Core SMB2 server
Copyright (C) Stefan Metzmacher 2009
+ Copyright (C) Jeremy Allison 2010
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
#include "../libcli/auth/spnego.h"
#include "ntlmssp.h"
-static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *req,
+static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *smb2req,
uint64_t in_session_id,
uint8_t in_security_mode,
DATA_BLOB in_security_buffer,
DATA_BLOB *out_security_buffer,
uint64_t *out_session_id);
-NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *req)
+NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *smb2req)
{
const uint8_t *inhdr;
const uint8_t *inbody;
- int i = req->current_idx;
+ int i = smb2req->current_idx;
uint8_t *outhdr;
DATA_BLOB outbody;
DATA_BLOB outdyn;
DATA_BLOB out_security_buffer;
NTSTATUS status;
- inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
+ inhdr = (const uint8_t *)smb2req->in.vector[i+0].iov_base;
- if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
- return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+ if (smb2req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
+ return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
}
- inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
+ inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
body_size = SVAL(inbody, 0x00);
if (body_size != expected_body_size) {
- return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+ return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
}
in_security_offset = SVAL(inbody, 0x0C);
in_security_length = SVAL(inbody, 0x0E);
if (in_security_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
- return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+ return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
}
- if (in_security_length > req->in.vector[i+2].iov_len) {
- return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+ if (in_security_length > smb2req->in.vector[i+2].iov_len) {
+ return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
}
in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
in_security_mode = CVAL(inbody, 0x03);
- in_security_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
+ in_security_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base;
in_security_buffer.length = in_security_length;
- status = smbd_smb2_session_setup(req,
+ status = smbd_smb2_session_setup(smb2req,
in_session_id,
in_security_mode,
in_security_buffer,
if (!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
status = nt_status_squash(status);
- return smbd_smb2_request_error(req, status);
+ return smbd_smb2_request_error(smb2req, status);
}
out_security_offset = SMB2_HDR_BODY + 0x08;
- outhdr = (uint8_t *)req->out.vector[i].iov_base;
+ outhdr = (uint8_t *)smb2req->out.vector[i].iov_base;
- outbody = data_blob_talloc(req->out.vector, NULL, 0x08);
+ outbody = data_blob_talloc(smb2req->out.vector, NULL, 0x08);
if (outbody.data == NULL) {
- return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
+ return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
}
SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id);
outdyn = out_security_buffer;
- return smbd_smb2_request_done_ex(req, status, outbody, &outdyn,
+ return smbd_smb2_request_done_ex(smb2req, status, outbody, &outdyn,
__location__);
}
return 0;
}
-static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *req,
- uint64_t in_session_id,
- uint8_t in_security_mode,
+static NTSTATUS smbd_smb2_session_setup_krb5(struct smbd_smb2_session *session,
+ struct smbd_smb2_request *smb2req,
+ const DATA_BLOB *psecblob_in,
+ const char *kerb_mech,
+ uint16_t *out_session_flags,
+ DATA_BLOB *out_security_buffer,
+ uint64_t *out_session_id)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS smbd_smb2_spnego_negotiate(struct smbd_smb2_session *session,
+ struct smbd_smb2_request *smb2req,
