?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smb2_server: for performance reasons we use tevent_fd and readv/writev directly
[Samba.git] / source3 / smbd / smb2_server.c
blobf2703afe8a1999ff9c2ba8249efc0d194469a3b6
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "smbprofile.h"
29 #include "../lib/util/bitmap.h"
30 #include "../librpc/gen_ndr/krb5pac.h"
31 #include "auth.h"
32
33 static void smbd_smb2_connection_handler(struct tevent_context *ev,
34 struct tevent_fd *fde,
35 uint16_t flags,
36 void *private_data);
37 static NTSTATUS smbd_smb2_io_handler(struct smbd_server_connection *sconn,
38 uint16_t fde_flags);
39
40 #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)
41
42 static const struct smbd_smb2_dispatch_table {
43 uint16_t opcode;
44 const char *name;
45 bool need_session;
46 bool need_tcon;
47 bool as_root;
48 uint16_t fileid_ofs;
49 bool allow_invalid_fileid;
50 } smbd_smb2_table[] = {
51 #define _OP(o) .opcode = o, .name = #o
52 {
53 _OP(SMB2_OP_NEGPROT),
54 .as_root = true,
55 },{
56 _OP(SMB2_OP_SESSSETUP),
57 .as_root = true,
58 },{
59 _OP(SMB2_OP_LOGOFF),
60 .need_session = true,
61 .as_root = true,
62 },{
63 _OP(SMB2_OP_TCON),
64 .need_session = true,
65 /*
66 * This call needs to be run as root.
67 *
68 * smbd_smb2_request_process_tcon()
69 * calls make_connection_snum(), which will call
70 * change_to_user(), when needed.
71 */
72 .as_root = true,
73 },{
74 _OP(SMB2_OP_TDIS),
75 .need_session = true,
76 .need_tcon = true,
77 .as_root = true,
78 },{
79 _OP(SMB2_OP_CREATE),
80 .need_session = true,
81 .need_tcon = true,
82 },{
83 _OP(SMB2_OP_CLOSE),
84 .need_session = true,
85 .need_tcon = true,
86 .fileid_ofs = 0x08,
87 },{
88 _OP(SMB2_OP_FLUSH),
89 .need_session = true,
90 .need_tcon = true,
91 .fileid_ofs = 0x08,
92 },{
93 _OP(SMB2_OP_READ),
94 .need_session = true,
95 .need_tcon = true,
96 .fileid_ofs = 0x10,
97 },{
98 _OP(SMB2_OP_WRITE),
99 .need_session = true,
100 .need_tcon = true,
101 .fileid_ofs = 0x10,
102 },{
103 _OP(SMB2_OP_LOCK),
104 .need_session = true,
105 .need_tcon = true,
106 .fileid_ofs = 0x08,
107 },{
108 _OP(SMB2_OP_IOCTL),
109 .need_session = true,
110 .need_tcon = true,
111 .fileid_ofs = 0x08,
112 .allow_invalid_fileid = true,
113 },{
114 _OP(SMB2_OP_CANCEL),
115 .as_root = true,
116 },{
117 _OP(SMB2_OP_KEEPALIVE),
118 .as_root = true,
119 },{
120 _OP(SMB2_OP_FIND),
121 .need_session = true,
122 .need_tcon = true,
123 .fileid_ofs = 0x08,
124 },{
125 _OP(SMB2_OP_NOTIFY),
126 .need_session = true,
127 .need_tcon = true,
128 .fileid_ofs = 0x08,
129 },{
130 _OP(SMB2_OP_GETINFO),
131 .need_session = true,
132 .need_tcon = true,
133 .fileid_ofs = 0x18,
134 },{
135 _OP(SMB2_OP_SETINFO),
136 .need_session = true,
137 .need_tcon = true,
138 .fileid_ofs = 0x10,
139 },{
140 _OP(SMB2_OP_BREAK),
141 .need_session = true,
142 .need_tcon = true,
143 /*
144 * we do not set
145 * .fileid_ofs here
146 * as LEASE breaks does not
147 * have a file id
148 */
149 }
150 };
151
152 const char *smb2_opcode_name(uint16_t opcode)
153 {
154 if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
155 return "Bad SMB2 opcode";
156 }
157 return smbd_smb2_table[opcode].name;
158 }
159
160 static const struct smbd_smb2_dispatch_table *smbd_smb2_call(uint16_t opcode)
161 {
162 const struct smbd_smb2_dispatch_table *ret = NULL;
163
164 if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
165 return NULL;
166 }
167
168 ret = &smbd_smb2_table[opcode];
169
170 SMB_ASSERT(ret->opcode == opcode);
171
172 return ret;
173 }
174
175 static void print_req_vectors(const struct smbd_smb2_request *req)
176 {
177 int i;
178
179 for (i = 0; i < req->in.vector_count; i++) {
180 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
181 (unsigned int)i,
182 (unsigned int)req->in.vector[i].iov_len);
183 }
184 for (i = 0; i < req->out.vector_count; i++) {
185 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
186 (unsigned int)i,
187 (unsigned int)req->out.vector[i].iov_len);
188 }
189 }
190
191 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
192 {
193 if (size < (4 + SMB2_HDR_BODY)) {
194 return false;
195 }
196
197 if (IVAL(inbuf, 4) != SMB2_MAGIC) {
198 return false;
199 }
200
201 return true;
202 }
203
204 static NTSTATUS smbd_initialize_smb2(struct smbd_server_connection *sconn)
205 {
206 TALLOC_FREE(sconn->smb1.fde);
207
208 sconn->smb2.send_queue = NULL;
209
210 sconn->smb2.seqnum_low = 0;
211 sconn->smb2.seqnum_range = 1;
212 sconn->smb2.credits_granted = 1;
213 sconn->smb2.max_credits = lp_smb2_max_credits();
214 sconn->smb2.credits_bitmap = bitmap_talloc(sconn,
215 sconn->smb2.max_credits);
216 if (sconn->smb2.credits_bitmap == NULL) {
217 return NT_STATUS_NO_MEMORY;
218 }
219
220 sconn->smb2.fde = tevent_add_fd(sconn->ev_ctx,
221 sconn,
222 sconn->sock,
223 TEVENT_FD_READ,
224 smbd_smb2_connection_handler,
225 sconn);
226 if (sconn->smb2.fde == NULL) {
227 return NT_STATUS_NO_MEMORY;
228 }
229
230 /* Ensure child is set to non-blocking mode */
231 set_blocking(sconn->sock, false);
232 return NT_STATUS_OK;
233 }
234
235 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
236 #define _smb2_setlen(_buf,len) do { \
237 uint8_t *buf = (uint8_t *)_buf; \
238 buf[0] = 0; \
239 buf[1] = ((len)&0xFF0000)>>16; \
240 buf[2] = ((len)&0xFF00)>>8; \
241 buf[3] = (len)&0xFF; \
242 } while (0)
243
244 static void smb2_setup_nbt_length(struct iovec *vector, int count)
245 {
246 size_t len = 0;
247 int i;
248
249 for (i=1; i < count; i++) {
250 len += vector[i].iov_len;
251 }
252
253 _smb2_setlen(vector[0].iov_base, len);
254 }
255
256 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
257 {
258 data_blob_clear_free(&req->first_key);
259 data_blob_clear_free(&req->last_key);
260 return 0;
261 }
262
263 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
264 {
265 TALLOC_CTX *mem_pool;
266 struct smbd_smb2_request *req;
267
268 #if 0
269 /* Enable this to find subtle valgrind errors. */
270 mem_pool = talloc_init("smbd_smb2_request_allocate");
271 #else
272 mem_pool = talloc_pool(mem_ctx, 8192);
273 #endif
274 if (mem_pool == NULL) {
275 return NULL;
276 }
277
278 req = talloc_zero(mem_pool, struct smbd_smb2_request);
279 if (req == NULL) {
280 talloc_free(mem_pool);
281 return NULL;
282 }
283 talloc_reparent(mem_pool, mem_ctx, req);
284 TALLOC_FREE(mem_pool);
285
286 req->last_session_id = UINT64_MAX;
287 req->last_tid = UINT32_MAX;
288
289 talloc_set_destructor(req, smbd_smb2_request_destructor);
290
291 return req;
292 }
293
294 static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *conn,
295 NTTIME now,
296 uint8_t *buf,
297 size_t buflen,
298 TALLOC_CTX *mem_ctx,
299 struct iovec **piov,
300 int *pnum_iov)
301 {
302 struct iovec *iov;
303 int num_iov = 1;
304 size_t taken = 0;
305 uint8_t *first_hdr = buf;
306 size_t verified_buflen = 0;
307 uint8_t *tf = NULL;
308 size_t tf_len = 0;
309
310 /*
311 * Note: index '0' is reserved for the transport protocol
312 */
313 iov = talloc_zero_array(mem_ctx, struct iovec, num_iov);
314 if (iov == NULL) {
315 return NT_STATUS_NO_MEMORY;
316 }
317
318 while (taken < buflen) {
319 size_t len = buflen - taken;
320 uint8_t *hdr = first_hdr + taken;
321 struct iovec *cur;
322 size_t full_size;
323 size_t next_command_ofs;
324 uint16_t body_size;
325 uint8_t *body = NULL;
326 uint32_t dyn_size;
327 uint8_t *dyn = NULL;
328 struct iovec *iov_tmp;
329
330 if (verified_buflen > taken) {
331 len = verified_buflen - taken;
332 } else {
333 tf = NULL;
334 tf_len = 0;
335 }
336
337 if (len < 4) {
338 DEBUG(10, ("%d bytes left, expected at least %d\n",
339 (int)len, 4));
340 goto inval;
341 }
342 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
343 struct smbXsrv_session *s = NULL;
344 uint64_t uid;
345 struct iovec tf_iov[2];
346 NTSTATUS status;
347 size_t enc_len;
348
349 if (conn->protocol < PROTOCOL_SMB2_24) {
350 DEBUG(10, ("Got SMB2_TRANSFORM header, "
351 "but dialect[0x%04X] is used\n",
352 conn->smb2.server.dialect));
353 goto inval;
354 }
355
356 if (!(conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
357 DEBUG(10, ("Got SMB2_TRANSFORM header, "
358 "but not negotiated "
359 "client[0x%08X] server[0x%08X]\n",
360 conn->smb2.client.capabilities,
361 conn->smb2.server.capabilities));
362 goto inval;
363 }
364
365 if (len < SMB2_TF_HDR_SIZE) {
366 DEBUG(1, ("%d bytes left, expected at least %d\n",
367 (int)len, SMB2_TF_HDR_SIZE));
368 goto inval;
369 }
370 tf = hdr;
371 tf_len = SMB2_TF_HDR_SIZE;
372 taken += tf_len;
373
374 hdr = first_hdr + taken;
375 enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
376 uid = BVAL(tf, SMB2_TF_SESSION_ID);
377
378 if (len < SMB2_TF_HDR_SIZE + enc_len) {
379 DEBUG(1, ("%d bytes left, expected at least %d\n",
380 (int)len,
381 (int)(SMB2_TF_HDR_SIZE + enc_len)));
382 goto inval;
383 }
384
385 status = smb2srv_session_lookup(conn, uid, now, &s);
386 if (s == NULL) {
387 DEBUG(1, ("invalid session[%llu] in "
388 "SMB2_TRANSFORM header\n",
389 (unsigned long long)uid));
390 TALLOC_FREE(iov);
391 return NT_STATUS_USER_SESSION_DELETED;
392 }
393
394 tf_iov[0].iov_base = (void *)tf;
395 tf_iov[0].iov_len = tf_len;
396 tf_iov[1].iov_base = (void *)hdr;
397 tf_iov[1].iov_len = enc_len;
398
399 status = smb2_signing_decrypt_pdu(s->global->decryption_key,
400 conn->protocol,
401 tf_iov, 2);
402 if (!NT_STATUS_IS_OK(status)) {
403 TALLOC_FREE(iov);
404 return status;
405 }
406
407 verified_buflen = taken + enc_len;
408 len = enc_len;
409 }
410
411 /*
412 * We need the header plus the body length field
413 */
414
415 if (len < SMB2_HDR_BODY + 2) {
416 DEBUG(10, ("%d bytes left, expected at least %d\n",
417 (int)len, SMB2_HDR_BODY));
418 goto inval;
419 }
420 if (IVAL(hdr, 0) != SMB2_MAGIC) {
421 DEBUG(10, ("Got non-SMB2 PDU: %x\n",
422 IVAL(hdr, 0)));
423 goto inval;
424 }
425 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
426 DEBUG(10, ("Got HDR len %d, expected %d\n",
427 SVAL(hdr, 4), SMB2_HDR_BODY));
428 goto inval;
429 }
430
431 full_size = len;
432 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
433 body_size = SVAL(hdr, SMB2_HDR_BODY);
434
435 if (next_command_ofs != 0) {
436 if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
437 goto inval;
438 }
439 if (next_command_ofs > full_size) {
440 goto inval;
441 }
442 full_size = next_command_ofs;
443 }
444 if (body_size < 2) {
445 goto inval;
446 }
447 body_size &= 0xfffe;
448
449 if (body_size > (full_size - SMB2_HDR_BODY)) {
450 /*
451 * let the caller handle the error
452 */
453 body_size = full_size - SMB2_HDR_BODY;
454 }
455 body = hdr + SMB2_HDR_BODY;
456 dyn = body + body_size;
457 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
458
459 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
460 num_iov + SMBD_SMB2_NUM_IOV_PER_REQ);
461 if (iov_tmp == NULL) {
462 TALLOC_FREE(iov);
463 return NT_STATUS_NO_MEMORY;
464 }
465 iov = iov_tmp;
466 cur = &iov[num_iov];
467 num_iov += SMBD_SMB2_NUM_IOV_PER_REQ;
468
469 cur[SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
470 cur[SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
471 cur[SMBD_SMB2_HDR_IOV_OFS].iov_base = hdr;
