diff options
Diffstat (limited to 'source4/smb_server/smb')
| -rw-r--r-- | source4/smb_server/smb/reply.c | 237 | ||||
| -rw-r--r-- | source4/smb_server/smb/sesssetup.c | 338 |
2 files changed, 330 insertions, 245 deletions
diff --git a/source4/smb_server/smb/reply.c b/source4/smb_server/smb/reply.c index 256abc0c7c..dd5e964bae 100644 --- a/source4/smb_server/smb/reply.c +++ b/source4/smb_server/smb/reply.c @@ -1776,25 +1776,106 @@ void smbsrv_reply_getattrE(struct smbsrv_request *req) SMBSRV_CALL_NTVFS_BACKEND(ntvfs_qfileinfo(req->ntvfs, info)); } +void smbsrv_reply_sesssetup_send(struct smbsrv_request *req, + union smb_sesssetup *io, + NTSTATUS status) +{ + switch (io->old.level) { + case RAW_SESSSETUP_OLD: + if (!NT_STATUS_IS_OK(status)) { + smbsrv_send_error(req, status); + return; + } + + /* construct reply */ + smbsrv_setup_reply(req, 3, 0); + + SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE); + SSVAL(req->out.vwv, VWV(1), 0); + SSVAL(req->out.vwv, VWV(2), io->old.out.action); + + SSVAL(req->out.hdr, HDR_UID, io->old.out.vuid); + + smbsrv_chain_reply(req); + return; + + case RAW_SESSSETUP_NT1: + if (!NT_STATUS_IS_OK(status)) { + smbsrv_send_error(req, status); + return; + } + + /* construct reply */ + smbsrv_setup_reply(req, 3, 0); + + SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE); + SSVAL(req->out.vwv, VWV(1), 0); + SSVAL(req->out.vwv, VWV(2), io->nt1.out.action); + + SSVAL(req->out.hdr, HDR_UID, io->nt1.out.vuid); + + req_push_str(req, NULL, io->nt1.out.os, -1, STR_TERMINATE); + req_push_str(req, NULL, io->nt1.out.lanman, -1, STR_TERMINATE); + req_push_str(req, NULL, io->nt1.out.domain, -1, STR_TERMINATE); + + smbsrv_chain_reply(req); + return; + + case RAW_SESSSETUP_SPNEGO: + if (!NT_STATUS_IS_OK(status) && + !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + smbsrv_send_error(req, status); + return; + } + + /* construct reply */ + smbsrv_setup_reply(req, 4, io->spnego.out.secblob.length); + + if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + smbsrv_setup_error(req, status); + } + + SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE); + SSVAL(req->out.vwv, VWV(1), 0); + SSVAL(req->out.vwv, VWV(2), io->spnego.out.action); + SSVAL(req->out.vwv, VWV(3), io->spnego.out.secblob.length); + + SSVAL(req->out.hdr, HDR_UID, io->spnego.out.vuid); + + memcpy(req->out.data, io->spnego.out.secblob.data, io->spnego.out.secblob.length); + req_push_str(req, NULL, io->spnego.out.os, -1, STR_TERMINATE); + req_push_str(req, NULL, io->spnego.out.lanman, -1, STR_TERMINATE); + req_push_str(req, NULL, io->spnego.out.workgroup, -1, STR_TERMINATE); + + smbsrv_chain_reply(req); + return; + + case RAW_SESSSETUP_SMB2: + break; + } + + smbsrv_send_error(req, NT_STATUS_INTERNAL_ERROR); +} /**************************************************************************** reply to an old style session setup command ****************************************************************************/ static void reply_sesssetup_old(struct smbsrv_request *req) { - NTSTATUS status; - union smb_sesssetup sess; uint8_t *p; uint16_t passlen; + union smb_sesssetup *io; + + SMBSRV_TALLOC_IO_PTR(io, union smb_sesssetup); - sess.old.level = RAW_SESSSETUP_OLD; + io->old.level = RAW_SESSSETUP_OLD; /* parse request */ - sess.old.in.bufsize = SVAL(req->in.vwv, VWV(2)); - sess.old.in.mpx_max = SVAL(req->in.vwv, VWV(3)); - sess.old.in.vc_num = SVAL(req->in.vwv, VWV(4)); - sess.old.in.sesskey = IVAL(req->in.vwv, VWV(5)); - passlen = SVAL(req->in.vwv, VWV(7)); + io->old.in.bufsize = SVAL(req->in.vwv, VWV(2)); + io->old.in.mpx_max = SVAL(req->in.vwv, VWV(3)); + io->old.in.vc_num = SVAL(req->in.vwv, VWV(4)); + io->old.in.sesskey = IVAL(req->in.vwv, VWV(5)); + passlen = SVAL(req->in.vwv, VWV(7)); /* check the request isn't malformed */ if (req_data_oob(req, req->in.data, passlen)) { @@ -1803,58 +1884,42 @@ static void reply_sesssetup_old(struct smbsrv_request *req) } p = req->in.data; - if (!req_pull_blob(req, p, passlen, &sess.old.in.password)) { + if (!req_pull_blob(req, p, passlen, &io->old.in.password)) { smbsrv_send_error(req, NT_STATUS_FOOBAR); return; } p += passlen; - p += req_pull_string(req, &sess.old.in.user, p, -1, STR_TERMINATE); - p += req_pull_string(req, &sess.old.in.domain, p, -1, STR_TERMINATE); - p += req_pull_string(req, &sess.old.in.os, p, -1, STR_TERMINATE); - p += req_pull_string(req, &sess.old.in.lanman, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->old.in.user, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->old.in.domain, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->old.in.os, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->old.in.lanman, p, -1, STR_TERMINATE); /* call the generic handler */ - status = smbsrv_sesssetup_backend(req, &sess); - - if (!NT_STATUS_IS_OK(status)) { - smbsrv_send_error(req, status); - return; - } - - /* construct reply */ - smbsrv_setup_reply(req, 3, 0); - - SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE); - SSVAL(req->out.vwv, VWV(1), 0); - SSVAL(req->out.vwv, VWV(2), sess.old.out.action); - - SSVAL(req->out.hdr, HDR_UID, sess.old.out.vuid); - - smbsrv_chain_reply(req); + smbsrv_sesssetup_backend(req, io); } - /**************************************************************************** reply to an NT1 style session setup command ****************************************************************************/ static void reply_sesssetup_nt1(struct smbsrv_request *req) { - NTSTATUS status; - union smb_sesssetup sess; uint8_t *p; uint16_t passlen1, passlen2; + union smb_sesssetup *io; + + SMBSRV_TALLOC_IO_PTR(io, union smb_sesssetup); - sess.nt1.level = RAW_SESSSETUP_NT1; + io->nt1.level = RAW_SESSSETUP_NT1; /* parse request */ - sess.nt1.in.bufsize = SVAL(req->in.vwv, VWV(2)); - sess.nt1.in.mpx_max = SVAL(req->in.vwv, VWV(3)); - sess.nt1.in.vc_num = SVAL(req->in.vwv, VWV(4)); - sess.nt1.in.sesskey = IVAL(req->in.vwv, VWV(5)); - passlen1 = SVAL(req->in.vwv, VWV(7)); - passlen2 = SVAL(req->in.vwv, VWV(8)); - sess.nt1.in.capabilities = IVAL(req->in.vwv, VWV(11)); + io->nt1.in.bufsize = SVAL(req->in.vwv, VWV(2)); + io->nt1.in.mpx_max = SVAL(req->in.vwv, VWV(3)); + io->nt1.in.vc_num = SVAL(req->in.vwv, VWV(4)); + io->nt1.in.sesskey = IVAL(req->in.vwv, VWV(5)); + passlen1 = SVAL(req->in.vwv, VWV(7)); + passlen2 = SVAL(req->in.vwv, VWV(8)); + io->nt1.in.capabilities = IVAL(req->in.vwv, VWV(11)); /* check the request isn't malformed */ if (req_data_oob(req, req->in.data, passlen1) || @@ -1864,44 +1929,24 @@ static void reply_sesssetup_nt1(struct smbsrv_request *req) } p = req->in.data; - if (!req_pull_blob(req, p, passlen1, &sess.nt1.in.password1)) { + if (!req_pull_blob(req, p, passlen1, &io->nt1.in.password1)) { smbsrv_send_error(req, NT_STATUS_FOOBAR); return; } p += passlen1; - if (!req_pull_blob(req, p, passlen2, &sess.nt1.in.password2)) { + if (!req_pull_blob(req, p, passlen2, &io->nt1.in.password2)) { smbsrv_send_error(req, NT_STATUS_FOOBAR); return; } p += passlen2; - p += req_pull_string(req, &sess.nt1.in.user, p, -1, STR_TERMINATE); - p += req_pull_string(req, &sess.nt1.in.domain, p, -1, STR_TERMINATE); - p += req_pull_string(req, &sess.nt1.in.os, p, -1, STR_TERMINATE); - p += req_pull_string(req, &sess.nt1.in.lanman, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->nt1.in.user, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->nt1.in.domain, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->nt1.in.os, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->nt1.in.lanman, p, -1, STR_TERMINATE); /* call the generic handler */ - status = smbsrv_sesssetup_backend(req, &sess); - - if (!NT_STATUS_IS_OK(status)) { - smbsrv_send_error(req, status); - return; - } - - /* construct reply */ - smbsrv_setup_reply(req, 3, 0); - - SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE); - SSVAL(req->out.vwv, VWV(1), 0); - SSVAL(req->out.vwv, VWV(2), sess.nt1.out.action); - - SSVAL(req->out.hdr, HDR_UID, sess.nt1.out.vuid); - - req_push_str(req, NULL, sess.nt1.out.os, -1, STR_TERMINATE); - req_push_str(req, NULL, sess.nt1.out.lanman, -1, STR_TERMINATE); - req_push_str(req, NULL, sess.nt1.out.domain, -1, STR_TERMINATE); - - smbsrv_chain_reply(req); + smbsrv_sesssetup_backend(req, io); } @@ -1910,61 +1955,35 @@ reply to an SPNEGO style session setup command ****************************************************************************/ static void reply_sesssetup_spnego(struct smbsrv_request *req) { - NTSTATUS status; - union smb_sesssetup sess; uint8_t *p; uint16_t blob_len; + union smb_sesssetup *io; - sess.spnego.level = RAW_SESSSETUP_SPNEGO; + SMBSRV_TALLOC_IO_PTR(io, union smb_sesssetup); + + io->spnego.level = RAW_SESSSETUP_SPNEGO; /* parse request */ - sess.spnego.in.bufsize = SVAL(req->in.vwv, VWV(2)); - sess.spnego.in.mpx_max = SVAL(req->in.vwv, VWV(3)); - sess.spnego.in.vc_num = SVAL(req->in.vwv, VWV(4)); - sess.spnego.in.sesskey = IVAL(req->in.vwv, VWV(5)); - blob_len = SVAL(req->in.vwv, VWV(7)); - sess.spnego.in.capabilities = IVAL(req->in.vwv, VWV(10)); + io->spnego.in.bufsize = SVAL(req->in.vwv, VWV(2)); + io->spnego.in.mpx_max = SVAL(req->in.vwv, VWV(3)); + io->spnego.in.vc_num = SVAL(req->in.vwv, VWV(4)); + io->spnego.in.sesskey = IVAL(req->in.vwv, VWV(5)); + blob_len = SVAL(req->in.vwv, VWV(7)); + io->spnego.in.capabilities = IVAL(req->in.vwv, VWV(10)); p = req->in.data; - if (!req_pull_blob(req, p, blob_len, &sess.spnego.in.secblob)) { + if (!req_pull_blob(req, p, blob_len, &io->spnego.in.secblob)) { smbsrv_send_error(req, NT_STATUS_FOOBAR); return; } p += blob_len; - p += req_pull_string(req, &sess.spnego.in.os, p, -1, STR_TERMINATE); - p += req_pull_string(req, &sess.spnego.in.lanman, p, -1, STR_TERMINATE); - p += req_pull_string(req, &sess.spnego.in.workgroup, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->spnego.in.os, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->spnego.in.lanman, p, -1, STR_TERMINATE); + p += req_pull_string(req, &io->spnego.in.workgroup, p, -1, STR_TERMINATE); /* call the generic handler */ - status = smbsrv_sesssetup_backend(req, &sess); - - if (!NT_STATUS_IS_OK(status) && - !