source3/smbd/sesssetup.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    handle SMBsessionsetup
   4    Copyright (C) Andrew Tridgell 1998-2001
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
   7    Copyright (C) Luke Howard          2003
   8    Copyright (C) Volker Lendecke      2007
   9    Copyright (C) Jeremy Allison       2007
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "lib/util/server_id.h"
  28 #include "smbd/smbd.h"
  29 #include "smbd/globals.h"
  30 #include "auth.h"
  31 #include "messages.h"
  32 #include "smbprofile.h"
  33 #include "../libcli/security/security.h"
  34 #include "auth/gensec/gensec.h"
  35 #include "lib/conn_tdb.h"
  36 #include "../libcli/smb/smb_signing.h"
  37
  38 /****************************************************************************
  39  Add the standard 'Samba' signature to the end of the session setup.
  40 ****************************************************************************/
  41
  42 static int push_signature(uint8_t **outbuf)
  43 {
  44         char *lanman;
  45         int result, tmp;
  46         fstring native_os;
  47
  48         result = 0;
  49
  50         fstr_sprintf(native_os, "Windows %d.%d", SAMBA_MAJOR_NBT_ANNOUNCE_VERSION,
  51                 SAMBA_MINOR_NBT_ANNOUNCE_VERSION);
  52
  53         tmp = message_push_string(outbuf, native_os, STR_TERMINATE);
  54
  55         if (tmp == -1) return -1;
  56         result += tmp;
  57
  58         if (asprintf(&lanman, "Samba %s", samba_version_string()) != -1) {
  59                 tmp = message_push_string(outbuf, lanman, STR_TERMINATE);
  60                 SAFE_FREE(lanman);
  61         }
  62         else {
  63                 tmp = message_push_string(outbuf, "Samba", STR_TERMINATE);
  64         }
  65
  66         if (tmp == -1) return -1;
  67         result += tmp;
  68
  69         tmp = message_push_string(outbuf, lp_workgroup(), STR_TERMINATE);
  70
  71         if (tmp == -1) return -1;
  72         result += tmp;
  73
  74         return result;
  75 }
  76
  77 /****************************************************************************
  78  Reply to a session setup command.
  79  conn POINTER CAN BE NULL HERE !
  80 ****************************************************************************/
  81
  82 static void reply_sesssetup_and_X_spnego(struct smb_request *req)
  83 {
  84         const uint8_t *p;
  85         DATA_BLOB in_blob;
  86         DATA_BLOB out_blob = data_blob_null;
  87         size_t bufrem;
  88         char *tmp;
  89         const char *native_os;
  90         const char *native_lanman;
  91         const char *primary_domain;
  92         uint16_t data_blob_len = SVAL(req->vwv+7, 0);
  93         enum remote_arch_types ra_type = get_remote_arch();
  94         uint64_t vuid = req->vuid;
  95         NTSTATUS status = NT_STATUS_OK;
  96         struct smbXsrv_connection *xconn = req->xconn;
  97         struct smbd_server_connection *sconn = req->sconn;
  98         uint16_t action = 0;
  99         bool is_authenticated = false;
 100         NTTIME now = timeval_to_nttime(&req->request_time);
 101         struct smbXsrv_session *session = NULL;
 102         uint16_t smb_bufsize = SVAL(req->vwv+2, 0);
 103         uint32_t client_caps = IVAL(req->vwv+10, 0);
 104         struct smbXsrv_session_auth0 *auth;
 105
 106         DEBUG(3,("Doing spnego session setup\n"));
 107
 108         if (!xconn->smb1.sessions.done_sesssetup) {
 109                 global_client_caps = client_caps;
 110
 111                 if (!(global_client_caps & CAP_STATUS32)) {
 112                         remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
 113                 }
 114         }
 115
 116         p = req->buf;
 117
 118         if (data_blob_len == 0) {
 119                 /* an invalid request */
 120                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
 121                 return;
 122         }
 123
 124         bufrem = smbreq_bufrem(req, p);
 125         /* pull the spnego blob */
 126         in_blob = data_blob_const(p, MIN(bufrem, data_blob_len));
 127
 128 #if 0
 129         file_save("negotiate.dat", in_blob.data, in_blob.length);
 130 #endif
 131
 132         p = req->buf + in_blob.length;
 133
 134         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 135                                      STR_TERMINATE);
 136         native_os = tmp ? tmp : "";
 137
 138         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 139                                      STR_TERMINATE);
 140         native_lanman = tmp ? tmp : "";
 141
 142         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 143                                      STR_TERMINATE);
 144         primary_domain = tmp ? tmp : "";
 145
 146         DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
 147                 native_os, native_lanman, primary_domain));
 148
 149         if ( ra_type == RA_WIN2K ) {
 150                 /* Vista sets neither the OS or lanman strings */
 151
 152                 if ( !strlen(native_os) && !strlen(native_lanman) )
 153                         set_remote_arch(RA_VISTA);
 154
 155                 /* Windows 2003 doesn't set the native lanman string,
 156                    but does set primary domain which is a bug I think */
 157
 158                 if ( !strlen(native_lanman) ) {
 159                         ra_lanman_string( primary_domain );
 160                 } else {
 161                         ra_lanman_string( native_lanman );
 162                 }
 163         } else if ( ra_type == RA_VISTA ) {
 164                 if ( strncmp(native_os, "Mac OS X", 8) == 0 ) {
 165                         set_remote_arch(RA_OSX);
 166                 }
 167         }
 168
 169         if (vuid != 0) {
 170                 status = smb1srv_session_lookup(xconn,
 171                                                 vuid, now,
 172                                                 &session);
 173                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
 174                         reply_force_doserror(req, ERRSRV, ERRbaduid);
 175                         return;
 176                 }
 177                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 178                         status = NT_STATUS_OK;
 179                 }
 180                 if (NT_STATUS_IS_OK(status)) {
 181                         session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 182                         status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 183                         TALLOC_FREE(session->pending_auth);
 184                 }
