?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smb2_server: use req->xconn in smbd_smb2_request_check_session()
[Samba.git] / source3 / smbd / smb2_server.c
blob04f1e4ee7838d7e806a53ac878acc6bc3808673b
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "smbprofile.h"
29 #include "../lib/util/bitmap.h"
30 #include "../librpc/gen_ndr/krb5pac.h"
31 #include "auth.h"
32
33 static void smbd_smb2_connection_handler(struct tevent_context *ev,
34 struct tevent_fd *fde,
35 uint16_t flags,
36 void *private_data);
37 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn);
38
39 static const struct smbd_smb2_dispatch_table {
40 uint16_t opcode;
41 const char *name;
42 bool need_session;
43 bool need_tcon;
44 bool as_root;
45 uint16_t fileid_ofs;
46 bool allow_invalid_fileid;
47 } smbd_smb2_table[] = {
48 #define _OP(o) .opcode = o, .name = #o
49 {
50 _OP(SMB2_OP_NEGPROT),
51 .as_root = true,
52 },{
53 _OP(SMB2_OP_SESSSETUP),
54 .as_root = true,
55 },{
56 _OP(SMB2_OP_LOGOFF),
57 .need_session = true,
58 .as_root = true,
59 },{
60 _OP(SMB2_OP_TCON),
61 .need_session = true,
62 /*
63 * This call needs to be run as root.
64 *
65 * smbd_smb2_request_process_tcon()
66 * calls make_connection_snum(), which will call
67 * change_to_user(), when needed.
68 */
69 .as_root = true,
70 },{
71 _OP(SMB2_OP_TDIS),
72 .need_session = true,
73 .need_tcon = true,
74 .as_root = true,
75 },{
76 _OP(SMB2_OP_CREATE),
77 .need_session = true,
78 .need_tcon = true,
79 },{
80 _OP(SMB2_OP_CLOSE),
81 .need_session = true,
82 .need_tcon = true,
83 .fileid_ofs = 0x08,
84 },{
85 _OP(SMB2_OP_FLUSH),
86 .need_session = true,
87 .need_tcon = true,
88 .fileid_ofs = 0x08,
89 },{
90 _OP(SMB2_OP_READ),
91 .need_session = true,
92 .need_tcon = true,
93 .fileid_ofs = 0x10,
94 },{
95 _OP(SMB2_OP_WRITE),
96 .need_session = true,
97 .need_tcon = true,
98 .fileid_ofs = 0x10,
99 },{
100 _OP(SMB2_OP_LOCK),
101 .need_session = true,
102 .need_tcon = true,
103 .fileid_ofs = 0x08,
104 },{
105 _OP(SMB2_OP_IOCTL),
106 .need_session = true,
107 .need_tcon = true,
108 .fileid_ofs = 0x08,
109 .allow_invalid_fileid = true,
110 },{
111 _OP(SMB2_OP_CANCEL),
112 .as_root = true,
113 },{
114 _OP(SMB2_OP_KEEPALIVE),
115 .as_root = true,
116 },{
117 _OP(SMB2_OP_FIND),
118 .need_session = true,
119 .need_tcon = true,
120 .fileid_ofs = 0x08,
121 },{
122 _OP(SMB2_OP_NOTIFY),
123 .need_session = true,
124 .need_tcon = true,
125 .fileid_ofs = 0x08,
126 },{
127 _OP(SMB2_OP_GETINFO),
128 .need_session = true,
129 .need_tcon = true,
130 .fileid_ofs = 0x18,
131 },{
132 _OP(SMB2_OP_SETINFO),
133 .need_session = true,
134 .need_tcon = true,
135 .fileid_ofs = 0x10,
136 },{
137 _OP(SMB2_OP_BREAK),
138 .need_session = true,
139 .need_tcon = true,
140 /*
141 * we do not set
142 * .fileid_ofs here
143 * as LEASE breaks does not
144 * have a file id
145 */
146 }
147 };
148
149 const char *smb2_opcode_name(uint16_t opcode)
150 {
151 if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
152 return "Bad SMB2 opcode";
153 }
154 return smbd_smb2_table[opcode].name;
155 }
156
157 static const struct smbd_smb2_dispatch_table *smbd_smb2_call(uint16_t opcode)
158 {
159 const struct smbd_smb2_dispatch_table *ret = NULL;
160
161 if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
162 return NULL;
163 }
164
165 ret = &smbd_smb2_table[opcode];
166
167 SMB_ASSERT(ret->opcode == opcode);
168
169 return ret;
170 }
171
172 static void print_req_vectors(const struct smbd_smb2_request *req)
173 {
174 int i;
175
176 for (i = 0; i < req->in.vector_count; i++) {
177 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
178 (unsigned int)i,
179 (unsigned int)req->in.vector[i].iov_len);
180 }
181 for (i = 0; i < req->out.vector_count; i++) {
182 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
183 (unsigned int)i,
184 (unsigned int)req->out.vector[i].iov_len);
185 }
186 }
187
188 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
189 {
190 if (size < (4 + SMB2_HDR_BODY)) {
191 return false;
192 }
193
194 if (IVAL(inbuf, 4) != SMB2_MAGIC) {
195 return false;
196 }
197
198 return true;
199 }
200
201 static NTSTATUS smbd_initialize_smb2(struct smbXsrv_connection *xconn)
202 {
203 TALLOC_FREE(xconn->transport.fde);
204
205 xconn->smb2.credits.seq_low = 0;
206 xconn->smb2.credits.seq_range = 1;
207 xconn->smb2.credits.granted = 1;
208 xconn->smb2.credits.max = lp_smb2_max_credits();
209 xconn->smb2.credits.bitmap = bitmap_talloc(xconn,
210 xconn->smb2.credits.max);
211 if (xconn->smb2.credits.bitmap == NULL) {
212 return NT_STATUS_NO_MEMORY;
213 }
214
215 xconn->transport.fde = tevent_add_fd(xconn->ev_ctx,
216 xconn,
217 xconn->transport.sock,
218 TEVENT_FD_READ,
219 smbd_smb2_connection_handler,
220 xconn);
221 if (xconn->transport.fde == NULL) {
222 return NT_STATUS_NO_MEMORY;
223 }
224
225 /* Ensure child is set to non-blocking mode */
226 set_blocking(xconn->transport.sock, false);
227 return NT_STATUS_OK;
228 }
229
230 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
231 #define _smb2_setlen(_buf,len) do { \
232 uint8_t *buf = (uint8_t *)_buf; \
233 buf[0] = 0; \
234 buf[1] = ((len)&0xFF0000)>>16; \
235 buf[2] = ((len)&0xFF00)>>8; \
236 buf[3] = (len)&0xFF; \
237 } while (0)
238
239 static void smb2_setup_nbt_length(struct iovec *vector, int count)
240 {
241 size_t len = 0;
242 int i;
243
244 for (i=1; i < count; i++) {
245 len += vector[i].iov_len;
246 }
247
248 _smb2_setlen(vector[0].iov_base, len);
249 }
250
251 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
252 {
253 if (req->first_key.length > 0) {
254 data_blob_clear_free(&req->first_key);
255 }
256 if (req->last_key.length > 0) {
257 data_blob_clear_free(&req->last_key);
258 }
259 return 0;
260 }
261
262 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
263 {
264 TALLOC_CTX *mem_pool;
265 struct smbd_smb2_request *req;
266
267 #if 0
268 /* Enable this to find subtle valgrind errors. */
269 mem_pool = talloc_init("smbd_smb2_request_allocate");
270 #else
271 mem_pool = talloc_tos();
272 #endif
273 if (mem_pool == NULL) {
274 return NULL;
275 }
276
277 req = talloc_zero(mem_pool, struct smbd_smb2_request);
278 if (req == NULL) {
279 talloc_free(mem_pool);
280 return NULL;
281 }
282 talloc_reparent(mem_pool, mem_ctx, req);
283 #if 0
284 TALLOC_FREE(mem_pool);
285 #endif
286
287 req->last_session_id = UINT64_MAX;
288 req->last_tid = UINT32_MAX;
289
290 talloc_set_destructor(req, smbd_smb2_request_destructor);
291
292 return req;
293 }
294
295 static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *xconn,
296 NTTIME now,
297 uint8_t *buf,
298 size_t buflen,
299 struct smbd_smb2_request *req,
300 struct iovec **piov,
301 int *pnum_iov)
302 {
303 TALLOC_CTX *mem_ctx = req;
304 struct iovec *iov;
305 int num_iov = 1;
306 size_t taken = 0;
307 uint8_t *first_hdr = buf;
308 size_t verified_buflen = 0;
309 uint8_t *tf = NULL;
310 size_t tf_len = 0;
311
312 /*
313 * Note: index '0' is reserved for the transport protocol
314 */
315 iov = req->in._vector;
316
317 while (taken < buflen) {
318 size_t len = buflen - taken;
319 uint8_t *hdr = first_hdr + taken;
320 struct iovec *cur;
321 size_t full_size;
322 size_t next_command_ofs;
323 uint16_t body_size;
324 uint8_t *body = NULL;
325 uint32_t dyn_size;
326 uint8_t *dyn = NULL;
327 struct iovec *iov_alloc = NULL;
328
329 if (iov != req->in._vector) {
330 iov_alloc = iov;
331 }
332
333 if (verified_buflen > taken) {
334 len = verified_buflen - taken;
335 } else {
336 tf = NULL;
337 tf_len = 0;
338 }
339
340 if (len < 4) {
341 DEBUG(10, ("%d bytes left, expected at least %d\n",
342 (int)len, 4));
343 goto inval;
344 }
345 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
346 struct smbXsrv_session *s = NULL;
347 uint64_t uid;
348 struct iovec tf_iov[2];
349 NTSTATUS status;
350 size_t enc_len;
351
352 if (xconn->protocol < PROTOCOL_SMB2_24) {
353 DEBUG(10, ("Got SMB2_TRANSFORM header, "
354 "but dialect[0x%04X] is used\n",
355 xconn->smb2.server.dialect));
356 goto inval;
357 }
358
359 if (!(xconn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
360 DEBUG(10, ("Got SMB2_TRANSFORM header, "
361 "but not negotiated "
362 "client[0x%08X] server[0x%08X]\n",
363 xconn->smb2.client.capabilities,
364 xconn->smb2.server.capabilities));
365 goto inval;
366 }
367
368 if (len < SMB2_TF_HDR_SIZE) {
369 DEBUG(1, ("%d bytes left, expected at least %d\n",
370 (int)len, SMB2_TF_HDR_SIZE));
371 goto inval;
372 }
373 tf = hdr;
374 tf_len = SMB2_TF_HDR_SIZE;
375 taken += tf_len;
376
377 hdr = first_hdr + taken;
378 enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
379 uid = BVAL(tf, SMB2_TF_SESSION_ID);
380
381 if (len < SMB2_TF_HDR_SIZE + enc_len) {
382 DEBUG(1, ("%d bytes left, expected at least %d\n",
383 (int)len,
384 (int)(SMB2_TF_HDR_SIZE + enc_len)));
385 goto inval;
386 }
387
388 status = smb2srv_session_lookup(xconn, uid, now, &s);
389 if (s == NULL) {
390 DEBUG(1, ("invalid session[%llu] in "
391 "SMB2_TRANSFORM header\n",
392 (unsigned long long)uid));
393 TALLOC_FREE(iov_alloc);
394 return NT_STATUS_USER_SESSION_DELETED;
395 }
396
397 tf_iov[0].iov_base = (void *)tf;
398 tf_iov[0].iov_len = tf_len;
399 tf_iov[1].iov_base = (void *)hdr;
400 tf_iov[1].iov_len = enc_len;
401
402 status = smb2_signing_decrypt_pdu(s->global->decryption_key,
403 xconn->protocol,
404 tf_iov, 2);
405 if (!NT_STATUS_IS_OK(status)) {
406 TALLOC_FREE(iov_alloc);
407 return status;
408 }
409
410 verified_buflen = taken + enc_len;
411 len = enc_len;
412 }
413
414 /*
415 * We need the header plus the body length field
416 */
417
418 if (len < SMB2_HDR_BODY + 2) {
419 DEBUG(10, ("%d bytes left, expected at least %d\n",
420 (int)len, SMB2_HDR_BODY));
421 goto inval;
422 }
423 if (IVAL(hdr, 0) != SMB2_MAGIC) {
424 DEBUG(10, ("Got non-SMB2 PDU: %x\n",
425 IVAL(hdr, 0)));
426 goto inval;
427 }
428 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
429 DEBUG(10, ("Got HDR len %d, expected %d\n",
430 SVAL(hdr, 4), SMB2_HDR_BODY));
431 goto inval;
432 }
433
434 full_size = len;
435 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
436 body_size = SVAL(hdr, SMB2_HDR_BODY);
437
438 if (next_command_ofs != 0) {
439 if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
440 goto inval;
441 }
442 if (next_command_ofs > full_size) {
443 goto inval;
444 }
445 full_size = next_command_ofs;
446 }
447 if (body_size < 2) {
448 goto inval;
449 }
450 body_size &= 0xfffe;
451
452 if (body_size > (full_size - SMB2_HDR_BODY)) {
453 /*
454 * let the caller handle the error
455 */
456 body_size = full_size - SMB2_HDR_BODY;
457 }
458 body = hdr + SMB2_HDR_BODY;
459 dyn = body + body_size;
460 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
461
462 if (num_iov >= ARRAY_SIZE(req->in._vector)) {
463 struct iovec *iov_tmp = NULL;
464
465 iov_tmp = talloc_realloc(mem_ctx, iov_alloc,
466 struct iovec,
467 num_iov +
468 SMBD_SMB2_NUM_IOV_PER_REQ);
469 if (iov_tmp == NULL) {
470 TALLOC_FREE(iov_alloc);
471 return NT_STATUS_NO_MEMORY;
472 }
473
474 if (iov_alloc == NULL) {
475 memcpy(iov_tmp,
476 req->in._vector,
477 sizeof(req->in._vector));
478 }
479
480 iov = iov_tmp;
481 }
482 cur = &iov[num_iov];
483 num_iov += SMBD_SMB2_NUM_IOV_PER_REQ;
484
485 cur[SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
486 cur[SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
487 cur[SMBD_SMB2_HDR_IOV_OFS].iov_base = hdr;
