source3/smbd/sesssetup.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    handle SMBsessionsetup
   4    Copyright (C) Andrew Tridgell 1998-2001
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
   7    Copyright (C) Luke Howard          2003
   8    Copyright (C) Volker Lendecke      2007
   9    Copyright (C) Jeremy Allison       2007
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "smbd/smbd.h"
  28 #include "smbd/globals.h"
  29 #include "../libcli/auth/spnego.h"
  30 #include "../libcli/auth/ntlmssp.h"
  31 #include "ntlmssp_wrap.h"
  32 #include "../librpc/gen_ndr/krb5pac.h"
  33 #include "libads/kerberos_proto.h"
  34 #include "../lib/util/asn1.h"
  35 #include "auth.h"
  36 #include "messages.h"
  37 #include "smbprofile.h"
  38 #include "../libcli/security/security.h"
  39
  40 /* For split krb5 SPNEGO blobs. */
  41 struct pending_auth_data {
  42         struct pending_auth_data *prev, *next;
  43         uint16 vuid; /* Tag for this entry. */
  44         uint16 smbpid; /* Alternate tag for this entry. */
  45         size_t needed_len;
  46         DATA_BLOB partial_data;
  47 };
  48
  49 /****************************************************************************
  50  Add the standard 'Samba' signature to the end of the session setup.
  51 ****************************************************************************/
  52
  53 static int push_signature(uint8 **outbuf)
  54 {
  55         char *lanman;
  56         int result, tmp;
  57
  58         result = 0;
  59
  60         tmp = message_push_string(outbuf, "Unix", STR_TERMINATE);
  61
  62         if (tmp == -1) return -1;
  63         result += tmp;
  64
  65         if (asprintf(&lanman, "Samba %s", samba_version_string()) != -1) {
  66                 tmp = message_push_string(outbuf, lanman, STR_TERMINATE);
  67                 SAFE_FREE(lanman);
  68         }
  69         else {
  70                 tmp = message_push_string(outbuf, "Samba", STR_TERMINATE);
  71         }
  72
  73         if (tmp == -1) return -1;
  74         result += tmp;
  75
  76         tmp = message_push_string(outbuf, lp_workgroup(), STR_TERMINATE);
  77
  78         if (tmp == -1) return -1;
  79         result += tmp;
  80
  81         return result;
  82 }
  83
  84 /****************************************************************************
  85  Send a security blob via a session setup reply.
  86 ****************************************************************************/
  87
  88 static void reply_sesssetup_blob(struct smb_request *req,
  89                                  DATA_BLOB blob,
  90                                  NTSTATUS nt_status)
  91 {
  92         if (!NT_STATUS_IS_OK(nt_status) &&
  93             !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
  94                 reply_nterror(req, nt_status_squash(nt_status));
  95                 return;
  96         }
  97
  98         nt_status = nt_status_squash(nt_status);
  99         SIVAL(req->outbuf, smb_rcls, NT_STATUS_V(nt_status));
 100         SSVAL(req->outbuf, smb_vwv0, 0xFF); /* no chaining possible */
 101         SSVAL(req->outbuf, smb_vwv3, blob.length);
 102
 103         if ((message_push_blob(&req->outbuf, blob) == -1)
 104             || (push_signature(&req->outbuf) == -1)) {
 105                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 106         }
 107 }
 108
 109 /****************************************************************************
 110  Do a 'guest' logon, getting back the
 111 ****************************************************************************/
 112
 113 static NTSTATUS check_guest_password(const struct tsocket_address *remote_address,
 114                                      struct auth_serversupplied_info **server_info)
 115 {
 116         struct auth_context *auth_context;
 117         struct auth_usersupplied_info *user_info = NULL;
 118
 119         NTSTATUS nt_status;
 120         static unsigned char chal[8] = { 0, };
 121
 122         DEBUG(3,("Got anonymous request\n"));
 123
 124         nt_status = make_auth_context_fixed(talloc_tos(), &auth_context, chal);
 125         if (!NT_STATUS_IS_OK(nt_status)) {
 126                 return nt_status;
 127         }
 128
 129         if (!make_user_info_guest(remote_address, &user_info)) {
 130                 TALLOC_FREE(auth_context);
 131                 return NT_STATUS_NO_MEMORY;
 132         }
 133
 134         nt_status = auth_context->check_ntlm_password(auth_context,
 135                                                 user_info,
 136                                                 server_info);
 137         TALLOC_FREE(auth_context);
 138         free_user_info(&user_info);
 139         return nt_status;
 140 }
 141
 142
 143 #ifdef HAVE_KRB5
 144
 145 #if 0
 146 /* Experiment that failed. See "only happens with a KDC" comment below. */
 147 /****************************************************************************
 148  Cerate a clock skew error blob for a Windows client.
 149 ****************************************************************************/
 150
 151 static bool make_krb5_skew_error(DATA_BLOB *pblob_out)
 152 {
 153         krb5_context context = NULL;
 154         krb5_error_code kerr = 0;
 155         krb5_data reply;
 156         krb5_principal host_princ = NULL;
 157         char *host_princ_s = NULL;
 158         bool ret = False;
 159
 160         *pblob_out = data_blob_null;
 161
 162         initialize_krb5_error_table();
 163         kerr = krb5_init_context(&context);
 164         if (kerr) {
 165                 return False;
 166         }
 167         /* Create server principal. */
 168         asprintf(&host_princ_s, "%s$@%s", lp_netbios_name(), lp_realm());
 169         if (!host_princ_s) {
 170                 goto out;
 171         }
 172         strlower_m(host_princ_s);
 173
 174         kerr = smb_krb5_parse_name(context, host_princ_s, &host_princ);
 175         if (kerr) {
 176                 DEBUG(10,("make_krb5_skew_error: smb_krb5_parse_name failed "
 177                         "for name %s: Error %s\n",
 178                         host_princ_s, error_message(kerr) ));
 179                 goto out;
 180         }
 181
 182         kerr = smb_krb5_mk_error(context, KRB5KRB_AP_ERR_SKEW,
 183                         host_princ, &reply);
 184         if (kerr) {
 185                 DEBUG(10,("make_krb5_skew_error: smb_krb5_mk_error "
 186                         "failed: Error %s\n",
 187                         error_message(kerr) ));
 188                 goto out;
 189         }
 190
 191         *pblob_out = data_blob(reply.data, reply.length);
 192         kerberos_free_data_contents(context,&reply);
 193         ret = True;
 194
 195   out:
 196
 197         if (host_princ_s) {
 198                 SAFE_FREE(host_princ_s);
 199         }
 200         if (host_princ) {
 201                 krb5_free_principal(context, host_princ);
 202         }
 203         krb5_free_context(context);
 204         return ret;
 205 }
 206 #endif
 207
 208 /****************************************************************************
 209  Reply to a session setup spnego negotiate packet for kerberos.
 210 ****************************************************************************/
 211
 212 static void reply_spnego_kerberos(struct smb_request *req,
 213                                   DATA_BLOB *secblob,
 214                                   const char *mechOID,
 215                                   uint16 vuid,
 216                                   bool *p_invalidate_vuid)
 217 {
 218         TALLOC_CTX *mem_ctx;
 219         DATA_BLOB ticket;
 220         struct passwd *pw;
 221         int sess_vuid = req->vuid;
 222         NTSTATUS ret = NT_STATUS_OK;
 223         DATA_BLOB ap_rep, ap_rep_wrapped, response;
 224         struct auth_session_info *session_info = NULL;
 225         DATA_BLOB session_key = data_blob_null;
 226         uint8 tok_id[2];
 227         DATA_BLOB nullblob = data_blob_null;
 228         bool map_domainuser_to_guest = False;
 229         bool username_was_mapped;
 230         struct PAC_LOGON_INFO *logon_info = NULL;
 231         struct smbd_server_connection *sconn = req->sconn;
 232         char *principal;
 233         char *user;
 234         char *domain;
 235         char *real_username;
 236
 237         ZERO_STRUCT(ticket);
 238         ZERO_STRUCT(ap_rep);
 239         ZERO_STRUCT(ap_rep_wrapped);
 240         ZERO_STRUCT(response);
 241
 242         /* Normally we will always invalidate the intermediate vuid. */
 243         *p_invalidate_vuid = True;
 244
 245         mem_ctx = talloc_init("reply_spnego_kerberos");
 246         if (mem_ctx == NULL) {
 247                 reply_nterror(req, nt_status_squash(NT_STATUS_NO_MEMORY));
 248                 return;
 249         }
 250
 251         if (!spnego_parse_krb5_wrap(mem_ctx, *secblob, &ticket, tok_id)) {
 252                 talloc_destroy(mem_ctx);
 253                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
 254                 return;
 255         }
 256
 257         ret = ads_verify_ticket(mem_ctx, lp_realm(), 0, &ticket,
 258                                 &principal, &logon_info, &ap_rep,
 259                                 &session_key, True);
 260
 261         data_blob_free(&ticket);
 262
 263         if (!NT_STATUS_IS_OK(ret)) {
 264 #if 0
 265                 /* Experiment that failed.
