source3/smbd/smbXsrv_session.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2011-2012
   5    Copyright (C) Michael Adam 2012
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/filesys.h"
  23 #include <tevent.h>
  24 #include "lib/util/server_id.h"
  25 #include "smbd/smbd.h"
  26 #include "smbd/globals.h"
  27 #include "dbwrap/dbwrap.h"
  28 #include "dbwrap/dbwrap_rbt.h"
  29 #include "dbwrap/dbwrap_open.h"
  30 #include "dbwrap/dbwrap_watch.h"
  31 #include "session.h"
  32 #include "auth.h"
  33 #include "auth/gensec/gensec.h"
  34 #include "../lib/tsocket/tsocket.h"
  35 #include "../libcli/security/security.h"
  36 #include "messages.h"
  37 #include "lib/util/util_tdb.h"
  38 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  39 #include "serverid.h"
  40 #include "lib/util/tevent_ntstatus.h"
  41
  42 struct smbXsrv_session_table {
  43         struct {
  44                 struct db_context *db_ctx;
  45                 uint32_t lowest_id;
  46                 uint32_t highest_id;
  47                 uint32_t max_sessions;
  48                 uint32_t num_sessions;
  49         } local;
  50         struct {
  51                 struct db_context *db_ctx;
  52         } global;
  53 };
  54
  55 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
  56
  57 NTSTATUS smbXsrv_session_global_init(struct messaging_context *msg_ctx)
  58 {
  59         char *global_path = NULL;
  60         struct db_context *backend = NULL;
  61         struct db_context *db_ctx = NULL;
  62
  63         if (smbXsrv_session_global_db_ctx != NULL) {
  64                 return NT_STATUS_OK;
  65         }
  66
  67         /*
  68          * This contains secret information like session keys!
  69          */
  70         global_path = lock_path("smbXsrv_session_global.tdb");
  71         if (global_path == NULL) {
  72                 return NT_STATUS_NO_MEMORY;
  73         }
  74
  75         backend = db_open(NULL, global_path,
  76                           0, /* hash_size */
  77                           TDB_DEFAULT |
  78                           TDB_CLEAR_IF_FIRST |
  79                           TDB_INCOMPATIBLE_HASH,
  80                           O_RDWR | O_CREAT, 0600,
  81                           DBWRAP_LOCK_ORDER_1,
  82                           DBWRAP_FLAG_NONE);
  83         TALLOC_FREE(global_path);
  84         if (backend == NULL) {
  85                 NTSTATUS status;
  86
  87                 status = map_nt_error_from_unix_common(errno);
  88
  89                 return status;
  90         }
  91
  92         db_ctx = db_open_watched(NULL, backend, server_messaging_context());
  93         if (db_ctx == NULL) {
  94                 TALLOC_FREE(backend);
  95                 return NT_STATUS_NO_MEMORY;
  96         }
  97
  98         smbXsrv_session_global_db_ctx = db_ctx;
  99
 100         return NT_STATUS_OK;
 101 }
 102
 103 /*
 104  * NOTE:
 105  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
 106  * has the same result as integer comparison between the uint32_t
 107  * values.
 108  *
 109  * TODO: implement string based key
 110  */
 111
 112 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
 113
 114 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
 115                                                  uint8_t *key_buf)
 116 {
 117         TDB_DATA key;
 118
 119         RSIVAL(key_buf, 0, id);
 120
 121         key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
 122
 123         return key;
 124 }
 125
 126 #if 0
 127 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
 128 {
 129         if (id == NULL) {
 130                 return NT_STATUS_INVALID_PARAMETER;
 131         }
 132
 133         if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
 134                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 135         }
 136
 137         *id = RIVAL(key.dptr, 0);
 138
 139         return NT_STATUS_OK;
 140 }
 141 #endif
 142
 143 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
 144
 145 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
 146                                                 uint8_t *key_buf)
 147 {
 148         TDB_DATA key;
 149
 150         RSIVAL(key_buf, 0, id);
 151
 152         key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
 153
 154         return key;
 155 }
 156
 157 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
 158 {
 159         if (id == NULL) {
 160                 return NT_STATUS_INVALID_PARAMETER;
 161         }
 162
 163         if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
 164                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 165         }
 166
 167         *id = RIVAL(key.dptr, 0);
 168
 169         return NT_STATUS_OK;
 170 }
 171
 172 static struct db_record *smbXsrv_session_global_fetch_locked(
 173                         struct db_context *db,
 174                         uint32_t id,
 175                         TALLOC_CTX *mem_ctx)
 176 {
 177         TDB_DATA key;
 178         uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
 179         struct db_record *rec = NULL;
 180
 181         key = smbXsrv_session_global_id_to_key(id, key_buf);
 182
 183         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 184
 185         if (rec == NULL) {
 186                 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
 187                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 188         }
 189
 190         return rec;
 191 }
 192
 193 static struct db_record *smbXsrv_session_local_fetch_locked(
 194                         struct db_context *db,
 195                         uint32_t id,
 196                         TALLOC_CTX *mem_ctx)
 197 {
 198         TDB_DATA key;
 199         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 200         struct db_record *rec = NULL;
 201
 202         key = smbXsrv_session_local_id_to_key(id, key_buf);
 203
 204         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 205
 206         if (rec == NULL) {
 207                 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
 208                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 209         }
 210
 211         return rec;
 212 }
 213
 214 static void smbXsrv_session_close_loop(struct tevent_req *subreq);
 215
 216 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
 217                                            uint32_t lowest_id,
 218                                            uint32_t highest_id,
 219                                            uint32_t max_sessions)
 220 {
 221         struct smbXsrv_client *client = conn->client;
 222         struct smbXsrv_session_table *table;
 223         NTSTATUS status;
 224         struct tevent_req *subreq;
 225         uint64_t max_range;
 226
 227         if (lowest_id > highest_id) {
 228                 return NT_STATUS_INTERNAL_ERROR;
 229         }
 230
 231         max_range = highest_id;
 232         max_range -= lowest_id;
 233         max_range += 1;
 234
 235         if (max_sessions > max_range) {