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { - smbsrv_send_error(req, status); - return; - } - - /* construct reply */ - smbsrv_setup_reply(req, 4, sess.spnego.out.secblob.length); - - if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { - smbsrv_setup_error(req, status); - } - - SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE); - SSVAL(req->out.vwv, VWV(1), 0); - SSVAL(req->out.vwv, VWV(2), sess.spnego.out.action); - SSVAL(req->out.vwv, VWV(3), sess.spnego.out.secblob.length); - - SSVAL(req->out.hdr, HDR_UID, sess.spnego.out.vuid); - - memcpy(req->out.data, sess.spnego.out.secblob.data, sess.spnego.out.secblob.length); - req_push_str(req, NULL, sess.spnego.out.os, -1, STR_TERMINATE); - req_push_str(req, NULL, sess.spnego.out.lanman, -1, STR_TERMINATE); - req_push_str(req, NULL, sess.spnego.out.workgroup, -1, STR_TERMINATE); - - smbsrv_chain_reply(req); + smbsrv_sesssetup_backend(req, io); } diff --git a/source4/smb_server/smb/sesssetup.c b/source4/smb_server/smb/sesssetup.c index f4407c1a28..fe75cce17e 100644 --- a/source4/smb_server/smb/sesssetup.c +++ b/source4/smb_server/smb/sesssetup.c @@ -41,40 +41,89 @@ static void sesssetup_common_strings(struct smbsrv_request *req, (*domain) = talloc_asprintf(req, "%s", lp_workgroup()); } +static void smbsrv_sesssetup_backend_send(struct smbsrv_request *req, + union smb_sesssetup *sess, + NTSTATUS status) +{ + if (NT_STATUS_IS_OK(status)) { + req->smb_conn->negotiate.done_sesssetup = True; + } + smbsrv_reply_sesssetup_send(req, sess, status); +} + +static void sesssetup_old_send(struct auth_check_password_request *areq, + void *private_data) +{ + struct smbsrv_request *req = talloc_get_type(private_data, struct smbsrv_request); + union smb_sesssetup *sess = talloc_get_type(req->io_ptr, union smb_sesssetup); + struct auth_serversupplied_info *server_info = NULL; + struct auth_session_info *session_info; + struct smbsrv_session *smb_sess; + NTSTATUS status; + + status = auth_check_password_recv(areq, req, &server_info); + if (!NT_STATUS_IS_OK(status)) goto failed; + + /* This references server_info into session_info */ + status = auth_generate_session_info(req, server_info, &session_info); + if (!NT_STATUS_IS_OK(status)) goto failed; + + /* allocate a new session */ + smb_sess = smbsrv_session_new(req->smb_conn, NULL); + if (!smb_sess) { + status = NT_STATUS_INSUFFICIENT_RESOURCES; + goto failed; + } + + /* Ensure this is marked as a 'real' vuid, not one + * simply valid for the session setup leg */ + status = smbsrv_session_sesssetup_finished(smb_sess, session_info); + if (!NT_STATUS_IS_OK(status)) goto failed; + + /* To correctly process any AndX packet (like a tree connect) + * we need to fill in the session on the request here */ + req->session = smb_sess; + sess->old.out.vuid = smb_sess->vuid; + +failed: + status = auth_nt_status_squash(status); + smbsrv_sesssetup_backend_send(req, sess, status); +} /* handler for old style session setup */ -static NTSTATUS sesssetup_old(struct smbsrv_request *req, union smb_sesssetup *sess) +static void sesssetup_old(struct smbsrv_request *req, union smb_sesssetup *sess) { - NTSTATUS status; struct auth_usersupplied_info *user_info = NULL; - struct auth_serversupplied_info *server_info = NULL; - struct auth_session_info *session_info; - struct smbsrv_session *smb_sess; struct socket_address *remote_address; const char *remote_machine = NULL; sess->old.out.vuid = 0; sess->old.out.action = 0; + sesssetup_common_strings(req, + &sess->old.out.os, + &sess->old.out.lanman, + &sess->old.out.domain); + if (!req->smb_conn->negotiate.done_sesssetup) { req->smb_conn->negotiate.max_send = sess->old.in.bufsize; } - + if (req->smb_conn->negotiate.calling_name) { remote_machine = req->smb_conn->negotiate.calling_name->name; } remote_address = socket_get_peer_addr(req->smb_conn->connection->socket, req); - NT_STATUS_HAVE_NO_MEMORY(remote_address); + if (!remote_address) goto nomem; if (!remote_machine) { remote_machine = remote_address->addr; } user_info = talloc(req, struct auth_usersupplied_info); - NT_STATUS_HAVE_NO_MEMORY(user_info); + if (!user_info) goto nomem; user_info->mapped_state = False; user_info->logon_parameters = 0; @@ -89,62 +138,93 @@ static NTSTATUS sesssetup_old(struct smbsrv_request *req, union smb_sesssetup *s user_info->password.response.lanman.data = talloc_steal(user_info, sess->old.in.password.data); user_info->password.response.nt = data_blob(NULL, 0); - status = auth_check_password(req->smb_conn->negotiate.auth_context, - req, user_info, &server_info); - if (!NT_STATUS_IS_OK(status)) { - return auth_nt_status_squash(status); - } + auth_check_password_send(req->smb_conn->negotiate.auth_context, user_info, + sesssetup_old_send, req); + return; + +nomem: + smbsrv_sesssetup_backend_send(req, sess, NT_STATUS_NO_MEMORY); +} + +static void sesssetup_nt1_send(struct auth_check_password_request *areq, + void *private_data) +{ + struct smbsrv_request *req = talloc_get_type(private_data, struct smbsrv_request); + union smb_sesssetup *sess = talloc_get_type(req->io_ptr, union smb_sesssetup); + struct auth_serversupplied_info *server_info = NULL; + struct auth_session_info *session_info; + struct smbsrv_session *smb_sess; + NTSTATUS status; + + status = auth_check_password_recv(areq, req, &server_info); + if (!NT_STATUS_IS_OK(status)) goto failed; /* This references server_info into session_info */ status = auth_generate_session_info(req, server_info, &session_info); - if (!NT_STATUS_IS_OK(status)) { - return auth_nt_status_squash(status); - } + if (!NT_STATUS_IS_OK(status)) goto failed; /* allocate a new session */ smb_sess = smbsrv_session_new(req->smb_conn, NULL); if (!smb_sess) { - return NT_STATUS_ACCESS_DENIED; + status = NT_STATUS_INSUFFICIENT_RESOURCES; + goto failed; } /* Ensure this is marked as a 'real' vuid, not one * simply valid for the session setup leg */ status = smbsrv_session_sesssetup_finished(smb_sess, session_info); - if (!NT_STATUS_IS_OK(status)) { - return auth_nt_status_squash(status); - } + if (!NT_STATUS_IS_OK(status)) goto failed; /* To correctly process any AndX packet (like a tree connect) * we need to fill in the session on the request here */ req->session = smb_sess; - sess->old.out.vuid = smb_sess->vuid; + sess->nt1.out.vuid = smb_sess->vuid; - sesssetup_common_strings(req, - &sess->old.out.os, - &sess->old.out.lanman, - &sess->old.out.domain); + if (!session_info->server_info->authenticated) { + /* don't try signing as anonymous */ + goto done; + } - return NT_STATUS_OK; -} + if (!smbsrv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2)) { + /* Already signing, or disabled */ + goto done; + } + /* Force check of the request packet, now we