2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../auth/gensec/gensec.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/tevent_ntstatus.h"
32 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
33 struct tevent_context *ev,
34 struct smbd_smb2_request *smb2req,
35 uint64_t in_session_id,
37 uint8_t in_security_mode,
38 uint64_t in_previous_session_id,
39 DATA_BLOB in_security_buffer);
40 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
41 uint16_t *out_session_flags,
43 DATA_BLOB *out_security_buffer,
44 uint64_t *out_session_id);
46 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq);
48 NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *smb2req)
51 const uint8_t *inbody;
52 int i = smb2req->current_idx;
53 uint64_t in_session_id;
55 uint8_t in_security_mode;
56 uint64_t in_previous_session_id;
57 uint16_t in_security_offset;
58 uint16_t in_security_length;
59 DATA_BLOB in_security_buffer;
61 struct tevent_req *subreq;
63 status = smbd_smb2_request_verify_sizes(smb2req, 0x19);
64 if (!NT_STATUS_IS_OK(status)) {
65 return smbd_smb2_request_error(smb2req, status);
67 inhdr = (const uint8_t *)smb2req->in.vector[i+0].iov_base;
68 inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
70 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
72 in_flags = CVAL(inbody, 0x02);
73 in_security_mode = CVAL(inbody, 0x03);
74 /* Capabilities = IVAL(inbody, 0x04) */
75 /* Channel = IVAL(inbody, 0x08) */
76 in_security_offset = SVAL(inbody, 0x0C);
77 in_security_length = SVAL(inbody, 0x0E);
78 in_previous_session_id = BVAL(inbody, 0x10);
80 if (in_security_offset != (SMB2_HDR_BODY + smb2req->in.vector[i+1].iov_len)) {
81 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
84 if (in_security_length > smb2req->in.vector[i+2].iov_len) {
85 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
88 in_security_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base;
89 in_security_buffer.length = in_security_length;
91 subreq = smbd_smb2_session_setup_send(smb2req,
92 smb2req->sconn->ev_ctx,
97 in_previous_session_id,
100 return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
102 tevent_req_set_callback(subreq, smbd_smb2_request_sesssetup_done, smb2req);
104 return smbd_smb2_request_pending_queue(smb2req, subreq, 500);
107 static void smbd_smb2_request_sesssetup_done(struct tevent_req *subreq)
109 struct smbd_smb2_request *smb2req =
110 tevent_req_callback_data(subreq,
111 struct smbd_smb2_request);
112 int i = smb2req->current_idx;
116 uint16_t out_session_flags;
117 uint64_t out_session_id;
118 uint16_t out_security_offset;
119 DATA_BLOB out_security_buffer = data_blob_null;
121 NTSTATUS error; /* transport error */
123 status = smbd_smb2_session_setup_recv(subreq,
126 &out_security_buffer,
129 if (!NT_STATUS_IS_OK(status) &&
130 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
131 status = nt_status_squash(status);
132 error = smbd_smb2_request_error(smb2req, status);
133 if (!NT_STATUS_IS_OK(error)) {
134 smbd_server_connection_terminate(smb2req->sconn,
141 out_security_offset = SMB2_HDR_BODY + 0x08;
143 outhdr = (uint8_t *)smb2req->out.vector[i].iov_base;
145 outbody = data_blob_talloc(smb2req->out.vector, NULL, 0x08);
146 if (outbody.data == NULL) {
147 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
148 if (!NT_STATUS_IS_OK(error)) {
149 smbd_server_connection_terminate(smb2req->sconn,
156 SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id);
158 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
159 SSVAL(outbody.data, 0x02,
160 out_session_flags); /* session flags */
161 SSVAL(outbody.data, 0x04,
162 out_security_offset); /* security buffer offset */
163 SSVAL(outbody.data, 0x06,
164 out_security_buffer.length); /* security buffer length */
166 outdyn = out_security_buffer;
168 error = smbd_smb2_request_done_ex(smb2req, status, outbody, &outdyn,
170 if (!NT_STATUS_IS_OK(error)) {
171 smbd_server_connection_terminate(smb2req->sconn,
177 static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
178 struct smbd_smb2_request *smb2req,
179 uint8_t in_security_mode,
180 uint64_t in_previous_session_id,