DATA_BLOB in_security_buffer,
uint16_t *out_session_flags,
DATA_BLOB *out_security_buffer,
uint64_t *out_session_id)
{
- struct smbd_smb2_session *session;
+ DATA_BLOB secblob_in = data_blob_null;
+ DATA_BLOB chal_out = data_blob_null;
+ DATA_BLOB secblob_out = data_blob_null;
+ char *kerb_mech = NULL;
NTSTATUS status;
- *out_session_flags = 0;
- *out_session_id = 0;
-
- if (in_session_id == 0) {
- int id;
+ /* Ensure we have no old NTLM state around. */
+ auth_ntlmssp_end(&session->auth_ntlmssp_state);
- /* create a new session */
- session = talloc_zero(req->sconn, struct smbd_smb2_session);
- if (session == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
- id = idr_get_new_random(req->sconn->smb2.sessions.idtree,
- session,
- req->sconn->smb2.sessions.limit);
- if (id == -1) {
- return NT_STATUS_INSUFFICIENT_RESOURCES;
- }
- session->vuid = id;
-
- session->tcons.idtree = idr_init(session);
- if (session->tcons.idtree == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- session->tcons.limit = 0x0000FFFE;
- session->tcons.list = NULL;
-
- DLIST_ADD_END(req->sconn->smb2.sessions.list, session,
- struct smbd_smb2_session *);
- session->sconn = req->sconn;
- talloc_set_destructor(session, smbd_smb2_session_destructor);
- } else {
- void *p;
-
- /* lookup an existing session */
- p = idr_find(req->sconn->smb2.sessions.idtree, in_session_id);
- if (p == NULL) {
- return NT_STATUS_USER_SESSION_DELETED;
- }
- session = talloc_get_type_abort(p, struct smbd_smb2_session);
+ status = parse_spnego_mechanisms(in_security_buffer,
+ &secblob_in, &kerb_mech);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto out;
}
- if (NT_STATUS_IS_OK(session->status)) {
- return NT_STATUS_REQUEST_NOT_ACCEPTED;
+#ifdef HAVE_KRB5
+ if (kerb_mech && ((lp_security()==SEC_ADS) ||
+ USE_KERBEROS_KEYTAB) ) {
+ status = smbd_smb2_session_setup_krb5(session,
+ smb2req,
+ &secblob_in,
+ kerb_mech,
+ out_session_flags,
+ out_security_buffer,
+ out_session_id);
+
+ goto out;
}
+#endif
- if (session->auth_ntlmssp_state == NULL) {
- status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
- if (!NT_STATUS_IS_OK(status)) {
- TALLOC_FREE(session);
- return status;
- }
+ status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto out;
}
- if (in_security_buffer.data[0] == ASN1_APPLICATION(0)) {
- DATA_BLOB secblob_in;
- DATA_BLOB chal_out;
- char *kerb_mech = NULL;
-
- status = parse_spnego_mechanisms(in_security_buffer,
- &secblob_in, &kerb_mech);
- if (!NT_STATUS_IS_OK(status)) {
- TALLOC_FREE(session);
- return nt_status_squash(status);
- }
-
- /* For now, just SPNEGO NTLMSSP - krb5 goes here later.. */
- status = auth_ntlmssp_update(session->auth_ntlmssp_state,
- secblob_in,
- &chal_out);
-
- if (!NT_STATUS_IS_OK(status) &&
- !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
- auth_ntlmssp_end(&session->auth_ntlmssp_state);
- TALLOC_FREE(session);
- return nt_status_squash(status);
- }
-
- *out_security_buffer = spnego_gen_auth_response(&chal_out,
- status, OID_NTLMSSP);
-
- *out_session_id = session->vuid;
- return status;
- } else if (in_security_buffer.data[0] == ASN1_CONTEXT(1)) {
- DATA_BLOB auth = data_blob_null;
- DATA_BLOB auth_out = data_blob_null;
-
- /* its an auth packet */
- if (!spnego_parse_auth(in_security_buffer, &auth)) {
- TALLOC_FREE(session);
- return NT_STATUS_LOGON_FAILURE;
- }
- /* For now, just SPNEGO NTLMSSP - krb5 goes here later.. */
- status = auth_ntlmssp_update(session->auth_ntlmssp_state,
- auth,
- &auth_out);
- if (!NT_STATUS_IS_OK(status)) {
- auth_ntlmssp_end(&session->auth_ntlmssp_state);
- TALLOC_FREE(session);
- return nt_status_squash(status);
- }
+ status = auth_ntlmssp_update(session->auth_ntlmssp_state,
+ secblob_in,
+ &chal_out);
- *out_security_buffer = spnego_gen_auth_response(&auth_out,
- status, NULL);
+ if (!NT_STATUS_IS_OK(status) &&
