2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/tevent_ntstatus.h"
32 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
33 struct tevent_context *ev,
34 struct smbd_smb2_request *smb2req,
35 uint64_t in_session_id,
37 uint8_t in_security_mode,
38 uint64_t in_previous_session_id,
39 DATA_BLOB in_security_buffer);
40 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
41 uint16_t *out_session_flags,
43 DATA_BLOB *out_security_buffer,
44 uint64_t *out_session_id);
46 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq);
48 NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *smb2req)
51 const uint8_t *inbody;
52 int i = smb2req->current_idx;
53 uint64_t in_session_id;
55 uint8_t in_security_mode;
56 uint64_t in_previous_session_id;
57 uint16_t in_security_offset;
58 uint16_t in_security_length;
59 DATA_BLOB in_security_buffer;
61 struct tevent_req *subreq;
63 status = smbd_smb2_request_verify_sizes(smb2req, 0x19);
64 if (!NT_STATUS_IS_OK(status)) {
65 return smbd_smb2_request_error(smb2req, status);
67 inhdr = (const uint8_t *)smb2req->in.vector[i+0].iov_base;
68 inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
70 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
72 in_flags = CVAL(inbody, 0x02);
73 in_security_mode = CVAL(inbody, 0x03);
74 /* Capabilities = IVAL(inbody, 0x04) */
75 /* Channel = IVAL(inbody, 0x08) */
76 in_security_offset = SVAL(inbody, 0x0C);
77 in_security_length = SVAL(inbody, 0x0E);
78 in_previous_session_id = BVAL(inbody, 0x10);
80 if (in_security_offset != (SMB2_HDR_BODY + smb2req->in.vector[i+1].iov_len)) {
81 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
84 if (in_security_length > smb2req->in.vector[i+2].iov_len) {
85 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
88 in_security_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base;
89 in_security_buffer.length = in_security_length;
91 subreq = smbd_smb2_session_setup_send(smb2req,
92 smb2req->sconn->ev_ctx,
97 in_previous_session_id,
100 return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
102 tevent_req_set_callback(subreq, smbd_smb2_request_sesssetup_done, smb2req);
104 return smbd_smb2_request_pending_queue(smb2req, subreq, 500);
107 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq)
109 struct smbd_smb2_request *smb2req =
110 tevent_req_callback_data(subreq,
111 struct smbd_smb2_request);
112 int i = smb2req->current_idx;
116 uint16_t out_session_flags;
117 uint64_t out_session_id;
118 uint16_t out_security_offset;
119 DATA_BLOB out_security_buffer = data_blob_null;
121 NTSTATUS error; /* transport error */
123 status = smbd_smb2_session_setup_recv(subreq,
126 &out_security_buffer,
129 if (!NT_STATUS_IS_OK(status) &&
130 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
131 status = nt_status_squash(status);
132 error = smbd_smb2_request_error(smb2req, status);
133 if (!NT_STATUS_IS_OK(error)) {
134 smbd_server_connection_terminate(smb2req->sconn,
141 out_security_offset = SMB2_HDR_BODY + 0x08;
143 outhdr = (uint8_t *)smb2req->out.vector[i].iov_base;
145 outbody = data_blob_talloc(smb2req->out.vector, NULL, 0x08);
146 if (outbody.data == NULL) {
147 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
148 if (!NT_STATUS_IS_OK(error)) {
149 smbd_server_connection_terminate(smb2req->sconn,
156 SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id);
158 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
159 SSVAL(outbody.data, 0x02,
160 out_session_flags); /* session flags */
161 SSVAL(outbody.data, 0x04,
162 out_security_offset); /* security buffer offset */
163 SSVAL(outbody.data, 0x06,
164 out_security_buffer.length); /* security buffer length */
166 outdyn = out_security_buffer;
168 error = smbd_smb2_request_done_ex(smb2req, status, outbody, &outdyn,
170 if (!NT_STATUS_IS_OK(error)) {
171 smbd_server_connection_terminate(smb2req->sconn,
177 static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
178 struct smbd_smb2_request *smb2req,
179 uint8_t in_security_mode,
180 uint64_t in_previous_session_id,
181 DATA_BLOB in_security_buffer,
182 uint16_t *out_session_flags,
183 uint64_t *out_session_id)
187 uint8_t session_key[16];
188 struct smbXsrv_session *x = session;
189 struct auth_session_info *session_info;
