2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/tevent_ntstatus.h"
32 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
33 struct tevent_context *ev,
34 struct smbd_smb2_request *smb2req,
35 uint64_t in_session_id,
37 uint8_t in_security_mode,
38 uint64_t in_previous_session_id,
39 DATA_BLOB in_security_buffer);
40 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
41 uint16_t *out_session_flags,
43 DATA_BLOB *out_security_buffer,
44 uint64_t *out_session_id);
46 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq);
48 NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *smb2req)
51 const uint8_t *inbody;
52 int i = smb2req->current_idx;
53 uint64_t in_session_id;
55 uint8_t in_security_mode;
56 uint64_t in_previous_session_id;
57 uint16_t in_security_offset;
58 uint16_t in_security_length;
59 DATA_BLOB in_security_buffer;
61 struct tevent_req *subreq;
63 status = smbd_smb2_request_verify_sizes(smb2req, 0x19);
64 if (!NT_STATUS_IS_OK(status)) {
65 return smbd_smb2_request_error(smb2req, status);
67 inhdr = (const uint8_t *)smb2req->in.vector[i+0].iov_base;
68 inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
70 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
72 in_flags = CVAL(inbody, 0x02);
73 in_security_mode = CVAL(inbody, 0x03);
74 /* Capabilities = IVAL(inbody, 0x04) */
75 /* Channel = IVAL(inbody, 0x08) */
76 in_security_offset = SVAL(inbody, 0x0C);
77 in_security_length = SVAL(inbody, 0x0E);
78 in_previous_session_id = BVAL(inbody, 0x10);
80 if (in_security_offset != (SMB2_HDR_BODY + smb2req->in.vector[i+1].iov_len)) {
81 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
84 if (in_security_length > smb2req->in.vector[i+2].iov_len) {
85 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
88 in_security_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base;
89 in_security_buffer.length = in_security_length;
91 subreq = smbd_smb2_session_setup_send(smb2req,
92 smb2req->sconn->ev_ctx,
97 in_previous_session_id,
100 return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
102 tevent_req_set_callback(subreq, smbd_smb2_request_sesssetup_done, smb2req);
104 return smbd_smb2_request_pending_queue(smb2req, subreq, 500);
107 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq)
109 struct smbd_smb2_request *smb2req =
110 tevent_req_callback_data(subreq,
111 struct smbd_smb2_request);
112 int i = smb2req->current_idx;
116 uint16_t out_session_flags;
117 uint64_t out_session_id;
118 uint16_t out_security_offset;
119 DATA_BLOB out_security_buffer = data_blob_null;
121 NTSTATUS error; /* transport error */
123 status = smbd_smb2_session_setup_recv(subreq,
126 &out_security_buffer,
129 if (!NT_STATUS_IS_OK(status) &&
130 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
131 status = nt_status_squash(status);
132 error = smbd_smb2_request_error(smb2req, status);
133 if (!NT_STATUS_IS_OK(error)) {
134 smbd_server_connection_terminate(smb2req->sconn,
141 out_security_offset = SMB2_HDR_BODY + 0x08;
143 outhdr = (uint8_t *)smb2req->out.vector[i].iov_base;
145 outbody = data_blob_talloc(smb2req->out.vector, NULL, 0x08);
146 if (outbody.data == NULL) {
147 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
148 if (!NT_STATUS_IS_OK(error)) {
149 smbd_server_connection_terminate(smb2req->sconn,
156 SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id);
158 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
159 SSVAL(outbody.data, 0x02,
160 out_session_flags); /* session flags */
161 SSVAL(outbody.data, 0x04,
162 out_security_offset); /* security buffer offset */
163 SSVAL(outbody.data, 0x06,
164 out_security_buffer.length); /* security buffer length */
166 outdyn = out_security_buffer;
168 error = smbd_smb2_request_done_ex(smb2req, status, outbody, &outdyn,
170 if (!NT_STATUS_IS_OK(error)) {
171 smbd_server_connection_terminate(smb2req->sconn,
177 static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
178 struct smbd_smb2_request *smb2req,
179 uint8_t in_security_mode,
180 uint64_t in_previous_session_id,
181 DATA_BLOB in_security_buffer,
182 uint16_t *out_session_flags,
183 uint64_t *out_session_id)
187 uint8_t session_key[16];
188 struct smbXsrv_session *x = session;
189 struct auth_session_info *session_info;
190 struct smbXsrv_connection *conn = session->connection;
192 if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
193 lp_server_signing() == SMB_SIGNING_REQUIRED) {
194 x->global->signing_required = true;
197 status = gensec_session_info(session->gensec,
200 if (!NT_STATUS_IS_OK(status)) {
201 TALLOC_FREE(session);
205 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