488 cur[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
489 cur[SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
490 cur[SMBD_SMB2_BODY_IOV_OFS].iov_len = body_size;
491 cur[SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
492 cur[SMBD_SMB2_DYN_IOV_OFS].iov_len = dyn_size;
493
494 taken += full_size;
495 }
496
497 *piov = iov;
498 *pnum_iov = num_iov;
499 return NT_STATUS_OK;
500
501 inval:
502 if (iov != req->in._vector) {
503 TALLOC_FREE(iov);
504 }
505 return NT_STATUS_INVALID_PARAMETER;
506 }
507
508 static NTSTATUS smbd_smb2_request_create(struct smbXsrv_connection *xconn,
509 uint8_t *inbuf, size_t size,
510 struct smbd_smb2_request **_req)
511 {
512 struct smbd_server_connection *sconn = xconn->sconn;
513 struct smbd_smb2_request *req;
514 uint32_t protocol_version;
515 const uint8_t *inhdr = NULL;
516 uint16_t cmd;
517 uint32_t next_command_ofs;
518 NTSTATUS status;
519 NTTIME now;
520
521 if (size < (4 + SMB2_HDR_BODY + 2)) {
522 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
523 return NT_STATUS_INVALID_PARAMETER;
524 }
525
526 inhdr = inbuf + 4;
527
528 protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
529 if (protocol_version != SMB2_MAGIC) {
530 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
531 protocol_version));
532 return NT_STATUS_INVALID_PARAMETER;
533 }
534
535 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
536 if (cmd != SMB2_OP_NEGPROT) {
537 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
538 cmd));
539 return NT_STATUS_INVALID_PARAMETER;
540 }
541
542 next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
543 if (next_command_ofs != 0) {
544 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
545 next_command_ofs));
546 return NT_STATUS_INVALID_PARAMETER;
547 }
548
549 req = smbd_smb2_request_allocate(xconn);
550 if (req == NULL) {
551 return NT_STATUS_NO_MEMORY;
552 }
553 req->sconn = sconn;
554 req->xconn = xconn;
555
556 talloc_steal(req, inbuf);
557
558 req->request_time = timeval_current();
559 now = timeval_to_nttime(&req->request_time);
560
561 status = smbd_smb2_inbuf_parse_compound(xconn,
562 now,
563 inbuf + NBT_HDR_SIZE,
564 size - NBT_HDR_SIZE,
565 req, &req->in.vector,
566 &req->in.vector_count);
567 if (!NT_STATUS_IS_OK(status)) {
568 TALLOC_FREE(req);
569 return status;
570 }
571
572 req->current_idx = 1;
573
574 *_req = req;
575 return NT_STATUS_OK;
576 }
577
578 static bool smb2_validate_sequence_number(struct smbXsrv_connection *xconn,
579 uint64_t message_id, uint64_t seq_id)
580 {
581 struct bitmap *credits_bm = xconn->smb2.credits.bitmap;
582 unsigned int offset;
583 uint64_t seq_tmp;
584
585 seq_tmp = xconn->smb2.credits.seq_low;
586 if (seq_id < seq_tmp) {
587 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
588 "%llu (sequence id %llu) "
589 "(granted = %u, low = %llu, range = %u)\n",
590 (unsigned long long)message_id,
591 (unsigned long long)seq_id,
592 (unsigned int)xconn->smb2.credits.granted,
593 (unsigned long long)xconn->smb2.credits.seq_low,
594 (unsigned int)xconn->smb2.credits.seq_range));
595 return false;
596 }
597
598 seq_tmp += xconn->smb2.credits.seq_range;
599 if (seq_id >= seq_tmp) {
600 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
601 "%llu (sequence id %llu) "
602 "(granted = %u, low = %llu, range = %u)\n",
603 (unsigned long long)message_id,
604 (unsigned long long)seq_id,
605 (unsigned int)xconn->smb2.credits.granted,
606 (unsigned long long)xconn->smb2.credits.seq_low,
607 (unsigned int)xconn->smb2.credits.seq_range));
608 return false;
609 }
610
611 offset = seq_id % xconn->smb2.credits.max;
612
613 if (bitmap_query(credits_bm, offset)) {
614 DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
615 "%llu (sequence id %llu) "
616 "(granted = %u, low = %llu, range = %u) "
617 "(bm offset %u)\n",
618 (unsigned long long)message_id,
619 (unsigned long long)seq_id,
620 (unsigned int)xconn->smb2.credits.granted,
621 (unsigned long long)xconn->smb2.credits.seq_low,
622 (unsigned int)xconn->smb2.credits.seq_range,
623 offset));
624 return false;
625 }
626
627 /* Mark the message_ids as seen in the bitmap. */
628 bitmap_set(credits_bm, offset);
629
630 if (seq_id != xconn->smb2.credits.seq_low) {
631 return true;
632 }
633
634 /*
635 * Move the window forward by all the message_id's
636 * already seen.
637 */
638 while (bitmap_query(credits_bm, offset)) {
639 DEBUG(10,("smb2_validate_sequence_number: clearing "
640 "id %llu (position %u) from bitmap\n",
641 (unsigned long long)(xconn->smb2.credits.seq_low),
642 offset));
643 bitmap_clear(credits_bm, offset);
644
645 xconn->smb2.credits.seq_low += 1;
646 xconn->smb2.credits.seq_range -= 1;
647 offset = xconn->smb2.credits.seq_low % xconn->smb2.credits.max;
648 }
649
650 return true;
651 }
652
653 static bool smb2_validate_message_id(struct smbXsrv_connection *xconn,
654 const uint8_t *inhdr)
655 {
656 uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
657 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
658 uint16_t credit_charge = 1;
659 uint64_t i;
660
661 if (opcode == SMB2_OP_CANCEL) {
662 /* SMB2_CANCEL requests by definition resend messageids. */
663 return true;
664 }
665
666 if (xconn->smb2.credits.multicredit) {
667 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
668 credit_charge = MAX(credit_charge, 1);
669 }
670
671 DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
672 "credits_granted %llu, "
673 "seqnum low/range: %llu/%llu\n",
674 (unsigned long long) message_id,
675 (unsigned long long) credit_charge,
676 (unsigned long long) xconn->smb2.credits.granted,
677 (unsigned long long) xconn->smb2.credits.seq_low,
678 (unsigned long long) xconn->smb2.credits.seq_range));
679
680 if (xconn->smb2.credits.granted < credit_charge) {
681 DEBUG(0, ("smb2_validate_message_id: client used more "
682 "credits than granted, mid %llu, charge %llu, "
683 "credits_granted %llu, "
684 "seqnum low/range: %llu/%llu\n",
685 (unsigned long long) message_id,
686 (unsigned long long) credit_charge,
687 (unsigned long long) xconn->smb2.credits.granted,
688 (unsigned long long) xconn->smb2.credits.seq_low,
689 (unsigned long long) xconn->smb2.credits.seq_range));
690 return false;
691 }
692
693 /*
694 * now check the message ids
695 *
696 * for multi-credit requests we need to check all current mid plus
697 * the implicit mids caused by the credit charge
698 * e.g. current mid = 15, charge 5 => mark 15-19 as used
699 */
700
701 for (i = 0; i <= (credit_charge-1); i++) {
702 uint64_t id = message_id + i;
703 bool ok;
704
705 DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
706 (unsigned long long)message_id,
707 credit_charge,
708 (unsigned long long)id));
709
710 ok = smb2_validate_sequence_number(xconn, message_id, id);
711 if (!ok) {
712 return false;
713 }
714 }
715
716 /* substract used credits */
717 xconn->smb2.credits.granted -= credit_charge;
718
719 return true;
720 }
721
722 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
723 {
724 int count;
725 int idx;
726
727 count = req->in.vector_count;
728
729 if (count < 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
730 /* It's not a SMB2 request */
731 return NT_STATUS_INVALID_PARAMETER;
732 }
733
734 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
735 struct iovec *hdr = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
736 struct iovec *body = SMBD_SMB2_IDX_BODY_IOV(req,in,idx);
737 const uint8_t *inhdr = NULL;
738
739 if (hdr->iov_len != SMB2_HDR_BODY) {
740 return NT_STATUS_INVALID_PARAMETER;
741 }
742
743 if (body->iov_len < 2) {
744 return NT_STATUS_INVALID_PARAMETER;
745 }
746
747 inhdr = (const uint8_t *)hdr->iov_base;
748
749 /* Check the SMB2 header */
750 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
751 return NT_STATUS_INVALID_PARAMETER;
752 }
753
754 if (!smb2_validate_message_id(req->xconn, inhdr)) {
755 return NT_STATUS_INVALID_PARAMETER;
756 }
757 }
758
759 return NT_STATUS_OK;
760 }
761
762 static void smb2_set_operation_credit(struct smbXsrv_connection *xconn,
763 const struct iovec *in_vector,
764 struct iovec *out_vector)
765 {
766 struct smbd_server_connection *sconn = xconn->sconn;
767 const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
768 uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
769 uint16_t credit_charge = 1;
770 uint16_t credits_requested;
771 uint32_t out_flags;
772 uint16_t cmd;
773 NTSTATUS out_status;
774 uint16_t credits_granted = 0;
775 uint64_t credits_possible;
776 uint16_t current_max_credits;
777
778 /*
779 * first we grant only 1/16th of the max range.
780 *
781 * Windows also starts with the 1/16th and then grants
782 * more later. I was only able to trigger higher
783 * values, when using a very high credit charge.
784 *
785 * TODO: scale up depending on load, free memory
786 * or other stuff.
787 * Maybe also on the relationship between number
788 * of requests and the used sequence number.
789 * Which means we would grant more credits
790 * for client which use multi credit requests.
791 */
792 current_max_credits = xconn->smb2.credits.max / 16;
793 current_max_credits = MAX(current_max_credits, 1);
794
795 if (xconn->smb2.credits.multicredit) {
796 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
797 credit_charge = MAX(credit_charge, 1);
798 }
799
800 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
801 credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
802 out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
803 out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
804
805 SMB_ASSERT(xconn->smb2.credits.max >= xconn->smb2.credits.granted);
806
807 if (xconn->smb2.credits.max < credit_charge) {
808 smbd_server_connection_terminate(sconn,
809 "client error: credit charge > max credits\n");
810 return;
811 }
812
813 if (out_flags & SMB2_HDR_FLAG_ASYNC) {
814 /*
815 * In case we already send an async interim
816 * response, we should not grant
817 * credits on the final response.
818 */
819 credits_granted = 0;
820 } else if (credits_requested > 0) {
821 uint16_t additional_max = 0;
822 uint16_t additional_credits = credits_requested - 1;
823
824 switch (cmd) {
825 case SMB2_OP_NEGPROT:
826 break;
827 case SMB2_OP_SESSSETUP:
828 /*
829 * Windows 2012 RC1 starts to grant
830 * additional credits
831 * with a successful session setup
832 */
833 if (NT_STATUS_IS_OK(out_status)) {
834 additional_max = 32;
835 }
836 break;
837 default:
838 /*
839 * We match windows and only grant additional credits
840 * in chunks of 32.
841 */
842 additional_max = 32;
843 break;
844 }
845
846 additional_credits = MIN(additional_credits, additional_max);
847
848 credits_granted = credit_charge + additional_credits;
849 } else if (xconn->smb2.credits.granted == 0) {
850 /*
851 * Make sure the client has always at least one credit
852 */
853 credits_granted = 1;
854 }
855
856 /*
857 * sequence numbers should not wrap
858 *
859 * 1. calculate the possible credits until
860 * the sequence numbers start to wrap on 64-bit.
861 *
862 * 2. UINT64_MAX is used for Break Notifications.
863 *
864 * 2. truncate the possible credits to the maximum
865 * credits we want to grant to the client in total.
866 *
867 * 3. remove the range we'll already granted to the client
868 * this makes sure the client consumes the lowest sequence
869 * number, before we can grant additional credits.