190 struct smbXsrv_connection *conn = session->connection;
192 if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
193 lp_server_signing() == SMB_SIGNING_REQUIRED) {
194 x->global->signing_required = true;
197 status = gensec_session_info(session->gensec,
200 if (!NT_STATUS_IS_OK(status)) {
201 TALLOC_FREE(session);
205 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
206 /* we map anonymous to guest internally */
207 *out_session_flags |= SMB2_SESSION_FLAG_IS_GUEST;
208 *out_session_flags |= SMB2_SESSION_FLAG_IS_NULL;
209 /* force no signing */
210 x->global->signing_required = false;
214 ZERO_STRUCT(session_key);
215 memcpy(session_key, session_info->session_key.data,
216 MIN(session_info->session_key.length, sizeof(session_key)));
218 x->global->signing_key = data_blob_talloc(x->global,
220 sizeof(session_key));
221 if (x->global->signing_key.data == NULL) {
222 ZERO_STRUCT(session_key);
223 TALLOC_FREE(session);
224 return NT_STATUS_NO_MEMORY;
227 if (conn->protocol >= PROTOCOL_SMB2_24) {
228 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
229 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
231 smb2_key_derivation(session_key, sizeof(session_key),
232 label.data, label.length,
233 context.data, context.length,
234 x->global->signing_key.data);
237 x->global->application_key = data_blob_dup_talloc(x->global,
238 x->global->signing_key);
239 if (x->global->application_key.data == NULL) {
240 ZERO_STRUCT(session_key);
241 TALLOC_FREE(session);
242 return NT_STATUS_NO_MEMORY;
245 if (conn->protocol >= PROTOCOL_SMB2_24) {
246 const DATA_BLOB label = data_blob_string_const_null("SMB2APP");
247 const DATA_BLOB context = data_blob_string_const_null("SmbRpc");
249 smb2_key_derivation(session_key, sizeof(session_key),
250 label.data, label.length,
251 context.data, context.length,
252 x->global->application_key.data);
254 ZERO_STRUCT(session_key);
256 x->global->channels[0].signing_key = data_blob_dup_talloc(x->global->channels,
257 x->global->signing_key);
258 if (x->global->channels[0].signing_key.data == NULL) {
259 TALLOC_FREE(session);
260 return NT_STATUS_NO_MEMORY;
263 data_blob_clear_free(&session_info->session_key);
264 session_info->session_key = data_blob_dup_talloc(session_info,
265 x->global->application_key);
266 if (session_info->session_key.data == NULL) {
267 TALLOC_FREE(session);
268 return NT_STATUS_NO_MEMORY;
271 session->compat = talloc_zero(session, user_struct);
272 if (session->compat == NULL) {
273 TALLOC_FREE(session);
274 return NT_STATUS_NO_MEMORY;
276 session->compat->homes_snum = -1;
277 session->compat->session_info = session_info;
278 session->compat->session_keystr = NULL;
279 session->compat->vuid = session->global->session_wire_id;
280 DLIST_ADD(smb2req->sconn->users, session->compat);
281 smb2req->sconn->num_users++;
283 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
284 session->compat->homes_snum =
285 register_homes_share(session_info->unix_info->unix_name);
288 if (!session_claim(smb2req->sconn, session->compat)) {
289 DEBUG(1, ("smb2: Failed to claim session "
291 session->compat->vuid));
292 TALLOC_FREE(session);
293 return NT_STATUS_LOGON_FAILURE;
296 set_current_user_info(session_info->unix_info->sanitized_username,
297 session_info->unix_info->unix_name,
298 session_info->info->domain_name);
300 reload_services(smb2req->sconn, conn_snum_used, true);
302 session->status = NT_STATUS_OK;
303 session->global->auth_session_info = session->session_info;
304 session->global->auth_session_info_seqnum += 1;
305 session->global->channels[0].auth_session_info_seqnum =
306 session->global->auth_session_info_seqnum;
307 session->global->expiration_time = gensec_expire_time(session->gensec);
309 if ((in_previous_session_id != 0) &&
310 (session->global->session_wire_id !=
311 in_previous_session_id))
313 struct tevent_context *ev;
314 struct tevent_req *subreq;
317 ev = event_context_init(talloc_tos());
319 TALLOC_FREE(session);
320 return NT_STATUS_LOGON_FAILURE;
323 subreq = smb2srv_session_close_previous_send(smb2req, ev,
325 in_previous_session_id);
326 if (subreq == NULL) {
327 TALLOC_FREE(session);
328 return NT_STATUS_LOGON_FAILURE;
331 ok = tevent_req_poll_ntstatus(subreq, ev, &status);
334 TALLOC_FREE(session);
