source3/smbd/sesssetup.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    handle SMBsessionsetup
   4    Copyright (C) Andrew Tridgell 1998-2001
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
   7    Copyright (C) Luke Howard          2003
   8    Copyright (C) Volker Lendecke      2007
   9    Copyright (C) Jeremy Allison       2007
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "lib/util/server_id.h"
  28 #include "smbd/smbd.h"
  29 #include "smbd/globals.h"
  30 #include "auth.h"
  31 #include "messages.h"
  32 #include "smbprofile.h"
  33 #include "../libcli/security/security.h"
  34 #include "auth/gensec/gensec.h"
  35 #include "lib/conn_tdb.h"
  36 #include "../libcli/smb/smb_signing.h"
  37
  38 /****************************************************************************
  39  Add the standard 'Samba' signature to the end of the session setup.
  40 ****************************************************************************/
  41
  42 static int push_signature(uint8_t **outbuf)
  43 {
  44         char *lanman;
  45         int result, tmp;
  46         fstring native_os;
  47
  48         result = 0;
  49
  50         fstr_sprintf(native_os, "Windows %d.%d", SAMBA_MAJOR_NBT_ANNOUNCE_VERSION,
  51                 SAMBA_MINOR_NBT_ANNOUNCE_VERSION);
  52
  53         tmp = message_push_string(outbuf, native_os, STR_TERMINATE);
  54
  55         if (tmp == -1) return -1;
  56         result += tmp;
  57
  58         if (asprintf(&lanman, "Samba %s", samba_version_string()) != -1) {
  59                 tmp = message_push_string(outbuf, lanman, STR_TERMINATE);
  60                 SAFE_FREE(lanman);
  61         }
  62         else {
  63                 tmp = message_push_string(outbuf, "Samba", STR_TERMINATE);
  64         }
  65
  66         if (tmp == -1) return -1;
  67         result += tmp;
  68
  69         tmp = message_push_string(outbuf, lp_workgroup(), STR_TERMINATE);
  70
  71         if (tmp == -1) return -1;
  72         result += tmp;
  73
  74         return result;
  75 }
  76
  77 /****************************************************************************
  78  Reply to a session setup command.
  79  conn POINTER CAN BE NULL HERE !
  80 ****************************************************************************/
  81
  82 static void reply_sesssetup_and_X_spnego(struct smb_request *req)
  83 {
  84         const uint8_t *p;
  85         DATA_BLOB in_blob;
  86         DATA_BLOB out_blob = data_blob_null;
  87         size_t bufrem;
  88         char *tmp;
  89         const char *native_os;
  90         const char *native_lanman;
  91         const char *primary_domain;
  92         uint16_t data_blob_len = SVAL(req->vwv+7, 0);
  93         enum remote_arch_types ra_type = get_remote_arch();
  94         uint64_t vuid = req->vuid;
  95         NTSTATUS status = NT_STATUS_OK;
  96         struct smbXsrv_connection *xconn = req->xconn;
  97         struct smbd_server_connection *sconn = req->sconn;
  98         uint16_t action = 0;
  99         bool is_authenticated = false;
 100         NTTIME now = timeval_to_nttime(&req->request_time);
 101         struct smbXsrv_session *session = NULL;
 102         uint16_t smb_bufsize = SVAL(req->vwv+2, 0);
 103         uint32_t client_caps = IVAL(req->vwv+10, 0);
 104         struct smbXsrv_session_auth0 *auth;
 105
 106         DEBUG(3,("Doing spnego session setup\n"));
 107
 108         if (!xconn->smb1.sessions.done_sesssetup) {
 109                 global_client_caps = client_caps;
 110
 111                 if (!(global_client_caps & CAP_STATUS32)) {
 112                         remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
 113                 }
 114         }
 115
 116         p = req->buf;
 117
 118         if (data_blob_len == 0) {
 119                 /* an invalid request */
 120                 reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
 121                 return;
 122         }
 123
 124         bufrem = smbreq_bufrem(req, p);
 125         /* pull the spnego blob */
 126         in_blob = data_blob_const(p, MIN(bufrem, data_blob_len));
 127
 128 #if 0
 129         file_save("negotiate.dat", in_blob.data, in_blob.length);
 130 #endif
 131
 132         p = req->buf + in_blob.length;
 133
 134         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 135                                      STR_TERMINATE);
 136         native_os = tmp ? tmp : "";
 137
 138         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 139                                      STR_TERMINATE);
 140         native_lanman = tmp ? tmp : "";
 141
 142         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 143                                      STR_TERMINATE);
 144         primary_domain = tmp ? tmp : "";
 145
 146         DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
 147                 native_os, native_lanman, primary_domain));
 148
 149         if ( ra_type == RA_WIN2K ) {
 150                 /* Vista sets neither the OS or lanman strings */
 151
 152                 if ( !strlen(native_os) && !strlen(native_lanman) )
 153                         set_remote_arch(RA_VISTA);
 154
 155                 /* Windows 2003 doesn't set the native lanman string,
 156                    but does set primary domain which is a bug I think */
 157
 158                 if ( !strlen(native_lanman) ) {
 159                         ra_lanman_string( primary_domain );
 160                 } else {
 161                         ra_lanman_string( native_lanman );
 162                 }
 163         } else if ( ra_type == RA_VISTA ) {
 164                 if ( strncmp(native_os, "Mac OS X", 8) == 0 ) {
 165                         set_remote_arch(RA_OSX);
 166                 }
 167         }
 168
 169         if (vuid != 0) {
 170                 status = smb1srv_session_lookup(xconn,
 171                                                 vuid, now,
 172                                                 &session);
 173                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
 174                         reply_force_doserror(req, ERRSRV, ERRbaduid);
 175                         return;
 176                 }
 177                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 178                         status = NT_STATUS_OK;
 179                 }
 180                 if (NT_STATUS_IS_OK(status)) {
 181                         session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 182                         status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 183                         TALLOC_FREE(session->pending_auth);
 184                 }