 236                 return NT_STATUS_INTERNAL_ERROR;
 237         }
 238
 239         table = talloc_zero(client, struct smbXsrv_session_table);
 240         if (table == NULL) {
 241                 return NT_STATUS_NO_MEMORY;
 242         }
 243
 244         table->local.db_ctx = db_open_rbt(table);
 245         if (table->local.db_ctx == NULL) {
 246                 TALLOC_FREE(table);
 247                 return NT_STATUS_NO_MEMORY;
 248         }
 249         table->local.lowest_id = lowest_id;
 250         table->local.highest_id = highest_id;
 251         table->local.max_sessions = max_sessions;
 252
 253         status = smbXsrv_session_global_init(client->msg_ctx);
 254         if (!NT_STATUS_IS_OK(status)) {
 255                 TALLOC_FREE(table);
 256                 return status;
 257         }
 258
 259         table->global.db_ctx = smbXsrv_session_global_db_ctx;
 260
 261         subreq = messaging_read_send(table,
 262                                      client->raw_ev_ctx,
 263                                      client->msg_ctx,
 264                                      MSG_SMBXSRV_SESSION_CLOSE);
 265         if (subreq == NULL) {
 266                 TALLOC_FREE(table);
 267                 return NT_STATUS_NO_MEMORY;
 268         }
 269         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
 270
 271         client->session_table = table;
 272         return NT_STATUS_OK;
 273 }
 274
 275 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
 276
 277 static void smbXsrv_session_close_loop(struct tevent_req *subreq)
 278 {
 279         struct smbXsrv_client *client =
 280                 tevent_req_callback_data(subreq,
 281                 struct smbXsrv_client);
 282         struct smbXsrv_session_table *table = client->session_table;
 283         int ret;
 284         struct messaging_rec *rec = NULL;
 285         struct smbXsrv_session_closeB close_blob;
 286         enum ndr_err_code ndr_err;
 287         struct smbXsrv_session_close0 *close_info0 = NULL;
 288         struct smbXsrv_session *session = NULL;
 289         NTSTATUS status;
 290         struct timeval tv = timeval_current();
 291         NTTIME now = timeval_to_nttime(&tv);
 292
 293         ret = messaging_read_recv(subreq, talloc_tos(), &rec);
 294         TALLOC_FREE(subreq);
 295         if (ret != 0) {
 296                 goto next;
 297         }
 298
 299         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
 300                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
 301         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 302                 status = ndr_map_error2ntstatus(ndr_err);
 303                 DEBUG(1,("smbXsrv_session_close_loop: "
 304                          "ndr_pull_struct_blob - %s\n",
 305                          nt_errstr(status)));
 306                 goto next;
 307         }
 308
 309         DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
 310         if (DEBUGLVL(10)) {
 311                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 312         }
 313
 314         if (close_blob.version != SMBXSRV_VERSION_0) {
 315                 DEBUG(0,("smbXsrv_session_close_loop: "
 316                          "ignore invalid version %u\n", close_blob.version));
 317                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 318                 goto next;
 319         }
 320
 321         close_info0 = close_blob.info.info0;
 322         if (close_info0 == NULL) {
 323                 DEBUG(0,("smbXsrv_session_close_loop: "
 324                          "ignore NULL info %u\n", close_blob.version));
 325                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 326                 goto next;
 327         }
 328
 329         status = smb2srv_session_lookup_client(client,
 330                                                close_info0->old_session_wire_id,
 331                                                now, &session);
 332         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
 333                 DEBUG(4,("smbXsrv_session_close_loop: "
 334                          "old_session_wire_id %llu not found\n",
 335                          (unsigned long long)close_info0->old_session_wire_id));
 336                 if (DEBUGLVL(4)) {
 337                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 338                 }
 339                 goto next;
 340         }
 341         if (!NT_STATUS_IS_OK(status) &&
 342             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
 343             !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 344                 DEBUG(1,("smbXsrv_session_close_loop: "
 345                          "old_session_wire_id %llu - %s\n",
 346                          (unsigned long long)close_info0->old_session_wire_id,
 347                          nt_errstr(status)));
 348                 if (DEBUGLVL(1)) {
 349                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 350                 }
 351                 goto next;
 352         }
 353
 354         if (session->global->session_global_id != close_info0->old_session_global_id) {
 355                 DEBUG(1,("smbXsrv_session_close_loop: "
 356                          "old_session_wire_id %llu - global %u != %u\n",
 357                          (unsigned long long)close_info0->old_session_wire_id,
 358                          session->global->session_global_id,
 359                          close_info0->old_session_global_id));
 360                 if (DEBUGLVL(1)) {
 361                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 362                 }
 363                 goto next;
 364         }
 365
 366         if (session->global->creation_time != close_info0->old_creation_time) {
 367                 DEBUG(1,("smbXsrv_session_close_loop: "
 368                          "old_session_wire_id %llu - "
 369                          "creation %s (%llu) != %s (%llu)\n",
 370                          (unsigned long long)close_info0->old_session_wire_id,
 371                          nt_time_string(rec, session->global->creation_time),
 372                          (unsigned long long)session->global->creation_time,
 373                          nt_time_string(rec, close_info0->old_creation_time),
 374                          (unsigned long long)close_info0->old_creation_time));
 375                 if (DEBUGLVL(1)) {
 376                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 377                 }
 378                 goto next;
 379         }
 380
 381         subreq = smb2srv_session_shutdown_send(session, client->raw_ev_ctx,
 382                                                session, NULL);
 383         if (subreq == NULL) {
 384                 status = NT_STATUS_NO_MEMORY;
 385                 DEBUG(0, ("smbXsrv_session_close_loop: "
 386                           "smb2srv_session_shutdown_send(%llu) failed: %s\n",
 387                           (unsigned long long)session->global->session_wire_id,
 388                           nt_errstr(status)));