472 cur[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
473 cur[SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
474 cur[SMBD_SMB2_BODY_IOV_OFS].iov_len = body_size;
475 cur[SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
476 cur[SMBD_SMB2_DYN_IOV_OFS].iov_len = dyn_size;
477
478 taken += full_size;
479 }
480
481 *piov = iov;
482 *pnum_iov = num_iov;
483 return NT_STATUS_OK;
484
485 inval:
486 TALLOC_FREE(iov);
487 return NT_STATUS_INVALID_PARAMETER;
488 }
489
490 static NTSTATUS smbd_smb2_request_create(struct smbd_server_connection *sconn,
491 uint8_t *inbuf, size_t size,
492 struct smbd_smb2_request **_req)
493 {
494 struct smbd_smb2_request *req;
495 uint32_t protocol_version;
496 const uint8_t *inhdr = NULL;
497 uint16_t cmd;
498 uint32_t next_command_ofs;
499 NTSTATUS status;
500 NTTIME now;
501
502 if (size < (4 + SMB2_HDR_BODY + 2)) {
503 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
504 return NT_STATUS_INVALID_PARAMETER;
505 }
506
507 inhdr = inbuf + 4;
508
509 protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
510 if (protocol_version != SMB2_MAGIC) {
511 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
512 protocol_version));
513 return NT_STATUS_INVALID_PARAMETER;
514 }
515
516 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
517 if (cmd != SMB2_OP_NEGPROT) {
518 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
519 cmd));
520 return NT_STATUS_INVALID_PARAMETER;
521 }
522
523 next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
524 if (next_command_ofs != 0) {
525 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
526 next_command_ofs));
527 return NT_STATUS_INVALID_PARAMETER;
528 }
529
530 req = smbd_smb2_request_allocate(sconn);
531 if (req == NULL) {
532 return NT_STATUS_NO_MEMORY;
533 }
534 req->sconn = sconn;
535
536 talloc_steal(req, inbuf);
537
538 req->request_time = timeval_current();
539 now = timeval_to_nttime(&req->request_time);
540
541 status = smbd_smb2_inbuf_parse_compound(sconn->conn,
542 now,
543 inbuf + NBT_HDR_SIZE,
544 size - NBT_HDR_SIZE,
545 req, &req->in.vector,
546 &req->in.vector_count);
547 if (!NT_STATUS_IS_OK(status)) {
548 TALLOC_FREE(req);
549 return status;
550 }
551
552 req->current_idx = 1;
553
554 *_req = req;
555 return NT_STATUS_OK;
556 }
557
558 static bool smb2_validate_sequence_number(struct smbd_server_connection *sconn,
559 uint64_t message_id, uint64_t seq_id)
560 {
561 struct bitmap *credits_bm = sconn->smb2.credits_bitmap;
562 unsigned int offset;
563
564 if (seq_id < sconn->smb2.seqnum_low) {
565 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
566 "%llu (sequence id %llu) "
567 "(granted = %u, low = %llu, range = %u)\n",
568 (unsigned long long)message_id,
569 (unsigned long long)seq_id,
570 (unsigned int)sconn->smb2.credits_granted,
571 (unsigned long long)sconn->smb2.seqnum_low,
572 (unsigned int)sconn->smb2.seqnum_range));
573 return false;
574 }
575
576 if (seq_id >= sconn->smb2.seqnum_low + sconn->smb2.seqnum_range) {
577 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
578 "%llu (sequence id %llu) "
579 "(granted = %u, low = %llu, range = %u)\n",
580 (unsigned long long)message_id,
581 (unsigned long long)seq_id,
582 (unsigned int)sconn->smb2.credits_granted,
583 (unsigned long long)sconn->smb2.seqnum_low,
584 (unsigned int)sconn->smb2.seqnum_range));
585 return false;
586 }
587
588 offset = seq_id % sconn->smb2.max_credits;
589
590 if (bitmap_query(credits_bm, offset)) {
591 DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
592 "%llu (sequence id %llu) "
593 "(granted = %u, low = %llu, range = %u) "
594 "(bm offset %u)\n",
595 (unsigned long long)message_id,
596 (unsigned long long)seq_id,
597 (unsigned int)sconn->smb2.credits_granted,
598 (unsigned long long)sconn->smb2.seqnum_low,
599 (unsigned int)sconn->smb2.seqnum_range,
600 offset));
601 return false;
602 }
603
604 /* Mark the message_ids as seen in the bitmap. */
605 bitmap_set(credits_bm, offset);
606
607 if (seq_id != sconn->smb2.seqnum_low) {
608 return true;
609 }
610
611 /*
612 * Move the window forward by all the message_id's
613 * already seen.
614 */
615 while (bitmap_query(credits_bm, offset)) {
616 DEBUG(10,("smb2_validate_sequence_number: clearing "
617 "id %llu (position %u) from bitmap\n",
618 (unsigned long long)(sconn->smb2.seqnum_low),
619 offset));
620 bitmap_clear(credits_bm, offset);
621
622 sconn->smb2.seqnum_low += 1;
623 sconn->smb2.seqnum_range -= 1;
624 offset = sconn->smb2.seqnum_low % sconn->smb2.max_credits;
625 }
626
627 return true;
628 }
629
630 static bool smb2_validate_message_id(struct smbd_server_connection *sconn,
631 const uint8_t *inhdr)
632 {
633 uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
634 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
635 uint16_t credit_charge = 1;
636 uint64_t i;
637
638 if (opcode == SMB2_OP_CANCEL) {
639 /* SMB2_CANCEL requests by definition resend messageids. */
640 return true;
641 }
642
643 if (sconn->smb2.supports_multicredit) {
644 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
645 credit_charge = MAX(credit_charge, 1);
646 }
647
648 DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
649 "credits_granted %llu, "
650 "seqnum low/range: %llu/%llu\n",
651 (unsigned long long) message_id,
652 (unsigned long long) credit_charge,
653 (unsigned long long) sconn->smb2.credits_granted,
654 (unsigned long long) sconn->smb2.seqnum_low,
655 (unsigned long long) sconn->smb2.seqnum_range));
656
657 if (sconn->smb2.credits_granted < credit_charge) {
658 DEBUG(0, ("smb2_validate_message_id: client used more "
659 "credits than granted, mid %llu, charge %llu, "
660 "credits_granted %llu, "
661 "seqnum low/range: %llu/%llu\n",
662 (unsigned long long) message_id,
663 (unsigned long long) credit_charge,
664 (unsigned long long) sconn->smb2.credits_granted,
665 (unsigned long long) sconn->smb2.seqnum_low,
666 (unsigned long long) sconn->smb2.seqnum_range));
667 return false;
668 }
669
670 /*
671 * now check the message ids
672 *
673 * for multi-credit requests we need to check all current mid plus
674 * the implicit mids caused by the credit charge
675 * e.g. current mid = 15, charge 5 => mark 15-19 as used
676 */
677
678 for (i = 0; i <= (credit_charge-1); i++) {
679 uint64_t id = message_id + i;
680 bool ok;
681
682 DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
683 (unsigned long long)message_id,
684 credit_charge,
685 (unsigned long long)id));
686
687 ok = smb2_validate_sequence_number(sconn, message_id, id);
688 if (!ok) {
689 return false;
690 }
691 }
692
693 /* substract used credits */
694 sconn->smb2.credits_granted -= credit_charge;
695
696 return true;
697 }
698
699 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
700 {
701 int count;
702 int idx;
703
704 count = req->in.vector_count;
705
706 if (count < 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
707 /* It's not a SMB2 request */
708 return NT_STATUS_INVALID_PARAMETER;
709 }
710
711 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
712 struct iovec *hdr = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
713 struct iovec *body = SMBD_SMB2_IDX_BODY_IOV(req,in,idx);
714 const uint8_t *inhdr = NULL;
715
716 if (hdr->iov_len != SMB2_HDR_BODY) {
717 return NT_STATUS_INVALID_PARAMETER;
718 }
719
720 if (body->iov_len < 2) {
721 return NT_STATUS_INVALID_PARAMETER;
722 }
723
724 inhdr = (const uint8_t *)hdr->iov_base;
725
726 /* Check the SMB2 header */
727 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
728 return NT_STATUS_INVALID_PARAMETER;
729 }
730
731 if (!smb2_validate_message_id(req->sconn, inhdr)) {
732 return NT_STATUS_INVALID_PARAMETER;
733 }
734 }
735
736 return NT_STATUS_OK;
737 }
738
739 static void smb2_set_operation_credit(struct smbd_server_connection *sconn,
740 const struct iovec *in_vector,
741 struct iovec *out_vector)
742 {
743 const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
744 uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
745 uint16_t credit_charge = 1;
746 uint16_t credits_requested;
747 uint32_t out_flags;
748 uint16_t cmd;
749 NTSTATUS out_status;
750 uint16_t credits_granted = 0;
751 uint64_t credits_possible;
752 uint16_t current_max_credits;
753
754 /*
755 * first we grant only 1/16th of the max range.
756 *
757 * Windows also starts with the 1/16th and then grants
758 * more later. I was only able to trigger higher
759 * values, when using a very high credit charge.
760 *
761 * TODO: scale up depending on load, free memory
762 * or other stuff.
763 * Maybe also on the relationship between number
764 * of requests and the used sequence number.
765 * Which means we would grant more credits
766 * for client which use multi credit requests.
767 */
768 current_max_credits = sconn->smb2.max_credits / 16;
769 current_max_credits = MAX(current_max_credits, 1);
770
771 if (sconn->smb2.supports_multicredit) {
772 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
773 credit_charge = MAX(credit_charge, 1);
774 }
775
776 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
777 credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
778 out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
779 out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
780
781 SMB_ASSERT(sconn->smb2.max_credits >= sconn->smb2.credits_granted);
782
783 if (sconn->smb2.max_credits < credit_charge) {
784 smbd_server_connection_terminate(sconn,
785 "client error: credit charge > max credits\n");
786 return;
787 }
788
789 if (out_flags & SMB2_HDR_FLAG_ASYNC) {
790 /*
791 * In case we already send an async interim
792 * response, we should not grant
793 * credits on the final response.
794 */
795 credits_granted = 0;
796 } else if (credits_requested > 0) {
797 uint16_t additional_max = 0;
798 uint16_t additional_credits = credits_requested - 1;
799
800 switch (cmd) {
801 case SMB2_OP_NEGPROT:
802 break;
803 case SMB2_OP_SESSSETUP:
804 /*
805 * Windows 2012 RC1 starts to grant
806 * additional credits
807 * with a successful session setup
808 */
809 if (NT_STATUS_IS_OK(out_status)) {
810 additional_max = 32;
811 }
812 break;
813 default:
814 /*
815 * We match windows and only grant additional credits
816 * in chunks of 32.
817 */
818 additional_max = 32;
819 break;
820 }
821
822 additional_credits = MIN(additional_credits, additional_max);
823
824 credits_granted = credit_charge + additional_credits;
825 } else if (sconn->smb2.credits_granted == 0) {
826 /*
827 * Make sure the client has always at least one credit
828 */
829 credits_granted = 1;
830 }
831
832 /*
833 * sequence numbers should not wrap
834 *
835 * 1. calculate the possible credits until
836 * the sequence numbers start to wrap on 64-bit.
837 *
838 * 2. UINT64_MAX is used for Break Notifications.
839 *
840 * 2. truncate the possible credits to the maximum
841 * credits we want to grant to the client in total.
842 *
843 * 3. remove the range we'll already granted to the client
844 * this makes sure the client consumes the lowest sequence
845 * number, before we can grant additional credits.
