2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2014
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "system/filesys.h"
23 #include "lib/util/server_id.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "dbwrap/dbwrap.h"
27 #include "dbwrap/dbwrap_rbt.h"
28 #include "dbwrap/dbwrap_open.h"
29 #include "dbwrap/dbwrap_watch.h"
32 #include "auth/gensec/gensec.h"
33 #include "../lib/tsocket/tsocket.h"
34 #include "../libcli/security/security.h"
36 #include "lib/util/util_tdb.h"
37 #include "librpc/gen_ndr/ndr_smbXsrv.h"
39 #include "lib/util/tevent_ntstatus.h"
40 #include "lib/util/iov_buf.h"
41 #include "lib/global_contexts.h"
42 #include "source3/include/util_tdb.h"
44 struct smbXsrv_client_table
{
50 struct db_context
*db_ctx
;
54 static struct db_context
*smbXsrv_client_global_db_ctx
= NULL
;
56 NTSTATUS
smbXsrv_client_global_init(void)
58 const char *global_path
= NULL
;
59 struct db_context
*backend
= NULL
;
60 struct db_context
*db_ctx
= NULL
;
62 if (smbXsrv_client_global_db_ctx
!= NULL
) {
67 * This contains secret information like client keys!
69 global_path
= lock_path(talloc_tos(), "smbXsrv_client_global.tdb");
70 if (global_path
== NULL
) {
71 return NT_STATUS_NO_MEMORY
;
74 backend
= db_open(NULL
, global_path
,
78 TDB_INCOMPATIBLE_HASH
,
79 O_RDWR
| O_CREAT
, 0600,
82 if (backend
== NULL
) {
85 status
= map_nt_error_from_unix_common(errno
);
90 db_ctx
= db_open_watched(NULL
, &backend
, global_messaging_context());
93 return NT_STATUS_NO_MEMORY
;
96 smbXsrv_client_global_db_ctx
= db_ctx
;
103 * We need to store the keys in big endian so that dbwrap_rbt's memcmp
104 * has the same result as integer comparison between the uint32_t
107 * TODO: implement string based key
110 #define SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE 16
112 static TDB_DATA
smbXsrv_client_global_id_to_key(const struct GUID
*client_guid
,
115 TDB_DATA key
= { .dsize
= 0, };
117 struct GUID_ndr_buf buf
= { .buf
= {0}, };
119 status
= GUID_to_ndr_buf(client_guid
, &buf
);
120 if (!NT_STATUS_IS_OK(status
)) {
123 memcpy(key_buf
, buf
.buf
, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE
);
125 key
= make_tdb_data(key_buf
, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE
);
130 static struct db_record
*smbXsrv_client_global_fetch_locked(
131 struct db_context
*db
,
132 const struct GUID
*client_guid
,
136 uint8_t key_buf
[SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE
];
137 struct db_record
*rec
= NULL
;
139 key
= smbXsrv_client_global_id_to_key(client_guid
, key_buf
);
141 rec
= dbwrap_fetch_locked(db
, mem_ctx
, key
);
144 struct GUID_txt_buf buf
;
145 DBG_DEBUG("Failed to lock guid [%s], key '%s'\n",
146 GUID_buf_string(client_guid
, &buf
),
153 static NTSTATUS
smbXsrv_client_table_create(TALLOC_CTX
*mem_ctx
,
154 struct messaging_context
*msg_ctx
,
155 uint32_t max_clients
,
156 struct smbXsrv_client_table
**_table
)
158 struct smbXsrv_client_table
*table
;
161 if (max_clients
> 1) {
162 return NT_STATUS_INTERNAL_ERROR
;
165 table
= talloc_zero(mem_ctx
, struct smbXsrv_client_table
);
167 return NT_STATUS_NO_MEMORY
;
170 table
->local
.max_clients
= max_clients
;
172 status
= smbXsrv_client_global_init();
173 if (!NT_STATUS_IS_OK(status
)) {
178 table
->global
.db_ctx
= smbXsrv_client_global_db_ctx
;
184 static int smbXsrv_client_global_destructor(struct smbXsrv_client_global0
*global
)
189 static void smbXsrv_client_global_verify_record(struct db_record
*db_rec
,
193 const struct server_id
*dead_server_id
,
194 struct smbXsrv_client_global0
**_g
,
200 struct smbXsrv_client_globalB global_blob
;
201 enum ndr_err_code ndr_err
;
202 struct smbXsrv_client_global0
*global
= NULL
;
205 TALLOC_CTX
*frame
= talloc_stackframe();
219 key
= dbwrap_record_get_key(db_rec
);
221 val
= dbwrap_record_get_value(db_rec
);
222 if (val
.dsize
== 0) {
231 blob
= data_blob_const(val
.dptr
, val
.dsize
);
233 ndr_err
= ndr_pull_struct_blob(&blob
, frame
, &global_blob
,
234 (ndr_pull_flags_fn_t
)ndr_pull_smbXsrv_client_globalB
);
235 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
236 NTSTATUS status
= ndr_map_error2ntstatus(ndr_err
);
237 DBG_WARNING("key '%s' ndr_pull_struct_blob - %s\n",
244 DBG_DEBUG("client_global:\n");
245 if (DEBUGLVL(DBGLVL_DEBUG
)) {
246 NDR_PRINT_DEBUG(smbXsrv_client_globalB
, &global_blob
);
249 if (global_blob
.version
!= SMBXSRV_VERSION_0
) {
250 DBG_ERR("key '%s' use unsupported version %u\n",
252 global_blob
.version
);
