TODO backport? smb1 spnego smb1.sessions.done_sesssetup
[metze/samba/wip.git] / source3 / smbd / sesssetup.c
index 75da143a28d4435bcb6740748cafb112f90cd2c8..84e2181058191a66fc13508aea84f990ad068f18 100644 (file)
 
 #include "includes.h"
 #include "../lib/tsocket/tsocket.h"
+#include "lib/util/server_id.h"
 #include "smbd/smbd.h"
 #include "smbd/globals.h"
-#include "../libcli/auth/spnego.h"
-#include "../auth/ntlmssp/ntlmssp.h"
-#include "../librpc/gen_ndr/krb5pac.h"
-#include "libads/kerberos_proto.h"
-#include "../lib/util/asn1.h"
 #include "auth.h"
 #include "messages.h"
 #include "smbprofile.h"
 #include "../libcli/security/security.h"
 #include "auth/gensec/gensec.h"
 #include "lib/conn_tdb.h"
+#include "../libcli/smb/smb_signing.h"
 
 /****************************************************************************
  Add the standard 'Samba' signature to the end of the session setup.
 ****************************************************************************/
 
-static int push_signature(uint8 **outbuf)
+static int push_signature(uint8_t **outbuf)
 {
        char *lanman;
        int result, tmp;
@@ -77,41 +74,6 @@ static int push_signature(uint8 **outbuf)
        return result;
 }
 
-/****************************************************************************
- Do a 'guest' logon, getting back the
-****************************************************************************/
-
-static NTSTATUS check_guest_password(const struct tsocket_address *remote_address,
-                                    TALLOC_CTX *mem_ctx, 
-                                    struct auth_session_info **session_info)
-{
-       struct auth4_context *auth_context;
-       struct auth_usersupplied_info *user_info = NULL;
-       uint8_t chal[8];
-       NTSTATUS nt_status;
-
-       DEBUG(3,("Got anonymous request\n"));
-
-       nt_status = make_auth4_context(talloc_tos(), &auth_context);
-       if (!NT_STATUS_IS_OK(nt_status)) {
-               return nt_status;
-       }
-
-       auth_context->get_ntlm_challenge(auth_context,
-                                        chal);
-
-       if (!make_user_info_guest(talloc_tos(), remote_address, &user_info)) {
-               TALLOC_FREE(auth_context);
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       nt_status = auth_check_password_session_info(auth_context, 
-                                                    mem_ctx, user_info, session_info);
-       TALLOC_FREE(user_info);
-       TALLOC_FREE(auth_context);
-       return nt_status;
-}
-
 /****************************************************************************
  Reply to a session setup command.
  conn POINTER CAN BE NULL HERE !
@@ -119,7 +81,7 @@ static NTSTATUS check_guest_password(const struct tsocket_address *remote_addres
 
 static void reply_sesssetup_and_X_spnego(struct smb_request *req)
 {
-       const uint8 *p;
+       const uint8_t *p;
        DATA_BLOB in_blob;
        DATA_BLOB out_blob = data_blob_null;
        size_t bufrem;
@@ -127,17 +89,19 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
        const char *native_os;
        const char *native_lanman;
        const char *primary_domain;
-       uint16 data_blob_len = SVAL(req->vwv+7, 0);
+       uint16_t data_blob_len = SVAL(req->vwv+7, 0);
        enum remote_arch_types ra_type = get_remote_arch();
        uint64_t vuid = req->vuid;
        NTSTATUS status = NT_STATUS_OK;
+       struct smbXsrv_connection *xconn = req->xconn;
        struct smbd_server_connection *sconn = req->sconn;
-       struct smbXsrv_connection *xconn = sconn->conn;
        uint16_t action = 0;
+       bool is_authenticated = false;
        NTTIME now = timeval_to_nttime(&req->request_time);
        struct smbXsrv_session *session = NULL;
        uint16_t smb_bufsize = SVAL(req->vwv+2, 0);
        uint32_t client_caps = IVAL(req->vwv+10, 0);
+       struct smbXsrv_session_auth0 *auth;
 
        DEBUG(3,("Doing spnego session setup\n"));
 