 266                  * See "only happens with a KDC" comment below. */
 267
 268                 if (NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
 269
 270                         /*
 271                          * Windows in this case returns
 272                          * NT_STATUS_MORE_PROCESSING_REQUIRED
 273                          * with a negTokenTarg blob containing an krb5_error
 274                          * struct ASN1 encoded containing KRB5KRB_AP_ERR_SKEW.
 275                          * The client then fixes its clock and continues rather
 276                          * than giving an error. JRA.
 277                          * -- Looks like this only happens with a KDC. JRA.
 278                          */
 279
 280                         bool ok = make_krb5_skew_error(&ap_rep);
 281                         if (!ok) {
 282                                 talloc_destroy(mem_ctx);
 283                                 return ERROR_NT(nt_status_squash(
 284                                                 NT_STATUS_LOGON_FAILURE));
 285                         }
 286                         ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
 287                                         TOK_ID_KRB_ERROR);
 288                         response = spnego_gen_auth_response(&ap_rep_wrapped,
 289                                         ret, OID_KERBEROS5_OLD);
 290                         reply_sesssetup_blob(conn, inbuf, outbuf, response,
 291                                         NT_STATUS_MORE_PROCESSING_REQUIRED);
 292
 293                         /*
 294                          * In this one case we don't invalidate the
 295                          * intermediate vuid as we're expecting the client
 296                          * to re-use it for the next sessionsetupX packet. JRA.
 297                          */
 298
 299                         *p_invalidate_vuid = False;
 300
 301                         data_blob_free(&ap_rep);
 302                         data_blob_free(&ap_rep_wrapped);
 303                         data_blob_free(&response);
 304                         talloc_destroy(mem_ctx);
 305                         return -1; /* already replied */
 306                 }
 307 #else
 308                 if (!NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
 309                         ret = NT_STATUS_LOGON_FAILURE;
 310                 }
 311 #endif
 312                 DEBUG(1,("Failed to verify incoming ticket with error %s!\n",
 313                                 nt_errstr(ret)));
 314                 talloc_destroy(mem_ctx);
 315                 reply_nterror(req, nt_status_squash(ret));
 316                 return;
 317         }
 318
 319         ret = get_user_from_kerberos_info(talloc_tos(),
 320                                           sconn->remote_hostname,
 321                                           principal, logon_info,
 322                                           &username_was_mapped,
 323                                           &map_domainuser_to_guest,
 324                                           &user, &domain,
 325                                           &real_username, &pw);
 326         if (!NT_STATUS_IS_OK(ret)) {
 327                 data_blob_free(&ap_rep);
 328                 data_blob_free(&session_key);
 329                 talloc_destroy(mem_ctx);
 330                 reply_nterror(req,nt_status_squash(NT_STATUS_LOGON_FAILURE));
 331                 return;
 332         }
 333
 334         /* save the PAC data if we have it */
 335         if (logon_info) {
 336                 netsamlogon_cache_store(user, &logon_info->info3);
 337         }
 338
 339         /* setup the string used by %U */
 340         sub_set_smb_name(real_username);
 341
 342         /* reload services so that the new %U is taken into account */
 343         reload_services(sconn->msg_ctx, sconn->sock, True);
 344
 345         ret = make_session_info_krb5(mem_ctx,
 346                                      user, domain, real_username, pw,
 347                                      logon_info, map_domainuser_to_guest,
 348                                      username_was_mapped,
 349                                      &session_key,
 350                                      &session_info);
 351         data_blob_free(&session_key);
 352         if (!NT_STATUS_IS_OK(ret)) {
 353                 DEBUG(1, ("make_server_info_krb5 failed!\n"));
 354                 data_blob_free(&ap_rep);
 355                 TALLOC_FREE(mem_ctx);
 356                 reply_nterror(req, nt_status_squash(ret));
 357                 return;
 358         }
 359
 360         if (!is_partial_auth_vuid(sconn, sess_vuid)) {
 361                 sess_vuid = register_initial_vuid(sconn);
 362         }
 363
 364         /* register_existing_vuid keeps the server info */
 365         /* register_existing_vuid takes ownership of session_key on success,
 366          * no need to free after this on success. A better interface would copy
 367          * it.... */
 368
 369         sess_vuid = register_existing_vuid(sconn, sess_vuid,
 370                                            session_info, nullblob, user);
 371
 372         reply_outbuf(req, 4, 0);
 373         SSVAL(req->outbuf,smb_uid,sess_vuid);
 374
 375         if (sess_vuid == UID_FIELD_INVALID ) {
 376                 ret = NT_STATUS_LOGON_FAILURE;
 377         } else {
 378                 /* current_user_info is changed on new vuid */
 379                 reload_services(sconn->msg_ctx, sconn->sock, True);
 380
 381                 SSVAL(req->outbuf, smb_vwv3, 0);
 382
 383                 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
 384                         SSVAL(req->outbuf,smb_vwv2,1);
 385                 }
 386
 387                 SSVAL(req->outbuf, smb_uid, sess_vuid);
 388
 389                 /* Successful logon. Keep this vuid. */
 390                 *p_invalidate_vuid = False;
 391         }
 392
 393         /* wrap that up in a nice GSS-API wrapping */
 394         if (NT_STATUS_IS_OK(ret)) {
 395                 ap_rep_wrapped = spnego_gen_krb5_wrap(talloc_tos(), ap_rep,
 396                                 TOK_ID_KRB_AP_REP);
 397         } else {
 398                 ap_rep_wrapped = data_blob_null;
 399         }
 400         response = spnego_gen_auth_response(talloc_tos(), &ap_rep_wrapped, ret,
 401                         mechOID);
 402         reply_sesssetup_blob(req, response, ret);
 403
 404         data_blob_free(&ap_rep);
 405         data_blob_free(&ap_rep_wrapped);
 406         data_blob_free(&response);
 407         TALLOC_FREE(mem_ctx);
 408 }
 409
 410 #endif
 411
 412 /****************************************************************************
 413  Send a session setup reply, wrapped in SPNEGO.
 414  Get vuid and check first.
 415  End the NTLMSSP exchange context if we are OK/complete fail
 416  This should be split into two functions, one to handle each
 417  leg of the NTLM auth steps.