 389                 if (DEBUGLVL(1)) {
 390                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 391                 }
 392                 goto next;
 393         }
 394         tevent_req_set_callback(subreq,
 395                                 smbXsrv_session_close_shutdown_done,
 396                                 session);
 397
 398 next:
 399         TALLOC_FREE(rec);
 400
 401         subreq = messaging_read_send(table,
 402                                      client->raw_ev_ctx,
 403                                      client->msg_ctx,
 404                                      MSG_SMBXSRV_SESSION_CLOSE);
 405         if (subreq == NULL) {
 406                 const char *r;
 407                 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
 408                 exit_server_cleanly(r);
 409                 return;
 410         }
 411         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
 412 }
 413
 414 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
 415 {
 416         struct smbXsrv_session *session =
 417                 tevent_req_callback_data(subreq,
 418                 struct smbXsrv_session);
 419         NTSTATUS status;
 420
 421         status = smb2srv_session_shutdown_recv(subreq);
 422         TALLOC_FREE(subreq);
 423         if (!NT_STATUS_IS_OK(status)) {
 424                 DEBUG(0, ("smbXsrv_session_close_loop: "
 425                           "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
 426                           (unsigned long long)session->global->session_wire_id,
 427                           nt_errstr(status)));
 428         }
 429
 430         status = smbXsrv_session_logoff(session);
 431         if (!NT_STATUS_IS_OK(status)) {
 432                 DEBUG(0, ("smbXsrv_session_close_loop: "
 433                           "smbXsrv_session_logoff(%llu) failed: %s\n",
 434                           (unsigned long long)session->global->session_wire_id,
 435                           nt_errstr(status)));
 436         }
 437
 438         TALLOC_FREE(session);
 439 }
 440
 441 struct smb1srv_session_local_allocate_state {
 442         const uint32_t lowest_id;
 443         const uint32_t highest_id;
 444         uint32_t last_id;
 445         uint32_t useable_id;
 446         NTSTATUS status;
 447 };
 448
 449 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
 450                                                    void *private_data)
 451 {
 452         struct smb1srv_session_local_allocate_state *state =
 453                 (struct smb1srv_session_local_allocate_state *)private_data;
 454         TDB_DATA key = dbwrap_record_get_key(rec);
 455         uint32_t id = 0;
 456         NTSTATUS status;
 457
 458         status = smbXsrv_session_local_key_to_id(key, &id);
 459         if (!NT_STATUS_IS_OK(status)) {
 460                 state->status = status;
 461                 return -1;
 462         }
 463
 464         if (id <= state->last_id) {
 465                 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 466                 return -1;
 467         }
 468         state->last_id = id;
 469
 470         if (id > state->useable_id) {
 471                 state->status = NT_STATUS_OK;
 472                 return -1;
 473         }
 474
 475         if (state->useable_id == state->highest_id) {
 476                 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
 477                 return -1;
 478         }
 479
 480         state->useable_id +=1;
 481         return 0;
 482 }
 483
 484 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
 485                                                   uint32_t lowest_id,
 486                                                   uint32_t highest_id,
 487                                                   TALLOC_CTX *mem_ctx,
 488                                                   struct db_record **_rec,
 489                                                   uint32_t *_id)
 490 {
 491         struct smb1srv_session_local_allocate_state state = {
 492                 .lowest_id = lowest_id,
 493                 .highest_id = highest_id,
 494                 .last_id = 0,
 495                 .useable_id = lowest_id,
 496                 .status = NT_STATUS_INTERNAL_ERROR,
 497         };
 498         uint32_t i;
 499         uint32_t range;
 500         NTSTATUS status;
 501         int count = 0;
 502
 503         *_rec = NULL;
 504         *_id = 0;
 505
 506         if (lowest_id > highest_id) {
 507                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 508         }
 509
 510         /*
 511          * first we try randomly
 512          */
 513         range = (highest_id - lowest_id) + 1;
 514
 515         for (i = 0; i < (range / 2); i++) {
 516                 uint32_t id;
 517                 TDB_DATA val;
 518                 struct db_record *rec = NULL;
 519
 520                 id = generate_random() % range;
 521                 id += lowest_id;
 522
 523                 if (id < lowest_id) {
 524                         id = lowest_id;
 525                 }
 526                 if (id > highest_id) {
 527                         id = highest_id;
 528                 }
 529
 530                 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
 531                 if (rec == NULL) {
 532                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 533                 }
 534
 535                 val = dbwrap_record_get_value(rec);
 536                 if (val.dsize != 0) {
 537                         TALLOC_FREE(rec);
 538                         continue;
 539                 }
 540
 541                 *_rec = rec;
 542                 *_id = id;
 543                 return NT_STATUS_OK;
 544         }
 545
 546         /*
 547          * if the range is almost full,
 548          * we traverse the whole table
 549          * (this relies on sorted behavior of dbwrap_rbt)
 550          */
 551         status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
 552                                       &state, &count);
 553         if (NT_STATUS_IS_OK(status)) {
 554                 if (NT_STATUS_IS_OK(state.status)) {
 555                         return NT_STATUS_INTERNAL_ERROR;
 556                 }
 557
 558                 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
 559                         return state.status;
 560                 }
 561
 562                 if (state.useable_id <= state.highest_id) {
 563                         state.status = NT_STATUS_OK;
 564                 } else {
 565                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 566                 }
 567         } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
 568                 /*
 569                  * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
 570                  *
 571                  * If we get anything else it is an error, because it
 572                  * means we did not manage to find a free slot in
 573                  * the db.