 185                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 186                         reply_nterror(req, nt_status_squash(status));
 187                         return;
 188                 }
 189         }
 190
 191         if (session == NULL) {
 192                 /* create a new session */
 193                 status = smbXsrv_session_create(xconn,
 194                                                 now, &session);
 195                 if (!NT_STATUS_IS_OK(status)) {
 196                         reply_nterror(req, nt_status_squash(status));
 197                         return;
 198                 }
 199         }
 200
 201         status = smbXsrv_session_find_auth(session, xconn, now, &auth);
 202         if (!NT_STATUS_IS_OK(status)) {
 203                 status = smbXsrv_session_create_auth(session, xconn, now,
 204                                                      0, /* flags */
 205                                                      0, /* security */
 206                                                      &auth);
 207                 if (!NT_STATUS_IS_OK(status)) {
 208                         reply_nterror(req, nt_status_squash(status));
 209                         return;
 210                 }
 211         }
 212
 213         if (auth->gensec == NULL) {
 214                 status = auth_generic_prepare(session,
 215                                               xconn->remote_address,
 216                                               xconn->local_address,
 217                                               "SMB",
 218                                               &auth->gensec);
 219                 if (!NT_STATUS_IS_OK(status)) {
 220                         TALLOC_FREE(session);
 221                         reply_nterror(req, nt_status_squash(status));
 222                         return;
 223                 }
 224
 225                 gensec_want_feature(auth->gensec, GENSEC_FEATURE_SESSION_KEY);
 226                 gensec_want_feature(auth->gensec, GENSEC_FEATURE_UNIX_TOKEN);
 227                 gensec_want_feature(auth->gensec, GENSEC_FEATURE_SMB_TRANSPORT);
 228
 229                 status = gensec_start_mech_by_oid(auth->gensec,
 230                                                   GENSEC_OID_SPNEGO);
 231                 if (!NT_STATUS_IS_OK(status)) {
 232                         DEBUG(0, ("Failed to start SPNEGO handler!\n"));
 233                         TALLOC_FREE(session);;
 234                         reply_nterror(req, nt_status_squash(status));
 235                         return;
 236                 }
 237         }
 238
 239         become_root();
 240         status = gensec_update(auth->gensec,
 241                                talloc_tos(),
 242                                in_blob, &out_blob);
 243         unbecome_root();
 244         if (!NT_STATUS_IS_OK(status) &&
 245             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 246                 TALLOC_FREE(session);
 247                 reply_nterror(req, nt_status_squash(status));
 248                 return;
 249         }
 250
 251         if (NT_STATUS_IS_OK(status) && session->global->auth_session_info == NULL) {
 252                 struct auth_session_info *session_info = NULL;
 253
 254                 status = gensec_session_info(auth->gensec,
 255                                              session,
 256                                              &session_info);
 257                 if (!NT_STATUS_IS_OK(status)) {
 258                         DEBUG(1,("Failed to generate session_info "
 259                                  "(user and group token) for session setup: %s\n",
 260                                  nt_errstr(status)));
 261                         data_blob_free(&out_blob);
 262                         TALLOC_FREE(session);
 263                         reply_nterror(req, nt_status_squash(status));
 264                         return;
 265                 }
 266
 267                 if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
 268                         action |= SMB_SETUP_GUEST;
 269                 }
 270
 271                 if (session_info->session_key.length > 0) {
 272                         struct smbXsrv_session *x = session;
 273
 274                         /*
 275                          * Note: the SMB1 signing key is not truncated to 16 byte!
 276                          */
 277                         x->global->signing_key =
 278                                 data_blob_dup_talloc(x->global,
 279                                                      session_info->session_key);
 280                         if (x->global->signing_key.data == NULL) {
 281                                 data_blob_free(&out_blob);
 282                                 TALLOC_FREE(session);
 283                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 284                                 return;
 285                         }
 286
 287                         /*
 288                          * clear the session key
 289                          * the first tcon will add setup the application key
 290                          */
 291                         data_blob_clear_free(&session_info->session_key);
 292                 }
 293
 294                 session->compat = talloc_zero(session, struct user_struct);
 295                 if (session->compat == NULL) {
 296                         data_blob_free(&out_blob);
 297                         TALLOC_FREE(session);
 298                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 299                         return;
 300                 }
 301                 session->compat->session = session;
 302                 session->compat->homes_snum = -1;
 303                 session->compat->session_info = session_info;
 304                 session->compat->session_keystr = NULL;
 305                 session->compat->vuid = session->global->session_wire_id;
 306                 DLIST_ADD(sconn->users, session->compat);
 307                 sconn->num_users++;
 308
 309                 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
 310                         is_authenticated = true;
 311                         session->compat->homes_snum =
 312                                 register_homes_share(session_info->unix_info->unix_name);
 313                 }
 314
 315                 if (srv_is_signing_negotiated(xconn) &&
 316                     is_authenticated &&
 317                     session->global->signing_key.length > 0)
 318                 {
 319                         /*
 320                          * Try and turn on server signing on the first non-guest
 321                          * sessionsetup.