181 DATA_BLOB in_security_buffer,
182 uint16_t *out_session_flags,
183 uint64_t *out_session_id)
187 uint8_t session_key[16];
188 struct smbXsrv_session *x = session;
189 struct auth_session_info *session_info;
190 struct smbXsrv_connection *conn = session->connection;
192 if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
193 lp_server_signing() == SMB_SIGNING_REQUIRED) {
194 x->global->signing_required = true;
197 status = gensec_session_info(session->gensec,
200 if (!NT_STATUS_IS_OK(status)) {
201 TALLOC_FREE(session);
205 if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
206 /* we map anonymous to guest internally */
207 *out_session_flags |= SMB2_SESSION_FLAG_IS_GUEST;
208 *out_session_flags |= SMB2_SESSION_FLAG_IS_NULL;
209 /* force no signing */
210 x->global->signing_required = false;
214 ZERO_STRUCT(session_key);
215 memcpy(session_key, session_info->session_key.data,
216 MIN(session_info->session_key.length, sizeof(session_key)));
218 x->global->signing_key = data_blob_talloc(x->global,
220 sizeof(session_key));
221 if (x->global->signing_key.data == NULL) {
222 ZERO_STRUCT(session_key);
223 TALLOC_FREE(session);
224 return NT_STATUS_NO_MEMORY;
227 if (conn->protocol >= PROTOCOL_SMB2_24) {
228 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
229 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
231 smb2_key_derivation(session_key, sizeof(session_key),
232 label.data, label.length,
233 context.data, context.length,
234 x->global->signing_key.data);
237 x->global->application_key = data_blob_dup_talloc(x->global,
238 x->global->signing_key);
239 if (x->global->application_key.data == NULL) {
240 ZERO_STRUCT(session_key);
241 TALLOC_FREE(session);
242 return NT_STATUS_NO_MEMORY;
245 if (conn->protocol >= PROTOCOL_SMB2_24) {
246 const DATA_BLOB label = data_blob_string_const_null("SMB2APP");
247 const DATA_BLOB context = data_blob_string_const_null("SmbRpc");
249 smb2_key_derivation(session_key, sizeof(session_key),
250 label.data, label.length,
251 context.data, context.length,
252 x->global->application_key.data);
254 ZERO_STRUCT(session_key);
256 x->global->channels[0].signing_key = data_blob_dup_talloc(x->global->channels,
257 x->global->signing_key);
258 if (x->global->channels[0].signing_key.data == NULL) {
259 TALLOC_FREE(session);
260 return NT_STATUS_NO_MEMORY;
263 data_blob_clear_free(&session_info->session_key);
264 session_info->session_key = data_blob_dup_talloc(session_info,
265 x->global->application_key);
266 if (session_info->session_key.data == NULL) {
267 TALLOC_FREE(session);
268 return NT_STATUS_NO_MEMORY;
271 session->compat = talloc_zero(session, user_struct);
272 if (session->compat == NULL) {
273 TALLOC_FREE(session);
274 return NT_STATUS_NO_MEMORY;
276 session->compat->homes_snum = -1;
277 session->compat->session_info = session_info;
278 session->compat->session_keystr = NULL;
279 session->compat->vuid = session->global->session_wire_id;
280 DLIST_ADD(smb2req->sconn->users, session->compat);
281 smb2req->sconn->num_users++;
283 if (security_session_user_level(session_info, NULL) >= SECURITY_USER) {
284 session->compat->homes_snum =
285 register_homes_share(session_info->unix_info->unix_name);
288 if (!session_claim(smb2req->sconn, session->compat)) {
289 DEBUG(1, ("smb2: Failed to claim session "
291 session->compat->vuid));
292 TALLOC_FREE(session);
293 return NT_STATUS_LOGON_FAILURE;
296 set_current_user_info(session_info->unix_info->sanitized_username,
297 session_info->unix_info->unix_name,
298 session_info->info->domain_name);
300 reload_services(smb2req->sconn, conn_snum_used, true);
302 session->status = NT_STATUS_OK;
303 session->global->auth_session_info = session->session_info;
304 session->global->auth_session_info_seqnum += 1;
305 session->global->channels[0].auth_session_info_seqnum =
306 session->global->auth_session_info_seqnum;
307 session->global->expiration_time = gensec_expire_time(session->gensec);
309 status = smbXsrv_session_update(session);
310 if (!NT_STATUS_IS_OK(status)) {
311 DEBUG(0, ("smb2: Failed to update session for vuid=%d - %s\n",
312 session->compat->vuid, nt_errstr(status)));
