {
 553                         DEBUG(10,("failed to create local token: %s\n",
 554                                 nt_errstr(ret)));
 555                         data_blob_free(&ap_rep);
 556                         data_blob_free(&session_key);
 557                         TALLOC_FREE( mem_ctx );
 558                         TALLOC_FREE( server_info );
 559                         reply_nterror(req, nt_status_squash(ret));
 560                         return;
 561                 }
 562         }
 563
 564         if (!is_partial_auth_vuid(sconn, sess_vuid)) {
 565                 sess_vuid = register_initial_vuid(sconn);
 566         }
 567
 568         data_blob_free(&server_info->user_session_key);
 569         server_info->user_session_key = session_key;
 570         talloc_steal(server_info, session_key.data);
 571
 572         session_key = data_blob_null;
 573
 574         /* register_existing_vuid keeps the server info */
 575         /* register_existing_vuid takes ownership of session_key on success,
 576          * no need to free after this on success. A better interface would copy
 577          * it.... */
 578
 579         sess_vuid = register_existing_vuid(sconn,
 580                                         sess_vuid,
 581                                         server_info,
 582                                         nullblob,
 583                                         client);
 584
 585         reply_outbuf(req, 4, 0);
 586         SSVAL(req->outbuf,smb_uid,sess_vuid);
 587
 588         if (sess_vuid == UID_FIELD_INVALID ) {
 589                 ret = NT_STATUS_LOGON_FAILURE;
 590         } else {
 591                 /* current_user_info is changed on new vuid */
 592                 reload_services(sconn->msg_ctx, sconn->sock, True);
 593
 594                 SSVAL(req->outbuf, smb_vwv3, 0);
 595
 596                 if (server_info->guest) {
 597                         SSVAL(req->outbuf,smb_vwv2,1);
 598                 }
 599
 600                 SSVAL(req->outbuf, smb_uid, sess_vuid);
 601
 602                 /* Successful logon. Keep this vuid. */
 603                 *p_invalidate_vuid = False;
 604         }
 605
 606         /* wrap that up in a nice GSS-API wrapping */
 607         if (NT_STATUS_IS_OK(ret)) {
 608                 ap_rep_wrapped = spnego_gen_krb5_wrap(talloc_tos(), ap_rep,
 609                                 TOK_ID_KRB_AP_REP);
 610         } else {
 611                 ap_rep_wrapped = data_blob_null;
 612         }
 613         response = spnego_gen_auth_response(talloc_tos(), &ap_rep_wrapped, ret,
 614                         mechOID);
 615         reply_sesssetup_blob(req, response, ret);
 616
 617         data_blob_free(&ap_rep);
 618         data_blob_free(&ap_rep_wrapped);
 619         data_blob_free(&response);
 620         TALLOC_FREE(mem_ctx);
 621 }
 622
 623 #endif
 624
 625 /****************************************************************************
 626  Send a session setup reply, wrapped in SPNEGO.
 627  Get vuid and check first.
 628  End the NTLMSSP exchange context if we are OK/complete fail
 629  This should be split into two functions, one to handle each
 630  leg of the NTLM auth steps.
 631 ***************************************************************************/
 632
 633 static void reply_spnego_ntlmssp(struct smb_request *req,
 634                                  uint16 vuid,
 635                                  struct auth_ntlmssp_state **auth_ntlmssp_state,
 636                                  DATA_BLOB *ntlmssp_blob, NTSTATUS nt_status,
 637                                  const char *OID,
 638                                  bool wrap)
 639 {
 640         bool do_invalidate = true;
 641         DATA_BLOB response;
 642         struct auth_serversupplied_info *server_info = NULL;
 643         struct smbd_server_connection *sconn = req->sconn;
 644
 645         if (NT_STATUS_IS_OK(nt_status)) {
 646                 nt_status = auth_ntlmssp_steal_server_info(talloc_tos(),
 647                                         (*auth_ntlmssp_state), &server_info);
 648         } else {
 649                 /* Note that this server_info won't have a session
 650                  * key.  But for map to guest, that's exactly the right
 651                  * thing - we can't reasonably guess the key the
 652                  * client wants, as the password was wrong */
 653                 nt_status = do_map_to_guest(nt_status,
 654                                             &server_info,
 655                                             auth_ntlmssp_get_username(*auth_ntlmssp_state),
 656                                             auth_ntlmssp_get_domain(*auth_ntlmssp_state));
 657         }
 658
 659         reply_outbuf(req, 4, 0);
 660
 661         SSVAL(req->outbuf, smb_uid, vuid);
 662
 663         if (NT_STATUS_IS_OK(nt_status)) {
 664                 DATA_BLOB nullblob = data_blob_null;
 665
 666                 if (!is_partial_auth_vuid(sconn, vuid)) {
 667                         nt_status = NT_STATUS_LOGON_FAILURE;
 668                         goto out;
 669                 }
 670
 671                 /* register_existing_vuid keeps the server info */
 672                 if (register_existing_vuid(sconn, vuid,
 673                                            server_info, nullblob,
 674                                            auth_ntlmssp_get_username(*auth_ntlmssp_state)) !=
 675                                            vuid) {
 676                         /* The problem is, *auth_ntlmssp_state points
 677                          * into the vuser this will have
 678                          * talloc_free()'ed in
 679                          * register_existing_vuid() */
 680                         do_invalidate = false;
 681                         nt_status = NT_STATUS_LOGON_FAILURE;
 682                         goto out;
 683                 }
 684
 685                 /* current_user_info is changed on new vuid */
 686                 reload_services(sconn->msg_ctx, sconn->sock, True);
 687
 688                 SSVAL(req->outbuf, smb_vwv3, 0);
 689
 690                 if (server_info->guest) {
 691                         SSVAL(req->outbuf,smb_vwv2,1);
 692                 }
 693         }
 694
 695   out:
 696
 697         if (wrap) {
 698                 response = spnego_gen_auth_response(talloc_tos(),
 699                                 ntlmssp_blob,
 700                                 nt_status, OID);
 701         } else {
 702                 response = *ntlmssp_blob;
 703         }
 704
 705         reply_sesssetup_blob(req, response, nt_status);
 706         if (wrap) {
 707                 data_blob_free(&response);
 708         }
 709
 710         /* NT_STATUS_MORE_PROCESSING_REQUIRED from our NTLMSSP code tells us,
 711            and the other end, that we are not finished yet. */
 712
 713         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 714                 /* NB. This is *NOT* an error case. JRA */
 715                 if (do_invalidate) {
 716                         TALLOC_FREE(*auth_ntlmssp_state);
 717                         if (!NT_STATUS_IS_OK(nt_status)) {
 718                                 /* Kill the intermediate vuid */
 719                                 invalidate_vuid(sconn, vuid);
 720                         }
 721                 }
 722         }
 723 }
 724
 725 /****************************************************************************