 185                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 186                         reply_nterror(req, nt_status_squash(status));
 187                         return;
 188                 }
 189         }
 190
 191         if (session == NULL) {
 192                 /* create a new session */
 193                 status = smbXsrv_session_create(xconn,
 194                                                 now, &session);
 195                 if (!NT_STATUS_IS_OK(status)) {
 196                         reply_nterror(req, nt_status_squash(status));
 197                         return;
 198                 }
 199         }
 200
 201         status = smbXsrv_session_find_auth(session, xconn, now, &auth);
 202         if (!NT_STATUS_IS_OK(status)) {
 203                 status = smbXsrv_session_create_auth(session, xconn, now,
 204                                                      0, /* flags */
 205                                                      0, /* security */
 206                                                      &auth);
 207                 if (!NT_STATUS_IS_OK(status)) {
 208                         reply_nterror(req, nt_status_squash(status));
 209                         return;
 210                 }
 211         }
 212
 213         if (auth->gensec == NULL) {
 214                 status = auth_generic_prepare(session,
 215                                               xconn->remote_address,
 216                                               xconn->local_address,
 217                                               "SMB",
 218                                               &auth->gensec);
 219                 if (!NT_STATUS_IS_OK(status)) {
 220                         TALLOC_FREE(session);
 221                         reply_nterror(req, nt_status_squash(status));
 222                         return;
 223                 }
 224
 225                 gensec_want_feature(auth->gensec, GENSEC_FEATURE_SESSION_KEY);
 226                 gensec_want_feature(auth->gensec, GENSEC_FEATURE_UNIX_TOKEN);
 227                 gensec_want_feature(auth->gensec, GENSEC_FEATURE_SMB_TRANSPORT);
 228
 229                 status = gensec_start_mech_by_oid(auth->gensec,
 230                                                   GENSEC_OID_SPNEGO);
 231                 if (!NT_STATUS_IS_OK(status)) {
 232                         DEBUG(0, ("Failed to start SPNEGO handler!\n"));
 233                         TALLOC_FREE(session);;
 234                         reply_nterror(req, nt_status_squash(status));
 235                         return;
 236                 }
 237         }
 238
 239         become_root();
 240         status = gensec_update(auth->gensec,
 241                                talloc_tos(),
 242                                in_blob, &out_blob);
 243         unbecome_root();
 244         if (!NT_STATUS_IS_OK(status) &&
 245             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 246                 TALLOC_FREE(session);
 247                 reply_nterror(req, nt_status_squash(status));
 248                 return;
 249         }
 250
 251         if (NT_STATUS_IS_OK(status) && session->global->auth_session_info == NULL) {
 252                 struct auth_session_info *session_info = NULL;
 253
 254                 status = gensec_session_info(auth->gensec,
 255                                              session,
 256                                              &session_info);
 257                 if (!NT_STATUS_IS_OK(status)) {
 258                         DEBUG(1,("Failed to generate session_info "
 259                                  "(user and group token) for session setup: %s\n",
 260                                  nt_errstr(status)));
 261                         data_blob_free(&out_blob);
 262                         TALLOC_FREE(session);
 263                         reply_nterror(req, nt_status_squash(status));
 264                         return;
 265                 }
 266
 267                 if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
 268                         action |= SMB_SETUP_GUEST;
 269                 }
 270
 271                 if (session_info->session_key.length > 0) {
 272                         struct smbXsrv_session *x = session;
 273
 274                         /*
 275                          * Note: the SMB1 signing key is not truncated to 16 byte!
 276                          */
 277                         x->global->signing_key =
 278                                 data_blob_dup_talloc(x->global,
 279                                                      session_info->session_key);
 280                         if (x->global->signing_key.data == NULL) {
 281                                 data_blob_free(&out_blob);
 282                                 TALLOC_FREE(session);
 283                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 284                                 return;
 285                         }
 286
 287                         /*
 288                          * clear the session key
 289                          * the first tcon will add setup the application key
 290                          */
 291                         data_blob_clear_free(&session_info->session_key);
 292                 }
 293
 294                 session->compat = talloc_zero(session, struct user_struct);
 295                 if (session->compat == NULL) {
 296                         data_blob_free(&out_blob);
 297                         TALLOC_FREE(session);
 298                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 299                         return;
 300                 }
 301                 session->compat->session = session;
 302                 session->compat->homes_snum = -1;
 303                 session->compat->session_info = session_info;
 304                 session->compat->session_keystr = NULL;
 305                 session->compat->vuid = session->global->session_wire_id;
 306                 DLIST_ADD(sconn->users, session->compat);
 307                 sconn->num_users++;
 308
 309                 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
 310                         is_authenticated = true;
 311                         session->compat->homes_snum =
 312                                 register_homes_share(session_info->unix_info->unix_name);
 313                 }
 314
 315                 if (srv_is_signing_negotiated(xconn) &&
 316                     is_authenticated &&
 317                     session->global->signing_key.length > 0)
 318                 {
 319                         /*
 320                          * Try and turn on server signing on the first non-guest
 321                          * sessionsetup.
