summaryrefslogtreecommitdiff
path: root/source3/smbd
diff options
context:
space:
mode:
Diffstat (limited to 'source3/smbd')
-rw-r--r--source3/smbd/service.c6
-rw-r--r--source3/smbd/sesssetup.c64
-rw-r--r--source3/smbd/smb2_sesssetup.c23
3 files changed, 34 insertions, 59 deletions
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index f48cfcaa5d..b29713d21d 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -655,8 +655,8 @@ static NTSTATUS create_connection_session_info(struct smbd_server_connection *sc
return NT_STATUS_WRONG_PASSWORD;
}
- return make_serverinfo_from_username(mem_ctx, user, guest,
- presult);
+ return make_session_info_from_username(mem_ctx, user, guest,
+ presult);
}
DEBUG(0, ("invalid VUID (vuser) but not in security=share\n"));
@@ -688,7 +688,7 @@ NTSTATUS set_conn_force_user_group(connection_struct *conn, int snum)
return NT_STATUS_NO_MEMORY;
}
- status = make_serverinfo_from_username(
+ status = make_session_info_from_username(
conn, fuser, conn->session_info->guest,
&forced_serverinfo);
if (!NT_STATUS_IS_OK(status)) {
diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 57b0b68be7..5067201a65 100644
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -248,7 +248,7 @@ static void reply_spnego_kerberos(struct smb_request *req,
int sess_vuid = req->vuid;
NTSTATUS ret = NT_STATUS_OK;
DATA_BLOB ap_rep, ap_rep_wrapped, response;
- struct auth_serversupplied_info *server_info = NULL;
+ struct auth_serversupplied_info *session_info = NULL;
DATA_BLOB session_key = data_blob_null;
uint8 tok_id[2];
DATA_BLOB nullblob = data_blob_null;
@@ -369,15 +369,16 @@ static void reply_spnego_kerberos(struct smb_request *req,
/* reload services so that the new %U is taken into account */
reload_services(sconn->msg_ctx, sconn->sock, True);
- ret = make_server_info_krb5(mem_ctx,
- user, domain, real_username, pw,
- logon_info, map_domainuser_to_guest,
- username_was_mapped,
- &server_info);
+ ret = make_session_info_krb5(mem_ctx,
+ user, domain, real_username, pw,
+ logon_info, map_domainuser_to_guest,
+ username_was_mapped,
+ &session_key,
+ &session_info);
+ data_blob_free(&session_key);
if (!NT_STATUS_IS_OK(ret)) {
DEBUG(1, ("make_server_info_krb5 failed!\n"));
data_blob_free(&ap_rep);
- data_blob_free(&session_key);
TALLOC_FREE(mem_ctx);
reply_nterror(req, nt_status_squash(ret));
return;
@@ -387,20 +388,13 @@ static void reply_spnego_kerberos(struct smb_request *req,
sess_vuid = register_initial_vuid(sconn);
}
- data_blob_free(&server_info->user_session_key);
- /* Set the kerberos-derived session key onto the server_info */
- server_info->user_session_key = session_key;
- talloc_steal(server_info, session_key.data);
-
- session_key = data_blob_null;
-
/* register_existing_vuid keeps the server info */
/* register_existing_vuid takes ownership of session_key on success,
* no need to free after this on success. A better interface would copy
* it.... */
sess_vuid = register_existing_vuid(sconn, sess_vuid,
- server_info, nullblob, user);
+ session_info, nullblob, user);
reply_outbuf(req, 4, 0);
SSVAL(req->outbuf,smb_uid,sess_vuid);
@@ -413,7 +407,7 @@ static void reply_spnego_kerberos(struct smb_request *req,
SSVAL(req->outbuf, smb_vwv3, 0);
- if (server_info->guest) {
+ if (session_info->guest) {
SSVAL(req->outbuf,smb_vwv2,1);
}
@@ -1275,6 +1269,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
const char *primary_domain;
struct auth_usersupplied_info *user_info = NULL;
struct auth_serversupplied_info *server_info = NULL;
+ struct auth_serversupplied_info *session_info = NULL;