870 */
871 credits_possible = UINT64_MAX - xconn->smb2.credits.seq_low;
872 if (credits_possible > 0) {
873 /* remove UINT64_MAX */
874 credits_possible -= 1;
875 }
876 credits_possible = MIN(credits_possible, current_max_credits);
877 credits_possible -= xconn->smb2.credits.seq_range;
878
879 credits_granted = MIN(credits_granted, credits_possible);
880
881 SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
882 xconn->smb2.credits.granted += credits_granted;
883 xconn->smb2.credits.seq_range += credits_granted;
884
885 DEBUG(10,("smb2_set_operation_credit: requested %u, charge %u, "
886 "granted %u, current possible/max %u/%u, "
887 "total granted/max/low/range %u/%u/%llu/%u\n",
888 (unsigned int)credits_requested,
889 (unsigned int)credit_charge,
890 (unsigned int)credits_granted,
891 (unsigned int)credits_possible,
892 (unsigned int)current_max_credits,
893 (unsigned int)xconn->smb2.credits.granted,
894 (unsigned int)xconn->smb2.credits.max,
895 (unsigned long long)xconn->smb2.credits.seq_low,
896 (unsigned int)xconn->smb2.credits.seq_range));
897 }
898
899 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
900 struct smbd_smb2_request *outreq)
901 {
902 int count, idx;
903 uint16_t total_credits = 0;
904
905 count = outreq->out.vector_count;
906
907 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
908 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(inreq,in,idx);
909 struct iovec *outhdr_v = SMBD_SMB2_IDX_HDR_IOV(outreq,out,idx);
910 uint8_t *outhdr = (uint8_t *)outhdr_v->iov_base;
911
912 smb2_set_operation_credit(outreq->xconn, inhdr_v, outhdr_v);
913
914 /* To match Windows, count up what we
915 just granted. */
916 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
917 /* Set to zero in all but the last reply. */
918 if (idx + SMBD_SMB2_NUM_IOV_PER_REQ < count) {
919 SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
920 } else {
921 SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
922 }
923 }
924 }
925
926 DATA_BLOB smbd_smb2_generate_outbody(struct smbd_smb2_request *req, size_t size)
927 {
928 if (req->current_idx <= 1) {
929 if (size <= sizeof(req->out._body)) {
930 return data_blob_const(req->out._body, size);
931 }
932 }
933
934 return data_blob_talloc(req, NULL, size);
935 }
936
937 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
938 {
939 struct smbXsrv_connection *xconn = req->xconn;
940 TALLOC_CTX *mem_ctx;
941 struct iovec *vector;
942 int count;
943 int idx;
944
945 count = req->in.vector_count;
946 if (count <= ARRAY_SIZE(req->out._vector)) {
947 mem_ctx = req;
948 vector = req->out._vector;
949 } else {
950 vector = talloc_zero_array(req, struct iovec, count);
951 if (vector == NULL) {
952 return NT_STATUS_NO_MEMORY;
953 }
954 mem_ctx = vector;
955 }
956
957 vector[0].iov_base = req->out.nbt_hdr;
958 vector[0].iov_len = 4;
959 SIVAL(req->out.nbt_hdr, 0, 0);
960
961 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
962 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
963 const uint8_t *inhdr = (const uint8_t *)inhdr_v->iov_base;
964 uint8_t *outhdr = NULL;
965 uint8_t *outbody = NULL;
966 uint32_t next_command_ofs = 0;
967 struct iovec *current = &vector[idx];
968
969 if ((idx + SMBD_SMB2_NUM_IOV_PER_REQ) < count) {
970 /* we have a next command -
971 * setup for the error case. */
972 next_command_ofs = SMB2_HDR_BODY + 9;
973 }
974
975 if (idx == 1) {
976 outhdr = req->out._hdr;
977 } else {
978 outhdr = talloc_zero_array(mem_ctx, uint8_t,
979 OUTVEC_ALLOC_SIZE);
980 if (outhdr == NULL) {
981 return NT_STATUS_NO_MEMORY;
982 }
983 }
984
985 outbody = outhdr + SMB2_HDR_BODY;
986
987 /*
988 * SMBD_SMB2_TF_IOV_OFS might be used later
989 */
990 current[SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
991 current[SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
992
993 current[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)outhdr;
994 current[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
995
996 current[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)outbody;
997 current[SMBD_SMB2_BODY_IOV_OFS].iov_len = 8;
998
999 current[SMBD_SMB2_DYN_IOV_OFS].iov_base = NULL;
1000 current[SMBD_SMB2_DYN_IOV_OFS].iov_len = 0;
1001
1002 /* setup the SMB2 header */
1003 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1004 SSVAL(outhdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1005 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
1006 SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
1007 SIVAL(outhdr, SMB2_HDR_STATUS,
1008 NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
1009 SSVAL(outhdr, SMB2_HDR_OPCODE,
1010 SVAL(inhdr, SMB2_HDR_OPCODE));
1011 SIVAL(outhdr, SMB2_HDR_FLAGS,
1012 IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
1013 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
1014 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
1015 BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
1016 SIVAL(outhdr, SMB2_HDR_PID,
1017 IVAL(inhdr, SMB2_HDR_PID));
1018 SIVAL(outhdr, SMB2_HDR_TID,
1019 IVAL(inhdr, SMB2_HDR_TID));
1020 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
1021 BVAL(inhdr, SMB2_HDR_SESSION_ID));
1022 memcpy(outhdr + SMB2_HDR_SIGNATURE,
1023 inhdr + SMB2_HDR_SIGNATURE, 16);
1024
1025 /* setup error body header */
1026 SSVAL(outbody, 0x00, 0x08 + 1);
1027 SSVAL(outbody, 0x02, 0);
1028 SIVAL(outbody, 0x04, 0);
1029 }
1030
1031 req->out.vector = vector;
1032 req->out.vector_count = count;
1033
1034 /* setup the length of the NBT packet */
1035 smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
1036
1037 DLIST_ADD_END(xconn->smb2.requests, req, struct smbd_smb2_request *);
1038
1039 return NT_STATUS_OK;
1040 }
1041
1042 void smbd_server_connection_terminate_ex(struct smbd_server_connection *sconn,
1043 const char *reason,
1044 const char *location)
1045 {
1046 DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
1047 reason, location));
1048 exit_server_cleanly(reason);
1049 }
1050
1051 static bool dup_smb2_vec4(TALLOC_CTX *ctx,
1052 struct iovec *outvec,
1053 const struct iovec *srcvec)
1054 {
1055 const uint8_t *srctf;
1056 size_t srctf_len;
1057 const uint8_t *srchdr;
1058 size_t srchdr_len;
1059 const uint8_t *srcbody;
1060 size_t srcbody_len;
1061 const uint8_t *expected_srcbody;
1062 const uint8_t *srcdyn;
1063 size_t srcdyn_len;
1064 const uint8_t *expected_srcdyn;
1065 uint8_t *dsttf;
1066 uint8_t *dsthdr;
1067 uint8_t *dstbody;
1068 uint8_t *dstdyn;
1069
1070 srctf = (const uint8_t *)srcvec[SMBD_SMB2_TF_IOV_OFS].iov_base;
1071 srctf_len = srcvec[SMBD_SMB2_TF_IOV_OFS].iov_len;
1072 srchdr = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
1073 srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
1074 srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
1075 srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
1076 expected_srcbody = srchdr + SMB2_HDR_BODY;
1077 srcdyn = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
1078 srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
1079 expected_srcdyn = srcbody + 8;
1080
1081 if ((srctf_len != SMB2_TF_HDR_SIZE) && (srctf_len != 0)) {
1082 return false;
1083 }
1084
1085 if (srchdr_len != SMB2_HDR_BODY) {
1086 return false;
1087 }
1088
1089 if (srctf_len == SMB2_TF_HDR_SIZE) {
1090 dsttf = talloc_memdup(ctx, srctf, SMB2_TF_HDR_SIZE);
1091 if (dsttf == NULL) {
1092 return false;
1093 }
1094 } else {
1095 dsttf = NULL;
1096 }
1097 outvec[SMBD_SMB2_TF_IOV_OFS].iov_base = (void *)dsttf;
1098 outvec[SMBD_SMB2_TF_IOV_OFS].iov_len = srctf_len;
1099
1100 /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
1101 * be allocated with size OUTVEC_ALLOC_SIZE. */
1102
1103 dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
1104 if (dsthdr == NULL) {
1105 return false;
1106 }
1107 outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
1108 outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1109
1110 /*
1111 * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
1112 * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
1113 * then duplicate this. Else use talloc_memdup().
1114 */
1115
1116 if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
1117 dstbody = dsthdr + SMB2_HDR_BODY;
1118 } else {
1119 dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
1120 if (dstbody == NULL) {
1121 return false;
1122 }
1123 }
1124 outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
1125 outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
1126
1127 /*
1128 * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
1129 * pointing to
1130 * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
1131 * then duplicate this. Else use talloc_memdup().
1132 */
1133
1134 if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
1135 dstdyn = dsthdr + SMB2_HDR_BODY + 8;
1136 } else if (srcdyn == NULL) {
1137 dstdyn = NULL;
1138 } else {
1139 dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
1140 if (dstdyn == NULL) {
1141 return false;
1142 }
1143 }
1144 outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
1145 outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
1146
1147 return true;
1148 }
1149
1150 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
1151 {
1152 struct smbd_smb2_request *newreq = NULL;
1153 struct iovec *outvec = NULL;
1154 int count = req->out.vector_count;
1155 int i;
1156
1157 newreq = smbd_smb2_request_allocate(req->xconn);
1158 if (!newreq) {
1159 return NULL;
1160 }
1161
1162 newreq->sconn = req->sconn;
1163 newreq->xconn = req->xconn;
1164 newreq->session = req->session;
1165 newreq->do_encryption = req->do_encryption;
1166 newreq->do_signing = req->do_signing;
1167 newreq->current_idx = req->current_idx;
1168
1169 outvec = talloc_zero_array(newreq, struct iovec, count);
1170 if (!outvec) {
1171 TALLOC_FREE(newreq);
1172 return NULL;
1173 }
1174 newreq->out.vector = outvec;
1175 newreq->out.vector_count = count;
1176
1177 /* Setup the outvec's identically to req. */
1178 outvec[0].iov_base = newreq->out.nbt_hdr;
1179 outvec[0].iov_len = 4;
1180 memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
1181
1182 /* Setup the vectors identically to the ones in req. */
1183 for (i = 1; i < count; i += SMBD_SMB2_NUM_IOV_PER_REQ) {
1184 if (!dup_smb2_vec4(outvec, &outvec[i], &req->out.vector[i])) {
1185 break;
1186 }
1187 }
1188
1189 if (i < count) {
1190 /* Alloc failed. */
1191 TALLOC_FREE(newreq);
1192 return NULL;
1193 }
1194
1195 smb2_setup_nbt_length(newreq->out.vector,
1196 newreq->out.vector_count);
1197
1198 return newreq;
1199 }
1200
1201 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
1202 {
1203 struct smbXsrv_connection *xconn = req->xconn;
1204 int first_idx = 1;
1205 struct iovec *firsttf = NULL;
1206 struct iovec *outhdr_v = NULL;
1207 uint8_t *outhdr = NULL;
1208 struct smbd_smb2_request *nreq = NULL;
1209 NTSTATUS status;
1210
1211 /* Create a new smb2 request we'll use
1212 for the interim return. */
1213 nreq = dup_smb2_req(req);
1214 if (!nreq) {
1215 return NT_STATUS_NO_MEMORY;
1216 }
1217
1218 /* Lose the last X out vectors. They're the
1219 ones we'll be using for the async reply. */
1220 nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
1221
1222 smb2_setup_nbt_length(nreq->out.vector,
1223 nreq->out.vector_count);
1224
1225 /* Step back to the previous reply. */
1226 nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
1227 firsttf = SMBD_SMB2_IDX_TF_IOV(nreq,out,first_idx);
1228 outhdr_v = SMBD_SMB2_OUT_HDR_IOV(nreq);
1229 outhdr = SMBD_SMB2_OUT_HDR_PTR(nreq);
1230 /* And end the chain. */
1231 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
1232
1233 /* Calculate outgoing credits */
1234 smb2_calculate_credits(req, nreq);
1235
1236 if (DEBUGLEVEL >= 10) {
1237 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
1238 (unsigned int)nreq->current_idx );
1239 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
1240 (unsigned int)nreq->out.vector_count );
1241 print_req_vectors(nreq);
1242 }
1243
1244 /*
1245 * As we have changed the header (SMB2_HDR_NEXT_COMMAND),
1246 * we need to sign/encrypt here with the last/first key we remembered
1247 */
1248 if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
1249 status = smb2_signing_encrypt_pdu(req->first_key,
1250 xconn->protocol,
1251 firsttf,
1252 nreq->out.vector_count - first_idx);
1253 if (!NT_STATUS_IS_OK(status)) {
1254 return status;
1255 }
1256 } else if (req->last_key.length > 0) {
1257 status = smb2_signing_sign_pdu(req->last_key,
1258 xconn->protocol,
1259 outhdr_v,
1260 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1261 if (!NT_STATUS_IS_OK(status)) {
1262 return status;
1263 }
1264 }
1265
1266 nreq->queue_entry.mem_ctx = nreq;
1267 nreq->queue_entry.vector = nreq->out.vector;
1268 nreq->queue_entry.count = nreq->out.vector_count;
1269 DLIST_ADD_END(xconn->smb2.send_queue, &nreq->queue_entry, NULL);
1270 xconn->smb2.send_queue_len++;
1271
1272 status = smbd_smb2_flush_send_queue(xconn);
1273 if (!NT_STATUS_IS_OK(status)) {
1274 return status;
1275 }
1276
1277 return NT_STATUS_OK;
1278 }
1279
1280 struct smbd_smb2_request_pending_state {
1281 struct smbd_smb2_send_queue queue_entry;
1282 uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
1283 struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
1284 };
1285
1286 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1287 struct tevent_timer *te,
1288 struct timeval current_time,
1289 void *private_data);
1290
1291 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
1292 struct tevent_req *subreq,
1293 uint32_t defer_time)
1294 {
1295 NTSTATUS status;
1296 struct timeval defer_endtime;
1297 uint8_t *outhdr = NULL;
1298 uint32_t flags;
1299
1300 if (!tevent_req_is_in_progress(subreq)) {
1301 /*
1302 * This is a performance optimization,
1303 * it avoids one tevent_loop iteration,
1304 * which means we avoid one
1305 * talloc_stackframe_pool/talloc_free pair.
1306 */
1307 tevent_req_notify_callback(subreq);
1308 return NT_STATUS_OK;
1309 }
1310
1311 req->subreq = subreq;
1312 subreq = NULL;
1313
1314 if (req->async_te) {
1315 /* We're already async. */
1316 return NT_STATUS_OK;
1317 }
1318
1319 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1320 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1321 if (flags & SMB2_HDR_FLAG_ASYNC) {
1322 /* We're already async. */
1323 return NT_STATUS_OK;
1324 }
1325
1326 if (req->in.vector_count > req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
1327 /*
1328 * We're trying to go async in a compound
1329 * request chain.