 322                          */
 323                         srv_set_signing(xconn,
 324                                 session->global->signing_key,
 325                                 data_blob_null);
 326                 }
 327
 328                 set_current_user_info(session_info->unix_info->sanitized_username,
 329                                       session_info->unix_info->unix_name,
 330                                       session_info->info->domain_name);
 331
 332                 session->status = NT_STATUS_OK;
 333                 session->global->auth_session_info = talloc_move(session->global,
 334                                                                  &session_info);
 335                 session->global->auth_session_info_seqnum += 1;
 336                 session->global->channels[0].auth_session_info_seqnum =
 337                         session->global->auth_session_info_seqnum;
 338                 session->global->auth_time = now;
 339                 if (client_caps & CAP_DYNAMIC_REAUTH) {
 340                         session->global->expiration_time =
 341                                 gensec_expire_time(auth->gensec);
 342                 } else {
 343                         session->global->expiration_time =
 344                                 GENSEC_EXPIRE_TIME_INFINITY;
 345                 }
 346
 347                 if (!session_claim(session)) {
 348                         DEBUG(1, ("smb1: Failed to claim session for vuid=%llu\n",
 349                                   (unsigned long long)session->compat->vuid));
 350                         data_blob_free(&out_blob);
 351                         TALLOC_FREE(session);
 352                         reply_nterror(req, NT_STATUS_LOGON_FAILURE);
 353                         return;
 354                 }
 355
 356                 status = smbXsrv_session_update(session);
 357                 if (!NT_STATUS_IS_OK(status)) {
 358                         DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
 359                                   (unsigned long long)session->compat->vuid,
 360                                   nt_errstr(status)));
 361                         data_blob_free(&out_blob);
 362                         TALLOC_FREE(session);
 363                         reply_nterror(req, NT_STATUS_LOGON_FAILURE);
 364                         return;
 365                 }
 366
 367                 if (!xconn->smb1.sessions.done_sesssetup) {
 368                         if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
 369                                 reply_force_doserror(req, ERRSRV, ERRerror);
 370                                 return;
 371                         }
 372                         xconn->smb1.sessions.max_send = smb_bufsize;
 373                         xconn->smb1.sessions.done_sesssetup = true;
 374                 }
 375
 376                 /* current_user_info is changed on new vuid */
 377                 reload_services(sconn, conn_snum_used, true);
 378         } else if (NT_STATUS_IS_OK(status)) {
 379                 struct auth_session_info *session_info = NULL;
 380
 381                 status = gensec_session_info(auth->gensec,
 382                                              session,
 383                                              &session_info);
 384                 if (!NT_STATUS_IS_OK(status)) {
 385                         DEBUG(1,("Failed to generate session_info "
 386                                  "(user and group token) for session setup: %s\n",
 387                                  nt_errstr(status)));
 388                         data_blob_free(&out_blob);
 389                         TALLOC_FREE(session);
 390                         reply_nterror(req, nt_status_squash(status));
 391                         return;
 392                 }
 393
 394                 if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
 395                         action |= SMB_SETUP_GUEST;
 396                 }
 397
 398                 /*
 399                  * Keep the application key
 400                  */
 401                 data_blob_clear_free(&session_info->session_key);
 402                 session_info->session_key =
 403                         session->global->auth_session_info->session_key;
 404                 talloc_steal(session_info, session_info->session_key.data);
 405                 TALLOC_FREE(session->global->auth_session_info);
 406
 407                 session->compat->session_info = session_info;
 408
 409                 session->compat->vuid = session->global->session_wire_id;
 410
 411                 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
 412                         session->compat->homes_snum =
 413                                 register_homes_share(session_info->unix_info->unix_name);
 414                 }
 415
 416                 set_current_user_info(session_info->unix_info->sanitized_username,
 417                                       session_info->unix_info->unix_name,
 418                                       session_info->info->domain_name);
 419
 420                 session->status = NT_STATUS_OK;
 421                 session->global->auth_session_info = talloc_move(session->global,
 422                                                                  &session_info);
 423                 session->global->auth_session_info_seqnum += 1;