 418 ***************************************************************************/
 419
 420 static void reply_spnego_ntlmssp(struct smb_request *req,
 421                                  uint16 vuid,
 422                                  struct auth_ntlmssp_state **auth_ntlmssp_state,
 423                                  DATA_BLOB *ntlmssp_blob, NTSTATUS nt_status,
 424                                  const char *OID,
 425                                  bool wrap)
 426 {
 427         bool do_invalidate = true;
 428         DATA_BLOB response;
 429         struct auth_session_info *session_info = NULL;
 430         struct smbd_server_connection *sconn = req->sconn;
 431
 432         if (NT_STATUS_IS_OK(nt_status)) {
 433                 nt_status = auth_ntlmssp_steal_session_info(talloc_tos(),
 434                                         (*auth_ntlmssp_state), &session_info);
 435         }
 436
 437         reply_outbuf(req, 4, 0);
 438
 439         SSVAL(req->outbuf, smb_uid, vuid);
 440
 441         if (NT_STATUS_IS_OK(nt_status)) {
 442                 DATA_BLOB nullblob = data_blob_null;
 443
 444                 if (!is_partial_auth_vuid(sconn, vuid)) {
 445                         nt_status = NT_STATUS_LOGON_FAILURE;
 446                         goto out;
 447                 }
 448
 449                 /* register_existing_vuid keeps the server info */
 450                 if (register_existing_vuid(sconn, vuid,
 451                                            session_info, nullblob,
 452                                            auth_ntlmssp_get_username(*auth_ntlmssp_state)) !=
 453                                            vuid) {
 454                         /* The problem is, *auth_ntlmssp_state points
 455                          * into the vuser this will have
 456                          * talloc_free()'ed in
 457                          * register_existing_vuid() */
 458                         do_invalidate = false;
 459                         nt_status = NT_STATUS_LOGON_FAILURE;
 460                         goto out;
 461                 }
 462
 463                 /* current_user_info is changed on new vuid */
 464                 reload_services(sconn->msg_ctx, sconn->sock, True);
 465
 466                 SSVAL(req->outbuf, smb_vwv3, 0);
 467
 468                 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
 469                         SSVAL(req->outbuf,smb_vwv2,1);
 470                 }
 471         }
 472
 473   out:
 474
 475         if (wrap) {
 476                 response = spnego_gen_auth_response(talloc_tos(),
 477                                 ntlmssp_blob,
 478                                 nt_status, OID);
 479         } else {
 480                 response = *ntlmssp_blob;
 481         }
 482
 483         reply_sesssetup_blob(req, response, nt_status);
 484         if (wrap) {
 485                 data_blob_free(&response);
 486         }
 487
 488         /* NT_STATUS_MORE_PROCESSING_REQUIRED from our NTLMSSP code tells us,
 489            and the other end, that we are not finished yet. */
 490
 491         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 492                 /* NB. This is *NOT* an error case. JRA */
 493                 if (do_invalidate) {
 494                         TALLOC_FREE(*auth_ntlmssp_state);
 495                         if (!NT_STATUS_IS_OK(nt_status)) {
 496                                 /* Kill the intermediate vuid */
 497                                 invalidate_vuid(sconn, vuid);
 498                         }
 499                 }
 500         }
 501 }
 502
 503 /****************************************************************************
 504  Is this a krb5 mechanism ?
 505 ****************************************************************************/
 506
 507 NTSTATUS parse_spnego_mechanisms(TALLOC_CTX *ctx,
 508                 DATA_BLOB blob_in,
 509                 DATA_BLOB *pblob_out,
 510                 char **kerb_mechOID)
 511 {
 512         char *OIDs[ASN1_MAX_OIDS];
 513         int i;
 514         NTSTATUS ret = NT_STATUS_OK;
 515
 516         *kerb_mechOID = NULL;
 517
 518         /* parse out the OIDs and the first sec blob */
 519         if (!spnego_parse_negTokenInit(ctx, blob_in, OIDs, NULL, pblob_out) ||
 520                         (OIDs[0] == NULL)) {
 521                 return NT_STATUS_LOGON_FAILURE;
 522         }
 523
 524         /* only look at the first OID for determining the mechToken --
 525            according to RFC2478, we should choose the one we want
 526            and renegotiate, but i smell a client bug here..
 527
 528            Problem observed when connecting to a member (samba box)
 529            of an AD domain as a user in a Samba domain.  Samba member
 530            server sent back krb5/mskrb5/ntlmssp as mechtypes, but the
 531            client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an
 532            NTLMSSP mechtoken.                 --jerry              */
 533
 534 #ifdef HAVE_KRB5
 535         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 ||
 536             strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
 537                 *kerb_mechOID = talloc_strdup(ctx, OIDs[0]);
 538                 if (*kerb_mechOID == NULL) {
 539                         ret = NT_STATUS_NO_MEMORY;
 540                 }
 541         }
 542 #endif
 543
 544         for (i=0;OIDs[i];i++) {
 545                 DEBUG(5,("parse_spnego_mechanisms: Got OID %s\n", OIDs[i]));
 546                 talloc_free(OIDs[i]);
 547         }
 548         return ret;
 549 }
 550
 551 /****************************************************************************
 552  Fall back from krb5 to NTLMSSP.
 553 ****************************************************************************/
 554
 555 static void reply_spnego_downgrade_to_ntlmssp(struct smb_request *req,
 556                                                 uint16 vuid)
 557 {
 558         DATA_BLOB response;
 559
 560         reply_outbuf(req, 4, 0);
 561         SSVAL(req->outbuf,smb_uid,vuid);
 562
 563         DEBUG(3,("reply_spnego_downgrade_to_ntlmssp: Got krb5 ticket in SPNEGO "
 564                 "but set to downgrade to NTLMSSP\n"));
 565
 566         response = spnego_gen_auth_response(talloc_tos(), NULL,
 567                         NT_STATUS_MORE_PROCESSING_REQUIRED,
 568                         OID_NTLMSSP);
 569         reply_sesssetup_blob(req, response, NT_STATUS_MORE_PROCESSING_REQUIRED);
 570         data_blob_free(&response);
 571 }
 572
 573 /****************************************************************************
 574  Reply to a session setup spnego negotiate packet.
 575 ****************************************************************************/
 576
 577 static void reply_spnego_negotiate(struct smb_request *req,
 578                                    uint16 vuid,
 579                                    DATA_BLOB blob1,
 580                                    struct auth_ntlmssp_state **auth_ntlmssp_state)
 581 {
 582         DATA_BLOB secblob;
 583         DATA_BLOB chal;
 584         char *kerb_mech = NULL;
 585         NTSTATUS status;
 586         struct smbd_server_connection *sconn = req->sconn;
 587
 588         status = parse_spnego_mechanisms(talloc_tos(),
 589                         blob1, &secblob, &kerb_mech);
 590         if (!NT_STATUS_IS_OK(status)) {
 591                 /* Kill the intermediate vuid */
 592                 invalidate_vuid(sconn, vuid);
 593                 reply_nterror(req, nt_status_squash(status));
 594                 return;
 595         }
 596
 597         DEBUG(3,("reply_spnego_negotiate: Got secblob of size %lu\n",
 598                                 (unsigned long)secblob.length));
 599
 600 #ifdef HAVE_KRB5
 601         if (kerb_mech && ((lp_security()==SEC_ADS) ||
 602                                 USE_KERBEROS_KEYTAB) ) {
 603                 bool destroy_vuid = True;
 604                 reply_spnego_kerberos(req, &secblob, kerb_mech,
 605                                       vuid, &destroy_vuid);
 606                 data_blob_free(&secblob);
 607                 if (destroy_vuid) {
 608                         /* Kill the intermediate vuid */
 609                         invalidate_vuid(sconn, vuid);
 610                 }
 611                 TALLOC_FREE(kerb_mech);
 612                 return;
 613         }
 614 #endif
 615
 616         TALLOC_FREE(*auth_ntlmssp_state);
 617
 618         if (kerb_mech) {
 619                 data_blob_free(&secblob);
 620                 /* The mechtoken is a krb5 ticket, but
 621                  * we need to fall back to NTLM. */
 622                 reply_spnego_downgrade_to_ntlmssp(req, vuid);
 623                 TALLOC_FREE(kerb_mech);
 624                 return;
 625         }
 626
 627         status = auth_ntlmssp_prepare(sconn->remote_address,
 628                                       auth_ntlmssp_state);
 629         if (!NT_STATUS_IS_OK(status)) {
 630                 /* Kill the intermediate vuid */
 631                 invalidate_vuid(sconn, vuid);
 632                 reply_nterror(req, nt_status_squash(status));
 633                 return;
 634         }
 635
 636         auth_ntlmssp_want_feature(*auth_ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
 637
 638         status = auth_ntlmssp_start(*auth_ntlmssp_state);
 639         if (!NT_STATUS_IS_OK(status)) {
 640                 /* Kill the intermediate vuid */
 641                 invalidate_vuid(sconn, vuid);
 642                 reply_nterror(req, nt_status_squash(status));
 643                 return;
 644         }
 645
 646         status = auth_ntlmssp_update(*auth_ntlmssp_state, talloc_tos(),
 647                                         secblob, &chal);
 648
 649         data_blob_free(&secblob);
 650
 651         reply_spnego_ntlmssp(req, vuid, auth_ntlmssp_state,
 652                              &chal, status, OID_NTLMSSP, true);
 653
 654         data_blob_free(&chal);
 655
 656         /* already replied */
 657         return;
 658 }
 659
 660 /****************************************************************************
