archive
/
windows-nt-4.0
mirror of https://github.com/lianthony/NT4.0
2
0
Fork 0
Code Issues Projects Releases Wiki Activity
Windows NT 4.0 source code leak
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2 Commits
1 Branch
0 Tags
184 MiB
 
 
 
 
 
 
Tree: b4a8d373d8
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'b4a8d373d8'
${ noResults }
windows-nt-4.0/private/ntos/srv/smbadmin.c

2657 lines
74 KiB
Raw Blame History

/*++
Copyright (c) 1989 Microsoft Corporation
Module Name:
smbadmin.c
Abstract:
This module contains routines for processing the administrative SMBs:
negotiate, session setup, tree connect, and logoff.
Author:
David Treadwell (davidtr) 30-Oct-1989
Revision History:
--*/
#include "precomp.h"
#pragma hdrstop
#define ENCRYPT_TEXT_LENGTH 20
VOID
GetEncryptionKey (
OUT CHAR EncryptionKey[MSV1_0_CHALLENGE_LENGTH]
);
VOID SRVFASTCALL
BlockingSessionSetupAndX (
IN OUT PWORK_CONTEXT WorkContext
);
VOID SRVFASTCALL
BlockingSessionSetup (
IN OUT PWORK_CONTEXT WorkContext
);
//
// EncryptionKeyCount is a monotonically increasing count of the number
// of times GetEncryptionKey has been called. This number is added to
// the system time to ensure that we do not use the same seed twice in
// generating a random challenge.
//
STATIC
ULONG EncryptionKeyCount = 0;
#ifdef ALLOC_PRAGMA
#pragma alloc_text( PAGE, SrvSmbNegotiate )
#pragma alloc_text( PAGE, SrvSmbProcessExit )
#pragma alloc_text( PAGE, SrvSmbSessionSetupAndX )
#pragma alloc_text( PAGE, BlockingSessionSetupAndX )
#pragma alloc_text( PAGE, SrvSmbSessionSetup )
#pragma alloc_text( PAGE, BlockingSessionSetup )
#pragma alloc_text( PAGE, SrvSmbLogoffAndX )
#pragma alloc_text( PAGE, GetEncryptionKey )
#endif
SMB_PROCESSOR_RETURN_TYPE
SrvSmbNegotiate (
SMB_PROCESSOR_PARAMETERS
)
/*++
Routine Description:
Processes a negotiate SMB.
Arguments:
SMB_PROCESSOR_PARAMETERS - See smbprocs.h for a description
of the parameters to SMB processor routines.
Return Value:
SMB_PROCESSOR_RETURN_TYPE - See smbprocs.h
--*/
{
PREQ_NEGOTIATE request;
PRESP_NT_NEGOTIATE ntResponse;
PRESP_NEGOTIATE response;
PRESP_OLD_NEGOTIATE respOldNegotiate;
PCONNECTION connection;
PENDPOINT endpoint;
PPAGED_CONNECTION pagedConnection;
USHORT byteCount;
PSZ s;
SMB_DIALECT bestDialect, serverDialect, firstDialect;
USHORT consumerDialectChosen, consumerDialect;
LARGE_INTEGER serverTime;
SMB_DATE date;
SMB_TIME time;
ULONG capabilities;
PAGED_CODE( );
IF_SMB_DEBUG(ADMIN1) {
SrvPrint2( "Negotiate request header at 0x%lx, "
"response header at 0x%lx\n",
WorkContext->RequestHeader, WorkContext->ResponseHeader );
SrvPrint2( "Negotiate request parameters at 0x%lx, "
"response parameters at 0x%lx\n",
WorkContext->RequestParameters,
WorkContext->ResponseParameters );
}
//
// Set up input and output buffers for parameters.
//
request = (PREQ_NEGOTIATE)WorkContext->RequestParameters;
response = (PRESP_NEGOTIATE)WorkContext->ResponseParameters;
ntResponse = (PRESP_NT_NEGOTIATE)WorkContext->ResponseParameters;
//
// Make sure that this is the first negotiate command sent.
// SrvStartListen() sets the dialect to illegal, so if it has changed
// then a negotiate SMB has already been sent.
//
connection = WorkContext->Connection;
pagedConnection = connection->PagedConnection;
endpoint = connection->Endpoint;
if ( connection->SmbDialect != SmbDialectIllegal ) {
IF_DEBUG(SMB_ERRORS) {
SrvPrint0( "SrvSmbNegotiate: Command already sent.\n" );
}
SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
return SmbStatusSendResponse;
}
//
// Find out which (if any) of the sent dialect strings matches the
// dialect strings known by this server. The ByteCount is verified
// to be legitimate in SrvProcessSmb, so it is not possible to walk
// off the end of the SMB here.
//
bestDialect = SmbDialectIllegal;
consumerDialectChosen = (USHORT)0xFFFF;
if( endpoint->IsPrimaryName ) {
firstDialect = FIRST_DIALECT;
} else {
firstDialect = FIRST_DIALECT_EMULATED;
}
for ( s = (PSZ)request->Buffer, consumerDialect = 0;
s < SmbGetUshort( &request->ByteCount ) + (PSZ)request->Buffer;
s += strlen(s) + 1, consumerDialect++ ) {
if ( *s++ != SMB_FORMAT_DIALECT ) {
IF_DEBUG(SMB_ERRORS) {
SrvPrint0( "SrvSmbNegotiate: Invalid dialect format code.\n" );
}
SrvLogInvalidSmb( WorkContext );
SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
return SmbStatusSendResponse;
}
for ( serverDialect = firstDialect;
serverDialect < bestDialect;
serverDialect++ ) {
if ( !strcmp( s, StrDialects[serverDialect] ) ) {
IF_SMB_DEBUG(ADMIN2) {
SrvPrint2( "Matched: %s and %s\n",
StrDialects[serverDialect], s );
}
bestDialect = serverDialect;
consumerDialectChosen = consumerDialect;
}
}
}
connection->SmbDialect = bestDialect;
if( bestDialect <= SmbDialectNtLanMan ) {
connection->IpxDropDuplicateCount = MIN_IPXDROPDUP;
} else {
connection->IpxDropDuplicateCount = MAX_IPXDROPDUP;
}
IF_SMB_DEBUG(ADMIN1) {
SrvPrint2( "Choosing dialect #%ld, string = %s\n",
consumerDialectChosen, StrDialects[bestDialect] );
}
//
// Determine the current system time on the server. We use this
// to determine the time zone of the server and to tell the client
// the current time of day on the server.
//
KeQuerySystemTime( &serverTime );
//
// If the consumer only knows the core protocol, return short (old)
// form of the negotiate response. Also, if no dialect is acceptable,
// return 0xFFFF as the selected dialect.
//
if ( bestDialect == SmbDialectPcNet10 ||
consumerDialectChosen == (USHORT)0xFFFF ) {
respOldNegotiate = (PRESP_OLD_NEGOTIATE)response;
respOldNegotiate->WordCount = 1;
SmbPutUshort( &respOldNegotiate->DialectIndex, consumerDialectChosen );
SmbPutUshort( &respOldNegotiate->ByteCount, 0 );
WorkContext->ResponseParameters = NEXT_LOCATION(
respOldNegotiate,
RESP_OLD_NEGOTIATE,
0
);
}
else if ( bestDialect > SmbDialectNtLanMan ) {
//
// Send the OS/2 LAN Man SMB response.
//
WorkContext->ResponseHeader->Flags =
(UCHAR)(WorkContext->RequestHeader->Flags | SMB_FLAGS_LOCK_AND_READ_OK);
response->WordCount = 13;
SmbPutUshort( &response->DialectIndex, consumerDialectChosen );
//
// Indicate that we're user-level security and that we
// want encrypted passwords.
//
SmbPutUshort(
&response->SecurityMode,
NEGOTIATE_USER_SECURITY | NEGOTIATE_ENCRYPT_PASSWORDS
);
//
// Get an encryption key for this connection.
//
GetEncryptionKey( pagedConnection->EncryptionKey );
SmbPutUshort( &response->EncryptionKeyLength, MSV1_0_CHALLENGE_LENGTH );
SmbPutUshort( &response->Reserved, 0 );
byteCount = MSV1_0_CHALLENGE_LENGTH;
RtlCopyMemory(
response->Buffer,
pagedConnection->EncryptionKey,
MSV1_0_CHALLENGE_LENGTH
);
if ( endpoint->IsConnectionless ) {
ULONG adapterNumber;
ULONG maxBufferSize;
//
// Our server max buffer size is the smaller of the
// server receive buffer size and the ipx transport
// indicated max packet size.