846 */
847 credits_possible = UINT64_MAX - sconn->smb2.seqnum_low;
848 if (credits_possible > 0) {
849 /* remove UINT64_MAX */
850 credits_possible -= 1;
851 }
852 credits_possible = MIN(credits_possible, current_max_credits);
853 credits_possible -= sconn->smb2.seqnum_range;
854
855 credits_granted = MIN(credits_granted, credits_possible);
856
857 SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
858 sconn->smb2.credits_granted += credits_granted;
859 sconn->smb2.seqnum_range += credits_granted;
860
861 DEBUG(10,("smb2_set_operation_credit: requested %u, charge %u, "
862 "granted %u, current possible/max %u/%u, "
863 "total granted/max/low/range %u/%u/%llu/%u\n",
864 (unsigned int)credits_requested,
865 (unsigned int)credit_charge,
866 (unsigned int)credits_granted,
867 (unsigned int)credits_possible,
868 (unsigned int)current_max_credits,
869 (unsigned int)sconn->smb2.credits_granted,
870 (unsigned int)sconn->smb2.max_credits,
871 (unsigned long long)sconn->smb2.seqnum_low,
872 (unsigned int)sconn->smb2.seqnum_range));
873 }
874
875 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
876 struct smbd_smb2_request *outreq)
877 {
878 int count, idx;
879 uint16_t total_credits = 0;
880
881 count = outreq->out.vector_count;
882
883 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
884 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(inreq,in,idx);
885 struct iovec *outhdr_v = SMBD_SMB2_IDX_HDR_IOV(outreq,out,idx);
886 uint8_t *outhdr = (uint8_t *)outhdr_v->iov_base;
887
888 smb2_set_operation_credit(outreq->sconn, inhdr_v, outhdr_v);
889
890 /* To match Windows, count up what we
891 just granted. */
892 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
893 /* Set to zero in all but the last reply. */
894 if (idx + SMBD_SMB2_NUM_IOV_PER_REQ < count) {
895 SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
896 } else {
897 SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
898 }
899 }
900 }
901
902 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
903 {
904 struct iovec *vector;
905 int count;
906 int idx;
907
908 count = req->in.vector_count;
909 vector = talloc_zero_array(req, struct iovec, count);
910 if (vector == NULL) {
911 return NT_STATUS_NO_MEMORY;
912 }
913
914 vector[0].iov_base = req->out.nbt_hdr;
915 vector[0].iov_len = 4;
916 SIVAL(req->out.nbt_hdr, 0, 0);
917
918 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
919 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
920 const uint8_t *inhdr = (const uint8_t *)inhdr_v->iov_base;
921 uint8_t *outhdr = NULL;
922 uint8_t *outbody = NULL;
923 uint32_t next_command_ofs = 0;
924 struct iovec *current = &vector[idx];
925
926 if ((idx + SMBD_SMB2_NUM_IOV_PER_REQ) < count) {
927 /* we have a next command -
928 * setup for the error case. */
929 next_command_ofs = SMB2_HDR_BODY + 9;
930 }
931
932 outhdr = talloc_zero_array(vector, uint8_t,
933 OUTVEC_ALLOC_SIZE);
934 if (outhdr == NULL) {
935 return NT_STATUS_NO_MEMORY;
936 }
937
938 outbody = outhdr + SMB2_HDR_BODY;
939
940 /*
941 * SMBD_SMB2_TF_IOV_OFS might be used later
942 */
943 current[SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
944 current[SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
945
946 current[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)outhdr;
947 current[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
948
949 current[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)outbody;
950 current[SMBD_SMB2_BODY_IOV_OFS].iov_len = 8;
951
952 current[SMBD_SMB2_DYN_IOV_OFS].iov_base = NULL;
953 current[SMBD_SMB2_DYN_IOV_OFS].iov_len = 0;
954
955 /* setup the SMB2 header */
956 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
957 SSVAL(outhdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
958 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
959 SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
960 SIVAL(outhdr, SMB2_HDR_STATUS,
961 NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
962 SSVAL(outhdr, SMB2_HDR_OPCODE,
963 SVAL(inhdr, SMB2_HDR_OPCODE));
964 SIVAL(outhdr, SMB2_HDR_FLAGS,
965 IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
966 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
967 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
968 BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
969 SIVAL(outhdr, SMB2_HDR_PID,
970 IVAL(inhdr, SMB2_HDR_PID));
971 SIVAL(outhdr, SMB2_HDR_TID,
972 IVAL(inhdr, SMB2_HDR_TID));
973 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
974 BVAL(inhdr, SMB2_HDR_SESSION_ID));
975 memcpy(outhdr + SMB2_HDR_SIGNATURE,
976 inhdr + SMB2_HDR_SIGNATURE, 16);
977
978 /* setup error body header */
979 SSVAL(outbody, 0x00, 0x08 + 1);
980 SSVAL(outbody, 0x02, 0);
981 SIVAL(outbody, 0x04, 0);
982 }
983
984 req->out.vector = vector;
985 req->out.vector_count = count;
986
987 /* setup the length of the NBT packet */
988 smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
989
990 DLIST_ADD_END(req->sconn->smb2.requests, req, struct smbd_smb2_request *);
991
992 return NT_STATUS_OK;
993 }
994
995 void smbd_server_connection_terminate_ex(struct smbd_server_connection *sconn,
996 const char *reason,
997 const char *location)
998 {
999 DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
1000 reason, location));
1001 exit_server_cleanly(reason);
1002 }
1003
1004 static bool dup_smb2_vec4(TALLOC_CTX *ctx,
1005 struct iovec *outvec,
1006 const struct iovec *srcvec)
1007 {
1008 const uint8_t *srctf;
1009 size_t srctf_len;
1010 const uint8_t *srchdr;
1011 size_t srchdr_len;
1012 const uint8_t *srcbody;
1013 size_t srcbody_len;
1014 const uint8_t *expected_srcbody;
1015 const uint8_t *srcdyn;
1016 size_t srcdyn_len;
1017 const uint8_t *expected_srcdyn;
1018 uint8_t *dsttf;
1019 uint8_t *dsthdr;
1020 uint8_t *dstbody;
1021 uint8_t *dstdyn;
1022
1023 srctf = (const uint8_t *)srcvec[SMBD_SMB2_TF_IOV_OFS].iov_base;
1024 srctf_len = srcvec[SMBD_SMB2_TF_IOV_OFS].iov_len;
1025 srchdr = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
1026 srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
1027 srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
1028 srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
1029 expected_srcbody = srchdr + SMB2_HDR_BODY;
1030 srcdyn = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
1031 srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
1032 expected_srcdyn = srcbody + 8;
1033
1034 if ((srctf_len != SMB2_TF_HDR_SIZE) && (srctf_len != 0)) {
1035 return false;
1036 }
1037
1038 if (srchdr_len != SMB2_HDR_BODY) {
1039 return false;
1040 }
1041
1042 if (srctf_len == SMB2_TF_HDR_SIZE) {
1043 dsttf = talloc_memdup(ctx, srctf, SMB2_TF_HDR_SIZE);
1044 if (dsttf == NULL) {
1045 return false;
1046 }
1047 } else {
1048 dsttf = NULL;
1049 }
1050 outvec[SMBD_SMB2_TF_IOV_OFS].iov_base = (void *)dsttf;
1051 outvec[SMBD_SMB2_TF_IOV_OFS].iov_len = srctf_len;
1052
1053 /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
1054 * be allocated with size OUTVEC_ALLOC_SIZE. */
1055
1056 dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
1057 if (dsthdr == NULL) {
1058 return false;
1059 }
1060 outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
1061 outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1062
1063 /*
1064 * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
1065 * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
1066 * then duplicate this. Else use talloc_memdup().
1067 */
1068
1069 if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
1070 dstbody = dsthdr + SMB2_HDR_BODY;
1071 } else {
1072 dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
1073 if (dstbody == NULL) {
1074 return false;
1075 }
1076 }
1077 outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
1078 outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
1079
1080 /*
1081 * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
1082 * pointing to
1083 * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
1084 * then duplicate this. Else use talloc_memdup().
1085 */
1086
1087 if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
1088 dstdyn = dsthdr + SMB2_HDR_BODY + 8;
1089 } else if (srcdyn == NULL) {
1090 dstdyn = NULL;
1091 } else {
1092 dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
1093 if (dstdyn == NULL) {
1094 return false;
1095 }
1096 }
1097 outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
1098 outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
1099
1100 return true;
1101 }
1102
1103 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
1104 {
1105 struct smbd_smb2_request *newreq = NULL;
1106 struct iovec *outvec = NULL;
1107 int count = req->out.vector_count;
1108 int i;
1109
1110 newreq = smbd_smb2_request_allocate(req->sconn);
1111 if (!newreq) {
1112 return NULL;
1113 }
1114
1115 newreq->sconn = req->sconn;
1116 newreq->session = req->session;
1117 newreq->do_encryption = req->do_encryption;
1118 newreq->do_signing = req->do_signing;
1119 newreq->current_idx = req->current_idx;
1120
1121 outvec = talloc_zero_array(newreq, struct iovec, count);
1122 if (!outvec) {
1123 TALLOC_FREE(newreq);
1124 return NULL;
1125 }
1126 newreq->out.vector = outvec;
1127 newreq->out.vector_count = count;
1128
1129 /* Setup the outvec's identically to req. */
1130 outvec[0].iov_base = newreq->out.nbt_hdr;
1131 outvec[0].iov_len = 4;
1132 memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
1133
1134 /* Setup the vectors identically to the ones in req. */
1135 for (i = 1; i < count; i += SMBD_SMB2_NUM_IOV_PER_REQ) {
1136 if (!dup_smb2_vec4(outvec, &outvec[i], &req->out.vector[i])) {
1137 break;
1138 }
1139 }
1140
1141 if (i < count) {
1142 /* Alloc failed. */
1143 TALLOC_FREE(newreq);
1144 return NULL;
1145 }
1146
1147 smb2_setup_nbt_length(newreq->out.vector,
1148 newreq->out.vector_count);
1149
1150 return newreq;
1151 }
1152
1153 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
1154 {
1155 struct smbd_server_connection *sconn = req->sconn;
1156 struct smbXsrv_connection *conn = req->sconn->conn;
1157 int first_idx = 1;
1158 struct iovec *firsttf = NULL;
1159 struct iovec *outhdr_v = NULL;
1160 uint8_t *outhdr = NULL;
1161 struct smbd_smb2_request *nreq = NULL;
1162 NTSTATUS status;
1163
1164 /* Create a new smb2 request we'll use
1165 for the interim return. */
1166 nreq = dup_smb2_req(req);
1167 if (!nreq) {
1168 return NT_STATUS_NO_MEMORY;
1169 }
1170
1171 /* Lose the last X out vectors. They're the
1172 ones we'll be using for the async reply. */
1173 nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
1174
1175 smb2_setup_nbt_length(nreq->out.vector,
1176 nreq->out.vector_count);
1177
1178 /* Step back to the previous reply. */
1179 nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
1180 firsttf = SMBD_SMB2_IDX_TF_IOV(nreq,out,first_idx);
1181 outhdr_v = SMBD_SMB2_OUT_HDR_IOV(nreq);
1182 outhdr = SMBD_SMB2_OUT_HDR_PTR(nreq);
1183 /* And end the chain. */
1184 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
1185
1186 /* Calculate outgoing credits */
1187 smb2_calculate_credits(req, nreq);
1188
1189 if (DEBUGLEVEL >= 10) {
1190 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
1191 (unsigned int)nreq->current_idx );
1192 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
1193 (unsigned int)nreq->out.vector_count );
1194 print_req_vectors(nreq);
1195 }
1196
1197 /*
1198 * As we have changed the header (SMB2_HDR_NEXT_COMMAND),
1199 * we need to sign/encrypt here with the last/first key we remembered
1200 */
1201 if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
1202 status = smb2_signing_encrypt_pdu(req->first_key,
1203 conn->protocol,
1204 firsttf,
1205 nreq->out.vector_count - first_idx);
1206 if (!NT_STATUS_IS_OK(status)) {
1207 return status;
1208 }
1209 } else if (req->last_key.length > 0) {
1210 status = smb2_signing_sign_pdu(req->last_key,
1211 conn->protocol,
1212 outhdr_v,
1213 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1214 if (!NT_STATUS_IS_OK(status)) {
1215 return status;
1216 }
1217 }
1218
1219 nreq->queue_entry.mem_ctx = nreq;
1220 nreq->queue_entry.vector = nreq->out.vector;
1221 nreq->queue_entry.count = nreq->out.vector_count;
1222 DLIST_ADD_END(nreq->sconn->smb2.send_queue, &nreq->queue_entry, NULL);
1223 nreq->sconn->smb2.send_queue_len++;
1224
1225 status = smbd_smb2_io_handler(sconn, TEVENT_FD_WRITE);
1226 if (!NT_STATUS_IS_OK(status)) {
1227 return status;
1228 }
1229
1230 return NT_STATUS_OK;
1231 }
1232
1233 struct smbd_smb2_request_pending_state {
1234 struct smbd_server_connection *sconn;
1235 struct smbd_smb2_send_queue queue_entry;
1236 uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
1237 struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
1238 };
1239
1240 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1241 struct tevent_timer *te,
1242 struct timeval current_time,
1243 void *private_data);
1244
1245 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
1246 struct tevent_req *subreq,
1247 uint32_t defer_time)
1248 {
1249 NTSTATUS status;
1250 struct timeval defer_endtime;
1251 uint8_t *outhdr = NULL;
1252 uint32_t flags;
1253
1254 if (!tevent_req_is_in_progress(subreq)) {
1255 return NT_STATUS_OK;
1256 }
1257
1258 req->subreq = subreq;
1259 subreq = NULL;
1260
1261 if (req->async_te) {
1262 /* We're already async. */
1263 return NT_STATUS_OK;
1264 }
1265
1266 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1267 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1268 if (flags & SMB2_HDR_FLAG_ASYNC) {
1269 /* We're already async. */
1270 return NT_STATUS_OK;
1271 }
1272
1273 if (req->in.vector_count > req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
1274 /*
1275 * We're trying to go async in a compound
1276 * request chain.