 726  Is this a krb5 mechanism ?
 727 ****************************************************************************/
 728
 729 NTSTATUS parse_spnego_mechanisms(TALLOC_CTX *ctx,
 730                 DATA_BLOB blob_in,
 731                 DATA_BLOB *pblob_out,
 732                 char **kerb_mechOID)
 733 {
 734         char *OIDs[ASN1_MAX_OIDS];
 735         int i;
 736         NTSTATUS ret = NT_STATUS_OK;
 737
 738         *kerb_mechOID = NULL;
 739
 740         /* parse out the OIDs and the first sec blob */
 741         if (!spnego_parse_negTokenInit(ctx, blob_in, OIDs, NULL, pblob_out)) {
 742                 return NT_STATUS_LOGON_FAILURE;
 743         }
 744
 745         /* only look at the first OID for determining the mechToken --
 746            according to RFC2478, we should choose the one we want
 747            and renegotiate, but i smell a client bug here..
 748
 749            Problem observed when connecting to a member (samba box)
 750            of an AD domain as a user in a Samba domain.  Samba member
 751            server sent back krb5/mskrb5/ntlmssp as mechtypes, but the
 752            client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an
 753            NTLMSSP mechtoken.                 --jerry              */
 754
 755 #ifdef HAVE_KRB5
 756         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 ||
 757             strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
 758                 *kerb_mechOID = talloc_strdup(ctx, OIDs[0]);
 759                 if (*kerb_mechOID == NULL) {
 760                         ret = NT_STATUS_NO_MEMORY;
 761                 }
 762         }
 763 #endif
 764
 765         for (i=0;OIDs[i];i++) {
 766                 DEBUG(5,("parse_spnego_mechanisms: Got OID %s\n", OIDs[i]));
 767                 talloc_free(OIDs[i]);
 768         }
 769         return ret;
 770 }
 771
 772 /****************************************************************************
 773  Fall back from krb5 to NTLMSSP.
 774 ****************************************************************************/
 775
 776 static void reply_spnego_downgrade_to_ntlmssp(struct smb_request *req,
 777                                                 uint16 vuid)
 778 {
 779         DATA_BLOB response;
 780
 781         reply_outbuf(req, 4, 0);
 782         SSVAL(req->outbuf,smb_uid,vuid);
 783
 784         DEBUG(3,("reply_spnego_downgrade_to_ntlmssp: Got krb5 ticket in SPNEGO "
 785                 "but set to downgrade to NTLMSSP\n"));
 786
 787         response = spnego_gen_auth_response(talloc_tos(), NULL,
 788                         NT_STATUS_MORE_PROCESSING_REQUIRED,
 789                         OID_NTLMSSP);
 790         reply_sesssetup_blob(req, response, NT_STATUS_MORE_PROCESSING_REQUIRED);
 791         data_blob_free(&response);
 792 }
 793
 794 /****************************************************************************
 795  Reply to a session setup spnego negotiate packet.
 796 ****************************************************************************/
 797
 798 static void reply_spnego_negotiate(struct smb_request *req,
 799                                    uint16 vuid,
 800                                    DATA_BLOB blob1,
 801                                    struct auth_ntlmssp_state **auth_ntlmssp_state)
 802 {
 803         DATA_BLOB secblob;
 804         DATA_BLOB chal;
 805         char *kerb_mech = NULL;
 806         NTSTATUS status;
 807         struct smbd_server_connection *sconn = req->sconn;
 808
 809         status = parse_spnego_mechanisms(talloc_tos(),
 810                         blob1, &secblob, &kerb_mech);
 811         if (!NT_STATUS_IS_OK(status)) {
 812                 /* Kill the intermediate vuid */
 813                 invalidate_vuid(sconn, vuid);
 814                 reply_nterror(req, nt_status_squash(status));
 815                 return;
 816         }
 817
 818         DEBUG(3,("reply_spnego_negotiate: Got secblob of size %lu\n",
 819                                 (unsigned long)secblob.length));
 820
 821 #ifdef HAVE_KRB5
 822         if (kerb_mech && ((lp_security()==SEC_ADS) ||
 823                                 USE_KERBEROS_KEYTAB) ) {
 824                 bool destroy_vuid = True;
 825                 reply_spnego_kerberos(req, &secblob, kerb_mech,
 826                                       vuid, &destroy_vuid);
 827                 data_blob_free(&secblob);
 828                 if (destroy_vuid) {
 829                         /* Kill the intermediate vuid */
 830                         invalidate_vuid(sconn, vuid);
 831                 }
 832                 TALLOC_FREE(kerb_mech);
 833                 return;
 834         }
 835 #endif
 836
 837         if (*auth_ntlmssp_state) {
 838                 TALLOC_FREE(*auth_ntlmssp_state);
 839         }
 840
 841         if (kerb_mech) {
 842                 data_blob_free(&secblob);
 843                 /* The mechtoken is a krb5 ticket, but
 844                  * we need to fall back to NTLM. */
 845                 reply_spnego_downgrade_to_ntlmssp(req, vuid);
 846                 TALLOC_FREE(kerb_mech);
 847                 return;
 848         }
 849
 850         status = auth_ntlmssp_start(auth_ntlmssp_state);
 851         if (!NT_STATUS_IS_OK(status)) {
 852                 /* Kill the intermediate vuid */
 853                 invalidate_vuid(sconn, vuid);
 854                 reply_nterror(req, nt_status_squash(status));
 855                 return;
 856         }
 857
 858         status = auth_ntlmssp_update(*auth_ntlmssp_state,
 859                                         secblob, &chal);
 860
 861         data_blob_free(&secblob);
 862
 863         reply_spnego_ntlmssp(req, vuid, auth_ntlmssp_state,
 864                              &chal, status, OID_NTLMSSP, true);
 865
 866         data_blob_free(&chal);
 867
 868         /* already replied */
 869         return;
 870 }
 871
 872 /****************************************************************************