253 NDR_PRINT_DEBUG(smbXsrv_client_globalB
, &global_blob
);
258 global
= global_blob
.info
.info0
;
260 dead
= server_id_equal(dead_server_id
, &global
->server_id
);
262 struct server_id_buf tmp
;
264 DBG_NOTICE("key '%s' server_id %s is already dead.\n",
266 server_id_str_buf(global
->server_id
, &tmp
));
267 if (DEBUGLVL(DBGLVL_NOTICE
)) {
268 NDR_PRINT_DEBUG(smbXsrv_client_globalB
, &global_blob
);
271 dbwrap_record_delete(db_rec
);
276 exists
= serverid_exists(&global
->server_id
);
278 struct server_id_buf tmp
;
280 DBG_NOTICE("key '%s' server_id %s does not exist.\n",
282 server_id_str_buf(global
->server_id
, &tmp
));
283 if (DEBUGLVL(DBGLVL_NOTICE
)) {
284 NDR_PRINT_DEBUG(smbXsrv_client_globalB
, &global_blob
);
287 dbwrap_record_delete(db_rec
);
293 *_g
= talloc_move(mem_ctx
, &global
);
296 *pseqnum
= global_blob
.seqnum
;
301 static NTSTATUS
smb2srv_client_connection_pass(struct smbd_smb2_request
*smb2req
,
302 struct smbXsrv_client_global0
*global
)
305 enum ndr_err_code ndr_err
;
307 struct smbXsrv_connection_pass0 pass_info0
;
308 struct smbXsrv_connection_passB pass_blob
;
312 pass_info0
= (struct smbXsrv_connection_pass0
) {
313 .client_guid
= global
->client_guid
,
314 .src_server_id
= smb2req
->xconn
->client
->global
->server_id
,
315 .xconn_connect_time
= smb2req
->xconn
->client
->global
->initial_connect_time
,
316 .dst_server_id
= global
->server_id
,
317 .client_connect_time
= global
->initial_connect_time
,
320 reqlen
= iov_buflen(smb2req
->in
.vector
, smb2req
->in
.vector_count
);
322 return NT_STATUS_INVALID_BUFFER_SIZE
;
325 pass_info0
.negotiate_request
.length
= reqlen
;
326 pass_info0
.negotiate_request
.data
= talloc_array(talloc_tos(), uint8_t,
328 if (pass_info0
.negotiate_request
.data
== NULL
) {
329 return NT_STATUS_NO_MEMORY
;
331 iov_buf(smb2req
->in
.vector
, smb2req
->in
.vector_count
,
332 pass_info0
.negotiate_request
.data
,
333 pass_info0
.negotiate_request
.length
);
335 ZERO_STRUCT(pass_blob
);
336 pass_blob
.version
= smbXsrv_version_global_current();
337 pass_blob
.info
.info0
= &pass_info0
;
339 if (DEBUGLVL(DBGLVL_DEBUG
)) {
340 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &pass_blob
);
343 ndr_err
= ndr_push_struct_blob(&blob
, talloc_tos(), &pass_blob
,
344 (ndr_push_flags_fn_t
)ndr_push_smbXsrv_connection_passB
);
345 data_blob_free(&pass_info0
.negotiate_request
);
346 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
347 status
= ndr_map_error2ntstatus(ndr_err
);
351 iov
.iov_base
= blob
.data
;
352 iov
.iov_len
= blob
.length
;
354 status
= messaging_send_iov(smb2req
->xconn
->client
->msg_ctx
,
356 MSG_SMBXSRV_CONNECTION_PASS
,
358 &smb2req
->xconn
->transport
.sock
, 1);
359 data_blob_free(&blob
);
360 if (!NT_STATUS_IS_OK(status
)) {
367 static NTSTATUS
smb2srv_client_connection_drop(struct smbd_smb2_request
*smb2req
,
368 struct smbXsrv_client_global0
*global
)
371 enum ndr_err_code ndr_err
;
373 struct smbXsrv_connection_drop0 drop_info0
;
374 struct smbXsrv_connection_dropB drop_blob
;
377 drop_info0
= (struct smbXsrv_connection_drop0
) {
378 .client_guid
= global
->client_guid
,
379 .src_server_id
= smb2req
->xconn
->client
->global
->server_id
,
380 .xconn_connect_time
= smb2req
->xconn
->client
->global
->initial_connect_time
,
381 .dst_server_id
= global
->server_id
,
382 .client_connect_time
= global
->initial_connect_time
,
385 ZERO_STRUCT(drop_blob
);
386 drop_blob
.version
= smbXsrv_version_global_current();
387 drop_blob
.info
.info0
= &drop_info0
;
389 if (DEBUGLVL(DBGLVL_DEBUG
)) {
390 NDR_PRINT_DEBUG(smbXsrv_connection_dropB
, &drop_blob
);
393 ndr_err
= ndr_push_struct_blob(&blob
, talloc_tos(), &drop_blob
,
394 (ndr_push_flags_fn_t
)ndr_push_smbXsrv_connection_dropB
);
395 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
396 status
= ndr_map_error2ntstatus(ndr_err
);
400 iov
.iov_base
= blob
.data
;
401 iov
.iov_len
= blob
.length
;
403 status
= messaging_send_iov(smb2req
->xconn
->client
->msg_ctx
,
405 MSG_SMBXSRV_CONNECTION_DROP
,
408 data_blob_free(&blob
);
409 if (!NT_STATUS_IS_OK(status
)) {
416 static NTSTATUS
smbXsrv_client_global_store(struct smbXsrv_client_global0
*global
)
418 struct smbXsrv_client_globalB global_blob
;
419 DATA_BLOB blob
= data_blob_null
;
423 enum ndr_err_code ndr_err
;
424 bool saved_stored
= global
->stored
;
427 * TODO: if we use other versions than '0'
428 * we would add glue code here, that would be able to
429 * store the information in the old format.