 322                          */
 323                         srv_set_signing(xconn,
 324                                 session->global->signing_key,
 325                                 data_blob_null);
 326                 }
 327
 328                 set_current_user_info(session_info->unix_info->sanitized_username,
 329                                       session_info->unix_info->unix_name,
 330                                       session_info->info->domain_name);
 331
 332                 session->status = NT_STATUS_OK;
 333                 session->global->auth_session_info = talloc_move(session->global,
 334                                                                  &session_info);
 335                 session->global->auth_session_info_seqnum += 1;
 336                 session->global->channels[0].auth_session_info_seqnum =
 337                         session->global->auth_session_info_seqnum;
 338                 session->global->auth_time = now;
 339                 if (client_caps & CAP_DYNAMIC_REAUTH) {
 340                         session->global->expiration_time =
 341                                 gensec_expire_time(auth->gensec);
 342                 } else {
 343                         session->global->expiration_time =
 344                                 GENSEC_EXPIRE_TIME_INFINITY;
 345                 }
 346
 347                 if (!session_claim(session)) {
 348                         DEBUG(1, ("smb1: Failed to claim session for vuid=%llu\n",
 349                                   (unsigned long long)session->compat->vuid));
 350                         data_blob_free(&out_blob);
 351                         TALLOC_FREE(session);
 352                         reply_nterror(req, NT_STATUS_LOGON_FAILURE);
 353                         return;
 354                 }
 355
 356                 status = smbXsrv_session_update(session);
 357                 if (!NT_STATUS_IS_OK(status)) {
 358                         DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
 359                                   (unsigned long long)session->compat->vuid,
 360                                   nt_errstr(status)));
 361                         data_blob_free(&out_blob);
 362                         TALLOC_FREE(session);
 363                         reply_nterror(req, NT_STATUS_LOGON_FAILURE);
 364                         return;
 365                 }
 366
 367                 if (!xconn->smb1.sessions.done_sesssetup) {
 368                         if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
 369                                 reply_force_doserror(req, ERRSRV, ERRerror);
 370                                 return;
 371                         }
 372                         xconn->smb1.sessions.max_send = smb_bufsize;
 373                         xconn->smb1.sessions.done_sesssetup = true;
 374                 }
 375
 376                 /* current_user_info is changed on new vuid */
 377                 reload_services(sconn, conn_snum_used, true);
 378         } else if (NT_STATUS_IS_OK(status)) {
 379                 struct auth_session_info *session_info = NULL;
 380
 381                 status = gensec_session_info(auth->gensec,
 382                                              session,
 383                                              &session_info);
 384                 if (!NT_STATUS_IS_OK(status)) {
 385                         DEBUG(1,("Failed to generate session_info "
 386                                  "(user and group token) for session setup: %s\n",
 387                                  nt_errstr(status)));
 388                         data_blob_free(&out_blob);
 389                         TALLOC_FREE(session);
 390                         reply_nterror(req, nt_status_squash(status));
 391                         return;
 392                 }
 393
 394                 if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
 395                         action |= SMB_SETUP_GUEST;
 396                 }
 397
 398                 /*
 399                  * Keep the application key
 400                  */
 401                 data_blob_clear_free(&session_info->session_key);
 402                 session_info->session_key =
 403                         session->global->auth_session_info->session_key;
 404                 talloc_steal(session_info, session_info->session_key.data);
 405                 TALLOC_FREE(session->global->auth_session_info);
 406
 407                 session->compat->session_info = session_info;
 408
 409                 session->compat->vuid = session->global->session_wire_id;
 410
 411                 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
 412                         session->compat->homes_snum =
 413                                 register_homes_share(session_info->unix_info->unix_name);
 414                 }
 415
 416                 set_current_user_info(session_info->unix_info->sanitized_username,
 417                                       session_info->unix_info->unix_name,
 418                                       session_info->info->domain_name);
 419
 420                 session->status = NT_STATUS_OK;
 421                 session->global->auth_session_info = talloc_move(session->global,
 422                                                                  &session_info);
 423                 session->global->auth_session_info_seqnum += 1;
 424                 session->global->channels[0].auth_session_info_seqnum =
 425                         session->global->auth_session_info_seqnum;
 426                 session->global->auth_time = now;
 427                 if (client_caps & CAP_DYNAMIC_REAUTH) {
 428                         session->global->expiration_time =
 429                                 gensec_expire_time(auth->gensec);
 430                 } else {
 431                         session->global->expiration_time =
 432                                 GENSEC_EXPIRE_TIME_INFINITY;
 433                 }
 434
 435                 status = smbXsrv_session_update(session);
 436                 if (!NT_STATUS_IS_OK(status)) {
 437                         DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
 438                                   (unsigned long long)session->compat->vuid,
 439                                   nt_errstr(status)));
 440                         data_blob_free(&out_blob);
 441                         TALLOC_FREE(session);
 442                         reply_nterror(req, NT_STATUS_LOGON_FAILURE);
 443                         return;
 444                 }
 445
 446                 conn_clear_vuid_caches(sconn, session->compat->vuid);
 447
 448                 /* current_user_info is changed on new vuid */
 449                 reload_services(sconn, conn_snum_used, true);
 450         }
 451
 452         vuid = session->global->session_wire_id;
 453
 454         reply_outbuf(req, 4, 0);
 455
 456         SSVAL(req->outbuf, smb_uid, vuid);
 457         SIVAL(req->outbuf, smb_rcls, NT_STATUS_V(status));
 458         SSVAL(req->outbuf, smb_vwv0, 0xFF); /* no chaining possible */
 459         SSVAL(req->outbuf, smb_vwv2, action);
 460         SSVAL(req->outbuf, smb_vwv3, out_blob.length);
 461
 462         if (message_push_blob(&req->outbuf, out_blob) == -1) {
 463                 data_blob_free(&out_blob);
 464                 TALLOC_FREE(session);
 465                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 466                 return;
 467         }
 468         data_blob_free(&out_blob);
 469
 470         if (push_signature(&req->outbuf) == -1) {
 471                 TALLOC_FREE(session);
 472                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 473                 return;
 474         }
 475 }
 476
 477 /****************************************************************************