know the session key */ + smbsrv_signing_check_incoming(req); +/* TODO: why don't we check the result here? */ + + /* Unfortunetly win2k3 as a client doesn't sign the request + * packet here, so we have to force signing to start again */ + + smbsrv_signing_restart(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2); + +done: + status = NT_STATUS_OK; +failed: + status = auth_nt_status_squash(status); + smbsrv_sesssetup_backend_send(req, sess, status); +} /* handler for NT1 style session setup */ -static NTSTATUS sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *sess) +static void sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *sess) { NTSTATUS status; struct auth_context *auth_context; struct auth_usersupplied_info *user_info = NULL; - struct auth_serversupplied_info *server_info = NULL; - struct auth_session_info *session_info; - struct smbsrv_session *smb_sess; struct socket_address *remote_address; const char *remote_machine = NULL; sess->nt1.out.vuid = 0; sess->nt1.out.action = 0; + sesssetup_common_strings(req, + &sess->nt1.out.os, + &sess->nt1.out.lanman, + &sess->nt1.out.domain); + if (!req->smb_conn->negotiate.done_sesssetup) { req->smb_conn->negotiate.max_send = sess->nt1.in.bufsize; req->smb_conn->negotiate.client_caps = sess->nt1.in.capabilities; @@ -154,14 +234,15 @@ static NTSTATUS sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *s if (sess->nt1.in.user && *sess->nt1.in.user) { /* We can't accept a normal login, because we * don't have a challenge */ - return NT_STATUS_LOGON_FAILURE; + status = NT_STATUS_LOGON_FAILURE; + goto failed; } /* TODO: should we use just "anonymous" here? */ status = auth_context_create(req, lp_auth_methods(), - &auth_context, + &auth_context, req->smb_conn->connection->event.ctx); - NT_STATUS_NOT_OK_RETURN(status); + if (!NT_STATUS_IS_OK(status)) goto failed; } else { auth_context = req->smb_conn->negotiate.auth_context; } @@ -171,15 +252,15 @@ static NTSTATUS sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *s } remote_address = socket_get_peer_addr(req->smb_conn->connection->socket, req); - NT_STATUS_HAVE_NO_MEMORY(remote_address); + if (!remote_address) goto nomem; if (!remote_machine) { remote_machine = remote_address->addr; } user_info = talloc(req, struct auth_usersupplied_info); - NT_STATUS_HAVE_NO_MEMORY(user_info); - + if (!user_info) goto nomem; + user_info->mapped_state = False; user_info->logon_parameters = 0; user_info->flags = 0; @@ -194,72 +275,77 @@ static NTSTATUS sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *s user_info->password.response.nt = sess->nt1.in.password2; user_info->password.response.nt.data = talloc_steal(user_info, sess->nt1.in.password2.data); - status = auth_check_password(auth_context, req, user_info, &server_info); - if (!NT_STATUS_IS_OK(status)) { - return auth_nt_status_squash(status); - } + auth_check_password_send(auth_context, user_info, + sesssetup_nt1_send, req); + return; - /* This references server_info into session_info */ - status = auth_generate_session_info(req, server_info, &session_info); - if (!NT_STATUS_IS_OK(status)) { - return auth_nt_status_squash(status); - } +nomem: + status = NT_STATUS_NO_MEMORY; +failed: + status = auth_nt_status_squash(status); + smbsrv_sesssetup_backend_send(req, sess, status); +} - /* allocate a new session */ - smb_sess = smbsrv_session_new(req->smb_conn, NULL); - if (!smb_sess) { - return NT_STATUS_ACCESS_DENIED; - } +struct sesssetup_spnego_state { + struct smbsrv_request *req; + union smb_sesssetup *sess; + struct smbsrv_session *smb_sess; +}; - /* Ensure this is marked as a 'real' vuid, not one - * simply valid for the session setup leg */ - status = smbsrv_session_sesssetup_finished(smb_sess, session_info); - if (!NT_STATUS_IS_OK(status)) { - return auth_nt_status_squash(status); - } +static void sesssetup_spnego_send(struct gensec_update_request *greq, void *private_data) +{ + struct sesssetup_spnego_state *s = talloc_get_type(private_data, + struct sesssetup_spnego_state); + struct smbsrv_request *req = s->req; + union smb_sesssetup *sess = s->sess; + struct smbsrv_session *smb_sess = s->smb_sess; + struct auth_session_info *session_info = NULL; + NTSTATUS status; + NTSTATUS skey_status; + DATA_BLOB session_key; - /* To correctly process any AndX packet (like a tree connect) - * we need to fill in the session on the request here */ - req->session = smb_sess; - sess->nt1.out.vuid = smb_sess->vuid; + status = gensec_update_recv(greq, req, &sess->spnego.out.secblob); + if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + goto done; + } else if (!NT_STATUS_IS_OK(status)) { + goto failed; + } - sesssetup_common_strings(req, - &sess->nt1.out.os, - &sess->nt1.out.lanman, - &sess->nt1.out.domain); + status = gensec_session_info(smb_sess->gensec_ctx, &session_info); + if (!NT_STATUS_IS_OK(status)) goto failed; - if (!session_info->server_info->authenticated) { - return NT_STATUS_OK; - } + skey_status = gensec_session_key(smb_sess->gensec_ctx, &session_key); + if (NT_STATUS_IS_OK(skey_status) && + session_info->server_info->authenticated && + smbsrv_setup_signing(req->smb_conn, &session_key, NULL)) { + /* Force check of the request packet, now we know the session key */ + smbsrv_signing_check_incoming(req); - if (!smbsrv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2)) { - /* Already signing, or disabled */ - return NT_STATUS_OK; + smbsrv_signing_restart(req->smb_conn, &session_key, NULL); } - /* Force check of the request packet, now we know the session key */ - smbsrv_signing_check_incoming(req); -/* TODO: why don't we check the result here? */ - - /* Unfortunetly win2k3 as a client doesn't sign the request - * packet here, so we have to force signing to start again */ + /* Ensure this is marked as a 'real' vuid, not one + * simply valid for the session setup leg */ + status = smbsrv_session_sesssetup_finished(smb_sess, session_info); + if (!NT_STATUS_IS_OK(status)) goto failed; - smbsrv_signing_restart(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2); + req->session = smb_sess; - return NT_STATUS_OK; +done: + sess->spnego.out.vuid = smb_sess->vuid; +failed: + status = auth_nt_status_squash(status); + smbsrv_sesssetup_backend_send(req, sess, status); } - /* handler for SPNEGO style session setup */ -static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup *sess) +static void sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup *sess) { NTSTATUS status; - NTSTATUS skey_status; struct smbsrv_session *smb_sess = NULL; - struct auth_session_info *session_info = NULL; - DATA_BLOB session_key; + struct sesssetup_spnego_state *s = NULL; uint16_t vuid; sess->spnego.out.vuid = 0; @@ -286,7 +372,7 