432 SMB_ASSERT(global
->local_address
!= NULL
);
433 SMB_ASSERT(global
->remote_address
!= NULL
);
434 SMB_ASSERT(global
->remote_name
!= NULL
);
436 if (global
->db_rec
== NULL
) {
437 return NT_STATUS_INTERNAL_ERROR
;
440 key
= dbwrap_record_get_key(global
->db_rec
);
441 val
= dbwrap_record_get_value(global
->db_rec
);
443 ZERO_STRUCT(global_blob
);
444 global_blob
.version
= smbXsrv_version_global_current();
445 if (val
.dsize
>= 8) {
446 global_blob
.seqnum
= IVAL(val
.dptr
, 4);
448 global_blob
.seqnum
+= 1;
449 global_blob
.info
.info0
= global
;
451 global
->stored
= true;
452 ndr_err
= ndr_push_struct_blob(&blob
, global
->db_rec
, &global_blob
,
453 (ndr_push_flags_fn_t
)ndr_push_smbXsrv_client_globalB
);
454 global
->stored
= saved_stored
;
455 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
456 status
= ndr_map_error2ntstatus(ndr_err
);
457 DBG_WARNING("key '%s' ndr_push - %s\n",
460 TALLOC_FREE(global
->db_rec
);
464 val
= make_tdb_data(blob
.data
, blob
.length
);
465 status
= dbwrap_record_store(global
->db_rec
, val
, TDB_REPLACE
);
466 if (!NT_STATUS_IS_OK(status
)) {
467 DBG_WARNING("key '%s' store - %s\n",
470 TALLOC_FREE(global
->db_rec
);
474 global
->stored
= true;
476 if (DEBUGLVL(DBGLVL_DEBUG
)) {
477 DBG_DEBUG("key '%s' stored\n",
479 NDR_PRINT_DEBUG(smbXsrv_client_globalB
, &global_blob
);
482 TALLOC_FREE(global
->db_rec
);
487 struct smb2srv_client_mc_negprot_state
{
488 struct tevent_context
*ev
;
489 struct smbd_smb2_request
*smb2req
;
490 struct db_record
*db_rec
;
491 struct server_id sent_server_id
;
492 uint64_t watch_instance
;
493 uint32_t last_seqnum
;
494 struct tevent_req
*filter_subreq
;
497 static void smb2srv_client_mc_negprot_cleanup(struct tevent_req
*req
,
498 enum tevent_req_state req_state
)
500 struct smb2srv_client_mc_negprot_state
*state
=
502 struct smb2srv_client_mc_negprot_state
);
504 if (state
->db_rec
!= NULL
) {
505 dbwrap_watched_watch_remove_instance(state
->db_rec
,
506 state
->watch_instance
);
507 state
->watch_instance
= 0;
508 TALLOC_FREE(state
->db_rec
);
512 static void smb2srv_client_mc_negprot_next(struct tevent_req
*req
);
513 static bool smb2srv_client_mc_negprot_filter(struct messaging_rec
*rec
, void *private_data
);
514 static void smb2srv_client_mc_negprot_done(struct tevent_req
*subreq
);
515 static void smb2srv_client_mc_negprot_watched(struct tevent_req
*subreq
);
517 struct tevent_req
*smb2srv_client_mc_negprot_send(TALLOC_CTX
*mem_ctx
,
518 struct tevent_context
*ev
,
519 struct smbd_smb2_request
*smb2req
)
521 struct tevent_req
*req
= NULL
;
522 struct smb2srv_client_mc_negprot_state
*state
= NULL
;
524 req
= tevent_req_create(mem_ctx
, &state
,
525 struct smb2srv_client_mc_negprot_state
);
530 state
->smb2req
= smb2req
;
532 tevent_req_set_cleanup_fn(req
, smb2srv_client_mc_negprot_cleanup
);
534 server_id_set_disconnected(&state
->sent_server_id
);
536 smb2srv_client_mc_negprot_next(req
);
538 if (!tevent_req_is_in_progress(req
)) {
539 return tevent_req_post(req
, ev
);
545 static void smb2srv_client_mc_negprot_next(struct tevent_req
*req
)
547 struct smb2srv_client_mc_negprot_state
*state
=
549 struct smb2srv_client_mc_negprot_state
);
550 struct smbXsrv_connection
*xconn
= state
->smb2req
->xconn
;
551 struct smbXsrv_client
*client
= xconn
->client
;
552 struct smbXsrv_client_table
*table
= client
->table
;
553 struct GUID client_guid
= xconn
->smb2
.client
.guid
;
554 struct smbXsrv_client_global0
*global
= NULL
;
555 bool is_free
= false;
556 struct tevent_req
*subreq
= NULL
;
559 struct server_id last_server_id
= { .pid
= 0, };
561 SMB_ASSERT(state
->db_rec
== NULL
);
562 state
->db_rec
= smbXsrv_client_global_fetch_locked(table
->global
.db_ctx
,
565 if (state
->db_rec
== NULL
) {
566 tevent_req_nterror(req
, NT_STATUS_INTERNAL_DB_ERROR
);
573 smbXsrv_client_global_verify_record(state
->db_rec
,
581 dbwrap_watched_watch_remove_instance(state
->db_rec
,
582 state
->watch_instance
);
583 state
->watch_instance
= 0;
586 * This stores the new client information in
587 * smbXsrv_client_global.tdb
589 client
->global
->client_guid
= xconn
->smb2
.client
.guid
;
591 client
->global
->db_rec
= state
->db_rec
;
592 state
->db_rec
= NULL
;
593 status
= smbXsrv_client_global_store(client
->global
);
594 SMB_ASSERT(client
->global
->db_rec
== NULL
);
595 if (!NT_STATUS_IS_OK(status
)) {
596 struct GUID_txt_buf buf
;
597 DBG_ERR("client_guid[%s] store failed - %s\n",
598 GUID_buf_string(&client
->global
->client_guid
,
601 tevent_req_nterror(req
, status
);
605 if (DEBUGLVL(DBGLVL_DEBUG
)) {
606 struct smbXsrv_clientB client_blob
= {
607 .version
= SMBXSRV_VERSION_0
,
608 .info
.info0
= client
,
610 struct GUID_txt_buf buf
;
612 DBG_DEBUG("client_guid[%s] stored\n",
613 GUID_buf_string(&client
->global
->client_guid
,
615 NDR_PRINT_DEBUG(smbXsrv_clientB
, &client_blob
);
618 xconn
->smb2
.client
.guid_verified
= true;
619 tevent_req_done(req
);
623 if (global
== NULL
) {
625 * most likely ndr_pull_struct_blob() failed
627 tevent_req_nterror(req
, NT_STATUS_INTERNAL_DB_CORRUPTION
);
631 if (server_id_equal(&state
->sent_server_id
, &global
->server_id
)) {
633 * We hit a race with other concurrent connections,
634 * which have woken us.