 478  On new VC == 0, shutdown *all* old connections and users.
 479  It seems that only NT4.x does this. At W2K and above (XP etc.).
 480  a new session setup with VC==0 is ignored.
 481 ****************************************************************************/
 482
 483 struct shutdown_state {
 484         const char *ip;
 485         struct messaging_context *msg_ctx;
 486 };
 487
 488 static int shutdown_other_smbds(struct smbXsrv_session_global0 *session,
 489                                 void *private_data)
 490 {
 491         struct shutdown_state *state = (struct shutdown_state *)private_data;
 492         struct server_id self_pid = messaging_server_id(state->msg_ctx);
 493         struct server_id pid = session->channels[0].server_id;
 494         const char *addr = session->channels[0].remote_address;
 495         struct server_id_buf tmp;
 496
 497         DEBUG(10, ("shutdown_other_smbds: %s, %s\n",
 498                    server_id_str_buf(pid, &tmp), addr));
 499
 500         if (!process_exists(pid)) {
 501                 DEBUG(10, ("process does not exist\n"));
 502                 return 0;
 503         }
 504
 505         if (serverid_equal(&pid, &self_pid)) {
 506                 DEBUG(10, ("It's me\n"));
 507                 return 0;
 508         }
 509
 510         /*
 511          * here we use strstr() because 'addr'
 512          * (session->channels[0].remote_address)
 513          * contains a string like:
 514          * 'ipv4:127.0.0.1:48163'
 515          */
 516         if (strstr(addr, state->ip)  == NULL) {
 517                 DEBUG(10, ("%s does not match %s\n", state->ip, addr));
 518                 return 0;
 519         }
 520
 521         DEBUG(1, ("shutdown_other_smbds: shutting down pid %u "
 522                   "(IP %s)\n", (unsigned int)procid_to_pid(&pid),
 523                   state->ip));
 524
 525         messaging_send(state->msg_ctx, pid, MSG_SHUTDOWN,
 526                        &data_blob_null);
 527         return 0;
 528 }
 529
 530 static void setup_new_vc_session(struct smbd_server_connection *sconn)
 531 {
 532         DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x "
 533                 "compatible we would close all old resources.\n"));
 534 #if 0
 535         conn_close_all();
 536         invalidate_all_vuids();
 537 #endif
 538         if (lp_reset_on_zero_vc()) {
 539                 char *addr;
 540                 struct shutdown_state state;
 541
 542                 addr = tsocket_address_inet_addr_string(
 543                         sconn->remote_address, talloc_tos());
 544                 if (addr == NULL) {
 545                         return;
 546                 }
 547                 state.ip = addr;
 548                 state.msg_ctx = sconn->msg_ctx;
 549                 smbXsrv_session_global_traverse(shutdown_other_smbds, &state);
 550                 TALLOC_FREE(addr);
 551         }
 552 }
 553
 554 /****************************************************************************
