s3:smbd: only mark real guest sessions with the GUEST flag

[samba.git] / source3 / smbd / sesssetup.c

diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 43be24a889d494aefbef374e63495241158ed3c9..77b80776cbe9fb62bbcb3df672569267913346d1 100644 (file)
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -37,6 +37,7 @@
 #include "../libcli/security/security.h"
 #include "auth/gensec/gensec.h"
 #include "lib/conn_tdb.h"
+#include "../libcli/smb/smb_signing.h"
 
 /****************************************************************************
  Add the standard 'Samba' signature to the end of the session setup.
@@ -131,8 +132,8 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
        enum remote_arch_types ra_type = get_remote_arch();
        uint64_t vuid = req->vuid;
        NTSTATUS status = NT_STATUS_OK;
+       struct smbXsrv_connection *xconn = req->xconn;
        struct smbd_server_connection *sconn = req->sconn;
-       struct smbXsrv_connection *xconn = sconn->conn;
        uint16_t action = 0;
        NTTIME now = timeval_to_nttime(&req->request_time);
        struct smbXsrv_session *session = NULL;
@@ -203,7 +204,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
        }
 
        if (vuid != 0) {
-               status = smb1srv_session_lookup(sconn->conn,
+               status = smb1srv_session_lookup(xconn,
                                                vuid, now,
                                                &session);
                if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
@@ -226,7 +227,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
 
        if (session == NULL) {
                /* create a new session */
-               status = smbXsrv_session_create(sconn->conn,
+               status = smbXsrv_session_create(xconn,
                                                now, &session);
                if (!NT_STATUS_IS_OK(status)) {
                        reply_nterror(req, nt_status_squash(status));
@@ -235,7 +236,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
        }
 
        if (!session->gensec) {
-               status = auth_generic_prepare(session, sconn->remote_address,
+               status = auth_generic_prepare(session, xconn->remote_address,
                                              &session->gensec);
                if (!NT_STATUS_IS_OK(status)) {
                        TALLOC_FREE(session);
@@ -284,8 +285,8 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                        return;
                }
 
-               if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
-                       action = 1;
+               if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
+                       action |= SMB_SETUP_GUEST;
                }
 
                if (session_info->session_key.length > 0) {
@@ -354,6 +355,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                session->global->auth_session_info_seqnum += 1;
                session->global->channels[0].auth_session_info_seqnum =
                        session->global->auth_session_info_seqnum;
+               session->global->auth_time = now;
                if (client_caps & CAP_DYNAMIC_REAUTH) {
                        session->global->expiration_time =
                                gensec_expire_time(session->gensec);
@@ -409,8 +411,8 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                        return;
                }
 
-               if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
-                       action = 1;
+               if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
+                       action |= SMB_SETUP_GUEST;
                }
 
                /*
@@ -441,6 +443,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                session->global->auth_session_info_seqnum += 1;
                session->global->channels[0].auth_session_info_seqnum =
                        session->global->auth_session_info_seqnum;
+               session->global->auth_time = now;
                if (client_caps & CAP_DYNAMIC_REAUTH) {
                        session->global->expiration_time =
                                gensec_expire_time(session->gensec);
@@ -592,11 +595,12 @@ void reply_sesssetup_and_X(struct smb_request *req)
        NTTIME now = timeval_to_nttime(&req->request_time);
        struct smbXsrv_session *session = NULL;
        NTSTATUS nt_status;
+       struct smbXsrv_connection *xconn = req->xconn;
        struct smbd_server_connection *sconn = req->sconn;
-       struct smbXsrv_connection *xconn = sconn->conn;
        bool doencrypt = xconn->smb1.negprot.encrypted_passwords;
        bool signing_allowed = false;
-       bool signing_mandatory = false;
+       bool signing_mandatory = smb_signing_is_mandatory(
+               xconn->smb1.signing_state);
 
        START_PROFILE(SMBsesssetupX);
 
@@ -935,14 +939,14 @@ void reply_sesssetup_and_X(struct smb_request *req)
                /* perhaps grab OS version here?? */
        }
 
-       if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
-               action = 1;
+       if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
+               action |= SMB_SETUP_GUEST;
        }
 
        /* register the name and uid as being validated, so further connections
           to a uid can get through without a password, on the same VC */
 
-       nt_status = smbXsrv_session_create(sconn->conn,
+       nt_status = smbXsrv_session_create(xconn,
                                           now, &session);
        if (!NT_STATUS_IS_OK(nt_status)) {
                data_blob_free(&nt_resp);
@@ -1052,6 +1056,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
        session->global->auth_session_info_seqnum += 1;
        session->global->channels[0].auth_session_info_seqnum =
                session->global->auth_session_info_seqnum;
+       session->global->auth_time = now;
        session->global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
 
        nt_status = smbXsrv_session_update(session);