@@ -203,7 +167,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
        }
 
        if (vuid != 0) {
-               status = smb1srv_session_lookup(sconn->conn,
+               status = smb1srv_session_lookup(xconn,
                                                vuid, now,
                                                &session);
                if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
@@ -216,7 +180,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                if (NT_STATUS_IS_OK(status)) {
                        session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
                        status = NT_STATUS_MORE_PROCESSING_REQUIRED;
-                       TALLOC_FREE(session->gensec);
+                       TALLOC_FREE(session->pending_auth);
                }
                if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
                        reply_nterror(req, nt_status_squash(status));
@@ -226,7 +190,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
 
        if (session == NULL) {
                /* create a new session */
-               status = smbXsrv_session_create(sconn->conn,
+               status = smbXsrv_session_create(xconn,
                                                now, &session);
                if (!NT_STATUS_IS_OK(status)) {
                        reply_nterror(req, nt_status_squash(status));
@@ -234,19 +198,35 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                }
        }
 
-       if (!session->gensec) {
-               status = auth_generic_prepare(session, sconn->remote_address,
-                                             &session->gensec);
+       status = smbXsrv_session_find_auth(session, xconn, now, &auth);
+       if (!NT_STATUS_IS_OK(status)) {
+               status = smbXsrv_session_create_auth(session, xconn, now,
+                                                    0, /* flags */
+                                                    0, /* security */
+                                                    &auth);
+               if (!NT_STATUS_IS_OK(status)) {
+                       reply_nterror(req, nt_status_squash(status));
+                       return;
+               }
+       }
+
+       if (auth->gensec == NULL) {
+               status = auth_generic_prepare(session,
+                                             xconn->remote_address,
+                                             xconn->local_address,
+                                             "SMB",
+                                             &auth->gensec);
                if (!NT_STATUS_IS_OK(status)) {
                        TALLOC_FREE(session);
                        reply_nterror(req, nt_status_squash(status));
                        return;
                }
 
-               gensec_want_feature(session->gensec, GENSEC_FEATURE_SESSION_KEY);
-               gensec_want_feature(session->gensec, GENSEC_FEATURE_UNIX_TOKEN);
+               gensec_want_feature(auth->gensec, GENSEC_FEATURE_SESSION_KEY);
+               gensec_want_feature(auth->gensec, GENSEC_FEATURE_UNIX_TOKEN);
+               gensec_want_feature(auth->gensec, GENSEC_FEATURE_SMB_TRANSPORT);
 
-               status = gensec_start_mech_by_oid(session->gensec,
+               status = gensec_start_mech_by_oid(auth->gensec,
                                                  GENSEC_OID_SPNEGO);
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(0, ("Failed to start SPNEGO handler!\n"));
@@ -257,7 +237,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
        }
 
        become_root();
-       status = gensec_update(session->gensec,
+       status = gensec_update(auth->gensec,
                               talloc_tos(),
                               in_blob, &out_blob);
        unbecome_root();
@@ -271,7 +251,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
        if (NT_STATUS_IS_OK(status) && session->global->auth_session_info == NULL) {
                struct auth_session_info *session_info = NULL;
 
-               status = gensec_session_info(session->gensec,
+               status = gensec_session_info(auth->gensec,
                                             session,
                                             &session_info);
                if (!NT_STATUS_IS_OK(status)) {
@@ -284,8 +264,8 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                        return;
                }
 
-               if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
-                       action = 1;
+               if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
+                       action |= SMB_SETUP_GUEST;
                }
 
                if (session_info->session_key.length > 0) {
@@ -327,19 +307,20 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                sconn->num_users++;
 
                if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
+                       is_authenticated = true;
                        session->compat->homes_snum =
                                register_homes_share(session_info->unix_info->unix_name);
                }
 
-               if (srv_is_signing_negotiated(sconn) &&
-                   action == 0 &&
+               if (srv_is_signing_negotiated(xconn) &&
+                   is_authenticated &&
                    session->global->signing_key.length > 0)
                {
                        /*
                         * Try and turn on server signing on the first non-guest
                         * sessionsetup.
                         */
-                       srv_set_signing(sconn,
+                       srv_set_signing(xconn,
                                session->global->signing_key,
                                data_blob_null);
                }
@@ -354,9 +335,10 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                session->global->auth_session_info_seqnum += 1;
                session->global->channels[0].auth_session_info_seqnum =
                        session->global->auth_session_info_seqnum;
+               session->global->auth_time = now;
                if (client_caps & CAP_DYNAMIC_REAUTH) {
                        session->global->expiration_time =
-                               gensec_expire_time(session->gensec);
+                               gensec_expire_time(auth->gensec);
                } else {
                        session->global->expiration_time =
                                GENSEC_EXPIRE_TIME_INFINITY;
@@ -396,7 +378,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
        } else if (NT_STATUS_IS_OK(status)) {
                struct auth_session_info *session_info = NULL;
 
