2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/tevent_ntstatus.h"
32 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
33 struct tevent_context *ev,
34 struct smbd_smb2_request *smb2req,
35 uint64_t in_session_id,
37 uint8_t in_security_mode,
38 uint64_t in_previous_session_id,
39 DATA_BLOB in_security_buffer);
40 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
41 uint16_t *out_session_flags,
43 DATA_BLOB *out_security_buffer,
44 uint64_t *out_session_id);
46 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq);
48 NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *smb2req)
51 const uint8_t *inbody;
52 int i = smb2req->current_idx;
53 uint64_t in_session_id;
55 uint8_t in_security_mode;
56 uint64_t in_previous_session_id;
57 uint16_t in_security_offset;
58 uint16_t in_security_length;
59 DATA_BLOB in_security_buffer;
61 struct tevent_req *subreq;
63 status = smbd_smb2_request_verify_sizes(smb2req, 0x19);
64 if (!NT_STATUS_IS_OK(status)) {
65 return smbd_smb2_request_error(smb2req, status);
67 inhdr = (const uint8_t *)smb2req->in.vector[i+0].iov_base;
68 inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
70 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
72 in_flags = CVAL(inbody, 0x02);
73 in_security_mode = CVAL(inbody, 0x03);
74 /* Capabilities = IVAL(inbody, 0x04) */
75 /* Channel = IVAL(inbody, 0x08) */
76 in_security_offset = SVAL(inbody, 0x0C);
77 in_security_length = SVAL(inbody, 0x0E);
78 in_previous_session_id = BVAL(inbody, 0x10);
80 if (in_security_offset != (SMB2_HDR_BODY + smb2req->in.vector[i+1].iov_len)) {
81 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
84 if (in_security_length > smb2req->in.vector[i+2].iov_len) {
85 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
88 in_security_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base;
89 in_security_buffer.length = in_security_length;
91 subreq = smbd_smb2_session_setup_send(smb2req,
92 smb2req->sconn->ev_ctx,
97 in_previous_session_id,
100 return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
102 tevent_req_set_callback(subreq, smbd_smb2_request_sesssetup_done, smb2req);
104 return smbd_smb2_request_pending_queue(smb2req, subreq, 500);
107 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq)
109 struct smbd_smb2_request *smb2req =
110 tevent_req_callback_data(subreq,
111 struct smbd_smb2_request);
112 int i = smb2req->current_idx;
116 uint16_t out_session_flags;
117 uint64_t out_session_id;
118 uint16_t out_security_offset;
119 DATA_BLOB out_security_buffer = data_blob_null;
121 NTSTATUS error; /* transport error */
123 status = smbd_smb2_session_setup_recv(subreq,
126 &out_security_buffer,
129 if (!NT_STATUS_IS_OK(status) &&
130 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
131 status = nt_status_squash(status);
132 error = smbd_smb2_request_error(smb2req, status);
133 if (!NT_STATUS_IS_OK(error)) {
134 smbd_server_connection_terminate(smb2req->sconn,
141 out_security_offset = SMB2_HDR_BODY + 0x08;
143 outhdr = (uint8_t *)smb2req->out.vector[i].iov_base;
145 outbody = data_blob_talloc(smb2req->out.vector, NULL, 0x08);
146 if (outbody.data == NULL) {
147 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
148 if (!NT_STATUS_IS_OK(error)) {
149 smbd_server_connection_terminate(smb2req->sconn,
156 SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id);
158 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
159 SSVAL(outbody.data, 0x02,
160 out_session_flags); /* session flags */
161 SSVAL(outbody.data, 0x04,
162 out_security_offset); /* security buffer offset */
163 SSVAL(outbody.data, 0x06,
164 out_security_buffer.length); /* security buffer length */
166 outdyn = out_security_buffer;
168 error = smbd_smb2_request_done_ex(smb2req, status, outbody, &outdyn,
170 if (!NT_STATUS_IS_OK(error)) {
171 smbd_server_connection_terminate(smb2req->sconn,
177 static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
178 struct smbd_smb2_request *smb2req,
179 uint8_t in_security_mode,
180 uint64_t in_previous_session_id,
181 DATA_BLOB in_security_buffer,
182 uint16_t *out_session_flags,
183 uint64_t *out_session_id)
187 uint8_t session_key[16];
188 struct smbXsrv_session *x = session;