313 TALLOC_FREE(session);
314 return NT_STATUS_LOGON_FAILURE;
318 * we attach the session to the request
319 * so that the response can be signed
321 smb2req->session = session;
323 smb2req->do_signing = true;
326 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
328 *out_session_id = session->global->session_wire_id;
333 static NTSTATUS smbd_smb2_reauth_generic_return(struct smbXsrv_session *session,
334 struct smbd_smb2_request *smb2req,
335 uint16_t *out_session_flags,
336 uint64_t *out_session_id)
339 struct smbXsrv_session *x = session;
340 struct auth_session_info *session_info;
341 struct smbXsrv_connection *conn = session->connection;
343 status = gensec_session_info(session->gensec,
346 if (!NT_STATUS_IS_OK(status)) {
347 TALLOC_FREE(session);
351 data_blob_clear_free(&session_info->session_key);
352 session_info->session_key = data_blob_dup_talloc(session_info,
353 x->global->application_key);
354 if (session_info->session_key.data == NULL) {
355 TALLOC_FREE(session);
356 return NT_STATUS_NO_MEMORY;
359 session->compat->session_info = session_info;
360 session->compat->vuid = session->global->session_wire_id;
362 session->compat->homes_snum =
363 register_homes_share(session_info->unix_info->unix_name);
365 set_current_user_info(session_info->unix_info->sanitized_username,
366 session_info->unix_info->unix_name,
367 session_info->info->domain_name);
369 reload_services(smb2req->sconn, conn_snum_used, true);
371 session->status = NT_STATUS_OK;
372 TALLOC_FREE(session->global->auth_session_info);
373 session->global->auth_session_info = session->session_info;
374 session->global->auth_session_info_seqnum += 1;
375 session->global->channels[0].auth_session_info_seqnum =
376 session->global->auth_session_info_seqnum;
377 session->global->expiration_time = gensec_expire_time(session->gensec);
379 status = smbXsrv_session_update(session);
380 if (!NT_STATUS_IS_OK(status)) {
381 DEBUG(0, ("smb2: Failed to update session for vuid=%d - %s\n",
382 session->compat->vuid, nt_errstr(status)));
383 TALLOC_FREE(session);
384 return NT_STATUS_LOGON_FAILURE;
387 conn_clear_vuid_caches(conn->sconn, session->compat->vuid);
390 * we attach the session to the request
391 * so that the response can be signed
393 smb2req->session = session;
394 smb2req->do_signing = true;
396 global_client_caps |= (CAP_LEVEL_II_OPLOCKS|CAP_STATUS32);
398 *out_session_id = session->global->session_wire_id;
403 static NTSTATUS smbd_smb2_auth_generic(struct smbXsrv_session *session,
404 struct smbd_smb2_request *smb2req,
405 uint8_t in_security_mode,
406 uint64_t in_previous_session_id,
407 DATA_BLOB in_security_buffer,
408 uint16_t *out_session_flags,
409 DATA_BLOB *out_security_buffer,
410 uint64_t *out_session_id)
414 *out_security_buffer = data_blob_null;
416 if (session->gensec == NULL) {
417 status = auth_generic_prepare(session,
418 session->connection->remote_address,
420 if (!NT_STATUS_IS_OK(status)) {
421 TALLOC_FREE(session);
425 gensec_want_feature(session->gensec, GENSEC_FEATURE_SESSION_KEY);
426 gensec_want_feature(session->gensec, GENSEC_FEATURE_UNIX_TOKEN);
428 status = gensec_start_mech_by_oid(session->gensec,
430 if (!NT_STATUS_IS_OK(status)) {
431 TALLOC_FREE(session);
437 status = gensec_update(session->gensec,
440 out_security_buffer);
442 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
443 !NT_STATUS_IS_OK(status)) {
444 TALLOC_FREE(session);
445 return nt_status_squash(status);
448 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
449 *out_session_id = session->global->session_wire_id;
453 if (session->global->auth_session_info != NULL) {
454 return smbd_smb2_reauth_generic_return(session,
460 return smbd_smb2_auth_generic_return(session,
463 in_previous_session_id,
469 static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *smb2req,
470 uint64_t in_session_id,
472 uint8_t in_security_mode,
473 uint64_t in_previous_session_id,
474 DATA_BLOB in_security_buffer,
475 uint16_t *out_session_flags,
476 DATA_BLOB *out_security_buffer,
477 uint64_t *out_session_id)
479 struct smbXsrv_session *session;
481 NTTIME now = timeval_to_nttime(&req->request_time);