//
adapterNumber =
WorkContext->ClientAddress->DatagramOptions.LocalTarget.NicId;
maxBufferSize = GetIpxMaxBufferSize(
endpoint,
adapterNumber,
SrvReceiveBufferLength
);
SmbPutUshort(
&response->MaxBufferSize,
(USHORT)maxBufferSize
);
} else {
SmbPutUshort(
&response->MaxBufferSize,
(USHORT)SrvReceiveBufferLength
);
}
SmbPutUshort( &response->MaxMpxCount, SrvMaxMpxCount );
SmbPutUshort( &response->MaxNumberVcs, (USHORT)SrvMaxNumberVcs );
SmbPutUlong( &response->SessionKey, 0 );
//
// If this is an MS-NET 1.03 client or before, then tell him that we
// don't support raw writes. MS-NET 1.03 does different things with
// raw writes that are more trouble than they're worth, and since
// raw is simply a performance issue, we don't support it.
//
if ( bestDialect >= SmbDialectMsNet103 ) {
SmbPutUshort(
&response->RawMode,
(USHORT)(SrvEnableRawMode ?
NEGOTIATE_READ_RAW_SUPPORTED :
0)
);
} else {
SmbPutUshort(
&response->RawMode,
(USHORT)(SrvEnableRawMode ?
NEGOTIATE_READ_RAW_SUPPORTED |
NEGOTIATE_WRITE_RAW_SUPPORTED :
0)
);
}
SmbPutUlong( &response->SessionKey, 0 );
SrvTimeToDosTime( &serverTime, &date, &time );
SmbPutDate( &response->ServerDate, date );
SmbPutTime( &response->ServerTime, time );
//
// Get time zone bias. We compute this during session
// setup rather than once during server startup because
// we might switch from daylight time to standard time
// or vice versa during normal server operation.
//
SmbPutUshort( &response->ServerTimeZone,
SrvGetOs2TimeZone(&serverTime) );
if ( bestDialect == SmbDialectLanMan21 ||
bestDialect == SmbDialectDosLanMan21 ) {
//
// Append the domain to the SMB.
//
RtlCopyMemory(
response->Buffer + byteCount,
endpoint->OemDomainName.Buffer,
endpoint->OemDomainName.Length + sizeof(CHAR)
);
byteCount += endpoint->OemDomainName.Length + sizeof(CHAR);
}
SmbPutUshort( &response->ByteCount, byteCount );
WorkContext->ResponseParameters = NEXT_LOCATION(
response,
RESP_NEGOTIATE,
byteCount
);
} else {
//
// NT or better protocol has been negotiated.
//
ntResponse->WordCount = 17;
SmbPutUshort( &ntResponse->DialectIndex, consumerDialectChosen );
// !!! This says that we don't want encrypted passwords.
SmbPutUshort( &ntResponse->MaxMpxCount, SrvMaxMpxCount );
SmbPutUshort( &ntResponse->MaxNumberVcs, (USHORT)SrvMaxNumberVcs );
SmbPutUlong( &ntResponse->MaxRawSize, 64 * 1024 ); // !!!
SmbPutUlong( &ntResponse->SessionKey, 0 );
capabilities = CAP_RAW_MODE |
CAP_UNICODE |
CAP_LARGE_FILES |
CAP_NT_SMBS |
CAP_NT_FIND |
CAP_RPC_REMOTE_APIS |
CAP_NT_STATUS |
CAP_LEVEL_II_OPLOCKS |
CAP_LOCK_AND_READ;
//
// If we're supporting Dfs operations, let the client know about it.
//
if( SrvDfsFastIoDeviceControl ) {
capabilities |= CAP_DFS;
}
if ( endpoint->IsConnectionless ) {
ULONG adapterNumber;
ULONG maxBufferSize;
capabilities |= CAP_MPX_MODE;
//
// Our server max buffer size is the smaller of the
// server receive buffer size and the ipx transport
// indicated max packet size.
//
adapterNumber =
WorkContext->ClientAddress->DatagramOptions.LocalTarget.NicId;
maxBufferSize = GetIpxMaxBufferSize(
endpoint,
adapterNumber,
SrvReceiveBufferLength
);
SmbPutUlong(
&ntResponse->MaxBufferSize,
maxBufferSize
);
} else {
SmbPutUlong(
&ntResponse->MaxBufferSize,
SrvReceiveBufferLength
);
if( SrvSupportsBulkTransfer ) {
capabilities |= CAP_BULK_TRANSFER;
if( SrvSupportsCompression ) {
capabilities |= CAP_COMPRESSED_DATA;
}
}
capabilities |= CAP_LARGE_READX;
}
SmbPutUlong( &ntResponse->Capabilities, capabilities );
//
// Stick the servers system time and timezone in the negotiate
// response.
//
SmbPutUlong( &ntResponse->SystemTimeLow, serverTime.LowPart );
SmbPutUlong( &ntResponse->SystemTimeHigh, serverTime.HighPart );
SmbPutUshort( &ntResponse->ServerTimeZone,
SrvGetOs2TimeZone(&serverTime) );
//
// Indicate that we're user-level security and that we
// want encrypted passwords.
//
ntResponse->SecurityMode =
NEGOTIATE_USER_SECURITY | NEGOTIATE_ENCRYPT_PASSWORDS;
//
// Get an encryption key for this connection.
//
GetEncryptionKey( pagedConnection->EncryptionKey );
RtlCopyMemory(
ntResponse->Buffer,
pagedConnection->EncryptionKey,
MSV1_0_CHALLENGE_LENGTH
);
ASSERT ( MSV1_0_CHALLENGE_LENGTH <= 0xff ) ;
ntResponse->EncryptionKeyLength = MSV1_0_CHALLENGE_LENGTH;
byteCount = MSV1_0_CHALLENGE_LENGTH;
{
USHORT domainLength;
PWCH buffer = (PWCHAR)( ntResponse->Buffer+byteCount );
PWCH ptr;
//
// append either the Lanman domain or the Kerberos
// domain.
//
if((ptr = KerberosRealm.Buffer)
&&
(bestDialect <= SmbDialectCairo)
)
{
domainLength = KerberosRealm.MaximumLength;
}
else
{
domainLength = endpoint->DomainName.Length +
sizeof(UNICODE_NULL);
ptr = endpoint->DomainName.Buffer;
}
RtlCopyMemory(
buffer,
ptr,
domainLength
);
byteCount += domainLength;
}
SmbPutUshort( &ntResponse->ByteCount, byteCount );
WorkContext->ResponseParameters = NEXT_LOCATION(
ntResponse,
RESP_NT_NEGOTIATE,
byteCount
);
} // else (NT protocol has been negotiated).
IF_DEBUG(TRACE2) SrvPrint0( "SrvSmbNegotiate complete.\n" );
return SmbStatusSendResponse;
} // SrvSmbNegotiate
SMB_PROCESSOR_RETURN_TYPE
SrvSmbProcessExit (
SMB_PROCESSOR_PARAMETERS
)
/*++
Routine Description:
Processes a Process Exit SMB.
Arguments:
SMB_PROCESSOR_PARAMETERS - See smbprocs.h for a description
of the parameters to SMB processor routines.
Return Value:
SMB_PROCESSOR_RETURN_TYPE - See smbprocs.h
--*/
{
PREQ_PROCESS_EXIT request;
PRESP_PROCESS_EXIT response;
PSESSION session;
USHORT pid;
PAGED_CODE( );
IF_SMB_DEBUG(ADMIN1) {
SrvPrint2( "Process exit request header at 0x%lx, "
"response header at 0x%lx\n",
WorkContext->RequestHeader,
WorkContext->ResponseHeader );
SrvPrint2( "Process exit request parameters at 0x%lx, "
"response parameters at 0x%lx\n",
WorkContext->RequestParameters,
WorkContext->ResponseParameters );
}
//
// Set up parameters.
//
request = (PREQ_PROCESS_EXIT)(WorkContext->RequestParameters);
response = (PRESP_PROCESS_EXIT)(WorkContext->ResponseParameters);
//
// If a session block has not already been assigned to the current
// work context, verify the UID. If verified, the address of the
// session block corresponding to this user is stored in the
// WorkContext block and the session block is referenced.
//
session = SrvVerifyUid(
WorkContext,
SmbGetAlignedUshort( &WorkContext->RequestHeader->Uid )
);
if ( session == NULL ) {
IF_DEBUG(SMB_ERRORS) {
SrvPrint1( "SrvSmbProcessExit: Invalid UID: 0x%lx\n",
SmbGetAlignedUshort( &WorkContext->RequestHeader->Uid ) );
}
SrvSetSmbError( WorkContext, STATUS_SMB_BAD_UID );
return SmbStatusSendResponse;
}
//
// Close all files with the same PID as in the header for this request.
