*/
#include "includes.h"
+#include "auth/auth.h"
+#include "smb_server/smb_server.h"
+
/*
setup the OS, Lanman and domain portions of a session setup reply
static void sesssetup_common_strings(struct smbsrv_request *req,
char **os, char **lanman, char **domain)
{
- (*os) = talloc_asprintf(req->mem_ctx, "Unix");
- (*lanman) = talloc_asprintf(req->mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
- (*domain) = talloc_asprintf(req->mem_ctx, "%s", lp_workgroup());
+ (*os) = talloc_asprintf(req, "Unix");
+ (*lanman) = talloc_asprintf(req, "Samba %s", SAMBA_VERSION_STRING);
+ (*domain) = talloc_asprintf(req, "%s", lp_workgroup());
}
struct auth_usersupplied_info *user_info = NULL;
struct auth_serversupplied_info *server_info = NULL;
struct auth_session_info *session_info;
- DATA_BLOB null_blob;
+ char *remote_machine;
+ TALLOC_CTX *mem_ctx;
+
+ mem_ctx = talloc_named(req, 0, "OLD session setup");
+ NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
if (!req->smb_conn->negotiate.done_sesssetup) {
req->smb_conn->negotiate.max_send = sess->old.in.bufsize;
}
-
- null_blob.length = 0;
-
- status = make_user_info_for_reply_enc(&user_info,
+
+ remote_machine = socket_get_peer_addr(req->smb_conn->connection->socket, mem_ctx);
+ status = make_user_info_for_reply_enc(req->smb_conn,
sess->old.in.user, sess->old.in.domain,
+ remote_machine,
sess->old.in.password,
- null_blob);
+ data_blob(NULL, 0),
+ &user_info);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return NT_STATUS_ACCESS_DENIED;
}
- status = req->smb_conn->negotiate.auth_context->check_ntlm_password(req->smb_conn->negotiate.auth_context,
- user_info,
- &server_info);
+ status = auth_check_password(req->smb_conn->negotiate.auth_context,
+ mem_ctx, user_info, &server_info);
if (!NT_STATUS_IS_OK(status)) {
- return nt_status_squash(status);
+ talloc_free(mem_ctx);
+ return auth_nt_status_squash(status);
}
- status = make_session_info(server_info, &session_info);
+ /* This references server_info into session_info */
+ status = auth_generate_session_info(req, server_info, &session_info);
+ talloc_free(mem_ctx);
if (!NT_STATUS_IS_OK(status)) {
- return nt_status_squash(status);
+ return auth_nt_status_squash(status);
}
sess->old.out.action = 0;
struct auth_usersupplied_info *user_info = NULL;
struct auth_serversupplied_info *server_info = NULL;
struct auth_session_info *session_info;
+ TALLOC_CTX *mem_ctx;
+
+ mem_ctx = talloc_named(req, 0, "NT1 session setup");
+ NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
if (!req->smb_conn->negotiate.done_sesssetup) {
req->smb_conn->negotiate.max_send = sess->nt1.in.bufsize;
if (sess->nt1.in.user && *sess->nt1.in.user) {
return NT_STATUS_ACCESS_DENIED;
- } else {
- make_user_info_guest(&user_info);
}
-
- status = make_auth_context_subsystem(&auth_context);
+ status = make_user_info_anonymous(req->smb_conn, &user_info);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
+ return status;
+ }
+
+ /* TODO: should we use just "anonymous" here? */
+ status = auth_context_create(req->smb_conn, lp_auth_methods(), &auth_context);
+ if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return status;
}
-
- status = auth_context->check_ntlm_password(auth_context,
- user_info,
- &server_info);
-
- free_auth_context(&auth_context);
+ status = auth_check_password(auth_context, mem_ctx,
+ user_info, &server_info);
} else {
- status = make_user_info_for_reply_enc(&user_info,
+ char *remote_machine;
+
+ remote_machine = socket_get_peer_addr(req->smb_conn->connection->socket, mem_ctx);
+
+ status = make_user_info_for_reply_enc(req->smb_conn,
sess->nt1.in.user, sess->nt1.in.domain,
+ remote_machine,
sess->nt1.in.password1,
- sess->nt1.in.password2);
+ sess->nt1.in.password2,
+ &user_info);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
return NT_STATUS_ACCESS_DENIED;
}
- status = req->smb_conn->negotiate