 574                  */
 575                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 576         }
 577
 578         if (NT_STATUS_IS_OK(state.status)) {
 579                 uint32_t id;
 580                 TDB_DATA val;
 581                 struct db_record *rec = NULL;
 582
 583                 id = state.useable_id;
 584
 585                 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
 586                 if (rec == NULL) {
 587                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 588                 }
 589
 590                 val = dbwrap_record_get_value(rec);
 591                 if (val.dsize != 0) {
 592                         TALLOC_FREE(rec);
 593                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 594                 }
 595
 596                 *_rec = rec;
 597                 *_id = id;
 598                 return NT_STATUS_OK;
 599         }
 600
 601         return state.status;
 602 }
 603
 604 struct smbXsrv_session_local_fetch_state {
 605         struct smbXsrv_session *session;
 606         NTSTATUS status;
 607 };
 608
 609 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
 610                                                void *private_data)
 611 {
 612         struct smbXsrv_session_local_fetch_state *state =
 613                 (struct smbXsrv_session_local_fetch_state *)private_data;
 614         void *ptr;
 615
 616         if (data.dsize != sizeof(ptr)) {
 617                 state->status = NT_STATUS_INTERNAL_DB_ERROR;
 618                 return;
 619         }
 620
 621         memcpy(&ptr, data.dptr, data.dsize);
 622         state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
 623         state->status = NT_STATUS_OK;
 624 }
 625
 626 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
 627                                              /* conn: optional */
 628                                              struct smbXsrv_connection *conn,
 629                                              uint32_t session_local_id,
 630                                              NTTIME now,
 631                                              struct smbXsrv_session **_session)
 632 {
 633         struct smbXsrv_session_local_fetch_state state = {
 634                 .session = NULL,
 635                 .status = NT_STATUS_INTERNAL_ERROR,
 636         };
 637         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 638         TDB_DATA key;
 639         NTSTATUS status;
 640
 641         *_session = NULL;
 642
 643         if (session_local_id == 0) {
 644                 return NT_STATUS_USER_SESSION_DELETED;
 645         }
 646
 647         if (table == NULL) {
 648                 /* this might happen before the end of negprot */
 649                 return NT_STATUS_USER_SESSION_DELETED;
 650         }
 651
 652         if (table->local.db_ctx == NULL) {
 653                 return NT_STATUS_INTERNAL_ERROR;
 654         }
 655
 656         key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
 657
 658         status = dbwrap_parse_record(table->local.db_ctx, key,
 659                                      smbXsrv_session_local_fetch_parser,
 660                                      &state);
 661         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
 662                 return NT_STATUS_USER_SESSION_DELETED;
 663         } else if (!NT_STATUS_IS_OK(status)) {
 664                 return status;
 665         }
 666         if (!NT_STATUS_IS_OK(state.status)) {
 667                 return state.status;
 668         }
 669
 670         if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
 671                 return NT_STATUS_USER_SESSION_DELETED;
 672         }
 673
 674         /*
 675          * If a connection is specified check if the session is
 676          * valid on the channel.
 677          */
 678         if (conn != NULL) {
 679                 struct smbXsrv_channel_global0 *c = NULL;
 680
 681                 status = smbXsrv_session_find_channel(state.session, conn, &c);
 682                 if (!NT_STATUS_IS_OK(status)) {
 683                         return status;
 684                 }
 685         }
 686
 687         state.session->idle_time = now;
 688
 689         if (!NT_STATUS_IS_OK(state.session->status)) {
 690                 *_session = state.session;
 691                 return state.session->status;
 692         }
 693
 694         if (now > state.session->global->expiration_time) {
 695                 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
 696         }
 697
 698         *_session = state.session;
 699         return state.session->status;
 700 }
 701
 702 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
 703 {
 704         return 0;
 705 }
 706
 707 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 708                                         bool *is_free,
 709                                         bool *was_free,
 710                                         TALLOC_CTX *mem_ctx,
 711                                         struct smbXsrv_session_global0 **_g);
 712
 713 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
 714                                         TALLOC_CTX *mem_ctx,
 715                                         struct smbXsrv_session_global0 **_global)
 716 {
 717         uint32_t i;
 718         struct smbXsrv_session_global0 *global = NULL;
 719         uint32_t last_free = 0;
 720         const uint32_t min_tries = 3;
 721
 722         *_global = NULL;
 723
 724         global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
 725         if (global == NULL) {
 726                 return NT_STATUS_NO_MEMORY;
 727         }
 728         talloc_set_destructor(global, smbXsrv_session_global_destructor);
 729
 730         /*
 731          * Here we just randomly try the whole 32-bit space
 732          *
 733          * We use just 32-bit, because we want to reuse the
 734          * ID for SRVSVC.
 735          */
 736         for (i = 0; i < UINT32_MAX; i++) {
 737                 bool is_free = false;
 738                 bool was_free = false;
 739                 uint32_t id;
 740
 741                 if (i >= min_tries && last_free != 0) {
 742                         id = last_free;
 743                 } else {
 744                         id = generate_random();
 745                 }
 746                 if (id == 0) {
 747                         id++;
 748                 }
 749                 if (id == UINT32_MAX) {
 750                         id--;
 751                 }
 752
 753                 global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
 754                                                                      mem_ctx);
 755                 if (global->db_rec == NULL) {
 756                         talloc_free(global);
 757                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 758                 }
 759
 760                 smbXsrv_session_global_verify_record(global->db_rec,
 761                                                      &is_free,
 762                                                      &was_free,
 763                                                      NULL, NULL);
 764
 765                 if (!is_free) {
 766                         TALLOC_FREE(global->db_rec);
 767                         continue;
 768                 }
 769
 770                 if (!was_free && i < min_tries) {
 771                         /*
 772                          * The session_id is free now,
 773                          * but was not free before.
 774                          *
 775                          * This happens if a smbd crashed
 776                          * and did not cleanup the record.
 777                          *
 778                          * If this is one of our first tries,
 779                          * then we try to find a real free one.