//
pid = SmbGetAlignedUshort( &WorkContext->RequestHeader->Pid );
IF_SMB_DEBUG(ADMIN1) SrvPrint1( "Closing files with PID = %lx\n", pid );
SrvCloseRfcbsOnSessionOrPid( session, &pid );
//
// Close all searches with the same PID as in the header for this request.
//
IF_SMB_DEBUG(ADMIN1) SrvPrint1( "Closing searches with PID = %lx\n", pid );
SrvCloseSearches(
session->Connection,
(PSEARCH_FILTER_ROUTINE)SrvSearchOnPid,
(PVOID) pid,
NULL
);
//
// Close any cached directories for this client
//
SrvCloseCachedDirectoryEntries( session->Connection );
//
// Build the response SMB.
//
response->WordCount = 0;
SmbPutUshort( &response->ByteCount, 0 );
WorkContext->ResponseParameters = NEXT_LOCATION(
response,
RESP_PROCESS_EXIT,
0
);
return SmbStatusSendResponse;
} // SrvSmbProcessExit
SMB_PROCESSOR_RETURN_TYPE
SrvSmbSessionSetupAndX(
SMB_PROCESSOR_PARAMETERS
)
/*++
Routine Description:
Processes a session setup and X SMB.
Arguments:
SMB_PROCESSOR_PARAMETERS - See smbprocs.h for a description
of the parameters to SMB processor routines.
Return Value:
SMB_PROCESSOR_RETURN_TYPE - See smbprocs.h
--*/
{
PAGED_CODE();
//
// This SMB must be processed in a blocking thread.
//
WorkContext->FspRestartRoutine = BlockingSessionSetupAndX;
SrvQueueWorkToBlockingThread( WorkContext );
return SmbStatusInProgress;
} // SrvSmbSessionSetupAndX
VOID SRVFASTCALL
BlockingSessionSetupAndX(
IN OUT PWORK_CONTEXT WorkContext
)
/*++
Routine Description:
Processes a session setup and X SMB.
Arguments:
SMB_PROCESSOR_PARAMETERS - See smbprocs.h for a description
of the parameters to SMB processor routines.
Return Value:
SMB_PROCESSOR_RETURN_TYPE - See smbprocs.h
NOTE:
We have disabled CAP_KERBEROS_BLOB until we decide exactly
how we want to do security negotiation. Since NT 4.0 does
not ship kerberos, it is premature to turn it on now
--*/
{
PREQ_SESSION_SETUP_ANDX request;
PREQ_NT_SESSION_SETUP_ANDX ntRequest;
PRESP_SESSION_SETUP_ANDX response;
NTSTATUS status;
PSESSION session;
PCONNECTION connection;
PENDPOINT endpoint;
PPAGED_CONNECTION pagedConnection;
PTABLE_ENTRY entry;
SHORT uidIndex;
USHORT reqAndXOffset;
UCHAR nextCommand;
PSZ userName;
UNICODE_STRING nameString;
UNICODE_STRING domainString;
PCHAR caseInsensitivePassword;
CLONG caseInsensitivePasswordLength;
PCHAR caseSensitivePassword;
CLONG caseSensitivePasswordLength;
USHORT action = 0;
USHORT byteCount;
USHORT nameLength;
BOOLEAN locksHeld;
BOOLEAN isUnicode, IsKerb;
PAGED_CODE();
//
// If the connection has closed (timed out), abort.
//
connection = WorkContext->Connection;
if ( GET_BLOCK_STATE(connection) != BlockStateActive ) {
IF_DEBUG(ERRORS) {
SrvPrint0( "SrvSmbSessionSetupAndX: Connection closing\n" );
}
SrvEndSmbProcessing( WorkContext, SmbStatusNoResponse );
return;
}
IF_SMB_DEBUG(ADMIN1) {
SrvPrint2( "Session setup request header at 0x%lx, "
"response header at 0x%lx\n",
WorkContext->RequestHeader, WorkContext->ResponseHeader );
SrvPrint2( "Session setup request parameters at 0x%lx, "
"response parameters at 0x%lx\n",
WorkContext->RequestParameters,
WorkContext->ResponseParameters );
}
//
// Initialize local variables for error cleanup.
//
nameString.Buffer = NULL;
domainString.Buffer = NULL;
session = NULL;
locksHeld = FALSE;
//
// Set up parameters.
//
request = (PREQ_SESSION_SETUP_ANDX)(WorkContext->RequestParameters);
ntRequest = (PREQ_NT_SESSION_SETUP_ANDX)(WorkContext->RequestParameters);
response = (PRESP_SESSION_SETUP_ANDX)(WorkContext->ResponseParameters);
connection = WorkContext->Connection;
pagedConnection = connection->PagedConnection;
//
// First verify that the SMB format is correct.
//
if ( (connection->SmbDialect <= SmbDialectNtLanMan &&
request->WordCount != 13) ||
(connection->SmbDialect > SmbDialectNtLanMan &&
request->WordCount != 10 ) ||
(connection->SmbDialect == SmbDialectIllegal ) ) {
//
// The SMB word count is invalid.
//
IF_DEBUG(SMB_ERRORS) {
if ( connection->SmbDialect == SmbDialectIllegal ) {
SrvPrint1("BlockingSessionSetupAndX: Client %Z is using an "
"illegal dialect.\n", &connection->OemClientMachineNameString );
}
}
status = STATUS_INVALID_SMB;
goto error_exit1;
}
//
// Convert the client name to unicode
//
if ( pagedConnection->ClientMachineNameString.Length == 0 ) {
UNICODE_STRING clientMachineName;
clientMachineName.Buffer = pagedConnection->ClientMachineName;
clientMachineName.MaximumLength =
(USHORT)(COMPUTER_NAME_LENGTH+1)*sizeof(WCHAR);
(VOID)RtlOemStringToUnicodeString(
&clientMachineName,
&connection->OemClientMachineNameString,
FALSE
);
//
// Add the double backslashes to the length
//
pagedConnection->ClientMachineNameString.Length =
(USHORT)(clientMachineName.Length + 2*sizeof(WCHAR));
}
//
// If this is LanMan 2.1 or better, the session setup response may
// be longer than the request. Allocate an extra SMB buffer. The
// buffer is freed after we have finished sending the SMB response.
//
// !!! Try to be smarter before grabbing the extra buffer.
//
if ( connection->SmbDialect <= SmbDialectDosLanMan21 &&
!WorkContext->UsingExtraSmbBuffer) {
status = SrvAllocateExtraSmbBuffer( WorkContext );
if ( !NT_SUCCESS(status) ) {
goto error_exit;
}
response = (PRESP_SESSION_SETUP_ANDX)(WorkContext->ResponseParameters);
RtlCopyMemory(
WorkContext->ResponseHeader,
WorkContext->RequestHeader,
sizeof( SMB_HEADER )
);
}
//
// Get the client capabilities
//
if ( connection->SmbDialect <= SmbDialectNtLanMan ) {
connection->ClientCapabilities =
SmbGetUlong( &ntRequest->Capabilities ) &
( CAP_UNICODE |
CAP_LARGE_FILES |
CAP_NT_SMBS |
CAP_NT_FIND |
CAP_NT_STATUS |
#ifdef CAP_KERBEROS_BLOB
CAP_KERBEROS_BLOB |
#endif
CAP_LEVEL_II_OPLOCKS );
if ( connection->ClientCapabilities & CAP_NT_SMBS ) {
connection->ClientCapabilities |= CAP_NT_FIND;
}
}
//
// Get the account name, and additional information from the SMB buffer.
//
if ( connection->SmbDialect <= SmbDialectNtLanMan) {
//
// The NT-NT SMB protocol passes both case sensitive (Unicode,
// mixed case) and case insensitive (ANSI, uppercased) passwords.
// Get pointers to them to pass to SrvValidateUser.
//
caseInsensitivePasswordLength =
(CLONG)SmbGetUshort( &ntRequest->CaseInsensitivePasswordLength );
caseInsensitivePassword = (PCHAR)(ntRequest->Buffer);
caseSensitivePasswordLength =
(CLONG)SmbGetUshort( &ntRequest->CaseSensitivePasswordLength );
caseSensitivePassword =
caseInsensitivePassword + caseInsensitivePasswordLength;
userName = (PSZ)(caseSensitivePassword + caseSensitivePasswordLength);
} else {
//
// Downlevel clients do not pass the case sensitive password;
// just get the case insensitive password and use NULL as the
// case sensitive password. LSA will do the right thing with
// it.
