r12115: bring SMB sesssetup_spnego in sync with SMB2 sesssetup

metze
(This used to be commit 99cf7dbb177f92df40301ed8faeeb93e89452922)

diff --git a/source4/smb_server/smb/sesssetup.c b/source4/smb_server/smb/sesssetup.c
index 3f09346243a4062b95a64d727b2f1bec8caa277e..2532a2f78fb8d539bf07c3e6a05ba45150cfd3a1 100644 (file)
--- a/source4/smb_server/smb/sesssetup.c
+++ b/source4/smb_server/smb/sesssetup.c
@@ -246,10 +246,11 @@ static NTSTATUS sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *s
 */
 static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup *sess)
 {
-       NTSTATUS status = NT_STATUS_ACCESS_DENIED;
-       struct smbsrv_session *smb_sess;
-       struct gensec_security *gensec_ctx;
+       NTSTATUS status;
+       NTSTATUS skey_status;
+       struct smbsrv_session *smb_sess = NULL;
        struct auth_session_info *session_info = NULL;
+       DATA_BLOB session_key;
        uint16_t vuid;
 
        sess->spnego.out.vuid = 0;
@@ -266,10 +267,12 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup
        }
 
        vuid = SVAL(req->in.hdr,HDR_UID);
+
+       /* lookup an existing session */
        smb_sess = smbsrv_session_find_sesssetup(req->smb_conn, vuid);
-       if (smb_sess) {
-               gensec_ctx = smb_sess->gensec_ctx;
-       } else {
+       if (!smb_sess) {
+               struct gensec_security *gensec_ctx;
+
                status = gensec_server_start(req, &gensec_ctx,
                                             req->smb_conn->connection->event.ctx);
                if (!NT_STATUS_IS_OK(status)) {
@@ -289,55 +292,57 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup
                        return status;
                }
 
+               /* allocate a new session */
                smb_sess = smbsrv_session_new(req->smb_conn, gensec_ctx);
-               if (!smb_sess) {
-                       return NT_STATUS_ACCESS_DENIED;
-               }
        }
 
-       status = gensec_update(gensec_ctx, req, sess->spnego.in.secblob, &sess->spnego.out.secblob);
-       if (NT_STATUS_IS_OK(status)) {
-               DATA_BLOB session_key;
-               
-               status = gensec_session_info(gensec_ctx, &session_info);
-               if (!NT_STATUS_IS_OK(status)) {
-                       talloc_free(smb_sess);
-                       return status;
-               }
-               
-               status = gensec_session_key(gensec_ctx, 
-                                           &session_key);
-/* TODO: what if getting the session key failed? */
-               if (NT_STATUS_IS_OK(status) 
-                   && session_info->server_info->authenticated
-                   && srv_setup_signing(req->smb_conn, &session_key, NULL)) {
-                       /* Force check of the request packet, now we know the session key */
-                       req_signing_check_incoming(req);
-
-                       srv_signing_restart(req->smb_conn, &session_key, NULL);
-               }
+       if (!smb_sess) {
+               return NT_STATUS_ACCESS_DENIED;
+       }
 
-       } else if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-       } else {
-               status = auth_nt_status_squash(status);
-               
-               /* This invalidates the VUID of the failed login */
-               talloc_free(smb_sess);
+       if (!smb_sess->gensec_ctx) {
+               status = NT_STATUS_INTERNAL_ERROR;
+               DEBUG(1, ("Internal ERROR: no gensec_ctx on session: %s\n", nt_errstr(status)));
+               goto failed;
+       }
+
+       status = gensec_update(smb_sess->gensec_ctx, req, sess->spnego.in.secblob, &sess->spnego.out.secblob);
+       if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+               sess->spnego.out.vuid = smb_sess->vuid;
                return status;
+       } else if (!NT_STATUS_IS_OK(status)) {
+               goto failed;
        }
-               
-       if (NT_STATUS_IS_OK(status)) {
-               /* Ensure this is marked as a 'real' vuid, not one
-                * simply valid for the session setup leg */
-               status = smbsrv_session_sesssetup_finished(smb_sess, session_info);
-               if (!NT_STATUS_IS_OK(status)) {
-                       return auth_nt_status_squash(status);
-               }
-               req->session = smb_sess;
+
+       status = gensec_session_info(smb_sess->gensec_ctx, &session_info);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto failed;
+       }
+
+       skey_status = gensec_session_key(smb_sess->gensec_ctx, &session_key);
+       if (NT_STATUS_IS_OK(skey_status) &&
+           session_info->server_info->authenticated &&
+           srv_setup_signing(req->smb_conn, &session_key, NULL)) {
+               /* Force check of the request packet, now we know the session key */
+               req_signing_check_incoming(req);
+
+               srv_signing_restart(req->smb_conn, &session_key, NULL);
+       }
+
+       /* Ensure this is marked as a 'real' vuid, not one
+        * simply valid for the session setup leg */
+       status = smbsrv_session_sesssetup_finished(smb_sess, session_info);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto failed;
        }
+       req->session = smb_sess;
+
        sess->spnego.out.vuid = smb_sess->vuid;
+       return NT_STATUS_OK;
 
-       return status;
+failed:
+       talloc_free(smb_sess);
+       return auth_nt_status_squash(status);
 }
 
 /*