 424                 session->global->channels[0].auth_session_info_seqnum =
 425                         session->global->auth_session_info_seqnum;
 426                 session->global->auth_time = now;
 427                 if (client_caps & CAP_DYNAMIC_REAUTH) {
 428                         session->global->expiration_time =
 429                                 gensec_expire_time(auth->gensec);
 430                 } else {
 431                         session->global->expiration_time =
 432                                 GENSEC_EXPIRE_TIME_INFINITY;
 433                 }
 434
 435                 status = smbXsrv_session_update(session);
 436                 if (!NT_STATUS_IS_OK(status)) {
 437                         DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
 438                                   (unsigned long long)session->compat->vuid,
 439                                   nt_errstr(status)));
 440                         data_blob_free(&out_blob);
 441                         TALLOC_FREE(session);
 442                         reply_nterror(req, NT_STATUS_LOGON_FAILURE);
 443                         return;
 444                 }
 445
 446                 conn_clear_vuid_caches(sconn, session->compat->vuid);
 447
 448                 /* current_user_info is changed on new vuid */
 449                 reload_services(sconn, conn_snum_used, true);
 450         }
 451
 452         vuid = session->global->session_wire_id;
 453
 454         reply_outbuf(req, 4, 0);
 455
 456         SSVAL(req->outbuf, smb_uid, vuid);
 457         SIVAL(req->outbuf, smb_rcls, NT_STATUS_V(status));
 458         SSVAL(req->outbuf, smb_vwv0, 0xFF); /* no chaining possible */
 459         SSVAL(req->outbuf, smb_vwv2, action);
 460         SSVAL(req->outbuf, smb_vwv3, out_blob.length);
 461
 462         if (message_push_blob(&req->outbuf, out_blob) == -1) {
 463                 data_blob_free(&out_blob);
 464                 TALLOC_FREE(session);
 465                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 466                 return;
 467         }
 468         data_blob_free(&out_blob);
 469
 470         if (push_signature(&req->outbuf) == -1) {
 471                 TALLOC_FREE(session);
 472                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 473                 return;
 474         }
 475 }
 476
 477 /****************************************************************************
 478  On new VC == 0, shutdown *all* old connections and users.
 479  It seems that only NT4.x does this. At W2K and above (XP etc.).
 480  a new session setup with VC==0 is ignored.
 481 ****************************************************************************/
 482
 483 struct shutdown_state {
 484         const char *ip;
 485         struct messaging_context *msg_ctx;
 486 };
 487
 488 static int shutdown_other_smbds(struct smbXsrv_session_global0 *session,
 489                                 void *private_data)
 490 {
 491         struct shutdown_state *state = (struct shutdown_state *)private_data;
 492         struct server_id self_pid = messaging_server_id(state->msg_ctx);
 493         struct server_id pid = session->channels[0].server_id;
 494         const char *addr = session->channels[0].remote_address;
 495         struct server_id_buf tmp;
 496
 497         DEBUG(10, ("shutdown_other_smbds: %s, %s\n",
 498                    server_id_str_buf(pid, &tmp), addr));
 499
 500         if (!process_exists(pid)) {
 501                 DEBUG(10, ("process does not exist\n"));
 502                 return 0;
 503         }
 504
 505         if (serverid_equal(&pid, &self_pid)) {
 506                 DEBUG(10, ("It's me\n"));
 507                 return 0;
 508         }
 509
 510         /*
 511          * here we use strstr() because 'addr'
 512          * (session->channels[0].remote_address)
 513          * contains a string like:
 514          * 'ipv4:127.0.0.1:48163'
 515          */
 516         if (strstr(addr, state->ip)  == NULL) {
 517                 DEBUG(10, ("%s does not match %s\n", state->ip, addr));
 518                 return 0;
 519         }
 520
 521         DEBUG(1, ("shutdown_other_smbds: shutting down pid %u "
 522                   "(IP %s)\n", (unsigned int)procid_to_pid(&pid),
 523                   state->ip));
 524
 525         messaging_send(state->msg_ctx, pid, MSG_SHUTDOWN,
 526                        &data_blob_null);
 527         return 0;
 528 }
 529
 530 static void setup_new_vc_session(struct smbd_server_connection *sconn)
 531 {
 532         DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x "
 533                 "compatible we would close all old resources.\n"));
 534 #if 0
 535         conn_close_all();
 536         invalidate_all_vuids();
 537 #endif
 538         if (lp_reset_on_zero_vc()) {
 539                 char *addr;
 540                 struct shutdown_state state;
 541
 542                 addr = tsocket_address_inet_addr_string(
 543                         sconn->remote_address, talloc_tos());
 544                 if (addr == NULL) {
 545                         return;
 546                 }
 547                 state.ip = addr;
 548                 state.msg_ctx = sconn->msg_ctx;
 549                 smbXsrv_session_global_traverse(shutdown_other_smbds, &state);
 550                 TALLOC_FREE(addr);
 551         }
 552 }
 553
 554 /****************************************************************************