189 struct auth_session_info *session_info;
190 struct smbXsrv_connection *conn = session->connection;
192 if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
193 lp_server_signing() == SMB_SIGNING_REQUIRED) {
194 x->global->signing_required = true;
197 status = gensec_session_info(session->gensec,
200 if (!NT_STATUS_IS_OK(status)) {
201 TALLOC_FREE(session);
205 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
206 /* we map anonymous to guest internally */
207 *out_session_flags |= SMB2_SESSION_FLAG_IS_GUEST;
208 *out_session_flags |= SMB2_SESSION_FLAG_IS_NULL;
209 /* force no signing */
210 x->global->signing_required = false;
214 ZERO_STRUCT(session_key);
215 memcpy(session_key, session_info->session_key.data,
216 MIN(session_info->session_key.length, sizeof(session_key)));
218 x->global->signing_key = data_blob_talloc(x->global,
220 sizeof(session_key));
221 if (x->global->signing_key.data == NULL) {
222 ZERO_STRUCT(session_key);
223 TALLOC_FREE(session);
224 return NT_STATUS_NO_MEMORY;
227 if (conn->protocol >= PROTOCOL_SMB2_24) {
228 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
229 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
231 smb2_key_derivation(session_key, sizeof(session_key),
232 label.data, label.length,
233 context.data, context.length,
234 x->global->signing_key.data);
237 x->global->application_key = data_blob_dup_talloc(x->global,
238 x->global->signing_key);
239 if (x->global->application_key.data == NULL) {
240 ZERO_STRUCT(session_key);
241 TALLOC_FREE(session);
242 return NT_STATUS_NO_MEMORY;
245 if (conn->protocol >= PROTOCOL_SMB2_24) {
246 const DATA_BLOB label = data_blob_string_const_null("SMB2APP");
247 const DATA_BLOB context = data_blob_string_const_null("SmbRpc");
249 smb2_key_derivation(session_key, sizeof(session_key),
250 label.data, label.length,
251 context.data, context.length,
252 x->global->application_key.data);
254 ZERO_STRUCT(session_key);
256 x->global->channels[0].signing_key = data_blob_dup_talloc(x->global->channels,
257 x->global->signing_key);
258 if (x->global->channels[0].signing_key.data == NULL) {
259 TALLOC_FREE(session);
260 return NT_STATUS_NO_MEMORY;
263 data_blob_clear_free(&session_info->session_key);
264 session_info->session_key = data_blob_dup_talloc(session_info,
265 x->global->application_key);
266 if (session_info->session_key.data == NULL) {
267 TALLOC_FREE(session);
268 return NT_STATUS_NO_MEMORY;
271 session->compat = talloc_zero(session, struct user_struct);
272 if (session->compat == NULL) {
273 TALLOC_FREE(session);
274 return NT_STATUS_NO_MEMORY;
276 session->compat->session = session;
277 session->compat->homes_snum = -1;
278 session->compat->session_info = session_info;
279 session->compat->session_keystr = NULL;
280 session->compat->vuid = session->global->session_wire_id;
281 DLIST_ADD(smb2req->sconn->users, session->compat);
282 smb2req->sconn->num_users++;
284 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
285 session->compat->homes_snum =
286 register_homes_share(session_info->unix_info->unix_name);
289 if (!session_claim(smb2req->sconn, session->compat)) {
290 DEBUG(1, ("smb2: Failed to claim session "
292 (unsigned long long)session->compat->vuid));
293 TALLOC_FREE(session);
294 return NT_STATUS_LOGON_FAILURE;
297 set_current_user_info(session_info->unix_info->sanitized_username,
298 session_info->unix_info->unix_name,
299 session_info->info->domain_name);
301 reload_services(smb2req->sconn, conn_snum_used, true);
303 session->status = NT_STATUS_OK;
304 session->global->auth_session_info = session_info;
305 session->global->auth_session_info_seqnum += 1;
306 session->global->channels[0].auth_session_info_seqnum =
307 session->global->auth_session_info_seqnum;
308 session->global->expiration_time = gensec_expire_time(session->gensec);
310 status = smbXsrv_session_update(session);
311 if (!NT_STATUS_IS_OK(status)) {
312 DEBUG(0, ("smb2: Failed to update session for vuid=%llu - %s\n",
313 (unsigned long long)session->compat->vuid,
315 TALLOC_FREE(session);
316 return NT_STATUS_LOGON_FAILURE;
320 * we attach the session to the request
321 * so that the response can be signed
323 smb2req->session = session;