//
caseInsensitivePasswordLength =
(CLONG)SmbGetUshort( &request->PasswordLength );
caseInsensitivePassword = (PCHAR)request->Buffer;
caseSensitivePasswordLength = 0;
caseSensitivePassword = NULL;
userName = (PSZ)(request->Buffer + caseInsensitivePasswordLength);
}
isUnicode = SMB_IS_UNICODE( WorkContext );
if ( isUnicode ) {
userName = ALIGN_SMB_WSTR( userName );
}
nameLength = SrvGetStringLength(
userName,
END_OF_REQUEST_SMB( WorkContext ),
isUnicode,
FALSE // don't include null terminator
);
if ( nameLength == (USHORT)-1 ) {
status = STATUS_INVALID_SMB;
goto error_exit;
}
status = SrvMakeUnicodeString(
isUnicode,
&nameString,
userName,
&nameLength );
if ( !NT_SUCCESS( status ) ) {
goto error_exit;
}
//
// If client information strings exists, extract the information
// from the SMB buffer.
//
if ( connection->SmbDialect <= SmbDialectDosLanMan21) {
PCHAR smbInformation;
USHORT length;
PWCH infoBuffer;
smbInformation = userName + nameLength +
( isUnicode ? sizeof( WCHAR ) : 1 );
//
// Now copy the strings to the allocated buffer.
//
if ( isUnicode ) {
smbInformation = ALIGN_SMB_WSTR( smbInformation );
}
length = SrvGetStringLength(
smbInformation,
END_OF_REQUEST_SMB( WorkContext ),
isUnicode,
FALSE // don't include null terminator
);
if ( length == (USHORT)-1) {
status = STATUS_INVALID_SMB;
goto error_exit;
}
//
// DOS clients send an empty domain name if they don't know
// their domain name (e.g., during logon). OS/2 clients send
// a name of "?". This confuses the LSA. Convert such a name
// to an empty name.
//
if ( isUnicode ) {
if ( (length == sizeof(WCHAR)) &&
(*(PWCH)smbInformation == '?') ) {
length = 0;
}
} else {
if ( (length == 1) && (*smbInformation == '?') ) {
length = 0;
}
}
status = SrvMakeUnicodeString(
isUnicode,
&domainString,
smbInformation,
&length
);
if ( !NT_SUCCESS( status ) ) {
goto error_exit;
}
smbInformation += length + ( isUnicode ? sizeof(WCHAR) : 1 );
//
// Get the client type strings if we do not already have this
// information.
//
if ( connection->ClientOSType.Buffer == NULL) {
//
// Calculate the size of the client LAN Man type and OS type
// strings. and allocate a buffer large enough to store
// them all.
//
if ( connection->SmbDialect <= SmbDialectNtLanMan ) {
length = (USHORT)( (PUCHAR)&ntRequest->ByteCount +
sizeof( USHORT ) +
SmbGetUshort( &ntRequest->ByteCount ) -
smbInformation);
} else {
length = (USHORT)( (PUCHAR)&request->ByteCount +
sizeof( USHORT ) +
SmbGetUshort( &request->ByteCount ) -
smbInformation);
}
//
// If the SMB buffer is ANSI, adjust the size of the buffer we
// are allocating to Unicode size.
//
if ( !isUnicode ) {
length *= sizeof( WCHAR );
}
infoBuffer = ALLOCATE_NONPAGED_POOL( length, BlockTypeDataBuffer );
if ( infoBuffer == NULL ) {
status = STATUS_INSUFF_SERVER_RESOURCES;
goto error_exit;
}
connection->ClientOSType.Buffer = (PWCH)infoBuffer;
//
// Copy the client OS type to the new buffer.
//
length = SrvGetString(
&connection->ClientOSType,
smbInformation,
END_OF_REQUEST_SMB( WorkContext ),
isUnicode
);
if ( length == (USHORT)-1) {
DEALLOCATE_NONPAGED_POOL( infoBuffer );
status = STATUS_INVALID_SMB;
goto error_exit;
}
smbInformation += length;
connection->ClientLanManType.Buffer = (PWCH)(
(PCHAR)connection->ClientOSType.Buffer +
connection->ClientOSType.MaximumLength);
//
// Copy the client LAN Manager type to the new buffer.
//
length = SrvGetString(
&connection->ClientLanManType,
smbInformation,
END_OF_REQUEST_SMB( WorkContext ),
isUnicode
);
if ( length == (USHORT)-1) {
DEALLOCATE_NONPAGED_POOL( infoBuffer );
status = STATUS_INVALID_SMB;
goto error_exit;
}
}
} else {
domainString.Length = 0;
}
//
// Allocate a Session block.
//
SrvAllocateSession( &session, &nameString, &domainString );
if ( !isUnicode && domainString.Buffer != NULL ) {
RtlFreeUnicodeString( &domainString );
domainString.Buffer = NULL;
}
if ( session == NULL ) {
//
// Unable to allocate a Session block. Return an error status.
//
status = STATUS_INSUFF_SERVER_RESOURCES;
goto error_exit;
}
//
// If using uppercase pathnames, indicate in the session block. DOS
// always uses uppercase paths.
//
if ( (WorkContext->RequestHeader->Flags &
SMB_FLAGS_CANONICALIZED_PATHS) != 0 ||
IS_DOS_DIALECT( connection->SmbDialect ) ) {
session->UsingUppercasePaths = TRUE;
} else {
session->UsingUppercasePaths = FALSE;
}
//
// Enter data from request SMB into the session block. If MaxMpx is 1
// disable oplocks on this connection.
//
endpoint = connection->Endpoint;
if ( endpoint->IsConnectionless ) {
ULONG adapterNumber;
//
// Our session max buffer size is the smaller of the
// client buffer size and the ipx transport
// indicated max packet size.
//
adapterNumber =
WorkContext->ClientAddress->DatagramOptions.LocalTarget.NicId;
session->MaxBufferSize =
(USHORT)GetIpxMaxBufferSize(
endpoint,
adapterNumber,
(ULONG)SmbGetUshort(&request->MaxBufferSize)
);
} else {
session->MaxBufferSize = SmbGetUshort( &request->MaxBufferSize );
}
session->MaxMpxCount = SmbGetUshort( &request->MaxMpxCount );
if ( session->MaxMpxCount < 2 ) {
connection->OplocksAlwaysDisabled = TRUE;
}
//
// Ready to validate the credentials. We have either a Kerberos
// ticket, or something alleging to be a Kerberos ticket, or we
// have Lanman-style credentials. Check which and call the proper
// routine.
//
#ifdef CAP_KERBEROS_BLOB
if (SrvHaveKerberos) {
IsKerb =
(connection->ClientCapabilities & (CAP_NT_SMBS | CAP_KERBEROS_BLOB)) ==
(CAP_NT_SMBS | CAP_KERBEROS_BLOB);
} else
#endif
{
IsKerb = FALSE;
}
if(IsKerb)
{
//
// Kerberos it is
//
status = SrvValidateBlob( // We have a Kerberos Blob
session,
connection,
&nameString,
caseSensitivePassword, // Where the blob is
&caseSensitivePasswordLength);
if(byteCount = (USHORT)caseSensitivePasswordLength)
{
//
// Have something to return. Stick it in
//
RtlCopyMemory(response->Buffer,
caseSensitivePassword,
caseSensitivePasswordLength);
SmbPutUshort( &response->ByteCount, byteCount );
if(!NT_SUCCESS(status))
{
goto error_exit;
}
}
}
else
{
byteCount = 0;
status = SrvValidateUser(
&session->UserHandle,
session,
connection,
&nameString,
caseInsensitivePassword,
caseInsensitivePasswordLength,
caseSensitivePassword,
caseSensitivePasswordLength,
&action
);
}
if ( !isUnicode ) {
RtlFreeUnicodeString( &nameString );
nameString.Buffer = NULL;
}
//
// If a bad name/password combination was sent, return an error.
//
if ( !NT_SUCCESS(status) ) {
IF_DEBUG(ERRORS) {
SrvPrint0( "BlockingSessionSetupAndX: Bad user/password "
"combination.\n" );
}
SrvStatistics.LogonErrors++;
goto error_exit;
}
IF_SMB_DEBUG(ADMIN1) {
SrvPrint1( "Validated user: %s\n", userName );
}
//
// If the client thinks that it is the first user on this
// connection, get rid of other connections (may be due to rebooting
// of client). Also get rid of other sessions on this connection
// with the same user name--this handles a DOS "weirdness" where
// it sends multiple session setups if a tree connect fails.
//
// *** If VcNumber is non-zero, we do nothing special. This is the
// case even though the SrvMaxVcNumber configurable variable
// should always be equal to one. If a second VC is established
// between machines, a new session must also be established.
// This duplicates the LM 2.0 server's behavior.