 873  Reply to a session setup spnego auth packet.
 874 ****************************************************************************/
 875
 876 static void reply_spnego_auth(struct smb_request *req,
 877                               uint16 vuid,
 878                               DATA_BLOB blob1,
 879                               struct auth_ntlmssp_state **auth_ntlmssp_state)
 880 {
 881         DATA_BLOB auth = data_blob_null;
 882         DATA_BLOB auth_reply = data_blob_null;
 883         DATA_BLOB secblob = data_blob_null;
 884         NTSTATUS status = NT_STATUS_LOGON_FAILURE;
 885         struct smbd_server_connection *sconn = req->sconn;
 886
 887         if (!spnego_parse_auth(talloc_tos(), blob1, &auth)) {
 888 #if 0
 889                 file_save("auth.dat", blob1.data, blob1.length);
 890 #endif
 891                 /* Kill the intermediate vuid */
 892                 invalidate_vuid(sconn, vuid);
 893
 894                 reply_nterror(req, nt_status_squash(
 895                                       NT_STATUS_LOGON_FAILURE));
 896                 return;
 897         }
 898
 899         if (auth.data[0] == ASN1_APPLICATION(0)) {
 900                 /* Might be a second negTokenTarg packet */
 901                 char *kerb_mech = NULL;
 902
 903                 status = parse_spnego_mechanisms(talloc_tos(),
 904                                 auth, &secblob, &kerb_mech);
 905
 906                 if (!NT_STATUS_IS_OK(status)) {
 907                         /* Kill the intermediate vuid */
 908                         invalidate_vuid(sconn, vuid);
 909                         reply_nterror(req, nt_status_squash(status));
 910                         return;
 911                 }
 912
 913                 DEBUG(3,("reply_spnego_auth: Got secblob of size %lu\n",
 914                                 (unsigned long)secblob.length));
 915 #ifdef HAVE_KRB5
 916                 if (kerb_mech && ((lp_security()==SEC_ADS) ||
 917                                         USE_KERBEROS_KEYTAB)) {
 918                         bool destroy_vuid = True;
 919                         reply_spnego_kerberos(req, &secblob, kerb_mech,
 920                                               vuid, &destroy_vuid);
 921                         data_blob_free(&secblob);
 922                         data_blob_free(&auth);
 923                         if (destroy_vuid) {
 924                                 /* Kill the intermediate vuid */
 925                                 invalidate_vuid(sconn, vuid);
 926                         }
 927                         TALLOC_FREE(kerb_mech);
 928                         return;
 929                 }
 930 #endif
 931                 /* Can't blunder into NTLMSSP auth if we have
 932                  * a krb5 ticket. */
 933
 934                 if (kerb_mech) {
 935                         /* Kill the intermediate vuid */
 936                         invalidate_vuid(sconn, vuid);
 937                         DEBUG(3,("reply_spnego_auth: network "
 938                                 "misconfiguration, client sent us a "
 939                                 "krb5 ticket and kerberos security "
 940                                 "not enabled\n"));
 941                         reply_nterror(req, nt_status_squash(
 942                                         NT_STATUS_LOGON_FAILURE));
 943                         TALLOC_FREE(kerb_mech);
 944                 }
 945         }
 946
 947         /* If we get here it wasn't a negTokenTarg auth packet. */
 948         data_blob_free(&secblob);
 949
 950         if (!*auth_ntlmssp_state) {
 951                 status = auth_ntlmssp_start(auth_ntlmssp_state);
 952                 if (!NT_STATUS_IS_OK(status)) {
 953                         /* Kill the intermediate vuid */
 954                         invalidate_vuid(sconn, vuid);
 955                         reply_nterror(req, nt_status_squash(status));
 956                         return;
 957                 }
 958         }
 959
 960         status = auth_ntlmssp_update(*auth_ntlmssp_state,
 961                                         auth, &auth_reply);
 962
 963         data_blob_free(&auth);
 964
 965         /* Don't send the mechid as we've already sent this (RFC4178). */
 966
 967         reply_spnego_ntlmssp(req, vuid,
 968                              auth_ntlmssp_state,
 969                              &auth_reply, status, NULL, true);
 970
 971         data_blob_free(&auth_reply);
 972
 973         /* and tell smbd that we have already replied to this packet */
 974         return;
 975 }
 976
 977 /****************************************************************************
 978  Delete an entry on the list.
 979 ****************************************************************************/
 980
 981 static void delete_partial_auth(struct smbd_server_connection *sconn,
 982                                 struct pending_auth_data *pad)
 983 {
 984         if (!pad) {
 985                 return;
 986         }
 987         DLIST_REMOVE(sconn->smb1.pd_list, pad);
 988         data_blob_free(&pad->partial_data);
 989         SAFE_FREE(pad);
 990 }
 991
 992 /****************************************************************************
 993  Search for a partial SPNEGO auth fragment matching an smbpid.
 994 ****************************************************************************/
 995
 996 static struct pending_auth_data *get_pending_auth_data(
 997                 struct smbd_server_connection *sconn,
 998                 uint16_t smbpid)
 999 {
1000         struct pending_auth_data *pad;
1001 /*
1002  * NOTE: using the smbpid here is completely wrong...
1003  *       see [MS-SMB]
1004  *       3.3.5.3 Receiving an SMB_COM_SESSION_SETUP_ANDX Request
1005  */
1006         for (pad = sconn->smb1.pd_list; pad; pad = pad->next) {
1007                 if (pad->smbpid == smbpid) {
1008                         break;
1009                 }
1010         }
1011         return pad;
1012 }
1013
1014 /****************************************************************************
1015  Check the size of an SPNEGO blob. If we need more return
1016  NT_STATUS_MORE_PROCESSING_REQUIRED, else return NT_STATUS_OK. Don't allow
1017  the blob to be more than 64k.