1330 * This is only allowed for opens that
1331 * cause an oplock break, otherwise it
1332 * is not allowed. See [MS-SMB2].pdf
1333 * note <194> on Section 3.3.5.2.7.
1334 */
1335 const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1336
1337 if (SVAL(inhdr, SMB2_HDR_OPCODE) != SMB2_OP_CREATE) {
1338 /*
1339 * Cancel the outstanding request.
1340 */
1341 bool ok = tevent_req_cancel(req->subreq);
1342 if (ok) {
1343 return NT_STATUS_OK;
1344 }
1345 TALLOC_FREE(req->subreq);
1346 return smbd_smb2_request_error(req,
1347 NT_STATUS_INTERNAL_ERROR);
1348 }
1349 }
1350
1351 if (DEBUGLEVEL >= 10) {
1352 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
1353 (unsigned int)req->current_idx );
1354 print_req_vectors(req);
1355 }
1356
1357 if (req->current_idx > 1) {
1358 /*
1359 * We're going async in a compound
1360 * chain after the first request has
1361 * already been processed. Send an
1362 * interim response containing the
1363 * set of replies already generated.
1364 */
1365 int idx = req->current_idx;
1366
1367 status = smb2_send_async_interim_response(req);
1368 if (!NT_STATUS_IS_OK(status)) {
1369 return status;
1370 }
1371 if (req->first_key.length > 0) {
1372 data_blob_clear_free(&req->first_key);
1373 }
1374
1375 req->current_idx = 1;
1376
1377 /*
1378 * Re-arrange the in.vectors to remove what
1379 * we just sent.
1380 */
1381 memmove(&req->in.vector[1],
1382 &req->in.vector[idx],
1383 sizeof(req->in.vector[0])*(req->in.vector_count - idx));
1384 req->in.vector_count = 1 + (req->in.vector_count - idx);
1385
1386 /* Re-arrange the out.vectors to match. */
1387 memmove(&req->out.vector[1],
1388 &req->out.vector[idx],
1389 sizeof(req->out.vector[0])*(req->out.vector_count - idx));
1390 req->out.vector_count = 1 + (req->out.vector_count - idx);
1391
1392 if (req->in.vector_count == 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
1393 /*
1394 * We only have one remaining request as
1395 * we've processed everything else.
1396 * This is no longer a compound request.
1397 */
1398 req->compound_related = false;
1399 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1400 flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
1401 SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
1402 }
1403 }
1404 if (req->last_key.length > 0) {
1405 data_blob_clear_free(&req->last_key);
1406 }
1407
1408 defer_endtime = timeval_current_ofs_usec(defer_time);
1409 req->async_te = tevent_add_timer(req->sconn->ev_ctx,
1410 req, defer_endtime,
1411 smbd_smb2_request_pending_timer,
1412 req);
1413 if (req->async_te == NULL) {
1414 return NT_STATUS_NO_MEMORY;
1415 }
1416
1417 return NT_STATUS_OK;
1418 }
1419
1420 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1421 struct tevent_timer *te,
1422 struct timeval current_time,
1423 void *private_data)
1424 {
1425 struct smbd_smb2_request *req =
1426 talloc_get_type_abort(private_data,
1427 struct smbd_smb2_request);
1428 struct smbXsrv_connection *xconn = req->xconn;
1429 struct smbd_smb2_request_pending_state *state = NULL;
1430 uint8_t *outhdr = NULL;
1431 const uint8_t *inhdr = NULL;
1432 uint8_t *tf = NULL;
1433 size_t tf_len = 0;
1434 uint8_t *hdr = NULL;
1435 uint8_t *body = NULL;
1436 uint8_t *dyn = NULL;
1437 uint32_t flags = 0;
1438 uint64_t session_id = 0;
1439 uint64_t message_id = 0;
1440 uint64_t nonce_high = 0;
1441 uint64_t nonce_low = 0;
1442 uint64_t async_id = 0;
1443 NTSTATUS status;
1444
1445 TALLOC_FREE(req->async_te);
1446
1447 /* Ensure our final reply matches the interim one. */
1448 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1449 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1450 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1451 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1452 session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
1453
1454 async_id = message_id; /* keep it simple for now... */
1455
1456 SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1457 SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
1458
1459 DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1460 "going async\n",
1461 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1462 (unsigned long long)async_id ));
1463
1464 /*
1465 * What we send is identical to a smbd_smb2_request_error
1466 * packet with an error status of STATUS_PENDING. Make use
1467 * of this fact sometime when refactoring. JRA.
1468 */
1469
1470 state = talloc_zero(req->xconn, struct smbd_smb2_request_pending_state);
1471 if (state == NULL) {
1472 smbd_server_connection_terminate(req->sconn,
1473 nt_errstr(NT_STATUS_NO_MEMORY));
1474 return;
1475 }
1476
1477 tf = state->buf + NBT_HDR_SIZE;
1478 tf_len = SMB2_TF_HDR_SIZE;
1479
1480 hdr = tf + SMB2_TF_HDR_SIZE;
1481 body = hdr + SMB2_HDR_BODY;
1482 dyn = body + 8;
1483
1484 if (req->do_encryption) {
1485 struct smbXsrv_session *x = req->session;
1486
1487 nonce_high = x->nonce_high;
1488 nonce_low = x->nonce_low;
1489
1490 x->nonce_low += 1;
1491 if (x->nonce_low == 0) {
1492 x->nonce_low += 1;
1493 x->nonce_high += 1;
1494 }
1495 }
1496
1497 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
1498 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
1499 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
1500 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
1501
1502 SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1503 SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1504 SSVAL(hdr, SMB2_HDR_EPOCH, 0);
1505 SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
1506 SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
1507
1508 SIVAL(hdr, SMB2_HDR_FLAGS, flags);
1509 SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
1510 SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
1511 SBVAL(hdr, SMB2_HDR_PID, async_id);
1512 SBVAL(hdr, SMB2_HDR_SESSION_ID,
1513 BVAL(outhdr, SMB2_HDR_SESSION_ID));
1514 memcpy(hdr+SMB2_HDR_SIGNATURE,
1515 outhdr+SMB2_HDR_SIGNATURE, 16);
1516
1517 SSVAL(body, 0x00, 0x08 + 1);
1518
1519 SCVAL(body, 0x02, 0);
1520 SCVAL(body, 0x03, 0);
1521 SIVAL(body, 0x04, 0);
1522 /* Match W2K8R2... */
1523 SCVAL(dyn, 0x00, 0x21);
1524
1525 state->vector[0].iov_base = (void *)state->buf;
1526 state->vector[0].iov_len = NBT_HDR_SIZE;
1527
1528 if (req->do_encryption) {
1529 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
1530 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
1531 } else {
1532 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
1533 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
1534 }
1535
1536 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base = hdr;
1537 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1538
1539 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
1540 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len = 8;
1541
1542 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
1543 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len = 1;
1544
1545 smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
1546
1547 /* Ensure we correctly go through crediting. Grant
1548 the credits now, and zero credits on the final
1549 response. */
1550 smb2_set_operation_credit(req->xconn,
1551 SMBD_SMB2_IN_HDR_IOV(req),
1552 &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
1553
1554 SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1555
1556 if (DEBUGLVL(10)) {
1557 int i;
1558
1559 for (i = 0; i < ARRAY_SIZE(state->vector); i++) {
1560 dbgtext("\tstate->vector[%u/%u].iov_len = %u\n",
1561 (unsigned int)i,
1562 (unsigned int)ARRAY_SIZE(state->vector),
1563 (unsigned int)state->vector[i].iov_len);
1564 }
1565 }
1566
1567 if (req->do_encryption) {
1568 struct smbXsrv_session *x = req->session;
1569 DATA_BLOB encryption_key = x->global->encryption_key;
1570
1571 status = smb2_signing_encrypt_pdu(encryption_key,
1572 xconn->protocol,
1573 &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
1574 SMBD_SMB2_NUM_IOV_PER_REQ);
1575 if (!NT_STATUS_IS_OK(status)) {
1576 smbd_server_connection_terminate(req->sconn,
1577 nt_errstr(status));
1578 return;
1579 }
1580 } else if (req->do_signing) {
1581 struct smbXsrv_session *x = req->session;
1582 DATA_BLOB signing_key = x->global->channels[0].signing_key;
1583
1584 status = smb2_signing_sign_pdu(signing_key,
1585 xconn->protocol,
1586 &state->vector[1+SMBD_SMB2_HDR_IOV_OFS],
1587 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1588 if (!NT_STATUS_IS_OK(status)) {
1589 smbd_server_connection_terminate(req->sconn,
1590 nt_errstr(status));
1591 return;
1592 }
1593 }
1594
1595 state->queue_entry.mem_ctx = state;
1596 state->queue_entry.vector = state->vector;
1597 state->queue_entry.count = ARRAY_SIZE(state->vector);
1598 DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry, NULL);
1599 xconn->smb2.send_queue_len++;
1600
1601 status = smbd_smb2_flush_send_queue(xconn);
1602 if (!NT_STATUS_IS_OK(status)) {
1603 smbd_server_connection_terminate(req->sconn,
1604 nt_errstr(status));
1605 return;
1606 }
1607 }
1608
1609 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
1610 {
1611 struct smbXsrv_connection *xconn = req->xconn;
1612 struct smbd_smb2_request *cur;
1613 const uint8_t *inhdr;
1614 uint32_t flags;
1615 uint64_t search_message_id;
1616 uint64_t search_async_id;
1617 uint64_t found_id;
1618
1619 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1620
1621 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1622 search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1623 search_async_id = BVAL(inhdr, SMB2_HDR_PID);
1624
1625 /*
1626 * we don't need the request anymore
1627 * cancel requests never have a response
1628 */
1629 DLIST_REMOVE(xconn->smb2.requests, req);
1630 TALLOC_FREE(req);
1631
1632 for (cur = xconn->smb2.requests; cur; cur = cur->next) {
1633 const uint8_t *outhdr;
1634 uint64_t message_id;
1635 uint64_t async_id;
1636
1637 if (cur->compound_related) {
1638 /*
1639 * Never cancel anything in a compound request.
1640 * Way too hard to deal with the result.
1641 */
1642 continue;
1643 }
1644
1645 outhdr = SMBD_SMB2_OUT_HDR_PTR(cur);
1646
1647 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1648 async_id = BVAL(outhdr, SMB2_HDR_PID);
1649
1650 if (flags & SMB2_HDR_FLAG_ASYNC) {
1651 if (search_async_id == async_id) {
1652 found_id = async_id;
1653 break;
1654 }
1655 } else {
1656 if (search_message_id == message_id) {
1657 found_id = message_id;
1658 break;
1659 }
1660 }
1661 }
1662
1663 if (cur && cur->subreq) {
1664 inhdr = SMBD_SMB2_IN_HDR_PTR(cur);
1665 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1666 "cancel opcode[%s] mid %llu\n",
1667 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1668 (unsigned long long)found_id ));
1669 tevent_req_cancel(cur->subreq);
1670 }
1671
1672 return NT_STATUS_OK;
1673 }
1674
1675 /*************************************************************
1676 Ensure an incoming tid is a valid one for us to access.
1677 Change to the associated uid credentials and chdir to the
1678 valid tid directory.
1679 *************************************************************/
1680
1681 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
1682 {
1683 const uint8_t *inhdr;
1684 uint32_t in_flags;
1685 uint32_t in_tid;
1686 struct smbXsrv_tcon *tcon;
1687 NTSTATUS status;
1688 NTTIME now = timeval_to_nttime(&req->request_time);
1689
1690 req->tcon = NULL;
1691
1692 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1693
1694 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1695 in_tid = IVAL(inhdr, SMB2_HDR_TID);
1696
1697 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1698 in_tid = req->last_tid;
1699 }
1700
1701 req->last_tid = 0;
1702
1703 status = smb2srv_tcon_lookup(req->session,
1704 in_tid, now, &tcon);
1705 if (!NT_STATUS_IS_OK(status)) {
1706 return status;
1707 }
1708
1709 if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
1710 return NT_STATUS_ACCESS_DENIED;
1711 }
1712
1713 /* should we pass FLAG_CASELESS_PATHNAMES here? */
1714 if (!set_current_service(tcon->compat, 0, true)) {
1715 return NT_STATUS_ACCESS_DENIED;
1716 }
1717
1718 req->tcon = tcon;
1719 req->last_tid = in_tid;
1720
1721 return NT_STATUS_OK;
1722 }
1723
1724 /*************************************************************
1725 Ensure an incoming session_id is a valid one for us to access.
1726 *************************************************************/
1727
1728 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
1729 {
1730 const uint8_t *inhdr;
1731 uint32_t in_flags;
1732 uint16_t in_opcode;
1733 uint64_t in_session_id;
1734 struct smbXsrv_session *session = NULL;
1735 struct auth_session_info *session_info;
1736 NTSTATUS status;
1737 NTTIME now = timeval_to_nttime(&req->request_time);
1738
1739 req->session = NULL;
1740 req->tcon = NULL;
1741
1742 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1743
1744 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1745 in_opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1746 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
1747
1748 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1749 in_session_id = req->last_session_id;
1750 }
1751
1752 req->last_session_id = 0;
1753
1754 /* lookup an existing session */
1755 status = smb2srv_session_lookup(req->xconn,
1756 in_session_id, now,
1757 &session);
1758 if (session) {
1759 req->session = session;
1760 req->last_session_id = in_session_id;
1761 }
1762 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1763 switch (in_opcode) {
1764 case SMB2_OP_SESSSETUP:
1765 status = NT_STATUS_OK;
1766 break;
1767 default:
1768 break;
1769 }
1770 }
1771 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1772 switch (in_opcode) {
1773 case SMB2_OP_TCON:
1774 case SMB2_OP_CREATE:
1775 case SMB2_OP_GETINFO:
1776 case SMB2_OP_SETINFO:
1777 return NT_STATUS_INVALID_HANDLE;
1778 default:
1779 /*
1780 * Notice the check for
1781 * (session_info == NULL)
1782 * below.
