*/
#include "includes.h"
+#include "auth/auth.h"
+#include "asn_1.h"
/*
setup the OS, Lanman and domain portions of a session setup reply
static void sesssetup_common_strings(struct smbsrv_request *req,
char **os, char **lanman, char **domain)
{
- (*os) = talloc_asprintf(req->mem_ctx, "Unix");
- (*lanman) = talloc_asprintf(req->mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
- (*domain) = talloc_asprintf(req->mem_ctx, "%s", lp_workgroup());
+ (*os) = talloc_asprintf(req, "Unix");
+ (*lanman) = talloc_asprintf(req, "Samba %s", SAMBA_VERSION_STRING);
+ (*domain) = talloc_asprintf(req, "%s", lp_workgroup());
}
struct auth_usersupplied_info *user_info = NULL;
struct auth_serversupplied_info *server_info = NULL;
struct auth_session_info *session_info;
- DATA_BLOB null_blob;
+ TALLOC_CTX *mem_ctx = talloc_named(req, 0, "NT1 session setup");
+ char *remote_machine;
+ if (!mem_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
if (!req->smb_conn->negotiate.done_sesssetup) {
req->smb_conn->negotiate.max_send = sess->old.in.bufsize;
}
-
- null_blob.length = 0;
-
- status = make_user_info_for_reply_enc(&user_info,
+
+ remote_machine = socket_get_peer_addr(req->smb_conn->connection->socket, mem_ctx);
+ status = make_user_info_for_reply_enc(req->smb_conn,
+ &user_info,
sess->old.in.user, sess->old.in.domain,
+ remote_machine,
sess->old.in.password,
- null_blob);
+ data_blob(NULL, 0));
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return NT_STATUS_ACCESS_DENIED;
}
status = req->smb_conn->negotiate.auth_context->check_ntlm_password(req->smb_conn->negotiate.auth_context,
- user_info,
- &server_info);
+ user_info,
+ mem_ctx,
+ &server_info);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return nt_status_squash(status);
}
- status = make_session_info(server_info, &session_info);
+ /* This references server_info into session_info */
+ status = make_session_info(req, server_info, &session_info);
+ talloc_free(mem_ctx);
if (!NT_STATUS_IS_OK(status)) {
return nt_status_squash(status);
}
struct auth_usersupplied_info *user_info = NULL;
struct auth_serversupplied_info *server_info = NULL;
struct auth_session_info *session_info;
+ TALLOC_CTX *mem_ctx = talloc_named(req, 0, "NT1 session setup");
+
+ if (!mem_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
if (!req->smb_conn->negotiate.done_sesssetup) {
req->smb_conn->negotiate.max_send = sess->nt1.in.bufsize;
req->smb_conn->negotiate.client_caps = sess->nt1.in.capabilities;
}
- status = make_user_info_for_reply_enc(&user_info,
- sess->nt1.in.user, sess->nt1.in.domain,
- sess->nt1.in.password1,
- sess->nt1.in.password2);
- if (!NT_STATUS_IS_OK(status)) {
- return NT_STATUS_ACCESS_DENIED;
+ if (req->smb_conn->negotiate.spnego_negotiated) {
+ struct auth_context *auth_context;
+
+ if (sess->nt1.in.user && *sess->nt1.in.user) {
+ return NT_STATUS_ACCESS_DENIED;
+ } else {
+ make_user_info_guest(req->smb_conn, &user_info);
+ }
+
+ status = make_auth_context_subsystem(req->smb_conn, &auth_context);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
+ return status;
+ }
+
+ status = auth_context->check_ntlm_password(auth_context,
+ user_info,
+ mem_ctx,
+ &server_info);
+ } else {
+ char *remote_machine;
+ remote_machine = socket_get_peer_addr(req->smb_conn->connection->socket, mem_ctx);
+ status = make_user_info_for_reply_enc(req->smb_conn,
+ &user_info,
+ sess->nt1.in.user, sess->nt1.in.domain,
+ remote_machine,
+ sess->nt1.in.password1,
+ sess->nt1.in.password2);
+ if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ status = req->smb_conn->negotiate
+ .auth_context->check_ntlm_password(req->smb_conn->negotiate
+ .auth_context,
+ user_info,
+ req,
+ &server_info);
}
- status = req->smb_conn->negotiate
- .auth_context->check_ntlm_password(req->smb_conn->negotiate
- .auth_context,
- user_info,
- &server_info);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return nt_status_squash(status);
}