1018 ****************************************************************************/
1019
1020 static NTSTATUS check_spnego_blob_complete(struct smbd_server_connection *sconn,
1021                                            uint16 smbpid, uint16 vuid,
1022                                            DATA_BLOB *pblob)
1023 {
1024         struct pending_auth_data *pad = NULL;
1025         ASN1_DATA *data;
1026         size_t needed_len = 0;
1027
1028         pad = get_pending_auth_data(sconn, smbpid);
1029
1030         /* Ensure we have some data. */
1031         if (pblob->length == 0) {
1032                 /* Caller can cope. */
1033                 DEBUG(2,("check_spnego_blob_complete: zero blob length !\n"));
1034                 delete_partial_auth(sconn, pad);
1035                 return NT_STATUS_OK;
1036         }
1037
1038         /* Were we waiting for more data ? */
1039         if (pad) {
1040                 DATA_BLOB tmp_blob;
1041                 size_t copy_len = MIN(65536, pblob->length);
1042
1043                 /* Integer wrap paranoia.... */
1044
1045                 if (pad->partial_data.length + copy_len <
1046                                 pad->partial_data.length ||
1047                     pad->partial_data.length + copy_len < copy_len) {
1048
1049                         DEBUG(2,("check_spnego_blob_complete: integer wrap "
1050                                 "pad->partial_data.length = %u, "
1051                                 "copy_len = %u\n",
1052                                 (unsigned int)pad->partial_data.length,
1053                                 (unsigned int)copy_len ));
1054
1055                         delete_partial_auth(sconn, pad);
1056                         return NT_STATUS_INVALID_PARAMETER;
1057                 }
1058
1059                 DEBUG(10,("check_spnego_blob_complete: "
1060                         "pad->partial_data.length = %u, "
1061                         "pad->needed_len = %u, "
1062                         "copy_len = %u, "
1063                         "pblob->length = %u,\n",
1064                         (unsigned int)pad->partial_data.length,
1065                         (unsigned int)pad->needed_len,
1066                         (unsigned int)copy_len,
1067                         (unsigned int)pblob->length ));
1068
1069                 tmp_blob = data_blob(NULL,
1070                                 pad->partial_data.length + copy_len);
1071
1072                 /* Concatenate the two (up to copy_len) bytes. */
1073                 memcpy(tmp_blob.data,
1074                         pad->partial_data.data,
1075                         pad->partial_data.length);
1076                 memcpy(tmp_blob.data + pad->partial_data.length,
1077                         pblob->data,
1078                         copy_len);
1079
1080                 /* Replace the partial data. */
1081                 data_blob_free(&pad->partial_data);
1082                 pad->partial_data = tmp_blob;
1083                 ZERO_STRUCT(tmp_blob);
1084
1085                 /* Are we done ? */
1086                 if (pblob->length >= pad->needed_len) {
1087                         /* Yes, replace pblob. */
1088                         data_blob_free(pblob);
1089                         *pblob = pad->partial_data;
1090                         ZERO_STRUCT(pad->partial_data);
1091                         delete_partial_auth(sconn, pad);
1092                         return NT_STATUS_OK;
1093                 }
1094
1095                 /* Still need more data. */
1096                 pad->needed_len -= copy_len;
1097                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
1098         }
1099
1100         if ((pblob->data[0] != ASN1_APPLICATION(0)) &&
1101             (pblob->data[0] != ASN1_CONTEXT(1))) {
1102                 /* Not something we can determine the
1103                  * length of.
1104                  */
1105                 return NT_STATUS_OK;
1106         }
1107
1108         /* This is a new SPNEGO sessionsetup - see if
1109          * the data given in this blob is enough.
1110          */
1111
1112         data = asn1_init(NULL);
1113         if (data == NULL) {
1114                 return NT_STATUS_NO_MEMORY;
1115         }
1116
1117         asn1_load(data, *pblob);
1118         asn1_start_tag(data, pblob->data[0]);
1119         if (data->has_error || data->nesting == NULL) {
1120                 asn1_free(data);
1121                 /* Let caller catch. */
1122                 return NT_STATUS_OK;
1123         }
1124
1125         /* Integer wrap paranoia.... */
1126
1127         if (data->nesting->taglen + data->nesting->start < data->nesting->taglen ||
1128             data->nesting->taglen + data->nesting->start < data->nesting->start) {
1129
1130                 DEBUG(2,("check_spnego_blob_complete: integer wrap "
1131                         "data.nesting->taglen = %u, "
1132                         "data.nesting->start = %u\n",
1133                         (unsigned int)data->nesting->taglen,
1134                         (unsigned int)data->nesting->start ));
1135
1136                 asn1_free(data);
1137                 return NT_STATUS_INVALID_PARAMETER;
1138         }
1139
1140         /* Total length of the needed asn1 is the tag length
1141          * plus the current offset. */
1142
1143         needed_len = data->nesting->taglen + data->nesting->start;
1144         asn1_free(data);
1145
1146         DEBUG(10,("check_spnego_blob_complete: needed_len = %u, "
1147                 "pblob->length = %u\n",
1148                 (unsigned int)needed_len,
1149                 (unsigned int)pblob->length ));
1150
1151         if (needed_len <= pblob->length) {
1152                 /* Nothing to do - blob is complete. */
1153                 return NT_STATUS_OK;
1154         }
1155
1156         /* Refuse the blob if it's bigger than 64k. */
1157         if (needed_len > 65536) {
1158                 DEBUG(2,("check_spnego_blob_complete: needed_len "
1159                         "too large (%u)\n",
1160                         (unsigned int)needed_len ));
1161                 return NT_STATUS_INVALID_PARAMETER;
1162         }
1163
1164         /* We must store this blob until complete. */
1165         if (!(pad = SMB_MALLOC_P(struct pending_auth_data))) {
1166                 return NT_STATUS_NO_MEMORY;
1167         }
1168         pad->needed_len = needed_len - pblob->length;
1169         pad->partial_data = data_blob(pblob->data, pblob->length);
1170         if (pad->partial_data.data == NULL) {
1171                 SAFE_FREE(pad);
1172                 return NT_STATUS_NO_MEMORY;
1173         }
1174         pad->smbpid = smbpid;
1175         pad->vuid = vuid;
1176         DLIST_ADD(sconn->smb1.pd_list, pad);
1177
1178         return NT_STATUS_MORE_PROCESSING_REQUIRED;
1179 }
1180
1181 /****************************************************************************
1182  Reply to a session setup command.
1183  conn POINTER CAN BE NULL HERE !