 661  Reply to a session setup spnego auth packet.
 662 ****************************************************************************/
 663
 664 static void reply_spnego_auth(struct smb_request *req,
 665                               uint16 vuid,
 666                               DATA_BLOB blob1,
 667                               struct auth_ntlmssp_state **auth_ntlmssp_state)
 668 {
 669         DATA_BLOB auth = data_blob_null;
 670         DATA_BLOB auth_reply = data_blob_null;
 671         DATA_BLOB secblob = data_blob_null;
 672         NTSTATUS status = NT_STATUS_LOGON_FAILURE;
 673         struct smbd_server_connection *sconn = req->sconn;
 674
 675         if (!spnego_parse_auth(talloc_tos(), blob1, &auth)) {
 676 #if 0
 677                 file_save("auth.dat", blob1.data, blob1.length);
 678 #endif
 679                 /* Kill the intermediate vuid */
 680                 invalidate_vuid(sconn, vuid);
 681
 682                 reply_nterror(req, nt_status_squash(
 683                                       NT_STATUS_LOGON_FAILURE));
 684                 return;
 685         }
 686
 687         if (auth.data[0] == ASN1_APPLICATION(0)) {
 688                 /* Might be a second negTokenTarg packet */
 689                 char *kerb_mech = NULL;
 690
 691                 status = parse_spnego_mechanisms(talloc_tos(),
 692                                 auth, &secblob, &kerb_mech);
 693
 694                 if (!NT_STATUS_IS_OK(status)) {
 695                         /* Kill the intermediate vuid */
 696                         invalidate_vuid(sconn, vuid);
 697                         reply_nterror(req, nt_status_squash(status));
 698                         return;
 699                 }
 700
 701                 DEBUG(3,("reply_spnego_auth: Got secblob of size %lu\n",
 702                                 (unsigned long)secblob.length));
 703 #ifdef HAVE_KRB5
 704                 if (kerb_mech && ((lp_security()==SEC_ADS) ||
 705                                         USE_KERBEROS_KEYTAB)) {
 706                         bool destroy_vuid = True;
 707                         reply_spnego_kerberos(req, &secblob, kerb_mech,
 708                                               vuid, &destroy_vuid);
 709                         data_blob_free(&secblob);
 710                         data_blob_free(&auth);
 711                         if (destroy_vuid) {
 712                                 /* Kill the intermediate vuid */
 713                                 invalidate_vuid(sconn, vuid);
 714                         }
 715                         TALLOC_FREE(kerb_mech);
 716                         return;
 717                 }
 718 #endif
 719                 /* Can't blunder into NTLMSSP auth if we have
 720                  * a krb5 ticket. */
 721
 722                 if (kerb_mech) {
 723                         /* Kill the intermediate vuid */
 724                         invalidate_vuid(sconn, vuid);
 725                         DEBUG(3,("reply_spnego_auth: network "
 726                                 "misconfiguration, client sent us a "
 727                                 "krb5 ticket and kerberos security "
 728                                 "not enabled\n"));
 729                         reply_nterror(req, nt_status_squash(
 730                                         NT_STATUS_LOGON_FAILURE));
 731                         TALLOC_FREE(kerb_mech);
 732                 }
 733         }
 734
 735         /* If we get here it wasn't a negTokenTarg auth packet. */
 736         data_blob_free(&secblob);
 737
 738         if (!*auth_ntlmssp_state) {
 739                 status = auth_ntlmssp_prepare(sconn->remote_address,
 740                                               auth_ntlmssp_state);
 741                 if (!NT_STATUS_IS_OK(status)) {
 742                         /* Kill the intermediate vuid */
 743                         invalidate_vuid(sconn, vuid);
 744                         reply_nterror(req, nt_status_squash(status));
 745                         return;
 746                 }
 747
 748                 auth_ntlmssp_want_feature(*auth_ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
 749
 750                 status = auth_ntlmssp_start(*auth_ntlmssp_state);
 751                 if (!NT_STATUS_IS_OK(status)) {
 752                         /* Kill the intermediate vuid */
 753                         invalidate_vuid(sconn, vuid);
 754                         reply_nterror(req, nt_status_squash(status));
 755                         return;
 756                 }
 757         }
 758
 759         status = auth_ntlmssp_update(*auth_ntlmssp_state, talloc_tos(),
 760                                      auth, &auth_reply);
 761
 762         data_blob_free(&auth);
 763
 764         /* Don't send the mechid as we've already sent this (RFC4178). */
 765
 766         reply_spnego_ntlmssp(req, vuid,
 767                              auth_ntlmssp_state,
 768                              &auth_reply, status, NULL, true);
 769
 770         data_blob_free(&auth_reply);
 771
 772         /* and tell smbd that we have already replied to this packet */
 773         return;
 774 }
 775
 776 /****************************************************************************
 777  Delete an entry on the list.
 778 ****************************************************************************/
 779
 780 static void delete_partial_auth(struct smbd_server_connection *sconn,
 781                                 struct pending_auth_data *pad)
 782 {
 783         if (!pad) {
 784                 return;
 785         }
 786         DLIST_REMOVE(sconn->smb1.pd_list, pad);
 787         data_blob_free(&pad->partial_data);
 788         SAFE_FREE(pad);
 789 }
 790
 791 /****************************************************************************
 792  Search for a partial SPNEGO auth fragment matching an smbpid.
 793 ****************************************************************************/
 794
 795 static struct pending_auth_data *get_pending_auth_data(
 796                 struct smbd_server_connection *sconn,
 797                 uint16_t smbpid)
 798 {
 799         struct pending_auth_data *pad;
 800 /*
 801  * NOTE: using the smbpid here is completely wrong...
 802  *       see [MS-SMB]
 803  *       3.3.5.3 Receiving an SMB_COM_SESSION_SETUP_ANDX Request
 804  */
 805         for (pad = sconn->smb1.pd_list; pad; pad = pad->next) {
 806                 if (pad->smbpid == smbpid) {
 807                         break;
 808                 }
 809         }
 810         return pad;
 811 }
 812
 813 /****************************************************************************
 814  Check the size of an SPNEGO blob. If we need more return
 815  NT_STATUS_MORE_PROCESSING_REQUIRED, else return NT_STATUS_OK. Don't allow
 816  the blob to be more than 64k.
 817 ****************************************************************************/
 818
 819 static NTSTATUS check_spnego_blob_complete(struct smbd_server_connection *sconn,
 820                                            uint16 smbpid, uint16 vuid,
 821                                            DATA_BLOB *pblob)
 822 {
 823         struct pending_auth_data *pad = NULL;
 824         ASN1_DATA *data;
 825         size_t needed_len = 0;
 826
 827         pad = get_pending_auth_data(sconn, smbpid);
 828
 829         /* Ensure we have some data. */
 830         if (pblob->length == 0) {
 831                 /* Caller can cope. */
 832                 DEBUG(2,("check_spnego_blob_complete: zero blob length !\n"));
 833                 delete_partial_auth(sconn, pad);
 834                 return NT_STATUS_OK;
 835         }
 836
 837         /* Were we waiting for more data ? */
 838         if (pad) {
 839                 DATA_BLOB tmp_blob;
 840                 size_t copy_len = MIN(65536, pblob->length);
 841
 842                 /* Integer wrap paranoia.... */
 843
 844                 if (pad->partial_data.length + copy_len <
 845                                 pad->partial_data.length ||
 846                     pad->partial_data.length + copy_len < copy_len) {
 847
 848                         DEBUG(2,("check_spnego_blob_complete: integer wrap "
 849                                 "pad->partial_data.length = %u, "
 850                                 "copy_len = %u\n",
 851                                 (unsigned int)pad->partial_data.length,
 852                                 (unsigned int)copy_len ));
 853
 854                         delete_partial_auth(sconn, pad);
 855                         return NT_STATUS_INVALID_PARAMETER;
 856                 }
 857
 858                 DEBUG(10,("check_spnego_blob_complete: "
 859                         "pad->partial_data.length = %u, "
 860                         "pad->needed_len = %u, "
 861                         "copy_len = %u, "
 862                         "pblob->length = %u,\n",
 863                         (unsigned int)pad->partial_data.length,
 864                         (unsigned int)pad->needed_len,
 865                         (unsigned int)copy_len,
 866                         (unsigned int)pblob->length ));
 867
 868                 tmp_blob = data_blob(NULL,
 869                                 pad->partial_data.length + copy_len);
 870
 871                 /* Concatenate the two (up to copy_len) bytes. */
 872                 memcpy(tmp_blob.data,
 873                         pad->partial_data.data,
 874                         pad->partial_data.length);
 875                 memcpy(tmp_blob.data + pad->partial_data.length,
 876                         pblob->data,
 877                         copy_len);
 878
 879                 /* Replace the partial data. */
 880                 data_blob_free(&pad->partial_data);
 881                 pad->partial_data = tmp_blob;
 882                 ZERO_STRUCT(tmp_blob);
 883
 884                 /* Are we done ? */
 885                 if (pblob->length >= pad->needed_len) {
 886                         /* Yes, replace pblob. */
 887                         data_blob_free(pblob);
 888                         *pblob = pad->partial_data;
 889                         ZERO_STRUCT(pad->partial_data);
 890                         delete_partial_auth(sconn, pad);
 891                         return NT_STATUS_OK;
 892                 }
 893
 894                 /* Still need more data. */
 895                 pad->needed_len -= copy_len;
 896                 return NT_STATUS_MORE_PROCESSING_REQUIRED;
 897         }
 898
 899         if ((pblob->data[0] != ASN1_APPLICATION(0)) &&
 900             (pblob->data[0] != ASN1_CONTEXT(1))) {
 901                 /* Not something we can determine the
 902                  * length of.