1783 */
1784 status = NT_STATUS_OK;
1785 break;
1786 }
1787 }
1788 if (!NT_STATUS_IS_OK(status)) {
1789 return status;
1790 }
1791
1792 session_info = session->global->auth_session_info;
1793 if (session_info == NULL) {
1794 return NT_STATUS_INVALID_HANDLE;
1795 }
1796
1797 if (in_session_id != req->xconn->last_session_id) {
1798 req->xconn->last_session_id = in_session_id;
1799 set_current_user_info(session_info->unix_info->sanitized_username,
1800 session_info->unix_info->unix_name,
1801 session_info->info->domain_name);
1802 }
1803
1804 return NT_STATUS_OK;
1805 }
1806
1807 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
1808 uint32_t data_length)
1809 {
1810 struct smbXsrv_connection *xconn = req->sconn->conn;
1811 uint16_t needed_charge;
1812 uint16_t credit_charge = 1;
1813 const uint8_t *inhdr;
1814
1815 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1816
1817 if (xconn->smb2.credits.multicredit) {
1818 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
1819 credit_charge = MAX(credit_charge, 1);
1820 }
1821
1822 needed_charge = (data_length - 1)/ 65536 + 1;
1823
1824 DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
1825 (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
1826 credit_charge, needed_charge));
1827
1828 if (needed_charge > credit_charge) {
1829 DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
1830 credit_charge, needed_charge));
1831 return NT_STATUS_INVALID_PARAMETER;
1832 }
1833
1834 return NT_STATUS_OK;
1835 }
1836
1837 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
1838 size_t expected_body_size)
1839 {
1840 struct iovec *inhdr_v;
1841 const uint8_t *inhdr;
1842 uint16_t opcode;
1843 const uint8_t *inbody;
1844 size_t body_size;
1845 size_t min_dyn_size = expected_body_size & 0x00000001;
1846 int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
1847
1848 /*
1849 * The following should be checked already.
1850 */
1851 if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
1852 return NT_STATUS_INTERNAL_ERROR;
1853 }
1854 if (req->current_idx > max_idx) {
1855 return NT_STATUS_INTERNAL_ERROR;
1856 }
1857
1858 inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
1859 if (inhdr_v->iov_len != SMB2_HDR_BODY) {
1860 return NT_STATUS_INTERNAL_ERROR;
1861 }
1862 if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
1863 return NT_STATUS_INTERNAL_ERROR;
1864 }
1865
1866 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1867 opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1868
1869 switch (opcode) {
1870 case SMB2_OP_IOCTL:
1871 case SMB2_OP_GETINFO:
1872 min_dyn_size = 0;
1873 break;
1874 case SMB2_OP_WRITE:
1875 if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) {
1876 if (req->smb1req->unread_bytes < min_dyn_size) {
1877 return NT_STATUS_INVALID_PARAMETER;
1878 }
1879
1880 min_dyn_size = 0;
1881 }
1882 break;
1883 }
1884
1885 /*
1886 * Now check the expected body size,
1887 * where the last byte might be in the
1888 * dynamic section..
1889 */
1890 if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
1891 return NT_STATUS_INVALID_PARAMETER;
1892 }
1893 if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
1894 return NT_STATUS_INVALID_PARAMETER;
1895 }
1896
1897 inbody = SMBD_SMB2_IN_BODY_PTR(req);
1898
1899 body_size = SVAL(inbody, 0x00);
1900 if (body_size != expected_body_size) {
1901 return NT_STATUS_INVALID_PARAMETER;
1902 }
1903
1904 return NT_STATUS_OK;
1905 }
1906
1907 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
1908 {
1909 struct smbXsrv_connection *xconn = req->sconn->conn;
1910 const struct smbd_smb2_dispatch_table *call = NULL;
1911 const struct iovec *intf_v = SMBD_SMB2_IN_TF_IOV(req);
1912 const uint8_t *inhdr;
1913 uint16_t opcode;
1914 uint32_t flags;
1915 uint64_t mid;
1916 NTSTATUS status;
1917 NTSTATUS session_status;
1918 uint32_t allowed_flags;
1919 NTSTATUS return_value;
1920 struct smbXsrv_session *x = NULL;
1921 bool signing_required = false;
1922 bool encryption_required = false;
1923
1924 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1925
1926 /* TODO: verify more things */
1927
1928 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1929 opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1930 mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1931 DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
1932 smb2_opcode_name(opcode),
1933 (unsigned long long)mid));
1934
1935 if (xconn->protocol >= PROTOCOL_SMB2_02) {
1936 /*
1937 * once the protocol is negotiated
1938 * SMB2_OP_NEGPROT is not allowed anymore
1939 */
1940 if (opcode == SMB2_OP_NEGPROT) {
1941 /* drop the connection */
1942 return NT_STATUS_INVALID_PARAMETER;
1943 }
1944 } else {
1945 /*
1946 * if the protocol is not negotiated yet
1947 * only SMB2_OP_NEGPROT is allowed.
1948 */
1949 if (opcode != SMB2_OP_NEGPROT) {
1950 /* drop the connection */
1951 return NT_STATUS_INVALID_PARAMETER;
1952 }
1953 }
1954
1955 /*
1956 * Check if the client provided a valid session id,
1957 * if so smbd_smb2_request_check_session() calls
1958 * set_current_user_info().
1959 *
1960 * As some command don't require a valid session id
1961 * we defer the check of the session_status
1962 */
1963 session_status = smbd_smb2_request_check_session(req);
1964 x = req->session;
1965 if (x != NULL) {
1966 signing_required = x->global->signing_required;
1967 encryption_required = x->global->encryption_required;
1968
1969 if (opcode == SMB2_OP_SESSSETUP &&
1970 x->global->channels[0].signing_key.length) {
1971 signing_required = true;
1972 }
1973 }
1974
1975 req->do_signing = false;
1976 req->do_encryption = false;
1977 if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
1978 const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
1979 uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
1980
1981 if (x != NULL && x->global->session_wire_id != tf_session_id) {
1982 DEBUG(0,("smbd_smb2_request_dispatch: invalid session_id"
1983 "in SMB2_HDR[%llu], SMB2_TF[%llu]\n",
1984 (unsigned long long)x->global->session_wire_id,
1985 (unsigned long long)tf_session_id));
1986 /*
1987 * TODO: windows allows this...
1988 * should we drop the connection?
1989 *
1990 * For now we just return ACCESS_DENIED
1991 * (Windows clients never trigger this)
1992 * and wait for an update of [MS-SMB2].
1993 */
1994 return smbd_smb2_request_error(req,
1995 NT_STATUS_ACCESS_DENIED);
1996 }
1997
1998 req->do_encryption = true;
1999 }
2000
2001 if (encryption_required && !req->do_encryption) {
2002 return smbd_smb2_request_error(req,
2003 NT_STATUS_ACCESS_DENIED);
2004 }
2005
2006 call = smbd_smb2_call(opcode);
2007 if (call == NULL) {
2008 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2009 }
2010
2011 allowed_flags = SMB2_HDR_FLAG_CHAINED |
2012 SMB2_HDR_FLAG_SIGNED |
2013 SMB2_HDR_FLAG_DFS;
2014 if (opcode == SMB2_OP_CANCEL) {
2015 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
2016 }
2017 if ((flags & ~allowed_flags) != 0) {
2018 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2019 }
2020
2021 if (flags & SMB2_HDR_FLAG_CHAINED) {
2022 /*
2023 * This check is mostly for giving the correct error code
2024 * for compounded requests.
2025 */
2026 if (!NT_STATUS_IS_OK(session_status)) {
2027 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2028 }
2029 } else {
2030 req->compat_chain_fsp = NULL;
2031 }
2032
2033 if (req->do_encryption) {
2034 signing_required = false;
2035 } else if (signing_required || (flags & SMB2_HDR_FLAG_SIGNED)) {
2036 DATA_BLOB signing_key;
2037
2038 if (x == NULL) {
2039 /*
2040 * MS-SMB2: 3.3.5.2.4 Verifying the Signature.
2041 * If the SMB2 header of the SMB2 NEGOTIATE
2042 * request has the SMB2_FLAGS_SIGNED bit set in the
2043 * Flags field, the server MUST fail the request
2044 * with STATUS_INVALID_PARAMETER.
2045 *
2046 * Microsoft test tool checks this.
2047 */
2048
2049 if ((opcode == SMB2_OP_NEGPROT) &&
2050 (flags & SMB2_HDR_FLAG_SIGNED)) {
2051 status = NT_STATUS_INVALID_PARAMETER;
2052 } else {
2053 status = NT_STATUS_USER_SESSION_DELETED;
2054 }
2055 return smbd_smb2_request_error(req, status);
2056 }
2057
2058 signing_key = x->global->channels[0].signing_key;
2059
2060 /*
2061 * If we have a signing key, we should
2062 * sign the response
2063 */
2064 if (signing_key.length > 0) {
2065 req->do_signing = true;
2066 }
2067
2068 status = smb2_signing_check_pdu(signing_key,
2069 xconn->protocol,
2070 SMBD_SMB2_IN_HDR_IOV(req),
2071 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2072 if (!NT_STATUS_IS_OK(status)) {
2073 return smbd_smb2_request_error(req, status);
2074 }
2075
2076 /*
2077 * Now that we know the request was correctly signed
2078 * we have to sign the response too.
2079 */
2080 req->do_signing = true;
2081
2082 if (!NT_STATUS_IS_OK(session_status)) {
2083 return smbd_smb2_request_error(req, session_status);
2084 }
2085 } else if (opcode == SMB2_OP_CANCEL) {
2086 /* Cancel requests are allowed to skip the signing */
2087 } else if (signing_required) {
2088 /*
2089 * If signing is required we try to sign
2090 * a possible error response
2091 */
2092 req->do_signing = true;
2093 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
2094 }
2095
2096 if (flags & SMB2_HDR_FLAG_CHAINED) {
2097 req->compound_related = true;
2098 }
2099
2100 if (call->need_session) {
2101 if (!NT_STATUS_IS_OK(session_status)) {
2102 return smbd_smb2_request_error(req, session_status);
2103 }
2104 }
2105
2106 if (call->need_tcon) {
2107 SMB_ASSERT(call->need_session);
2108
2109 /*
2110 * This call needs to be run as user.
2111 *
2112 * smbd_smb2_request_check_tcon()
2113 * calls change_to_user() on success.