//
if ( SmbGetUshort( &request->VcNumber ) == 0 ) {
SrvCloseConnectionsFromClient( connection );
SrvCloseSessionsOnConnection( connection, &session->UserName );
}
//
// Making a new session visible is a multiple-step operation. It
// must be inserted in the global ordered tree connect list and the
// containing connection's session table, and the connection must be
// referenced. We need to make these operations appear atomic, so
// that the session cannot be accessed elsewhere before we're done
// setting it up. In order to do this, we hold all necessary locks
// the entire time we're doing the operations. The first operation
// is protected by the global ordered list lock
// (SrvOrderedListLock), while the other operations are protected by
// the per-connection lock. We take out the ordered list lock
// first, then the connection lock. This ordering is required by
// lock levels (see lock.h).
//
ASSERT( SrvSessionList.Lock == &SrvOrderedListLock );
ACQUIRE_LOCK( SrvSessionList.Lock );
ACQUIRE_LOCK( &connection->Lock );
locksHeld = TRUE;
//
// Ready to try to find a UID for the session. Check to see if the
// connection is being closed, and if so, terminate this operation.
//
if ( GET_BLOCK_STATE(connection) != BlockStateActive ) {
IF_DEBUG(ERRORS) {
SrvPrint0( "BlockingSessionSetupAndX: Connection closing\n" );
}
status = STATUS_INVALID_PARAMETER;
goto error_exit;
}
//
// If this client speaks a dialect above LM 1.0, find a UID that can
// be used for this session. Otherwise, just use location 0 of the
// table because those clients will not send a UID in SMBs and they
// can have only one session.
//
if ( connection->SmbDialect < SmbDialectLanMan10 ) {
if ( pagedConnection->SessionTable.FirstFreeEntry == -1
&&
SrvGrowTable(
&pagedConnection->SessionTable,
SrvInitialSessionTableSize,
SrvMaxSessionTableSize ) == FALSE
) {
//
// No free entries in the user table. Reject the request.
//
IF_DEBUG(ERRORS) {
SrvPrint0( "BlockingSessionSetupAndX: No more UIDs available.\n" );
}
SrvLogTableFullError( SRV_TABLE_SESSION );
status = STATUS_SMB_TOO_MANY_UIDS;
goto error_exit;
}
uidIndex = pagedConnection->SessionTable.FirstFreeEntry;
} else { // if ( dialect < SmbDialectLanMan10 )
//
// If this client already has a session at this server, abort.
// The session should have been closed by the call to
// SrvCloseSessionsOnConnection above. (We could try to work
// around the existence of the session by closing it, but that
// would involve releasing the locks, closing the session, and
// retrying. This case shouldn't happen.)
//
if ( pagedConnection->SessionTable.Table[0].Owner != NULL ) {
IF_DEBUG(ERRORS) {
SrvPrint0( "BlockingSessionSetupAndX: Core client already "
"has session.\n" );
}
status = STATUS_SMB_TOO_MANY_UIDS;
goto error_exit;
}
//
// Use location 0 of the session table.
//
IF_SMB_DEBUG(ADMIN2) {
SrvPrint0( "Client LM 1.0 or before--using location 0 of session "
"table.\n" );
}
uidIndex = 0;
}
//
// Remove the UID slot from the free list and set its owner and
// sequence number. Create a UID for the session. Increment count
// of sessions.
//
entry = &pagedConnection->SessionTable.Table[uidIndex];
pagedConnection->SessionTable.FirstFreeEntry = entry->NextFreeEntry;
DEBUG entry->NextFreeEntry = -2;
if ( pagedConnection->SessionTable.LastFreeEntry == uidIndex ) {
pagedConnection->SessionTable.LastFreeEntry = -1;
}
INCREMENT_UID_SEQUENCE( entry->SequenceNumber );
if ( uidIndex == 0 && entry->SequenceNumber == 0 ) {
INCREMENT_UID_SEQUENCE( entry->SequenceNumber );
}
session->Uid = MAKE_UID( uidIndex, entry->SequenceNumber );
entry->Owner = session;
pagedConnection->CurrentNumberOfSessions++;
IF_SMB_DEBUG(ADMIN1) {
SrvPrint2( "Found UID. Index = 0x%lx, sequence = 0x%lx\n",
UID_INDEX( session->Uid ),
UID_SEQUENCE( session->Uid ) );
}
//
// Insert the session on the global session list.
//
SrvInsertEntryOrderedList( &SrvSessionList, session );
//
// Reference the connection block to account for the new session.
//
SrvReferenceConnection( connection );
session->Connection = connection;
RELEASE_LOCK( &connection->Lock );
RELEASE_LOCK( SrvSessionList.Lock );
//
// Session successfully created. Insert the session in the global
// list of active sessions. Remember its address in the work
// context block.
//
// *** Note that the reference count on the session block is
// initially set to 2, to allow for the active status on the
// block and the pointer that we're maintaining. In other
// words, this is a referenced pointer, and the pointer must be
// dereferenced when processing of this SMB is complete.
//
WorkContext->Session = session;
//
// Build response SMB, making sure to save request fields first in
// case the response overwrites the request. Save the
// newly-assigned UID in both the request SMB and the response SMB
// so that subsequent command processors and the client,
// respectively, can see it.
//
nextCommand = request->AndXCommand;
reqAndXOffset = SmbGetUshort( &request->AndXOffset );
SmbPutAlignedUshort( &WorkContext->RequestHeader->Uid, session->Uid );
SmbPutAlignedUshort( &WorkContext->ResponseHeader->Uid, session->Uid );
response->WordCount = 3;
response->AndXCommand = nextCommand;
response->AndXReserved = 0;
//
// If appropriate, append the Native OS and Native LAN Man strings
// to the response.
//
if (!IsKerb && (connection->SmbDialect <= SmbDialectDosLanMan21) )
{
ULONG stringLength;
if ( isUnicode ) {
PWCH buffer = ALIGN_SMB_WSTR( response->Buffer );
byteCount = (USHORT)(SrvNativeOS.Length + sizeof(UNICODE_NULL));
RtlCopyMemory(
buffer,
SrvNativeOS.Buffer,
byteCount
);
stringLength = SrvNativeLanMan.Length + sizeof(UNICODE_NULL);
RtlCopyMemory(
(PCHAR)buffer + byteCount,
SrvNativeLanMan.Buffer,
stringLength
);
byteCount += (USHORT)stringLength;
} else {
byteCount = SrvOemNativeOS.Length + sizeof(CHAR);
RtlCopyMemory(
response->Buffer,
SrvOemNativeOS.Buffer,
byteCount
);
stringLength = SrvOemNativeLanMan.Length + sizeof(CHAR);
RtlCopyMemory(
(PVOID) (response->Buffer + byteCount),
SrvOemNativeLanMan.Buffer,
stringLength
);
byteCount += (USHORT)stringLength;
}
if ( connection->SmbDialect <= SmbDialectNtLanMan ) {
if ( isUnicode ) {
PWCH buffer = ALIGN_SMB_WSTR( response->Buffer + byteCount );
stringLength = endpoint->DomainName.Length + sizeof(UNICODE_NULL);
RtlCopyMemory(
buffer,
endpoint->DomainName.Buffer,
stringLength
);
byteCount = (USHORT)(((PCHAR)buffer - response->Buffer) +
stringLength);
} else {
stringLength = endpoint->OemDomainName.Length + sizeof(CHAR);
RtlCopyMemory(
(PVOID) (response->Buffer + byteCount),
endpoint->OemDomainName.Buffer,
stringLength
);
byteCount += (USHORT)stringLength;
}
}
}
SmbPutUshort( &response->AndXOffset, GET_ANDX_OFFSET(
WorkContext->ResponseHeader,
WorkContext->ResponseParameters,
RESP_SESSION_SETUP_ANDX,
byteCount
) );
//
// Normally, turning on bit 0 of Action indicates that the user was
// logged on as GUEST. However, NT does not have automatic guest
// logon--a user ID and password are required for every single logon
// (though the password may have null length). Therefore, the
// server need not concern itself with what kind of account the
// client gets.
//
// Bit 1 tells the client that the user was logged on
// using the lm session key instead of the user session key.
//
SmbPutUshort( &response->Action, action );
SmbPutUshort( &response->ByteCount, byteCount );
WorkContext->ResponseParameters = (PCHAR)WorkContext->ResponseHeader +
SmbGetUshort( &response->AndXOffset );
//
// Test for legal followon command.