1184 ****************************************************************************/
1185
1186 static void reply_sesssetup_and_X_spnego(struct smb_request *req)
1187 {
1188         const uint8 *p;
1189         DATA_BLOB blob1;
1190         size_t bufrem;
1191         char *tmp;
1192         const char *native_os;
1193         const char *native_lanman;
1194         const char *primary_domain;
1195         const char *p2;
1196         uint16 data_blob_len = SVAL(req->vwv+7, 0);
1197         enum remote_arch_types ra_type = get_remote_arch();
1198         int vuid = req->vuid;
1199         user_struct *vuser = NULL;
1200         NTSTATUS status = NT_STATUS_OK;
1201         uint16 smbpid = req->smbpid;
1202         struct smbd_server_connection *sconn = req->sconn;
1203
1204         DEBUG(3,("Doing spnego session setup\n"));
1205
1206         if (global_client_caps == 0) {
1207                 global_client_caps = IVAL(req->vwv+10, 0);
1208
1209                 if (!(global_client_caps & CAP_STATUS32)) {
1210                         remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1211                 }
1212
1213         }
1214
1215         p = req->buf;
1216
1217         if (data_blob_len == 0) {
1218                 /* an invalid request */
1219                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1220                 return;
1221         }
1222
1223         bufrem = smbreq_bufrem(req, p);
1224         /* pull the spnego blob */
1225         blob1 = data_blob(p, MIN(bufrem, data_blob_len));
1226
1227 #if 0
1228         file_save("negotiate.dat", blob1.data, blob1.length);
1229 #endif
1230
1231         p2 = (char *)req->buf + blob1.length;
1232
1233         p2 += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p2,
1234                                      STR_TERMINATE);
1235         native_os = tmp ? tmp : "";
1236
1237         p2 += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p2,
1238                                      STR_TERMINATE);
1239         native_lanman = tmp ? tmp : "";
1240
1241         p2 += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p2,
1242                                      STR_TERMINATE);
1243         primary_domain = tmp ? tmp : "";
1244
1245         DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
1246                 native_os, native_lanman, primary_domain));
1247
1248         if ( ra_type == RA_WIN2K ) {
1249                 /* Vista sets neither the OS or lanman strings */
1250
1251                 if ( !strlen(native_os) && !strlen(native_lanman) )
1252                         set_remote_arch(RA_VISTA);
1253
1254                 /* Windows 2003 doesn't set the native lanman string,
1255                    but does set primary domain which is a bug I think */
1256
1257                 if ( !strlen(native_lanman) ) {
1258                         ra_lanman_string( primary_domain );
1259                 } else {
1260                         ra_lanman_string( native_lanman );
1261                 }
1262         }
1263
1264         /* Did we get a valid vuid ? */
1265         if (!is_partial_auth_vuid(sconn, vuid)) {
1266                 /* No, then try and see if this is an intermediate sessionsetup
1267                  * for a large SPNEGO packet. */
1268                 struct pending_auth_data *pad;
1269                 pad = get_pending_auth_data(sconn, smbpid);
1270                 if (pad) {
1271                         DEBUG(10,("reply_sesssetup_and_X_spnego: found "
1272                                 "pending vuid %u\n",
1273                                 (unsigned int)pad->vuid ));
1274                         vuid = pad->vuid;
1275                 }
1276         }
1277
1278         /* Do we have a valid vuid now ? */
1279         if (!is_partial_auth_vuid(sconn, vuid)) {
1280                 /* No, start a new authentication setup. */
1281                 vuid = register_initial_vuid(sconn);
1282                 if (vuid == UID_FIELD_INVALID) {
1283                         data_blob_free(&blob1);
1284                         reply_nterror(req, nt_status_squash(
1285                                               NT_STATUS_INVALID_PARAMETER));
1286                         return;
1287                 }
1288         }
1289
1290         vuser = get_partial_auth_user_struct(sconn, vuid);
1291         /* This MUST be valid. */
1292         if (!vuser) {
1293                 smb_panic("reply_sesssetup_and_X_spnego: invalid vuid.");
1294         }
1295
1296         /* Large (greater than 4k) SPNEGO blobs are split into multiple
1297          * sessionsetup requests as the Windows limit on the security blob
1298          * field is 4k. Bug #4400. JRA.
1299          */
1300
1301         status = check_spnego_blob_complete(sconn, smbpid, vuid, &blob1);
1302         if (!NT_STATUS_IS_OK(status)) {
1303                 if (!NT_STATUS_EQUAL(status,
1304                                 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1305                         /* Real error - kill the intermediate vuid */
1306                         invalidate_vuid(sconn, vuid);
1307                 }
1308                 data_blob_free(&blob1);
1309                 reply_nterror(req, nt_status_squash(status));
1310                 return;
1311         }
1312
1313         if (blob1.data[0] == ASN1_APPLICATION(0)) {
1314
1315                 /* its a negTokenTarg packet */
1316
1317                 reply_spnego_negotiate(req, vuid, blob1,
1318                                        &vuser->auth_ntlmssp_state);
1319                 data_blob_free(&blob1);
1320                 return;
1321         }
1322
1323         if (blob1.data[0] == ASN1_CONTEXT(1)) {
1324
1325                 /* its a auth packet */
1326
1327                 reply_spnego_auth(req, vuid, blob1,
1328                                   &vuser->auth_ntlmssp_state);
1329                 data_blob_free(&blob1);
1330                 return;
1331         }
1332
1333         if (strncmp((char *)(blob1.data), "NTLMSSP", 7) == 0) {
1334                 DATA_BLOB chal;
1335
1336                 if (!vuser->auth_ntlmssp_state) {
1337                         status = auth_ntlmssp_start(&vuser->auth_ntlmssp_state);
1338                         if (!NT_STATUS_IS_OK(status)) {
1339                                 /* Kill the intermediate vuid */
1340                                 invalidate_vuid(sconn, vuid);
1341                                 data_blob_free(&blob1);
1342                                 reply_nterror(req, nt_status_squash(status));
1343                                 return;
1344                         }
1345                 }
1346
1347                 status = auth_ntlmssp_update(vuser->auth_ntlmssp_state,
1348                                                 blob1, &chal);
1349
1350                 data_blob_free(&blob1);
1351
1352                 reply_spnego_ntlmssp(req, vuid,
1353                                      &vuser->auth_ntlmssp_state,
1354                                      &chal, status, OID_NTLMSSP, false);
1355                 data_blob_free(&chal);
1356                 return;
1357         }
1358
1359         /* what sort of packet is this? */
1360         DEBUG(1,("Unknown packet in reply_sesssetup_and_X_spnego\n"));
1361
1362         data_blob_free(&blob1);
1363
1364         reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1365 }
1366
1367 /****************************************************************************
1368  On new VC == 0, shutdown *all* old connections and users.
1369  It seems that only NT4.x does this. At W2K and above (XP etc.).
1370  a new session setup with VC==0 is ignored.