338 status = smb2srv_session_close_previous_recv(subreq);
340 if (!NT_STATUS_IS_OK(status)) {
341 TALLOC_FREE(session);
346 status = smbXsrv_session_update(session);
347 if (!NT_STATUS_IS_OK(status)) {
348 DEBUG(0, ("smb2: Failed to update session for vuid=%d - %s\n",
349 session->compat->vuid, nt_errstr(status)));
350 TALLOC_FREE(session);
351 return NT_STATUS_LOGON_FAILURE;
355 * we attach the session to the request
356 * so that the response can be signed
358 smb2req->session = session;
360 smb2req->do_signing = true;
363 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
365 *out_session_id = session->global->session_wire_id;
370 static NTSTATUS smbd_smb2_reauth_generic_return(struct smbXsrv_session *session,
371 struct smbd_smb2_request *smb2req,
372 uint16_t *out_session_flags,
373 uint64_t *out_session_id)
376 struct smbXsrv_session *x = session;
377 struct auth_session_info *session_info;
378 struct smbXsrv_connection *conn = session->connection;
380 status = gensec_session_info(session->gensec,
383 if (!NT_STATUS_IS_OK(status)) {
384 TALLOC_FREE(session);
388 data_blob_clear_free(&session_info->session_key);
389 session_info->session_key = data_blob_dup_talloc(session_info,
390 x->global->application_key);
391 if (session_info->session_key.data == NULL) {
392 TALLOC_FREE(session);
393 return NT_STATUS_NO_MEMORY;
396 session->compat->session_info = session_info;
397 session->compat->vuid = session->global->session_wire_id;
399 session->compat->homes_snum =
400 register_homes_share(session_info->unix_info->unix_name);
402 set_current_user_info(session_info->unix_info->sanitized_username,
403 session_info->unix_info->unix_name,
404 session_info->info->domain_name);
406 reload_services(smb2req->sconn, conn_snum_used, true);
408 session->status = NT_STATUS_OK;
409 TALLOC_FREE(session->global->auth_session_info);
410 session->global->auth_session_info = session->session_info;
411 session->global->auth_session_info_seqnum += 1;
412 session->global->channels[0].auth_session_info_seqnum =
413 session->global->auth_session_info_seqnum;
414 session->global->expiration_time = gensec_expire_time(session->gensec);
416 status = smbXsrv_session_update(session);
417 if (!NT_STATUS_IS_OK(status)) {
418 DEBUG(0, ("smb2: Failed to update session for vuid=%d - %s\n",
419 session->compat->vuid, nt_errstr(status)));
420 TALLOC_FREE(session);
421 return NT_STATUS_LOGON_FAILURE;
424 conn_clear_vuid_caches(conn->sconn, session->compat->vuid);
427 * we attach the session to the request
428 * so that the response can be signed
430 smb2req->session = session;
431 smb2req->do_signing = true;
433 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
435 *out_session_id = session->global->session_wire_id;
440 static NTSTATUS smbd_smb2_auth_generic(struct smbXsrv_session *session,
441 struct smbd_smb2_request *smb2req,
442 uint8_t in_security_mode,
443 uint64_t in_previous_session_id,
444 DATA_BLOB in_security_buffer,
445 uint16_t *out_session_flags,
446 DATA_BLOB *out_security_buffer,
447 uint64_t *out_session_id)
451 *out_security_buffer = data_blob_null;
453 if (session->gensec == NULL) {
454 status = auth_generic_prepare(session,
455 session->connection->remote_address,
457 if (!NT_STATUS_IS_OK(status)) {
458 TALLOC_FREE(session);
462 gensec_want_feature(session->gensec, GENSEC_FEATURE_SESSION_KEY);
463 gensec_want_feature(session->gensec, GENSEC_FEATURE_UNIX_TOKEN);
465 status = gensec_start_mech_by_oid(session->gensec,
467 if (!NT_STATUS_IS_OK(status)) {
468 TALLOC_FREE(session);
474 status = gensec_update(session->gensec,
477 out_security_buffer);
479 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
480 !NT_STATUS_IS_OK(status)) {
481 TALLOC_FREE(session);
482 return nt_status_squash(status);
485 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
486 *out_session_id = session->global->session_wire_id;
490 if (session->global->auth_session_info != NULL) {
491 return smbd_smb2_reauth_generic_return(session,
497 return smbd_smb2_auth_generic_return(session,
500 in_previous_session_id,
506 static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *smb2req,
507 uint64_t in_session_id,
509 uint8_t in_security_mode,
510 uint64_t in_previous_session_id,
511 DATA_BLOB in_security_buffer,