 555  Reply to a session setup command.
 556 ****************************************************************************/
 557
 558 struct reply_sesssetup_and_X_state {
 559         struct smb_request *req;
 560         struct auth4_context *auth_context;
 561         struct auth_usersupplied_info *user_info;
 562         const char *user;
 563         const char *domain;
 564         DATA_BLOB lm_resp;
 565         DATA_BLOB nt_resp;
 566         DATA_BLOB plaintext_password;
 567 };
 568
 569 static int reply_sesssetup_and_X_state_destructor(
 570                 struct reply_sesssetup_and_X_state *state)
 571 {
 572         data_blob_clear_free(&state->nt_resp);
 573         data_blob_clear_free(&state->lm_resp);
 574         data_blob_clear_free(&state->plaintext_password);
 575         return 0;
 576 }
 577
 578 void reply_sesssetup_and_X(struct smb_request *req)
 579 {
 580         struct reply_sesssetup_and_X_state *state = NULL;
 581         uint64_t sess_vuid;
 582         uint16_t smb_bufsize;
 583         char *tmp;
 584         fstring sub_user; /* Sanitised username for substituion */
 585         const char *native_os;
 586         const char *native_lanman;
 587         const char *primary_domain;
 588         struct auth_session_info *session_info = NULL;
 589         uint16_t smb_flag2 = req->flags2;
 590         uint16_t action = 0;
 591         bool is_authenticated = false;
 592         NTTIME now = timeval_to_nttime(&req->request_time);
 593         struct smbXsrv_session *session = NULL;
 594         NTSTATUS nt_status;
 595         struct smbXsrv_connection *xconn = req->xconn;
 596         struct smbd_server_connection *sconn = req->sconn;
 597         bool doencrypt = xconn->smb1.negprot.encrypted_passwords;
 598         bool signing_allowed = false;
 599         bool signing_mandatory = smb_signing_is_mandatory(
 600                 xconn->smb1.signing_state);
 601
 602         START_PROFILE(SMBsesssetupX);
 603
 604         DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
 605
 606         state = talloc_zero(req, struct reply_sesssetup_and_X_state);
 607         if (state == NULL) {
 608                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 609                 END_PROFILE(SMBsesssetupX);
 610                 return;
 611         }
 612         state->req = req;
 613         talloc_set_destructor(state, reply_sesssetup_and_X_state_destructor);
 614
 615         if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES) {
 616                 signing_allowed = true;
 617         }
 618         if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) {
 619                 signing_mandatory = true;
 620         }
 621
 622         /*
 623          * We can call srv_set_signing_negotiated() each time.
 624          * It finds out when it needs to turn into a noop
 625          * itself.
 626          */
 627         srv_set_signing_negotiated(xconn,
 628                                    signing_allowed,
 629                                    signing_mandatory);
 630
 631         /* a SPNEGO session setup has 12 command words, whereas a normal
 632            NT1 session setup has 13. See the cifs spec. */
 633         if (req->wct == 12 &&
 634             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
 635
 636                 if (!xconn->smb1.negprot.spnego) {
 637                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
 638                                  "at SPNEGO session setup when it was not "
 639                                  "negotiated.\n"));
 640                         reply_nterror(req, nt_status_squash(
 641                                               NT_STATUS_LOGON_FAILURE));
 642                         END_PROFILE(SMBsesssetupX);
 643                         return;
 644                 }
 645
 646                 if (SVAL(req->vwv+4, 0) == 0) {
 647                         setup_new_vc_session(req->sconn);
 648                 }
 649
 650                 reply_sesssetup_and_X_spnego(req);
 651                 END_PROFILE(SMBsesssetupX);
 652                 return;
 653         }
 654
 655         smb_bufsize = SVAL(req->vwv+2, 0);
 656
 657         if (get_Protocol() < PROTOCOL_NT1) {
 658                 uint16_t passlen1 = SVAL(req->vwv+7, 0);
 659
 660                 /* Never do NT status codes with protocols before NT1 as we
 661                  * don't get client caps. */
 662                 remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
 663
 664                 if ((passlen1 > MAX_PASS_LEN) || (passlen1 > req->buflen)) {
 665                         reply_nterror(req, nt_status_squash(
 666                                               NT_STATUS_INVALID_PARAMETER));
 667                         END_PROFILE(SMBsesssetupX);
 668                         return;
 669                 }
 670
 671                 if (doencrypt) {
 672                         state->lm_resp = data_blob_talloc(state,
 673                                                           req->buf,
 674                                                           passlen1);
 675                 } else {
 676                         state->plaintext_password = data_blob_talloc(state,
 677                                                                 req->buf,
 678                                                                 passlen1+1);
 679                         /* Ensure null termination */
 680                         state->plaintext_password.data[passlen1] = 0;
 681                 }
 682
 683                 srvstr_pull_req_talloc(state, req, &tmp,
 684                                        req->buf + passlen1, STR_TERMINATE);
 685                 state->user = tmp ? tmp : "";
 686
 687                 state->domain = "";
 688
 689         } else {
 690                 uint16_t passlen1 = SVAL(req->vwv+7, 0);
 691                 uint16_t passlen2 = SVAL(req->vwv+8, 0);
 692                 enum remote_arch_types ra_type = get_remote_arch();
 693                 const uint8_t *p = req->buf;
 694                 const uint8_t *save_p = req->buf;
 695                 uint16_t byte_count;
 696
 697                 if (!xconn->smb1.sessions.done_sesssetup) {
 698                         global_client_caps = IVAL(req->vwv+11, 0);
 699
 700                         if (!(global_client_caps & CAP_STATUS32)) {
 701                                 remove_from_common_flags2(
 702                                                 FLAGS2_32_BIT_ERROR_CODES);
 703                         }
 704
 705                         /* client_caps is used as final determination if
 706                          * client is NT or Win95. This is needed to return
 707                          * the correct error codes in some circumstances.