 903                  */
 904                 return NT_STATUS_OK;
 905         }
 906
 907         /* This is a new SPNEGO sessionsetup - see if
 908          * the data given in this blob is enough.
 909          */
 910
 911         data = asn1_init(NULL);
 912         if (data == NULL) {
 913                 return NT_STATUS_NO_MEMORY;
 914         }
 915
 916         asn1_load(data, *pblob);
 917         if (asn1_start_tag(data, pblob->data[0])) {
 918                 /* asn1_start_tag checks if the given
 919                    length of the blob is enough to complete
 920                    the tag. If it returns true we know
 921                    there is nothing to do - the blob is
 922                    complete. */
 923                 asn1_free(data);
 924                 return NT_STATUS_OK;
 925         }
 926
 927         if (data->nesting == NULL) {
 928                 /* Incorrect tag, allocation failed,
 929                    or reading the tag length failed.
 930                    Let the caller catch. */
 931                 asn1_free(data);
 932                 return NT_STATUS_OK;
 933         }
 934
 935         /* Here we know asn1_start_tag() has set data->has_error to true.
 936            asn1_tag_remaining() will have failed due to the given blob
 937            being too short. We need to work out how short. */
 938
 939         /* Integer wrap paranoia.... */
 940
 941         if (data->nesting->taglen + data->nesting->start < data->nesting->taglen ||
 942             data->nesting->taglen + data->nesting->start < data->nesting->start) {
 943
 944                 DEBUG(2,("check_spnego_blob_complete: integer wrap "
 945                         "data.nesting->taglen = %u, "
 946                         "data.nesting->start = %u\n",
 947                         (unsigned int)data->nesting->taglen,
 948                         (unsigned int)data->nesting->start ));
 949
 950                 asn1_free(data);
 951                 return NT_STATUS_INVALID_PARAMETER;
 952         }
 953
 954         /* Total length of the needed asn1 is the tag length
 955          * plus the current offset. */
 956
 957         needed_len = data->nesting->taglen + data->nesting->start;
 958         asn1_free(data);
 959
 960         DEBUG(10,("check_spnego_blob_complete: needed_len = %u, "
 961                 "pblob->length = %u\n",
 962                 (unsigned int)needed_len,
 963                 (unsigned int)pblob->length ));
 964
 965         if (needed_len <= pblob->length) {
 966                 /* Nothing to do - blob is complete. */
 967                 /* THIS SHOULD NOT HAPPEN - asn1_start_tag()
 968                    above should have caught this !!! */
 969                 DEBUG(0,("check_spnego_blob_complete: logic "
 970                         "error (needed_len = %u, "
 971                         "pblob->length = %u).\n",
 972                         (unsigned int)needed_len,
 973                         (unsigned int)pblob->length ));
 974                 return NT_STATUS_OK;
 975         }
 976
 977         /* Refuse the blob if it's bigger than 64k. */
 978         if (needed_len > 65536) {
 979                 DEBUG(2,("check_spnego_blob_complete: needed_len "
 980                         "too large (%u)\n",
 981                         (unsigned int)needed_len ));
 982                 return NT_STATUS_INVALID_PARAMETER;
 983         }
 984
 985         /* We must store this blob until complete. */
 986         if (!(pad = SMB_MALLOC_P(struct pending_auth_data))) {
 987                 return NT_STATUS_NO_MEMORY;
 988         }
 989         pad->needed_len = needed_len - pblob->length;
 990         pad->partial_data = data_blob(pblob->data, pblob->length);
 991         if (pad->partial_data.data == NULL) {
 992                 SAFE_FREE(pad);
 993                 return NT_STATUS_NO_MEMORY;
 994         }
 995         pad->smbpid = smbpid;
 996         pad->vuid = vuid;
 997         DLIST_ADD(sconn->smb1.pd_list, pad);
 998
 999         return NT_STATUS_MORE_PROCESSING_REQUIRED;
1000 }
1001
1002 /****************************************************************************
1003  Reply to a session setup command.
1004  conn POINTER CAN BE NULL HERE !
1005 ****************************************************************************/
1006
1007 static void reply_sesssetup_and_X_spnego(struct smb_request *req)
1008 {
1009         const uint8 *p;
1010         DATA_BLOB blob1;
1011         size_t bufrem;
1012         char *tmp;
1013         const char *native_os;
1014         const char *native_lanman;
1015         const char *primary_domain;
1016         const char *p2;
1017         uint16 data_blob_len = SVAL(req->vwv+7, 0);
1018         enum remote_arch_types ra_type = get_remote_arch();
1019         int vuid = req->vuid;
1020         user_struct *vuser = NULL;
1021         NTSTATUS status = NT_STATUS_OK;
1022         uint16 smbpid = req->smbpid;
1023         struct smbd_server_connection *sconn = req->sconn;
1024
1025         DEBUG(3,("Doing spnego session setup\n"));
1026
1027         if (global_client_caps == 0) {
1028                 global_client_caps = IVAL(req->vwv+10, 0);
1029
1030                 if (!(global_client_caps & CAP_STATUS32)) {
1031                         remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1032                 }
1033
1034         }
1035
1036         p = req->buf;
1037
1038         if (data_blob_len == 0) {
1039                 /* an invalid request */
1040                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1041                 return;
1042         }
1043
1044         bufrem = smbreq_bufrem(req, p);
1045         /* pull the spnego blob */
1046         blob1 = data_blob(p, MIN(bufrem, data_blob_len));
1047
1048 #if 0
1049         file_save("negotiate.dat", blob1.data, blob1.length);
1050 #endif
1051
1052         p2 = (const char *)req->buf + blob1.length;
1053
1054         p2 += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p2,
1055                                      STR_TERMINATE);
1056         native_os = tmp ? tmp : "";
1057
1058         p2 += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p2,
1059                                      STR_TERMINATE);
1060         native_lanman = tmp ? tmp : "";
1061
1062         p2 += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p2,
1063                                      STR_TERMINATE);
1064         primary_domain = tmp ? tmp : "";
1065
1066         DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
1067                 native_os, native_lanman, primary_domain));
1068
1069         if ( ra_type == RA_WIN2K ) {
1070                 /* Vista sets neither the OS or lanman strings */
1071
1072                 if ( !strlen(native_os) && !strlen(native_lanman) )
1073                         set_remote_arch(RA_VISTA);
1074
1075                 /* Windows 2003 doesn't set the native lanman string,
1076                    but does set primary domain which is a bug I think */
1077
1078                 if ( !strlen(native_lanman) ) {
1079                         ra_lanman_string( primary_domain );
1080                 } else {
1081                         ra_lanman_string( native_lanman );
1082                 }
1083         } else if ( ra_type == RA_VISTA ) {
1084                 if ( strncmp(native_os, "Mac OS X", 8) == 0 ) {
1085                         set_remote_arch(RA_OSX);
1086                 }
1087         }
1088
1089         /* Did we get a valid vuid ? */
1090         if (!is_partial_auth_vuid(sconn, vuid)) {
1091                 /* No, then try and see if this is an intermediate sessionsetup
1092                  * for a large SPNEGO packet. */
1093                 struct pending_auth_data *pad;
1094                 pad = get_pending_auth_data(sconn, smbpid);
1095                 if (pad) {
1096                         DEBUG(10,("reply_sesssetup_and_X_spnego: found "
1097                                 "pending vuid %u\n",
1098                                 (unsigned int)pad->vuid ));
1099                         vuid = pad->vuid;
1100                 }
1101         }
1102
1103         /* Do we have a valid vuid now ? */
1104         if (!is_partial_auth_vuid(sconn, vuid)) {
1105                 /* No, start a new authentication setup. */
1106                 vuid = register_initial_vuid(sconn);
1107                 if (vuid == UID_FIELD_INVALID) {
1108                         data_blob_free(&blob1);
1109                         reply_nterror(req, nt_status_squash(
1110                                               NT_STATUS_INVALID_PARAMETER));
1111                         return;
1112                 }
1113         }
1114
1115         vuser = get_partial_auth_user_struct(sconn, vuid);
1116         /* This MUST be valid. */
1117         if (!vuser) {
1118                 smb_panic("reply_sesssetup_and_X_spnego: invalid vuid.");
1119         }
1120
1121         /* Large (greater than 4k) SPNEGO blobs are split into multiple
1122          * sessionsetup requests as the Windows limit on the security blob
1123          * field is 4k. Bug #4400. JRA.
