2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/tevent_ntstatus.h"
31 #include "lib/crypto/sha512.h"
32 #include "lib/crypto/aes.h"
33 #include "lib/crypto/aes_ccm_128.h"
34 #include "lib/crypto/aes_gcm_128.h"
36 static struct tevent_req *smbd_smb2_session_setup_wrap_send(TALLOC_CTX *mem_ctx,
37 struct tevent_context *ev,
38 struct smbd_smb2_request *smb2req,
39 uint64_t in_session_id,
41 uint8_t in_security_mode,
42 uint64_t in_previous_session_id,
43 DATA_BLOB in_security_buffer);
44 static NTSTATUS smbd_smb2_session_setup_wrap_recv(struct tevent_req *req,
45 uint16_t *out_session_flags,
47 DATA_BLOB *out_security_buffer,
48 uint64_t *out_session_id);
50 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq);
52 NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *smb2req)
55 const uint8_t *inbody;
56 uint64_t in_session_id;
58 uint8_t in_security_mode;
59 uint64_t in_previous_session_id;
60 uint16_t in_security_offset;
61 uint16_t in_security_length;
62 DATA_BLOB in_security_buffer;
64 struct tevent_req *subreq;
66 status = smbd_smb2_request_verify_sizes(smb2req, 0x19);
67 if (!NT_STATUS_IS_OK(status)) {
68 return smbd_smb2_request_error(smb2req, status);
70 inhdr = SMBD_SMB2_IN_HDR_PTR(smb2req);
71 inbody = SMBD_SMB2_IN_BODY_PTR(smb2req);
73 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
75 in_flags = CVAL(inbody, 0x02);
76 in_security_mode = CVAL(inbody, 0x03);
77 /* Capabilities = IVAL(inbody, 0x04) */
78 /* Channel = IVAL(inbody, 0x08) */
79 in_security_offset = SVAL(inbody, 0x0C);
80 in_security_length = SVAL(inbody, 0x0E);
81 in_previous_session_id = BVAL(inbody, 0x10);
83 if (in_security_offset != (SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(smb2req))) {
84 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
87 if (in_security_length > SMBD_SMB2_IN_DYN_LEN(smb2req)) {
88 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
91 in_security_buffer.data = SMBD_SMB2_IN_DYN_PTR(smb2req);
92 in_security_buffer.length = in_security_length;
94 subreq = smbd_smb2_session_setup_wrap_send(smb2req,
95 smb2req->sconn->ev_ctx,
100 in_previous_session_id,
102 if (subreq == NULL) {
103 return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
105 tevent_req_set_callback(subreq, smbd_smb2_request_sesssetup_done, smb2req);
107 return smbd_smb2_request_pending_queue(smb2req, subreq, 500);
110 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq)
112 struct smbd_smb2_request *smb2req =
113 tevent_req_callback_data(subreq,
114 struct smbd_smb2_request);
118 uint16_t out_session_flags = 0;
119 uint64_t out_session_id = 0;
120 uint16_t out_security_offset;
121 DATA_BLOB out_security_buffer = data_blob_null;
123 NTSTATUS error; /* transport error */
125 status = smbd_smb2_session_setup_wrap_recv(subreq,
128 &out_security_buffer,
131 if (!NT_STATUS_IS_OK(status) &&
132 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
133 status = nt_status_squash(status);
134 error = smbd_smb2_request_error(smb2req, status);
135 if (!NT_STATUS_IS_OK(error)) {
136 smbd_server_connection_terminate(smb2req->xconn,
143 out_security_offset = SMB2_HDR_BODY + 0x08;
145 outhdr = SMBD_SMB2_OUT_HDR_PTR(smb2req);
147 outbody = smbd_smb2_generate_outbody(smb2req, 0x08);
148 if (outbody.data == NULL) {
149 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
150 if (!NT_STATUS_IS_OK(error)) {
151 smbd_server_connection_terminate(smb2req->xconn,
158 SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id);
160 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
161 SSVAL(outbody.data, 0x02,
162 out_session_flags); /* session flags */
163 SSVAL(outbody.data, 0x04,
164 out_security_offset); /* security buffer offset */
165 SSVAL(outbody.data, 0x06,
166 out_security_buffer.length); /* security buffer length */