 555  Reply to a session setup command.
 556 ****************************************************************************/
 557
 558 void reply_sesssetup_and_X(struct smb_request *req)
 559 {
 560         uint64_t sess_vuid;
 561         uint16_t smb_bufsize;
 562         DATA_BLOB lm_resp;
 563         DATA_BLOB nt_resp;
 564         DATA_BLOB plaintext_password;
 565         char *tmp;
 566         const char *user;
 567         fstring sub_user; /* Sanitised username for substituion */
 568         const char *domain;
 569         const char *native_os;
 570         const char *native_lanman;
 571         const char *primary_domain;
 572         struct auth_usersupplied_info *user_info = NULL;
 573         struct auth_session_info *session_info = NULL;
 574         uint16_t smb_flag2 = req->flags2;
 575         uint16_t action = 0;
 576         bool is_authenticated = false;
 577         NTTIME now = timeval_to_nttime(&req->request_time);
 578         struct smbXsrv_session *session = NULL;
 579         NTSTATUS nt_status;
 580         struct smbXsrv_connection *xconn = req->xconn;
 581         struct smbd_server_connection *sconn = req->sconn;
 582         bool doencrypt = xconn->smb1.negprot.encrypted_passwords;
 583         bool signing_allowed = false;
 584         bool signing_mandatory = smb_signing_is_mandatory(
 585                 xconn->smb1.signing_state);
 586
 587         START_PROFILE(SMBsesssetupX);
 588
 589         ZERO_STRUCT(lm_resp);
 590         ZERO_STRUCT(nt_resp);
 591         ZERO_STRUCT(plaintext_password);
 592
 593         DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
 594
 595         if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES) {
 596                 signing_allowed = true;
 597         }
 598         if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) {
 599                 signing_mandatory = true;
 600         }
 601
 602         /*
 603          * We can call srv_set_signing_negotiated() each time.
 604          * It finds out when it needs to turn into a noop
 605          * itself.
 606          */
 607         srv_set_signing_negotiated(xconn,
 608                                    signing_allowed,
 609                                    signing_mandatory);
 610
 611         /* a SPNEGO session setup has 12 command words, whereas a normal
 612            NT1 session setup has 13. See the cifs spec. */
 613         if (req->wct == 12 &&
 614             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
 615
 616                 if (!xconn->smb1.negprot.spnego) {
 617                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
 618                                  "at SPNEGO session setup when it was not "
 619                                  "negotiated.\n"));
 620                         reply_nterror(req, nt_status_squash(
 621                                               NT_STATUS_LOGON_FAILURE));
 622                         END_PROFILE(SMBsesssetupX);
 623                         return;
 624                 }
 625
 626                 if (SVAL(req->vwv+4, 0) == 0) {
 627                         setup_new_vc_session(req->sconn);
 628                 }
 629
 630                 reply_sesssetup_and_X_spnego(req);
 631                 END_PROFILE(SMBsesssetupX);
 632                 return;
 633         }
 634
 635         smb_bufsize = SVAL(req->vwv+2, 0);
 636
 637         if (get_Protocol() < PROTOCOL_NT1) {
 638                 uint16_t passlen1 = SVAL(req->vwv+7, 0);
 639
 640                 /* Never do NT status codes with protocols before NT1 as we
 641                  * don't get client caps. */
 642                 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
 643
 644                 if ((passlen1 > MAX_PASS_LEN) || (passlen1 > req->buflen)) {
 645                         reply_nterror(req, nt_status_squash(
 646                                               NT_STATUS_INVALID_PARAMETER));
 647                         END_PROFILE(SMBsesssetupX);
 648                         return;
 649                 }
 650
 651                 if (doencrypt) {
 652                         lm_resp = data_blob(req->buf, passlen1);
 653                 } else {
 654                         plaintext_password = data_blob(req->buf, passlen1+1);
 655                         /* Ensure null termination */
 656                         plaintext_password.data[passlen1] = 0;
 657                 }
 658
 659                 srvstr_pull_req_talloc(talloc_tos(), req, &tmp,
 660                                        req->buf + passlen1, STR_TERMINATE);
 661                 user = tmp ? tmp : "";
 662
 663                 domain = "";
 664
 665         } else {
 666                 uint16_t passlen1 = SVAL(req->vwv+7, 0);
 667                 uint16_t passlen2 = SVAL(req->vwv+8, 0);
 668                 enum remote_arch_types ra_type = get_remote_arch();
 669                 const uint8_t *p = req->buf;
 670                 const uint8_t *save_p = req->buf;
 671                 uint16_t byte_count;
 672
 673                 if (!xconn->smb1.sessions.done_sesssetup) {
 674                         global_client_caps = IVAL(req->vwv+11, 0);
 675
 676                         if (!(global_client_caps & CAP_STATUS32)) {
 677                                 remove_from_common_flags2(
 678                                                 FLAGS2_32_BIT_ERROR_CODES);
 679                         }
 680
 681                         /* client_caps is used as final determination if
 682                          * client is NT or Win95. This is needed to return
 683                          * the correct error codes in some circumstances.
 684                         */
 685
 686                         if(ra_type == RA_WINNT || ra_type == RA_WIN2K ||
 687                                         ra_type == RA_WIN95) {
 688                                 if(!(global_client_caps & (CAP_NT_SMBS|
 689                                                         CAP_STATUS32))) {
 690                                         set_remote_arch( RA_WIN95);
 691                                 }
 692                         }
 693                 }
 694
 695                 if (!doencrypt) {
 696                         /* both Win95 and WinNT stuff up the password
 697                          * lengths for non-encrypting systems. Uggh.