 708                         */
 709
 710                         if(ra_type == RA_WINNT || ra_type == RA_WIN2K ||
 711                                         ra_type == RA_WIN95) {
 712                                 if(!(global_client_caps & (CAP_NT_SMBS|
 713                                                         CAP_STATUS32))) {
 714                                         set_remote_arch( RA_WIN95);
 715                                 }
 716                         }
 717                 }
 718
 719                 if (!doencrypt) {
 720                         /* both Win95 and WinNT stuff up the password
 721                          * lengths for non-encrypting systems. Uggh.
 722
 723                            if passlen1==24 its a win95 system, and its setting
 724                            the password length incorrectly. Luckily it still
 725                            works with the default code because Win95 will null
 726                            terminate the password anyway
 727
 728                            if passlen1>0 and passlen2>0 then maybe its a NT box
 729                            and its setting passlen2 to some random value which
 730                            really stuffs things up. we need to fix that one.  */
 731
 732                         if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 &&
 733                                         passlen2 != 1) {
 734                                 passlen2 = 0;
 735                         }
 736                 }
 737
 738                 /* check for nasty tricks */
 739                 if (passlen1 > MAX_PASS_LEN
 740                     || passlen1 > smbreq_bufrem(req, p)) {
 741                         reply_nterror(req, nt_status_squash(
 742                                               NT_STATUS_INVALID_PARAMETER));
 743                         END_PROFILE(SMBsesssetupX);
 744                         return;
 745                 }
 746
 747                 if (passlen2 > MAX_PASS_LEN
 748                     || passlen2 > smbreq_bufrem(req, p+passlen1)) {
 749                         reply_nterror(req, nt_status_squash(
 750                                               NT_STATUS_INVALID_PARAMETER));
 751                         END_PROFILE(SMBsesssetupX);
 752                         return;
 753                 }
 754
 755                 /* Save the lanman2 password and the NT md4 password. */
 756
 757                 if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
 758                         doencrypt = False;
 759                 }
 760
 761                 if (doencrypt) {
 762                         state->lm_resp = data_blob_talloc(state, p, passlen1);
 763                         state->nt_resp = data_blob_talloc(state, p+passlen1, passlen2);
 764                 } else {
 765                         char *pass = NULL;
 766                         bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
 767
 768                         if (unic && (passlen2 == 0) && passlen1) {
 769                                 /* Only a ascii plaintext password was sent. */
 770                                 (void)srvstr_pull_talloc(state,
 771                                                         req->inbuf,
 772                                                         req->flags2,
 773                                                         &pass,
 774                                                         req->buf,
 775                                                         passlen1,
 776                                                         STR_TERMINATE|STR_ASCII);
 777                         } else {
 778                                 (void)srvstr_pull_talloc(state,
 779                                                         req->inbuf,
 780                                                         req->flags2,
 781                                                         &pass,
 782                                                         req->buf,
 783                                                         unic ? passlen2 : passlen1,
 784                                                         STR_TERMINATE);
 785                         }
 786                         if (!pass) {
 787                                 reply_nterror(req, nt_status_squash(
 788                                               NT_STATUS_INVALID_PARAMETER));
 789                                 END_PROFILE(SMBsesssetupX);
 790                                 return;
 791                         }
 792                         state->plaintext_password = data_blob_talloc(state,
 793                                                                 pass,
 794                                                                 strlen(pass)+1);
 795                 }
 796
 797                 p += passlen1 + passlen2;
 798
 799                 p += srvstr_pull_req_talloc(state, req, &tmp, p,
 800                                             STR_TERMINATE);
 801                 state->user = tmp ? tmp : "";
 802
 803                 p += srvstr_pull_req_talloc(state, req, &tmp, p,
 804                                             STR_TERMINATE);
 805                 state->domain = tmp ? tmp : "";
 806
 807                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 808                                             STR_TERMINATE);
 809                 native_os = tmp ? tmp : "";
 810
 811                 p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 812                                             STR_TERMINATE);
 813                 native_lanman = tmp ? tmp : "";
 814
 815                 /* not documented or decoded by Ethereal but there is one more
 816                  * string in the extra bytes which is the same as the
 817                  * PrimaryDomain when using extended security.  Windows NT 4
 818                  * and 2003 use this string to store the native lanman string.