168 outdyn = out_security_buffer;
170 error = smbd_smb2_request_done_ex(smb2req, status, outbody, &outdyn,
172 if (!NT_STATUS_IS_OK(error)) {
173 smbd_server_connection_terminate(smb2req->xconn,
179 static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
180 struct smbXsrv_session_auth0 **_auth,
181 struct smbd_smb2_request *smb2req,
182 uint8_t in_security_mode,
183 struct auth_session_info *session_info,
184 uint16_t *out_session_flags,
185 uint64_t *out_session_id)
189 uint8_t session_key[16];
190 struct smbXsrv_session *x = session;
191 struct smbXsrv_session_auth0 *auth = *_auth;
192 struct smbXsrv_connection *xconn = smb2req->xconn;
199 struct _derivation signing;
200 struct _derivation encryption;
201 struct _derivation decryption;
202 struct _derivation application;
207 if (xconn->protocol >= PROTOCOL_SMB3_10) {
208 struct smbXsrv_preauth *preauth;
209 struct _derivation *d;
211 struct hc_sha512state sctx;
213 preauth = talloc_move(smb2req, &auth->preauth);
215 samba_SHA512_Init(&sctx);
216 samba_SHA512_Update(&sctx, preauth->sha512_value,
217 sizeof(preauth->sha512_value));
218 for (i = 1; i < smb2req->in.vector_count; i++) {
219 samba_SHA512_Update(&sctx,
220 smb2req->in.vector[i].iov_base,
221 smb2req->in.vector[i].iov_len);
223 samba_SHA512_Final(preauth->sha512_value, &sctx);
225 p = data_blob_const(preauth->sha512_value,
226 sizeof(preauth->sha512_value));
228 d = &derivation.signing;
229 d->label = data_blob_string_const_null("SMBSigningKey");
232 d = &derivation.decryption;
233 d->label = data_blob_string_const_null("SMBC2SCipherKey");
236 d = &derivation.encryption;
237 d->label = data_blob_string_const_null("SMBS2CCipherKey");
240 d = &derivation.application;
241 d->label = data_blob_string_const_null("SMBAppKey");
244 } else if (xconn->protocol >= PROTOCOL_SMB2_24) {
245 struct _derivation *d;
247 d = &derivation.signing;
248 d->label = data_blob_string_const_null("SMB2AESCMAC");
249 d->context = data_blob_string_const_null("SmbSign");
251 d = &derivation.decryption;
252 d->label = data_blob_string_const_null("SMB2AESCCM");
253 d->context = data_blob_string_const_null("ServerIn ");
255 d = &derivation.encryption;
256 d->label = data_blob_string_const_null("SMB2AESCCM");
257 d->context = data_blob_string_const_null("ServerOut");
259 d = &derivation.application;
260 d->label = data_blob_string_const_null("SMB2APP");
261 d->context = data_blob_string_const_null("SmbRpc");
264 if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
265 lp_server_signing() == SMB_SIGNING_REQUIRED) {
266 x->global->signing_required = true;
269 if ((lp_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) &&
270 (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) {
271 x->encryption_desired = true;
274 if (lp_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) {
275 x->encryption_desired = true;
276 x->global->encryption_required = true;
279 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
280 /* we map anonymous to guest internally */
281 *out_session_flags |= SMB2_SESSION_FLAG_IS_GUEST;
282 *out_session_flags |= SMB2_SESSION_FLAG_IS_NULL;
283 /* force no signing */
284 x->global->signing_required = false;
288 if (guest && x->global->encryption_required) {
289 DEBUG(1,("reject guest session as encryption is required\n"));
290 return NT_STATUS_ACCESS_DENIED;
293 if (xconn->smb2.server.cipher == 0) {
294 if (x->global->encryption_required) {
295 DEBUG(1,("reject session with dialect[0x%04X] "
296 "as encryption is required\n",
297 xconn->smb2.server.dialect));
298 return NT_STATUS_ACCESS_DENIED;
302 if (x->encryption_desired) {
303 *out_session_flags |= SMB2_SESSION_FLAG_ENCRYPT_DATA;
306 ZERO_STRUCT(session_key);