 698
 699                            if passlen1==24 its a win95 system, and its setting
 700                            the password length incorrectly. Luckily it still
 701                            works with the default code because Win95 will null
 702                            terminate the password anyway
 703
 704                            if passlen1>0 and passlen2>0 then maybe its a NT box
 705                            and its setting passlen2 to some random value which
 706                            really stuffs things up. we need to fix that one.  */
 707
 708                         if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 &&
 709                                         passlen2 != 1) {
 710                                 passlen2 = 0;
 711                         }
 712                 }
 713
 714                 /* check for nasty tricks */
 715                 if (passlen1 > MAX_PASS_LEN
 716                     || passlen1 > smbreq_bufrem(req, p)) {
 717                         reply_nterror(req, nt_status_squash(
 718                                               NT_STATUS_INVALID_PARAMETER));
 719                         END_PROFILE(SMBsesssetupX);
 720                         return;
 721                 }
 722
 723                 if (passlen2 > MAX_PASS_LEN
 724                     || passlen2 > smbreq_bufrem(req, p+passlen1)) {
 725                         reply_nterror(req, nt_status_squash(
 726                                               NT_STATUS_INVALID_PARAMETER));
 727                         END_PROFILE(SMBsesssetupX);
 728                         return;
 729                 }
 730
 731                 /* Save the lanman2 password and the NT md4 password. */
 732
 733                 if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
 734                         doencrypt = False;
 735                 }
 736
 737                 if (doencrypt) {
 738                         lm_resp = data_blob(p, passlen1);
 739                         nt_resp = data_blob(p+passlen1, passlen2);
 740                 } else {
 741                         char *pass = NULL;
 742                         bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
 743
 744                         if (unic && (passlen2 == 0) && passlen1) {
 745                                 /* Only a ascii plaintext password was sent. */
 746                                 (void)srvstr_pull_talloc(talloc_tos(),
 747                                                         req->inbuf,
 748                                                         req->flags2,
 749                                                         &pass,
 750                                                         req->buf,
 751                                                         passlen1,
 752                                                         STR_TERMINATE|STR_ASCII);
 753                         } else {
 754                                 (void)srvstr_pull_talloc(talloc_tos(),
 755                                                         req->inbuf,
 756                                                         req->flags2,
 757                                                         &pass,
 758                                                         req->buf,
 759                                                         unic ? passlen2 : passlen1,
 760                                                         STR_TERMINATE);
 761                         }
 762                         if (!pass) {
 763                                 reply_nterror(req, nt_status_squash(
 764                                               NT_STATUS_INVALID_PARAMETER));
 765                                 END_PROFILE(SMBsesssetupX);
 766                                 return;
 767                         }
 768                         plaintext_password = data_blob(pass, strlen(pass)+1);
 769                 }
 770
 771                 p += passlen1 + passlen2;
 772
 773                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 774                                             STR_TERMINATE);
 775                 user = tmp ? tmp : "";
 776
 777                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 778                                             STR_TERMINATE);
 779                 domain = tmp ? tmp : "";
 780
 781                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 782                                             STR_TERMINATE);
 783                 native_os = tmp ? tmp : "";
 784
 785                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 786                                             STR_TERMINATE);
 787                 native_lanman = tmp ? tmp : "";
 788
 789                 /* not documented or decoded by Ethereal but there is one more
 790                  * string in the extra bytes which is the same as the
 791                  * PrimaryDomain when using extended security.  Windows NT 4
 792                  * and 2003 use this string to store the native lanman string.
 793                  * Windows 9x does not include a string here at all so we have
 794                  * to check if we have any extra bytes left */
 795
 796                 byte_count = SVAL(req->vwv+13, 0);
 797                 if ( PTR_DIFF(p, save_p) < byte_count) {
 798                         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 799                                                     STR_TERMINATE);
 800                         primary_domain = tmp ? tmp : "";
 801                 } else {
 802                         primary_domain = talloc_strdup(talloc_tos(), "null");
 803                 }
 804
 805                 DEBUG(3,("Domain=[%s]  NativeOS=[%s] NativeLanMan=[%s] "
 806                         "PrimaryDomain=[%s]\n",
 807                         domain, native_os, native_lanman, primary_domain));
 808
 809                 if ( ra_type == RA_WIN2K ) {
 810                         if ( strlen(native_lanman) == 0 )
 811                                 ra_lanman_string( primary_domain );
 812                         else
 813                                 ra_lanman_string( native_lanman );
 814                 }
 815
 816         }
 817
 818         if (SVAL(req->vwv+4, 0) == 0) {
 819                 setup_new_vc_session(req->sconn);
 820         }
 821
 822         DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
 823                                 domain, user, get_remote_machine_name()));
 824
 825         if (*user) {
 826                 if (xconn->smb1.negprot.spnego) {
 827
 828                         /* This has to be here, because this is a perfectly
 829                          * valid behaviour for guest logons :-( */
 830
 831                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
 832                                 "at 'normal' session setup after "
 833                                 "negotiating spnego.\n"));