636 * We already sent the pass or drop message to
637 * the process, so we need to wait for a
638 * response and not pass the connection
639 * again! Otherwise the process would
640 * receive the same tcp connection via
641 * more than one file descriptor and
642 * create more than one smbXsrv_connection
643 * structure for the same tcp connection,
644 * which means the client would see more
645 * than one SMB2 negprot response to its
646 * single SMB2 netprot request and we
647 * as server get the session keys and
648 * message id validation wrong
653 server_id_set_disconnected(&state
->sent_server_id
);
656 * If last_server_id is set, we expect
657 * smbXsrv_client_global_verify_record()
658 * to detect the already dead global->server_id
659 * as state->db_rec is still locked and its
660 * value didn't change.
662 SMB_ASSERT(last_server_id
.pid
== 0);
663 last_server_id
= global
->server_id
;
665 TALLOC_FREE(state
->filter_subreq
);
666 if (procid_is_local(&global
->server_id
)) {
667 subreq
= messaging_filtered_read_send(state
,
670 smb2srv_client_mc_negprot_filter
,
672 if (tevent_req_nomem(subreq
, req
)) {
675 tevent_req_set_callback(subreq
, smb2srv_client_mc_negprot_done
, req
);
676 state
->filter_subreq
= subreq
;
679 if (procid_is_local(&global
->server_id
)) {
680 status
= smb2srv_client_connection_pass(state
->smb2req
,
682 if (NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
684 * We remembered last_server_id = global->server_id
685 * above, so we'll treat it as dead in the
686 * next round to smbXsrv_client_global_verify_record().
690 state
->sent_server_id
= global
->server_id
;
691 if (tevent_req_nterror(req
, status
)) {
695 status
= smb2srv_client_connection_drop(state
->smb2req
,
697 if (NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
699 * We remembered last_server_id = global->server_id
700 * above, so we'll treat it as dead in the
701 * next round to smbXsrv_client_global_verify_record().
705 state
->sent_server_id
= global
->server_id
;
706 if (tevent_req_nterror(req
, status
)) {
714 * If the record changed, but we are not happy with the change yet,
715 * we better remove ourself from the waiter list
716 * (most likely the first position)
717 * and re-add us at the end of the list.
719 * This gives other waiters a change
722 * Otherwise we'll keep our waiter instance alive,
723 * keep waiting (most likely at first position).
724 * It means the order of watchers stays fair.
726 if (state
->last_seqnum
!= seqnum
) {
727 state
->last_seqnum
= seqnum
;
728 dbwrap_watched_watch_remove_instance(state
->db_rec
,
729 state
->watch_instance
);
730 state
->watch_instance
=
731 dbwrap_watched_watch_add_instance(state
->db_rec
);
734 subreq
= dbwrap_watched_watch_send(state
,
737 state
->watch_instance
,
739 if (tevent_req_nomem(subreq
, req
)) {
742 tevent_req_set_callback(subreq
, smb2srv_client_mc_negprot_watched
, req
);
745 TALLOC_FREE(state
->db_rec
);
749 static bool smb2srv_client_mc_negprot_filter(struct messaging_rec
*rec
, void *private_data
)
751 if (rec
->msg_type
!= MSG_SMBXSRV_CONNECTION_PASSED
) {
755 if (rec
->num_fds
!= 0) {
762 static void smb2srv_client_mc_negprot_done(struct tevent_req
*subreq
)
764 struct tevent_req
*req
=
765 tevent_req_callback_data(subreq
,
767 struct smb2srv_client_mc_negprot_state
*state
=
769 struct smb2srv_client_mc_negprot_state
);
770 struct smbXsrv_connection
*xconn
= state
->smb2req
->xconn
;
771 struct smbXsrv_client
*client
= xconn
->client
;
772 struct messaging_rec
*rec
= NULL
;
773 struct smbXsrv_connection_passB passed_blob
;
774 enum ndr_err_code ndr_err
;
775 struct smbXsrv_connection_pass0
*passed_info0
= NULL
;
779 SMB_ASSERT(state
->filter_subreq
== subreq
);
780 state
->filter_subreq
= NULL
;
782 ret
= messaging_filtered_read_recv(subreq
, state
, &rec
);
785 status
= map_nt_error_from_unix_common(ret
);
786 DBG_ERR("messaging_filtered_read_recv() - %s\n",
788 tevent_req_nterror(req
, status
);
792 DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASSED: received...\n");
794 ndr_err
= ndr_pull_struct_blob(&rec
->buf
, rec
, &passed_blob
,
795 (ndr_pull_flags_fn_t
)ndr_pull_smbXsrv_connection_passB
);
796 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
797 status
= ndr_map_error2ntstatus(ndr_err
);
798 DBG_ERR("ndr_pull_struct_blob - %s\n", nt_errstr(status