1277 * This is only allowed for opens that
1278 * cause an oplock break, otherwise it
1279 * is not allowed. See [MS-SMB2].pdf
1280 * note <194> on Section 3.3.5.2.7.
1281 */
1282 const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1283
1284 if (SVAL(inhdr, SMB2_HDR_OPCODE) != SMB2_OP_CREATE) {
1285 /*
1286 * Cancel the outstanding request.
1287 */
1288 bool ok = tevent_req_cancel(req->subreq);
1289 if (ok) {
1290 return NT_STATUS_OK;
1291 }
1292 TALLOC_FREE(req->subreq);
1293 return smbd_smb2_request_error(req,
1294 NT_STATUS_INTERNAL_ERROR);
1295 }
1296 }
1297
1298 if (DEBUGLEVEL >= 10) {
1299 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
1300 (unsigned int)req->current_idx );
1301 print_req_vectors(req);
1302 }
1303
1304 if (req->current_idx > 1) {
1305 /*
1306 * We're going async in a compound
1307 * chain after the first request has
1308 * already been processed. Send an
1309 * interim response containing the
1310 * set of replies already generated.
1311 */
1312 int idx = req->current_idx;
1313
1314 status = smb2_send_async_interim_response(req);
1315 if (!NT_STATUS_IS_OK(status)) {
1316 return status;
1317 }
1318 data_blob_clear_free(&req->first_key);
1319
1320 req->current_idx = 1;
1321
1322 /*
1323 * Re-arrange the in.vectors to remove what
1324 * we just sent.
1325 */
1326 memmove(&req->in.vector[1],
1327 &req->in.vector[idx],
1328 sizeof(req->in.vector[0])*(req->in.vector_count - idx));
1329 req->in.vector_count = 1 + (req->in.vector_count - idx);
1330
1331 /* Re-arrange the out.vectors to match. */
1332 memmove(&req->out.vector[1],
1333 &req->out.vector[idx],
1334 sizeof(req->out.vector[0])*(req->out.vector_count - idx));
1335 req->out.vector_count = 1 + (req->out.vector_count - idx);
1336
1337 if (req->in.vector_count == 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
1338 /*
1339 * We only have one remaining request as
1340 * we've processed everything else.
1341 * This is no longer a compound request.
1342 */
1343 req->compound_related = false;
1344 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1345 flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
1346 SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
1347 }
1348 }
1349 data_blob_clear_free(&req->last_key);
1350
1351 defer_endtime = timeval_current_ofs_usec(defer_time);
1352 req->async_te = tevent_add_timer(req->sconn->ev_ctx,
1353 req, defer_endtime,
1354 smbd_smb2_request_pending_timer,
1355 req);
1356 if (req->async_te == NULL) {
1357 return NT_STATUS_NO_MEMORY;
1358 }
1359
1360 return NT_STATUS_OK;
1361 }
1362
1363 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1364 struct tevent_timer *te,
1365 struct timeval current_time,
1366 void *private_data)
1367 {
1368 struct smbd_smb2_request *req =
1369 talloc_get_type_abort(private_data,
1370 struct smbd_smb2_request);
1371 struct smbd_server_connection *sconn = req->sconn;
1372 struct smbd_smb2_request_pending_state *state = NULL;
1373 uint8_t *outhdr = NULL;
1374 const uint8_t *inhdr = NULL;
1375 uint8_t *tf = NULL;
1376 size_t tf_len = 0;
1377 uint8_t *hdr = NULL;
1378 uint8_t *body = NULL;
1379 uint8_t *dyn = NULL;
1380 uint32_t flags = 0;
1381 uint64_t session_id = 0;
1382 uint64_t message_id = 0;
1383 uint64_t nonce_high = 0;
1384 uint64_t nonce_low = 0;
1385 uint64_t async_id = 0;
1386 NTSTATUS status;
1387
1388 TALLOC_FREE(req->async_te);
1389
1390 /* Ensure our final reply matches the interim one. */
1391 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1392 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1393 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1394 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1395 session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
1396
1397 async_id = message_id; /* keep it simple for now... */
1398
1399 SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1400 SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
1401
1402 DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1403 "going async\n",
1404 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1405 (unsigned long long)async_id ));
1406
1407 /*
1408 * What we send is identical to a smbd_smb2_request_error
1409 * packet with an error status of STATUS_PENDING. Make use
1410 * of this fact sometime when refactoring. JRA.
1411 */
1412
1413 state = talloc_zero(req->sconn, struct smbd_smb2_request_pending_state);
1414 if (state == NULL) {
1415 smbd_server_connection_terminate(req->sconn,
1416 nt_errstr(NT_STATUS_NO_MEMORY));
1417 return;
1418 }
1419 state->sconn = req->sconn;
1420
1421 tf = state->buf + NBT_HDR_SIZE;
1422 tf_len = SMB2_TF_HDR_SIZE;
1423
1424 hdr = tf + SMB2_TF_HDR_SIZE;
1425 body = hdr + SMB2_HDR_BODY;
1426 dyn = body + 8;
1427
1428 if (req->do_encryption) {
1429 struct smbXsrv_session *x = req->session;
1430
1431 nonce_high = x->nonce_high;
1432 nonce_low = x->nonce_low;
1433
1434 x->nonce_low += 1;
1435 if (x->nonce_low == 0) {
1436 x->nonce_low += 1;
1437 x->nonce_high += 1;
1438 }
1439 }
1440
1441 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
1442 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
1443 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
1444 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
1445
1446 SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1447 SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1448 SSVAL(hdr, SMB2_HDR_EPOCH, 0);
1449 SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
1450 SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
1451
1452 SIVAL(hdr, SMB2_HDR_FLAGS, flags);
1453 SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
1454 SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
1455 SBVAL(hdr, SMB2_HDR_PID, async_id);
1456 SBVAL(hdr, SMB2_HDR_SESSION_ID,
1457 BVAL(outhdr, SMB2_HDR_SESSION_ID));
1458 memcpy(hdr+SMB2_HDR_SIGNATURE,
1459 outhdr+SMB2_HDR_SIGNATURE, 16);
1460
1461 SSVAL(body, 0x00, 0x08 + 1);
1462
1463 SCVAL(body, 0x02, 0);
1464 SCVAL(body, 0x03, 0);
1465 SIVAL(body, 0x04, 0);
1466 /* Match W2K8R2... */
1467 SCVAL(dyn, 0x00, 0x21);
1468
1469 state->vector[0].iov_base = (void *)state->buf;
1470 state->vector[0].iov_len = NBT_HDR_SIZE;
1471
1472 if (req->do_encryption) {
1473 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
1474 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
1475 } else {
1476 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
1477 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
1478 }
1479
1480 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base = hdr;
1481 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1482
1483 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
1484 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len = 8;
1485
1486 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
1487 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len = 1;
1488
1489 smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
1490
1491 /* Ensure we correctly go through crediting. Grant
1492 the credits now, and zero credits on the final
1493 response. */
1494 smb2_set_operation_credit(req->sconn,
1495 SMBD_SMB2_IN_HDR_IOV(req),
1496 &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
1497
1498 SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1499
1500 if (DEBUGLVL(10)) {
1501 int i;
1502
1503 for (i = 0; i < ARRAY_SIZE(state->vector); i++) {
1504 dbgtext("\tstate->vector[%u/%u].iov_len = %u\n",
1505 (unsigned int)i,
1506 (unsigned int)ARRAY_SIZE(state->vector),
1507 (unsigned int)state->vector[i].iov_len);
1508 }
1509 }
1510
1511 if (req->do_encryption) {
1512 struct smbXsrv_session *x = req->session;
1513 struct smbXsrv_connection *conn = x->connection;
1514 DATA_BLOB encryption_key = x->global->encryption_key;
1515
1516 status = smb2_signing_encrypt_pdu(encryption_key,
1517 conn->protocol,
1518 &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
1519 SMBD_SMB2_NUM_IOV_PER_REQ);
1520 if (!NT_STATUS_IS_OK(status)) {
1521 smbd_server_connection_terminate(req->sconn,
1522 nt_errstr(status));
1523 return;
1524 }
1525 } else if (req->do_signing) {
1526 struct smbXsrv_session *x = req->session;
1527 struct smbXsrv_connection *conn = x->connection;
1528 DATA_BLOB signing_key = x->global->channels[0].signing_key;
1529
1530 status = smb2_signing_sign_pdu(signing_key,
1531 conn->protocol,
1532 &state->vector[1+SMBD_SMB2_HDR_IOV_OFS],
1533 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1534 if (!NT_STATUS_IS_OK(status)) {
1535 smbd_server_connection_terminate(req->sconn,
1536 nt_errstr(status));
1537 return;
1538 }
1539 }
1540
1541 state->queue_entry.mem_ctx = state;
1542 state->queue_entry.vector = state->vector;
1543 state->queue_entry.count = ARRAY_SIZE(state->vector);
1544 DLIST_ADD_END(sconn->smb2.send_queue, &state->queue_entry, NULL);
1545 sconn->smb2.send_queue_len++;
1546
1547 status = smbd_smb2_io_handler(sconn, TEVENT_FD_WRITE);
1548 if (!NT_STATUS_IS_OK(status)) {
1549 smbd_server_connection_terminate(sconn,
1550 nt_errstr(status));
1551 return;
1552 }
1553 }
1554
1555 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
1556 {
1557 struct smbd_server_connection *sconn = req->sconn;
1558 struct smbd_smb2_request *cur;
1559 const uint8_t *inhdr;
1560 uint32_t flags;
1561 uint64_t search_message_id;
1562 uint64_t search_async_id;
1563 uint64_t found_id;
1564
1565 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1566
1567 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1568 search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1569 search_async_id = BVAL(inhdr, SMB2_HDR_PID);
1570
1571 /*
1572 * we don't need the request anymore
1573 * cancel requests never have a response
1574 */
1575 DLIST_REMOVE(req->sconn->smb2.requests, req);
1576 TALLOC_FREE(req);
1577
1578 for (cur = sconn->smb2.requests; cur; cur = cur->next) {
1579 const uint8_t *outhdr;
1580 uint64_t message_id;
1581 uint64_t async_id;
1582
1583 if (cur->compound_related) {
1584 /*
1585 * Never cancel anything in a compound request.
1586 * Way too hard to deal with the result.
1587 */
1588 continue;
1589 }
1590
1591 outhdr = SMBD_SMB2_OUT_HDR_PTR(cur);
1592
1593 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1594 async_id = BVAL(outhdr, SMB2_HDR_PID);
1595
1596 if (flags & SMB2_HDR_FLAG_ASYNC) {
1597 if (search_async_id == async_id) {
1598 found_id = async_id;
1599 break;
1600 }
1601 } else {
1602 if (search_message_id == message_id) {
1603 found_id = message_id;
1604 break;
1605 }
1606 }
1607 }
1608
1609 if (cur && cur->subreq) {
1610 inhdr = SMBD_SMB2_IN_HDR_PTR(cur);
1611 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1612 "cancel opcode[%s] mid %llu\n",
1613 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1614 (unsigned long long)found_id ));
1615 tevent_req_cancel(cur->subreq);
1616 }
1617
1618 return NT_STATUS_OK;
1619 }
1620
1621 /*************************************************************
1622 Ensure an incoming tid is a valid one for us to access.
1623 Change to the associated uid credentials and chdir to the
1624 valid tid directory.