 834                         reply_nterror(req, nt_status_squash(
 835                                               NT_STATUS_LOGON_FAILURE));
 836                         END_PROFILE(SMBsesssetupX);
 837                         return;
 838                 }
 839                 fstrcpy(sub_user, user);
 840         } else {
 841                 fstrcpy(sub_user, "");
 842         }
 843
 844         sub_set_smb_name(sub_user);
 845
 846         reload_services(sconn, conn_snum_used, true);
 847
 848         if (!*user) {
 849                 struct auth4_context *auth_context = NULL;
 850
 851                 DEBUG(3,("Got anonymous request\n"));
 852
 853                 nt_status = make_auth4_context(talloc_tos(), &auth_context);
 854                 if (NT_STATUS_IS_OK(nt_status)) {
 855                         uint8_t chal[8];
 856
 857                         auth_context->get_ntlm_challenge(auth_context,
 858                                                          chal);
 859
 860                         if (!make_user_info_guest(talloc_tos(),
 861                                                   sconn->remote_address,
 862                                                   sconn->local_address,
 863                                                   "SMB", &user_info)) {
 864                                 nt_status =  NT_STATUS_NO_MEMORY;
 865                         }
 866
 867                         if (NT_STATUS_IS_OK(nt_status)) {
 868                                 user_info->auth_description = "guest";
 869                                 nt_status = auth_check_password_session_info(
 870                                                                 auth_context,
 871                                                                 req, user_info,
 872                                                                 &session_info);
 873                         }
 874                         TALLOC_FREE(auth_context);
 875                 }
 876         } else if (doencrypt) {
 877                 struct auth4_context *negprot_auth_context = NULL;
 878                 negprot_auth_context = xconn->smb1.negprot.auth_context;
 879                 if (!negprot_auth_context) {
 880                         DEBUG(0, ("reply_sesssetup_and_X:  Attempted encrypted "
 881                                 "session setup without negprot denied!\n"));
 882                         reply_nterror(req, nt_status_squash(
 883                                               NT_STATUS_LOGON_FAILURE));
 884                         END_PROFILE(SMBsesssetupX);
 885                         return;
 886                 }
 887                 nt_status = make_user_info_for_reply_enc(talloc_tos(),
 888                                                          &user_info, user,
 889                                                          domain,
 890                                                          sconn->remote_address,
 891                                                          sconn->local_address,
 892                                                          "SMB",
 893                                                          lm_resp, nt_resp);
 894
 895                 if (NT_STATUS_IS_OK(nt_status)) {
 896                         user_info->auth_description = "bare-NTLM";
 897                         nt_status = auth_check_password_session_info(negprot_auth_context,
 898                                                                      req, user_info, &session_info);
 899                 }
 900         } else {
 901                 struct auth4_context *plaintext_auth_context = NULL;
 902
 903                 nt_status = make_auth4_context(
 904                         talloc_tos(), &plaintext_auth_context);
 905
 906                 if (NT_STATUS_IS_OK(nt_status)) {
 907                         uint8_t chal[8];
 908
 909                         plaintext_auth_context->get_ntlm_challenge(
 910                                         plaintext_auth_context, chal);
 911
 912                         if (!make_user_info_for_reply(talloc_tos(),
 913                                                       &user_info,
 914                                                       user, domain,
 915                                                       sconn->remote_address,
 916                                                       sconn->local_address,
 917                                                       "SMB",
 918                                                       chal,
 919                                                       plaintext_password)) {
 920                                 nt_status = NT_STATUS_NO_MEMORY;
 921                         }
 922
 923                         if (NT_STATUS_IS_OK(nt_status)) {
 924                                 user_info->auth_description = "plaintext";
 925                                 nt_status = auth_check_password_session_info(plaintext_auth_context,
 926                                                                              req, user_info, &session_info);
 927                         }
 928                         TALLOC_FREE(plaintext_auth_context);
 929                 }
 930         }
 931
 932         TALLOC_FREE(user_info);
 933
 934         if (!NT_STATUS_IS_OK(nt_status)) {
 935                 data_blob_free(&nt_resp);
 936                 data_blob_free(&lm_resp);
 937                 data_blob_clear_free(&plaintext_password);
 938                 reply_nterror(req, nt_status_squash(nt_status));
 939                 END_PROFILE(SMBsesssetupX);
 940                 return;
 941         }
 942
 943         data_blob_clear_free(&plaintext_password);
 944
 945         /* it's ok - setup a reply */
 946         reply_outbuf(req, 3, 0);
 947         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
 948         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
 949
 950         if (get_Protocol() >= PROTOCOL_NT1) {
 951                 push_signature(&req->outbuf);
 952                 /* perhaps grab OS version here?? */
 953         }
 954
 955         if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
 956                 action |= SMB_SETUP_GUEST;
 957         }
 958
 959         /* register the name and uid as being validated, so further connections
 960            to a uid can get through without a password, on the same VC */
 961
 962         nt_status = smbXsrv_session_create(xconn,
 963                                            now, &session);
 964         if (!NT_STATUS_IS_OK(nt_status)) {
 965                 data_blob_free(&nt_resp);
 966                 data_blob_free(&lm_resp);
 967                 reply_nterror(req, nt_status_squash(nt_status));
 968                 END_PROFILE(SMBsesssetupX);
 969                 return;
 970         }
 971
 972         if (session_info->session_key.length > 0) {
 973                 uint8_t session_key[16];
 974
 975                 /*
 976                  * Note: the SMB1 signing key is not truncated to 16 byte!