483 *out_session_flags = 0;
486 if (in_session_id == 0) {
487 /* create a new session */
488 status = smbXsrv_session_create(smb2req->sconn->conn,
490 if (!NT_STATUS_IS_OK(status)) {
494 status = smb2srv_session_lookup(smb2req->sconn->conn,
497 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
498 status = NT_STATUS_OK;
500 if (NT_STATUS_IS_OK(status)) {
501 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
502 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
503 TALLOC_FREE(session->gensec);
505 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
510 return smbd_smb2_auth_generic(session,
513 in_previous_session_id,
520 struct smbd_smb2_session_setup_state {
521 struct tevent_context *ev;
522 struct smbd_smb2_request *smb2req;
523 uint64_t in_session_id;
525 uint8_t in_security_mode;
526 uint64_t in_previous_session_id;
527 DATA_BLOB in_security_buffer;
528 uint16_t out_session_flags;
529 DATA_BLOB out_security_buffer;
530 uint64_t out_session_id;
533 static struct tevent_req *smbd_smb2_session_setup_send(TALLOC_CTX *mem_ctx,
534 struct tevent_context *ev,
535 struct smbd_smb2_request *smb2req,
536 uint64_t in_session_id,
538 uint8_t in_security_mode,
539 uint64_t in_previous_session_id,
540 DATA_BLOB in_security_buffer)
542 struct tevent_req *req;
543 struct smbd_smb2_session_setup_state *state;
546 req = tevent_req_create(mem_ctx, &state,
547 struct smbd_smb2_session_setup_state);
552 state->smb2req = smb2req;
553 state->in_session_id = in_session_id;
554 state->in_flags = in_flags;
555 state->in_security_mode = in_security_mode;
556 state->in_previous_session_id = in_previous_session_id;
557 state->in_security_buffer = in_security_buffer;
559 status = smbd_smb2_session_setup(smb2req,
563 in_previous_session_id,
565 &state->out_session_flags,
566 &state->out_security_buffer,
567 &state->out_session_id);
568 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
569 NT_STATUS_IS_OK(status))
571 talloc_steal(state, state->out_security_buffer.data);
573 if (tevent_req_nterror(req, status)) {
574 return tevent_req_post(req, ev);
577 tevent_req_done(req);
578 return tevent_req_post(req, ev);
581 static NTSTATUS smbd_smb2_session_setup_recv(struct tevent_req *req,
582 uint16_t *out_session_flags,
584 DATA_BLOB *out_security_buffer,
585 uint64_t *out_session_id)
587 struct smbd_smb2_session_setup_state *state =
589 struct smbd_smb2_session_setup_state);
592 if (tevent_req_is_nterror(req, &status)) {
593 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
594 tevent_req_received(req);
598 status = NT_STATUS_OK;
601 *out_session_flags = state->out_session_flags;
602 *out_security_buffer = state->out_security_buffer;
603 *out_session_id = state->out_session_id;
605 talloc_steal(mem_ctx, out_security_buffer->data);
606 tevent_req_received(req);
610 NTSTATUS smbd_smb2_request_process_logoff(struct smbd_smb2_request *req)
614 struct connection_struct *conn, *next_conn;
616 status = smbd_smb2_request_verify_sizes(req, 0x04);
617 if (!NT_STATUS_IS_OK(status)) {
618 return smbd_smb2_request_error(req, status);
622 * TODO: cancel all outstanding requests on the session
624 file_close_user(req->sconn, req->session->compat->vuid);
626 for (conn=req->sconn->connections; conn; conn=next_conn) {
627 struct smbXsrv_tcon *tcon;
629 next_conn = conn->next;
632 if (conn->vuid != req->session->compat->vuid) {
636 set_current_service(conn, 0, True);
637 close_cnum(conn, conn->vuid);
639 /* for now tcon is NULL for SMB1 */
643 invalidate_vuid(req->sconn, req->session->compat->vuid);
644 req->session->compat = NULL;
646 req->session->status = NT_STATUS_USER_SESSION_DELETED;
649 * we may need to sign the response, so we need to keep
650 * the session until the response is sent to the wire.
652 talloc_steal(req, req->session);
654 outbody = data_blob_talloc(req->out.vector, NULL, 0x04);
655 if (outbody.data == NULL) {
656 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
659 SSVAL(outbody.data, 0x00, 0x04); /* struct size */
660 SSVAL(outbody.data, 0x02, 0); /* reserved */
662 return smbd_smb2_request_done(req, outbody, NULL);