*/
#include "includes.h"
+#include "auth/auth.h"
+#include "smb_server/smb_server.h"
+
/*
setup the OS, Lanman and domain portions of a session setup reply
struct auth_serversupplied_info *server_info = NULL;
struct auth_session_info *session_info;
+ TALLOC_CTX *mem_ctx = talloc_named(req, 0, "NT1 session setup");
+ char *remote_machine;
+ if (!mem_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
if (!req->smb_conn->negotiate.done_sesssetup) {
req->smb_conn->negotiate.max_send = sess->old.in.bufsize;
}
-
- status = make_user_info_for_reply_enc(&user_info,
+
+ remote_machine = socket_get_peer_addr(req->smb_conn->connection->socket, mem_ctx);
+ status = make_user_info_for_reply_enc(req->smb_conn,
+ &user_info,
sess->old.in.user, sess->old.in.domain,
+ remote_machine,
sess->old.in.password,
data_blob(NULL, 0));
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return NT_STATUS_ACCESS_DENIED;
}
status = req->smb_conn->negotiate.auth_context->check_ntlm_password(req->smb_conn->negotiate.auth_context,
- user_info,
- &server_info);
+ user_info,
+ mem_ctx,
+ &server_info);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return nt_status_squash(status);
}
- status = make_session_info(server_info, &session_info);
+ /* This references server_info into session_info */
+ status = make_session_info(req, server_info, &session_info);
+ talloc_free(mem_ctx);
if (!NT_STATUS_IS_OK(status)) {
return nt_status_squash(status);
}
struct auth_usersupplied_info *user_info = NULL;
struct auth_serversupplied_info *server_info = NULL;
struct auth_session_info *session_info;
+ TALLOC_CTX *mem_ctx = talloc_named(req, 0, "NT1 session setup");
+
+ if (!mem_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
if (!req->smb_conn->negotiate.done_sesssetup) {
req->smb_conn->negotiate.max_send = sess->nt1.in.bufsize;
if (sess->nt1.in.user && *sess->nt1.in.user) {
return NT_STATUS_ACCESS_DENIED;
} else {
- make_user_info_guest(&user_info);
+ make_user_info_guest(req->smb_conn, &user_info);
}
- status = make_auth_context_subsystem(&auth_context);
+ status = make_auth_context_subsystem(req->smb_conn, &auth_context);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return status;
}
status = auth_context->check_ntlm_password(auth_context,
user_info,
+ mem_ctx,
&server_info);
-
- free_auth_context(&auth_context);
-
} else {
- status = make_user_info_for_reply_enc(&user_info,
+ char *remote_machine;
+ remote_machine = socket_get_peer_addr(req->smb_conn->connection->socket, mem_ctx);
+ status = make_user_info_for_reply_enc(req->smb_conn,
+ &user_info,
sess->nt1.in.user, sess->nt1.in.domain,
+ remote_machine,
sess->nt1.in.password1,
sess->nt1.in.password2);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return NT_STATUS_ACCESS_DENIED;
}
.auth_context->check_ntlm_password(req->smb_conn->negotiate
.auth_context,
user_info,
+ req,
&server_info);
}
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return nt_status_squash(status);
}
- status = make_session_info(server_info, &session_info);
+ /* This references server_info into session_info */
+ status = make_session_info(mem_ctx, server_info, &session_info);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return nt_status_squash(status);
}
sess->nt1.out.action = 0;
sess->nt1.out.vuid = smbsrv_register_session(req->smb_conn, session_info, NULL);
+ talloc_free(mem_ctx);
if (sess->nt1.out.vuid == UID_FIELD_INVALID) {
return NT_STATUS_ACCESS_DENIED;
}
vuid = SVAL(req->in.hdr,HDR_UID);
smb_sess = smbsrv_session_find(req->smb_conn, vuid);
- if (smb_sess) {
+ if (smb_sess && !smb_sess->session_info) {
if (!smb_sess->gensec_ctx) {
return NT_STATUS_INVALID_HANDLE;
}
- /* what is when the client is already successful authentificated? */
- if (smb_sess->session_info) {
- return NT_STATUS_ACCESS_DENIED;
- }
-
status = gensec_update(smb_sess->gensec_ctx, req, sess->spnego.in.secblob, &sess->spnego.out.secblob);
} else {
- status = gensec_server_start(&gensec_ctx);
+ smb_sess = NULL;
+
+ status = gensec_server_start(req->smb_conn, &gensec_ctx);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status)));
return status;
}
- gensec_want_feature(gensec_ctx, GENSEC_WANT_SESSION_KEY);
+ gensec_set_target_service(gensec_ctx, "cifs");
+
+ gensec_want_feature(gensec_ctx, GENSEC_FEATURE_SESSION_KEY);
- status = gensec_start_mech_by_oid(gensec_ctx, OID_SPNEGO);
+ status = gensec_start_mech_by_oid(gensec_ctx, GENSEC_OID_SPNEGO);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to start GENSEC SPNEGO server code: %s\n", nt_errstr(status)));
return status;
}
if (!smb_sess) {
- vuid = smbsrv_register_session(req->smb_conn, session_info, gensec_ctx);
+ vuid = smbsrv_register_session(req->smb_conn,
+ session_info, gensec_ctx);
if (vuid == UID_FIELD_INVALID) {
return NT_STATUS_ACCESS_DENIED;
}
}
} else {
status = nt_status_squash(status);
+ if (smb_sess->gensec_ctx &&
+ !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ talloc_free(smb_sess->gensec_ctx);
+ smb_sess->gensec_ctx = NULL;
+ }
}
sess->spnego.out.action = 0;