 977                  */
 978                 session->global->signing_key =
 979                         data_blob_dup_talloc(session->global,
 980                                              session_info->session_key);
 981                 if (session->global->signing_key.data == NULL) {
 982                         data_blob_free(&nt_resp);
 983                         data_blob_free(&lm_resp);
 984                         TALLOC_FREE(session);
 985                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 986                         END_PROFILE(SMBsesssetupX);
 987                         return;
 988                 }
 989
 990                 /*
 991                  * The application key is truncated/padded to 16 bytes
 992                  */
 993                 ZERO_STRUCT(session_key);
 994                 memcpy(session_key, session->global->signing_key.data,
 995                        MIN(session->global->signing_key.length,
 996                            sizeof(session_key)));
 997                 session->global->application_key =
 998                         data_blob_talloc(session->global,
 999                                          session_key,
1000                                          sizeof(session_key));
1001                 ZERO_STRUCT(session_key);
1002                 if (session->global->application_key.data == NULL) {
1003                         data_blob_free(&nt_resp);
1004                         data_blob_free(&lm_resp);
1005                         TALLOC_FREE(session);
1006                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1007                         END_PROFILE(SMBsesssetupX);
1008                         return;
1009                 }
1010
1011                 /*
1012                  * Place the application key into the session_info
1013                  */
1014                 data_blob_clear_free(&session_info->session_key);
1015                 session_info->session_key = data_blob_dup_talloc(session_info,
1016                                                 session->global->application_key);
1017                 if (session_info->session_key.data == NULL) {
1018                         data_blob_free(&nt_resp);
1019                         data_blob_free(&lm_resp);
1020                         TALLOC_FREE(session);
1021                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1022                         END_PROFILE(SMBsesssetupX);
1023                         return;
1024                 }
1025         }
1026
1027         session->compat = talloc_zero(session, struct user_struct);
1028         if (session->compat == NULL) {
1029                 data_blob_free(&nt_resp);
1030                 data_blob_free(&lm_resp);
1031                 TALLOC_FREE(session);
1032                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1033                 END_PROFILE(SMBsesssetupX);
1034                 return;
1035         }
1036         session->compat->session = session;
1037         session->compat->homes_snum = -1;
1038         session->compat->session_info = session_info;
1039         session->compat->session_keystr = NULL;
1040         session->compat->vuid = session->global->session_wire_id;
1041         DLIST_ADD(sconn->users, session->compat);
1042         sconn->num_users++;
1043
1044         if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
1045                 is_authenticated = true;
1046                 session->compat->homes_snum =
1047                         register_homes_share(session_info->unix_info->unix_name);
1048         }
1049
1050         if (srv_is_signing_negotiated(xconn) &&
1051             is_authenticated &&
1052             session->global->signing_key.length > 0)
1053         {
1054                 /*
1055                  * Try and turn on server signing on the first non-guest
1056                  * sessionsetup.
1057                  */
1058                 srv_set_signing(xconn,
1059                         session->global->signing_key,
1060                         nt_resp.data ? nt_resp : lm_resp);
1061         }
1062
1063         set_current_user_info(session_info->unix_info->sanitized_username,
1064                               session_info->unix_info->unix_name,
1065                               session_info->info->domain_name);
1066
1067         session->status = NT_STATUS_OK;
1068         session->global->auth_session_info = talloc_move(session->global,
1069                                                          &session_info);
1070         session->global->auth_session_info_seqnum += 1;
1071         session->global->channels[0].auth_session_info_seqnum =
1072                 session->global->auth_session_info_seqnum;
1073         session->global->auth_time = now;
1074         session->global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1075
1076         nt_status = smbXsrv_session_update(session);
1077         if (!NT_STATUS_IS_OK(nt_status)) {
1078                 DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
1079                           (unsigned long long)session->compat->vuid,
1080                           nt_errstr(nt_status)));
1081                 data_blob_free(&nt_resp);
1082                 data_blob_free(&lm_resp);
1083                 TALLOC_FREE(session);
1084                 reply_nterror(req, nt_status_squash(nt_status));
1085                 END_PROFILE(SMBsesssetupX);
1086                 return;
1087         }
1088
1089         if (!session_claim(session)) {
1090                 DEBUG(1, ("smb1: Failed to claim session for vuid=%llu\n",
1091                           (unsigned long long)session->compat->vuid));
1092                 data_blob_free(&nt_resp);
1093                 data_blob_free(&lm_resp);
1094                 TALLOC_FREE(session);
1095                 reply_nterror(req, NT_STATUS_LOGON_FAILURE);
1096                 END_PROFILE(SMBsesssetupX);
1097                 return;
1098         }
1099
1100         /* current_user_info is changed on new vuid */
1101         reload_services(sconn, conn_snum_used, true);
1102
1103         sess_vuid = session->global->session_wire_id;
1104
1105         data_blob_free(&nt_resp);
1106         data_blob_free(&lm_resp);
1107
1108         SSVAL(req->outbuf,smb_vwv2,action);
1109         SSVAL(req->outbuf,smb_uid,sess_vuid);
1110         SSVAL(discard_const_p(char, req->inbuf),smb_uid,sess_vuid);
1111         req->vuid = sess_vuid;
1112
1113         if (!xconn->smb1.sessions.done_sesssetup) {
1114                 if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
1115                         reply_force_doserror(req, ERRSRV, ERRerror);
1116                         END_PROFILE(SMBsesssetupX);
1117                         return;
1118                 }
1119                 xconn->smb1.sessions.max_send = smb_bufsize;
1120                 xconn->smb1.sessions.done_sesssetup = true;
1121         }
1122
1123         END_PROFILE(SMBsesssetupX);
1124 }