1625 *************************************************************/
1626
1627 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
1628 {
1629 const uint8_t *inhdr;
1630 uint32_t in_flags;
1631 uint32_t in_tid;
1632 struct smbXsrv_tcon *tcon;
1633 NTSTATUS status;
1634 NTTIME now = timeval_to_nttime(&req->request_time);
1635
1636 req->tcon = NULL;
1637
1638 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1639
1640 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1641 in_tid = IVAL(inhdr, SMB2_HDR_TID);
1642
1643 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1644 in_tid = req->last_tid;
1645 }
1646
1647 req->last_tid = 0;
1648
1649 status = smb2srv_tcon_lookup(req->session,
1650 in_tid, now, &tcon);
1651 if (!NT_STATUS_IS_OK(status)) {
1652 return status;
1653 }
1654
1655 if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
1656 return NT_STATUS_ACCESS_DENIED;
1657 }
1658
1659 /* should we pass FLAG_CASELESS_PATHNAMES here? */
1660 if (!set_current_service(tcon->compat, 0, true)) {
1661 return NT_STATUS_ACCESS_DENIED;
1662 }
1663
1664 req->tcon = tcon;
1665 req->last_tid = in_tid;
1666
1667 return NT_STATUS_OK;
1668 }
1669
1670 /*************************************************************
1671 Ensure an incoming session_id is a valid one for us to access.
1672 *************************************************************/
1673
1674 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
1675 {
1676 const uint8_t *inhdr;
1677 uint32_t in_flags;
1678 uint16_t in_opcode;
1679 uint64_t in_session_id;
1680 struct smbXsrv_session *session = NULL;
1681 struct auth_session_info *session_info;
1682 NTSTATUS status;
1683 NTTIME now = timeval_to_nttime(&req->request_time);
1684
1685 req->session = NULL;
1686 req->tcon = NULL;
1687
1688 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1689
1690 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1691 in_opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1692 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
1693
1694 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1695 in_session_id = req->last_session_id;
1696 }
1697
1698 req->last_session_id = 0;
1699
1700 /* lookup an existing session */
1701 status = smb2srv_session_lookup(req->sconn->conn,
1702 in_session_id, now,
1703 &session);
1704 if (session) {
1705 req->session = session;
1706 req->last_session_id = in_session_id;
1707 }
1708 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1709 switch (in_opcode) {
1710 case SMB2_OP_SESSSETUP:
1711 status = NT_STATUS_OK;
1712 break;
1713 default:
1714 break;
1715 }
1716 }
1717 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1718 switch (in_opcode) {
1719 case SMB2_OP_TCON:
1720 case SMB2_OP_CREATE:
1721 case SMB2_OP_GETINFO:
1722 case SMB2_OP_SETINFO:
1723 return NT_STATUS_INVALID_HANDLE;
1724 default:
1725 /*
1726 * Notice the check for
1727 * (session_info == NULL)
1728 * below.
1729 */
1730 status = NT_STATUS_OK;
1731 break;
1732 }
1733 }
1734 if (!NT_STATUS_IS_OK(status)) {
1735 return status;
1736 }
1737
1738 session_info = session->global->auth_session_info;
1739 if (session_info == NULL) {
1740 return NT_STATUS_INVALID_HANDLE;
1741 }
1742
1743 set_current_user_info(session_info->unix_info->sanitized_username,
1744 session_info->unix_info->unix_name,
1745 session_info->info->domain_name);
1746
1747 return NT_STATUS_OK;
1748 }
1749
1750 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
1751 uint32_t data_length)
1752 {
1753 uint16_t needed_charge;
1754 uint16_t credit_charge = 1;
1755 const uint8_t *inhdr;
1756
1757 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1758
1759 if (req->sconn->smb2.supports_multicredit) {
1760 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
1761 credit_charge = MAX(credit_charge, 1);
1762 }
1763
1764 needed_charge = (data_length - 1)/ 65536 + 1;
1765
1766 DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
1767 (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
1768 credit_charge, needed_charge));
1769
1770 if (needed_charge > credit_charge) {
1771 DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
1772 credit_charge, needed_charge));
1773 return NT_STATUS_INVALID_PARAMETER;
1774 }
1775
1776 return NT_STATUS_OK;
1777 }
1778
1779 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
1780 size_t expected_body_size)
1781 {
1782 struct iovec *inhdr_v;
1783 const uint8_t *inhdr;
1784 uint16_t opcode;
1785 const uint8_t *inbody;
1786 size_t body_size;
1787 size_t min_dyn_size = expected_body_size & 0x00000001;
1788 int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
1789
1790 /*
1791 * The following should be checked already.
1792 */
1793 if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
1794 return NT_STATUS_INTERNAL_ERROR;
1795 }
1796 if (req->current_idx > max_idx) {
1797 return NT_STATUS_INTERNAL_ERROR;
1798 }
1799
1800 inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
1801 if (inhdr_v->iov_len != SMB2_HDR_BODY) {
1802 return NT_STATUS_INTERNAL_ERROR;
1803 }
1804 if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
1805 return NT_STATUS_INTERNAL_ERROR;
1806 }
1807
1808 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1809 opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1810
1811 switch (opcode) {
1812 case SMB2_OP_IOCTL:
1813 case SMB2_OP_GETINFO:
1814 min_dyn_size = 0;
1815 break;
1816 }
1817
1818 /*
1819 * Now check the expected body size,
1820 * where the last byte might be in the
1821 * dynamic section..
1822 */
1823 if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
1824 return NT_STATUS_INVALID_PARAMETER;
1825 }
1826 if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
1827 return NT_STATUS_INVALID_PARAMETER;
1828 }
1829
1830 inbody = SMBD_SMB2_IN_BODY_PTR(req);
1831
1832 body_size = SVAL(inbody, 0x00);
1833 if (body_size != expected_body_size) {
1834 return NT_STATUS_INVALID_PARAMETER;
1835 }
1836
1837 return NT_STATUS_OK;
1838 }
1839
1840 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
1841 {
1842 struct smbXsrv_connection *conn = req->sconn->conn;
1843 const struct smbd_smb2_dispatch_table *call = NULL;
1844 const struct iovec *intf_v = SMBD_SMB2_IN_TF_IOV(req);
1845 const uint8_t *inhdr;
1846 uint16_t opcode;
1847 uint32_t flags;
1848 uint64_t mid;
1849 NTSTATUS status;
1850 NTSTATUS session_status;
1851 uint32_t allowed_flags;
1852 NTSTATUS return_value;
1853 struct smbXsrv_session *x = NULL;
1854 bool signing_required = false;
1855 bool encryption_required = false;
1856
1857 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1858
1859 /* TODO: verify more things */
1860
1861 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1862 opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1863 mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1864 DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
1865 smb2_opcode_name(opcode),
1866 (unsigned long long)mid));
1867
1868 if (conn->protocol >= PROTOCOL_SMB2_02) {
1869 /*
1870 * once the protocol is negotiated
1871 * SMB2_OP_NEGPROT is not allowed anymore
1872 */
1873 if (opcode == SMB2_OP_NEGPROT) {
1874 /* drop the connection */
1875 return NT_STATUS_INVALID_PARAMETER;
1876 }
1877 } else {
1878 /*
1879 * if the protocol is not negotiated yet
1880 * only SMB2_OP_NEGPROT is allowed.
1881 */
1882 if (opcode != SMB2_OP_NEGPROT) {
1883 /* drop the connection */
1884 return NT_STATUS_INVALID_PARAMETER;
1885 }
1886 }
1887
1888 /*
1889 * Check if the client provided a valid session id,
1890 * if so smbd_smb2_request_check_session() calls
1891 * set_current_user_info().
1892 *
1893 * As some command don't require a valid session id
1894 * we defer the check of the session_status
1895 */
1896 session_status = smbd_smb2_request_check_session(req);
1897 x = req->session;
1898 if (x != NULL) {
1899 signing_required = x->global->signing_required;
1900 encryption_required = x->global->encryption_required;
1901
1902 if (opcode == SMB2_OP_SESSSETUP &&
1903 x->global->channels[0].signing_key.length) {
1904 signing_required = true;
1905 }
1906 }
1907
1908 req->do_signing = false;
1909 req->do_encryption = false;
1910 if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
1911 const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
1912 uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
1913
1914 if (x != NULL && x->global->session_wire_id != tf_session_id) {
1915 DEBUG(0,("smbd_smb2_request_dispatch: invalid session_id"
1916 "in SMB2_HDR[%llu], SMB2_TF[%llu]\n",
1917 (unsigned long long)x->global->session_wire_id,
1918 (unsigned long long)tf_session_id));
1919 /*
1920 * TODO: windows allows this...
1921 * should we drop the connection?
1922 *
1923 * For now we just return ACCESS_DENIED
1924 * (Windows clients never trigger this)
1925 * and wait for an update of [MS-SMB2].
1926 */
1927 return smbd_smb2_request_error(req,
1928 NT_STATUS_ACCESS_DENIED);
1929 }
1930
1931 req->do_encryption = true;
1932 }
1933
1934 if (encryption_required && !req->do_encryption) {
1935 return smbd_smb2_request_error(req,
1936 NT_STATUS_ACCESS_DENIED);
1937 }
1938
1939 call = smbd_smb2_call(opcode);
1940 if (call == NULL) {
1941 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
1942 }
1943
1944 allowed_flags = SMB2_HDR_FLAG_CHAINED |
1945 SMB2_HDR_FLAG_SIGNED |
1946 SMB2_HDR_FLAG_DFS;
1947 if (opcode == SMB2_OP_CANCEL) {
1948 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
1949 }
1950 if ((flags & ~allowed_flags) != 0) {
1951 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
1952 }
1953
1954 if (flags & SMB2_HDR_FLAG_CHAINED) {
1955 /*
1956 * This check is mostly for giving the correct error code
1957 * for compounded requests.
1958 */
1959 if (!NT_STATUS_IS_OK(session_status)) {
1960 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
1961 }
1962 } else {
1963 req->compat_chain_fsp = NULL;
1964 }
1965
1966 if (req->do_encryption) {
1967 signing_required = false;
1968 } else if (flags & SMB2_HDR_FLAG_SIGNED) {
1969 DATA_BLOB signing_key;
1970
1971 if (x == NULL) {
1972 return smbd_smb2_request_error(
1973 req, NT_STATUS_ACCESS_DENIED);
1974 }
1975
1976 signing_key = x->global->channels[0].signing_key;
1977
1978 /*
1979 * If we have a signing key, we should
1980 * sign the response
1981 */
1982 if (signing_key.length > 0) {
1983 req->do_signing = true;
1984 }
1985
1986 status = smb2_signing_check_pdu(signing_key,
1987 conn->protocol,
1988 SMBD_SMB2_IN_HDR_IOV(req),
1989 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1990 if (!NT_STATUS_IS_OK(status)) {
1991 return smbd_smb2_request_error(req, status);
1992 }
1993
1994 /*
1995 * Now that we know the request was correctly signed
1996 * we have to sign the response too.
1997 */
1998 req->do_signing = true;
1999
2000 if (!NT_STATUS_IS_OK(session_status)) {
2001 return smbd_smb2_request_error(req, session_status);
2002 }
2003 } else if (opcode == SMB2_OP_CANCEL) {
2004 /* Cancel requests are allowed to skip the signing */
2005 } else if (signing_required) {
2006 /*
2007 * If signing is required we try to sign
2008 * a possible error response
2009 */
2010 req->do_signing = true;
2011 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
2012 }
2013
2014 if (flags & SMB2_HDR_FLAG_CHAINED) {
2015 req->compound_related = true;
2016 }
2017
2018 if (call->need_session) {
2019 if (!NT_STATUS_IS_OK(session_status)) {
2020 return smbd_smb2_request_error(req, session_status);
2021 }
2022 }
2023
2024 if (call->need_tcon) {
2025 SMB_ASSERT(call->need_session);
2026
2027 /*
2028 * This call needs to be run as user.
2029 *
2030 * smbd_smb2_request_check_tcon()
2031 * calls change_to_user() on success.
