s3-auth rename auth_ntlmssp_state -> auth_generic_state

[mat/samba.git] / source3 / smbd / sesssetup.c

diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 6dc8609071d0f3bae3f2541a83baee0a6e53ea80..43ff13ec2872fd47fc587b1705bdf2261375ddd9 100644 (file)
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -27,7 +27,7 @@
 #include "smbd/smbd.h"
 #include "smbd/globals.h"
 #include "../libcli/auth/spnego.h"
-#include "../libcli/auth/ntlmssp.h"
+#include "../auth/ntlmssp/ntlmssp.h"
 #include "ntlmssp_wrap.h"
 #include "../librpc/gen_ndr/krb5pac.h"
 #include "libads/kerberos_proto.h"
@@ -341,7 +341,7 @@ static void reply_spnego_kerberos(struct smb_request *req,
        sub_set_smb_name(real_username);
 
        /* reload services so that the new %U is taken into account */
-       reload_services(sconn->msg_ctx, sconn->sock, True);
+       reload_services(sconn, conn_snum_used, true);
 
        ret = make_session_info_krb5(mem_ctx,
                                     user, domain, real_username, pw,
@@ -377,7 +377,7 @@ static void reply_spnego_kerberos(struct smb_request *req,
                ret = NT_STATUS_LOGON_FAILURE;
        } else {
                /* current_user_info is changed on new vuid */
-               reload_services(sconn->msg_ctx, sconn->sock, True);
+               reload_services(sconn, conn_snum_used, true);
 
                SSVAL(req->outbuf, smb_vwv3, 0);
 
@@ -420,7 +420,7 @@ static void reply_spnego_kerberos(struct smb_request *req,
 
 static void reply_spnego_ntlmssp(struct smb_request *req,
                                 uint16 vuid,
-                                struct auth_ntlmssp_state **auth_ntlmssp_state,
+                                struct auth_generic_state **auth_ntlmssp_state,
                                 DATA_BLOB *ntlmssp_blob, NTSTATUS nt_status,
                                 const char *OID,
                                 bool wrap)
@@ -431,8 +431,9 @@ static void reply_spnego_ntlmssp(struct smb_request *req,
        struct smbd_server_connection *sconn = req->sconn;
 
        if (NT_STATUS_IS_OK(nt_status)) {
-               nt_status = auth_ntlmssp_session_info(talloc_tos(),
-                                       (*auth_ntlmssp_state), &session_info);
+               nt_status = gensec_session_info((*auth_ntlmssp_state)->gensec_security,
+                                               talloc_tos(),
+                                               &session_info);
        }
 
        reply_outbuf(req, 4, 0);
@@ -461,7 +462,7 @@ static void reply_spnego_ntlmssp(struct smb_request *req,
                }
 
                /* current_user_info is changed on new vuid */
-               reload_services(sconn->msg_ctx, sconn->sock, True);
+               reload_services(sconn, conn_snum_used, true);
 
                SSVAL(req->outbuf, smb_vwv3, 0);
 
@@ -577,7 +578,7 @@ static void reply_spnego_downgrade_to_ntlmssp(struct smb_request *req,
 static void reply_spnego_negotiate(struct smb_request *req,
                                   uint16 vuid,
                                   DATA_BLOB blob1,
-                                  struct auth_ntlmssp_state **auth_ntlmssp_state)
+                                  struct auth_generic_state **auth_ntlmssp_state)
 {
        DATA_BLOB secblob;
        DATA_BLOB chal;
@@ -633,7 +634,7 @@ static void reply_spnego_negotiate(struct smb_request *req,
                return;
        }
 
-       auth_ntlmssp_want_feature(*auth_ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
+       gensec_want_feature((*auth_ntlmssp_state)->gensec_security, GENSEC_FEATURE_SESSION_KEY);
 
        status = auth_ntlmssp_start(*auth_ntlmssp_state);
        if (!NT_STATUS_IS_OK(status)) {
@@ -643,8 +644,8 @@ static void reply_spnego_negotiate(struct smb_request *req,
                return;
        }
 