-               status = gensec_session_info(session->gensec,
+               status = gensec_session_info(auth->gensec,
                                             session,
                                             &session_info);
                if (!NT_STATUS_IS_OK(status)) {
@@ -409,8 +391,8 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                        return;
                }
 
-               if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
-                       action = 1;
+               if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
+                       action |= SMB_SETUP_GUEST;
                }
 
                /*
@@ -441,9 +423,10 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                session->global->auth_session_info_seqnum += 1;
                session->global->channels[0].auth_session_info_seqnum =
                        session->global->auth_session_info_seqnum;
+               session->global->auth_time = now;
                if (client_caps & CAP_DYNAMIC_REAUTH) {
                        session->global->expiration_time =
-                               gensec_expire_time(session->gensec);
+                               gensec_expire_time(auth->gensec);
                } else {
                        session->global->expiration_time =
                                GENSEC_EXPIRE_TIME_INFINITY;
@@ -489,6 +472,13 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
                reply_nterror(req, NT_STATUS_NO_MEMORY);
                return;
        }
+#if 0
+       if (!sconn->smb1.sessions.done_sesssetup) {
+               sconn->smb1.sessions.max_send =
+                       MIN(sconn->smb1.sessions.max_send,smb_bufsize);
+       }
+       sconn->smb1.sessions.done_sesssetup = true;
+#endif
 }
 
 /****************************************************************************
@@ -509,9 +499,10 @@ static int shutdown_other_smbds(struct smbXsrv_session_global0 *session,
        struct server_id self_pid = messaging_server_id(state->msg_ctx);
        struct server_id pid = session->channels[0].server_id;
        const char *addr = session->channels[0].remote_address;
+       struct server_id_buf tmp;
 
        DEBUG(10, ("shutdown_other_smbds: %s, %s\n",
-                  server_id_str(talloc_tos(), &pid), addr));
+                  server_id_str_buf(pid, &tmp), addr));
 
        if (!process_exists(pid)) {
                DEBUG(10, ("process does not exist\n"));
@@ -571,41 +562,63 @@ static void setup_new_vc_session(struct smbd_server_connection *sconn)
  Reply to a session setup command.
 ****************************************************************************/
 
+struct reply_sesssetup_and_X_state {
+       struct smb_request *req;
+       struct auth4_context *auth_context;
+       struct auth_usersupplied_info *user_info;
+       const char *user;
+       const char *domain;
+       DATA_BLOB lm_resp;
+       DATA_BLOB nt_resp;
+       DATA_BLOB plaintext_password;
+};
+
+static int reply_sesssetup_and_X_state_destructor(
+               struct reply_sesssetup_and_X_state *state)
+{
+       data_blob_clear_free(&state->nt_resp);
+       data_blob_clear_free(&state->lm_resp);
+       data_blob_clear_free(&state->plaintext_password);
+       return 0;
+}
+
 void reply_sesssetup_and_X(struct smb_request *req)
 {
+       struct reply_sesssetup_and_X_state *state = NULL;
        uint64_t sess_vuid;
        uint16_t smb_bufsize;
-       DATA_BLOB lm_resp;
-       DATA_BLOB nt_resp;
-       DATA_BLOB plaintext_password;
        char *tmp;
-       const char *user;
        fstring sub_user; /* Sanitised username for substituion */
-       const char *domain;
        const char *native_os;
        const char *native_lanman;
        const char *primary_domain;
-       struct auth_usersupplied_info *user_info = NULL;
        struct auth_session_info *session_info = NULL;
-       uint16 smb_flag2 = req->flags2;
+       uint16_t smb_flag2 = req->flags2;
        uint16_t action = 0;
+       bool is_authenticated = false;
        NTTIME now = timeval_to_nttime(&req->request_time);
        struct smbXsrv_session *session = NULL;
        NTSTATUS nt_status;
+       struct smbXsrv_connection *xconn = req->xconn;
        struct smbd_server_connection *sconn = req->sconn;
-       struct smbXsrv_connection *xconn = sconn->conn;
        bool doencrypt = xconn->smb1.negprot.encrypted_passwords;
        bool signing_allowed = false;
-       bool signing_mandatory = false;
+       bool signing_mandatory = smb_signing_is_mandatory(
+               xconn->smb1.signing_state);
 