206 /* we map anonymous to guest internally */
207 *out_session_flags |= SMB2_SESSION_FLAG_IS_GUEST;
208 *out_session_flags |= SMB2_SESSION_FLAG_IS_NULL;
209 /* force no signing */
210 x->global->signing_required = false;
214 ZERO_STRUCT(session_key);
215 memcpy(session_key, session_info->session_key.data,
216 MIN(session_info->session_key.length, sizeof(session_key)));
218 x->global->signing_key = data_blob_talloc(x->global,
220 sizeof(session_key));
221 if (x->global->signing_key.data == NULL) {
222 ZERO_STRUCT(session_key);
223 TALLOC_FREE(session);
224 return NT_STATUS_NO_MEMORY;
227 if (conn->protocol >= PROTOCOL_SMB2_24) {
228 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
229 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
231 smb2_key_derivation(session_key, sizeof(session_key),
232 label.data, label.length,
233 context.data, context.length,
234 x->global->signing_key.data);
237 x->global->application_key = data_blob_dup_talloc(x->global,
238 x->global->signing_key);
239 if (x->global->application_key.data == NULL) {
240 ZERO_STRUCT(session_key);
241 TALLOC_FREE(session);
242 return NT_STATUS_NO_MEMORY;
245 if (conn->protocol >= PROTOCOL_SMB2_24) {
246 const DATA_BLOB label = data_blob_string_const_null("SMB2APP");
247 const DATA_BLOB context = data_blob_string_const_null("SmbRpc");
249 smb2_key_derivation(session_key, sizeof(session_key),
250 label.data, label.length,
251 context.data, context.length,
252 x->global->application_key.data);
254 ZERO_STRUCT(session_key);
256 x->global->channels[0].signing_key = data_blob_dup_talloc(x->global->channels,
257 x->global->signing_key);
258 if (x->global->channels[0].signing_key.data == NULL) {
259 TALLOC_FREE(session);
260 return NT_STATUS_NO_MEMORY;
263 data_blob_clear_free(&session_info->session_key);
264 session_info->session_key = data_blob_dup_talloc(session_info,
265 x->global->application_key);
266 if (session_info->session_key.data == NULL) {
267 TALLOC_FREE(session);
268 return NT_STATUS_NO_MEMORY;
271 session->compat = talloc_zero(session, user_struct);
272 if (session->compat == NULL) {
273 TALLOC_FREE(session);
274 return NT_STATUS_NO_MEMORY;
276 session->compat->homes_snum = -1;
277 session->compat->session_info = session_info;
278 session->compat->session_keystr = NULL;
279 session->compat->vuid = session->global->session_wire_id;
280 DLIST_ADD(smb2req->sconn->users, session->compat);
281 smb2req->sconn->num_users++;
283 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
284 session->compat->homes_snum =
285 register_homes_share(session_info->unix_info->unix_name);
288 if (!session_claim(smb2req->sconn, session->compat)) {
289 DEBUG(1, ("smb2: Failed to claim session "
291 session->compat->vuid));
292 TALLOC_FREE(session);
293 return NT_STATUS_LOGON_FAILURE;
296 set_current_user_info(session_info->unix_info->sanitized_username,
297 session_info->unix_info->unix_name,
298 session_info->info->domain_name);
300 reload_services(smb2req->sconn, conn_snum_used, true);
302 session->status = NT_STATUS_OK;
303 session->global->auth_session_info = session->session_info;
304 session->global->auth_session_info_seqnum += 1;
305 session->global->channels[0].auth_session_info_seqnum =
306 session->global->auth_session_info_seqnum;
308 status = smbXsrv_session_update(session);
309 if (!NT_STATUS_IS_OK(status)) {
310 DEBUG(0, ("smb2: Failed to update session for vuid=%d - %s\n",
311 session->compat->vuid, nt_errstr(status)));
312 TALLOC_FREE(session);
313 return NT_STATUS_LOGON_FAILURE;
317 * we attach the session to the request
318 * so that the response can be signed
320 smb2req->session = session;
322 smb2req->do_signing = true;
325 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
327 *out_session_id = session->global->session_wire_id;
332 static NTSTATUS smbd_smb2_auth_generic(struct smbXsrv_session *session,
333 struct smbd_smb2_request *smb2req,
334 uint8_t in_security_mode,
335 uint64_t in_previous_session_id,
336 DATA_BLOB in_security_buffer,
337 uint16_t *out_session_flags,
338 DATA_BLOB *out_security_buffer,
339 uint64_t *out_session_id)
343 *out_security_buffer = data_blob_null;
345 if (session->gensec == NULL) {
346 status = auth_generic_prepare(session,
347 session->connection->remote_address,
349 if (!NT_STATUS_IS_OK(status)) {
350 TALLOC_FREE(session);
354 gensec_want_feature(session->gensec, GENSEC_FEATURE_SESSION_KEY);
355 gensec_want_feature(session->gensec, GENSEC_FEATURE_UNIX_TOKEN);
357 status = gensec_start_mech_by_oid(session->gensec,
359 if (!NT_STATUS_IS_OK(status)) {
360 TALLOC_FREE(session);
366 status = gensec_update(session->gensec,