-       status = auth_ntlmssp_update(*auth_ntlmssp_state, talloc_tos(),
-                                       secblob, &chal);
+       status = gensec_update((*auth_ntlmssp_state)->gensec_security, talloc_tos(),
+                              NULL, secblob, &chal);
 
        data_blob_free(&secblob);
 
@@ -664,7 +665,7 @@ static void reply_spnego_negotiate(struct smb_request *req,
 static void reply_spnego_auth(struct smb_request *req,
                              uint16 vuid,
                              DATA_BLOB blob1,
-                             struct auth_ntlmssp_state **auth_ntlmssp_state)
+                             struct auth_generic_state **auth_ntlmssp_state)
 {
        DATA_BLOB auth = data_blob_null;
        DATA_BLOB auth_reply = data_blob_null;
@@ -745,7 +746,7 @@ static void reply_spnego_auth(struct smb_request *req,
                        return;
                }
 
-               auth_ntlmssp_want_feature(*auth_ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
+               gensec_want_feature((*auth_ntlmssp_state)->gensec_security, GENSEC_FEATURE_SESSION_KEY);
 
                status = auth_ntlmssp_start(*auth_ntlmssp_state);
                if (!NT_STATUS_IS_OK(status)) {
@@ -756,8 +757,8 @@ static void reply_spnego_auth(struct smb_request *req,
                }
        }
 
-       status = auth_ntlmssp_update(*auth_ntlmssp_state, talloc_tos(),
-                                    auth, &auth_reply);
+       status = gensec_update((*auth_ntlmssp_state)->gensec_security, talloc_tos(),
+                              NULL, auth, &auth_reply);
 
        data_blob_free(&auth);
 
@@ -1154,7 +1155,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                                return;
                        }
 
-                       auth_ntlmssp_want_feature(vuser->auth_ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
+                       gensec_want_feature(vuser->auth_ntlmssp_state->gensec_security, GENSEC_FEATURE_SESSION_KEY);
 
                        if (sconn->use_gensec_hook) {
                                status = auth_generic_start(vuser->auth_ntlmssp_state, GENSEC_OID_SPNEGO);
@@ -1170,9 +1171,9 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                        }
                }
 
-               status = auth_ntlmssp_update(vuser->auth_ntlmssp_state,
-                                            talloc_tos(),
-                                            blob1, &chal);
+               status = gensec_update(vuser->auth_ntlmssp_state->gensec_security,
+                                      talloc_tos(), NULL,
+                                      blob1, &chal);
 
                data_blob_free(&blob1);
 
@@ -1306,6 +1307,8 @@ void reply_sesssetup_and_X(struct smb_request *req)
        struct smbd_server_connection *sconn = req->sconn;
 
        bool doencrypt = sconn->smb1.negprot.encrypted_passwords;
+       bool signing_allowed = false;
+       bool signing_mandatory = false;
 
        START_PROFILE(SMBsesssetupX);
 
@@ -1315,6 +1318,22 @@ void reply_sesssetup_and_X(struct smb_request *req)
 
        DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
 
+       if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES) {
+               signing_allowed = true;
+       }
+       if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) {
+               signing_mandatory = true;
+       }
+
+       /*
+        * We can call srv_set_signing_negotiated() each time.
+        * It finds out when it needs to turn into a noop
+        * itself.
+        */
+       srv_set_signing_negotiated(req->sconn,
+                                  signing_allowed,
+                                  signing_mandatory);
+
        /* a SPNEGO session setup has 12 command words, whereas a normal
           NT1 session setup has 13. See the cifs spec. */
        if (req->wct == 12 &&
@@ -1555,7 +1574,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
 
        sub_set_smb_name(sub_user);
 
-       reload_services(sconn->msg_ctx, sconn->sock, True);
+       reload_services(sconn, conn_snum_used, true);
 
        if (lp_security() == SEC_SHARE) {
                char *sub_user_mapped = NULL;
@@ -1708,7 +1727,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
                }
 
                /* current_user_info is changed on new vuid */
-               reload_services(sconn->msg_ctx, sconn->sock, True);
+               reload_services(sconn, conn_snum_used, true);
        }
 
        data_blob_free(&nt_resp);