));
799 tevent_req_nterror(req
, status
);
803 if (DEBUGLVL(DBGLVL_DEBUG
)) {
804 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &passed_blob
);
807 if (passed_blob
.version
!= SMBXSRV_VERSION_0
) {
808 DBG_ERR("ignore invalid version %u\n", passed_blob
.version
);
809 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &passed_blob
);
810 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
814 passed_info0
= passed_blob
.info
.info0
;
815 if (passed_info0
== NULL
) {
816 DBG_ERR("ignore NULL info %u\n", passed_blob
.version
);
817 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &passed_blob
);
818 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
822 if (!GUID_equal(&xconn
->smb2
.client
.guid
, &passed_info0
->client_guid
)) {
823 struct GUID_txt_buf buf1
, buf2
;
825 DBG_ERR("client's client_guid [%s] != passed guid [%s]\n",
826 GUID_buf_string(&xconn
->smb2
.client
.guid
,
828 GUID_buf_string(&passed_info0
->client_guid
,
830 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &passed_blob
);
831 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
835 if (client
->global
->initial_connect_time
!=
836 passed_info0
->xconn_connect_time
)
838 DBG_ERR("client's initial connect time [%s] (%llu) != "
839 "passed xconn connect time [%s] (%llu)\n",
840 nt_time_string(talloc_tos(),
841 client
->global
->initial_connect_time
),
842 (unsigned long long)client
->global
->initial_connect_time
,
843 nt_time_string(talloc_tos(),
844 passed_info0
->xconn_connect_time
),
845 (unsigned long long)passed_info0
->xconn_connect_time
);
846 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &passed_blob
);
847 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
851 if (passed_info0
->negotiate_request
.length
!= 0) {
852 DBG_ERR("negotiate_request.length[%zu]\n",
853 passed_info0
->negotiate_request
.length
);
854 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &passed_blob
);
855 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
859 tevent_req_nterror(req
, NT_STATUS_MESSAGE_RETRIEVED
);
862 static void smb2srv_client_mc_negprot_watched(struct tevent_req
*subreq
)
864 struct tevent_req
*req
=
865 tevent_req_callback_data(subreq
,
867 struct smb2srv_client_mc_negprot_state
*state
=
869 struct smb2srv_client_mc_negprot_state
);
871 uint64_t instance
= 0;
873 status
= dbwrap_watched_watch_recv(subreq
, &instance
, NULL
, NULL
);
875 if (tevent_req_nterror(req
, status
)) {
879 state
->watch_instance
= instance
;
881 smb2srv_client_mc_negprot_next(req
);
884 NTSTATUS
smb2srv_client_mc_negprot_recv(struct tevent_req
*req
)
886 return tevent_req_simple_recv_ntstatus(req
);
889 static NTSTATUS
smbXsrv_client_global_remove(struct smbXsrv_client_global0
*global
)
895 * TODO: if we use other versions than '0'
896 * we would add glue code here, that would be able to
897 * store the information in the old format.
900 if (global
->db_rec
== NULL
) {
901 return NT_STATUS_INTERNAL_ERROR
;
904 key
= dbwrap_record_get_key(global
->db_rec
);
906 status
= dbwrap_record_delete(global
->db_rec
);
907 if (!NT_STATUS_IS_OK(status
)) {
908 DBG_WARNING("key '%s' delete - %s\n",
911 TALLOC_FREE(global
->db_rec
);
914 global
->stored
= false;
915 DBG_DEBUG("key '%s' delete\n", tdb_data_dbg(key
));
917 TALLOC_FREE(global
->db_rec
);
922 static int smbXsrv_client_destructor(struct smbXsrv_client
*client
)
926 status
= smbXsrv_client_remove(client
);
927 if (!NT_STATUS_IS_OK(status
)) {
928 DBG_ERR("smbXsrv_client_remove() failed: %s\n",
932 TALLOC_FREE(client
->global
);
937 static bool smbXsrv_client_connection_pass_filter(struct messaging_rec
*rec
, void *private_data
);
938 static void smbXsrv_client_connection_pass_loop(struct tevent_req
*subreq
);
939 static bool smbXsrv_client_connection_drop_filter(struct messaging_rec
*rec
, void *private_data
);
940 static void smbXsrv_client_connection_drop_loop(struct tevent_req
*subreq
);
942 NTSTATUS
smbXsrv_client_create(TALLOC_CTX
*mem_ctx
,
943 struct tevent_context
*ev_ctx
,
944 struct messaging_context
*msg_ctx
,
946 struct smbXsrv_client
**_client
)
948 struct smbXsrv_client_table
*table
;
949 struct smbXsrv_client
*client
= NULL
;
950 struct smbXsrv_client_global0
*global
= NULL
;
952 struct tevent_req
*subreq
= NULL
;
954 status
= smbXsrv_client_table_create(mem_ctx
,
958 if (!NT_STATUS_IS_OK(status
)) {
962 if (table