uint16 smb_flag2 = req->flags2;
NTSTATUS nt_status;
@@ -1622,29 +1617,20 @@ void reply_sesssetup_and_X(struct smb_request *req)
return;
}
- /* Ensure we can't possible take a code path leading to a
- * null defref. */
- if (!server_info) {
- reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
+ nt_status = create_local_token(req, server_info, NULL, &session_info);
+ TALLOC_FREE(server_info);
+
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ DEBUG(10, ("create_local_token failed: %s\n",
+ nt_errstr(nt_status)));
+ data_blob_free(&nt_resp);
+ data_blob_free(&lm_resp);
+ data_blob_clear_free(&plaintext_password);
+ reply_nterror(req, nt_status_squash(nt_status));
END_PROFILE(SMBsesssetupX);
return;
}
- if (!server_info->security_token) {
- nt_status = create_local_token(server_info);
-
- if (!NT_STATUS_IS_OK(nt_status)) {
- DEBUG(10, ("create_local_token failed: %s\n",
- nt_errstr(nt_status)));
- data_blob_free(&nt_resp);
- data_blob_free(&lm_resp);
- data_blob_clear_free(&plaintext_password);
- reply_nterror(req, nt_status_squash(nt_status));
- END_PROFILE(SMBsesssetupX);
- return;
- }
- }
-
data_blob_clear_free(&plaintext_password);
/* it's ok - setup a reply */
@@ -1654,7 +1640,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
/* perhaps grab OS version here?? */
}
- if (server_info->guest) {
+ if (session_info->guest) {
SSVAL(req->outbuf,smb_vwv2,1);
}
@@ -1663,7 +1649,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
if (lp_security() == SEC_SHARE) {
sess_vuid = UID_FIELD_INVALID;
- TALLOC_FREE(server_info);
+ TALLOC_FREE(session_info);
} else {
/* Ignore the initial vuid. */
sess_vuid = register_initial_vuid(sconn);
@@ -1675,9 +1661,9 @@ void reply_sesssetup_and_X(struct smb_request *req)
END_PROFILE(SMBsesssetupX);
return;
}
- /* register_existing_vuid keeps the server info */
+ /* register_existing_vuid keeps the session_info */
sess_vuid = register_existing_vuid(sconn, sess_vuid,
- server_info,
+ session_info,
nt_resp.data ? nt_resp : lm_resp,
sub_user);
if (sess_vuid == UID_FIELD_INVALID) {
diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
index 3668ab8851..722e4c7705 100644
--- a/source3/smbd/smb2_sesssetup.c
+++ b/source3/smbd/smb2_sesssetup.c
@@ -236,11 +236,12 @@ static NTSTATUS smbd_smb2_session_setup_krb5(struct smbd_smb2_session *session,
/* reload services so that the new %U is taken into account */
reload_services(smb2req->sconn->msg_ctx, smb2req->sconn->sock, true);
- status = make_server_info_krb5(session,
- user, domain, real_username, pw,
- logon_info, map_domainuser_to_guest,
- username_was_mapped,
- &session->session_info);
+ status = make_session_info_krb5(session,
+ user, domain, real_username, pw,
+ logon_info, map_domainuser_to_guest,
+ username_was_mapped,
+ &session_key,
+ &session->session_info);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("smb2: make_server_info_krb5 failed\n"));
goto fail;
@@ -259,18 +260,6 @@ static NTSTATUS smbd_smb2_session_setup_krb5(struct smbd_smb2_session *session,
session->do_signing = false;
}
- data_blob_free(&session->session_info->user_session_key);
- session->session_info->user_session_key =
- data_blob_talloc(
- session->session_info,
- session_key.data,
- session_key.length);
- if (session_key.length > 0) {
- if (session->session_info->user_session_key.data == NULL) {
- status = NT_STATUS_NO_MEMORY;
- goto fail;
- }
- }
session->session_key = session->session_info->user_session_key;
session->compat_vuser = talloc_zero(session, user_struct);
generated by cgit (git 2.34.1) at 2024-07-07 09:26:26 +0000