1371 ****************************************************************************/
1372
1373 struct shutdown_state {
1374         const char *ip;
1375         struct messaging_context *msg_ctx;
1376 };
1377
1378 static int shutdown_other_smbds(const struct connections_key *key,
1379                                 const struct connections_data *crec,
1380                                 void *private_data)
1381 {
1382         struct shutdown_state *state = (struct shutdown_state *)private_data;
1383
1384         DEBUG(10, ("shutdown_other_smbds: %s, %s\n",
1385                    procid_str(talloc_tos(), &crec->pid), crec->addr));
1386
1387         if (!process_exists(crec->pid)) {
1388                 DEBUG(10, ("process does not exist\n"));
1389                 return 0;
1390         }
1391
1392         if (procid_is_me(&crec->pid)) {
1393                 DEBUG(10, ("It's me\n"));
1394                 return 0;
1395         }
1396
1397         if (strcmp(state->ip, crec->addr) != 0) {
1398                 DEBUG(10, ("%s does not match %s\n", state->ip, crec->addr));
1399                 return 0;
1400         }
1401
1402         DEBUG(1, ("shutdown_other_smbds: shutting down pid %u "
1403                   "(IP %s)\n", (unsigned int)procid_to_pid(&crec->pid),
1404                   state->ip));
1405
1406         messaging_send(state->msg_ctx, crec->pid, MSG_SHUTDOWN,
1407                        &data_blob_null);
1408         return 0;
1409 }
1410
1411 static void setup_new_vc_session(struct smbd_server_connection *sconn)
1412 {
1413         DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x "
1414                 "compatible we would close all old resources.\n"));
1415 #if 0
1416         conn_close_all();
1417         invalidate_all_vuids();
1418 #endif
1419         if (lp_reset_on_zero_vc()) {
1420                 char *addr;
1421                 struct shutdown_state state;
1422
1423                 addr = tsocket_address_inet_addr_string(
1424                         sconn->remote_address, talloc_tos());
1425                 if (addr == NULL) {
1426                         return;
1427                 }
1428                 state.ip = addr;
1429                 state.msg_ctx = sconn->msg_ctx;
1430                 connections_forall_read(shutdown_other_smbds, &state);
1431                 TALLOC_FREE(addr);
1432         }
1433 }
1434
1435 /****************************************************************************
1436  Reply to a session setup command.
1437 ****************************************************************************/
1438
1439 void reply_sesssetup_and_X(struct smb_request *req)
1440 {
1441         int sess_vuid;
1442         int smb_bufsize;
1443         DATA_BLOB lm_resp;
1444         DATA_BLOB nt_resp;
1445         DATA_BLOB plaintext_password;
1446         char *tmp;
1447         const char *user;
1448         fstring sub_user; /* Sanitised username for substituion */
1449         const char *domain;
1450         const char *native_os;
1451         const char *native_lanman;
1452         const char *primary_domain;
1453         struct auth_usersupplied_info *user_info = NULL;
1454         struct auth_serversupplied_info *server_info = NULL;
1455         uint16 smb_flag2 = req->flags2;
1456
1457         NTSTATUS nt_status;
1458         struct smbd_server_connection *sconn = req->sconn;
1459
1460         bool doencrypt = sconn->smb1.negprot.encrypted_passwords;
1461
1462         START_PROFILE(SMBsesssetupX);
1463
1464         ZERO_STRUCT(lm_resp);
1465         ZERO_STRUCT(nt_resp);
1466         ZERO_STRUCT(plaintext_password);
1467
1468         DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
1469
1470         /* a SPNEGO session setup has 12 command words, whereas a normal
1471            NT1 session setup has 13. See the cifs spec. */
1472         if (req->wct == 12 &&
1473             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
1474
1475                 if (!sconn->smb1.negprot.spnego) {
1476                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
1477                                  "at SPNEGO session setup when it was not "
1478                                  "negotiated.\n"));
1479                         reply_nterror(req, nt_status_squash(
1480                                               NT_STATUS_LOGON_FAILURE));
1481                         END_PROFILE(SMBsesssetupX);
1482                         return;
1483                 }
1484
1485                 if (SVAL(req->vwv+4, 0) == 0) {
1486                         setup_new_vc_session(req->sconn);
1487                 }
1488
1489                 reply_sesssetup_and_X_spnego(req);
1490                 END_PROFILE(SMBsesssetupX);
1491                 return;
1492         }
1493
1494         smb_bufsize = SVAL(req->vwv+2, 0);
1495
1496         if (get_Protocol() < PROTOCOL_NT1) {
1497                 uint16 passlen1 = SVAL(req->vwv+7, 0);
1498
1499                 /* Never do NT status codes with protocols before NT1 as we
1500                  * don't get client caps. */
1501                 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1502
1503                 if ((passlen1 > MAX_PASS_LEN) || (passlen1 > req->buflen)) {
1504                         reply_nterror(req, nt_status_squash(
1505                                               NT_STATUS_INVALID_PARAMETER));
1506                         END_PROFILE(SMBsesssetupX);
1507                         return;
1508                 }
1509
1510                 if (doencrypt) {
1511                         lm_resp = data_blob(req->buf, passlen1);
1512                 } else {
1513                         plaintext_password = data_blob(req->buf, passlen1+1);
1514                         /* Ensure null termination */
1515                         plaintext_password.data[passlen1] = 0;
1516                 }
1517
1518                 srvstr_pull_req_talloc(talloc_tos(), req, &tmp,
1519                                        req->buf + passlen1, STR_TERMINATE);
1520                 user = tmp ? tmp : "";
1521
1522                 domain = "";
1523
1524         } else {
1525                 uint16 passlen1 = SVAL(req->vwv+7, 0);
1526                 uint16 passlen2 = SVAL(req->vwv+8, 0);
1527                 enum remote_arch_types ra_type = get_remote_arch();
1528                 const uint8_t *p = req->buf;
1529                 const uint8_t *save_p = req->buf;
1530                 uint16 byte_count;
1531
1532
1533                 if(global_client_caps == 0) {
1534                         global_client_caps = IVAL(req->vwv+11, 0);
1535
1536                         if (!(global_client_caps & CAP_STATUS32)) {
1537                                 remove_from_common_flags2(
1538                                                 FLAGS2_32_BIT_ERROR_CODES);
1539                         }
1540
1541                         /* client_caps is used as final determination if
1542                          * client is NT or Win95. This is needed to return
1543                          * the correct error codes in some circumstances.