//
switch ( nextCommand ) {
case SMB_COM_TREE_CONNECT_ANDX:
case SMB_COM_OPEN:
case SMB_COM_OPEN_ANDX:
case SMB_COM_CREATE:
case SMB_COM_CREATE_NEW:
case SMB_COM_CREATE_DIRECTORY:
case SMB_COM_DELETE:
case SMB_COM_DELETE_DIRECTORY:
case SMB_COM_FIND:
case SMB_COM_FIND_UNIQUE:
case SMB_COM_COPY:
case SMB_COM_RENAME:
case SMB_COM_NT_RENAME:
case SMB_COM_CHECK_DIRECTORY:
case SMB_COM_QUERY_INFORMATION:
case SMB_COM_SET_INFORMATION:
case SMB_COM_QUERY_INFORMATION_SRV:
case SMB_COM_OPEN_PRINT_FILE:
case SMB_COM_GET_PRINT_QUEUE:
case SMB_COM_TRANSACTION:
case SMB_COM_NO_ANDX_COMMAND:
break;
default: // Illegal followon command
IF_DEBUG(SMB_ERRORS) {
SrvPrint1( "BlockingSessionSetupAndX: Illegal followon command: "
"0x%lx\n", nextCommand );
}
status = STATUS_INVALID_SMB;
goto error_exit1;
}
//
// If there is an AndX command, set up to process it. Otherwise,
// indicate completion to the caller.
//
if ( nextCommand != SMB_COM_NO_ANDX_COMMAND ) {
WorkContext->NextCommand = nextCommand;
WorkContext->RequestParameters = (PCHAR)WorkContext->RequestHeader +
reqAndXOffset;
SrvProcessSmb( WorkContext );
return;
}
IF_DEBUG(TRACE2) SrvPrint0( "BlockingSessionSetupAndX complete.\n" );
goto normal_exit;
error_exit:
if ( locksHeld ) {
RELEASE_LOCK( &connection->Lock );
RELEASE_LOCK( SrvSessionList.Lock );
}
if ( session != NULL ) {
SrvFreeSession( session );
}
if ( !isUnicode ) {
if ( domainString.Buffer != NULL ) {
RtlFreeUnicodeString( &domainString );
}
if ( nameString.Buffer != NULL ) {
RtlFreeUnicodeString( &nameString );
}
}
error_exit1:
SrvSetSmbError( WorkContext, status );
normal_exit:
SrvEndSmbProcessing( WorkContext, SmbStatusSendResponse );
return;
} // BlockingSessionSetupAndX
SMB_TRANS_STATUS
SrvSmbSessionSetup (
IN OUT PWORK_CONTEXT WorkContext
)
/*++
Routine Description:
Processes a session setup in a Trans2 SMB.
Arguments:
WorkContext - Supplies the address of a Work Context Block
describing the current request. See smbtypes.h for a more
complete description of the valid fields.
Return Value:
SMB_TRANS_STATUS - Indicates whether an error occurred. See
smbtypes.h for a more complete description.
--*/
{
PAGED_CODE();
//
// This SMB must be processed in a blocking thread.
//
WorkContext->FspRestartRoutine = BlockingSessionSetup;
SrvQueueWorkToBlockingThread( WorkContext );
return SmbTransStatusInProgress;
} // SrvSmbSessionSetup
VOID SRVFASTCALL
BlockingSessionSetup (
IN OUT PWORK_CONTEXT WorkContext
)
/*++
Routine Description:
Processes a session setup in a Trans2 SMB.
Arguments:
WorkContext - Supplies the address of a Work Context Block
describing the current request. See smbtypes.h for a more
complete description of the valid fields.
Return Value:
SMB_TRANS_STATUS - Indicates whether an error occurred. See
smbtypes.h for a more complete description.
--*/
{
//
// The OS/2 redirector never sends a remote FS control request.
// If we get one, simply reply that we cannot handle it.
//
NTSTATUS status;
PSESSION session = NULL;
PTABLE_ENTRY entry;
SHORT uidIndex;
PREQ_CAIRO_TRANS2_SESSION_SETUP request;
PRESP_CAIRO_TRANS2_SESSION_SETUP response;
PCONNECTION connection;
PPAGED_CONNECTION pagedConnection;
PTRANSACTION transaction;
PCHAR Blob;
CLONG BlobLength;
PSZ userName;
UNICODE_STRING nameString;
UNICODE_STRING domainString;
USHORT nameLength;
ULONG capabilities;
BOOLEAN locksHeld = FALSE;
USHORT SessId;
PAGED_CODE();
nameString.Buffer = NULL;
nameString.Length = 0;
nameString.MaximumLength = 0;
domainString.Buffer = NULL;
domainString.Length = 0;
domainString.MaximumLength = 0;
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint0( "SrvSmbSessionSetup\n");
}
transaction = WorkContext->Parameters.Transaction;
request = (PREQ_CAIRO_TRANS2_SESSION_SETUP)transaction->InData;
response = (PRESP_CAIRO_TRANS2_SESSION_SETUP)transaction->OutData;
connection = WorkContext->Connection;
pagedConnection = connection->PagedConnection;
//
// Verify that enough parameter bytes were sent and that we're allowed
// to return enough parameter bytes.
//
if ( (transaction->DataCount < sizeof(REQ_CAIRO_TRANS2_SESSION_SETUP)) ||
(transaction->MaxDataCount < sizeof(RESP_CAIRO_TRANS2_SESSION_SETUP)) ) {
//
// Not enough parameter bytes were sent.
//
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint2( "SrvSmbSessionSetup: bad InData byte counts: "
"%ld %ld\n",
transaction->DataCount,
transaction->MaxDataCount );
}
SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
SrvCompleteExecuteTransaction( WorkContext, SmbTransStatusErrorWithoutData );
return;
}
//
// Convert the client name to unicode
//
if ( pagedConnection->ClientMachineNameString.Length == 0 ) {
UNICODE_STRING clientMachineName;
clientMachineName.Buffer = pagedConnection->ClientMachineName;
clientMachineName.MaximumLength =
(USHORT)(COMPUTER_NAME_LENGTH+1)*sizeof(WCHAR);
(VOID)RtlOemStringToUnicodeString(
&clientMachineName,
&connection->OemClientMachineNameString,
FALSE
);
//
// Add the double backslashes to the length
//
pagedConnection->ClientMachineNameString.Length =
(USHORT)(clientMachineName.Length + 2*sizeof(WCHAR));
}
//
// get the capabilities of the client
//
ASSERT(connection->SmbDialect <= SmbDialectNtLanMan);
connection->ClientCapabilities =
SmbGetUlong( &request->Capabilities ) &
( CAP_UNICODE |
CAP_LARGE_FILES |
CAP_NT_SMBS |
CAP_NT_FIND |
CAP_NT_STATUS |
CAP_LEVEL_II_OPLOCKS );
if ( connection->ClientCapabilities & CAP_NT_SMBS ) {
connection->ClientCapabilities |= CAP_NT_FIND;
}
//
// now get the blob, and its length ( I guess I never really thought
// a blob would have a length )
//
BlobLength = request->BufferLength;
Blob = request->Buffer;
//
// get the username, which right now comes right after the Kerberos blob
//
userName = request->Buffer+request->BufferLength;
if ( SMB_IS_UNICODE( WorkContext ) ) {
userName = ALIGN_SMB_WSTR( userName );
}
nameLength = SrvGetStringLength(
userName,
transaction->InData + transaction->DataCount,
SMB_IS_UNICODE( WorkContext ),
FALSE
);
if ( nameLength == (USHORT)-1 ) {
status = STATUS_INVALID_SMB;
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint0( "SESSSETUP -- namelength == -1\n");
}
goto error_exit;
}
status = SrvMakeUnicodeString(
SMB_IS_UNICODE( WorkContext ),
&nameString,
userName,
&nameLength );
if ( !NT_SUCCESS( status ) ) {
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint1( "SESSSETUP -- failed making unicode string for name, %lC\n",status);
}
goto error_exit;
}
//
// Allocate a Session block.
//
SrvAllocateSession( &session, &nameString, &domainString );
if ( !SMB_IS_UNICODE( WorkContext ) && domainString.Buffer != NULL ) {
RtlFreeUnicodeString( &domainString );
domainString.Buffer = NULL;
}
if ( session == NULL ) {
//
// Unable to allocate a Session block. Return an error status.
//
status = STATUS_INSUFFICIENT_RESOURCES;
goto error_exit;
}
//
// If using uppercase pathnames, indicate in the session block. DOS
// always uses uppercase paths.
//
if ( (WorkContext->RequestHeader->Flags &
SMB_FLAGS_CANONICALIZED_PATHS) != 0 ||
IS_DOS_DIALECT( connection->SmbDialect ) ) {
session->UsingUppercasePaths = TRUE;
} else {
session->UsingUppercasePaths = FALSE;
}
//
// set the pointer in the transaction to the session
//
transaction->Session = session;
//
// Enter data from request SMB into the session block.
//
session->MaxBufferSize = SmbGetUshort( &request->MaxBufferSize );
//
// Try to find legitimate name/password combination.
//
// ASM
// There are a couple of special cases we test for, both
// related to the CAIRO dialect. Under this dialect, the
// SessionSetup can be using either Kerberos authentication
// or LM authentication. Eventually, Kerberos authentication will
// use a TRANSACT message do disambiguate the cases, but for
// now, we need to look at this message to tell the difference.