        START_PROFILE(SMBsesssetupX);
 
-       ZERO_STRUCT(lm_resp);
-       ZERO_STRUCT(nt_resp);
-       ZERO_STRUCT(plaintext_password);
-
        DEBUG(3,("wct=%d flg2=0x%x\n", req->wct, req->flags2));
 
+       state = talloc_zero(req, struct reply_sesssetup_and_X_state);
+       if (state == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               END_PROFILE(SMBsesssetupX);
+               return;
+       }
+       state->req = req;
+       talloc_set_destructor(state, reply_sesssetup_and_X_state_destructor);
+
        if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES) {
                signing_allowed = true;
        }
@@ -618,7 +631,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
         * It finds out when it needs to turn into a noop
         * itself.
         */
-       srv_set_signing_negotiated(req->sconn,
+       srv_set_signing_negotiated(xconn,
                                   signing_allowed,
                                   signing_mandatory);
 
@@ -649,7 +662,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
        smb_bufsize = SVAL(req->vwv+2, 0);
 
        if (get_Protocol() < PROTOCOL_NT1) {
-               uint16 passlen1 = SVAL(req->vwv+7, 0);
+               uint16_t passlen1 = SVAL(req->vwv+7, 0);
 
                /* Never do NT status codes with protocols before NT1 as we
                 * don't get client caps. */
@@ -663,26 +676,30 @@ void reply_sesssetup_and_X(struct smb_request *req)
                }
 
                if (doencrypt) {
-                       lm_resp = data_blob(req->buf, passlen1);
+                       state->lm_resp = data_blob_talloc(state,
+                                                         req->buf,
+                                                         passlen1);
                } else {
-                       plaintext_password = data_blob(req->buf, passlen1+1);
+                       state->plaintext_password = data_blob_talloc(state,
+                                                               req->buf,
+                                                               passlen1+1);
                        /* Ensure null termination */
-                       plaintext_password.data[passlen1] = 0;
+                       state->plaintext_password.data[passlen1] = 0;
                }
 
-               srvstr_pull_req_talloc(talloc_tos(), req, &tmp,
+               srvstr_pull_req_talloc(state, req, &tmp,
                                       req->buf + passlen1, STR_TERMINATE);
-               user = tmp ? tmp : "";
+               state->user = tmp ? tmp : "";
 
-               domain = "";
+               state->domain = "";
 
        } else {
-               uint16 passlen1 = SVAL(req->vwv+7, 0);
-               uint16 passlen2 = SVAL(req->vwv+8, 0);
+               uint16_t passlen1 = SVAL(req->vwv+7, 0);
+               uint16_t passlen2 = SVAL(req->vwv+8, 0);
                enum remote_arch_types ra_type = get_remote_arch();
                const uint8_t *p = req->buf;
                const uint8_t *save_p = req->buf;
-               uint16 byte_count;
+               uint16_t byte_count;
 
                if (!xconn->smb1.sessions.done_sesssetup) {
                        global_client_caps = IVAL(req->vwv+11, 0);
@@ -749,15 +766,15 @@ void reply_sesssetup_and_X(struct smb_request *req)
                }
 
                if (doencrypt) {
-                       lm_resp = data_blob(p, passlen1);
-                       nt_resp = data_blob(p+passlen1, passlen2);
+                       state->lm_resp = data_blob_talloc(state, p, passlen1);
+                       state->nt_resp = data_blob_talloc(state, p+passlen1, passlen2);
                } else {
                        char *pass = NULL;
                        bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
 
