s3-auth remove auth_ntlmssp_session_info()

[rusty/samba.git] / source3 / smbd / sesssetup.c

diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 20b31096b04aa253526bcf16dbf1b1bbbd046cdf..a5f2030ee59fc5064fb85da293d490de05449d46 100644 (file)
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -27,7 +27,7 @@
 #include "smbd/smbd.h"
 #include "smbd/globals.h"
 #include "../libcli/auth/spnego.h"
-#include "../libcli/auth/ntlmssp.h"
+#include "../auth/ntlmssp/ntlmssp.h"
 #include "ntlmssp_wrap.h"
 #include "../librpc/gen_ndr/krb5pac.h"
 #include "libads/kerberos_proto.h"
@@ -36,6 +36,7 @@
 #include "messages.h"
 #include "smbprofile.h"
 #include "../libcli/security/security.h"
+#include "auth/gensec/gensec.h"
 
 /* For split krb5 SPNEGO blobs. */
 struct pending_auth_data {
@@ -367,7 +368,7 @@ static void reply_spnego_kerberos(struct smb_request *req,
         * it.... */
 
        sess_vuid = register_existing_vuid(sconn, sess_vuid,
-                                          session_info, nullblob, user);
+                                          session_info, nullblob);
 
        reply_outbuf(req, 4, 0);
        SSVAL(req->outbuf,smb_uid,sess_vuid);
@@ -430,8 +431,9 @@ static void reply_spnego_ntlmssp(struct smb_request *req,
        struct smbd_server_connection *sconn = req->sconn;
 
        if (NT_STATUS_IS_OK(nt_status)) {
-               nt_status = auth_ntlmssp_steal_session_info(talloc_tos(),
-                                       (*auth_ntlmssp_state), &session_info);
+               nt_status = gensec_session_info((*auth_ntlmssp_state)->gensec_security,
+                                               talloc_tos(),
+                                               &session_info);
        }
 
        reply_outbuf(req, 4, 0);
@@ -448,8 +450,7 @@ static void reply_spnego_ntlmssp(struct smb_request *req,
 
                /* register_existing_vuid keeps the server info */
                if (register_existing_vuid(sconn, vuid,
-                                          session_info, nullblob,
-                                          auth_ntlmssp_get_username(*auth_ntlmssp_state)) !=
+                                          session_info, nullblob) !=
                                           vuid) {
                        /* The problem is, *auth_ntlmssp_state points
                         * into the vuser this will have
@@ -1135,27 +1136,12 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                return;
        }
 
-       if (blob1.data[0] == ASN1_APPLICATION(0)) {
-
-               /* its a negTokenTarg packet */
-
-               reply_spnego_negotiate(req, vuid, blob1,
-                                      &vuser->auth_ntlmssp_state);
-               data_blob_free(&blob1);
-               return;
-       }
-
-       if (blob1.data[0] == ASN1_CONTEXT(1)) {
-
-               /* its a auth packet */
-
-               reply_spnego_auth(req, vuid, blob1,
-                                 &vuser->auth_ntlmssp_state);
-               data_blob_free(&blob1);
-               return;
-       }
-
-       if (strncmp((char *)(blob1.data), "NTLMSSP", 7) == 0) {
+       /* Handle either raw NTLMSSP or hand off the whole blob to
+        * GENSEC.  The processing at this layer is essentially
+        * identical regardless.  In particular, both rely only on the
+        * status code (not the contents of the packet) and do not
+        * wrap the result */
+       if (sconn->use_gensec_hook || ntlmssp_blob_matches_magic(&blob1)) {
                DATA_BLOB chal;
 
                if (!vuser->auth_ntlmssp_state) {
@@ -1171,7 +1157,11 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
 
                        auth_ntlmssp_want_feature(vuser->auth_ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
 
-                       status = auth_ntlmssp_start(vuser->auth_ntlmssp_state);
+                       if (sconn->use_gensec_hook) {
+                               status = auth_generic_start(vuser->auth_ntlmssp_state, GENSEC_OID_SPNEGO);
+                       } else {
+                               status = auth_ntlmssp_start(vuser->auth_ntlmssp_state);
+                       }
                        if (!NT_STATUS_IS_OK(status)) {
                                /* Kill the intermediate vuid */
                                invalidate_vuid(sconn, vuid);
@@ -1189,11 +1179,31 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
 
                reply_spnego_ntlmssp(req, vuid,
                                     &vuser->auth_ntlmssp_state,
-                                    &chal, status, OID_NTLMSSP, false);
+                                    &chal, status, NULL, false);
                data_blob_free(&chal);
                return;
        }
 
+       if (blob1.data[0] == ASN1_APPLICATION(0)) {
+
+               /* its a negTokenTarg packet */
+
+               reply_spnego_negotiate(req, vuid, blob1,
+                                      &vuser->auth_ntlmssp_state);
+               data_blob_free(&blob1);
+               return;
+       }
+
+       if (blob1.data[0] == ASN1_CONTEXT(1)) {
+
+               /* its a auth packet */
+
+               reply_spnego_auth(req, vuid, blob1,
+                                 &vuser->auth_ntlmssp_state);
+               data_blob_free(&blob1);
+               return;
+       }
+
        /* what sort of packet is this? */
        DEBUG(1,("Unknown packet in reply_sesssetup_and_X_spnego\n"));
 
@@ -1297,6 +1307,8 @@ void reply_sesssetup_and_X(struct smb_request *req)
        struct smbd_server_connection *sconn = req->sconn;
 
        bool doencrypt = sconn->smb1.negprot.encrypted_passwords;
+       bool signing_allowed = false;
+       bool signing_mandatory = false;
 
        START_PROFILE(SMBsesssetupX);
 
@@ -1306,6 +1318,22 @@ void reply_sesssetup_and_X(struct smb_request *req)
 
        DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
 
+       if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES) {
+               signing_allowed = true;
+       }
+       if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED) {
+               signing_mandatory = true;
+       }
+
+       /*
+        * We can call srv_set_signing_negotiated() each time.
+        * It finds out when it needs to turn into a noop
+        * itself.
+        */
+       srv_set_signing_negotiated(req->sconn,
+                                  signing_allowed,
+                                  signing_mandatory);
+
        /* a SPNEGO session setup has 12 command words, whereas a normal
           NT1 session setup has 13. See the cifs spec. */
        if (req->wct == 12 &&
@@ -1541,7 +1569,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
                }
                fstrcpy(sub_user, user);
        } else {
-               fstrcpy(sub_user, lp_guestaccount());
+               fstrcpy(sub_user, "");
        }
 
        sub_set_smb_name(sub_user);
@@ -1641,7 +1669,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
                return;
        }
 
-       nt_status = create_local_token(req, server_info, NULL, &session_info);
+       nt_status = create_local_token(req, server_info, NULL, sub_user, &session_info);
        TALLOC_FREE(server_info);
 
        if (!NT_STATUS_IS_OK(nt_status)) {
@@ -1688,8 +1716,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
                /* register_existing_vuid keeps the session_info */
                sess_vuid = register_existing_vuid(sconn, sess_vuid,
                                        session_info,
-                                       nt_resp.data ? nt_resp : lm_resp,
-                                       sub_user);
+                                       nt_resp.data ? nt_resp : lm_resp);
                if (sess_vuid == UID_FIELD_INVALID) {
                        data_blob_free(&nt_resp);
                        data_blob_free(&lm_resp);