2114 */
2115 status = smbd_smb2_request_check_tcon(req);
2116 if (!NT_STATUS_IS_OK(status)) {
2117 return smbd_smb2_request_error(req, status);
2118 }
2119 if (req->tcon->global->encryption_required) {
2120 encryption_required = true;
2121 }
2122 if (encryption_required && !req->do_encryption) {
2123 return smbd_smb2_request_error(req,
2124 NT_STATUS_ACCESS_DENIED);
2125 }
2126 }
2127
2128 if (call->fileid_ofs != 0) {
2129 size_t needed = call->fileid_ofs + 16;
2130 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
2131 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
2132 uint64_t file_id_persistent;
2133 uint64_t file_id_volatile;
2134 struct files_struct *fsp;
2135
2136 SMB_ASSERT(call->need_tcon);
2137
2138 if (needed > body_size) {
2139 return smbd_smb2_request_error(req,
2140 NT_STATUS_INVALID_PARAMETER);
2141 }
2142
2143 file_id_persistent = BVAL(body, call->fileid_ofs + 0);
2144 file_id_volatile = BVAL(body, call->fileid_ofs + 8);
2145
2146 fsp = file_fsp_smb2(req, file_id_persistent, file_id_volatile);
2147 if (fsp == NULL) {
2148 if (!call->allow_invalid_fileid) {
2149 return smbd_smb2_request_error(req,
2150 NT_STATUS_FILE_CLOSED);
2151 }
2152
2153 if (file_id_persistent != UINT64_MAX) {
2154 return smbd_smb2_request_error(req,
2155 NT_STATUS_FILE_CLOSED);
2156 }
2157 if (file_id_volatile != UINT64_MAX) {
2158 return smbd_smb2_request_error(req,
2159 NT_STATUS_FILE_CLOSED);
2160 }
2161 }
2162 }
2163
2164 if (call->as_root) {
2165 SMB_ASSERT(call->fileid_ofs == 0);
2166 /* This call needs to be run as root */
2167 change_to_root_user();
2168 } else {
2169 SMB_ASSERT(call->need_tcon);
2170 }
2171
2172 switch (opcode) {
2173 case SMB2_OP_NEGPROT:
2174 {
2175 START_PROFILE(smb2_negprot);
2176 return_value = smbd_smb2_request_process_negprot(req);
2177 END_PROFILE(smb2_negprot);
2178 }
2179 break;
2180
2181 case SMB2_OP_SESSSETUP:
2182 {
2183 START_PROFILE(smb2_sesssetup);
2184 return_value = smbd_smb2_request_process_sesssetup(req);
2185 END_PROFILE(smb2_sesssetup);
2186 }
2187 break;
2188
2189 case SMB2_OP_LOGOFF:
2190 {
2191 START_PROFILE(smb2_logoff);
2192 return_value = smbd_smb2_request_process_logoff(req);
2193 END_PROFILE(smb2_logoff);
2194 }
2195 break;
2196
2197 case SMB2_OP_TCON:
2198 {
2199 START_PROFILE(smb2_tcon);
2200 return_value = smbd_smb2_request_process_tcon(req);
2201 END_PROFILE(smb2_tcon);
2202 }
2203 break;
2204
2205 case SMB2_OP_TDIS:
2206 {
2207 START_PROFILE(smb2_tdis);
2208 return_value = smbd_smb2_request_process_tdis(req);
2209 END_PROFILE(smb2_tdis);
2210 }
2211 break;
2212
2213 case SMB2_OP_CREATE:
2214 {
2215 START_PROFILE(smb2_create);
2216 return_value = smbd_smb2_request_process_create(req);
2217 END_PROFILE(smb2_create);
2218 }
2219 break;
2220
2221 case SMB2_OP_CLOSE:
2222 {
2223 START_PROFILE(smb2_close);
2224 return_value = smbd_smb2_request_process_close(req);
2225 END_PROFILE(smb2_close);
2226 }
2227 break;
2228
2229 case SMB2_OP_FLUSH:
2230 {
2231 START_PROFILE(smb2_flush);
2232 return_value = smbd_smb2_request_process_flush(req);
2233 END_PROFILE(smb2_flush);
2234 }
2235 break;
2236
2237 case SMB2_OP_READ:
2238 {
2239 START_PROFILE(smb2_read);
2240 return_value = smbd_smb2_request_process_read(req);
2241 END_PROFILE(smb2_read);
2242 }
2243 break;
2244
2245 case SMB2_OP_WRITE:
2246 {
2247 START_PROFILE(smb2_write);
2248 return_value = smbd_smb2_request_process_write(req);
2249 END_PROFILE(smb2_write);
2250 }
2251 break;
2252
2253 case SMB2_OP_LOCK:
2254 {
2255 START_PROFILE(smb2_lock);
2256 return_value = smbd_smb2_request_process_lock(req);
2257 END_PROFILE(smb2_lock);
2258 }
2259 break;
2260
2261 case SMB2_OP_IOCTL:
2262 {
2263 START_PROFILE(smb2_ioctl);
2264 return_value = smbd_smb2_request_process_ioctl(req);
2265 END_PROFILE(smb2_ioctl);
2266 }
2267 break;
2268
2269 case SMB2_OP_CANCEL:
2270 {
2271 START_PROFILE(smb2_cancel);
2272 return_value = smbd_smb2_request_process_cancel(req);
2273 END_PROFILE(smb2_cancel);
2274 }
2275 break;
2276
2277 case SMB2_OP_KEEPALIVE:
2278 {
2279 START_PROFILE(smb2_keepalive);
2280 return_value = smbd_smb2_request_process_keepalive(req);
2281 END_PROFILE(smb2_keepalive);
2282 }
2283 break;
2284
2285 case SMB2_OP_FIND:
2286 {
2287 START_PROFILE(smb2_find);
2288 return_value = smbd_smb2_request_process_find(req);
2289 END_PROFILE(smb2_find);
2290 }
2291 break;
2292
2293 case SMB2_OP_NOTIFY:
2294 {
2295 START_PROFILE(smb2_notify);
2296 return_value = smbd_smb2_request_process_notify(req);
2297 END_PROFILE(smb2_notify);
2298 }
2299 break;
2300
2301 case SMB2_OP_GETINFO:
2302 {
2303 START_PROFILE(smb2_getinfo);
2304 return_value = smbd_smb2_request_process_getinfo(req);
2305 END_PROFILE(smb2_getinfo);
2306 }
2307 break;
2308
2309 case SMB2_OP_SETINFO:
2310 {
2311 START_PROFILE(smb2_setinfo);
2312 return_value = smbd_smb2_request_process_setinfo(req);
2313 END_PROFILE(smb2_setinfo);
2314 }
2315 break;
2316
2317 case SMB2_OP_BREAK:
2318 {
2319 START_PROFILE(smb2_break);
2320 return_value = smbd_smb2_request_process_break(req);
2321 END_PROFILE(smb2_break);
2322 }
2323 break;
2324
2325 default:
2326 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2327 break;
2328 }
2329 return return_value;
2330 }
2331
2332 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
2333 {
2334 struct smbXsrv_connection *xconn = req->xconn;
2335 int first_idx = 1;
2336 struct iovec *firsttf = SMBD_SMB2_IDX_TF_IOV(req,out,first_idx);
2337 struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
2338 struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
2339 NTSTATUS status;
2340
2341 req->subreq = NULL;
2342 TALLOC_FREE(req->async_te);
2343
2344 if (req->do_encryption &&
2345 (firsttf->iov_len == 0) &&
2346 (req->first_key.length == 0) &&
2347 (req->session != NULL) &&
2348 (req->session->global->encryption_key.length != 0))
2349 {
2350 DATA_BLOB encryption_key = req->session->global->encryption_key;
2351 uint8_t *tf;
2352 uint64_t session_id = req->session->global->session_wire_id;
2353 struct smbXsrv_session *x = req->session;
2354 uint64_t nonce_high;
2355 uint64_t nonce_low;
2356
2357 nonce_high = x->nonce_high;
2358 nonce_low = x->nonce_low;
2359
2360 x->nonce_low += 1;
2361 if (x->nonce_low == 0) {
2362 x->nonce_low += 1;
2363 x->nonce_high += 1;
2364 }
2365
2366 /*
2367 * We need to place the SMB2_TRANSFORM header before the
2368 * first SMB2 header
2369 */
2370
2371 /*
2372 * we need to remember the encryption key
2373 * and defer the signing/encryption until
2374 * we are sure that we do not change
2375 * the header again.
2376 */
2377 req->first_key = data_blob_dup_talloc(req, encryption_key);
2378 if (req->first_key.data == NULL) {
2379 return NT_STATUS_NO_MEMORY;
2380 }
2381
2382 tf = talloc_zero_array(req, uint8_t,
2383 SMB2_TF_HDR_SIZE);
2384 if (tf == NULL) {
2385 return NT_STATUS_NO_MEMORY;
2386 }
2387
2388 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2389 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2390 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2391 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
2392
2393 firsttf->iov_base = (void *)tf;
2394 firsttf->iov_len = SMB2_TF_HDR_SIZE;
2395 }
2396
2397 if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
2398 (req->last_key.length > 0) &&
2399 (firsttf->iov_len == 0))
2400 {
2401 int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
2402 struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
2403
2404 /*
2405 * As we are sure the header of the last request in the
2406 * compound chain will not change, we can to sign here
2407 * with the last signing key we remembered.
2408 */
2409 status = smb2_signing_sign_pdu(req->last_key,
2410 xconn->protocol,
2411 lasthdr,
2412 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2413 if (!NT_STATUS_IS_OK(status)) {
2414 return status;
2415 }
2416 }
2417 if (req->last_key.length > 0) {
2418 data_blob_clear_free(&req->last_key);
2419 }
2420
2421 req->current_idx += SMBD_SMB2_NUM_IOV_PER_REQ;
2422
2423 if (req->current_idx < req->out.vector_count) {
2424 /*
2425 * We must process the remaining compound
2426 * SMB2 requests before any new incoming SMB2
2427 * requests. This is because incoming SMB2
2428 * requests may include a cancel for a
2429 * compound request we haven't processed
2430 * yet.
2431 */
2432 struct tevent_immediate *im = tevent_create_immediate(req);
2433 if (!im) {
2434 return NT_STATUS_NO_MEMORY;
2435 }
2436
2437 if (req->do_signing && firsttf->iov_len == 0) {
2438 struct smbXsrv_session *x = req->session;
2439 DATA_BLOB signing_key = x->global->channels[0].signing_key;
2440
2441 /*
2442 * we need to remember the signing key
2443 * and defer the signing until
2444 * we are sure that we do not change
2445 * the header again.
2446 */
2447 req->last_key = data_blob_dup_talloc(req, signing_key);
2448 if (req->last_key.data == NULL) {
2449 return NT_STATUS_NO_MEMORY;
2450 }
2451 }
2452
2453 tevent_schedule_immediate(im,
2454 req->sconn->ev_ctx,
2455 smbd_smb2_request_dispatch_immediate,
2456 req);
2457 return NT_STATUS_OK;
2458 }
2459
2460 if (req->compound_related) {
2461 req->compound_related = false;
2462 }
2463
2464 smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
2465
2466 /* Set credit for these operations (zero credits if this
2467 is a final reply for an async operation). */
2468 smb2_calculate_credits(req, req);
2469
2470 /*
2471 * now check if we need to sign the current response
2472 */
2473 if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
2474 status = smb2_signing_encrypt_pdu(req->first_key,
2475 xconn->protocol,
2476 firsttf,
2477 req->out.vector_count - first_idx);
2478 if (!NT_STATUS_IS_OK(status)) {
2479 return status;
2480 }
2481 } else if (req->do_signing) {
2482 struct smbXsrv_session *x = req->session;
2483 DATA_BLOB signing_key = x->global->channels[0].signing_key;
2484
2485 status = smb2_signing_sign_pdu(signing_key,
2486 xconn->protocol,
2487 outhdr,
2488 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2489 if (!NT_STATUS_IS_OK(status)) {
2490 return status;
2491 }
2492 }
2493 if (req->first_key.length > 0) {
2494 data_blob_clear_free(&req->first_key);
2495 }
2496
2497 /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
2498 if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
2499 outdyn->iov_base == NULL && outdyn->iov_len != 0) {
2500 /* Dynamic part is NULL. Chop it off,
2501 We're going to send it via sendfile. */
2502 req->out.vector_count -= 1;
2503 }
2504
2505 /*
2506 * We're done with this request -
2507 * move it off the "being processed" queue.
2508 */
2509 DLIST_REMOVE(xconn->smb2.requests, req);
2510
2511 req->queue_entry.mem_ctx = req;
2512 req->queue_entry.vector = req->out.vector;
2513 req->queue_entry.count = req->out.vector_count;
2514 DLIST_ADD_END(xconn->smb2.send_queue, &req->queue_entry, NULL);
2515 xconn->smb2.send_queue_len++;
2516
2517 status = smbd_smb2_flush_send_queue(xconn);
2518 if (!NT_STATUS_IS_OK(status)) {
2519 return status;
2520 }
2521
2522 return NT_STATUS_OK;
2523 }
2524
2525 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn);
2526
2527 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
2528 struct tevent_immediate *im,
2529 void *private_data)
2530 {
2531 struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
2532 struct smbd_smb2_request);
2533 struct smbd_server_connection *sconn = req->sconn;
2534 struct smbXsrv_connection *xconn = req->xconn;
2535 NTSTATUS status;
2536
2537 TALLOC_FREE(im);
2538
2539 if (DEBUGLEVEL >= 10) {
2540 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
2541 req->current_idx, req->in.vector_count));
2542 print_req_vectors(req);
2543 }
2544
2545 status = smbd_smb2_request_dispatch(req);
2546 if (!NT_STATUS_IS_OK(status)) {
2547 smbd_server_connection_terminate(sconn, nt_errstr(status));
2548 return;
2549 }
2550
2551 status = smbd_smb2_request_next_incoming(xconn);
2552 if (!NT_STATUS_IS_OK(status)) {
2553 smbd_server_connection_terminate(sconn, nt_errstr(status));
2554 return;
2555 }
2556 }
2557
2558 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
2559 NTSTATUS status,
2560 DATA_BLOB body, DATA_BLOB *dyn,
2561 const char *location)
2562 {
2563 uint8_t *outhdr;
2564 struct iovec *outbody_v;
2565 struct iovec *outdyn_v;
2566 uint32_t next_command_ofs;
2567
2568 DEBUG(10,("smbd_smb2_request_done_ex: "
2569 "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
2570 req->current_idx, nt_errstr(status), (unsigned int)body.length,
2571 dyn ? "yes": "no",
2572 (unsigned int)(dyn ? dyn->length : 0),
2573 location));
2574
2575 if (body.length < 2) {
2576 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2577 }
2578
2579 if ((body.length % 2) != 0) {
2580 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2581 }
2582
2583 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2584 outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
2585 outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
2586
2587 next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
2588 SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
2589
2590 outbody_v->iov_base = (void *)body.data;
2591 outbody_v->iov_len = body.length;
2592
2593 if (dyn) {
2594 outdyn_v->iov_base = (void *)dyn->data;
2595 outdyn_v->iov_len = dyn->length;
2596 } else {
2597 outdyn_v->iov_base = NULL;
2598 outdyn_v->iov_len = 0;
2599 }
2600
2601 /* see if we need to recalculate the offset to the next response */
2602 if (next_command_ofs > 0) {
2603 next_command_ofs = SMB2_HDR_BODY;
2604 next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
2605 next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
2606 }
2607
2608 if ((next_command_ofs % 8) != 0) {
2609 size_t pad_size = 8 - (next_command_ofs % 8);
2610 if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
2611 /*
2612 * if the dyn buffer is empty
2613 * we can use it to add padding
2614 */
2615 uint8_t *pad;
2616
2617 pad = talloc_zero_array(req,
2618 uint8_t, pad_size);
2619 if (pad == NULL) {
2620 return smbd_smb2_request_error(req,
2621 NT_STATUS_NO_MEMORY);
2622 }
2623
2624 outdyn_v->iov_base = (void *)pad;
2625 outdyn_v->iov_len = pad_size;
2626 } else {
2627 /*
2628 * For now we copy the dynamic buffer
2629 * and add the padding to the new buffer
2630 */
2631 size_t old_size;
2632 uint8_t *old_dyn;
2633 size_t new_size;
2634 uint8_t *new_dyn;
2635
2636 old_size = SMBD_SMB2_OUT_DYN_LEN(req);
2637 old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
2638
2639 new_size = old_size + pad_size;
2640 new_dyn = talloc_zero_array(req,
2641 uint8_t, new_size);
2642 if (new_dyn == NULL) {
2643 return smbd_smb2_request_error(req,
2644 NT_STATUS_NO_MEMORY);
2645 }
2646
2647 memcpy(new_dyn, old_dyn, old_size);
2648 memset(new_dyn + old_size, 0, pad_size);
2649
2650 outdyn_v->iov_base = (void *)new_dyn;
2651 outdyn_v->iov_len = new_size;
2652 }
2653 next_command_ofs += pad_size;
2654 }
2655
2656 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
2657
2658 return smbd_smb2_request_reply(req);
2659 }
2660
2661 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
2662 NTSTATUS status,
2663 DATA_BLOB *info,
2664 const char *location)
2665 {
2666 struct smbXsrv_connection *xconn = req->sconn->conn;
2667 DATA_BLOB body;
2668 DATA_BLOB _dyn;
2669 uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2670 size_t unread_bytes = smbd_smb2_unread_bytes(req);
2671
2672 DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
2673 req->current_idx, nt_errstr(status), info ? " +info" : "",
2674 location));
2675
2676 if (unread_bytes) {
2677 /* Recvfile error. Drain incoming socket. */
2678 size_t ret;
2679
2680 errno = 0;
2681 ret = drain_socket(xconn->transport.sock, unread_bytes);
2682 if (ret != unread_bytes) {
2683 NTSTATUS error;
2684
2685 if (errno == 0) {
2686 error = NT_STATUS_IO_DEVICE_ERROR;
2687 } else {
2688 error = map_nt_error_from_unix_common(errno);
2689 }
2690
2691 DEBUG(2, ("Failed to drain %u bytes from SMB2 socket: "
2692 "ret[%u] errno[%d] => %s\n",
2693 (unsigned)unread_bytes,
2694 (unsigned)ret, errno, nt_errstr(error)));
2695 return error;
2696 }
2697 }
2698
2699 body.data = outhdr + SMB2_HDR_BODY;
2700 body.length = 8;
2701 SSVAL(body.data, 0, 9);
2702
2703 if (info) {
2704 SIVAL(body.data, 0x04, info->length);
2705 } else {
2706 /* Allocated size of req->out.vector[i].iov_base
2707 * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
2708 * 1 byte without having to do an alloc.