325 smb2req->do_signing = true;
328 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
330 *out_session_id = session->global->session_wire_id;
335 static NTSTATUS smbd_smb2_reauth_generic_return(struct smbXsrv_session *session,
336 struct smbd_smb2_request *smb2req,
337 uint16_t *out_session_flags,
338 uint64_t *out_session_id)
341 struct smbXsrv_session *x = session;
342 struct auth_session_info *session_info;
343 struct smbXsrv_connection *conn = session->connection;
345 status = gensec_session_info(session->gensec,
348 if (!NT_STATUS_IS_OK(status)) {
349 TALLOC_FREE(session);
353 data_blob_clear_free(&session_info->session_key);
354 session_info->session_key = data_blob_dup_talloc(session_info,
355 x->global->application_key);
356 if (session_info->session_key.data == NULL) {
357 TALLOC_FREE(session);
358 return NT_STATUS_NO_MEMORY;
361 session->compat->session_info = session_info;
362 session->compat->vuid = session->global->session_wire_id;
364 session->compat->homes_snum =
365 register_homes_share(session_info->unix_info->unix_name);
367 set_current_user_info(session_info->unix_info->sanitized_username,
368 session_info->unix_info->unix_name,
369 session_info->info->domain_name);
371 reload_services(smb2req->sconn, conn_snum_used, true);
373 session->status = NT_STATUS_OK;
374 TALLOC_FREE(session->global->auth_session_info);
375 session->global->auth_session_info = session_info;
376 session->global->auth_session_info_seqnum += 1;
377 session->global->channels[0].auth_session_info_seqnum =
378 session->global->auth_session_info_seqnum;
379 session->global->expiration_time = gensec_expire_time(session->gensec);
381 status = smbXsrv_session_update(session);
382 if (!NT_STATUS_IS_OK(status)) {
383 DEBUG(0, ("smb2: Failed to update session for vuid=%llu - %s\n",
384 (unsigned long long)session->compat->vuid,
386 TALLOC_FREE(session);
387 return NT_STATUS_LOGON_FAILURE;
390 conn_clear_vuid_caches(conn->sconn, session->compat->vuid);
393 * we attach the session to the request
394 * so that the response can be signed
396 smb2req->session = session;
397 smb2req->do_signing = true;
399 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
401 *out_session_id = session->global->session_wire_id;
406 struct smbd_smb2_session_setup_state {
407 struct tevent_context *ev;
408 struct smbd_smb2_request *smb2req;
409 uint64_t in_session_id;
411 uint8_t in_security_mode;
412 uint64_t in_previous_session_id;
413 DATA_BLOB in_security_buffer;
414 struct smbXsrv_session *session;
415 uint16_t out_session_flags;
416 DATA_BLOB out_security_buffer;
417 uint64_t out_session_id;
420 static int smbd_smb2_session_setup_state_destructor(struct smbd_smb2_session_setup_state *state)
423 * if state->session is not NULL,
424 * we remove the session on failure
426 TALLOC_FREE(state->session);
430 static void smbd_smb2_session_setup_done(struct tevent_req *subreq);
432 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
433 struct tevent_context *ev,
434 struct smbd_smb2_request *smb2req,
435 uint64_t in_session_id,
437 uint8_t in_security_mode,
438 uint64_t in_previous_session_id,
439 DATA_BLOB in_security_buffer)
441 struct tevent_req *req;
442 struct smbd_smb2_session_setup_state *state;
444 NTTIME now = timeval_to_nttime(&smb2req->request_time);
445 struct tevent_req *subreq;
447 req = tevent_req_create(mem_ctx, &state,
448 struct smbd_smb2_session_setup_state);
453 state->smb2req = smb2req;
454 state->in_session_id = in_session_id;
455 state->in_flags = in_flags;
456 state->in_security_mode = in_security_mode;
457 state->in_previous_session_id = in_previous_session_id;
458 state->in_security_buffer = in_security_buffer;
460 talloc_set_destructor(state, smbd_smb2_session_setup_state_destructor);
462 if (state->in_session_id == 0) {
463 /* create a new session */
464 status = smbXsrv_session_create(state->smb2req->sconn->conn,
465 now, &state->session);
466 if (tevent_req_nterror(req, status)) {
467 return tevent_req_post(req, ev);
470 status = smb2srv_session_lookup(state->smb2req->sconn->conn,
471 state->in_session_id, now,
473 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
474 status = NT_STATUS_OK;