307 memcpy(session_key, session_info->session_key.data,
308 MIN(session_info->session_key.length, sizeof(session_key)));
310 x->global->signing_key = data_blob_talloc(x->global,
312 sizeof(session_key));
313 if (x->global->signing_key.data == NULL) {
314 ZERO_STRUCT(session_key);
315 return NT_STATUS_NO_MEMORY;
318 if (xconn->protocol >= PROTOCOL_SMB2_24) {
319 struct _derivation *d = &derivation.signing;
321 smb2_key_derivation(session_key, sizeof(session_key),
322 d->label.data, d->label.length,
323 d->context.data, d->context.length,
324 x->global->signing_key.data);
327 if (xconn->protocol >= PROTOCOL_SMB2_24) {
328 struct _derivation *d = &derivation.decryption;
330 x->global->decryption_key = data_blob_talloc(x->global,
332 sizeof(session_key));
333 if (x->global->decryption_key.data == NULL) {
334 ZERO_STRUCT(session_key);
335 return NT_STATUS_NO_MEMORY;
338 smb2_key_derivation(session_key, sizeof(session_key),
339 d->label.data, d->label.length,
340 d->context.data, d->context.length,
341 x->global->decryption_key.data);
344 if (xconn->protocol >= PROTOCOL_SMB2_24) {
345 struct _derivation *d = &derivation.encryption;
348 x->global->encryption_key = data_blob_talloc(x->global,
350 sizeof(session_key));
351 if (x->global->encryption_key.data == NULL) {
352 ZERO_STRUCT(session_key);
353 return NT_STATUS_NO_MEMORY;
356 smb2_key_derivation(session_key, sizeof(session_key),
357 d->label.data, d->label.length,
358 d->context.data, d->context.length,
359 x->global->encryption_key.data);
362 * CCM and GCM algorithms must never have their
363 * nonce wrap, or the security of the whole
364 * communication and the keys is destroyed.
365 * We must drop the connection once we have
366 * transfered too much data.
368 * NOTE: We assume nonces greater than 8 bytes.
370 generate_random_buffer((uint8_t *)&x->nonce_high_random,
371 sizeof(x->nonce_high_random));
372 switch (xconn->smb2.server.cipher) {
373 case SMB2_ENCRYPTION_AES128_CCM:
374 nonce_size = AES_CCM_128_NONCE_SIZE;
376 case SMB2_ENCRYPTION_AES128_GCM:
377 nonce_size = AES_GCM_128_IV_SIZE;
383 x->nonce_high_max = SMB2_NONCE_HIGH_MAX(nonce_size);
388 x->global->application_key = data_blob_dup_talloc(x->global,
389 x->global->signing_key);
390 if (x->global->application_key.data == NULL) {
391 ZERO_STRUCT(session_key);
392 return NT_STATUS_NO_MEMORY;
395 if (xconn->protocol >= PROTOCOL_SMB2_24) {
396 struct _derivation *d = &derivation.application;
398 smb2_key_derivation(session_key, sizeof(session_key),
399 d->label.data, d->label.length,
400 d->context.data, d->context.length,
401 x->global->application_key.data);
403 ZERO_STRUCT(session_key);
405 x->global->channels[0].signing_key = data_blob_dup_talloc(x->global->channels,
406 x->global->signing_key);
407 if (x->global->channels[0].signing_key.data == NULL) {
408 return NT_STATUS_NO_MEMORY;
411 data_blob_clear_free(&session_info->session_key);
412 session_info->session_key = data_blob_dup_talloc(session_info,
413 x->global->application_key);
414 if (session_info->session_key.data == NULL) {
415 return NT_STATUS_NO_MEMORY;
418 session->compat = talloc_zero(session, struct user_struct);
419 if (session->compat == NULL) {
420 return NT_STATUS_NO_MEMORY;
422 session->compat->session = session;
423 session->compat->homes_snum = -1;
424 session->compat->session_info = session_info;
425 session->compat->session_keystr = NULL;
426 session->compat->vuid = session->global->session_wire_id;
427 DLIST_ADD(smb2req->sconn->users, session->compat);
428 smb2req->sconn->num_users++;
430 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
431 session->compat->homes_snum =
432 register_homes_share(session_info->unix_info->unix_name);
435 set_current_user_info(session_info->unix_info->sanitized_username,