 780                          */
 781                         if (last_free == 0) {
 782                                 last_free = id;
 783                         }
 784                         TALLOC_FREE(global->db_rec);
 785                         continue;
 786                 }
 787
 788                 global->session_global_id = id;
 789
 790                 *_global = global;
 791                 return NT_STATUS_OK;
 792         }
 793
 794         /* should not be reached */
 795         talloc_free(global);
 796         return NT_STATUS_INTERNAL_ERROR;
 797 }
 798
 799 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 800                                         bool *is_free,
 801                                         bool *was_free,
 802                                         TALLOC_CTX *mem_ctx,
 803                                         struct smbXsrv_session_global0 **_g)
 804 {
 805         TDB_DATA key;
 806         TDB_DATA val;
 807         DATA_BLOB blob;
 808         struct smbXsrv_session_globalB global_blob;
 809         enum ndr_err_code ndr_err;
 810         struct smbXsrv_session_global0 *global = NULL;
 811         bool exists;
 812         TALLOC_CTX *frame = talloc_stackframe();
 813
 814         *is_free = false;
 815
 816         if (was_free) {
 817                 *was_free = false;
 818         }
 819         if (_g) {
 820                 *_g = NULL;
 821         }
 822
 823         key = dbwrap_record_get_key(db_rec);
 824
 825         val = dbwrap_record_get_value(db_rec);
 826         if (val.dsize == 0) {
 827                 TALLOC_FREE(frame);
 828                 *is_free = true;
 829                 if (was_free) {
 830                         *was_free = true;
 831                 }
 832                 return;
 833         }
 834
 835         blob = data_blob_const(val.dptr, val.dsize);
 836
 837         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 838                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
 839         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 840                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 841                 DEBUG(1,("smbXsrv_session_global_verify_record: "
 842                          "key '%s' ndr_pull_struct_blob - %s\n",
 843                          hex_encode_talloc(frame, key.dptr, key.dsize),
 844                          nt_errstr(status)));
 845                 TALLOC_FREE(frame);
 846                 *is_free = true;
 847                 if (was_free) {
 848                         *was_free = true;
 849                 }
 850                 return;
 851         }
 852
 853         DEBUG(10,("smbXsrv_session_global_verify_record\n"));
 854         if (DEBUGLVL(10)) {
 855                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 856         }
 857
 858         if (global_blob.version != SMBXSRV_VERSION_0) {
 859                 DEBUG(0,("smbXsrv_session_global_verify_record: "
 860                          "key '%s' use unsupported version %u\n",
 861                          hex_encode_talloc(frame, key.dptr, key.dsize),
 862                          global_blob.version));
 863                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 864                 TALLOC_FREE(frame);
 865                 *is_free = true;
 866                 if (was_free) {
 867                         *was_free = true;
 868                 }
 869                 return;
 870         }
 871
 872         global = global_blob.info.info0;
 873
 874         exists = serverid_exists(&global->channels[0].server_id);
 875         if (!exists) {
 876                 struct server_id_buf idbuf;
 877                 DEBUG(2,("smbXsrv_session_global_verify_record: "
 878                          "key '%s' server_id %s does not exist.\n",
 879                          hex_encode_talloc(frame, key.dptr, key.dsize),
 880                          server_id_str_buf(global->channels[0].server_id,
 881                                            &idbuf)));
 882                 if (DEBUGLVL(2)) {
 883                         NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 884                 }
 885                 TALLOC_FREE(frame);
 886                 dbwrap_record_delete(db_rec);
 887                 *is_free = true;
 888                 return;
 889         }
 890
 891         if (_g) {
 892                 *_g = talloc_move(mem_ctx, &global);
 893         }
 894         TALLOC_FREE(frame);
 895 }
 896
 897 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
 898 {
 899         struct smbXsrv_session_globalB global_blob;
 900         DATA_BLOB blob = data_blob_null;
 901         TDB_DATA key;
 902         TDB_DATA val;
 903         NTSTATUS status;
 904         enum ndr_err_code ndr_err;
 905
 906         /*
 907          * TODO: if we use other versions than '0'
 908          * we would add glue code here, that would be able to
 909          * store the information in the old format.
 910          */
 911
 912         if (global->db_rec == NULL) {
 913                 return NT_STATUS_INTERNAL_ERROR;
 914         }
 915
 916         key = dbwrap_record_get_key(global->db_rec);
 917         val = dbwrap_record_get_value(global->db_rec);
 918
 919         ZERO_STRUCT(global_blob);
 920         global_blob.version = smbXsrv_version_global_current();
 921         if (val.dsize >= 8) {
 922                 global_blob.seqnum = IVAL(val.dptr, 4);
 923         }
 924         global_blob.seqnum += 1;
 925         global_blob.info.info0 = global;
 926
 927         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 928                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
 929         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 930                 status = ndr_map_error2ntstatus(ndr_err);
 931                 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
 932                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 933                          nt_errstr(status)));
 934                 TALLOC_FREE(global->db_rec);
 935                 return status;
 936         }
 937
 938         val = make_tdb_data(blob.data, blob.length);
 939         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 940         if (!NT_STATUS_IS_OK(status)) {
 941                 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
 942                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 943                          nt_errstr(status)));
 944                 TALLOC_FREE(global->db_rec);
 945                 return status;
 946         }
 947
 948         if (DEBUGLVL(10)) {
 949                 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
 950                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
 951                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 952         }
 953
 954         TALLOC_FREE(global->db_rec);
 955
 956         return NT_STATUS_OK;
 957 }
 958
 959 struct smb2srv_session_close_previous_state {
 960         struct tevent_context *ev;
 961         struct smbXsrv_connection *connection;
 962         struct dom_sid *current_sid;
 963         uint64_t previous_session_id;
 964         uint64_t current_session_id;
 965         struct db_record *db_rec;
 966 };
 967
 968 static void smb2srv_session_close_previous_check(struct tevent_req *req);
 969 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
 970
 971 struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
 972                                         struct tevent_context *ev,
 973                                         struct smbXsrv_connection *conn,
 974                                         struct auth_session_info *session_info,
 975                                         uint64_t previous_session_id,
 976                                         uint64_t current_session_id)
 977 {
 978         struct tevent_req *req;
 979         struct smb2srv_session_close_previous_state *state;
 980         uint32_t global_id = previous_session_id & UINT32_MAX;
 981         uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