 819                  * Windows 9x does not include a string here at all so we have
 820                  * to check if we have any extra bytes left */
 821
 822                 byte_count = SVAL(req->vwv+13, 0);
 823                 if ( PTR_DIFF(p, save_p) < byte_count) {
 824                         p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
 825                                                     STR_TERMINATE);
 826                         primary_domain = tmp ? tmp : "";
 827                 } else {
 828                         primary_domain = talloc_strdup(talloc_tos(), "null");
 829                 }
 830
 831                 DEBUG(3,("Domain=[%s]  NativeOS=[%s] NativeLanMan=[%s] "
 832                         "PrimaryDomain=[%s]\n",
 833                         state->domain, native_os, native_lanman, primary_domain));
 834
 835                 if ( ra_type == RA_WIN2K ) {
 836                         if ( strlen(native_lanman) == 0 )
 837                                 ra_lanman_string( primary_domain );
 838                         else
 839                                 ra_lanman_string( native_lanman );
 840                 }
 841
 842         }
 843
 844         if (SVAL(req->vwv+4, 0) == 0) {
 845                 setup_new_vc_session(req->sconn);
 846         }
 847
 848         DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
 849                  state->domain, state->user, get_remote_machine_name()));
 850
 851         if (*state->user) {
 852                 if (xconn->smb1.negprot.spnego) {
 853
 854                         /* This has to be here, because this is a perfectly
 855                          * valid behaviour for guest logons :-( */
 856
 857                         DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
 858                                 "at 'normal' session setup after "
 859                                 "negotiating spnego.\n"));
 860                         reply_nterror(req, nt_status_squash(
 861                                               NT_STATUS_LOGON_FAILURE));
 862                         END_PROFILE(SMBsesssetupX);
 863                         return;
 864                 }
 865                 fstrcpy(sub_user, state->user);
 866         } else {
 867                 fstrcpy(sub_user, "");
 868         }
 869
 870         sub_set_smb_name(sub_user);
 871
 872         reload_services(sconn, conn_snum_used, true);
 873
 874         if (!*state->user) {
 875                 DEBUG(3,("Got anonymous request\n"));
 876
 877                 nt_status = make_auth4_context(state, &state->auth_context);
 878                 if (NT_STATUS_IS_OK(nt_status)) {
 879                         uint8_t chal[8];
 880
 881                         state->auth_context->get_ntlm_challenge(
 882                                         state->auth_context, chal);
 883
 884                         if (!make_user_info_guest(state,
 885                                                   sconn->remote_address,
 886                                                   sconn->local_address,
 887                                                   "SMB", &state->user_info)) {
 888                                 nt_status =  NT_STATUS_NO_MEMORY;
 889                         }
 890
 891                         if (NT_STATUS_IS_OK(nt_status)) {
 892                                 state->user_info->auth_description = "guest";
 893                         }
 894                 }
 895         } else if (doencrypt) {
 896                 state->auth_context = xconn->smb1.negprot.auth_context;
 897                 if (state->auth_context == NULL) {
 898                         DEBUG(0, ("reply_sesssetup_and_X:  Attempted encrypted "
 899                                 "session setup without negprot denied!\n"));
 900                         reply_nterror(req, nt_status_squash(
 901                                               NT_STATUS_LOGON_FAILURE));
 902                         END_PROFILE(SMBsesssetupX);
 903                         return;
 904                 }
 905                 nt_status = make_user_info_for_reply_enc(state,
 906                                                          &state->user_info,
 907                                                          state->user,
 908                                                          state->domain,
 909                                                          sconn->remote_address,
 910                                                          sconn->local_address,
 911                                                          "SMB",
 912                                                          state->lm_resp,
 913                                                          state->nt_resp);
 914
 915                 if (NT_STATUS_IS_OK(nt_status)) {
 916                         state->user_info->auth_description = "bare-NTLM";
 917                 }
 918         } else {
 919                 nt_status = make_auth4_context(state, &state->auth_context);
 920                 if (NT_STATUS_IS_OK(nt_status)) {
 921                         uint8_t chal[8];
 922
 923                         state->auth_context->get_ntlm_challenge(
 924                                         state->auth_context, chal);
 925
 926                         if (!make_user_info_for_reply(state,
 927                                                       &state->user_info,
 928                                                       state->user,
 929                                                       state->domain,
 930                                                       sconn->remote_address,
 931                                                       sconn->local_address,
 932                                                       "SMB",
 933                                                       chal,
 934                                                       state->plaintext_password)) {
 935                                 nt_status = NT_STATUS_NO_MEMORY;
 936                         }
 937
 938                         if (NT_STATUS_IS_OK(nt_status)) {
 939                                 state->user_info->auth_description = "plaintext";
 940                         }
 941                 }
 942         }
 943
 944         if (!NT_STATUS_IS_OK(nt_status)) {
 945                 reply_nterror(req, nt_status_squash(nt_status));
 946                 END_PROFILE(SMBsesssetupX);
 947                 return;
 948         }
 949
 950         nt_status = auth_check_password_session_info(state->auth_context,
 951                                                      req, state->user_info,
 952                                                      &session_info);
 953         TALLOC_FREE(state->user_info);
 954         if (!NT_STATUS_IS_OK(nt_status)) {
 955                 reply_nterror(req, nt_status_squash(nt_status));
 956                 END_PROFILE(SMBsesssetupX);
 957                 return;
 958         }
 959
 960         /* it's ok - setup a reply */
 961         reply_outbuf(req, 3, 0);
 962         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
 963         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
 964
 965         if (get_Protocol() >= PROTOCOL_NT1) {
 966                 push_signature(&req->outbuf);
 967                 /* perhaps grab OS version here?? */
 968         }
 969
 970         if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
 971                 action |= SMB_SETUP_GUEST;
 972         }
 973
 974         /* register the name and uid as being validated, so further connections
 975            to a uid can get through without a password, on the same VC */
 976
 977         nt_status = smbXsrv_session_create(xconn,
 978                                            now, &session);
 979         if (!NT_STATUS_IS_OK(nt_status)) {
 980                 reply_nterror(req, nt_status_squash(nt_status));
 981                 END_PROFILE(SMBsesssetupX);
 982                 return;
 983         }
 984
 985         if (session_info->session_key.length > 0) {
 986                 uint8_t session_key[16];
 987
 988                 /*
 989                  * Note: the SMB1 signing key is not truncated to 16 byte!
