s3:smbd: implement SMB2 Session Setup with raw NTLMSSP

metze

4 files changed, 221 insertions, 1 deletions

diff --git a/source3/Makefile.in b/source3/Makefile.in
index f5074e3a78..fdcd86a088 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -749,6 +749,7 @@ SMBD_OBJ_SRV = smbd/files.o smbd/chgpasswd.o smbd/connection.o \
 	       smbd/file_access.o \
 	       smbd/dnsregister.o smbd/globals.o \
 	       smbd/smb2_server.o smbd/smb2_negprot.o \
+	       smbd/smb2_sesssetup.o \
 	       smbd/smb2_keepalive.o \
 	       $(MANGLE_OBJ) @VFS_STATIC@
 
diff --git a/source3/smbd/globals.h b/source3/smbd/globals.h
index 93075ad901..5a7ad7d9e3 100644
--- a/source3/smbd/globals.h
+++ b/source3/smbd/globals.h
@@ -221,6 +221,7 @@ NTSTATUS smbd_smb2_request_done(struct smbd_smb2_request *req,
 				DATA_BLOB body, DATA_BLOB *dyn);
 
 NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req);
+NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *req);
 NTSTATUS smbd_smb2_request_process_keepalive(struct smbd_smb2_request *req);
 
 struct smbd_smb2_request {
@@ -276,6 +277,16 @@ struct smbd_smb2_request {
 	} out;
 };
 
+struct smbd_server_connection;
+
+struct smbd_smb2_session {
+	struct smbd_smb2_session *prev, *next;
+	struct smbd_server_connection *conn;
+	NTSTATUS status;
+	uint64_t vuid;
+	AUTH_NTLMSSP_STATE *auth_ntlmssp_state;
+};
+
 struct smbd_server_connection {
 	struct fd_event *fde;
 	uint64_t num_requests;
@@ -286,6 +297,17 @@ struct smbd_server_connection {
 		struct tevent_queue *recv_queue;
 		struct tevent_queue *send_queue;
 		struct tstream_context *stream;
+		struct {
+			/* an id tree used to allocate vuids */
+			/* this holds info on session vuids that are already
+			 * validated for this VC */
+			struct idr_context *idtree;
+
+			/* this is the limit of vuid values for this connection */
+			uint64_t limit;
+
+			struct smbd_smb2_session *list;
+		} sessions;
 	} smb2;
 };
 
diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index 68c812b37f..6d8961eebb 100644
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -55,6 +55,13 @@ static NTSTATUS smbd_initialize_smb2(struct smbd_server_connection *conn)
 		return NT_STATUS_NO_MEMORY;
 	}
 
+	conn->smb2.sessions.idtree = idr_init(conn);
+	if (conn->smb2.sessions.idtree == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	conn->smb2.sessions.limit = 0x0000FFFF;
+	conn->smb2.sessions.list = NULL;
+
 	ret = tstream_bsd_existing_socket(conn, smbd_server_fd(),
 					  &conn->smb2.stream);
 	if (ret == -1) {
@@ -293,7 +300,7 @@ static NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
 		return smbd_smb2_request_process_negprot(req);
 
 	case SMB2_OP_SESSSETUP:
-		return smbd_smb2_request_error(req, NT_STATUS_NOT_IMPLEMENTED);
+		return smbd_smb2_request_process_sesssetup(req);
 