 982         struct smbXsrv_session_table *table = conn->client->session_table;
 983         struct security_token *current_token = NULL;
 984
 985         req = tevent_req_create(mem_ctx, &state,
 986                                 struct smb2srv_session_close_previous_state);
 987         if (req == NULL) {
 988                 return NULL;
 989         }
 990         state->ev = ev;
 991         state->connection = conn;
 992         state->previous_session_id = previous_session_id;
 993         state->current_session_id = current_session_id;
 994
 995         if (global_zeros != 0) {
 996                 tevent_req_done(req);
 997                 return tevent_req_post(req, ev);
 998         }
 999
1000         if (session_info == NULL) {
1001                 tevent_req_done(req);
1002                 return tevent_req_post(req, ev);
1003         }
1004         current_token = session_info->security_token;
1005
1006         if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
1007                 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
1008         }
1009
1010         if (state->current_sid == NULL) {
1011                 tevent_req_done(req);
1012                 return tevent_req_post(req, ev);
1013         }
1014
1015         if (!security_token_has_nt_authenticated_users(current_token)) {
1016                 /* TODO */
1017                 tevent_req_done(req);
1018                 return tevent_req_post(req, ev);
1019         }
1020
1021         state->db_rec = smbXsrv_session_global_fetch_locked(
1022                                                         table->global.db_ctx,
1023                                                         global_id,
1024                                                         state /* TALLOC_CTX */);
1025         if (state->db_rec == NULL) {
1026                 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1027                 return tevent_req_post(req, ev);
1028         }
1029
1030         smb2srv_session_close_previous_check(req);
1031         if (!tevent_req_is_in_progress(req)) {
1032                 return tevent_req_post(req, ev);
1033         }
1034
1035         return req;
1036 }
1037
1038 static void smb2srv_session_close_previous_check(struct tevent_req *req)
1039 {
1040         struct smb2srv_session_close_previous_state *state =
1041                 tevent_req_data(req,
1042                 struct smb2srv_session_close_previous_state);
1043         struct smbXsrv_connection *conn = state->connection;
1044         DATA_BLOB blob;
1045         struct security_token *previous_token = NULL;
1046         struct smbXsrv_session_global0 *global = NULL;
1047         enum ndr_err_code ndr_err;
1048         struct smbXsrv_session_close0 close_info0;
1049         struct smbXsrv_session_closeB close_blob;
1050         struct tevent_req *subreq = NULL;
1051         NTSTATUS status;
1052         bool is_free = false;
1053
1054         smbXsrv_session_global_verify_record(state->db_rec,
1055                                              &is_free,
1056                                              NULL,
1057                                              state,
1058                                              &global);
1059
1060         if (is_free) {
1061                 TALLOC_FREE(state->db_rec);
1062                 tevent_req_done(req);
1063                 return;
1064         }
1065
1066         if (global->auth_session_info == NULL) {
1067                 TALLOC_FREE(state->db_rec);
1068                 tevent_req_done(req);
1069                 return;
1070         }
1071
1072         previous_token = global->auth_session_info->security_token;
1073
1074         if (!security_token_is_sid(previous_token, state->current_sid)) {
1075                 TALLOC_FREE(state->db_rec);
1076                 tevent_req_done(req);
1077                 return;
1078         }
1079
1080         subreq = dbwrap_watched_watch_send(state, state->ev, state->db_rec,
1081                                            (struct server_id){0});
1082         if (tevent_req_nomem(subreq, req)) {
1083                 TALLOC_FREE(state->db_rec);
1084                 return;
1085         }
1086         tevent_req_set_callback(subreq,
1087                                 smb2srv_session_close_previous_modified,
1088                                 req);
1089
1090         close_info0.old_session_global_id = global->session_global_id;
1091         close_info0.old_session_wire_id = global->session_wire_id;
1092         close_info0.old_creation_time = global->creation_time;
1093         close_info0.new_session_wire_id = state->current_session_id;
1094
1095         ZERO_STRUCT(close_blob);
1096         close_blob.version = smbXsrv_version_global_current();
1097         close_blob.info.info0 = &close_info0;
1098
1099         ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1100                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1101         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1102                 TALLOC_FREE(state->db_rec);
1103                 status = ndr_map_error2ntstatus(ndr_err);
1104                 DEBUG(1,("smb2srv_session_close_previous_check: "
1105                          "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1106                          (unsigned long long)close_info0.old_session_wire_id,
1107                          (unsigned long long)close_info0.new_session_wire_id,
1108                          nt_errstr(status)));
1109                 tevent_req_nterror(req, status);
1110                 return;
1111         }
1112
1113         status = messaging_send(conn->client->msg_ctx,
1114                                 global->channels[0].server_id,
1115                                 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1116         TALLOC_FREE(state->db_rec);
1117         if (tevent_req_nterror(req, status)) {
1118                 return;
1119         }
1120
1121         TALLOC_FREE(global);
1122         return;
1123 }
1124
1125 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1126 {
1127         struct tevent_req *req =
1128                 tevent_req_callback_data(subreq,
1129                 struct tevent_req);
1130         struct smb2srv_session_close_previous_state *state =
1131                 tevent_req_data(req,
1132                 struct smb2srv_session_close_previous_state);
1133         uint32_t global_id;
1134         NTSTATUS status;
1135
1136         status = dbwrap_watched_watch_recv(subreq, NULL, NULL);
1137         TALLOC_FREE(subreq);
1138         if (tevent_req_nterror(req, status)) {
1139                 return;
1140         }
1141
1142         global_id = state->previous_session_id & UINT32_MAX;
1143
1144         state->db_rec = smbXsrv_session_global_fetch_locked(
1145                 state->connection->client->session_table->global.db_ctx,
1146                 global_id, state /* TALLOC_CTX */);
1147
1148         smb2srv_session_close_previous_check(req);
1149 }
1150
1151 NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1152 {
1153         NTSTATUS status;
1154
1155         if (tevent_req_is_nterror(req, &status)) {
1156                 tevent_req_received(req);
1157                 return status;
1158         }
1159
1160         tevent_req_received(req);
1161         return NT_STATUS_OK;
1162 }
1163
1164 static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1165 {
1166         NTSTATUS status;
1167         struct smbXsrv_connection *xconn = NULL;
1168
1169         if (session->client != NULL) {
1170                 xconn = session->client->connections;
1171         }
1172
1173         for (; xconn != NULL; xconn = xconn->next) {
1174                 struct smbd_smb2_request *preq;
1175
1176                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1177                         if (preq->session != session) {
1178                                 continue;
1179                         }
1180
1181                         preq->session = NULL;
1182                         /*
1183                          * If we no longer have a session we can't
1184                          * sign or encrypt replies.