2709 */
2710 info = &_dyn;
2711 info->data = ((uint8_t *)outhdr) +
2712 OUTVEC_ALLOC_SIZE - 1;
2713 info->length = 1;
2714 SCVAL(info->data, 0, 0);
2715 }
2716
2717 /*
2718 * Note: Even if there is an error, continue to process the request.
2719 * per MS-SMB2.
2720 */
2721
2722 return smbd_smb2_request_done_ex(req, status, body, info, __location__);
2723 }
2724
2725
2726 struct smbd_smb2_send_break_state {
2727 struct smbd_server_connection *sconn;
2728 struct smbd_smb2_send_queue queue_entry;
2729 uint8_t nbt_hdr[NBT_HDR_SIZE];
2730 uint8_t tf[SMB2_TF_HDR_SIZE];
2731 uint8_t hdr[SMB2_HDR_BODY];
2732 struct iovec vector[1+SMBD_SMB2_NUM_IOV_PER_REQ];
2733 uint8_t body[1];
2734 };
2735
2736 static NTSTATUS smbd_smb2_send_break(struct smbd_server_connection *sconn,
2737 struct smbXsrv_session *session,
2738 struct smbXsrv_tcon *tcon,
2739 const uint8_t *body,
2740 size_t body_len)
2741 {
2742 struct smbd_smb2_send_break_state *state;
2743 struct smbXsrv_connection *xconn = sconn->conn;
2744 bool do_encryption = session->global->encryption_required;
2745 uint64_t nonce_high = 0;
2746 uint64_t nonce_low = 0;
2747 NTSTATUS status;
2748 size_t statelen;
2749
2750 if (tcon->global->encryption_required) {
2751 do_encryption = true;
2752 }
2753
2754 statelen = offsetof(struct smbd_smb2_send_break_state, body) +
2755 body_len;
2756
2757 state = talloc_zero_size(sconn, statelen);
2758 if (state == NULL) {
2759 return NT_STATUS_NO_MEMORY;
2760 }
2761 talloc_set_name_const(state, "struct smbd_smb2_send_break_state");
2762 state->sconn = sconn;
2763
2764 if (do_encryption) {
2765 nonce_high = session->nonce_high;
2766 nonce_low = session->nonce_low;
2767
2768 session->nonce_low += 1;
2769 if (session->nonce_low == 0) {
2770 session->nonce_low += 1;
2771 session->nonce_high += 1;
2772 }
2773 }
2774
2775 SIVAL(state->tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2776 SBVAL(state->tf, SMB2_TF_NONCE+0, nonce_low);
2777 SBVAL(state->tf, SMB2_TF_NONCE+8, nonce_high);
2778 SBVAL(state->tf, SMB2_TF_SESSION_ID, session->global->session_wire_id);
2779
2780 SIVAL(state->hdr, 0, SMB2_MAGIC);
2781 SSVAL(state->hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
2782 SSVAL(state->hdr, SMB2_HDR_EPOCH, 0);
2783 SIVAL(state->hdr, SMB2_HDR_STATUS, 0);
2784 SSVAL(state->hdr, SMB2_HDR_OPCODE, SMB2_OP_BREAK);
2785 SSVAL(state->hdr, SMB2_HDR_CREDIT, 0);
2786 SIVAL(state->hdr, SMB2_HDR_FLAGS, SMB2_HDR_FLAG_REDIRECT);
2787 SIVAL(state->hdr, SMB2_HDR_NEXT_COMMAND, 0);
2788 SBVAL(state->hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
2789 SIVAL(state->hdr, SMB2_HDR_PID, 0);
2790 SIVAL(state->hdr, SMB2_HDR_TID, 0);
2791 SBVAL(state->hdr, SMB2_HDR_SESSION_ID, 0);
2792 memset(state->hdr+SMB2_HDR_SIGNATURE, 0, 16);
2793
2794 state->vector[0] = (struct iovec) {
2795 .iov_base = state->nbt_hdr,
2796 .iov_len = sizeof(state->nbt_hdr)
2797 };
2798
2799 if (do_encryption) {
2800 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
2801 .iov_base = state->tf,
2802 .iov_len = sizeof(state->tf)
2803 };
2804 } else {
2805 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
2806 .iov_base = NULL,
2807 .iov_len = 0
2808 };
2809 }
2810
2811 state->vector[1+SMBD_SMB2_HDR_IOV_OFS] = (struct iovec) {
2812 .iov_base = state->hdr,
2813 .iov_len = sizeof(state->hdr)
2814 };
2815
2816 memcpy(state->body, body, body_len);
2817
2818 state->vector[1+SMBD_SMB2_BODY_IOV_OFS] = (struct iovec) {
2819 .iov_base = state->body,
2820 .iov_len = body_len /* no sizeof(state->body) .. :-) */
2821 };
2822
2823 /*
2824 * state->vector[1+SMBD_SMB2_DYN_IOV_OFS] is NULL by talloc_zero above
2825 */
2826
2827 smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
2828
2829 if (do_encryption) {
2830 DATA_BLOB encryption_key = session->global->encryption_key;
2831
2832 status = smb2_signing_encrypt_pdu(encryption_key,
2833 xconn->protocol,
2834 &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
2835 SMBD_SMB2_NUM_IOV_PER_REQ);
2836 if (!NT_STATUS_IS_OK(status)) {
2837 return status;
2838 }
2839 }
2840
2841 state->queue_entry.mem_ctx = state;
2842 state->queue_entry.vector = state->vector;
2843 state->queue_entry.count = ARRAY_SIZE(state->vector);
2844 DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry, NULL);
2845 xconn->smb2.send_queue_len++;
2846
2847 status = smbd_smb2_flush_send_queue(xconn);
2848 if (!NT_STATUS_IS_OK(status)) {
2849 return status;
2850 }
2851
2852 return NT_STATUS_OK;
2853 }
2854
2855 NTSTATUS smbd_smb2_send_oplock_break(struct smbd_server_connection *sconn,
2856 struct smbXsrv_session *session,
2857 struct smbXsrv_tcon *tcon,
2858 struct smbXsrv_open *op,
2859 uint8_t oplock_level)
2860 {
2861 uint8_t body[0x18];
2862
2863 SSVAL(body, 0x00, sizeof(body));
2864 SCVAL(body, 0x02, oplock_level);
2865 SCVAL(body, 0x03, 0); /* reserved */
2866 SIVAL(body, 0x04, 0); /* reserved */
2867 SBVAL(body, 0x08, op->global->open_persistent_id);
2868 SBVAL(body, 0x10, op->global->open_volatile_id);
2869
2870 return smbd_smb2_send_break(sconn, session, tcon, body, sizeof(body));
2871 }
2872
2873 static bool is_smb2_recvfile_write(struct smbd_smb2_request_read_state *state)
2874 {
2875 NTSTATUS status;
2876 uint32_t flags;
2877 uint64_t file_id_persistent;
2878 uint64_t file_id_volatile;
2879 struct smbXsrv_open *op = NULL;
2880 struct files_struct *fsp = NULL;
2881 const uint8_t *body = NULL;
2882
2883 /*
2884 * This is only called with a pktbuf
2885 * of at least SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN
2886 * bytes
2887 */
2888
2889 if (IVAL(state->pktbuf, 0) == SMB2_TF_MAGIC) {
2890 /* Transform header. Cannot recvfile. */
2891 return false;
2892 }
2893 if (IVAL(state->pktbuf, 0) != SMB2_MAGIC) {
2894 /* Not SMB2. Normal error path will cope. */
2895 return false;
2896 }
2897 if (SVAL(state->pktbuf, 4) != SMB2_HDR_BODY) {
2898 /* Not SMB2. Normal error path will cope. */
2899 return false;
2900 }
2901 if (SVAL(state->pktbuf, SMB2_HDR_OPCODE) != SMB2_OP_WRITE) {
2902 /* Needs to be a WRITE. */
2903 return false;
2904 }
2905 if (IVAL(state->pktbuf, SMB2_HDR_NEXT_COMMAND) != 0) {
2906 /* Chained. Cannot recvfile. */
2907 return false;
2908 }
2909 flags = IVAL(state->pktbuf, SMB2_HDR_FLAGS);
2910 if (flags & SMB2_HDR_FLAG_CHAINED) {
2911 /* Chained. Cannot recvfile. */
2912 return false;
2913 }
2914 if (flags & SMB2_HDR_FLAG_SIGNED) {
2915 /* Signed. Cannot recvfile. */
2916 return false;
2917 }
2918
2919 body = &state->pktbuf[SMB2_HDR_BODY];
2920
2921 file_id_persistent = BVAL(body, 0x10);
2922 file_id_volatile = BVAL(body, 0x18);
2923
2924 status = smb2srv_open_lookup(state->req->sconn->conn,
2925 file_id_persistent,
2926 file_id_volatile,
2927 0, /* now */
2928 &op);
2929 if (!NT_STATUS_IS_OK(status)) {
2930 return false;
2931 }
2932
2933 fsp = op->compat;
2934 if (fsp == NULL) {
2935 return false;
2936 }
2937 if (fsp->conn == NULL) {
2938 return false;
2939 }
2940
2941 if (IS_IPC(fsp->conn)) {
2942 return false;
2943 }
2944 if (IS_PRINT(fsp->conn)) {
2945 return false;
2946 }
2947
2948 DEBUG(10,("Doing recvfile write len = %u\n",
2949 (unsigned int)(state->pktfull - state->pktlen)));
2950
2951 return true;
2952 }
2953
2954 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn)
2955 {
2956 struct smbd_server_connection *sconn = xconn->sconn;
2957 struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
2958 size_t max_send_queue_len;
2959 size_t cur_send_queue_len;
2960
2961 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2962 /*
2963 * we're not supposed to do any io
2964 */
2965 return NT_STATUS_OK;
2966 }
2967
2968 if (state->req != NULL) {
2969 /*
2970 * if there is already a tstream_readv_pdu
2971 * pending, we are done.
2972 */
2973 return NT_STATUS_OK;
2974 }
2975
2976 max_send_queue_len = MAX(1, xconn->smb2.credits.max/16);
2977 cur_send_queue_len = xconn->smb2.send_queue_len;
2978
2979 if (cur_send_queue_len > max_send_queue_len) {
2980 /*
2981 * if we have a lot of requests to send,
2982 * we wait until they are on the wire until we
2983 * ask for the next request.