369 out_security_buffer);
371 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
372 !NT_STATUS_IS_OK(status)) {
373 TALLOC_FREE(session);
374 return nt_status_squash(status);
377 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
378 *out_session_id = session->global->session_wire_id;
382 return smbd_smb2_auth_generic_return(session,
385 in_previous_session_id,
391 static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *smb2req,
392 uint64_t in_session_id,
394 uint8_t in_security_mode,
395 uint64_t in_previous_session_id,
396 DATA_BLOB in_security_buffer,
397 uint16_t *out_session_flags,
398 DATA_BLOB *out_security_buffer,
399 uint64_t *out_session_id)
401 struct smbXsrv_session *session;
403 NTTIME now = timeval_to_nttime(&req->request_time);
405 *out_session_flags = 0;
408 if (in_session_id == 0) {
409 /* create a new session */
410 status = smbXsrv_session_create(smb2req->sconn->conn,
412 if (!NT_STATUS_IS_OK(status)) {
416 status = smb2srv_session_lookup(smb2req->sconn->conn,
419 if (NT_STATUS_IS_OK(status)) {
420 return NT_STATUS_REQUEST_NOT_ACCEPTED;
422 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
427 return smbd_smb2_auth_generic(session,
430 in_previous_session_id,
437 struct smbd_smb2_session_setup_state {
438 struct tevent_context *ev;
439 struct smbd_smb2_request *smb2req;
440 uint64_t in_session_id;
442 uint8_t in_security_mode;
443 uint64_t in_previous_session_id;
444 DATA_BLOB in_security_buffer;
445 uint16_t out_session_flags;
446 DATA_BLOB out_security_buffer;
447 uint64_t out_session_id;
450 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
451 struct tevent_context *ev,
452 struct smbd_smb2_request *smb2req,
453 uint64_t in_session_id,
455 uint8_t in_security_mode,
456 uint64_t in_previous_session_id,
457 DATA_BLOB in_security_buffer)
459 struct tevent_req *req;
460 struct smbd_smb2_session_setup_state *state;
463 req = tevent_req_create(mem_ctx, &state,
464 struct smbd_smb2_session_setup_state);
469 state->smb2req = smb2req;
470 state->in_session_id = in_session_id;
471 state->in_flags = in_flags;
472 state->in_security_mode = in_security_mode;
473 state->in_previous_session_id = in_previous_session_id;
474 state->in_security_buffer = in_security_buffer;
476 status = smbd_smb2_session_setup(smb2req,
480 in_previous_session_id,
482 &state->out_session_flags,
483 &state->out_security_buffer,
484 &state->out_session_id);
485 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
486 NT_STATUS_IS_OK(status))
488 talloc_steal(state, state->out_security_buffer.data);
490 if (tevent_req_nterror(req, status)) {
491 return tevent_req_post(req, ev);
494 tevent_req_done(req);
495 return tevent_req_post(req, ev);
498 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
499 uint16_t *out_session_flags,
501 DATA_BLOB *out_security_buffer,
502 uint64_t *out_session_id)
504 struct smbd_smb2_session_setup_state *state =
506 struct smbd_smb2_session_setup_state);
509 if (tevent_req_is_nterror(req, &status)) {
510 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
511 tevent_req_received(req);
515 status = NT_STATUS_OK;
518 *out_session_flags = state->out_session_flags;
519 *out_security_buffer = state->out_security_buffer;
520 *out_session_id = state->out_session_id;
522 talloc_steal(mem_ctx, out_security_buffer->data);
523 tevent_req_received(req);
527 NTSTATUS smbd_smb2_request_process_logoff(struct smbd_smb2_request *req)
531 struct connection_struct *conn, *next_conn;
533 status = smbd_smb2_request_verify_sizes(req, 0x04);
534 if (!NT_STATUS_IS_OK(status)) {
535 return smbd_smb2_request_error(req, status);
539 * TODO: cancel all outstanding requests on the session
541 file_close_user(req->sconn, req->session->compat->vuid);
543 for (conn=req->sconn->connections; conn; conn=next_conn) {
544 struct smbXsrv_tcon *tcon;
546 next_conn = conn->next;
549 if (conn->vuid != req->session->compat->vuid) {
553 set_current_service(conn, 0, True);
554 close_cnum(conn, conn->vuid);
556 /* for now tcon is NULL for SMB1 */
560 invalidate_vuid(req->sconn, req->session->compat->vuid);
561 req->session->compat = NULL;
563 req->session->status = NT_STATUS_USER_SESSION_DELETED;
566 * we may need to sign the response, so we need to keep
567 * the session until the response is sent to the wire.
569 talloc_steal(req, req->session);
571 outbody = data_blob_talloc(req->out.vector, NULL, 0x04);
572 if (outbody.data == NULL) {
573 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
576 SSVAL(outbody.data, 0x00, 0x04); /* struct size */
577 SSVAL(outbody.data, 0x02, 0); /* reserved */
579 return smbd_smb2_request_done(req, outbody, NULL);