 990                  */
 991                 session->global->signing_key =
 992                         data_blob_dup_talloc(session->global,
 993                                              session_info->session_key);
 994                 if (session->global->signing_key.data == NULL) {
 995                         TALLOC_FREE(session);
 996                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 997                         END_PROFILE(SMBsesssetupX);
 998                         return;
 999                 }
1000
1001                 /*
1002                  * The application key is truncated/padded to 16 bytes
1003                  */
1004                 ZERO_STRUCT(session_key);
1005                 memcpy(session_key, session->global->signing_key.data,
1006                        MIN(session->global->signing_key.length,
1007                            sizeof(session_key)));
1008                 session->global->application_key =
1009                         data_blob_talloc(session->global,
1010                                          session_key,
1011                                          sizeof(session_key));
1012                 ZERO_STRUCT(session_key);
1013                 if (session->global->application_key.data == NULL) {
1014                         TALLOC_FREE(session);
1015                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1016                         END_PROFILE(SMBsesssetupX);
1017                         return;
1018                 }
1019
1020                 /*
1021                  * Place the application key into the session_info
1022                  */
1023                 data_blob_clear_free(&session_info->session_key);
1024                 session_info->session_key = data_blob_dup_talloc(session_info,
1025                                                 session->global->application_key);
1026                 if (session_info->session_key.data == NULL) {
1027                         TALLOC_FREE(session);
1028                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1029                         END_PROFILE(SMBsesssetupX);
1030                         return;
1031                 }
1032         }
1033
1034         session->compat = talloc_zero(session, struct user_struct);
1035         if (session->compat == NULL) {
1036                 TALLOC_FREE(session);
1037                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1038                 END_PROFILE(SMBsesssetupX);
1039                 return;
1040         }
1041         session->compat->session = session;
1042         session->compat->homes_snum = -1;
1043         session->compat->session_info = session_info;
1044         session->compat->session_keystr = NULL;
1045         session->compat->vuid = session->global->session_wire_id;
1046         DLIST_ADD(sconn->users, session->compat);
1047         sconn->num_users++;
1048
1049         if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
1050                 is_authenticated = true;
1051                 session->compat->homes_snum =
1052                         register_homes_share(session_info->unix_info->unix_name);
1053         }
1054
1055         if (srv_is_signing_negotiated(xconn) &&
1056             is_authenticated &&
1057             session->global->signing_key.length > 0)
1058         {
1059                 /*
1060                  * Try and turn on server signing on the first non-guest
1061                  * sessionsetup.
1062                  */
1063                 srv_set_signing(xconn,
1064                         session->global->signing_key,
1065                         state->nt_resp.data ? state->nt_resp : state->lm_resp);
1066         }
1067
1068         set_current_user_info(session_info->unix_info->sanitized_username,
1069                               session_info->unix_info->unix_name,
1070                               session_info->info->domain_name);
1071
1072         session->status = NT_STATUS_OK;
1073         session->global->auth_session_info = talloc_move(session->global,
1074                                                          &session_info);
1075         session->global->auth_session_info_seqnum += 1;
1076         session->global->channels[0].auth_session_info_seqnum =
1077                 session->global->auth_session_info_seqnum;
1078         session->global->auth_time = now;
1079         session->global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1080
1081         nt_status = smbXsrv_session_update(session);
1082         if (!NT_STATUS_IS_OK(nt_status)) {
1083                 DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
1084                           (unsigned long long)session->compat->vuid,
1085                           nt_errstr(nt_status)));
1086                 TALLOC_FREE(session);
1087                 reply_nterror(req, nt_status_squash(nt_status));
1088                 END_PROFILE(SMBsesssetupX);
1089                 return;
1090         }
1091
1092         if (!session_claim(session)) {
1093                 DEBUG(1, ("smb1: Failed to claim session for vuid=%llu\n",
1094                           (unsigned long long)session->compat->vuid));
1095                 TALLOC_FREE(session);
1096                 reply_nterror(req, NT_STATUS_LOGON_FAILURE);
1097                 END_PROFILE(SMBsesssetupX);
1098                 return;
1099         }
1100
1101         /* current_user_info is changed on new vuid */
1102         reload_services(sconn, conn_snum_used, true);
1103
1104         sess_vuid = session->global->session_wire_id;
1105
1106         SSVAL(req->outbuf,smb_vwv2,action);
1107         SSVAL(req->outbuf,smb_uid,sess_vuid);
1108         SSVAL(discard_const_p(char, req->inbuf),smb_uid,sess_vuid);
1109         req->vuid = sess_vuid;
1110
1111         if (!xconn->smb1.sessions.done_sesssetup) {
1112                 if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
1113                         reply_force_doserror(req, ERRSRV, ERRerror);
1114                         END_PROFILE(SMBsesssetupX);
1115                         return;
1116                 }
1117                 xconn->smb1.sessions.max_send = smb_bufsize;
1118                 xconn->smb1.sessions.done_sesssetup = true;
1119         }
1120
1121         TALLOC_FREE(state);
1122         END_PROFILE(SMBsesssetupX);
1123 }