512 uint16_t *out_session_flags,
513 DATA_BLOB *out_security_buffer,
514 uint64_t *out_session_id)
516 struct smbXsrv_session *session;
518 NTTIME now = timeval_to_nttime(&req->request_time);
520 *out_session_flags = 0;
523 if (in_session_id == 0) {
524 /* create a new session */
525 status = smbXsrv_session_create(smb2req->sconn->conn,
527 if (!NT_STATUS_IS_OK(status)) {
531 status = smb2srv_session_lookup(smb2req->sconn->conn,
534 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
535 status = NT_STATUS_OK;
537 if (NT_STATUS_IS_OK(status)) {
538 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
539 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
540 TALLOC_FREE(session->gensec);
542 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
547 return smbd_smb2_auth_generic(session,
550 in_previous_session_id,
557 struct smbd_smb2_session_setup_state {
558 struct tevent_context *ev;
559 struct smbd_smb2_request *smb2req;
560 uint64_t in_session_id;
562 uint8_t in_security_mode;
563 uint64_t in_previous_session_id;
564 DATA_BLOB in_security_buffer;
565 uint16_t out_session_flags;
566 DATA_BLOB out_security_buffer;
567 uint64_t out_session_id;
570 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
571 struct tevent_context *ev,
572 struct smbd_smb2_request *smb2req,
573 uint64_t in_session_id,
575 uint8_t in_security_mode,
576 uint64_t in_previous_session_id,
577 DATA_BLOB in_security_buffer)
579 struct tevent_req *req;
580 struct smbd_smb2_session_setup_state *state;
583 req = tevent_req_create(mem_ctx, &state,
584 struct smbd_smb2_session_setup_state);
589 state->smb2req = smb2req;
590 state->in_session_id = in_session_id;
591 state->in_flags = in_flags;
592 state->in_security_mode = in_security_mode;
593 state->in_previous_session_id = in_previous_session_id;
594 state->in_security_buffer = in_security_buffer;
596 status = smbd_smb2_session_setup(smb2req,
600 in_previous_session_id,
602 &state->out_session_flags,
603 &state->out_security_buffer,
604 &state->out_session_id);
605 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
606 NT_STATUS_IS_OK(status))
608 talloc_steal(state, state->out_security_buffer.data);
610 if (tevent_req_nterror(req, status)) {
611 return tevent_req_post(req, ev);
614 tevent_req_done(req);
615 return tevent_req_post(req, ev);
618 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
619 uint16_t *out_session_flags,
621 DATA_BLOB *out_security_buffer,
622 uint64_t *out_session_id)
624 struct smbd_smb2_session_setup_state *state =
626 struct smbd_smb2_session_setup_state);
629 if (tevent_req_is_nterror(req, &status)) {
630 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
631 tevent_req_received(req);
635 status = NT_STATUS_OK;
638 *out_session_flags = state->out_session_flags;
639 *out_security_buffer = state->out_security_buffer;
640 *out_session_id = state->out_session_id;
642 talloc_steal(mem_ctx, out_security_buffer->data);
643 tevent_req_received(req);
647 NTSTATUS smbd_smb2_request_process_logoff(struct smbd_smb2_request *req)
651 struct connection_struct *conn, *next_conn;
653 status = smbd_smb2_request_verify_sizes(req, 0x04);
654 if (!NT_STATUS_IS_OK(status)) {
655 return smbd_smb2_request_error(req, status);
659 * TODO: cancel all outstanding requests on the session
661 file_close_user(req->sconn, req->session->compat->vuid);
663 for (conn=req->sconn->connections; conn; conn=next_conn) {
664 struct smbXsrv_tcon *tcon;
666 next_conn = conn->next;
669 if (conn->vuid != req->session->compat->vuid) {
673 set_current_service(conn, 0, True);
674 close_cnum(conn, conn->vuid);
676 /* for now tcon is NULL for SMB1 */
680 invalidate_vuid(req->sconn, req->session->compat->vuid);
681 req->session->compat = NULL;
683 req->session->status = NT_STATUS_USER_SESSION_DELETED;
686 * we may need to sign the response, so we need to keep
687 * the session until the response is sent to the wire.
689 talloc_steal(req, req->session);
691 outbody = data_blob_talloc(req->out.vector, NULL, 0x04);
692 if (outbody.data == NULL) {
693 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
696 SSVAL(outbody.data, 0x00, 0x04); /* struct size */
697 SSVAL(outbody.data, 0x02, 0); /* reserved */
699 return smbd_smb2_request_done(req, outbody, NULL);