436 session_info->unix_info->unix_name,
437 session_info->info->domain_name);
439 reload_services(smb2req->sconn, conn_snum_used, true);
441 session->status = NT_STATUS_OK;
442 session->global->auth_session_info = talloc_move(session->global,
444 session->global->auth_session_info_seqnum += 1;
445 for (i=0; i < session->global->num_channels; i++) {
446 struct smbXsrv_channel_global0 *_c =
447 &session->global->channels[i];
449 _c->auth_session_info_seqnum =
450 session->global->auth_session_info_seqnum;
452 session->global->auth_time = timeval_to_nttime(&smb2req->request_time);
453 session->global->expiration_time = gensec_expire_time(auth->gensec);
455 if (!session_claim(session)) {
456 DEBUG(1, ("smb2: Failed to claim session "
458 (unsigned long long)session->compat->vuid));
459 return NT_STATUS_LOGON_FAILURE;
463 status = smbXsrv_session_update(session);
464 if (!NT_STATUS_IS_OK(status)) {
465 DEBUG(0, ("smb2: Failed to update session for vuid=%llu - %s\n",
466 (unsigned long long)session->compat->vuid,
468 return NT_STATUS_LOGON_FAILURE;
472 * we attach the session to the request
473 * so that the response can be signed
476 smb2req->do_signing = true;
479 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
481 *out_session_id = session->global->session_wire_id;
486 static NTSTATUS smbd_smb2_reauth_generic_return(struct smbXsrv_session *session,
487 struct smbXsrv_session_auth0 **_auth,
488 struct smbd_smb2_request *smb2req,
489 struct auth_session_info *session_info,
490 uint16_t *out_session_flags,
491 uint64_t *out_session_id)
494 struct smbXsrv_session *x = session;
495 struct smbXsrv_session_auth0 *auth = *_auth;
496 struct smbXsrv_connection *xconn = smb2req->xconn;
501 data_blob_clear_free(&session_info->session_key);
502 session_info->session_key = data_blob_dup_talloc(session_info,
503 x->global->application_key);
504 if (session_info->session_key.data == NULL) {
505 return NT_STATUS_NO_MEMORY;
508 session->compat->session_info = session_info;
509 session->compat->vuid = session->global->session_wire_id;
511 session->compat->homes_snum =
512 register_homes_share(session_info->unix_info->unix_name);
514 set_current_user_info(session_info->unix_info->sanitized_username,
515 session_info->unix_info->unix_name,
516 session_info->info->domain_name);
518 reload_services(smb2req->sconn, conn_snum_used, true);
520 session->status = NT_STATUS_OK;
521 TALLOC_FREE(session->global->auth_session_info);
522 session->global->auth_session_info = talloc_move(session->global,
524 session->global->auth_session_info_seqnum += 1;
525 for (i=0; i < session->global->num_channels; i++) {
526 struct smbXsrv_channel_global0 *_c =
527 &session->global->channels[i];
529 _c->auth_session_info_seqnum =
530 session->global->auth_session_info_seqnum;
532 session->global->auth_time = timeval_to_nttime(&smb2req->request_time);
533 session->global->expiration_time = gensec_expire_time(auth->gensec);
536 status = smbXsrv_session_update(session);
537 if (!NT_STATUS_IS_OK(status)) {
538 DEBUG(0, ("smb2: Failed to update session for vuid=%llu - %s\n",
539 (unsigned long long)session->compat->vuid,
541 return NT_STATUS_LOGON_FAILURE;
544 conn_clear_vuid_caches(xconn->client->sconn, session->compat->vuid);
546 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
547 smb2req->do_signing = true;
550 *out_session_id = session->global->session_wire_id;
555 struct smbd_smb2_session_setup_state {
556 struct tevent_context *ev;
557 struct smbd_smb2_request *smb2req;
558 uint64_t in_session_id;
560 uint8_t in_security_mode;
561 uint64_t in_previous_session_id;
562 DATA_BLOB in_security_buffer;
563 struct smbXsrv_session *session;
564 struct smbXsrv_session_auth0 *auth;
565 struct auth_session_info *session_info;