2032 */
2033 status = smbd_smb2_request_check_tcon(req);
2034 if (!NT_STATUS_IS_OK(status)) {
2035 return smbd_smb2_request_error(req, status);
2036 }
2037 if (req->tcon->global->encryption_required) {
2038 encryption_required = true;
2039 }
2040 if (encryption_required && !req->do_encryption) {
2041 return smbd_smb2_request_error(req,
2042 NT_STATUS_ACCESS_DENIED);
2043 }
2044 }
2045
2046 if (call->fileid_ofs != 0) {
2047 size_t needed = call->fileid_ofs + 16;
2048 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
2049 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
2050 uint64_t file_id_persistent;
2051 uint64_t file_id_volatile;
2052 struct files_struct *fsp;
2053
2054 SMB_ASSERT(call->need_tcon);
2055
2056 if (needed > body_size) {
2057 return smbd_smb2_request_error(req,
2058 NT_STATUS_INVALID_PARAMETER);
2059 }
2060
2061 file_id_persistent = BVAL(body, call->fileid_ofs + 0);
2062 file_id_volatile = BVAL(body, call->fileid_ofs + 8);
2063
2064 fsp = file_fsp_smb2(req, file_id_persistent, file_id_volatile);
2065 if (fsp == NULL) {
2066 if (!call->allow_invalid_fileid) {
2067 return smbd_smb2_request_error(req,
2068 NT_STATUS_FILE_CLOSED);
2069 }
2070
2071 if (file_id_persistent != UINT64_MAX) {
2072 return smbd_smb2_request_error(req,
2073 NT_STATUS_FILE_CLOSED);
2074 }
2075 if (file_id_volatile != UINT64_MAX) {
2076 return smbd_smb2_request_error(req,
2077 NT_STATUS_FILE_CLOSED);
2078 }
2079 }
2080 }
2081
2082 if (call->as_root) {
2083 SMB_ASSERT(call->fileid_ofs == 0);
2084 /* This call needs to be run as root */
2085 change_to_root_user();
2086 } else {
2087 SMB_ASSERT(call->need_tcon);
2088 }
2089
2090 switch (opcode) {
2091 case SMB2_OP_NEGPROT:
2092 {
2093 START_PROFILE(smb2_negprot);
2094 return_value = smbd_smb2_request_process_negprot(req);
2095 END_PROFILE(smb2_negprot);
2096 }
2097 break;
2098
2099 case SMB2_OP_SESSSETUP:
2100 {
2101 START_PROFILE(smb2_sesssetup);
2102 return_value = smbd_smb2_request_process_sesssetup(req);
2103 END_PROFILE(smb2_sesssetup);
2104 }
2105 break;
2106
2107 case SMB2_OP_LOGOFF:
2108 {
2109 START_PROFILE(smb2_logoff);
2110 return_value = smbd_smb2_request_process_logoff(req);
2111 END_PROFILE(smb2_logoff);
2112 }
2113 break;
2114
2115 case SMB2_OP_TCON:
2116 {
2117 START_PROFILE(smb2_tcon);
2118 return_value = smbd_smb2_request_process_tcon(req);
2119 END_PROFILE(smb2_tcon);
2120 }
2121 break;
2122
2123 case SMB2_OP_TDIS:
2124 {
2125 START_PROFILE(smb2_tdis);
2126 return_value = smbd_smb2_request_process_tdis(req);
2127 END_PROFILE(smb2_tdis);
2128 }
2129 break;
2130
2131 case SMB2_OP_CREATE:
2132 {
2133 START_PROFILE(smb2_create);
2134 return_value = smbd_smb2_request_process_create(req);
2135 END_PROFILE(smb2_create);
2136 }
2137 break;
2138
2139 case SMB2_OP_CLOSE:
2140 {
2141 START_PROFILE(smb2_close);
2142 return_value = smbd_smb2_request_process_close(req);
2143 END_PROFILE(smb2_close);
2144 }
2145 break;
2146
2147 case SMB2_OP_FLUSH:
2148 {
2149 START_PROFILE(smb2_flush);
2150 return_value = smbd_smb2_request_process_flush(req);
2151 END_PROFILE(smb2_flush);
2152 }
2153 break;
2154
2155 case SMB2_OP_READ:
2156 {
2157 START_PROFILE(smb2_read);
2158 return_value = smbd_smb2_request_process_read(req);
2159 END_PROFILE(smb2_read);
2160 }
2161 break;
2162
2163 case SMB2_OP_WRITE:
2164 {
2165 START_PROFILE(smb2_write);
2166 return_value = smbd_smb2_request_process_write(req);
2167 END_PROFILE(smb2_write);
2168 }
2169 break;
2170
2171 case SMB2_OP_LOCK:
2172 {
2173 START_PROFILE(smb2_lock);
2174 return_value = smbd_smb2_request_process_lock(req);
2175 END_PROFILE(smb2_lock);
2176 }
2177 break;
2178
2179 case SMB2_OP_IOCTL:
2180 {
2181 START_PROFILE(smb2_ioctl);
2182 return_value = smbd_smb2_request_process_ioctl(req);
2183 END_PROFILE(smb2_ioctl);
2184 }
2185 break;
2186
2187 case SMB2_OP_CANCEL:
2188 {
2189 START_PROFILE(smb2_cancel);
2190 return_value = smbd_smb2_request_process_cancel(req);
2191 END_PROFILE(smb2_cancel);
2192 }
2193 break;
2194
2195 case SMB2_OP_KEEPALIVE:
2196 {
2197 START_PROFILE(smb2_keepalive);
2198 return_value = smbd_smb2_request_process_keepalive(req);
2199 END_PROFILE(smb2_keepalive);
2200 }
2201 break;
2202
2203 case SMB2_OP_FIND:
2204 {
2205 START_PROFILE(smb2_find);
2206 return_value = smbd_smb2_request_process_find(req);
2207 END_PROFILE(smb2_find);
2208 }
2209 break;
2210
2211 case SMB2_OP_NOTIFY:
2212 {
2213 START_PROFILE(smb2_notify);
2214 return_value = smbd_smb2_request_process_notify(req);
2215 END_PROFILE(smb2_notify);
2216 }
2217 break;
2218
2219 case SMB2_OP_GETINFO:
2220 {
2221 START_PROFILE(smb2_getinfo);
2222 return_value = smbd_smb2_request_process_getinfo(req);
2223 END_PROFILE(smb2_getinfo);
2224 }
2225 break;
2226
2227 case SMB2_OP_SETINFO:
2228 {
2229 START_PROFILE(smb2_setinfo);
2230 return_value = smbd_smb2_request_process_setinfo(req);
2231 END_PROFILE(smb2_setinfo);
2232 }
2233 break;
2234
2235 case SMB2_OP_BREAK:
2236 {
2237 START_PROFILE(smb2_break);
2238 return_value = smbd_smb2_request_process_break(req);
2239 END_PROFILE(smb2_break);
2240 }
2241 break;
2242
2243 default:
2244 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2245 break;
2246 }
2247 return return_value;
2248 }
2249
2250 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
2251 {
2252 struct smbd_server_connection *sconn = req->sconn;
2253 struct smbXsrv_connection *conn = req->sconn->conn;
2254 int first_idx = 1;
2255 struct iovec *firsttf = SMBD_SMB2_IDX_TF_IOV(req,out,first_idx);
2256 struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
2257 struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
2258 NTSTATUS status;
2259
2260 req->subreq = NULL;
2261 TALLOC_FREE(req->async_te);
2262
2263 if (req->do_encryption &&
2264 (firsttf->iov_len == 0) &&
2265 (req->first_key.length == 0) &&
2266 (req->session != NULL) &&
2267 (req->session->global->encryption_key.length != 0))
2268 {
2269 DATA_BLOB encryption_key = req->session->global->encryption_key;
2270 uint8_t *tf;
2271 uint64_t session_id = req->session->global->session_wire_id;
2272 struct smbXsrv_session *x = req->session;
2273 uint64_t nonce_high;
2274 uint64_t nonce_low;
2275
2276 nonce_high = x->nonce_high;
2277 nonce_low = x->nonce_low;
2278
2279 x->nonce_low += 1;
2280 if (x->nonce_low == 0) {
2281 x->nonce_low += 1;
2282 x->nonce_high += 1;
2283 }
2284
2285 /*
2286 * We need to place the SMB2_TRANSFORM header before the
2287 * first SMB2 header
2288 */
2289
2290 /*
2291 * we need to remember the encryption key
2292 * and defer the signing/encryption until
2293 * we are sure that we do not change
2294 * the header again.
2295 */
2296 req->first_key = data_blob_dup_talloc(req, encryption_key);
2297 if (req->first_key.data == NULL) {
2298 return NT_STATUS_NO_MEMORY;
2299 }
2300
2301 tf = talloc_zero_array(req->out.vector, uint8_t,
2302 SMB2_TF_HDR_SIZE);
2303 if (tf == NULL) {
2304 return NT_STATUS_NO_MEMORY;
2305 }
2306
2307 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2308 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2309 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2310 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
2311
2312 firsttf->iov_base = (void *)tf;
2313 firsttf->iov_len = SMB2_TF_HDR_SIZE;
2314 }
2315
2316 if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
2317 (req->last_key.length > 0) &&
2318 (firsttf->iov_len == 0))
2319 {
2320 int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
2321 struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
2322
2323 /*
2324 * As we are sure the header of the last request in the
2325 * compound chain will not change, we can to sign here
2326 * with the last signing key we remembered.
2327 */
2328 status = smb2_signing_sign_pdu(req->last_key,
2329 conn->protocol,
2330 lasthdr,
2331 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2332 if (!NT_STATUS_IS_OK(status)) {
2333 return status;
2334 }
2335 }
2336 data_blob_clear_free(&req->last_key);
2337
2338 req->current_idx += SMBD_SMB2_NUM_IOV_PER_REQ;
2339
2340 if (req->current_idx < req->out.vector_count) {
2341 /*
2342 * We must process the remaining compound
2343 * SMB2 requests before any new incoming SMB2
2344 * requests. This is because incoming SMB2
2345 * requests may include a cancel for a
2346 * compound request we haven't processed
2347 * yet.
2348 */
2349 struct tevent_immediate *im = tevent_create_immediate(req);
2350 if (!im) {
2351 return NT_STATUS_NO_MEMORY;
2352 }
2353
2354 if (req->do_signing && firsttf->iov_len == 0) {
2355 struct smbXsrv_session *x = req->session;
2356 DATA_BLOB signing_key = x->global->channels[0].signing_key;
2357
2358 /*
2359 * we need to remember the signing key
2360 * and defer the signing until
2361 * we are sure that we do not change
2362 * the header again.
2363 */
2364 req->last_key = data_blob_dup_talloc(req, signing_key);
2365 if (req->last_key.data == NULL) {
2366 return NT_STATUS_NO_MEMORY;
2367 }
2368 }
2369
2370 tevent_schedule_immediate(im,
2371 req->sconn->ev_ctx,
2372 smbd_smb2_request_dispatch_immediate,
2373 req);
2374 return NT_STATUS_OK;
2375 }
2376
2377 if (req->compound_related) {
2378 req->compound_related = false;
2379 }
2380
2381 smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
2382
2383 /* Set credit for these operations (zero credits if this
2384 is a final reply for an async operation). */
2385 smb2_calculate_credits(req, req);
2386
2387 /*
2388 * now check if we need to sign the current response
2389 */
2390 if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
2391 status = smb2_signing_encrypt_pdu(req->first_key,
2392 conn->protocol,
2393 firsttf,
2394 req->out.vector_count - first_idx);
2395 if (!NT_STATUS_IS_OK(status)) {
2396 return status;
2397 }
2398 } else if (req->do_signing) {
2399 struct smbXsrv_session *x = req->session;
2400 DATA_BLOB signing_key = x->global->channels[0].signing_key;
2401
2402 status = smb2_signing_sign_pdu(signing_key,
2403 conn->protocol,
2404 outhdr,
2405 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2406 if (!NT_STATUS_IS_OK(status)) {
2407 return status;
2408 }
2409 }
2410 data_blob_clear_free(&req->first_key);
2411
2412 /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
2413 if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
2414 outdyn->iov_base == NULL && outdyn->iov_len != 0) {
2415 /* Dynamic part is NULL. Chop it off,
2416 We're going to send it via sendfile. */
2417 req->out.vector_count -= 1;
2418 }
2419
2420 /*
2421 * We're done with this request -
2422 * move it off the "being processed" queue.