1185                          */
1186                         preq->do_signing = false;
1187                         preq->do_encryption = false;
1188                         preq->preauth = NULL;
1189                 }
1190         }
1191
1192         status = smbXsrv_session_logoff(session);
1193         return status;
1194 }
1195
1196 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1197 {
1198         NTSTATUS status;
1199
1200         status = smbXsrv_session_clear_and_logoff(session);
1201         if (!NT_STATUS_IS_OK(status)) {
1202                 DEBUG(0, ("smbXsrv_session_destructor: "
1203                           "smbXsrv_session_logoff() failed: %s\n",
1204                           nt_errstr(status)));
1205         }
1206
1207         TALLOC_FREE(session->global);
1208
1209         return 0;
1210 }
1211
1212 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1213                                 NTTIME now,
1214                                 struct smbXsrv_session **_session)
1215 {
1216         struct smbXsrv_session_table *table = conn->client->session_table;
1217         struct db_record *local_rec = NULL;
1218         struct smbXsrv_session *session = NULL;
1219         void *ptr = NULL;
1220         TDB_DATA val;
1221         struct smbXsrv_session_global0 *global = NULL;
1222         struct smbXsrv_channel_global0 *channel = NULL;
1223         NTSTATUS status;
1224
1225         if (table->local.num_sessions >= table->local.max_sessions) {
1226                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1227         }
1228
1229         session = talloc_zero(table, struct smbXsrv_session);
1230         if (session == NULL) {
1231                 return NT_STATUS_NO_MEMORY;
1232         }
1233         session->table = table;
1234         session->idle_time = now;
1235         session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1236         session->client = conn->client;
1237
1238         status = smbXsrv_session_global_allocate(table->global.db_ctx,
1239                                                  session,
1240                                                  &global);
1241         if (!NT_STATUS_IS_OK(status)) {
1242                 TALLOC_FREE(session);
1243                 return status;
1244         }
1245         session->global = global;
1246
1247         if (conn->protocol >= PROTOCOL_SMB2_02) {
1248                 uint64_t id = global->session_global_id;
1249
1250                 global->connection_dialect = conn->smb2.server.dialect;
1251
1252                 global->session_wire_id = id;
1253
1254                 status = smb2srv_tcon_table_init(session);
1255                 if (!NT_STATUS_IS_OK(status)) {
1256                         TALLOC_FREE(session);
1257                         return status;
1258                 }
1259
1260                 session->local_id = global->session_global_id;
1261
1262                 local_rec = smbXsrv_session_local_fetch_locked(
1263                                                 table->local.db_ctx,
1264                                                 session->local_id,
1265                                                 session /* TALLOC_CTX */);
1266                 if (local_rec == NULL) {
1267                         TALLOC_FREE(session);
1268                         return NT_STATUS_NO_MEMORY;
1269                 }
1270
1271                 val = dbwrap_record_get_value(local_rec);
1272                 if (val.dsize != 0) {
1273                         TALLOC_FREE(session);
1274                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1275                 }
1276         } else {
1277
1278                 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1279                                                         table->local.lowest_id,
1280                                                         table->local.highest_id,
1281                                                         session,
1282                                                         &local_rec,
1283                                                         &session->local_id);
1284                 if (!NT_STATUS_IS_OK(status)) {
1285                         TALLOC_FREE(session);
1286                         return status;
1287                 }
1288
1289                 global->session_wire_id = session->local_id;
1290         }
1291
1292         global->creation_time = now;
1293         global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1294
1295         status = smbXsrv_session_add_channel(session, conn, &channel);
1296         if (!NT_STATUS_IS_OK(status)) {
1297                 TALLOC_FREE(session);
1298                 return status;
1299         }
1300
1301         ptr = session;
1302         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1303         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1304         TALLOC_FREE(local_rec);
1305         if (!NT_STATUS_IS_OK(status)) {
1306                 TALLOC_FREE(session);
1307                 return status;
1308         }
1309         table->local.num_sessions += 1;
1310
1311         talloc_set_destructor(session, smbXsrv_session_destructor);
1312
1313         status = smbXsrv_session_global_store(global);
1314         if (!NT_STATUS_IS_OK(status)) {
1315                 DEBUG(0,("smbXsrv_session_create: "
1316                          "global_id (0x%08x) store failed - %s\n",
1317                          session->global->session_global_id,
1318                          nt_errstr(status)));
1319                 TALLOC_FREE(session);
1320                 return status;
1321         }
1322
1323         if (DEBUGLVL(10)) {
1324                 struct smbXsrv_sessionB session_blob;
1325
1326                 ZERO_STRUCT(session_blob);
1327                 session_blob.version = SMBXSRV_VERSION_0;
1328                 session_blob.info.info0 = session;
1329
1330                 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1331                          session->global->session_global_id));
1332                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1333         }
1334
1335         *_session = session;
1336         return NT_STATUS_OK;
1337 }
1338
1339 NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1340                                      struct smbXsrv_connection *conn,
1341                                      struct smbXsrv_channel_global0 **_c)
1342 {
1343         struct smbXsrv_session_global0 *global = session->global;
1344         struct smbXsrv_channel_global0 *c = NULL;
1345
1346         if (global->num_channels > 31) {
1347                 /*
1348                  * Windows 2012 and 2012R2 allow up to 32 channels
1349                  */
1350                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1351         }
1352
1353         c = talloc_realloc(global,
1354                            global->channels,
1355                            struct smbXsrv_channel_global0,