->local
.num_clients
>= table
->local
.max_clients
) {
964 return NT_STATUS_INSUFFICIENT_RESOURCES
;
967 client
= talloc_zero(mem_ctx
, struct smbXsrv_client
);
968 if (client
== NULL
) {
970 return NT_STATUS_NO_MEMORY
;
972 client
->raw_ev_ctx
= ev_ctx
;
973 client
->msg_ctx
= msg_ctx
;
975 client
->server_multi_channel_enabled
=
976 smbXsrv_server_multi_channel_enabled();
977 if (client
->server_multi_channel_enabled
) {
978 client
->next_channel_id
= 1;
980 client
->table
= talloc_move(client
, &table
);
981 table
= client
->table
;
983 global
= talloc_zero(client
, struct smbXsrv_client_global0
);
984 if (global
== NULL
) {
986 return NT_STATUS_NO_MEMORY
;
988 talloc_set_destructor(global
, smbXsrv_client_global_destructor
);
989 client
->global
= global
;
991 global
->initial_connect_time
= now
;
993 global
->server_id
= messaging_server_id(client
->msg_ctx
);
995 table
->local
.num_clients
+= 1;
997 talloc_set_destructor(client
, smbXsrv_client_destructor
);
999 if (DEBUGLVL(DBGLVL_DEBUG
)) {
1000 struct smbXsrv_clientB client_blob
= {
1001 .version
= SMBXSRV_VERSION_0
,
1002 .info
.info0
= client
,
1004 struct GUID_txt_buf buf
;
1006 DBG_DEBUG("client_guid[%s] created\n",
1007 GUID_buf_string(&global
->client_guid
, &buf
));
1008 NDR_PRINT_DEBUG(smbXsrv_clientB
, &client_blob
);
1011 subreq
= messaging_filtered_read_send(client
,
1014 smbXsrv_client_connection_pass_filter
,
1016 if (subreq
== NULL
) {
1017 TALLOC_FREE(client
);
1018 return NT_STATUS_NO_MEMORY
;
1020 tevent_req_set_callback(subreq
, smbXsrv_client_connection_pass_loop
, client
);
1021 client
->connection_pass_subreq
= subreq
;
1023 subreq
= messaging_filtered_read_send(client
,
1026 smbXsrv_client_connection_drop_filter
,
1028 if (subreq
== NULL
) {
1029 TALLOC_FREE(client
);
1030 return NT_STATUS_NO_MEMORY
;
1032 tevent_req_set_callback(subreq
, smbXsrv_client_connection_drop_loop
, client
);
1033 client
->connection_drop_subreq
= subreq
;
1036 return NT_STATUS_OK
;
1039 static NTSTATUS
smb2srv_client_connection_passed(struct smbXsrv_client
*client
,
1040 const struct smbXsrv_connection_pass0
*recv_info0
)
1043 enum ndr_err_code ndr_err
;
1045 struct smbXsrv_connection_pass0 passed_info0
;
1046 struct smbXsrv_connection_passB passed_blob
;
1050 * We echo back the message with a cleared negotiate_request
1052 passed_info0
= *recv_info0
;
1053 passed_info0
.negotiate_request
= data_blob_null
;
1055 ZERO_STRUCT(passed_blob
);
1056 passed_blob
.version
= smbXsrv_version_global_current();
1057 passed_blob
.info
.info0
= &passed_info0
;
1059 if (DEBUGLVL(DBGLVL_DEBUG
)) {
1060 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &passed_blob
);
1063 ndr_err
= ndr_push_struct_blob(&blob
, talloc_tos(), &passed_blob
,
1064 (ndr_push_flags_fn_t
)ndr_push_smbXsrv_connection_passB
);
1065 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1066 status
= ndr_map_error2ntstatus(ndr_err
);
1070 iov
.iov_base
= blob
.data
;
1071 iov
.iov_len
= blob
.length
;
1073 status
= messaging_send_iov(client
->msg_ctx
,
1074 recv_info0
->src_server_id
,
1075 MSG_SMBXSRV_CONNECTION_PASSED
,
1078 data_blob_free(&blob
);
1079 if (!NT_STATUS_IS_OK(status
)) {
1083 return NT_STATUS_OK
;
1086 static bool smbXsrv_client_connection_pass_filter(struct messaging_rec
*rec
, void *private_data
)
1088 if (rec
->msg_type
!= MSG_SMBXSRV_CONNECTION_PASS
) {
1092 if (rec
->num_fds
!= 1) {
1099 static void smbXsrv_client_connection_pass_loop(struct tevent_req
*subreq
)
1101 struct smbXsrv_client
*client
=
1102 tevent_req_callback_data(subreq
,
1103 struct smbXsrv_client
);
1104 struct smbXsrv_connection
*xconn
= NULL
;
1106 struct messaging_rec
*rec
= NULL
;
1107 struct smbXsrv_connection_passB pass_blob
;
1108 enum ndr_err_code ndr_err
;
1109 struct smbXsrv_connection_pass0
*pass_info0
= NULL
;
1114 client
->connection_pass_subreq
= NULL
;
1116 ret
= messaging_filtered_read_recv(subreq
, talloc_tos(), &rec
);
1117 TALLOC_FREE(subreq
);
1122 if (rec
->num_fds
!= 1) {
1123 DBG_ERR("MSG_SMBXSRV_CONNECTION_PASS: num_fds[%u]\n",
1128 sock_fd
= rec
->fds
[0];
1129 DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASS: got sock_fd[%d]\n", sock_fd
);
1131 ndr_err
= ndr_pull_struct_blob(&rec
->buf
, rec
, &pass_blob
,
1132 (ndr_pull_flags_fn_t
)ndr_pull_smbXsrv_connection_passB
);
1133 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1134 status