2423 */
2424 DLIST_REMOVE(req->sconn->smb2.requests, req);
2425
2426 req->queue_entry.mem_ctx = req;
2427 req->queue_entry.vector = req->out.vector;
2428 req->queue_entry.count = req->out.vector_count;
2429 DLIST_ADD_END(req->sconn->smb2.send_queue, &req->queue_entry, NULL);
2430 req->sconn->smb2.send_queue_len++;
2431
2432 status = smbd_smb2_io_handler(sconn, TEVENT_FD_WRITE);
2433 if (!NT_STATUS_IS_OK(status)) {
2434 return status;
2435 }
2436
2437 return NT_STATUS_OK;
2438 }
2439
2440 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn);
2441
2442 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
2443 struct tevent_immediate *im,
2444 void *private_data)
2445 {
2446 struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
2447 struct smbd_smb2_request);
2448 struct smbd_server_connection *sconn = req->sconn;
2449 NTSTATUS status;
2450
2451 TALLOC_FREE(im);
2452
2453 if (DEBUGLEVEL >= 10) {
2454 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
2455 req->current_idx, req->in.vector_count));
2456 print_req_vectors(req);
2457 }
2458
2459 status = smbd_smb2_request_dispatch(req);
2460 if (!NT_STATUS_IS_OK(status)) {
2461 smbd_server_connection_terminate(sconn, nt_errstr(status));
2462 return;
2463 }
2464
2465 status = smbd_smb2_request_next_incoming(sconn);
2466 if (!NT_STATUS_IS_OK(status)) {
2467 smbd_server_connection_terminate(sconn, nt_errstr(status));
2468 return;
2469 }
2470 }
2471
2472 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
2473 NTSTATUS status,
2474 DATA_BLOB body, DATA_BLOB *dyn,
2475 const char *location)
2476 {
2477 uint8_t *outhdr;
2478 struct iovec *outbody_v;
2479 struct iovec *outdyn_v;
2480 uint32_t next_command_ofs;
2481
2482 DEBUG(10,("smbd_smb2_request_done_ex: "
2483 "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
2484 req->current_idx, nt_errstr(status), (unsigned int)body.length,
2485 dyn ? "yes": "no",
2486 (unsigned int)(dyn ? dyn->length : 0),
2487 location));
2488
2489 if (body.length < 2) {
2490 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2491 }
2492
2493 if ((body.length % 2) != 0) {
2494 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2495 }
2496
2497 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2498 outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
2499 outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
2500
2501 next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
2502 SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
2503
2504 outbody_v->iov_base = (void *)body.data;
2505 outbody_v->iov_len = body.length;
2506
2507 if (dyn) {
2508 outdyn_v->iov_base = (void *)dyn->data;
2509 outdyn_v->iov_len = dyn->length;
2510 } else {
2511 outdyn_v->iov_base = NULL;
2512 outdyn_v->iov_len = 0;
2513 }
2514
2515 /* see if we need to recalculate the offset to the next response */
2516 if (next_command_ofs > 0) {
2517 next_command_ofs = SMB2_HDR_BODY;
2518 next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
2519 next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
2520 }
2521
2522 if ((next_command_ofs % 8) != 0) {
2523 size_t pad_size = 8 - (next_command_ofs % 8);
2524 if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
2525 /*
2526 * if the dyn buffer is empty
2527 * we can use it to add padding
2528 */
2529 uint8_t *pad;
2530
2531 pad = talloc_zero_array(req->out.vector,
2532 uint8_t, pad_size);
2533 if (pad == NULL) {
2534 return smbd_smb2_request_error(req,
2535 NT_STATUS_NO_MEMORY);
2536 }
2537
2538 outdyn_v->iov_base = (void *)pad;
2539 outdyn_v->iov_len = pad_size;
2540 } else {
2541 /*
2542 * For now we copy the dynamic buffer
2543 * and add the padding to the new buffer
2544 */
2545 size_t old_size;
2546 uint8_t *old_dyn;
2547 size_t new_size;
2548 uint8_t *new_dyn;
2549
2550 old_size = SMBD_SMB2_OUT_DYN_LEN(req);
2551 old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
2552
2553 new_size = old_size + pad_size;
2554 new_dyn = talloc_zero_array(req->out.vector,
2555 uint8_t, new_size);
2556 if (new_dyn == NULL) {
2557 return smbd_smb2_request_error(req,
2558 NT_STATUS_NO_MEMORY);
2559 }
2560
2561 memcpy(new_dyn, old_dyn, old_size);
2562 memset(new_dyn + old_size, 0, pad_size);
2563
2564 outdyn_v->iov_base = (void *)new_dyn;
2565 outdyn_v->iov_len = new_size;
2566 }
2567 next_command_ofs += pad_size;
2568 }
2569
2570 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
2571
2572 return smbd_smb2_request_reply(req);
2573 }
2574
2575 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
2576 NTSTATUS status,
2577 DATA_BLOB *info,
2578 const char *location)
2579 {
2580 DATA_BLOB body;
2581 uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2582 size_t unread_bytes = smbd_smb2_unread_bytes(req);
2583
2584 DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
2585 req->current_idx, nt_errstr(status), info ? " +info" : "",
2586 location));
2587
2588 if (unread_bytes) {
2589 /* Recvfile error. Drain incoming socket. */
2590 size_t ret;
2591
2592 errno = 0;
2593 ret = drain_socket(req->sconn->sock, unread_bytes);
2594 if (ret != unread_bytes) {
2595 NTSTATUS error;
2596
2597 if (errno == 0) {
2598 error = NT_STATUS_IO_DEVICE_ERROR;
2599 } else {
2600 error = map_nt_error_from_unix_common(errno);
2601 }
2602
2603 DEBUG(2, ("Failed to drain %u bytes from SMB2 socket: "
2604 "ret[%u] errno[%d] => %s\n",
2605 (unsigned)unread_bytes,
2606 (unsigned)ret, errno, nt_errstr(error)));
2607 return error;
2608 }
2609 }
2610
2611 body.data = outhdr + SMB2_HDR_BODY;
2612 body.length = 8;
2613 SSVAL(body.data, 0, 9);
2614
2615 if (info) {
2616 SIVAL(body.data, 0x04, info->length);
2617 } else {
2618 /* Allocated size of req->out.vector[i].iov_base
2619 * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
2620 * 1 byte without having to do an alloc.
2621 */
2622 info = talloc_zero_array(req->out.vector,
2623 DATA_BLOB,
2624 1);
2625 if (!info) {
2626 return NT_STATUS_NO_MEMORY;
2627 }
2628 info->data = ((uint8_t *)outhdr) +
2629 OUTVEC_ALLOC_SIZE - 1;
2630 info->length = 1;
2631 SCVAL(info->data, 0, 0);
2632 }
2633
2634 /*
2635 * Note: Even if there is an error, continue to process the request.
2636 * per MS-SMB2.
2637 */
2638
2639 return smbd_smb2_request_done_ex(req, status, body, info, __location__);
2640 }
2641
2642
2643 struct smbd_smb2_send_oplock_break_state {
2644 struct smbd_server_connection *sconn;
2645 struct smbd_smb2_send_queue queue_entry;
2646 uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x18];
2647 struct iovec vector[1+SMBD_SMB2_NUM_IOV_PER_REQ];
2648 };
2649
2650 NTSTATUS smbd_smb2_send_oplock_break(struct smbd_server_connection *sconn,
2651 struct smbXsrv_session *session,
2652 struct smbXsrv_tcon *tcon,
2653 struct smbXsrv_open *op,
2654 uint8_t oplock_level)
2655 {
2656 struct smbd_smb2_send_oplock_break_state *state;
2657 struct smbXsrv_connection *conn = sconn->conn;
2658 uint8_t *tf;
2659 size_t tf_len;
2660 uint8_t *hdr;
2661 uint8_t *body;
2662 size_t body_len;
2663 uint8_t *dyn;
2664 size_t dyn_len;
2665 bool do_encryption = session->global->encryption_required;
2666 uint64_t nonce_high = 0;
2667 uint64_t nonce_low = 0;
2668 NTSTATUS status;
2669
2670 if (tcon->global->encryption_required) {
2671 do_encryption = true;
2672 }
2673
2674 state = talloc(sconn, struct smbd_smb2_send_oplock_break_state);
2675 if (state == NULL) {
2676 return NT_STATUS_NO_MEMORY;
2677 }
2678 state->sconn = sconn;
2679
2680 tf = state->buf + NBT_HDR_SIZE;
2681 tf_len = SMB2_TF_HDR_SIZE;
2682 hdr = tf + tf_len;
2683 body = hdr + SMB2_HDR_BODY;
2684 body_len = 0x18;
2685 dyn = body + body_len;
2686 dyn_len = 0;
2687
2688 if (do_encryption) {
2689 nonce_high = session->nonce_high;
2690 nonce_low = session->nonce_low;
2691
2692 session->nonce_low += 1;
2693 if (session->nonce_low == 0) {
2694 session->nonce_low += 1;
2695 session->nonce_high += 1;
2696 }
2697 }
2698
2699 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2700 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2701 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2702 SBVAL(tf, SMB2_TF_SESSION_ID, session->global->session_wire_id);
2703
2704 SIVAL(hdr, 0, SMB2_MAGIC);
2705 SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
2706 SSVAL(hdr, SMB2_HDR_EPOCH, 0);
2707 SIVAL(hdr, SMB2_HDR_STATUS, 0);
2708 SSVAL(hdr, SMB2_HDR_OPCODE, SMB2_OP_BREAK);
2709 SSVAL(hdr, SMB2_HDR_CREDIT, 0);
2710 SIVAL(hdr, SMB2_HDR_FLAGS, SMB2_HDR_FLAG_REDIRECT);
2711 SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
2712 SBVAL(hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
2713 SIVAL(hdr, SMB2_HDR_PID, 0);
2714 SIVAL(hdr, SMB2_HDR_TID, 0);
2715 SBVAL(hdr, SMB2_HDR_SESSION_ID, 0);
2716 memset(hdr+SMB2_HDR_SIGNATURE, 0, 16);
2717
2718 SSVAL(body, 0x00, body_len);
2719
2720 SCVAL(body, 0x02, oplock_level);
2721 SCVAL(body, 0x03, 0); /* reserved */
2722 SIVAL(body, 0x04, 0); /* reserved */
2723 SBVAL(body, 0x08, op->global->open_persistent_id);
2724 SBVAL(body, 0x10, op->global->open_volatile_id);
2725
2726 state->vector[0].iov_base = (void *)state->buf;
2727 state->vector[0].iov_len = NBT_HDR_SIZE;
2728
2729 if (do_encryption) {
2730 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
2731 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
2732 } else {
2733 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
2734 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
2735 }
2736
2737 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base = hdr;
2738 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
2739
2740 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
2741 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len = body_len;
2742
2743 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
2744 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len = dyn_len;
2745
2746 smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
2747
2748 if (do_encryption) {
2749 DATA_BLOB encryption_key = session->global->encryption_key;
2750
2751 status = smb2_signing_encrypt_pdu(encryption_key,
2752 conn->protocol,
2753 &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
2754 SMBD_SMB2_NUM_IOV_PER_REQ);
2755 if (!NT_STATUS_IS_OK(status)) {
2756 return status;
2757 }
2758 }
2759
2760 state->queue_entry.mem_ctx = state;
2761 state->queue_entry.vector = state->vector;
2762 state->queue_entry.count = ARRAY_SIZE(state->vector);
2763 DLIST_ADD_END(state->sconn->smb2.send_queue, &state->queue_entry, NULL);
2764 state->sconn->smb2.send_queue_len++;
2765
2766 status = smbd_smb2_io_handler(sconn, TEVENT_FD_WRITE);
2767 if (!NT_STATUS_IS_OK(status)) {
2768 return status;
2769 }
2770
2771 return NT_STATUS_OK;
2772 }
2773
2774 static size_t get_min_receive_file_size(struct smbd_smb2_request *smb2_req)
2775 {
2776 if (smb2_req->do_signing) {
2777 return 0;
2778 }
2779 if (smb2_req->do_encryption) {
2780 return 0;
2781 }
2782 return (size_t)lp_min_receive_file_size();
2783 }
2784
2785 static bool is_smb2_recvfile_write(struct smbd_smb2_request_read_state *state)
2786 {
2787 uint32_t flags;
2788
2789 if (IVAL(state->pktbuf, 0) == SMB2_TF_MAGIC) {
2790 /* Transform header. Cannot recvfile. */
2791 return false;
2792 }
2793 if (IVAL(state->pktbuf, 0) != SMB2_MAGIC) {
2794 /* Not SMB2. Normal error path will cope. */
2795 return false;
2796 }
2797 if (SVAL(state->pktbuf, 4) != SMB2_HDR_BODY) {
2798 /* Not SMB2. Normal error path will cope. */
2799 return false;
2800 }
2801 if (SVAL(state->pktbuf, SMB2_HDR_OPCODE) != SMB2_OP_WRITE) {
2802 /* Needs to be a WRITE. */
2803 return false;
2804 }
2805 if (IVAL(state->pktbuf, SMB2_HDR_NEXT_COMMAND) != 0) {
2806 /* Chained. Cannot recvfile. */
2807 return false;
2808 }
2809 flags = IVAL(state->pktbuf, SMB2_HDR_FLAGS);
2810 if (flags & SMB2_HDR_FLAG_CHAINED) {
2811 /* Chained. Cannot recvfile. */
2812 return false;
2813 }
2814 if (flags & SMB2_HDR_FLAG_SIGNED) {
2815 /* Signed. Cannot recvfile. */
2816 return false;
2817 }
2818
2819 DEBUG(10,("Doing recvfile write len = %u\n",
2820 (unsigned int)(state->pktlen -
2821 SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN)));
2822
2823 return true;
2824 }
2825
2826 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn)
2827 {
2828 struct smbd_smb2_request_read_state *state = &sconn->smb2.request_read_state;
2829 size_t max_send_queue_len;
2830 size_t cur_send_queue_len;
2831
2832 if (state->req != NULL) {
2833 /*
2834 * if there is already a tstream_readv_pdu
2835 * pending, we are done.
2836 */
2837 return NT_STATUS_OK;
2838 }
2839
2840 max_send_queue_len = MAX(1, sconn->smb2.max_credits/16);
2841 cur_send_queue_len = sconn->smb2.send_queue_len;
2842
2843 if (cur_send_queue_len > max_send_queue_len) {
2844 /*
2845 * if we have a lot of requests to send,
2846 * we wait until they are on the wire until we
2847 * ask for the next request.