2984 */
2985 return NT_STATUS_OK;
2986 }
2987
2988 /* ask for the next request */
2989 ZERO_STRUCTP(state);
2990 state->req = smbd_smb2_request_allocate(xconn);
2991 if (state->req == NULL) {
2992 return NT_STATUS_NO_MEMORY;
2993 }
2994 state->req->sconn = sconn;
2995 state->req->xconn = xconn;
2996 state->min_recv_size = lp_min_receive_file_size();
2997
2998 TEVENT_FD_READABLE(xconn->transport.fde);
2999
3000 return NT_STATUS_OK;
3001 }
3002
3003 void smbd_smb2_first_negprot(struct smbXsrv_connection *xconn,
3004 uint8_t *inbuf, size_t size)
3005 {
3006 struct smbd_server_connection *sconn = xconn->sconn;
3007 NTSTATUS status;
3008 struct smbd_smb2_request *req = NULL;
3009
3010 DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
3011 (unsigned int)size));
3012
3013 status = smbd_initialize_smb2(xconn);
3014 if (!NT_STATUS_IS_OK(status)) {
3015 smbd_server_connection_terminate(sconn, nt_errstr(status));
3016 return;
3017 }
3018
3019 status = smbd_smb2_request_create(xconn, inbuf, size, &req);
3020 if (!NT_STATUS_IS_OK(status)) {
3021 smbd_server_connection_terminate(sconn, nt_errstr(status));
3022 return;
3023 }
3024
3025 status = smbd_smb2_request_validate(req);
3026 if (!NT_STATUS_IS_OK(status)) {
3027 smbd_server_connection_terminate(sconn, nt_errstr(status));
3028 return;
3029 }
3030
3031 status = smbd_smb2_request_setup_out(req);
3032 if (!NT_STATUS_IS_OK(status)) {
3033 smbd_server_connection_terminate(sconn, nt_errstr(status));
3034 return;
3035 }
3036
3037 status = smbd_smb2_request_dispatch(req);
3038 if (!NT_STATUS_IS_OK(status)) {
3039 smbd_server_connection_terminate(sconn, nt_errstr(status));
3040 return;
3041 }
3042
3043 status = smbd_smb2_request_next_incoming(xconn);
3044 if (!NT_STATUS_IS_OK(status)) {
3045 smbd_server_connection_terminate(sconn, nt_errstr(status));
3046 return;
3047 }
3048
3049 sconn->num_requests++;
3050 }
3051
3052 static int socket_error_from_errno(int ret,
3053 int sys_errno,
3054 bool *retry)
3055 {
3056 *retry = false;
3057
3058 if (ret >= 0) {
3059 return 0;
3060 }
3061
3062 if (ret != -1) {
3063 return EIO;
3064 }
3065
3066 if (sys_errno == 0) {
3067 return EIO;
3068 }
3069
3070 if (sys_errno == EINTR) {
3071 *retry = true;
3072 return sys_errno;
3073 }
3074
3075 if (sys_errno == EINPROGRESS) {
3076 *retry = true;
3077 return sys_errno;
3078 }
3079
3080 if (sys_errno == EAGAIN) {
3081 *retry = true;
3082 return sys_errno;
3083 }
3084
3085 /* ENOMEM is retryable on Solaris/illumos, and possibly other systems. */
3086 if (sys_errno == ENOMEM) {
3087 *retry = true;
3088 return sys_errno;
3089 }
3090
3091 #ifdef EWOULDBLOCK
3092 #if EWOULDBLOCK != EAGAIN
3093 if (sys_errno == EWOULDBLOCK) {
3094 *retry = true;
3095 return sys_errno;
3096 }
3097 #endif
3098 #endif
3099
3100 return sys_errno;
3101 }
3102
3103 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn)
3104 {
3105 int ret;
3106 int err;
3107 bool retry;
3108
3109 if (xconn->smb2.send_queue == NULL) {
3110 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3111 return NT_STATUS_OK;
3112 }
3113
3114 while (xconn->smb2.send_queue != NULL) {
3115 struct smbd_smb2_send_queue *e = xconn->smb2.send_queue;
3116
3117 if (e->sendfile_header != NULL) {
3118 size_t size = 0;
3119 size_t i = 0;
3120 uint8_t *buf;
3121
3122 for (i=0; i < e->count; i++) {
3123 size += e->vector[i].iov_len;
3124 }
3125
3126 if (size <= e->sendfile_header->length) {
3127 buf = e->sendfile_header->data;
3128 } else {
3129 buf = talloc_array(e->mem_ctx, uint8_t, size);
3130 if (buf == NULL) {
3131 return NT_STATUS_NO_MEMORY;
3132 }
3133 }
3134
3135 size = 0;
3136 for (i=0; i < e->count; i++) {
3137 memcpy(buf+size,
3138 e->vector[i].iov_base,
3139 e->vector[i].iov_len);
3140 size += e->vector[i].iov_len;
3141 }
3142
3143 e->sendfile_header->data = buf;
3144 e->sendfile_header->length = size;
3145 e->count = 0;
3146
3147 xconn->smb2.send_queue_len--;
3148 DLIST_REMOVE(xconn->smb2.send_queue, e);
3149 /*
3150 * This triggers the sendfile path via
3151 * the destructor.
3152 */
3153 talloc_free(e->mem_ctx);
3154 continue;
3155 }
3156
3157 ret = writev(xconn->transport.sock, e->vector, e->count);
3158 if (ret == 0) {
3159 /* propagate end of file */
3160 return NT_STATUS_INTERNAL_ERROR;
3161 }
3162 err = socket_error_from_errno(ret, errno, &retry);
3163 if (retry) {
3164 /* retry later */
3165 TEVENT_FD_WRITEABLE(xconn->transport.fde);
3166 return NT_STATUS_OK;
3167 }
3168 if (err != 0) {
3169 return map_nt_error_from_unix_common(err);
3170 }
3171 while (ret > 0) {
3172 if (ret < e->vector[0].iov_len) {
3173 uint8_t *base;
3174 base = (uint8_t *)e->vector[0].iov_base;
3175 base += ret;
3176 e->vector[0].iov_base = (void *)base;
3177 e->vector[0].iov_len -= ret;
3178 break;
3179 }
3180 ret -= e->vector[0].iov_len;
3181 e->vector += 1;
3182 e->count -= 1;
3183 }
3184
3185 /*
3186 * there're maybe some empty vectors at the end
3187 * which we need to skip, otherwise we would get
3188 * ret == 0 from the readv() call and return EPIPE
3189 */
3190 while (e->count > 0) {
3191 if (e->vector[0].iov_len > 0) {
3192 break;
3193 }
3194 e->vector += 1;
3195 e->count -= 1;
3196 }
3197
3198 if (e->count > 0) {
3199 /* we have more to write */
3200 TEVENT_FD_WRITEABLE(xconn->transport.fde);
3201 return NT_STATUS_OK;
3202 }
3203
3204 xconn->smb2.send_queue_len--;
3205 DLIST_REMOVE(xconn->smb2.send_queue, e);
3206 talloc_free(e->mem_ctx);
3207 }
3208
3209 return NT_STATUS_OK;
3210 }
3211
3212 static NTSTATUS smbd_smb2_io_handler(struct smbXsrv_connection *xconn,
3213 uint16_t fde_flags)
3214 {
3215 struct smbd_server_connection *sconn = xconn->sconn;
3216 struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
3217 struct smbd_smb2_request *req = NULL;
3218 size_t min_recvfile_size = UINT32_MAX;
3219 int ret;
3220 int err;
3221 bool retry;
3222 NTSTATUS status;
3223 NTTIME now;
3224
3225 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
3226 /*
3227 * we're not supposed to do any io
3228 */
3229 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3230 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3231 return NT_STATUS_OK;
3232 }
3233
3234 if (fde_flags & TEVENT_FD_WRITE) {
3235 status = smbd_smb2_flush_send_queue(xconn);
3236 if (!NT_STATUS_IS_OK(status)) {
3237 return status;
3238 }
3239 }
3240
3241 if (!(fde_flags & TEVENT_FD_READ)) {
3242 return NT_STATUS_OK;
3243 }
3244
3245 if (state->req == NULL) {
3246 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3247 return NT_STATUS_OK;
3248 }
3249
3250 again:
3251 if (!state->hdr.done) {
3252 state->hdr.done = true;
3253
3254 state->vector.iov_base = (void *)state->hdr.nbt;
3255 state->vector.iov_len = NBT_HDR_SIZE;
3256 }
3257
3258 ret = readv(xconn->transport.sock, &state->vector, 1);
3259 if (ret == 0) {
3260 /* propagate end of file */
3261 return NT_STATUS_END_OF_FILE;
3262 }
3263 err = socket_error_from_errno(ret, errno, &retry);
3264 if (retry) {
3265 /* retry later */
3266 TEVENT_FD_READABLE(xconn->transport.fde);
3267 return NT_STATUS_OK;
3268 }
3269 if (err != 0) {
3270 return map_nt_error_from_unix_common(err);
3271 }
3272
3273 if (ret < state->vector.iov_len) {
3274 uint8_t *base;
3275 base = (uint8_t *)state->vector.iov_base;
3276 base += ret;
3277 state->vector.iov_base = (void *)base;
3278 state->vector.iov_len -= ret;
3279 /* we have more to read */
3280 TEVENT_FD_READABLE(xconn->transport.fde);
3281 return NT_STATUS_OK;
3282 }
3283
3284 if (state->pktlen > 0) {
3285 if (state->doing_receivefile && !is_smb2_recvfile_write(state)) {
3286 /*
3287 * Not a possible receivefile write.
3288 * Read the rest of the data.
3289 */
3290 state->doing_receivefile = false;
3291
3292 state->pktbuf = talloc_realloc(state->req,
3293 state->pktbuf,
3294 uint8_t,
3295 state->pktfull);
3296 if (state->pktbuf == NULL) {
3297 return NT_STATUS_NO_MEMORY;
3298 }
3299
3300 state->vector.iov_base = (void *)(state->pktbuf +
3301 state->pktlen);
3302 state->vector.iov_len = (state->pktfull -
3303 state->pktlen);
3304
3305 state->pktlen = state->pktfull;
3306 goto again;
3307 }
3308
3309 /*
3310 * Either this is a receivefile write so we've
3311 * done a short read, or if not we have all the data.
3312 */
3313 goto got_full;
3314 }
3315
3316 /*
3317 * Now we analyze the NBT header
3318 */
3319 if (state->hdr.nbt[0] != 0x00) {
3320 state->min_recv_size = 0;
3321 }
3322 state->pktfull = smb2_len(state->hdr.nbt);
3323 if (state->pktfull == 0) {
3324 goto got_full;
3325 }
3326
3327 if (state->min_recv_size != 0) {
3328 min_recvfile_size = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3329 min_recvfile_size += state->min_recv_size;
3330 }
3331
3332 if (state->pktfull > min_recvfile_size) {
3333 /*
3334 * Might be a receivefile write. Read the SMB2 HEADER +
3335 * SMB2_WRITE header first. Set 'doing_receivefile'
3336 * as we're *attempting* receivefile write. If this
3337 * turns out not to be a SMB2_WRITE request or otherwise
3338 * not suitable then we'll just read the rest of the data
3339 * the next time this function is called.
3340 */
3341 state->pktlen = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3342 state->doing_receivefile = true;
3343 } else {
3344 state->pktlen = state->pktfull;
3345 }
3346
3347 state->pktbuf = talloc_array(state->req, uint8_t, state->pktlen);
3348 if (state->pktbuf == NULL) {
3349 return NT_STATUS_NO_MEMORY;
3350 }
3351
3352 state->vector.iov_base = (void *)state->pktbuf;
3353 state->vector.iov_len = state->pktlen;
3354
3355 goto again;
3356
3357 got_full:
3358
3359 if (state->hdr.nbt[0] != 0x00) {
3360 DEBUG(1,("ignore NBT[0x%02X] msg\n",
3361 state->hdr.nbt[0]));
3362
3363 req = state->req;
3364 ZERO_STRUCTP(state);
3365 state->req = req;
3366 state->min_recv_size = lp_min_receive_file_size();
3367 req = NULL;
3368 goto again;
3369 }
3370
3371 req = state->req;
3372 state->req = NULL;
3373
3374 req->request_time = timeval_current();
3375 now = timeval_to_nttime(&req->request_time);
3376
3377 status = smbd_smb2_inbuf_parse_compound(xconn,
3378 now,
3379 state->pktbuf,
3380 state->pktlen,
3381 req,
3382 &req->in.vector,
3383 &req->in.vector_count);
3384 if (!NT_STATUS_IS_OK(status)) {
3385 return status;
3386 }
3387
3388 if (state->doing_receivefile) {
3389 req->smb1req = talloc_zero(req, struct smb_request);
3390 if (req->smb1req == NULL) {
3391 return NT_STATUS_NO_MEMORY;
3392 }
3393 req->smb1req->unread_bytes = state->pktfull - state->pktlen;
3394 }
3395
3396 ZERO_STRUCTP(state);
3397
3398 req->current_idx = 1;
3399
3400 DEBUG(10,("smbd_smb2_request idx[%d] of %d vectors\n",
3401 req->current_idx, req->in.vector_count));
3402
3403 status = smbd_smb2_request_validate(req);
3404 if (!NT_STATUS_IS_OK(status)) {
3405 return status;
3406 }
3407
3408 status = smbd_smb2_request_setup_out(req);
3409 if (!NT_STATUS_IS_OK(status)) {
3410 return status;
3411 }
3412
3413 status = smbd_smb2_request_dispatch(req);
3414 if (!NT_STATUS_IS_OK(status)) {
3415 return status;
3416 }
3417
3418 sconn->num_requests++;
3419
3420 /* The timeout_processing function isn't run nearly
3421 often enough to implement 'max log size' without
3422 overrunning the size of the file by many megabytes.
3423 This is especially true if we are running at debug
3424 level 10. Checking every 50 SMB2s is a nice
3425 tradeoff of performance vs log file size overrun. */
3426
3427 if ((sconn->num_requests % 50) == 0 &&
3428 need_to_check_log_size()) {
3429 change_to_root_user();
3430 check_log_size();
3431 }
3432
3433 status = smbd_smb2_request_next_incoming(xconn);
3434 if (!NT_STATUS_IS_OK(status)) {
3435 return status;
3436 }
3437
3438 return NT_STATUS_OK;
3439 }
3440
3441 static void smbd_smb2_connection_handler(struct tevent_context *ev,
3442 struct tevent_fd *fde,
3443 uint16_t flags,
3444 void *private_data)
3445 {
3446 struct smbXsrv_connection *xconn =
3447 talloc_get_type_abort(private_data,
3448 struct smbXsrv_connection);
3449 struct smbd_server_connection *sconn = xconn->sconn;
3450 NTSTATUS status;
3451
3452 status = smbd_smb2_io_handler(xconn, flags);
3453 if (!NT_STATUS_IS_OK(status)) {
3454 smbd_server_connection_terminate(sconn, nt_errstr(status));
3455 return;
3456 }
3457 }
Samba GIT mirror