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup req->smb_conn->connection->event.ctx); if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status))); - return status; + goto failed; } gensec_set_credentials(gensec_ctx, req->smb_conn->negotiate.server_credentials); @@ -299,15 +385,20 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Failed to start GENSEC %s server code: %s\n", gensec_get_name_by_oid(req->smb_conn->negotiate.oid), nt_errstr(status))); - return status; + goto failed; } /* allocate a new session */ smb_sess = smbsrv_session_new(req->smb_conn, gensec_ctx); + if (!smb_sess) { + status = NT_STATUS_INSUFFICIENT_RESOURCES; + goto failed; + } } if (!smb_sess) { - return NT_STATUS_ACCESS_DENIED; + status = NT_STATUS_ACCESS_DENIED; + goto failed; } if (!smb_sess->gensec_ctx) { @@ -316,71 +407,46 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup goto failed; } - status = gensec_update(smb_sess->gensec_ctx, req, sess->spnego.in.secblob, &sess->spnego.out.secblob); - if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { - sess->spnego.out.vuid = smb_sess->vuid; - return status; - } else if (!NT_STATUS_IS_OK(status)) { - goto failed; - } - - status = gensec_session_info(smb_sess->gensec_ctx, &session_info); - if (!NT_STATUS_IS_OK(status)) { - goto failed; - } + s = talloc(req, struct sesssetup_spnego_state); + if (!s) goto nomem; + s->req = req; + s->sess = sess; + s->smb_sess = smb_sess; - skey_status = gensec_session_key(smb_sess->gensec_ctx, &session_key); - if (NT_STATUS_IS_OK(skey_status) && - session_info->server_info->authenticated && - smbsrv_setup_signing(req->smb_conn, &session_key, NULL)) { - /* Force check of the request packet, now we know the session key */ - smbsrv_signing_check_incoming(req); - - smbsrv_signing_restart(req->smb_conn, &session_key, NULL); - } - - /* Ensure this is marked as a 'real' vuid, not one - * simply valid for the session setup leg */ - status = smbsrv_session_sesssetup_finished(smb_sess, session_info); - if (!NT_STATUS_IS_OK(status)) { - goto failed; - } - req->session = smb_sess; - - sess->spnego.out.vuid = smb_sess->vuid; - return NT_STATUS_OK; + gensec_update_send(smb_sess->gensec_ctx, sess->spnego.in.secblob, + sesssetup_spnego_send, s); + return; +nomem: + status = NT_STATUS_NO_MEMORY; failed: talloc_free(smb_sess); - return auth_nt_status_squash(status); + status = auth_nt_status_squash(status); + smbsrv_sesssetup_backend_send(req, sess, status); } /* backend for sessionsetup call - this takes all 3 variants of the call */ -NTSTATUS smbsrv_sesssetup_backend(struct smbsrv_request *req, - union smb_sesssetup *sess) +void smbsrv_sesssetup_backend(struct smbsrv_request *req, + union smb_sesssetup *sess) { - NTSTATUS status = NT_STATUS_INVALID_LEVEL; - switch (sess->old.level) { case RAW_SESSSETUP_OLD: - status = sesssetup_old(req, sess); - break; + sesssetup_old(req, sess); + return; + case RAW_SESSSETUP_NT1: - status = sesssetup_nt1(req, sess); - break; + sesssetup_nt1(req, sess); + return; + case RAW_SESSSETUP_SPNEGO: - status = sesssetup_spnego(req, sess); - break; + sesssetup_spnego(req, sess); + return; + case RAW_SESSSETUP_SMB2: - status = NT_STATUS_INTERNAL_ERROR; break; } - if (NT_STATUS_IS_OK(status)) { - req->smb_conn->negotiate.done_sesssetup = True; - } - - return status; + smbsrv_sesssetup_backend_send(req, sess, NT_STATUS_INVALID_LEVEL); } |