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint0( "SESSSETUP -- going to validate the blob\n");
}
status = SrvValidateBlob( // We have a Kerberos Blob
session,
connection,
&nameString,
Blob, // Where the blob is
&BlobLength
);
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint1( "SESSSETUP -- blob validated, %lC\n",status);
}
//
// free if unused the unicode namestring buffer
//
if ( !SMB_IS_UNICODE( WorkContext ) ) {
RtlFreeUnicodeString( &nameString );
nameString.Buffer = NULL;
}
if(NT_SUCCESS(status)
||
BlobLength)
{
if(!NT_SUCCESS(status))
{
transaction->cMaxBufferSize = (CLONG)session->MaxBufferSize;
session->Connection = 0;
SessId = 0;
}
else
{
//
// If the client thinks that it is the first user on this
// connection, get rid of other connections (may be due to rebooting
// of client). Also get rid of other sessions on this connection
// with the same user name--this handles a DOS "weirdness" where
// it sends multiple session setups if a tree connect fails.
//
// *** If VcNumber is non-zero, we do nothing special. This is the
// case even though the SrvMaxVcNumber configurable variable
// should always be equal to one. If a second VC is established
// between machines, a new session must also be established.
// This duplicates the LM 2.0 server's behavior.
//
if ( SmbGetUshort( &request->VcNumber ) == 0 ) {
SrvCloseConnectionsFromClient( connection );
SrvCloseSessionsOnConnection( connection, &session->UserName );
}
//
// Making a new session visible is a multiple-step operation. It
// must be inserted in the global ordered tree connect list and the
// containing connection's session table, and the connection must be
// referenced. We need to make these operations appear atomic, so
// that the session cannot be accessed elsewhere before we're done
// setting it up. In order to do this, we hold all necessary locks
// the entire time we're doing the operations. The first operation
// is protected by the global ordered list lock
// (SrvOrderedListLock), while the other operations are protected by
// the per-connection lock. We take out the ordered list lock
// first, then the connection lock. This ordering is required by
// lock levels (see lock.h).
//
ASSERT( SrvSessionList.Lock == &SrvOrderedListLock );
ACQUIRE_LOCK( SrvSessionList.Lock );
ACQUIRE_LOCK( &connection->Lock );
locksHeld = TRUE;
//
// Ready to try to find a UID for the session. Check to see if the
// connection is being closed, and if so, terminate this operation.
//
if ( GET_BLOCK_STATE(connection) != BlockStateActive ) {
IF_DEBUG(ERRORS) {
SrvPrint0( "SrvSmbSessionSetupAndX: Connection closing\n" );
}
status = STATUS_INVALID_PARAMETER;
goto error_exit;
}
//
// If this client speaks a dialect above LM 1.0, find a UID that can
// be used for this session. Otherwise, just use location 0 of the
// table because those clients will not send a UID in SMBs and they
// can have only one session.
//
if ( pagedConnection->SessionTable.FirstFreeEntry == -1
&&
SrvGrowTable(
&pagedConnection->SessionTable,
SrvInitialSessionTableSize,
SrvMaxSessionTableSize ) == FALSE
) {
//
// No free entries in the user table. Reject the request.
//
IF_DEBUG(ERRORS) {
SrvPrint0( "SrvSmbSessionSetup: No more UIDs available.\n" );
}
status = STATUS_SMB_TOO_MANY_UIDS;
goto error_exit;
}
uidIndex = pagedConnection->SessionTable.FirstFreeEntry;
//
// Remove the UID slot from the free list and set its owner and
// sequence number. Create a UID for the session. Increment count
// of sessions.
//
entry = &pagedConnection->SessionTable.Table[uidIndex];
pagedConnection->SessionTable.FirstFreeEntry = entry->NextFreeEntry;
DEBUG entry->NextFreeEntry = -2;
if ( pagedConnection->SessionTable.LastFreeEntry == uidIndex ) {
pagedConnection->SessionTable.LastFreeEntry = -1;
}
INCREMENT_UID_SEQUENCE( entry->SequenceNumber );
session->Uid = MAKE_UID( uidIndex, entry->SequenceNumber );
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint1( "SESSSETUP -- made uid %x\n",session->Uid);
}
entry->Owner = session;
pagedConnection->CurrentNumberOfSessions++;
IF_SMB_DEBUG(ADMIN1) {
SrvPrint2( "Found UID. Index = 0x%lx, sequence = 0x%lx\n",
UID_INDEX( session->Uid ),
UID_SEQUENCE( session->Uid ) );
}
//
// Insert the session on the global session list.
//
SrvInsertEntryOrderedList( &SrvSessionList, session );
//
// Reference the connection block to account for the new session.
//
SrvReferenceConnection( connection );
session->Connection = connection;
RELEASE_LOCK( &connection->Lock );
RELEASE_LOCK( SrvSessionList.Lock );
//
// Session successfully created. Insert the session in the global
// list of active sessions. Remember its address in the work
// context block.
//
// *** Note that the reference count on the session block is
// initially set to 2, to allow for the active status on the
// block and the pointer that we're maintaining. In other
// words, this is a referenced pointer, and the pointer must be
// dereferenced when processing of this SMB is complete.
//
// It seems that perhaps we need another reference since we are
// doing this using a trans2 instead of a sessionsetup
//
SrvReferenceSession( session );
WorkContext->Session = session;
SessId = session->Uid;
}
status = S_OK;
}
else
{
//
// it failed
//
IF_DEBUG(ERRORS) {
SrvPrint0( "SrvSmbSessionSetupAndX: Bad user/password "
"combination.\n" );
}
SrvStatistics.LogonErrors++;
goto error_exit;
}
//
// Build response SMB, making sure to save request fields first in
// case the response overwrites the request. Save the
// newly-assigned UID in both the request SMB and the response SMB
// so that subsequent command processors and the client,
// respectively, can see it.
//
SmbPutAlignedUshort( &WorkContext->RequestHeader->Uid, SessId );
SmbPutAlignedUshort( &WorkContext->ResponseHeader->Uid, SessId );
SmbPutUshort( &response->Uid, SessId);
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint1( "SESSSETUP -- put uid for rdr = %x\n",response->Uid);
}
response->WordCount = 0;
//
// If appropriate, append the Native OS and Native LAN Man strings
// to the response.
//
RtlCopyMemory( response->Buffer,
Blob,
BlobLength );
//
// Normally, turning on bit 0 of Action indicates that the user was
// logged on as GUEST. However, NT does not have automatic guest
// logon--a user ID and password are required for every single logon
// (though the password may have null length). Therefore, the
// server need not concern itself with what kind of account the
// client gets.
//
SmbPutUlong( &response->BufferLength, BlobLength );
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint0( "SESSSETUP -- all done\n");
}
SrvCompleteExecuteTransaction( WorkContext, SmbTransStatusSuccess );
return;
error_exit:
if ( locksHeld ) {
RELEASE_LOCK( &connection->Lock );
RELEASE_LOCK( SrvSessionList.Lock );
}
if ( session != NULL ) {
// !!! Need to close token handle!
transaction->Session = NULL;
SrvFreeSession( session );
}
if ( domainString.Buffer != NULL && !SMB_IS_UNICODE(WorkContext) ) {
RtlFreeUnicodeString( &domainString );
}
if ( nameString.Buffer != NULL && !SMB_IS_UNICODE(WorkContext) ) {
RtlFreeUnicodeString( &nameString );
}
IF_SMB_DEBUG(TRANSACTION1) {
SrvPrint1( "SESSSETUP -- all done, status = %lC\n",status);
}
SrvSetSmbError( WorkContext, status );
SrvCompleteExecuteTransaction( WorkContext, SmbTransStatusErrorWithoutData );
return;
} // BlockingSessionSetup
SMB_PROCESSOR_RETURN_TYPE
SrvSmbLogoffAndX (
SMB_PROCESSOR_PARAMETERS
)
/*++
Routine Description:
Processes a Logoff and X SMB.
Arguments:
SMB_PROCESSOR_PARAMETERS - See smbprocs.h for a description
of the parameters to SMB processor routines.
Return Value:
SMB_PROCESSOR_RETURN_TYPE - See smbprocs.h
--*/
{
PREQ_LOGOFF_ANDX request;
PRESP_LOGOFF_ANDX response;
PSESSION session;
USHORT reqAndXOffset;
UCHAR nextCommand;
PAGED_CODE( );
IF_SMB_DEBUG(ADMIN1) {
SrvPrint2( "Logoff request header at 0x%lx, "
"response header at 0x%lx\n",
WorkContext->RequestHeader, WorkContext->ResponseHeader );
SrvPrint2( "Logoff request parameters at 0x%lx, "
"response parameters at 0x%lx\n",
WorkContext->RequestParameters,
WorkContext->ResponseParameters );
}
//
// Set up parameters.