                        if (unic && (passlen2 == 0) && passlen1) {
                                /* Only a ascii plaintext password was sent. */
-                               (void)srvstr_pull_talloc(talloc_tos(),
+                               (void)srvstr_pull_talloc(state,
                                                        req->inbuf,
                                                        req->flags2,
                                                        &pass,
@@ -765,7 +782,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
                                                        passlen1,
                                                        STR_TERMINATE|STR_ASCII);
                        } else {
-                               (void)srvstr_pull_talloc(talloc_tos(),
+                               (void)srvstr_pull_talloc(state,
                                                        req->inbuf,
                                                        req->flags2,
                                                        &pass,
@@ -779,18 +796,20 @@ void reply_sesssetup_and_X(struct smb_request *req)
                                END_PROFILE(SMBsesssetupX);
                                return;
                        }
-                       plaintext_password = data_blob(pass, strlen(pass)+1);
+                       state->plaintext_password = data_blob_talloc(state,
+                                                               pass,
+                                                               strlen(pass)+1);
                }
 
                p += passlen1 + passlen2;
 
-               p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
+               p += srvstr_pull_req_talloc(state, req, &tmp, p,
                                            STR_TERMINATE);
-               user = tmp ? tmp : "";
+               state->user = tmp ? tmp : "";
 
-               p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
+               p += srvstr_pull_req_talloc(state, req, &tmp, p,
                                            STR_TERMINATE);
-               domain = tmp ? tmp : "";
+               state->domain = tmp ? tmp : "";
 
                p += srvstr_pull_req_talloc(talloc_tos(), req, &tmp, p,
                                            STR_TERMINATE);
@@ -818,7 +837,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
 
                DEBUG(3,("Domain=[%s]  NativeOS=[%s] NativeLanMan=[%s] "
                        "PrimaryDomain=[%s]\n",
-                       domain, native_os, native_lanman, primary_domain));
+                       state->domain, native_os, native_lanman, primary_domain));
 
                if ( ra_type == RA_WIN2K ) {
                        if ( strlen(native_lanman) == 0 )
@@ -834,9 +853,9 @@ void reply_sesssetup_and_X(struct smb_request *req)
        }
 
        DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
-                               domain, user, get_remote_machine_name()));
+                state->domain, state->user, get_remote_machine_name()));
 
-       if (*user) {
+       if (*state->user) {
                if (xconn->smb1.negprot.spnego) {
 
                        /* This has to be here, because this is a perfectly
@@ -850,7 +869,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
                        END_PROFILE(SMBsesssetupX);
                        return;
                }
-               fstrcpy(sub_user, user);
+               fstrcpy(sub_user, state->user);
        } else {
                fstrcpy(sub_user, "");
        }
@@ -859,14 +878,30 @@ void reply_sesssetup_and_X(struct smb_request *req)
 
        reload_services(sconn, conn_snum_used, true);
 
-       if (!*user) {
+       if (!*state->user) {
+               DEBUG(3,("Got anonymous request\n"));
+
+               nt_status = make_auth4_context(state, &state->auth_context);
+               if (NT_STATUS_IS_OK(nt_status)) {
+                       uint8_t chal[8];
 
-               nt_status = check_guest_password(sconn->remote_address, req, &session_info);
+                       state->auth_context->get_ntlm_challenge(
+                                       state->auth_context, chal);
 
+                       if (!make_user_info_guest(state,
+                                                 sconn->remote_address,
+                                                 sconn->local_address,
+                                                 "SMB", &state->user_info)) {
+                               nt_status =  NT_STATUS_NO_MEMORY;
+                       }
+
+                       if (NT_STATUS_IS_OK(nt_status)) {
+                               state->user_info->auth_description = "guest";
+                       }
+               }
        } else if (doencrypt) {
-               struct auth4_context *negprot_auth_context = NULL;
-               negprot_auth_context = xconn->smb1.negprot.auth_context;
-               if (!negprot_auth_context) {
+               state->auth_context = xconn->smb1.negprot.auth_context;
+               if (state->auth_context == NULL) {
                        DEBUG(0, ("reply_sesssetup_and_X:  Attempted encrypted "
                                "session setup without negprot denied!\n"));
                        reply_nterror(req, nt_status_squash(
@@ -874,56 +909,60 @@ void reply_sesssetup_and_X(struct smb_request *req)
                        END_PROFILE(SMBsesssetupX);
                        return;
                }
-               nt_status = make_user_info_for_reply_enc(talloc_tos(),
-                                                        &user_info, user,
-                                                        domain,
+               nt_status = make_user_info_for_reply_enc(state,
+                                                        &state->user_info,
+                                                        state->user,
+                                                        state->domain,
                                                         sconn->remote_address,
-                                                        lm_resp, nt_resp);
+                                                        sconn->local_address,
+                                                        "SMB",
+                                                        state->lm_resp,
+                                                        state->nt_resp);
+
                if (NT_STATUS_IS_OK(nt_status)) {
-                       nt_status = auth_check_password_session_info(negprot_auth_context, 
-                                                                    req, user_info, &session_info);
+                       state->user_info->auth_description = "bare-NTLM";
                }
        } else {
-               struct auth4_context *plaintext_auth_context = NULL;
-
-               nt_status = make_auth4_context(
-                       talloc_tos(), &plaintext_auth_context);
-
+               nt_status = make_auth4_context(state, &state->auth_context);
                if (NT_STATUS_IS_OK(nt_status)) {
                        uint8_t chal[8];
 