1124          */
1125
1126         status = check_spnego_blob_complete(sconn, smbpid, vuid, &blob1);
1127         if (!NT_STATUS_IS_OK(status)) {
1128                 if (!NT_STATUS_EQUAL(status,
1129                                 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1130                         /* Real error - kill the intermediate vuid */
1131                         invalidate_vuid(sconn, vuid);
1132                 }
1133                 data_blob_free(&blob1);
1134                 reply_nterror(req, nt_status_squash(status));
1135                 return;
1136         }
1137
1138         if (blob1.data[0] == ASN1_APPLICATION(0)) {
1139
1140                 /* its a negTokenTarg packet */
1141
1142                 reply_spnego_negotiate(req, vuid, blob1,
1143                                        &vuser->auth_ntlmssp_state);
1144                 data_blob_free(&blob1);
1145                 return;
1146         }
1147
1148         if (blob1.data[0] == ASN1_CONTEXT(1)) {
1149
1150                 /* its a auth packet */
1151
1152                 reply_spnego_auth(req, vuid, blob1,
1153                                   &vuser->auth_ntlmssp_state);
1154                 data_blob_free(&blob1);
1155                 return;
1156         }
1157
1158         if (strncmp((char *)(blob1.data), "NTLMSSP", 7) == 0) {
1159                 DATA_BLOB chal;
1160
1161                 if (!vuser->auth_ntlmssp_state) {
1162                         status = auth_ntlmssp_prepare(sconn->remote_address,
1163                                                       &vuser->auth_ntlmssp_state);
1164                         if (!NT_STATUS_IS_OK(status)) {
1165                                 /* Kill the intermediate vuid */
1166                                 invalidate_vuid(sconn, vuid);
1167                                 data_blob_free(&blob1);
1168                                 reply_nterror(req, nt_status_squash(status));
1169                                 return;
1170                         }
1171
1172                         auth_ntlmssp_want_feature(vuser->auth_ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
1173
1174                         status = auth_ntlmssp_start(vuser->auth_ntlmssp_state);
1175                         if (!NT_STATUS_IS_OK(status)) {
1176                                 /* Kill the intermediate vuid */
1177                                 invalidate_vuid(sconn, vuid);
1178                                 data_blob_free(&blob1);
1179                                 reply_nterror(req, nt_status_squash(status));
1180                                 return;
1181                         }
1182                 }
1183
1184                 status = auth_ntlmssp_update(vuser->auth_ntlmssp_state,
1185                                              talloc_tos(),
1186                                              blob1, &chal);
1187
1188                 data_blob_free(&blob1);
1189
1190                 reply_spnego_ntlmssp(req, vuid,
1191                                      &vuser->auth_ntlmssp_state,
1192                                      &chal, status, OID_NTLMSSP, false);
1193                 data_blob_free(&chal);
1194                 return;
1195         }
1196
1197         /* what sort of packet is this? */
1198         DEBUG(1,("Unknown packet in reply_sesssetup_and_X_spnego\n"));
1199
1200         data_blob_free(&blob1);
1201
1202         reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
1203 }
1204
1205 /****************************************************************************
1206  On new VC == 0, shutdown *all* old connections and users.
1207  It seems that only NT4.x does this. At W2K and above (XP etc.).
1208  a new session setup with VC==0 is ignored.
1209 ****************************************************************************/
1210
1211 struct shutdown_state {
1212         const char *ip;
1213         struct messaging_context *msg_ctx;
1214 };
1215
1216 static int shutdown_other_smbds(const struct connections_key *key,
1217                                 const struct connections_data *crec,
1218                                 void *private_data)
1219 {
1220         struct shutdown_state *state = (struct shutdown_state *)private_data;
1221
1222         DEBUG(10, ("shutdown_other_smbds: %s, %s\n",
1223                    server_id_str(talloc_tos(), &crec->pid), crec->addr));
1224
1225         if (!process_exists(crec->pid)) {
1226                 DEBUG(10, ("process does not exist\n"));
1227                 return 0;
1228         }
1229
1230         if (procid_is_me(&crec->pid)) {
1231                 DEBUG(10, ("It's me\n"));
1232                 return 0;
1233         }
1234
1235         if (strcmp(state->ip, crec->addr) != 0) {
1236                 DEBUG(10, ("%s does not match %s\n", state->ip, crec->addr));
1237                 return 0;
1238         }
1239
1240         DEBUG(1, ("shutdown_other_smbds: shutting down pid %u "
1241                   "(IP %s)\n", (unsigned int)procid_to_pid(&crec->pid),
1242                   state->ip));
1243
1244         messaging_send(state->msg_ctx, crec->pid, MSG_SHUTDOWN,
1245                        &data_blob_null);
1246         return 0;
1247 }
1248
1249 static void setup_new_vc_session(struct smbd_server_connection *sconn)
1250 {
1251         DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x "
1252                 "compatible we would close all old resources.\n"));
1253 #if 0
1254         conn_close_all();
1255         invalidate_all_vuids();
1256 #endif
1257         if (lp_reset_on_zero_vc()) {
1258                 char *addr;
1259                 struct shutdown_state state;
1260
1261                 addr = tsocket_address_inet_addr_string(
1262                         sconn->remote_address, talloc_tos());
1263                 if (addr == NULL) {
1264                         return;
1265                 }
1266                 state.ip = addr;
1267                 state.msg_ctx = sconn->msg_ctx;
1268                 connections_forall_read(shutdown_other_smbds, &state);
1269                 TALLOC_FREE(addr);
1270         }
1271 }
1272
1273 /****************************************************************************