//
request = (PREQ_LOGOFF_ANDX)(WorkContext->RequestParameters);
response = (PRESP_LOGOFF_ANDX)(WorkContext->ResponseParameters);
//
// If a session block has not already been assigned to the current
// work context, verify the UID. If verified, the address of the
// session block corresponding to this user is stored in the
// WorkContext block and the session block is referenced.
//
session = SrvVerifyUid(
WorkContext,
SmbGetAlignedUshort( &WorkContext->RequestHeader->Uid )
);
if ( session == NULL ) {
IF_DEBUG(SMB_ERRORS) {
SrvPrint1( "SrvSmbLogoffAndX: Invalid UID: 0x%lx\n",
SmbGetAlignedUshort( &WorkContext->RequestHeader->Uid ) );
}
SrvSetSmbError( WorkContext, STATUS_SMB_BAD_UID );
return SmbStatusSendResponse;
}
//
// If we need to visit the license server, get over to a blocking
// thread to ensure that we don't consume the nonblocking threads
//
if( WorkContext->UsingBlockingThread == 0 &&
session->IsLSNotified == TRUE ) {
//
// Insert the work item at the tail of the blocking work queue
//
SrvInsertWorkQueueTail(
&SrvBlockingWorkQueue,
(PQUEUEABLE_BLOCK_HEADER)WorkContext
);
return SmbStatusInProgress;
}
//
// Do the actual logoff.
//
SrvCloseSession( session );
SrvStatistics.SessionsLoggedOff++;
//
// Dereference the session, since it's no longer valid, but we may
// end up processing a chained command. Clear the session pointer
// in the work context block to indicate that we've done this.
//
SrvDereferenceSession( session );
WorkContext->Session = NULL;
//
// Build the response SMB, making sure to save request fields first
// in case the response overwrites the request.
//
reqAndXOffset = SmbGetUshort( &request->AndXOffset );
nextCommand = request->AndXCommand;
response->WordCount = 2;
response->AndXCommand = request->AndXCommand;
response->AndXReserved = 0;
SmbPutUshort( &response->AndXOffset, GET_ANDX_OFFSET(
WorkContext->ResponseHeader,
WorkContext->ResponseParameters,
RESP_LOGOFF_ANDX,
0
) );
SmbPutUshort( &response->ByteCount, 0 );
WorkContext->ResponseParameters = (PCHAR)WorkContext->ResponseHeader +
SmbGetUshort( &response->AndXOffset );
//
// Test for legal followon command.
//
switch ( nextCommand ) {
case SMB_COM_SESSION_SETUP_ANDX:
case SMB_COM_NO_ANDX_COMMAND:
break;
default:
IF_DEBUG(SMB_ERRORS) {
SrvPrint1( "SrvSmbLogoffAndX: Illegal followon command: 0x%lx\n",
nextCommand );
}
SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
return SmbStatusSendResponse;
}
//
// If there is an AndX command, set up to process it. Otherwise,
// indicate completion to the caller.
//
if ( nextCommand != SMB_COM_NO_ANDX_COMMAND ) {
WorkContext->NextCommand = nextCommand;
WorkContext->RequestParameters = (PCHAR)WorkContext->RequestHeader +
reqAndXOffset;
return SmbStatusMoreCommands;
}
IF_DEBUG(TRACE2) SrvPrint0( "SrvSmbLogoffAndX complete.\n" );
return SmbStatusSendResponse;
} // SrvSmbLogoffAndX
STATIC
VOID
GetEncryptionKey (
OUT CHAR EncryptionKey[MSV1_0_CHALLENGE_LENGTH]
)
/*++
Routine Description:
Creates an encryption key to use as a challenge for a logon.
*** Although the MSV1_0 authentication package has a function that
returns an encryption key, we do not use that function in order
to avoid a trip through LPC and into LSA.
Arguments:
EncryptionKey - a pointer to a buffer which receives the encryption
key.
Return Value:
NTSTATUS - result of operation.
--*/
{
union {
LARGE_INTEGER time;
UCHAR bytes[8];
} u;
ULONG seed;
ULONG challenge[2];
ULONG result3;
//
// Create a pseudo-random 8-byte number by munging the system time
// for use as a random number seed.
//
// Start by getting the system time.
//
ASSERT( MSV1_0_CHALLENGE_LENGTH == 2 * sizeof(ULONG) );
KeQuerySystemTime( &u.time );
//
// To ensure that we don't use the same system time twice, add in the
// count of the number of times this routine has been called. Then
// increment the counter.
//
// *** Since we don't use the low byte of the system time (it doesn't
// take on enough different values, because of the timer
// resolution), we increment the counter by 0x100.
//
// *** We don't interlock the counter because we don't really care
// if it's not 100% accurate.
//
u.time.LowPart += EncryptionKeyCount;
EncryptionKeyCount += 0x100;
//
// Now use parts of the system time as a seed for the random
// number generator.
//
// *** Because the middle two bytes of the low part of the system
// time change most rapidly, we use those in forming the seed.
//
seed = ((u.bytes[1] + 1) << 0) |
((u.bytes[2] + 0) << 8) |
((u.bytes[2] - 1) << 16) |
((u.bytes[1] + 0) << 24);
//
// Now get two random numbers. RtlRandom does not return negative
// numbers, so we pseudo-randomly negate them.
//
challenge[0] = RtlRandom( &seed );
challenge[1] = RtlRandom( &seed );
result3 = RtlRandom( &seed );
if ( (result3 & 0x1) != 0 ) {
challenge[0] |= 0x80000000;
}
if ( (result3 & 0x2) != 0 ) {
challenge[1] |= 0x80000000;
}
//
// Return the challenge.
//
RtlCopyMemory( EncryptionKey, challenge, MSV1_0_CHALLENGE_LENGTH );
return;
#if 0
//
// This is the old code, which uses LSA to get the challenge.
//
PMSV1_0_LM20_CHALLENGE_REQUEST challengeRequest;
ULONG challengeRequestLength;
PMSV1_0_LM20_CHALLENGE_RESPONSE challengeResponse;
ULONG challengeResponseLength;
NTSTATUS protocolStatus;
NTSTATUS freeStatus;
NTSTATUS status;
PAGED_CODE( );
challengeRequest = NULL;
challengeRequestLength = sizeof(MSV1_0_LM20_CHALLENGE_REQUEST);
status = NtAllocateVirtualMemory(
NtCurrentProcess( ),
(PVOID *)&challengeRequest,
0,
&challengeRequestLength,
MEM_COMMIT,
PAGE_READWRITE
);
if ( !NT_SUCCESS(status) ) {
INTERNAL_ERROR(
ERROR_LEVEL_EXPECTED,
"GetEncryptionKey: NtAllocateVirtualMemory failed: %X\n.",
status,
NULL
);
SrvLogError(
SrvDeviceObject,
EVENT_SRV_NO_VIRTUAL_MEMORY,
status,
&challengeRequestLength,
sizeof(ULONG),
NULL,
0
);
return status;
}
challengeRequest->MessageType = MsV1_0Lm20ChallengeRequest;
//
// Get the "challenge" that clients will use to encrypt
// passwords. This challenge is used for all logons on this
// VC.
//
status = LsaCallAuthenticationPackage(
SrvLsaHandle,
SrvAuthenticationPackage,
challengeRequest,
challengeRequestLength,
(PVOID *)&challengeResponse,
&challengeResponseLength,
&protocolStatus
);
freeStatus = NtFreeVirtualMemory(
NtCurrentProcess( ),
(PVOID *)&challengeRequest,
&challengeRequestLength,
MEM_RELEASE
);
ASSERT( NT_SUCCESS(freeStatus) );
if ( NT_SUCCESS(status) ) {
status = protocolStatus;
}
if ( !NT_SUCCESS(status) ) {
INTERNAL_ERROR(
ERROR_LEVEL_UNEXPECTED,
"GetEncryptionKey: LsaCallAuthenticationPackage failed: %X\n.",
status,
NULL
);
SrvLogServiceFailure( SRV_SVC_LSA_CALL_AUTH_PACKAGE, status );
return status;
}
//
// Copy the challenge into the output buffer.
//
RtlCopyMemory(
EncryptionKey,
challengeResponse->ChallengeToClient,
MSV1_0_CHALLENGE_LENGTH
);
//
// Free the LSA response buffer.
//
status = LsaFreeReturnBuffer( challengeResponse );
ASSERT( NT_SUCCESS(status) );
return STATUS_SUCCESS;
#endif
} // GetEncryptionKey