2848 */
2849 return NT_STATUS_OK;
2850 }
2851
2852 /* ask for the next request */
2853 ZERO_STRUCTP(state);
2854 state->req = smbd_smb2_request_allocate(sconn);
2855 if (state->req == NULL) {
2856 return NT_STATUS_NO_MEMORY;
2857 }
2858 state->req->sconn = sconn;
2859 state->min_recv_size = get_min_receive_file_size(state->req);
2860
2861 TEVENT_FD_READABLE(sconn->smb2.fde);
2862
2863 return NT_STATUS_OK;
2864 }
2865
2866 void smbd_smb2_first_negprot(struct smbd_server_connection *sconn,
2867 uint8_t *inbuf, size_t size)
2868 {
2869 NTSTATUS status;
2870 struct smbd_smb2_request *req = NULL;
2871
2872 DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
2873 (unsigned int)size));
2874
2875 status = smbd_initialize_smb2(sconn);
2876 if (!NT_STATUS_IS_OK(status)) {
2877 smbd_server_connection_terminate(sconn, nt_errstr(status));
2878 return;
2879 }
2880
2881 status = smbd_smb2_request_create(sconn, inbuf, size, &req);
2882 if (!NT_STATUS_IS_OK(status)) {
2883 smbd_server_connection_terminate(sconn, nt_errstr(status));
2884 return;
2885 }
2886
2887 status = smbd_smb2_request_validate(req);
2888 if (!NT_STATUS_IS_OK(status)) {
2889 smbd_server_connection_terminate(sconn, nt_errstr(status));
2890 return;
2891 }
2892
2893 status = smbd_smb2_request_setup_out(req);
2894 if (!NT_STATUS_IS_OK(status)) {
2895 smbd_server_connection_terminate(sconn, nt_errstr(status));
2896 return;
2897 }
2898
2899 status = smbd_smb2_request_dispatch(req);
2900 if (!NT_STATUS_IS_OK(status)) {
2901 smbd_server_connection_terminate(sconn, nt_errstr(status));
2902 return;
2903 }
2904
2905 status = smbd_smb2_request_next_incoming(sconn);
2906 if (!NT_STATUS_IS_OK(status)) {
2907 smbd_server_connection_terminate(sconn, nt_errstr(status));
2908 return;
2909 }
2910
2911 sconn->num_requests++;
2912 }
2913
2914 static int socket_error_from_errno(int ret,
2915 int sys_errno,
2916 bool *retry)
2917 {
2918 *retry = false;
2919
2920 if (ret >= 0) {
2921 return 0;
2922 }
2923
2924 if (ret != -1) {
2925 return EIO;
2926 }
2927
2928 if (sys_errno == 0) {
2929 return EIO;
2930 }
2931
2932 if (sys_errno == EINTR) {
2933 *retry = true;
2934 return sys_errno;
2935 }
2936
2937 if (sys_errno == EINPROGRESS) {
2938 *retry = true;
2939 return sys_errno;
2940 }
2941
2942 if (sys_errno == EAGAIN) {
2943 *retry = true;
2944 return sys_errno;
2945 }
2946
2947 /* ENOMEM is retryable on Solaris/illumos, and possibly other systems. */
2948 if (sys_errno == ENOMEM) {
2949 *retry = true;
2950 return sys_errno;
2951 }
2952
2953 #ifdef EWOULDBLOCK
2954 if (sys_errno == EWOULDBLOCK) {
2955 *retry = true;
2956 return sys_errno;
2957 }
2958 #endif
2959
2960 return sys_errno;
2961 }
2962
2963 static NTSTATUS smbd_smb2_flush_send_queue(struct smbd_server_connection *sconn)
2964 {
2965 int ret;
2966 int err;
2967 bool retry;
2968
2969 if (sconn->smb2.send_queue == NULL) {
2970 TEVENT_FD_NOT_WRITEABLE(sconn->smb2.fde);
2971 return NT_STATUS_OK;
2972 }
2973
2974 while (sconn->smb2.send_queue != NULL) {
2975 struct smbd_smb2_send_queue *e = sconn->smb2.send_queue;
2976
2977 ret = writev(sconn->sock, e->vector, e->count);
2978 if (ret == 0) {
2979 /* propagate end of file */
2980 return NT_STATUS_INTERNAL_ERROR;
2981 }
2982 err = socket_error_from_errno(ret, errno, &retry);
2983 if (retry) {
2984 /* retry later */
2985 TEVENT_FD_WRITEABLE(sconn->smb2.fde);
2986 return NT_STATUS_OK;
2987 }
2988 if (err != 0) {
2989 return map_nt_error_from_unix_common(err);
2990 }
2991 while (ret > 0) {
2992 if (ret < e->vector[0].iov_len) {
2993 uint8_t *base;
2994 base = (uint8_t *)e->vector[0].iov_base;
2995 base += ret;
2996 e->vector[0].iov_base = (void *)base;
2997 e->vector[0].iov_len -= ret;
2998 break;
2999 }
3000 ret -= e->vector[0].iov_len;
3001 e->vector += 1;
3002 e->count -= 1;
3003 }
3004
3005 /*
3006 * there're maybe some empty vectors at the end
3007 * which we need to skip, otherwise we would get
3008 * ret == 0 from the readv() call and return EPIPE
3009 */
3010 while (e->count > 0) {
3011 if (e->vector[0].iov_len > 0) {
3012 break;
3013 }
3014 e->vector += 1;
3015 e->count -= 1;
3016 }
3017
3018 if (e->count > 0) {
3019 /* we have more to write */
3020 TEVENT_FD_WRITEABLE(sconn->smb2.fde);
3021 return NT_STATUS_OK;
3022 }
3023
3024 sconn->smb2.send_queue_len--;
3025 DLIST_REMOVE(sconn->smb2.send_queue, e);
3026 talloc_free(e->mem_ctx);
3027 }
3028
3029 return NT_STATUS_OK;
3030 }
3031
3032 static NTSTATUS smbd_smb2_io_handler(struct smbd_server_connection *sconn,
3033 uint16_t fde_flags)
3034 {
3035 struct smbd_smb2_request_read_state *state = &sconn->smb2.request_read_state;
3036 struct smbd_smb2_request *req = NULL;
3037 size_t min_recvfile_size = UINT32_MAX;
3038 int ret;
3039 int err;
3040 bool retry;
3041 NTSTATUS status;
3042 NTTIME now;
3043
3044 if (fde_flags & TEVENT_FD_WRITE) {
3045 status = smbd_smb2_flush_send_queue(sconn);
3046 if (!NT_STATUS_IS_OK(status)) {
3047 return status;
3048 }
3049 }
3050
3051 if (!(fde_flags & TEVENT_FD_READ)) {
3052 return NT_STATUS_OK;
3053 }
3054
3055 if (state->req == NULL) {
3056 TEVENT_FD_NOT_READABLE(sconn->smb2.fde);
3057 return NT_STATUS_OK;
3058 }
3059
3060 again:
3061 if (!state->hdr.done) {
3062 state->hdr.done = true;
3063
3064 state->vector.iov_base = (void *)state->hdr.nbt;
3065 state->vector.iov_len = NBT_HDR_SIZE;
3066 }
3067
3068 ret = readv(sconn->sock, &state->vector, 1);
3069 if (ret == 0) {
3070 /* propagate end of file */
3071 return NT_STATUS_END_OF_FILE;
3072 }
3073 err = socket_error_from_errno(ret, errno, &retry);
3074 if (retry) {
3075 /* retry later */
3076 TEVENT_FD_READABLE(sconn->smb2.fde);
3077 return NT_STATUS_OK;
3078 }
3079 if (err != 0) {
3080 return map_nt_error_from_unix_common(err);
3081 }
3082
3083 if (ret < state->vector.iov_len) {
3084 uint8_t *base;
3085 base = (uint8_t *)state->vector.iov_base;
3086 base += ret;
3087 state->vector.iov_base = (void *)base;
3088 state->vector.iov_len -= ret;
3089 /* we have more to read */
3090 TEVENT_FD_READABLE(sconn->smb2.fde);
3091 return NT_STATUS_OK;
3092 }
3093
3094 if (state->pktlen > 0) {
3095 if (state->doing_receivefile && !is_smb2_recvfile_write(state)) {
3096 /*
3097 * Not a possible receivefile write.
3098 * Read the rest of the data.
3099 */
3100 state->doing_receivefile = false;
3101 state->vector.iov_base = (void *)(state->pktbuf +
3102 SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN);
3103 state->vector.iov_len = (state->pktlen -
3104 SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN);
3105 goto again;
3106 }
3107
3108 /*
3109 * Either this is a receivefile write so we've
3110 * done a short read, or if not we have all the data.
3111 */
3112 goto got_full;
3113 }
3114
3115 /*
3116 * Now we analyze the NBT header
3117 */
3118 state->pktlen = smb2_len(state->hdr.nbt);
3119 if (state->pktlen == 0) {
3120 goto got_full;
3121 }
3122
3123 state->pktbuf = talloc_array(state->req, uint8_t, state->pktlen);
3124 if (state->pktbuf == NULL) {
3125 return NT_STATUS_NO_MEMORY;
3126 }
3127
3128 state->vector.iov_base = (void *)state->pktbuf;
3129
3130 if (state->min_recv_size != 0) {
3131 min_recvfile_size = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3132 min_recvfile_size += state->min_recv_size;
3133 }
3134
3135 if (state->pktlen > min_recvfile_size) {
3136 /*
3137 * Might be a receivefile write. Read the SMB2 HEADER +
3138 * SMB2_WRITE header first. Set 'doing_receivefile'
3139 * as we're *attempting* receivefile write. If this
3140 * turns out not to be a SMB2_WRITE request or otherwise
3141 * not suitable then we'll just read the rest of the data
3142 * the next time this function is called.
3143 */
3144 state->vector.iov_len = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3145 state->doing_receivefile = true;
3146 } else {
3147 state->vector.iov_len = state->pktlen;
3148 }
3149
3150 goto again;
3151
3152 got_full:
3153
3154 if (state->hdr.nbt[0] != 0x00) {
3155 DEBUG(1,("ignore NBT[0x%02X] msg\n",
3156 state->hdr.nbt[0]));
3157
3158 req = state->req;
3159 ZERO_STRUCTP(state);
3160 state->req = req;
3161 state->min_recv_size = get_min_receive_file_size(state->req);
3162 req = NULL;
3163 goto again;
3164 }
3165
3166 req = state->req;
3167 state->req = NULL;
3168
3169 req->request_time = timeval_current();
3170 now = timeval_to_nttime(&req->request_time);
3171
3172 status = smbd_smb2_inbuf_parse_compound(req->sconn->conn,
3173 now,
3174 state->pktbuf,
3175 state->pktlen,
3176 req,
3177 &req->in.vector,
3178 &req->in.vector_count);
3179 if (!NT_STATUS_IS_OK(status)) {
3180 return status;
3181 }
3182
3183 if (state->doing_receivefile) {
3184 req->smb1req = talloc_zero(req, struct smb_request);
3185 if (req->smb1req == NULL) {
3186 return NT_STATUS_NO_MEMORY;
3187 }
3188 req->smb1req->unread_bytes =
3189 state->pktlen - SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3190 }
3191
3192 ZERO_STRUCTP(state);
3193
3194 req->current_idx = 1;
3195
3196 DEBUG(10,("smbd_smb2_request idx[%d] of %d vectors\n",
3197 req->current_idx, req->in.vector_count));
3198
3199 status = smbd_smb2_request_validate(req);
3200 if (!NT_STATUS_IS_OK(status)) {
3201 return status;
3202 }
3203
3204 status = smbd_smb2_request_setup_out(req);
3205 if (!NT_STATUS_IS_OK(status)) {
3206 return status;
3207 }
3208
3209 status = smbd_smb2_request_dispatch(req);
3210 if (!NT_STATUS_IS_OK(status)) {
3211 return status;
3212 }
3213
3214 sconn->num_requests++;
3215
3216 /* The timeout_processing function isn't run nearly
3217 often enough to implement 'max log size' without
3218 overrunning the size of the file by many megabytes.
3219 This is especially true if we are running at debug
3220 level 10. Checking every 50 SMB2s is a nice
3221 tradeoff of performance vs log file size overrun. */
3222
3223 if ((sconn->num_requests % 50) == 0 &&
3224 need_to_check_log_size()) {
3225 change_to_root_user();
3226 check_log_size();
3227 }
3228
3229 status = smbd_smb2_request_next_incoming(sconn);
3230 if (!NT_STATUS_IS_OK(status)) {
3231 return status;
3232 }
3233
3234 return NT_STATUS_OK;
3235 }
3236
3237 static void smbd_smb2_connection_handler(struct tevent_context *ev,
3238 struct tevent_fd *fde,
3239 uint16_t flags,
3240 void *private_data)
3241 {
3242 struct smbd_server_connection *sconn =
3243 talloc_get_type_abort(private_data,
3244 struct smbd_server_connection);
3245 NTSTATUS status;
3246
3247 status = smbd_smb2_io_handler(sconn, flags);
3248 if (!NT_STATUS_IS_OK(status)) {
3249 smbd_server_connection_terminate(sconn, nt_errstr(status));
3250 return;
3251 }
3252 }
Samba GIT mirror