- status = make_session_info(server_info, &session_info);
+ /* This references server_info into session_info */
+ status = make_session_info(mem_ctx, server_info, &session_info);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return nt_status_squash(status);
}
sess->nt1.out.action = 0;
sess->nt1.out.vuid = smbsrv_register_session(req->smb_conn, session_info, NULL);
+ talloc_free(mem_ctx);
if (sess->nt1.out.vuid == UID_FIELD_INVALID) {
return NT_STATUS_ACCESS_DENIED;
}
&sess->nt1.out.domain);
req->session = smbsrv_session_find(req->smb_conn, sess->nt1.out.vuid);
- srv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2);
+ if (session_info->server_info->guest) {
+ return NT_STATUS_OK;
+ }
+ if (!srv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2)) {
+ /* Already signing, or disabled */
+ return NT_STATUS_OK;
+ }
+
+ /* Force check of the request packet, now we know the session key */
+ req_signing_check_incoming(req);
+
+ srv_signing_restart(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2);
+
return NT_STATUS_OK;
}
*/
static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup *sess)
{
- /* defer this one for now */
- return NT_STATUS_INVALID_LEVEL;
+ NTSTATUS status = NT_STATUS_ACCESS_DENIED;
+ struct smbsrv_session *smb_sess;
+ struct gensec_security *gensec_ctx = NULL;
+ struct auth_session_info *session_info = NULL;
+ uint16_t vuid;
+
+ if (!req->smb_conn->negotiate.done_sesssetup) {
+ req->smb_conn->negotiate.max_send = sess->nt1.in.bufsize;
+ req->smb_conn->negotiate.client_caps = sess->nt1.in.capabilities;
+ }
+
+ vuid = SVAL(req->in.hdr,HDR_UID);
+ smb_sess = smbsrv_session_find(req->smb_conn, vuid);
+ if (smb_sess && !smb_sess->session_info) {
+ if (!smb_sess->gensec_ctx) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ status = gensec_update(smb_sess->gensec_ctx, req, sess->spnego.in.secblob, &sess->spnego.out.secblob);
+ } else {
+ smb_sess = NULL;
+
+ status = gensec_server_start(req->smb_conn, &gensec_ctx);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status)));
+ return status;
+ }
+
+ gensec_want_feature(gensec_ctx, GENSEC_WANT_SESSION_KEY);
+
+ status = gensec_start_mech_by_oid(gensec_ctx, OID_SPNEGO);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Failed to start GENSEC SPNEGO server code: %s\n", nt_errstr(status)));
+ return status;
+ }
+
+ status = gensec_update(gensec_ctx, req, sess->spnego.in.secblob, &sess->spnego.out.secblob);
+
+ }
+
+ if (!smb_sess) {
+ vuid = smbsrv_register_session(req->smb_conn,
+ session_info, gensec_ctx);
+ if (vuid == UID_FIELD_INVALID) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ smb_sess = smbsrv_session_find(req->smb_conn, vuid);
+ if (!smb_sess) {
+ return NT_STATUS_FOOBAR;
+ }
+ }
+
+ if (NT_STATUS_IS_OK(status)) {
+ DATA_BLOB session_key;
+
+ status = gensec_session_info(smb_sess->gensec_ctx, &smb_sess->session_info);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = gensec_session_key(smb_sess->gensec_ctx,
+ &session_key);
+ if (NT_STATUS_IS_OK(status)
+ && !smb_sess->session_info->server_info->guest
+ && srv_setup_signing(req->smb_conn, &session_key, NULL)) {
+ /* Force check of the request packet, now we know the session key */
+ req_signing_check_incoming(req);
+
+ srv_signing_restart(req->smb_conn, &session_key, NULL);
+
+ }
+ } else {
+ status = nt_status_squash(status);
+ if (smb_sess->gensec_ctx &&
+ !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ gensec_end(&smb_sess->gensec_ctx);
+ }
+ }
+
+ sess->spnego.out.action = 0;
+ sess->spnego.out.vuid = vuid;
+ sesssetup_common_strings(req,
+ &sess->spnego.out.os,
+ &sess->spnego.out.lanman,
+ &sess->spnego.out.domain);
+
+ return status;
}
/*
NTSTATUS status = NT_STATUS_INVALID_LEVEL;
switch (sess->generic.level) {
+ case RAW_SESSSETUP_GENERIC:
+ status = NT_STATUS_INVALID_LEVEL;
+ break;
case RAW_SESSSETUP_OLD:
status = sesssetup_old(req, sess);
break;
git.samba.org / bbaumbach / samba-autobuild / .git / blobdiff