566 uint16_t out_session_flags;
567 DATA_BLOB out_security_buffer;
568 uint64_t out_session_id;
571 static void smbd_smb2_session_setup_gensec_done(struct tevent_req *subreq);
572 static void smbd_smb2_session_setup_previous_done(struct tevent_req *subreq);
573 static void smbd_smb2_session_setup_auth_return(struct tevent_req *req);
575 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
576 struct tevent_context *ev,
577 struct smbd_smb2_request *smb2req,
578 uint64_t in_session_id,
580 uint8_t in_security_mode,
581 uint64_t in_previous_session_id,
582 DATA_BLOB in_security_buffer)
584 struct tevent_req *req;
585 struct smbd_smb2_session_setup_state *state;
587 NTTIME now = timeval_to_nttime(&smb2req->request_time);
588 struct tevent_req *subreq;
589 struct smbXsrv_channel_global0 *c = NULL;
591 req = tevent_req_create(mem_ctx, &state,
592 struct smbd_smb2_session_setup_state);
597 state->smb2req = smb2req;
598 state->in_session_id = in_session_id;
599 state->in_flags = in_flags;
600 state->in_security_mode = in_security_mode;
601 state->in_previous_session_id = in_previous_session_id;
602 state->in_security_buffer = in_security_buffer;
604 if (in_flags & SMB2_SESSION_FLAG_BINDING) {
605 if (smb2req->xconn->protocol < PROTOCOL_SMB2_22) {
606 tevent_req_nterror(req, NT_STATUS_REQUEST_NOT_ACCEPTED);
607 return tevent_req_post(req, ev);
611 * We do not support multi channel.
613 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
614 return tevent_req_post(req, ev);
617 if (state->in_session_id == 0) {
618 /* create a new session */
619 status = smbXsrv_session_create(state->smb2req->xconn,
620 now, &state->session);
621 if (tevent_req_nterror(req, status)) {
622 return tevent_req_post(req, ev);
624 smb2req->session = state->session;
626 if (smb2req->session == NULL) {
627 tevent_req_nterror(req, NT_STATUS_USER_SESSION_DELETED);
628 return tevent_req_post(req, ev);
631 state->session = smb2req->session;
632 status = state->session->status;
633 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
634 status = NT_STATUS_OK;
636 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
637 status = NT_STATUS_OK;
639 if (tevent_req_nterror(req, status)) {
640 return tevent_req_post(req, ev);
642 if (!(in_flags & SMB2_SESSION_FLAG_BINDING)) {
643 state->session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
647 status = smbXsrv_session_find_channel(smb2req->session,
649 if (!NT_STATUS_IS_OK(status)) {
650 tevent_req_nterror(req, status);
651 return tevent_req_post(req, ev);
654 status = smbXsrv_session_find_auth(state->session, smb2req->xconn,
656 if (!NT_STATUS_IS_OK(status)) {
657 status = smbXsrv_session_create_auth(state->session,
659 in_flags, in_security_mode,
661 if (tevent_req_nterror(req, status)) {
662 return tevent_req_post(req, ev);
666 if (state->auth->gensec == NULL) {
667 status = auth_generic_prepare(state->auth,
668 state->smb2req->xconn->remote_address,
669 &state->auth->gensec);
670 if (tevent_req_nterror(req, status)) {
671 return tevent_req_post(req, ev);
674 gensec_want_feature(state->auth->gensec, GENSEC_FEATURE_SESSION_KEY);
675 gensec_want_feature(state->auth->gensec, GENSEC_FEATURE_UNIX_TOKEN);
677 status = gensec_start_mech_by_oid(state->auth->gensec,
679 if (tevent_req_nterror(req, status)) {
680 return tevent_req_post(req, ev);
684 status = smbXsrv_session_update(state->session);
685 if (tevent_req_nterror(req, status)) {
686 return tevent_req_post(req, ev);
690 subreq = gensec_update_send(state, state->ev,
692 state->in_security_buffer);
694 if (tevent_req_nomem(subreq, req)) {
695 return tevent_req_post(req, ev);
697 tevent_req_set_callback(subreq, smbd_smb2_session_setup_gensec_done, req);
702 static void smbd_smb2_session_setup_gensec_done(struct tevent_req *subreq)