= ndr_map_error2ntstatus(ndr_err
);
1135 DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status
));
1139 if (DEBUGLVL(DBGLVL_DEBUG
)) {
1140 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &pass_blob
);
1143 if (pass_blob
.version
!= SMBXSRV_VERSION_0
) {
1144 DBG_ERR("ignore invalid version %u\n", pass_blob
.version
);
1145 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &pass_blob
);
1149 pass_info0
= pass_blob
.info
.info0
;
1150 if (pass_info0
== NULL
) {
1151 DBG_ERR("ignore NULL info %u\n", pass_blob
.version
);
1152 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &pass_blob
);
1156 if (!GUID_equal(&client
->global
->client_guid
, &pass_info0
->client_guid
))
1158 struct GUID_txt_buf buf1
, buf2
;
1160 DBG_WARNING("client's client_guid [%s] != passed guid [%s]\n",
1161 GUID_buf_string(&client
->global
->client_guid
,
1163 GUID_buf_string(&pass_info0
->client_guid
,
1165 if (DEBUGLVL(DBGLVL_WARNING
)) {
1166 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &pass_blob
);
1171 if (client
->global
->initial_connect_time
!=
1172 pass_info0
->client_connect_time
)
1174 DBG_WARNING("client's initial connect time [%s] (%llu) != "
1175 "passed initial connect time [%s] (%llu)\n",
1176 nt_time_string(talloc_tos(),
1177 client
->global
->initial_connect_time
),
1178 (unsigned long long)client
->global
->initial_connect_time
,
1179 nt_time_string(talloc_tos(),
1180 pass_info0
->client_connect_time
),
1181 (unsigned long long)pass_info0
->client_connect_time
);
1182 if (DEBUGLVL(DBGLVL_WARNING
)) {
1183 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &pass_blob
);
1188 if (pass_info0
->negotiate_request
.length
< SMB2_HDR_BODY
) {
1189 DBG_WARNING("negotiate_request.length[%zu]\n",
1190 pass_info0
->negotiate_request
.length
);
1191 if (DEBUGLVL(DBGLVL_WARNING
)) {
1192 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &pass_blob
);
1197 status
= smb2srv_client_connection_passed(client
, pass_info0
);
1198 if (NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
1200 * We hit a race where, the client dropped the connection
1201 * while the socket was passed to us and the origin
1202 * process already existed.
1204 DBG_DEBUG("smb2srv_client_connection_passed() ignore %s\n",
1206 status
= NT_STATUS_OK
;
1208 if (!NT_STATUS_IS_OK(status
)) {
1209 const char *r
= "smb2srv_client_connection_passed() failed";
1210 DBG_ERR("%s => %s\n", r
, nt_errstr(status
));
1211 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &pass_blob
);
1212 exit_server_cleanly(r
);
1216 status
= smbd_add_connection(client
,
1218 pass_info0
->xconn_connect_time
,
1220 if (NT_STATUS_EQUAL(status
, NT_STATUS_NETWORK_ACCESS_DENIED
)) {
1222 smbd_server_connection_terminate(xconn
, nt_errstr(status
));
1224 if (!NT_STATUS_IS_OK(status
)) {
1225 DBG_ERR("smbd_add_connection => %s\n", nt_errstr(status
));
1226 NDR_PRINT_DEBUG(smbXsrv_connection_passB
, &pass_blob
);
1232 * Set seq_low to mid received in negprot
1234 seq_low
= BVAL(pass_info0
->negotiate_request
.data
,
1235 SMB2_HDR_MESSAGE_ID
);
1237 xconn
->smb2
.client
.guid_verified
= true;
1238 smbd_smb2_process_negprot(xconn
, seq_low
,
1239 pass_info0
->negotiate_request
.data
,
1240 pass_info0
->negotiate_request
.length
);
1246 for (fd_idx
= 0; fd_idx
< rec
->num_fds
; fd_idx
++) {
1247 sock_fd
= rec
->fds
[fd_idx
];
1255 subreq
= messaging_filtered_read_send(client
,
1258 smbXsrv_client_connection_pass_filter
,
1260 if (subreq
== NULL
) {
1262 r
= "messaging_read_send(MSG_SMBXSRV_CONNECTION_PASS failed";
1263 exit_server_cleanly(r
);
1266 tevent_req_set_callback(subreq
, smbXsrv_client_connection_pass_loop
, client
);
1267 client
->connection_pass_subreq
= subreq
;
1270 static bool smbXsrv_client_connection_drop_filter(struct messaging_rec
*rec
, void *private_data
)
1272 if (rec
->msg_type
!= MSG_SMBXSRV_CONNECTION_DROP
) {
1276 if (rec
->num_fds
!= 0) {
1283 static void smbXsrv_client_connection_drop_loop(struct tevent_req
*subreq
)
1285 struct smbXsrv_client
*client
=
1286 tevent_req_callback_data(subreq
,
1287 struct smbXsrv_client
);
1289 struct messaging_rec
*rec
= NULL
;
1290 struct smbXsrv_connection_dropB drop_blob
;
1291 enum ndr_err_code ndr_err
;
1292 struct smbXsrv_connection_drop0
*drop_info0
= NULL
;
1293 struct server_id_buf src_server_id_buf
= {};
1296 client