+ !NT_STATUS_EQUAL(status,
+ NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ goto out;
+ }
- *out_session_id = session->vuid;
- } else if (strncmp((char *)(in_security_buffer.data), "NTLMSSP", 7) == 0) {
+ secblob_out = spnego_gen_auth_response(&chal_out,
+ status,
+ OID_NTLMSSP);
+ *out_security_buffer = data_blob_talloc(smb2req,
+ secblob_out.data,
+ secblob_out.length);
+ if (out_security_buffer->data == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+ *out_session_id = session->vuid;
- /* RAW NTLMSSP */
- status = auth_ntlmssp_update(session->auth_ntlmssp_state,
- in_security_buffer,
- out_security_buffer);
+ out:
- if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
- *out_session_id = session->vuid;
- return status;
- }
- if (!NT_STATUS_IS_OK(status)) {
- auth_ntlmssp_end(&session->auth_ntlmssp_state);
- TALLOC_FREE(session);
- return nt_status_squash(status);
- }
- *out_session_id = session->vuid;
+ data_blob_free(&secblob_in);
+ data_blob_free(&secblob_out);
+ data_blob_free(&chal_out);
+ SAFE_FREE(kerb_mech);
+ if (!NT_STATUS_IS_OK(status) &&
+ !NT_STATUS_EQUAL(status,
+ NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ auth_ntlmssp_end(&session->auth_ntlmssp_state);
+ TALLOC_FREE(session);
}
+ return status;
+}
- /* TODO: setup session key for signing */
-
+static NTSTATUS smbd_smb2_common_ntlmssp_auth_return(struct smbd_smb2_session *session,
+ struct smbd_smb2_request *smb2req,
+ uint8_t in_security_mode,
+ DATA_BLOB in_security_buffer,
+ uint16_t *out_session_flags)
+{
if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
lp_server_signing() == Required) {
session->do_signing = true;
session->auth_ntlmssp_state->ntlmssp_state->session_key.length);
if (session->auth_ntlmssp_state->ntlmssp_state->session_key.length > 0) {
if (session->server_info->user_session_key.data == NULL) {
+ auth_ntlmssp_end(&session->auth_ntlmssp_state);
TALLOC_FREE(session);
return NT_STATUS_NO_MEMORY;
}
session->compat_vuser = talloc_zero(session, user_struct);
if (session->compat_vuser == NULL) {
+ auth_ntlmssp_end(&session->auth_ntlmssp_state);
TALLOC_FREE(session);
return NT_STATUS_NO_MEMORY;
}
* we attach the session to the request
* so that the response can be signed
*/
- req->session = session;
+ smb2req->session = session;
if (session->do_signing) {
- req->do_signing = true;
+ smb2req->do_signing = true;
+ }
+
+ global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS smbd_smb2_spnego_auth(struct smbd_smb2_session *session,
+ struct smbd_smb2_request *smb2req,
+ uint8_t in_security_mode,
+ DATA_BLOB in_security_buffer,
+ uint16_t *out_session_flags,
+ DATA_BLOB *out_security_buffer,
+ uint64_t *out_session_id)
+{
+ DATA_BLOB auth = data_blob_null;
+ DATA_BLOB auth_out = data_blob_null;
+ DATA_BLOB secblob_out = data_blob_null;
+ NTSTATUS status;
+
+ if (!spnego_parse_auth(in_security_buffer, &auth)) {
+ TALLOC_FREE(session);
+ return NT_STATUS_LOGON_FAILURE;
+ }
+
+ status = auth_ntlmssp_update(session->auth_ntlmssp_state,
+ auth,
+ &auth_out);
+ if (!NT_STATUS_IS_OK(status)) {
+ auth_ntlmssp_end(&session->auth_ntlmssp_state);
+ data_blob_free(&auth);
+ TALLOC_FREE(session);
+ return status;
+ }
+
+ data_blob_free(&auth);
+
+ secblob_out = spnego_gen_auth_response(&auth_out,
+ status, NULL);
+
+ *out_security_buffer = data_blob_talloc(smb2req,
+ secblob_out.data,
+ secblob_out.length);
+ if (out_security_buffer->data == NULL) {
+ auth_ntlmssp_end(&session->auth_ntlmssp_state);
+ TALLOC_FREE(session);
+ return NT_STATUS_NO_MEMORY;
}
*out_session_id = session->vuid;
- global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
- return status;
+ return smbd_smb2_common_ntlmssp_auth_return(session,
+ smb2req,
+ in_security_mode,
+ in_security_buffer,
+ out_session_flags);
+}
+
+static NTSTATUS smbd_smb2_raw_ntlmssp_auth(struct smbd_smb2_session *session,