704 struct tevent_req *req =
705 tevent_req_callback_data(subreq,
707 struct smbd_smb2_session_setup_state *state =
709 struct smbd_smb2_session_setup_state);
713 status = gensec_update_recv(subreq, state,
714 &state->out_security_buffer);
717 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
718 !NT_STATUS_IS_OK(status)) {
719 tevent_req_nterror(req, status);
723 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
724 state->out_session_id = state->session->global->session_wire_id;
725 state->smb2req->preauth = state->auth->preauth;
726 tevent_req_nterror(req, status);
730 status = gensec_session_info(state->auth->gensec,
732 &state->session_info);
733 if (tevent_req_nterror(req, status)) {
737 if ((state->in_previous_session_id != 0) &&
738 (state->session->global->session_wire_id !=
739 state->in_previous_session_id))
741 subreq = smb2srv_session_close_previous_send(state, state->ev,
742 state->smb2req->xconn,
744 state->in_previous_session_id,
745 state->session->global->session_wire_id);
746 if (tevent_req_nomem(subreq, req)) {
749 tevent_req_set_callback(subreq,
750 smbd_smb2_session_setup_previous_done,
755 smbd_smb2_session_setup_auth_return(req);
758 static void smbd_smb2_session_setup_previous_done(struct tevent_req *subreq)
760 struct tevent_req *req =
761 tevent_req_callback_data(subreq,
765 status = smb2srv_session_close_previous_recv(subreq);
767 if (tevent_req_nterror(req, status)) {
771 smbd_smb2_session_setup_auth_return(req);
774 static void smbd_smb2_session_setup_auth_return(struct tevent_req *req)
776 struct smbd_smb2_session_setup_state *state =
778 struct smbd_smb2_session_setup_state);
781 if (state->session->global->auth_session_info != NULL) {
782 status = smbd_smb2_reauth_generic_return(state->session,
786 &state->out_session_flags,
787 &state->out_session_id);
788 if (tevent_req_nterror(req, status)) {
791 tevent_req_done(req);
795 status = smbd_smb2_auth_generic_return(state->session,
798 state->in_security_mode,
800 &state->out_session_flags,
801 &state->out_session_id);
802 if (tevent_req_nterror(req, status)) {
806 tevent_req_done(req);
810 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
811 uint16_t *out_session_flags,
813 DATA_BLOB *out_security_buffer,
814 uint64_t *out_session_id)
816 struct smbd_smb2_session_setup_state *state =
818 struct smbd_smb2_session_setup_state);
821 if (tevent_req_is_nterror(req, &status)) {
822 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
823 tevent_req_received(req);
824 return nt_status_squash(status);
827 status = NT_STATUS_OK;
830 *out_session_flags = state->out_session_flags;
831 *out_security_buffer = state->out_security_buffer;
832 *out_session_id = state->out_session_id;
834 talloc_steal(mem_ctx, out_security_buffer->data);
835 tevent_req_received(req);
839 struct smbd_smb2_session_setup_wrap_state {
840 struct tevent_context *ev;
841 struct smbd_smb2_request *smb2req;
842 uint64_t in_session_id;
844 uint8_t in_security_mode;
845 uint64_t in_previous_session_id;
846 DATA_BLOB in_security_buffer;
847 uint16_t out_session_flags;
848 DATA_BLOB out_security_buffer;
849 uint64_t out_session_id;
853 static void smbd_smb2_session_setup_wrap_setup_done(struct tevent_req *subreq);
854 static void smbd_smb2_session_setup_wrap_shutdown_done(struct tevent_req *subreq);
856 static struct tevent_req *smbd_smb2_session_setup_wrap_send(TALLOC_CTX *mem_ctx,
857 struct tevent_context *ev,
858 struct smbd_smb2_request *smb2req,
859 uint64_t in_session_id,
861 uint8_t in_security_mode,
862 uint64_t in_previous_session_id,
863 DATA_BLOB in_security_buffer)
865 struct tevent_req *req;
866 struct smbd_smb2_session_setup_wrap_state *state;
867 struct tevent_req *subreq;