1544                         */
1545
1546                         if(ra_type == RA_WINNT || ra_type == RA_WIN2K ||
1547                                         ra_type == RA_WIN95) {
1548                                 if(!(global_client_caps & (CAP_NT_SMBS|
1549                                                         CAP_STATUS32))) {
1550                                         set_remote_arch( RA_WIN95);
1551                                 }
1552                         }
1553                 }
1554
1555                 if (!doencrypt) {
1556                         /* both Win95 and WinNT stuff up the password
1557                          * lengths for non-encrypting systems. Uggh.
1558
1559                            if passlen1==24 its a win95 system, and its setting
1560                            the password length incorrectly. Luckily it still
1561                            works with the default code because Win95 will null
1562                            terminate the password anyway
1563
1564                            if passlen1>0 and passlen2>0 then maybe its a NT box
1565                            and its setting passlen2 to some random value which
1566                            really stuffs things up. we need to fix that one.  */
1567
1568                         if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 &&
1569                                         passlen2 != 1) {
1570                                 passlen2 = 0;
1571                         }
1572                 }
1573
1574                 /* check for nasty tricks */
1575                 if (passlen1 > MAX_PASS_LEN
1576                     || passlen1 > smbreq_bufrem(req, p)) {
1577                         reply_nterror(req, nt_status_squash(
1578                                               NT_STATUS_INVALID_PARAMETER));
1579                         END_PROFILE(SMBsesssetupX);
1580                         return;
1581                 }
1582
1583                 if (passlen2 > MAX_PASS_LEN
1584                     || passlen2 > smbreq_bufrem(req, p+passlen1)) {
1585                         reply_nterror(req, nt_status_squash(
1586                                               NT_STATUS_INVALID_PARAMETER));
1587                         END_PROFILE(SMBsesssetupX);
1588                         return;
1589                 }
1590
1591                 /* Save the lanman2 password and the NT md4 password. */
1592
1593                 if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
1594                         doencrypt = False;
1595                 }
1596
1597                 if (doencrypt) {
1598                         lm_resp = data_blob(p, passlen1);
1599                         nt_resp = data_blob(p+passlen1, passlen2);
1600                 } else if (lp_security() != SEC_SHARE) {
1601                         /*
1602                          * In share level we should ignore any passwords, so
1603                          * only read them if we're not.
1604                          */
1605                         char *pass = NULL;
1606                         bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
1607
1608                         if (unic && (passlen2 == 0) && passlen1) {
1609                                 /* Only a ascii plaintext password was sent. */
1610                                 (void)srvstr_pull_talloc(talloc_tos(),
1611                                                         req->inbuf,
1612                                                         req->flags2,
1613                                                         &pass,
1614                                                         req->buf,
1615                                                         passlen1,
1616                                                         STR_TERMINATE|STR_ASCII);
1617                         } else {
1618                                 (void)srvstr_pull_talloc(talloc_tos(),
1619                                                         req->inbuf,
1620                                                         req->flags2,
1621                                                         &pass,
1622                                                         req->buf,
1623                                                         unic ? passlen2 : passlen1,
1624                                                         STR_TERMINATE);
1625                         }
1626                         if (!pass) {
1627                                 reply_nterror(req, nt_status_squash(
1628                                               NT_STATUS_INVALID_PARAMETER));
1629                                 END_PROFILE(SMBsesssetupX);
1630                                 return;
1631                         }
1632                         plaintext_password = data_blob(pass, strlen(pass)+1);
1633                 }
1634
1635                 p += passlen1 + passlen2;
1636
1637                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1638                                             STR_TERMINATE);
1639                 user = tmp ? tmp : "";
1640
1641                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1642                                             STR_TERMINATE);
1643                 domain = tmp ? tmp : "";
1644
1645                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1646                                             STR_TERMINATE);
1647                 native_os = tmp ? tmp : "";
1648
1649                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1650                                             STR_TERMINATE);
1651                 native_lanman = tmp ? tmp : "";
1652
1653                 /* not documented or decoded by Ethereal but there is one more
1654                  * string in the extra bytes which is the same as the
1655                  * PrimaryDomain when using extended security.  Windows NT 4
1656                  * and 2003 use this string to store the native lanman string.
1657                  * Windows 9x does not include a string here at all so we have
1658                  * to check if we have any extra bytes left */
1659
1660                 byte_count = SVAL(req->vwv+13, 0);
1661                 if ( PTR_DIFF(p, save_p) < byte_count) {
1662                         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1663                                                     STR_TERMINATE);
1664                         primary_domain = tmp ? tmp : "";
1665                 } else {
1666                         primary_domain = talloc_strdup(talloc_tos(), "null");
1667                 }
1668
1669                 DEBUG(3,("Domain=[%s]  NativeOS=[%s] NativeLanMan=[%s] "
1670                         "PrimaryDomain=[%s]\n",
1671                         domain, native_os, native_lanman, primary_domain));
1672
1673                 if ( ra_type == RA_WIN2K ) {
1674                         if ( strlen(native_lanman) == 0 )
1675                                 ra_lanman_string( primary_domain );
1676                         else
1677                                 ra_lanman_string( native_lanman );
1678                 }
1679
1680         }
1681
1682         if (SVAL(req->vwv+4, 0) == 0) {
1683                 setup_new_vc_session(req->sconn);
1684         }
1685
1686         DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
1687                                 domain, user, get_remote_machine_name()));
1688
1689         if (*user) {
1690                 if (sconn->smb1.negprot.spnego) {
1691
1692                         /* This has to be here, because this is a perfectly
1693                          * valid behaviour for guest logons :-( */
1694
1695                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
1696                                 "at 'normal' session setup after "
1697                                 "negotiating spnego.\n"));
1698                         reply_nterror(req, nt_status_squash(
1699                                               NT_STATUS_LOGON_FAILURE));