1274  Reply to a session setup command.
1275 ****************************************************************************/
1276
1277 void reply_sesssetup_and_X(struct smb_request *req)
1278 {
1279         int sess_vuid;
1280         int smb_bufsize;
1281         DATA_BLOB lm_resp;
1282         DATA_BLOB nt_resp;
1283         DATA_BLOB plaintext_password;
1284         char *tmp;
1285         const char *user;
1286         fstring sub_user; /* Sanitised username for substituion */
1287         const char *domain;
1288         const char *native_os;
1289         const char *native_lanman;
1290         const char *primary_domain;
1291         struct auth_usersupplied_info *user_info = NULL;
1292         struct auth_serversupplied_info *server_info = NULL;
1293         struct auth_session_info *session_info = NULL;
1294         uint16 smb_flag2 = req->flags2;
1295
1296         NTSTATUS nt_status;
1297         struct smbd_server_connection *sconn = req->sconn;
1298
1299         bool doencrypt = sconn->smb1.negprot.encrypted_passwords;
1300
1301         START_PROFILE(SMBsesssetupX);
1302
1303         ZERO_STRUCT(lm_resp);
1304         ZERO_STRUCT(nt_resp);
1305         ZERO_STRUCT(plaintext_password);
1306
1307         DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
1308
1309         /* a SPNEGO session setup has 12 command words, whereas a normal
1310            NT1 session setup has 13. See the cifs spec. */
1311         if (req->wct == 12 &&
1312             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
1313
1314                 if (!sconn->smb1.negprot.spnego) {
1315                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
1316                                  "at SPNEGO session setup when it was not "
1317                                  "negotiated.\n"));
1318                         reply_nterror(req, nt_status_squash(
1319                                               NT_STATUS_LOGON_FAILURE));
1320                         END_PROFILE(SMBsesssetupX);
1321                         return;
1322                 }
1323
1324                 if (SVAL(req->vwv+4, 0) == 0) {
1325                         setup_new_vc_session(req->sconn);
1326                 }
1327
1328                 reply_sesssetup_and_X_spnego(req);
1329                 END_PROFILE(SMBsesssetupX);
1330                 return;
1331         }
1332
1333         smb_bufsize = SVAL(req->vwv+2, 0);
1334
1335         if (get_Protocol() < PROTOCOL_NT1) {
1336                 uint16 passlen1 = SVAL(req->vwv+7, 0);
1337
1338                 /* Never do NT status codes with protocols before NT1 as we
1339                  * don't get client caps. */
1340                 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
1341
1342                 if ((passlen1 > MAX_PASS_LEN) || (passlen1 > req->buflen)) {
1343                         reply_nterror(req, nt_status_squash(
1344                                               NT_STATUS_INVALID_PARAMETER));
1345                         END_PROFILE(SMBsesssetupX);
1346                         return;
1347                 }
1348
1349                 if (doencrypt) {
1350                         lm_resp = data_blob(req->buf, passlen1);
1351                 } else {
1352                         plaintext_password = data_blob(req->buf, passlen1+1);
1353                         /* Ensure null termination */
1354                         plaintext_password.data[passlen1] = 0;
1355                 }
1356
1357                 srvstr_pull_req_talloc(talloc_tos(), req, &tmp,
1358                                        req->buf + passlen1, STR_TERMINATE);
1359                 user = tmp ? tmp : "";
1360
1361                 domain = "";
1362
1363         } else {
1364                 uint16 passlen1 = SVAL(req->vwv+7, 0);
1365                 uint16 passlen2 = SVAL(req->vwv+8, 0);
1366                 enum remote_arch_types ra_type = get_remote_arch();
1367                 const uint8_t *p = req->buf;
1368                 const uint8_t *save_p = req->buf;
1369                 uint16 byte_count;
1370
1371
1372                 if(global_client_caps == 0) {
1373                         global_client_caps = IVAL(req->vwv+11, 0);
1374
1375                         if (!(global_client_caps & CAP_STATUS32)) {
1376                                 remove_from_common_flags2(
1377                                                 FLAGS2_32_BIT_ERROR_CODES);
1378                         }
1379
1380                         /* client_caps is used as final determination if
1381                          * client is NT or Win95. This is needed to return
1382                          * the correct error codes in some circumstances.
1383                         */
1384
1385                         if(ra_type == RA_WINNT || ra_type == RA_WIN2K ||
1386                                         ra_type == RA_WIN95) {
1387                                 if(!(global_client_caps & (CAP_NT_SMBS|
1388                                                         CAP_STATUS32))) {
1389                                         set_remote_arch( RA_WIN95);
1390                                 }
1391                         }
1392                 }
1393
1394                 if (!doencrypt) {
1395                         /* both Win95 and WinNT stuff up the password
1396                          * lengths for non-encrypting systems. Uggh.
1397
1398                            if passlen1==24 its a win95 system, and its setting
1399                            the password length incorrectly. Luckily it still
1400                            works with the default code because Win95 will null
1401                            terminate the password anyway
1402
1403                            if passlen1>0 and passlen2>0 then maybe its a NT box
1404                            and its setting passlen2 to some random value which
1405                            really stuffs things up. we need to fix that one.  */
1406
1407                         if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 &&
1408                                         passlen2 != 1) {
1409                                 passlen2 = 0;
1410                         }
1411                 }
1412
1413                 /* check for nasty tricks */
1414                 if (passlen1 > MAX_PASS_LEN
1415                     || passlen1 > smbreq_bufrem(req, p)) {
1416                         reply_nterror(req, nt_status_squash(
1417                                               NT_STATUS_INVALID_PARAMETER));
1418                         END_PROFILE(SMBsesssetupX);
1419                         return;
1420                 }
1421
1422                 if (passlen2 > MAX_PASS_LEN
1423                     || passlen2 > smbreq_bufrem(req, p+passlen1)) {
1424                         reply_nterror(req, nt_status_squash(
1425                                               NT_STATUS_INVALID_PARAMETER));
1426                         END_PROFILE(SMBsesssetupX);
1427                         return;
1428                 }
1429
1430                 /* Save the lanman2 password and the NT md4 password. */
1431
1432                 if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
1433                         doencrypt = False;
1434                 }
1435
1436                 if (doencrypt) {
1437                         lm_resp = data_blob(p, passlen1);
1438                         nt_resp = data_blob(p+passlen1, passlen2);
1439                 } else if (lp_security() != SEC_SHARE) {
1440                         /*
1441                          * In share level we should ignore any passwords, so
1442                          * only read them if we're not.
1443                          */
1444                         char *pass = NULL;
1445                         bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
1446
1447                         if (unic && (passlen2 == 0) && passlen1) {
1448                                 /* Only a ascii plaintext password was sent. */
1449                                 (void)srvstr_pull_talloc(talloc_tos(),
1450                                                         req->inbuf,
1451                                                         req->flags2,
1452                                                         &pass,
1453                                                         req->buf,
1454                                                         passlen1,
1455                                                         STR_TERMINATE|STR_ASCII);
1456                         } else {
1457                                 (void)srvstr_pull_talloc(talloc_tos(),
1458                                                         req->inbuf,
1459                                                         req->flags2,
1460                                                         &pass,
1461                                                         req->buf,
1462                                                         unic ? passlen2 : passlen1,
1463                                                         STR_TERMINATE);
1464                         }
1465                         if (!pass) {
1466                                 reply_nterror(req, nt_status_squash(
1467                                               NT_STATUS_INVALID_PARAMETER));
1468                                 END_PROFILE(SMBsesssetupX);
1469                                 return;
1470                         }
1471                         plaintext_password = data_blob(pass, strlen(pass)+1);
1472                 }
1473
1474                 p += passlen1 + passlen2;
1475
1476                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1477                                             STR_TERMINATE);
1478                 user = tmp ? tmp : "";
1479
1480                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1481                                             STR_TERMINATE);
1482                 domain = tmp ? tmp : "";
1483
1484                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1485                                             STR_TERMINATE);
1486                 native_os = tmp ? tmp : "";
1487
1488                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1489                                             STR_TERMINATE);
1490                 native_lanman = tmp ? tmp : "";
1491
1492                 /* not documented or decoded by Ethereal but there is one more
1493                  * string in the extra bytes which is the same as the
1494                  * PrimaryDomain when using extended security.  Windows NT 4
1495                  * and 2003 use this string to store the native lanman string.
