1/* 2 Unix SMB/CIFS implementation. 3 Core SMB2 server 4 5 Copyright (C) Stefan Metzmacher 2009 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License as published by 9 the Free Software Foundation; either version 3 of the License, or 10 (at your option) any later version. 11 12 This program is distributed in the hope that it will be useful, 13 but WITHOUT ANY WARRANTY; without even the implied warranty of 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 GNU General Public License for more details. 16 17 You should have received a copy of the GNU General Public License 18 along with this program. If not, see <http://www.gnu.org/licenses/>. 19*/ 20 21#include "includes.h" 22#include "smbd/globals.h" 23#include "../libcli/smb/smb_common.h" 24#include "../libcli/auth/spnego.h" 25 26static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *req, 27 uint64_t in_session_id, 28 uint8_t in_security_mode, 29 DATA_BLOB in_security_buffer, 30 uint16_t *out_session_flags, 31 DATA_BLOB *out_security_buffer, 32 uint64_t *out_session_id); 33 34NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *req) 35{ 36 const uint8_t *inhdr; 37 const uint8_t *inbody; 38 int i = req->current_idx; 39 uint8_t *outhdr; 40 DATA_BLOB outbody; 41 DATA_BLOB outdyn; 42 size_t expected_body_size = 0x19; 43 size_t body_size; 44 uint64_t in_session_id; 45 uint8_t in_security_mode; 46 uint16_t in_security_offset; 47 uint16_t in_security_length; 48 DATA_BLOB in_security_buffer; 49 uint16_t out_session_flags; 50 uint64_t out_session_id; 51 uint16_t out_security_offset; 52 DATA_BLOB out_security_buffer; 53 NTSTATUS status; 54 55 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base; 56 57 if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) { 58 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); 59 } 60 61 inbody = (const uint8_t *)req->in.vector[i+1].iov_base; 62 63 body_size = SVAL(inbody, 0x00); 64 if (body_size != expected_body_size) { 65 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); 66 } 67 68 in_security_offset = SVAL(inbody, 0x0C); 69 in_security_length = SVAL(inbody, 0x0E); 70 71 if (in_security_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) { 72 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); 73 } 74 75 if (in_security_length > req->in.vector[i+2].iov_len) { 76 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); 77 } 78 79 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID); 80 in_security_mode = CVAL(inbody, 0x03); 81 in_security_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base; 82 in_security_buffer.length = in_security_length; 83 84 status = smbd_smb2_session_setup(req, 85 in_session_id, 86 in_security_mode, 87 in_security_buffer, 88 &out_session_flags, 89 &out_security_buffer, 90 &out_session_id); 91 if (!NT_STATUS_IS_OK(status) && 92 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { 93 status = nt_status_squash(status); 94 return smbd_smb2_request_error(req, status); 95 } 96 97 out_security_offset = SMB2_HDR_BODY + 0x08; 98 99 outhdr = (uint8_t *)req->out.vector[i].iov_base; 100 101 outbody = data_blob_talloc(req->out.vector, NULL, 0x08); 102 if (outbody.data == NULL) { 103 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY); 104 } 105 106 SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id); 107 108 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */ 109 SSVAL(outbody.data, 0x02, 110 out_session_flags); /* session flags */ 111 SSVAL(outbody.data, 0x04, 112 out_security_offset); /* security buffer offset */ 113 SSVAL(outbody.data, 0x06, 114 out_security_buffer.length); /* security buffer length */ 115 116 outdyn = out_security_buffer; 117 118 return smbd_smb2_request_done_ex(req, status, outbody, &outdyn, 119 __location__); 120} 121 122static int smbd_smb2_session_destructor(struct smbd_smb2_session *session) 123{ 124 if (session->sconn == NULL) { 125 return 0; 126 } 127 128 /* first free all tcons */ 129 while (session->tcons.list) { 130 talloc_free(session->tcons.list); 131 } 132 133 idr_remove(session->sconn->smb2.sessions.idtree, session->vuid); 134 DLIST_REMOVE(session->sconn->smb2.sessions.list, session); 