->connection_drop_subreq
= NULL
;
1298 ret
= messaging_filtered_read_recv(subreq
, talloc_tos(), &rec
);
1299 TALLOC_FREE(subreq
);
1304 if (rec
->num_fds
!= 0) {
1305 DBG_ERR("MSG_SMBXSRV_CONNECTION_DROP: num_fds[%u]\n",
1310 ndr_err
= ndr_pull_struct_blob(&rec
->buf
, rec
, &drop_blob
,
1311 (ndr_pull_flags_fn_t
)ndr_pull_smbXsrv_connection_dropB
);
1312 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1313 status
= ndr_map_error2ntstatus(ndr_err
);
1314 DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status
));
1318 if (DEBUGLVL(DBGLVL_DEBUG
)) {
1319 NDR_PRINT_DEBUG(smbXsrv_connection_dropB
, &drop_blob
);
1322 if (drop_blob
.version
!= SMBXSRV_VERSION_0
) {
1323 DBG_ERR("ignore invalid version %u\n", drop_blob
.version
);
1324 NDR_PRINT_DEBUG(smbXsrv_connection_dropB
, &drop_blob
);
1328 drop_info0
= drop_blob
.info
.info0
;
1329 if (drop_info0
== NULL
) {
1330 DBG_ERR("ignore NULL info %u\n", drop_blob
.version
);
1331 NDR_PRINT_DEBUG(smbXsrv_connection_dropB
, &drop_blob
);
1335 if (!GUID_equal(&client
->global
->client_guid
, &drop_info0
->client_guid
))
1337 struct GUID_txt_buf buf1
, buf2
;
1339 DBG_WARNING("client's client_guid [%s] != dropped guid [%s]\n",
1340 GUID_buf_string(&client
->global
->client_guid
,
1342 GUID_buf_string(&drop_info0
->client_guid
,
1344 if (DEBUGLVL(DBGLVL_WARNING
)) {
1345 NDR_PRINT_DEBUG(smbXsrv_connection_dropB
, &drop_blob
);
1350 if (client
->global
->initial_connect_time
!=
1351 drop_info0
->client_connect_time
)
1353 DBG_WARNING("client's initial connect time [%s] (%llu) != "
1354 "dropped initial connect time [%s] (%llu)\n",
1355 nt_time_string(talloc_tos(),
1356 client
->global
->initial_connect_time
),
1357 (unsigned long long)client
->global
->initial_connect_time
,
1358 nt_time_string(talloc_tos(),
1359 drop_info0
->client_connect_time
),
1360 (unsigned long long)drop_info0
->client_connect_time
);
1361 if (DEBUGLVL(DBGLVL_WARNING
)) {
1362 NDR_PRINT_DEBUG(smbXsrv_connection_dropB
, &drop_blob
);
1368 * Disconnect all client connections, which means we will tear down all
1369 * sessions, tcons and non-durable opens. At the end we will remove our
1370 * smbXsrv_client_global.tdb record, which will wake up the watcher on
1371 * the other node in order to let it take over the client.
1373 * The client will have to reopen all sessions, tcons and durable opens.
1375 smbd_server_disconnect_client(client
,
1376 server_id_str_buf(drop_info0
->src_server_id
, &src_server_id_buf
));
1384 for (fd_idx
= 0; fd_idx
< rec
->num_fds
; fd_idx
++) {
1385 sock_fd
= rec
->fds
[fd_idx
];
1393 subreq
= messaging_filtered_read_send(client
,
1396 smbXsrv_client_connection_drop_filter
,
1398 if (subreq
== NULL
) {
1400 r
= "messaging_read_send(MSG_SMBXSRV_CONNECTION_DROP failed";
1401 exit_server_cleanly(r
);
1404 tevent_req_set_callback(subreq
, smbXsrv_client_connection_drop_loop
, client
);
1405 client
->connection_drop_subreq
= subreq
;
1408 NTSTATUS
smbXsrv_client_remove(struct smbXsrv_client
*client
)
1410 struct smbXsrv_client_table
*table
= client
->table
;
1413 if (client
->global
->db_rec
!= NULL
) {
1414 struct GUID_txt_buf buf
;
1415 DBG_ERR("client_guid[%s]: Called with db_rec != NULL'\n",
1416 GUID_buf_string(&client
->global
->client_guid
,
1418 return NT_STATUS_INTERNAL_ERROR
;
1421 if (!client
->global
->stored
) {
1422 return NT_STATUS_OK
;
1425 TALLOC_FREE(client
->connection_pass_subreq
);
1426 TALLOC_FREE(client
->connection_drop_subreq
);
1428 client
->global
->db_rec
= smbXsrv_client_global_fetch_locked(
1429 table
->global
.db_ctx
,
1430 &client
->global
->client_guid
,
1431 client
->global
/* TALLOC_CTX */);
1432 if (client
->global
->db_rec
== NULL
) {
1433 return NT_STATUS_INTERNAL_DB_ERROR
;
1436 status
= smbXsrv_client_global_remove(client
->global
);
1437 if (!NT_STATUS_IS_OK(status
)) {
1438 struct GUID_txt_buf buf
;
1439 DBG_ERR("client_guid[%s] store failed - %s\n",
1440 GUID_buf_string(&client
->global
->client_guid
, &buf
),
1445 if (DEBUGLVL(DBGLVL_DEBUG
)) {
1446 struct smbXsrv_clientB client_blob
= {
1447 .version
= SMBXSRV_VERSION_0
,
1448 .info
.info0
= client
,
1450 struct GUID_txt_buf buf
;
1452 DBG_DEBUG("client_guid[%s] stored\n",
1453 GUID_buf_string(&client
->global
->client_guid
, &buf
));
1454 NDR_PRINT_DEBUG(smbXsrv_clientB
, &client_blob
);
1457 return NT_STATUS_OK
;