- .auth_context->check_ntlm_password(req->smb_conn->negotiate
- .auth_context,
- user_info,
- &server_info);
+ status = auth_check_password(req->smb_conn->negotiate.auth_context,
+ req, user_info, &server_info);
}
if (!NT_STATUS_IS_OK(status)) {
- return nt_status_squash(status);
+ talloc_free(mem_ctx);
+ return auth_nt_status_squash(status);
}
- status = make_session_info(server_info, &session_info);
+ /* This references server_info into session_info */
+ status = auth_generate_session_info(mem_ctx, server_info, &session_info);
if (!NT_STATUS_IS_OK(status)) {
- return nt_status_squash(status);
+ talloc_free(mem_ctx);
+ return auth_nt_status_squash(status);
}
sess->nt1.out.action = 0;
sess->nt1.out.vuid = smbsrv_register_session(req->smb_conn, session_info, NULL);
+ talloc_free(mem_ctx);
if (sess->nt1.out.vuid == UID_FIELD_INVALID) {
return NT_STATUS_ACCESS_DENIED;
}
&sess->nt1.out.domain);
req->session = smbsrv_session_find(req->smb_conn, sess->nt1.out.vuid);
- if (session_info->server_info->guest) {
+ if (!session_info->server_info->authenticated) {
return NT_STATUS_OK;
}
+
if (!srv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2)) {
/* Already signing, or disabled */
return NT_STATUS_OK;
}
-
+
/* Force check of the request packet, now we know the session key */
req_signing_check_incoming(req);
vuid = SVAL(req->in.hdr,HDR_UID);
smb_sess = smbsrv_session_find(req->smb_conn, vuid);
- if (smb_sess) {
+ if (smb_sess && !smb_sess->session_info) {
if (!smb_sess->gensec_ctx) {
return NT_STATUS_INVALID_HANDLE;
}
- /* what is when the client is already successful authentificated? */
- if (smb_sess->session_info) {
- return NT_STATUS_ACCESS_DENIED;
- }
-
- status = gensec_update(smb_sess->gensec_ctx, req->mem_ctx, sess->spnego.in.secblob, &sess->spnego.out.secblob);
+ status = gensec_update(smb_sess->gensec_ctx, req, sess->spnego.in.secblob, &sess->spnego.out.secblob);
} else {
- status = gensec_server_start(&gensec_ctx);
+ smb_sess = NULL;
+
+ status = gensec_server_start(req->smb_conn, &gensec_ctx);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status)));
return status;
}
- status = gensec_start_mech_by_oid(gensec_ctx, OID_SPNEGO);
+ gensec_set_target_service(gensec_ctx, "cifs");
+
+ gensec_want_feature(gensec_ctx, GENSEC_FEATURE_SESSION_KEY);
+
+ status = gensec_start_mech_by_oid(gensec_ctx, GENSEC_OID_SPNEGO);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to start GENSEC SPNEGO server code: %s\n", nt_errstr(status)));
return status;
}
- status = gensec_update(gensec_ctx, req->mem_ctx, sess->spnego.in.secblob, &sess->spnego.out.secblob);
+ status = gensec_update(gensec_ctx, req, sess->spnego.in.secblob, &sess->spnego.out.secblob);
}
if (!smb_sess) {
- vuid = smbsrv_register_session(req->smb_conn, session_info, gensec_ctx);
+ vuid = smbsrv_register_session(req->smb_conn,
+ session_info, gensec_ctx);
if (vuid == UID_FIELD_INVALID) {
return NT_STATUS_ACCESS_DENIED;
}
status = gensec_session_key(smb_sess->gensec_ctx,
&session_key);
if (NT_STATUS_IS_OK(status)
- && !smb_sess->session_info->server_info->guest
+ && smb_sess->session_info->server_info->authenticated
&& srv_setup_signing(req->smb_conn, &session_key, NULL)) {
/* Force check of the request packet, now we know the session key */
req_signing_check_incoming(req);
}
} else {
- status = nt_status_squash(status);
+ status = auth_nt_status_squash(status);
+ if (smb_sess->gensec_ctx &&
+ !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ talloc_free(smb_sess->gensec_ctx);
+ smb_sess->gensec_ctx = NULL;
+ }
}
sess->spnego.out.action = 0;
{
NTSTATUS status = NT_STATUS_INVALID_LEVEL;
- switch (sess->generic.level) {
- case RAW_SESSSETUP_GENERIC:
- status = NT_STATUS_INVALID_LEVEL;
- break;
+ switch (sess->old.level) {
case RAW_SESSSETUP_OLD:
status = sesssetup_old(req, sess);
break;
git.samba.org / gd / samba-autobuild / .git / blobdiff