1700                         END_PROFILE(SMBsesssetupX);
1701                         return;
1702                 }
1703                 fstrcpy(sub_user, user);
1704         } else {
1705                 fstrcpy(sub_user, lp_guestaccount());
1706         }
1707
1708         sub_set_smb_name(sub_user);
1709
1710         reload_services(sconn->msg_ctx, sconn->sock, True);
1711
1712         if (lp_security() == SEC_SHARE) {
1713                 /* In share level we should ignore any passwords */
1714
1715                 data_blob_free(&lm_resp);
1716                 data_blob_free(&nt_resp);
1717                 data_blob_clear_free(&plaintext_password);
1718
1719                 map_username(sub_user);
1720                 add_session_user(sconn, sub_user);
1721                 add_session_workgroup(sconn, domain);
1722                 /* Then force it to null for the benfit of the code below */
1723                 user = "";
1724         }
1725
1726         if (!*user) {
1727
1728                 nt_status = check_guest_password(&server_info);
1729
1730         } else if (doencrypt) {
1731                 struct auth_context *negprot_auth_context = NULL;
1732                 negprot_auth_context = sconn->smb1.negprot.auth_context;
1733                 if (!negprot_auth_context) {
1734                         DEBUG(0, ("reply_sesssetup_and_X:  Attempted encrypted "
1735                                 "session setup without negprot denied!\n"));
1736                         reply_nterror(req, nt_status_squash(
1737                                               NT_STATUS_LOGON_FAILURE));
1738                         END_PROFILE(SMBsesssetupX);
1739                         return;
1740                 }
1741                 nt_status = make_user_info_for_reply_enc(&user_info, user,
1742                                                 domain,
1743                                                 lm_resp, nt_resp);
1744                 if (NT_STATUS_IS_OK(nt_status)) {
1745                         nt_status = negprot_auth_context->check_ntlm_password(
1746                                         negprot_auth_context,
1747                                         user_info,
1748                                         &server_info);
1749                 }
1750         } else {
1751                 struct auth_context *plaintext_auth_context = NULL;
1752
1753                 nt_status = make_auth_context_subsystem(
1754                                 &plaintext_auth_context);
1755
1756                 if (NT_STATUS_IS_OK(nt_status)) {
1757                         uint8_t chal[8];
1758
1759                         plaintext_auth_context->get_ntlm_challenge(
1760                                         plaintext_auth_context, chal);
1761
1762                         if (!make_user_info_for_reply(&user_info,
1763                                                       user, domain, chal,
1764                                                       plaintext_password)) {
1765                                 nt_status = NT_STATUS_NO_MEMORY;
1766                         }
1767
1768                         if (NT_STATUS_IS_OK(nt_status)) {
1769                                 nt_status = plaintext_auth_context->check_ntlm_password(
1770                                                 plaintext_auth_context,
1771                                                 user_info,
1772                                                 &server_info);
1773
1774                                 TALLOC_FREE(plaintext_auth_context);
1775                         }
1776                 }
1777         }
1778
1779         free_user_info(&user_info);
1780
1781         if (!NT_STATUS_IS_OK(nt_status)) {
1782                 nt_status = do_map_to_guest(nt_status, &server_info,
1783                                 user, domain);
1784         }
1785
1786         if (!NT_STATUS_IS_OK(nt_status)) {
1787                 data_blob_free(&nt_resp);
1788                 data_blob_free(&lm_resp);
1789                 data_blob_clear_free(&plaintext_password);
1790                 reply_nterror(req, nt_status_squash(nt_status));
1791                 END_PROFILE(SMBsesssetupX);
1792                 return;
1793         }
1794
1795         /* Ensure we can't possible take a code path leading to a
1796          * null defref. */
1797         if (!server_info) {
1798                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1799                 END_PROFILE(SMBsesssetupX);
1800                 return;
1801         }
1802
1803         if (!server_info->ptok) {
1804                 nt_status = create_local_token(server_info);
1805
1806                 if (!NT_STATUS_IS_OK(nt_status)) {
1807                         DEBUG(10, ("create_local_token failed: %s\n",
1808                                    nt_errstr(nt_status)));
1809                         data_blob_free(&nt_resp);
1810                         data_blob_free(&lm_resp);
1811                         data_blob_clear_free(&plaintext_password);
1812                         reply_nterror(req, nt_status_squash(nt_status));
1813                         END_PROFILE(SMBsesssetupX);
1814                         return;
1815                 }
1816         }
1817
1818         data_blob_clear_free(&plaintext_password);
1819
1820         /* it's ok - setup a reply */
1821         reply_outbuf(req, 3, 0);
1822         if (get_Protocol() >= PROTOCOL_NT1) {
1823                 push_signature(&req->outbuf);
1824                 /* perhaps grab OS version here?? */
1825         }
1826
1827         if (server_info->guest) {
1828                 SSVAL(req->outbuf,smb_vwv2,1);
1829         }
1830
1831         /* register the name and uid as being validated, so further connections
1832            to a uid can get through without a password, on the same VC */
1833
1834         if (lp_security() == SEC_SHARE) {
1835                 sess_vuid = UID_FIELD_INVALID;
1836                 TALLOC_FREE(server_info);
1837         } else {
1838                 /* Ignore the initial vuid. */
1839                 sess_vuid = register_initial_vuid(sconn);
1840                 if (sess_vuid == UID_FIELD_INVALID) {
1841                         data_blob_free(&nt_resp);
1842                         data_blob_free(&lm_resp);
1843                         reply_nterror(req, nt_status_squash(
1844                                               NT_STATUS_LOGON_FAILURE));
1845                         END_PROFILE(SMBsesssetupX);
1846                         return;
1847                 }
1848                 /* register_existing_vuid keeps the server info */
1849                 sess_vuid = register_existing_vuid(sconn, sess_vuid,
1850                                         server_info,
1851                                         nt_resp.data ? nt_resp : lm_resp,
1852                                         sub_user);
1853                 if (sess_vuid == UID_FIELD_INVALID) {
1854                         data_blob_free(&nt_resp);
1855                         data_blob_free(&lm_resp);
1856                         reply_nterror(req, nt_status_squash(
1857                                               NT_STATUS_LOGON_FAILURE));
1858                         END_PROFILE(SMBsesssetupX);
1859                         return;
1860                 }
1861
1862                 /* current_user_info is changed on new vuid */
1863                 reload_services(sconn->msg_ctx, sconn->sock, True);
1864         }
1865
1866         data_blob_free(&nt_resp);
1867         data_blob_free(&lm_resp);
1868
1869         SSVAL(req->outbuf,smb_uid,sess_vuid);
1870         SSVAL(req->inbuf,smb_uid,sess_vuid);
1871         req->vuid = sess_vuid;
1872
1873         if (!sconn->smb1.sessions.done_sesssetup) {
1874                 sconn->smb1.sessions.max_send =
1875                         MIN(sconn->smb1.sessions.max_send,smb_bufsize);
1876         }
1877         sconn->smb1.sessions.done_sesssetup = true;
1878
1879         END_PROFILE(SMBsesssetupX);
1880         chain_reply(req);
1881         return;
1882 }