135 invalidate_vuid(session->sconn, session->vuid); 136 137 session->vuid = 0; 138 session->status = NT_STATUS_USER_SESSION_DELETED; 139 session->sconn = NULL; 140 141 return 0; 142} 143 144static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *req, 145 uint64_t in_session_id, 146 uint8_t in_security_mode, 147 DATA_BLOB in_security_buffer, 148 uint16_t *out_session_flags, 149 DATA_BLOB *out_security_buffer, 150 uint64_t *out_session_id) 151{ 152 struct smbd_smb2_session *session; 153 NTSTATUS status; 154 155 *out_session_flags = 0; 156 *out_session_id = 0; 157 158 if (in_session_id == 0) { 159 int id; 160 161 /* create a new session */ 162 session = talloc_zero(req->sconn, struct smbd_smb2_session); 163 if (session == NULL) { 164 return NT_STATUS_NO_MEMORY; 165 } 166 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED; 167 id = idr_get_new_random(req->sconn->smb2.sessions.idtree, 168 session, 169 req->sconn->smb2.sessions.limit); 170 if (id == -1) { 171 return NT_STATUS_INSUFFICIENT_RESOURCES; 172 } 173 session->vuid = id; 174 175 session->tcons.idtree = idr_init(session); 176 if (session->tcons.idtree == NULL) { 177 return NT_STATUS_NO_MEMORY; 178 } 179 session->tcons.limit = 0x0000FFFE; 180 session->tcons.list = NULL; 181 182 DLIST_ADD_END(req->sconn->smb2.sessions.list, session, 183 struct smbd_smb2_session *); 184 session->sconn = req->sconn; 185 talloc_set_destructor(session, smbd_smb2_session_destructor); 186 } else { 187 void *p; 188 189 /* lookup an existing session */ 190 p = idr_find(req->sconn->smb2.sessions.idtree, in_session_id); 191 if (p == NULL) { 192 return NT_STATUS_USER_SESSION_DELETED; 193 } 194 session = talloc_get_type_abort(p, struct smbd_smb2_session); 195 } 196 197 if (NT_STATUS_IS_OK(session->status)) { 198 return NT_STATUS_REQUEST_NOT_ACCEPTED; 199 } 200 201 if (session->auth_ntlmssp_state == NULL) { 202 status = auth_ntlmssp_start(&session->auth_ntlmssp_state); 203 if (!NT_STATUS_IS_OK(status)) { 204 TALLOC_FREE(session); 205 return status; 206 } 207 } 208 209 if (in_security_buffer.data[0] == ASN1_APPLICATION(0)) { 210 DATA_BLOB secblob_in; 211 DATA_BLOB chal_out; 212 char *kerb_mech = NULL; 213 214 status = parse_spnego_mechanisms(in_security_buffer, 215 &secblob_in, &kerb_mech); 216 if (!NT_STATUS_IS_OK(status)) { 217 TALLOC_FREE(session); 218 return nt_status_squash(status); 219 } 220 221 /* For now, just SPNEGO NTLMSSP - krb5 goes here later.. */ 222 status = auth_ntlmssp_update(session->auth_ntlmssp_state, 223 secblob_in, 224 &chal_out); 225 226 if (!NT_STATUS_IS_OK(status) && 227 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { 228 auth_ntlmssp_end(&session->auth_ntlmssp_state); 229 TALLOC_FREE(session); 230 return nt_status_squash(status); 231 } 232 233 *out_security_buffer = spnego_gen_auth_response(&chal_out, 234 status, OID_NTLMSSP); 235 236 *out_session_id = session->vuid; 237 return status; 238 } else if (in_security_buffer.data[0] == ASN1_CONTEXT(1)) { 239 DATA_BLOB auth = data_blob_null; 240 DATA_BLOB auth_out = data_blob_null; 241 242 /* its an auth packet */ 243 if (!spnego_parse_auth(in_security_buffer, &auth)) { 244 TALLOC_FREE(session); 245 return NT_STATUS_LOGON_FAILURE; 246 } 247 /* For now, just SPNEGO NTLMSSP - krb5 goes here later.. */ 248 status = auth_ntlmssp_update(session->auth_ntlmssp_state, 249 auth, 250 &auth_out); 251 if (!NT_STATUS_IS_OK(status)) { 252 auth_ntlmssp_end(&session->auth_ntlmssp_state); 253 TALLOC_FREE(session); 254 return nt_status_squash(status); 255 } 256 257 *out_security_buffer = spnego_gen_auth_response(&auth_out, 258 status, NULL); 259 260 *out_session_id = session->vuid; 261 } else if (strncmp((char *)(in_security_buffer.data), "NTLMSSP", 7) == 0) { 262 263 /* RAW NTLMSSP */ 264 status = auth_ntlmssp_update(session->auth_ntlmssp_state, 265 in_security_buffer, 266 out_security_buffer); 267 268 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { 269 *out_session_id = session->vuid; 270 return status; 271 } 272 if (!NT_STATUS_IS_OK(status)) { 273 auth_ntlmssp_end(&session->auth_ntlmssp_state); 274 TALLOC_FREE(session); 275 return nt_status_squash(status); 276 } 277 *out_session_id = session->vuid; 278 } 279 280 /* TODO: setup session key for signing */ 281 282 if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) || 283 lp_server_signing() == Required) { 284 session->do_signing = true; 285 } 286 287 if (session->auth_ntlmssp_state->server_info->guest) { 288 /* we map anonymous to guest internally */ 289 *out_session_flags |= SMB2_SESSION_FLAG_IS_GUEST; 290 *out_session_flags |= SMB2_SESSION_FLAG_IS_NULL; 291 /* force no signing */ 292 session->do_signing = false; 293 } 294 295 session->server_info = session->auth_ntlmssp_state->server_info; 296 data_blob_free(&session->server_info->user_session_key); 297 session->server_info->user_session_key = 298 data_blob_talloc( 299 session->server_info, 300 session->auth_ntlmssp_state->ntlmssp_state->session_key.data, 301 session->auth_ntlmssp_state->ntlmssp_state->session_key.length); 302 if (session->auth_ntlmssp_state->ntlmssp_state->session_key.length > 0) { 303 if (session->server_info->user_session_key.data == NULL) { 304 TALLOC_FREE(session); 305 return NT_STATUS_NO_MEMORY; 306 } 307 } 308 session->session_key = session->server_info->user_session_key; 309 310 session->compat_vuser = talloc_zero(session, user_struct); 311 if (session->compat_vuser == NULL) { 312 TALLOC_FREE(session); 313 return NT_STATUS_NO_MEMORY; 314 } 315 session->compat_vuser->auth_ntlmssp_state = session->auth_ntlmssp_state; 316 session->compat_vuser->homes_snum = -1; 317 session->compat_vuser->server_info = session->server_info; 318 session->compat_vuser->session_keystr = NULL; 319 session->compat_vuser->vuid = session->vuid; 320 DLIST_ADD(session->sconn->smb1.sessions.validated_users, session->compat_vuser); 321 322 session->status = NT_STATUS_OK; 323 324 /* 325 * we attach the session to the request 326 * so that the response can be signed 327 */ 328 req->session = session; 329 if (session->do_signing) { 330 req->do_signing = true; 331 } 332 333 *out_session_id = session->vuid; 334 return status; 335} 336 337NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req) 338{ 339 const uint8_t *inhdr; 340 int i = req->current_idx; 341 uint64_t in_session_id; 342 void *p; 343 struct smbd_smb2_session *session; 344 345 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base; 346 347 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID); 348 349 /* lookup an existing session */ 350 p = idr_find(req->sconn->smb2.sessions.idtree, in_session_id); 351 if (p == NULL) { 352 return NT_STATUS_USER_SESSION_DELETED; 353 } 354 session = talloc_get_type_abort(p, struct smbd_smb2_session); 355 356 if (!NT_STATUS_IS_OK(session->status)) { 357 return NT_STATUS_ACCESS_DENIED; 358 } 359 360 set_current_user_info(session->server_info->sanitized_username, 361 session->server_info->unix_name, 362 pdb_get_domain(session->server_info->sam_account)); 363 364 req->session = session; 365 return NT_STATUS_OK; 366} 367 368NTSTATUS smbd_smb2_request_process_logoff(struct smbd_smb2_request *req) 369{ 370 const uint8_t *inbody; 371 int i = req->current_idx; 372 DATA_BLOB outbody; 373 size_t expected_body_size = 0x04; 374 size_t body_size; 375 376 if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) { 377 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); 378 } 379 380 inbody = (const uint8_t *)req->in.vector[i+1].iov_base; 381 382 body_size = SVAL(inbody, 0x00); 383 if (body_size != expected_body_size) { 384 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); 385 } 386 387 /* 388 * TODO: cancel all outstanding requests on the session 389 * and delete all tree connections. 390 */ 391 smbd_smb2_session_destructor(req->session); 392 /* 393 * we may need to sign the response, so we need to keep 394 * the session until the response is sent to the wire. 395 */ 396 talloc_steal(req, req->session); 397 398 outbody = data_blob_talloc(req->out.vector, NULL, 0x04); 399 if (outbody.data == NULL) { 400 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY); 401 } 402 403 SSVAL(outbody.data, 0x00, 0x04); /* struct size */ 404 SSVAL(outbody.data, 0x02, 0); /* reserved */ 405 406 return smbd_smb2_request_done(req, outbody, NULL); 407} 408