869 req = tevent_req_create(mem_ctx, &state,
870 struct smbd_smb2_session_setup_wrap_state);
875 state->smb2req = smb2req;
876 state->in_session_id = in_session_id;
877 state->in_flags = in_flags;
878 state->in_security_mode = in_security_mode;
879 state->in_previous_session_id = in_previous_session_id;
880 state->in_security_buffer = in_security_buffer;
882 subreq = smbd_smb2_session_setup_send(state, state->ev,
884 state->in_session_id,
886 state->in_security_mode,
887 state->in_previous_session_id,
888 state->in_security_buffer);
889 if (tevent_req_nomem(subreq, req)) {
890 return tevent_req_post(req, ev);
892 tevent_req_set_callback(subreq,
893 smbd_smb2_session_setup_wrap_setup_done, req);
898 static void smbd_smb2_session_setup_wrap_setup_done(struct tevent_req *subreq)
900 struct tevent_req *req =
901 tevent_req_callback_data(subreq,
903 struct smbd_smb2_session_setup_wrap_state *state =
905 struct smbd_smb2_session_setup_wrap_state);
908 status = smbd_smb2_session_setup_recv(subreq,
909 &state->out_session_flags,
911 &state->out_security_buffer,
912 &state->out_session_id);
914 if (NT_STATUS_IS_OK(status)) {
915 tevent_req_done(req);
918 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
919 tevent_req_nterror(req, status);
923 if (state->smb2req->session == NULL) {
924 tevent_req_nterror(req, status);
928 state->error = status;
930 subreq = smb2srv_session_shutdown_send(state, state->ev,
931 state->smb2req->session,
933 if (tevent_req_nomem(subreq, req)) {
936 tevent_req_set_callback(subreq,
937 smbd_smb2_session_setup_wrap_shutdown_done,
941 static void smbd_smb2_session_setup_wrap_shutdown_done(struct tevent_req *subreq)
943 struct tevent_req *req =
944 tevent_req_callback_data(subreq,
946 struct smbd_smb2_session_setup_wrap_state *state =
948 struct smbd_smb2_session_setup_wrap_state);
951 status = smb2srv_session_shutdown_recv(subreq);
953 if (tevent_req_nterror(req, status)) {
958 * we may need to sign the response, so we need to keep
959 * the session until the response is sent to the wire.
961 talloc_steal(state->smb2req, state->smb2req->session);
963 tevent_req_nterror(req, state->error);
966 static NTSTATUS smbd_smb2_session_setup_wrap_recv(struct tevent_req *req,
967 uint16_t *out_session_flags,
969 DATA_BLOB *out_security_buffer,
970 uint64_t *out_session_id)
972 struct smbd_smb2_session_setup_wrap_state *state =
974 struct smbd_smb2_session_setup_wrap_state);
977 if (tevent_req_is_nterror(req, &status)) {
978 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
979 tevent_req_received(req);
980 return nt_status_squash(status);
983 status = NT_STATUS_OK;
986 *out_session_flags = state->out_session_flags;
987 *out_security_buffer = state->out_security_buffer;
988 *out_session_id = state->out_session_id;
990 talloc_steal(mem_ctx, out_security_buffer->data);
991 tevent_req_received(req);
995 static struct tevent_req *smbd_smb2_logoff_send(TALLOC_CTX *mem_ctx,
996 struct tevent_context *ev,
997 struct smbd_smb2_request *smb2req);
998 static NTSTATUS smbd_smb2_logoff_recv(struct tevent_req *req);
999 static void smbd_smb2_request_logoff_done(struct tevent_req *subreq);
1001 NTSTATUS smbd_smb2_request_process_logoff(struct smbd_smb2_request *req)
1004 struct tevent_req *subreq = NULL;
1006 status = smbd_smb2_request_verify_sizes(req, 0x04);
1007 if (!NT_STATUS_IS_OK(status)) {
1008 return smbd_smb2_request_error(req, status);
1011 subreq = smbd_smb2_logoff_send(req, req->sconn->ev_ctx, req);
1012 if (subreq == NULL) {
1013 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
1015 tevent_req_set_callback(subreq, smbd_smb2_request_logoff_done, req);
1018 * Wait a long time before going async on this to allow
1019 * requests we're waiting on to finish. Set timeout to 10 secs.