476 if (NT_STATUS_IS_OK(status)) {
477 state->session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
478 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
479 TALLOC_FREE(state->session->gensec);
481 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
482 tevent_req_nterror(req, status);
483 return tevent_req_post(req, ev);
487 if (state->session->gensec == NULL) {
488 status = auth_generic_prepare(state->session,
489 state->session->connection->remote_address,
490 &state->session->gensec);
491 if (tevent_req_nterror(req, status)) {
492 return tevent_req_post(req, ev);
495 gensec_want_feature(state->session->gensec, GENSEC_FEATURE_SESSION_KEY);
496 gensec_want_feature(state->session->gensec, GENSEC_FEATURE_UNIX_TOKEN);
498 status = gensec_start_mech_by_oid(state->session->gensec,
500 if (tevent_req_nterror(req, status)) {
501 return tevent_req_post(req, ev);
506 subreq = gensec_update_send(state, state->ev,
507 state->session->gensec,
508 state->in_security_buffer);
510 if (tevent_req_nomem(subreq, req)) {
511 return tevent_req_post(req, ev);
513 tevent_req_set_callback(subreq, smbd_smb2_session_setup_done, req);
518 static void smbd_smb2_session_setup_done(struct tevent_req *subreq)
520 struct tevent_req *req =
521 tevent_req_callback_data(subreq,
523 struct smbd_smb2_session_setup_state *state =
525 struct smbd_smb2_session_setup_state);
529 status = gensec_update_recv(subreq, state,
530 &state->out_security_buffer);
533 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
534 !NT_STATUS_IS_OK(status)) {
535 tevent_req_nterror(req, status);
539 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
540 state->out_session_id = state->session->global->session_wire_id;
541 /* we want to keep the session */
542 state->session = NULL;
543 tevent_req_nterror(req, status);
547 if (state->session->global->auth_session_info != NULL) {
548 status = smbd_smb2_reauth_generic_return(state->session,
550 &state->out_session_flags,
551 &state->out_session_id);
552 if (tevent_req_nterror(req, status)) {
555 /* we want to keep the session */
556 state->session = NULL;
557 tevent_req_done(req);
561 status = smbd_smb2_auth_generic_return(state->session,
563 state->in_security_mode,
564 state->in_previous_session_id,
565 state->in_security_buffer,
566 &state->out_session_flags,
567 &state->out_session_id);
568 if (tevent_req_nterror(req, status)) {
572 /* we want to keep the session */
573 state->session = NULL;
574 tevent_req_done(req);
578 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
579 uint16_t *out_session_flags,
581 DATA_BLOB *out_security_buffer,
582 uint64_t *out_session_id)
584 struct smbd_smb2_session_setup_state *state =
586 struct smbd_smb2_session_setup_state);
589 if (tevent_req_is_nterror(req, &status)) {
590 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
591 tevent_req_received(req);
592 return nt_status_squash(status);
595 status = NT_STATUS_OK;
598 *out_session_flags = state->out_session_flags;
599 *out_security_buffer = state->out_security_buffer;
600 *out_session_id = state->out_session_id;
602 talloc_steal(mem_ctx, out_security_buffer->data);
603 tevent_req_received(req);
607 NTSTATUS smbd_smb2_request_process_logoff(struct smbd_smb2_request *req)
612 status = smbd_smb2_request_verify_sizes(req, 0x04);
613 if (!NT_STATUS_IS_OK(status)) {
614 return smbd_smb2_request_error(req, status);
618 * TODO: cancel all outstanding requests on the session
620 status = smbXsrv_session_logoff(req->session);
621 if (!NT_STATUS_IS_OK(status)) {
622 DEBUG(0, ("smbd_smb2_request_process_logoff: "
623 "smbXsrv_session_logoff() failed: %s\n",
626 * If we hit this case, there is something completely
627 * wrong, so we better disconnect the transport connection.
633 * we may need to sign the response, so we need to keep
634 * the session until the response is sent to the wire.
636 talloc_steal(req, req->session);
638 outbody = data_blob_talloc(req->out.vector, NULL, 0x04);
639 if (outbody.data == NULL) {
640 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
643 SSVAL(outbody.data, 0x00, 0x04); /* struct size */
644 SSVAL(outbody.data, 0x02, 0); /* reserved */
646 return smbd_smb2_request_done(req, outbody, NULL);