-                       plaintext_auth_context->get_ntlm_challenge(
-                                       plaintext_auth_context, chal);
+                       state->auth_context->get_ntlm_challenge(
+                                       state->auth_context, chal);
 
-                       if (!make_user_info_for_reply(talloc_tos(),
-                                                     &user_info,
-                                                     user, domain,
+                       if (!make_user_info_for_reply(state,
+                                                     &state->user_info,
+                                                     state->user,
+                                                     state->domain,
                                                      sconn->remote_address,
+                                                     sconn->local_address,
+                                                     "SMB",
                                                      chal,
-                                                     plaintext_password)) {
+                                                     state->plaintext_password)) {
                                nt_status = NT_STATUS_NO_MEMORY;
                        }
 
                        if (NT_STATUS_IS_OK(nt_status)) {
-                               nt_status = auth_check_password_session_info(plaintext_auth_context, 
-                                                                            req, user_info, &session_info);
+                               state->user_info->auth_description = "plaintext";
                        }
-                       TALLOC_FREE(plaintext_auth_context);
                }
        }
 
-       TALLOC_FREE(user_info);
-
        if (!NT_STATUS_IS_OK(nt_status)) {
-               data_blob_free(&nt_resp);
-               data_blob_free(&lm_resp);
-               data_blob_clear_free(&plaintext_password);
                reply_nterror(req, nt_status_squash(nt_status));
                END_PROFILE(SMBsesssetupX);
                return;
        }
 
-       data_blob_clear_free(&plaintext_password);
+       nt_status = auth_check_password_session_info(state->auth_context,
+                                                    req, state->user_info,
+                                                    &session_info);
+       TALLOC_FREE(state->user_info);
+       if (!NT_STATUS_IS_OK(nt_status)) {
+               reply_nterror(req, nt_status_squash(nt_status));
+               END_PROFILE(SMBsesssetupX);
+               return;
+       }
 
        /* it's ok - setup a reply */
        reply_outbuf(req, 3, 0);
@@ -935,18 +974,16 @@ void reply_sesssetup_and_X(struct smb_request *req)
                /* perhaps grab OS version here?? */
        }
 
-       if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
-               action = 1;
+       if (security_session_user_level(session_info, NULL) == SECURITY_GUEST) {
+               action |= SMB_SETUP_GUEST;
        }
 
        /* register the name and uid as being validated, so further connections
           to a uid can get through without a password, on the same VC */
 
-       nt_status = smbXsrv_session_create(sconn->conn,
+       nt_status = smbXsrv_session_create(xconn,
                                           now, &session);
        if (!NT_STATUS_IS_OK(nt_status)) {
-               data_blob_free(&nt_resp);
-               data_blob_free(&lm_resp);
                reply_nterror(req, nt_status_squash(nt_status));
                END_PROFILE(SMBsesssetupX);
                return;
@@ -962,8 +999,6 @@ void reply_sesssetup_and_X(struct smb_request *req)
                        data_blob_dup_talloc(session->global,
                                             session_info->session_key);
                if (session->global->signing_key.data == NULL) {
-                       data_blob_free(&nt_resp);
-                       data_blob_free(&lm_resp);
                        TALLOC_FREE(session);
                        reply_nterror(req, NT_STATUS_NO_MEMORY);
                        END_PROFILE(SMBsesssetupX);
@@ -983,8 +1018,6 @@ void reply_sesssetup_and_X(struct smb_request *req)
                                         sizeof(session_key));
                ZERO_STRUCT(session_key);
                if (session->global->application_key.data == NULL) {
-                       data_blob_free(&nt_resp);
-                       data_blob_free(&lm_resp);
                        TALLOC_FREE(session);
                        reply_nterror(req, NT_STATUS_NO_MEMORY);
                        END_PROFILE(SMBsesssetupX);
@@ -998,8 +1031,6 @@ void reply_sesssetup_and_X(struct smb_request *req)
                session_info->session_key = data_blob_dup_talloc(session_info,
                                                session->global->application_key);
                if (session_info->session_key.data == NULL) {
-                       data_blob_free(&nt_resp);
-                       data_blob_free(&lm_resp);
                        TALLOC_FREE(session);
                        reply_nterror(req, NT_STATUS_NO_MEMORY);
                        END_PROFILE(SMBsesssetupX);
@@ -1009,8 +1040,6 @@ void reply_sesssetup_and_X(struct smb_request *req)
 