1021 return smbd_smb2_request_pending_queue(req, subreq, 10000000);
1024 static void smbd_smb2_request_logoff_done(struct tevent_req *subreq)
1026 struct smbd_smb2_request *smb2req =
1027 tevent_req_callback_data(subreq,
1028 struct smbd_smb2_request);
1033 status = smbd_smb2_logoff_recv(subreq);
1034 TALLOC_FREE(subreq);
1035 if (!NT_STATUS_IS_OK(status)) {
1036 error = smbd_smb2_request_error(smb2req, status);
1037 if (!NT_STATUS_IS_OK(error)) {
1038 smbd_server_connection_terminate(smb2req->xconn,
1045 outbody = smbd_smb2_generate_outbody(smb2req, 0x04);
1046 if (outbody.data == NULL) {
1047 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
1048 if (!NT_STATUS_IS_OK(error)) {
1049 smbd_server_connection_terminate(smb2req->xconn,
1056 SSVAL(outbody.data, 0x00, 0x04); /* struct size */
1057 SSVAL(outbody.data, 0x02, 0); /* reserved */
1059 error = smbd_smb2_request_done(smb2req, outbody, NULL);
1060 if (!NT_STATUS_IS_OK(error)) {
1061 smbd_server_connection_terminate(smb2req->xconn,
1067 struct smbd_smb2_logoff_state {
1068 struct smbd_smb2_request *smb2req;
1071 static void smbd_smb2_logoff_shutdown_done(struct tevent_req *subreq);
1073 static struct tevent_req *smbd_smb2_logoff_send(TALLOC_CTX *mem_ctx,
1074 struct tevent_context *ev,
1075 struct smbd_smb2_request *smb2req)
1077 struct tevent_req *req;
1078 struct smbd_smb2_logoff_state *state;
1079 struct tevent_req *subreq;
1081 req = tevent_req_create(mem_ctx, &state,
1082 struct smbd_smb2_logoff_state);
1086 state->smb2req = smb2req;
1088 subreq = smb2srv_session_shutdown_send(state, ev,
1091 if (tevent_req_nomem(subreq, req)) {
1092 return tevent_req_post(req, ev);
1094 tevent_req_set_callback(subreq, smbd_smb2_logoff_shutdown_done, req);
1099 static void smbd_smb2_logoff_shutdown_done(struct tevent_req *subreq)
1101 struct tevent_req *req = tevent_req_callback_data(
1102 subreq, struct tevent_req);
1103 struct smbd_smb2_logoff_state *state = tevent_req_data(
1104 req, struct smbd_smb2_logoff_state);
1107 status = smb2srv_session_shutdown_recv(subreq);
1108 if (tevent_req_nterror(req, status)) {
1111 TALLOC_FREE(subreq);
1114 * As we've been awoken, we may have changed
1115 * uid in the meantime. Ensure we're still
1116 * root (SMB2_OP_LOGOFF has .as_root = true).
1118 change_to_root_user();
1120 status = smbXsrv_session_logoff(state->smb2req->session);
1121 if (tevent_req_nterror(req, status)) {
1126 * we may need to sign the response, so we need to keep
1127 * the session until the response is sent to the wire.
1129 talloc_steal(state->smb2req, state->smb2req->session);
1131 tevent_req_done(req);
1134 static NTSTATUS smbd_smb2_logoff_recv(struct tevent_req *req)
1136 return tevent_req_simple_recv_ntstatus(req);