Subversion Repositories planix.SVN

#include "headers.h"
#include <mp.h>
#include <libsec.h>

SmbProcessResult
smbcomsessionsetupandx(SmbSession *s, SmbHeader *h, uchar *pdata, SmbBuffer *b)
{
        uchar andxcommand;
        ushort andxoffset;
        ulong andxfixupoffset;
        ushort vcnumber;
        ulong sessionkey;
        ushort caseinsensitivepasswordlength;
        ushort casesensitivepasswordlength;
        ushort bytecountfixup, offset;
        uchar *mschapreply;
        AuthInfo *ai;
        char *sp;
        SmbProcessResult pr;
        char *accountname = nil;
        char *primarydomain = nil;
        char *nativeos = nil;
        char *nativelanman = nil;

        if (!smbcheckwordcount("comsessionsetupandx", h, 13)) {
        fmtfail:
                pr = SmbProcessResultFormat;
                goto done;
        }

        andxcommand = *pdata++;
        switch (andxcommand) {
        case SMB_COM_TREE_CONNECT_ANDX:
        case SMB_COM_OPEN_ANDX:
        case SMB_COM_CREATE_NEW:
        case SMB_COM_DELETE:
        case SMB_COM_FIND:
        case SMB_COM_COPY:
        case SMB_COM_NT_RENAME:
        case SMB_COM_QUERY_INFORMATION:
        case SMB_COM_NO_ANDX_COMMAND:
        case SMB_COM_OPEN:
        case SMB_COM_CREATE:
        case SMB_COM_CREATE_DIRECTORY:
        case SMB_COM_DELETE_DIRECTORY:
        case SMB_COM_FIND_UNIQUE:
        case SMB_COM_RENAME:
        case SMB_COM_CHECK_DIRECTORY:
        case SMB_COM_SET_INFORMATION:
        case SMB_COM_OPEN_PRINT_FILE:
                break;
        default:
                smblogprint(h->command, "smbcomsessionsetupandx: invalid andxcommand %s (0x%.2ux)\n",
                        smboptable[andxcommand].name, andxcommand);
                goto fmtfail;
        }
        pdata++;
        andxoffset = smbnhgets(pdata); pdata += 2;
        s->peerinfo.maxlen = smbnhgets(pdata); pdata += 2;
        smbresponseinit(s, s->peerinfo.maxlen);
        s->client.maxmpxcount = smbnhgets(pdata); pdata += 2;
        vcnumber = smbnhgets(pdata); pdata += 2;
        sessionkey = smbnhgetl(pdata); pdata += 4;
        caseinsensitivepasswordlength = smbnhgets(pdata); pdata += 2;
        casesensitivepasswordlength = smbnhgets(pdata); pdata += 2;
        pdata += 4;
        s->peerinfo.capabilities = smbnhgetl(pdata); /*pdata += 4;*/
smbloglock();
smblogprint(h->command, "andxcommand: %s offset %ud\n", smboptable[andxcommand].name, andxoffset);
smblogprint(h->command, "client.maxbuffersize: %ud\n", s->peerinfo.maxlen);
smblogprint(h->command, "client.maxmpxcount: %ud\n", s->client.maxmpxcount);
smblogprint(h->command, "vcnumber: %ud\n", vcnumber);
smblogprint(h->command, "sessionkey: 0x%.8lux\n", sessionkey);
smblogprint(h->command, "caseinsensitivepasswordlength: %ud\n", caseinsensitivepasswordlength);
smblogprint(h->command, "casesensitivepasswordlength: %ud\n", casesensitivepasswordlength);
smblogprint(h->command, "clientcapabilities: 0x%.8lux\n", s->peerinfo.capabilities);
smblogunlock();

        mschapreply = smbbufferreadpointer(b);

        if (!smbbuffergetbytes(b, nil, caseinsensitivepasswordlength + casesensitivepasswordlength)) {
                smblogprint(h->command, "smbcomsessionsetupandx: not enough bdata for passwords\n");
                goto fmtfail;
        }
        if (!smbbuffergetstring(b, h, 0, &accountname)
                || !smbbuffergetstring(b, h, 0, &primarydomain)
                || !smbbuffergetstring(b, h, 0, &nativeos)
                || !smbbuffergetstring(b, h, 0, &nativelanman)) {
                smblogprint(h->command, "smbcomsessionsetupandx: not enough bytes for strings\n");
                goto fmtfail;
        }