+ struct smbd_smb2_request *smb2req,
+ uint8_t in_security_mode,
+ DATA_BLOB in_security_buffer,
+ uint16_t *out_session_flags,
+ DATA_BLOB *out_security_buffer,
+ uint64_t *out_session_id)
+{
+ NTSTATUS status;
+ DATA_BLOB secblob_out = data_blob_null;
+
+ if (session->auth_ntlmssp_state == NULL) {
+ status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
+ if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(session);
+ return status;
+ }
+ }
+
+ /* RAW NTLMSSP */
+ status = auth_ntlmssp_update(session->auth_ntlmssp_state,
+ in_security_buffer,
+ &secblob_out);
+
+ if (NT_STATUS_IS_OK(status) ||
+ NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ *out_security_buffer = data_blob_talloc(smb2req,
+ secblob_out.data,
+ secblob_out.length);
+ if (out_security_buffer->data == NULL) {
+ auth_ntlmssp_end(&session->auth_ntlmssp_state);
+ TALLOC_FREE(session);
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
+
+ if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ *out_session_id = session->vuid;
+ return status;
+ }
+ if (!NT_STATUS_IS_OK(status)) {
+ auth_ntlmssp_end(&session->auth_ntlmssp_state);
+ TALLOC_FREE(session);
+ return status;
+ }
+ *out_session_id = session->vuid;
+
+ return smbd_smb2_common_ntlmssp_auth_return(session,
+ smb2req,
+ in_security_mode,
+ in_security_buffer,
+ out_session_flags);
+}
+
+static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *smb2req,
+ uint64_t in_session_id,
+ uint8_t in_security_mode,
+ DATA_BLOB in_security_buffer,
+ uint16_t *out_session_flags,
+ DATA_BLOB *out_security_buffer,
+ uint64_t *out_session_id)
+{
+ struct smbd_smb2_session *session;
+
+ *out_session_flags = 0;
+ *out_session_id = 0;
+
+ if (in_session_id == 0) {
+ int id;
+
+ /* create a new session */
+ session = talloc_zero(smb2req->sconn, struct smbd_smb2_session);
+ if (session == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
+ id = idr_get_new_random(smb2req->sconn->smb2.sessions.idtree,
+ session,
+ smb2req->sconn->smb2.sessions.limit);
+ if (id == -1) {
+ return NT_STATUS_INSUFFICIENT_RESOURCES;
+ }
+ session->vuid = id;
+
+ session->tcons.idtree = idr_init(session);
+ if (session->tcons.idtree == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ session->tcons.limit = 0x0000FFFE;
+ session->tcons.list = NULL;
+
+ DLIST_ADD_END(smb2req->sconn->smb2.sessions.list, session,
+ struct smbd_smb2_session *);
+ session->sconn = smb2req->sconn;
+ talloc_set_destructor(session, smbd_smb2_session_destructor);
+ } else {
+ void *p;
+
+ /* lookup an existing session */
+ p = idr_find(smb2req->sconn->smb2.sessions.idtree, in_session_id);
+ if (p == NULL) {
+ return NT_STATUS_USER_SESSION_DELETED;
+ }
+ session = talloc_get_type_abort(p, struct smbd_smb2_session);
+ }
+
+ if (NT_STATUS_IS_OK(session->status)) {
+ return NT_STATUS_REQUEST_NOT_ACCEPTED;
+ }
+
+ if (in_security_buffer.data[0] == ASN1_APPLICATION(0)) {
+ return smbd_smb2_spnego_negotiate(session,
+ smb2req,
+ in_security_buffer,
+ out_session_flags,
+ out_security_buffer,
+ out_session_id);
+ } else if (in_security_buffer.data[0] == ASN1_CONTEXT(1)) {
+ return smbd_smb2_spnego_auth(session,
+ smb2req,
+ in_security_mode,
+ in_security_buffer,
+ out_session_flags,
+ out_security_buffer,
+ out_session_id);
+ } else if (strncmp((char *)(in_security_buffer.data), "NTLMSSP", 7) == 0) {
+ return smbd_smb2_raw_ntlmssp_auth(session,
+ smb2req,
+ in_security_mode,
+ in_security_buffer,
+ out_session_flags,
+ out_security_buffer,
+ out_session_id);
+ }
+
+ /* Unknown packet type. */
+ DEBUG(1,("Unknown packet type %u in smb2 sessionsetup\n",
+ (unsigned int)in_security_buffer.data[0] ));
+ auth_ntlmssp_end(&session->auth_ntlmssp_state);
+ TALLOC_FREE(session);
+ return NT_STATUS_LOGON_FAILURE;
}
NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
git.samba.org / samba.git / commitdiff