 	case SMB2_OP_LOGOFF:
 		return smbd_smb2_request_error(req, NT_STATUS_NOT_IMPLEMENTED);
diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
new file mode 100644
index 0000000000..6c4da393e1
--- /dev/null
+++ b/source3/smbd/smb2_sesssetup.c
@@ -0,0 +1,190 @@
+/*
+   Unix SMB/CIFS implementation.
+   Core SMB2 server
+
+   Copyright (C) Stefan Metzmacher 2009
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "smbd/globals.h"
+#include "../source4/libcli/smb2/smb2_constants.h"
+
+static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *req,
+					uint64_t in_session_id,
+					DATA_BLOB in_security_buffer,
+					DATA_BLOB *out_security_buffer,
+					uint64_t *out_session_id);
+
+NTSTATUS smbd_smb2_request_process_sesssetup(struct smbd_smb2_request *req)
+{
+	const uint8_t *inhdr;
+	const uint8_t *inbody;
+	int i = req->current_idx;
+	uint8_t *outhdr;
+	DATA_BLOB outbody;
+	DATA_BLOB outdyn;
+	size_t expected_body_size = 0x19;
+	size_t body_size;
+	uint64_t in_session_id;
+	uint16_t in_security_offset;
+	uint16_t in_security_length;
+	DATA_BLOB in_security_buffer;
+	uint64_t out_session_id;
+	uint16_t out_security_offset;
+	DATA_BLOB out_security_buffer;
+	NTSTATUS status;
+
+	inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
+
+	if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
+		return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+	}
+
+	inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
+
+	body_size = SVAL(inbody, 0x00);
+	if (body_size != expected_body_size) {
+		return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+	}
+
+	in_security_offset = SVAL(inbody, 0x0C);
+	in_security_length = SVAL(inbody, 0x0E);
+
+	if (in_security_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
+		return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+	}
+
+	if (in_security_length > req->in.vector[i+2].iov_len) {
+		return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+	}
+
+	in_session_id = SVAL(inhdr, SMB2_HDR_SESSION_ID);
+	in_security_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
+	in_security_buffer.length = in_security_length;
+
+	status = smbd_smb2_session_setup(req,
+					 in_session_id,
+					 in_security_buffer,
+					 &out_security_buffer,
+					 &out_session_id);
+	if (!NT_STATUS_IS_OK(status) &&
+	    !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+		status = nt_status_squash(status);
+		return smbd_smb2_request_error(req, status);
+	}
+
+	out_security_offset = SMB2_HDR_BODY + 0x08;
+
+	outhdr = (uint8_t *)req->out.vector[i].iov_base;
+
+	outbody = data_blob_talloc(req->out.vector, NULL, 0x08);
+	if (outbody.data == NULL) {
+		return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
+	}
+
+	SBVAL(outhdr, SMB2_HDR_SESSION_ID, out_session_id);
+
+	SSVAL(outbody.data, 0x00, 0x08 + 1);	/* struct size */
+	SSVAL(outbody.data, 0x02, 0);		/* session flags */
+	SSVAL(outbody.data, 0x04,
+	      out_security_offset);		/* security buffer offset */
+	SSVAL(outbody.data, 0x06,
+	      out_security_buffer.length);	/* security buffer length */
+
+	outdyn = out_security_buffer;
+
+	return smbd_smb2_request_done_ex(req, status, outbody, &outdyn);
+}
+
+static int smbd_smb2_session_destructor(struct smbd_smb2_session *session)
+{
+	if (session->conn == NULL) {
+		return 0;
+	}
+
+	idr_remove(session->conn->smb2.sessions.idtree, session->vuid);
+	DLIST_REMOVE(session->conn->smb2.sessions.list, session);
+
+	return 0;
+}
+
+static NTSTATUS smbd_smb2_session_setup(struct smbd_smb2_request *req,
+					uint64_t in_session_id,
+					DATA_BLOB in_security_buffer,
+					DATA_BLOB *out_security_buffer,
+					uint64_t *out_session_id)
+{
+	struct smbd_smb2_session *session;
+	NTSTATUS status;
+
+	if (in_session_id == 0) {
+		int id;
+
+		/* create a new session */
+		session = talloc_zero(req->conn, struct smbd_smb2_session);
+		if (session == NULL) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
+		id = idr_get_new_random(req->conn->smb2.sessions.idtree,
+					session,
+					req->conn->smb2.sessions.limit);
+		if (id == -1) {
+			return NT_STATUS_INSUFFICIENT_RESOURCES;
+		}
+		session->vuid = id;
+		DLIST_ADD_END(req->conn->smb2.sessions.list, session,
+			      struct smbd_smb2_session *);
+		session->conn = req->conn;
+		talloc_set_destructor(session, smbd_smb2_session_destructor);
+	} else {
+		void *p;
+
+		/* lookup an existing session */
+		p = idr_find(req->conn->smb2.sessions.idtree, in_session_id);
+		if (p == NULL) {
+			return NT_STATUS_USER_SESSION_DELETED;
+		}
+		session = talloc_get_type_abort(p, struct smbd_smb2_session);
+	}
+
+	if (NT_STATUS_IS_OK(session->status)) {
+		return NT_STATUS_REQUEST_NOT_ACCEPTED;
+	}
+
+	if (session->auth_ntlmssp_state == NULL) {
+		status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+	}
+
+	status = auth_ntlmssp_update(session->auth_ntlmssp_state,
+				     in_security_buffer,
+				     out_security_buffer);
+	if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+		/* nothing to do */
+	} else if (NT_STATUS_IS_OK(status)) {
+		/* TODO: setup session key for signing */
+		session->status = NT_STATUS_OK;
+	} else {
+		return status;
+	}
+
+	*out_session_id = session->vuid;
+	return status;
+}
+