1496                  * Windows 9x does not include a string here at all so we have
1497                  * to check if we have any extra bytes left */
1498
1499                 byte_count = SVAL(req->vwv+13, 0);
1500                 if ( PTR_DIFF(p, save_p) < byte_count) {
1501                         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
1502                                                     STR_TERMINATE);
1503                         primary_domain = tmp ? tmp : "";
1504                 } else {
1505                         primary_domain = talloc_strdup(talloc_tos(), "null");
1506                 }
1507
1508                 DEBUG(3,("Domain=[%s]  NativeOS=[%s] NativeLanMan=[%s] "
1509                         "PrimaryDomain=[%s]\n",
1510                         domain, native_os, native_lanman, primary_domain));
1511
1512                 if ( ra_type == RA_WIN2K ) {
1513                         if ( strlen(native_lanman) == 0 )
1514                                 ra_lanman_string( primary_domain );
1515                         else
1516                                 ra_lanman_string( native_lanman );
1517                 }
1518
1519         }
1520
1521         if (SVAL(req->vwv+4, 0) == 0) {
1522                 setup_new_vc_session(req->sconn);
1523         }
1524
1525         DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
1526                                 domain, user, get_remote_machine_name()));
1527
1528         if (*user) {
1529                 if (sconn->smb1.negprot.spnego) {
1530
1531                         /* This has to be here, because this is a perfectly
1532                          * valid behaviour for guest logons :-( */
1533
1534                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
1535                                 "at 'normal' session setup after "
1536                                 "negotiating spnego.\n"));
1537                         reply_nterror(req, nt_status_squash(
1538                                               NT_STATUS_LOGON_FAILURE));
1539                         END_PROFILE(SMBsesssetupX);
1540                         return;
1541                 }
1542                 fstrcpy(sub_user, user);
1543         } else {
1544                 fstrcpy(sub_user, lp_guestaccount());
1545         }
1546
1547         sub_set_smb_name(sub_user);
1548
1549         reload_services(sconn->msg_ctx, sconn->sock, True);
1550
1551         if (lp_security() == SEC_SHARE) {
1552                 char *sub_user_mapped = NULL;
1553                 /* In share level we should ignore any passwords */
1554
1555                 data_blob_free(&lm_resp);
1556                 data_blob_free(&nt_resp);
1557                 data_blob_clear_free(&plaintext_password);
1558
1559                 (void)map_username(talloc_tos(), sub_user, &sub_user_mapped);
1560                 if (!sub_user_mapped) {
1561                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1562                         END_PROFILE(SMBsesssetupX);
1563                         return;
1564                 }
1565                 fstrcpy(sub_user, sub_user_mapped);
1566                 add_session_user(sconn, sub_user);
1567                 add_session_workgroup(sconn, domain);
1568                 /* Then force it to null for the benfit of the code below */
1569                 user = "";
1570         }
1571
1572         if (!*user) {
1573
1574                 nt_status = check_guest_password(sconn->remote_address, &server_info);
1575
1576         } else if (doencrypt) {
1577                 struct auth_context *negprot_auth_context = NULL;
1578                 negprot_auth_context = sconn->smb1.negprot.auth_context;
1579                 if (!negprot_auth_context) {
1580                         DEBUG(0, ("reply_sesssetup_and_X:  Attempted encrypted "
1581                                 "session setup without negprot denied!\n"));
1582                         reply_nterror(req, nt_status_squash(
1583                                               NT_STATUS_LOGON_FAILURE));
1584                         END_PROFILE(SMBsesssetupX);
1585                         return;
1586                 }
1587                 nt_status = make_user_info_for_reply_enc(&user_info, user,
1588                                                 domain,
1589                                                 sconn->remote_address,
1590                                                 lm_resp, nt_resp);
1591                 if (NT_STATUS_IS_OK(nt_status)) {
1592                         nt_status = negprot_auth_context->check_ntlm_password(
1593                                         negprot_auth_context,
1594                                         user_info,
1595                                         &server_info);
1596                 }
1597         } else {
1598                 struct auth_context *plaintext_auth_context = NULL;
1599
1600                 nt_status = make_auth_context_subsystem(
1601                         talloc_tos(), &plaintext_auth_context);
1602
1603                 if (NT_STATUS_IS_OK(nt_status)) {
1604                         uint8_t chal[8];
1605
1606                         plaintext_auth_context->get_ntlm_challenge(
1607                                         plaintext_auth_context, chal);
1608
1609                         if (!make_user_info_for_reply(&user_info,
1610                                                       user, domain,
1611                                                       sconn->remote_address,
1612                                                       chal,
1613                                                       plaintext_password)) {
1614                                 nt_status = NT_STATUS_NO_MEMORY;
1615                         }
1616
1617                         if (NT_STATUS_IS_OK(nt_status)) {
1618                                 nt_status = plaintext_auth_context->check_ntlm_password(
1619                                                 plaintext_auth_context,
1620                                                 user_info,
1621                                                 &server_info);
1622
1623                                 TALLOC_FREE(plaintext_auth_context);
1624                         }
1625                 }
1626         }
1627
1628         free_user_info(&user_info);
1629
1630         if (!NT_STATUS_IS_OK(nt_status)) {
1631                 nt_status = do_map_to_guest_server_info(nt_status, &server_info,
1632                                                         user, domain);
1633         }
1634
1635         if (!NT_STATUS_IS_OK(nt_status)) {
1636                 data_blob_free(&nt_resp);
1637                 data_blob_free(&lm_resp);
1638                 data_blob_clear_free(&plaintext_password);
1639                 reply_nterror(req, nt_status_squash(nt_status));
1640                 END_PROFILE(SMBsesssetupX);
1641                 return;
1642         }
1643
1644         nt_status = create_local_token(req, server_info, NULL, &session_info);
1645         TALLOC_FREE(server_info);
1646
1647         if (!NT_STATUS_IS_OK(nt_status)) {
1648                 DEBUG(10, ("create_local_token failed: %s\n",
1649                            nt_errstr(nt_status)));
1650                 data_blob_free(&nt_resp);
1651                 data_blob_free(&lm_resp);
1652                 data_blob_clear_free(&plaintext_password);
1653                 reply_nterror(req, nt_status_squash(nt_status));
1654                 END_PROFILE(SMBsesssetupX);
1655                 return;
1656         }
1657
1658         data_blob_clear_free(&plaintext_password);
1659
1660         /* it's ok - setup a reply */
1661         reply_outbuf(req, 3, 0);
1662         if (get_Protocol() >= PROTOCOL_NT1) {
1663                 push_signature(&req->outbuf);
1664                 /* perhaps grab OS version here?? */
1665         }
1666
1667         if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
1668                 SSVAL(req->outbuf,smb_vwv2,1);
1669         }
1670
1671         /* register the name and uid as being validated, so further connections
1672            to a uid can get through without a password, on the same VC */
1673
1674         if (lp_security() == SEC_SHARE) {
1675                 sess_vuid = UID_FIELD_INVALID;
1676                 TALLOC_FREE(session_info);
1677         } else {
1678                 /* Ignore the initial vuid. */
1679                 sess_vuid = register_initial_vuid(sconn);
1680                 if (sess_vuid == UID_FIELD_INVALID) {
1681                         data_blob_free(&nt_resp);
1682                         data_blob_free(&lm_resp);
1683                         reply_nterror(req, nt_status_squash(
1684                                               NT_STATUS_LOGON_FAILURE));
1685                         END_PROFILE(SMBsesssetupX);
1686                         return;
1687                 }
1688                 /* register_existing_vuid keeps the session_info */
1689                 sess_vuid = register_existing_vuid(sconn, sess_vuid,
1690                                         session_info,
1691                                         nt_resp.data ? nt_resp : lm_resp,
1692                                         sub_user);
1693                 if (sess_vuid == UID_FIELD_INVALID) {
1694                         data_blob_free(&nt_resp);
1695                         data_blob_free(&lm_resp);
1696                         reply_nterror(req, nt_status_squash(
1697                                               NT_STATUS_LOGON_FAILURE));
1698                         END_PROFILE(SMBsesssetupX);
1699                         return;
1700                 }
1701
1702                 /* current_user_info is changed on new vuid */
1703                 reload_services(sconn->msg_ctx, sconn->sock, True);
1704         }
1705
1706         data_blob_free(&nt_resp);
1707         data_blob_free(&lm_resp);
1708
1709         SSVAL(req->outbuf,smb_uid,sess_vuid);
1710         SSVAL(discard_const_p(char, req->inbuf),smb_uid,sess_vuid);
1711         req->vuid = sess_vuid;
1712
1713         if (!sconn->smb1.sessions.done_sesssetup) {
1714                 sconn->smb1.sessions.max_send =
1715                         MIN(sconn->smb1.sessions.max_send,smb_bufsize);
1716         }
1717         sconn->smb1.sessions.done_sesssetup = true;
1718
1719         END_PROFILE(SMBsesssetupX);
1720         chain_reply(req);
1721         return;
1722 }