        for (sp = accountname; *sp; sp++)
                *sp = tolower(*sp);

smblogprint(h->command, "account: %s\n", accountname);
smblogprint(h->command, "primarydomain: %s\n", primarydomain);
smblogprint(h->command, "nativeos: %s\n", nativeos);
smblogprint(h->command, "nativelanman: %s\n", nativelanman);

        if (s->client.accountname && accountname[0] && strcmp(s->client.accountname, accountname) != 0) {
                smblogprint(h->command, "smbcomsessionsetupandx: more than one user on VC (before %s, now %s)\n",
                        s->client.accountname, accountname);
                smbseterror(s, ERRSRV, ERRtoomanyuids);
        errordone:
                pr = SmbProcessResultError;
                goto done;
        }

        if (s->client.accountname == nil) {
                /* first time */
                if (accountname[0] == 0) {
                        smbseterror(s, ERRSRV, ERRbaduid);
                        goto errordone;
                }
                if ((casesensitivepasswordlength != 24 || caseinsensitivepasswordlength != 24)) {
                        smblogprint(h->command,
                                "smbcomsessionsetupandx: case sensitive/insensitive password length not 24\n");
                        smbseterror(s, ERRSRV, ERRbadpw);
                        goto errordone;
                }
                memcpy(&s->client.mschapreply, mschapreply, sizeof(s->client.mschapreply));
                if(s->cs == nil){
                        smbseterror(s, ERRSRV, ERRerror);
                        goto errordone;
                }
                s->cs->user = accountname;
                s->cs->resp = &s->client.mschapreply;
                s->cs->nresp = sizeof(MSchapreply);
                ai = auth_response(s->cs);
                if (ai == nil) {
                        smblogprint(h->command, "authentication failed\n");
                        smbseterror(s, ERRSRV, ERRbadpw);
                        goto errordone;
                }
                smblogprint(h->command, "authentication succeeded\n");
                if (auth_chuid(ai, nil) < 0) {
                        smblogprint(h->command, "smbcomsessionsetupandx: chuid failed: %r\n");
                        auth_freeAI(ai);
                miscerror:
                        pr = SmbProcessResultMisc;
                        goto done;
                }
                auth_freeAI(ai);
                h->uid = 1;
                s->client.accountname = accountname;
                s->client.primarydomain = primarydomain;
                s->client.nativeos = nativeos;
                s->client.nativelanman = nativelanman;
                accountname = nil;
                primarydomain = nil;
                nativeos = nil;
                nativelanman = nil;
        }
        else {
                if (caseinsensitivepasswordlength == 24 && casesensitivepasswordlength == 24
                        && memcmp(&s->client.mschapreply, mschapreply, sizeof(MSchapreply)) != 0) {
                        smblogprint(h->command, "second time authentication failed\n");
                        smbseterror(s, ERRSRV, ERRbadpw);
                        goto errordone;
                }
        }

        /* CIFS says 4 with or without extended security, samba/ms says 3 without */
        h->wordcount = 3;
        if (!smbresponseputandxheader(s, h, andxcommand, &andxfixupoffset))
                goto miscerror;
        if (!smbresponseputs(s, 0))
                goto miscerror;
        bytecountfixup = smbresponseoffset(s);
        if (!smbresponseputs(s, 0))
                goto miscerror;
        if (!smbresponseputstring(s, 1, smbglobals.nativeos)
                || !smbresponseputstring(s, 1, smbglobals.serverinfo.nativelanman)
                || !smbresponseputstring(s, 1, smbglobals.primarydomain))
                goto miscerror;
        offset = smbresponseoffset(s);
        smbresponseoffsetputs(s, bytecountfixup, offset - bytecountfixup - 2);
        s->state = SmbSessionEstablished;
        if (andxcommand != SMB_COM_NO_ANDX_COMMAND)
                pr = smbchaincommand(s, h, andxfixupoffset, andxcommand, andxoffset, b);
        else
                pr = SmbProcessResultReply;
done:
        free(accountname);
        free(primarydomain);
        free(nativeos);
        free(nativelanman);
        return pr;
}