        session->compat = talloc_zero(session, struct user_struct);
        if (session->compat == NULL) {
-               data_blob_free(&nt_resp);
-               data_blob_free(&lm_resp);
                TALLOC_FREE(session);
                reply_nterror(req, NT_STATUS_NO_MEMORY);
                END_PROFILE(SMBsesssetupX);
@@ -1025,21 +1054,22 @@ void reply_sesssetup_and_X(struct smb_request *req)
        sconn->num_users++;
 
        if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
+               is_authenticated = true;
                session->compat->homes_snum =
                        register_homes_share(session_info->unix_info->unix_name);
        }
 
-       if (srv_is_signing_negotiated(sconn) &&
-           action == 0 &&
+       if (srv_is_signing_negotiated(xconn) &&
+           is_authenticated &&
            session->global->signing_key.length > 0)
        {
                /*
                 * Try and turn on server signing on the first non-guest
                 * sessionsetup.
                 */
-               srv_set_signing(sconn,
+               srv_set_signing(xconn,
                        session->global->signing_key,
-                       nt_resp.data ? nt_resp : lm_resp);
+                       state->nt_resp.data ? state->nt_resp : state->lm_resp);
        }
 
        set_current_user_info(session_info->unix_info->sanitized_username,
@@ -1052,6 +1082,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
        session->global->auth_session_info_seqnum += 1;
        session->global->channels[0].auth_session_info_seqnum =
                session->global->auth_session_info_seqnum;
+       session->global->auth_time = now;
        session->global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
 
        nt_status = smbXsrv_session_update(session);
@@ -1059,8 +1090,6 @@ void reply_sesssetup_and_X(struct smb_request *req)
                DEBUG(0, ("smb1: Failed to update session for vuid=%llu - %s\n",
                          (unsigned long long)session->compat->vuid,
                          nt_errstr(nt_status)));
-               data_blob_free(&nt_resp);
-               data_blob_free(&lm_resp);
                TALLOC_FREE(session);
                reply_nterror(req, nt_status_squash(nt_status));
                END_PROFILE(SMBsesssetupX);
@@ -1070,8 +1099,6 @@ void reply_sesssetup_and_X(struct smb_request *req)
        if (!session_claim(session)) {
                DEBUG(1, ("smb1: Failed to claim session for vuid=%llu\n",
                          (unsigned long long)session->compat->vuid));
-               data_blob_free(&nt_resp);
-               data_blob_free(&lm_resp);
                TALLOC_FREE(session);
                reply_nterror(req, NT_STATUS_LOGON_FAILURE);
                END_PROFILE(SMBsesssetupX);
@@ -1083,9 +1110,6 @@ void reply_sesssetup_and_X(struct smb_request *req)
 
        sess_vuid = session->global->session_wire_id;
 
-       data_blob_free(&nt_resp);
-       data_blob_free(&lm_resp);
-
        SSVAL(req->outbuf,smb_vwv2,action);
        SSVAL(req->outbuf,smb_uid,sess_vuid);
        SSVAL(discard_const_p(char, req->inbuf),smb_uid,sess_vuid);
@@ -1101,5 +1125,6 @@ void reply_sesssetup_and_X(struct smb_request *req)
                xconn->smb1.sessions.done_sesssetup = true;
        }
 
+       TALLOC_FREE(state);
        END_PROFILE(SMBsesssetupX);
 }