1356                            global->num_channels + 1);
1357         if (c == NULL) {
1358                 return NT_STATUS_NO_MEMORY;
1359         }
1360         global->channels = c;
1361
1362         c = &global->channels[global->num_channels];
1363         ZERO_STRUCTP(c);
1364
1365         c->server_id = messaging_server_id(conn->client->msg_ctx);
1366         c->local_address = tsocket_address_string(conn->local_address,
1367                                                   global->channels);
1368         if (c->local_address == NULL) {
1369                 return NT_STATUS_NO_MEMORY;
1370         }
1371         c->remote_address = tsocket_address_string(conn->remote_address,
1372                                                    global->channels);
1373         if (c->remote_address == NULL) {
1374                 return NT_STATUS_NO_MEMORY;
1375         }
1376         c->remote_name = talloc_strdup(global->channels,
1377                                        conn->remote_hostname);
1378         if (c->remote_name == NULL) {
1379                 return NT_STATUS_NO_MEMORY;
1380         }
1381         c->connection = conn;
1382
1383         global->num_channels += 1;
1384
1385         *_c = c;
1386         return NT_STATUS_OK;
1387 }
1388
1389 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1390 {
1391         struct smbXsrv_session_table *table = session->table;
1392         NTSTATUS status;
1393
1394         if (session->global->db_rec != NULL) {
1395                 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1396                           "Called with db_rec != NULL'\n",
1397                           session->global->session_global_id));
1398                 return NT_STATUS_INTERNAL_ERROR;
1399         }
1400
1401         session->global->db_rec = smbXsrv_session_global_fetch_locked(
1402                                         table->global.db_ctx,
1403                                         session->global->session_global_id,
1404                                         session->global /* TALLOC_CTX */);
1405         if (session->global->db_rec == NULL) {
1406                 return NT_STATUS_INTERNAL_DB_ERROR;
1407         }
1408
1409         status = smbXsrv_session_global_store(session->global);
1410         if (!NT_STATUS_IS_OK(status)) {
1411                 DEBUG(0,("smbXsrv_session_update: "
1412                          "global_id (0x%08x) store failed - %s\n",
1413                          session->global->session_global_id,
1414                          nt_errstr(status)));
1415                 return status;
1416         }
1417
1418         if (DEBUGLVL(10)) {
1419                 struct smbXsrv_sessionB session_blob;
1420
1421                 ZERO_STRUCT(session_blob);
1422                 session_blob.version = SMBXSRV_VERSION_0;
1423                 session_blob.info.info0 = session;
1424
1425                 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1426                           session->global->session_global_id));
1427                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1428         }
1429
1430         return NT_STATUS_OK;
1431 }
1432
1433 NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1434                                       const struct smbXsrv_connection *conn,
1435                                       struct smbXsrv_channel_global0 **_c)
1436 {
1437         uint32_t i;
1438
1439         for (i=0; i < session->global->num_channels; i++) {
1440                 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1441
1442                 if (c->connection == conn) {
1443                         *_c = c;
1444                         return NT_STATUS_OK;
1445                 }
1446         }
1447
1448         return NT_STATUS_USER_SESSION_DELETED;
1449 }
1450
1451 NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1452                                    const struct smbXsrv_connection *conn,
1453                                    NTTIME now,
1454                                    struct smbXsrv_session_auth0 **_a)
1455 {
1456         struct smbXsrv_session_auth0 *a;
1457
1458         for (a = session->pending_auth; a != NULL; a = a->next) {
1459                 if (a->connection == conn) {
1460                         if (now != 0) {
1461                                 a->idle_time = now;
1462                         }
1463                         *_a = a;
1464                         return NT_STATUS_OK;
1465                 }
1466         }
1467
1468         return NT_STATUS_USER_SESSION_DELETED;
1469 }
1470
1471 static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1472 {
1473         if (a->session == NULL) {
1474                 return 0;
1475         }
1476
1477         DLIST_REMOVE(a->session->pending_auth, a);
1478         a->session = NULL;
1479         return 0;
1480 }
1481
1482 NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1483                                      struct smbXsrv_connection *conn,
1484                                      NTTIME now,
1485                                      uint8_t in_flags,
1486                                      uint8_t in_security_mode,
1487                                      struct smbXsrv_session_auth0 **_a)
1488 {
1489         struct smbXsrv_session_auth0 *a;
1490         NTSTATUS status;
1491
1492         status = smbXsrv_session_find_auth(session, conn, 0, &a);
1493         if (NT_STATUS_IS_OK(status)) {
1494                 return NT_STATUS_INTERNAL_ERROR;
1495         }
1496
1497         a = talloc_zero(session, struct smbXsrv_session_auth0);
1498         if (a == NULL) {
1499                 return NT_STATUS_NO_MEMORY;
1500         }
1501         a->session = session;
1502         a->connection = conn;
1503         a->in_flags = in_flags;
1504         a->in_security_mode = in_security_mode;
1505         a->creation_time = now;
1506         a->idle_time = now;
1507
1508         if (conn->protocol >= PROTOCOL_SMB3_10) {
1509                 a->preauth = talloc(a, struct smbXsrv_preauth);
1510                 if (a->preauth == NULL) {
1511                         TALLOC_FREE(session);
1512                         return NT_STATUS_NO_MEMORY;
1513                 }
1514                 *a->preauth = conn->smb2.preauth;
1515         }
1516
1517         talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1518         DLIST_ADD_END(session->pending_auth, a);
1519
1520         *_a = a;
1521         return NT_STATUS_OK;
1522 }
1523
1524 struct smb2srv_session_shutdown_state {
1525         struct tevent_queue *wait_queue;
1526 };
1527
1528 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1529
1530 struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1531                                         struct tevent_context *ev,
1532                                         struct smbXsrv_session *session,
1533                                         struct smbd_smb2_request *current_req)
1534 {
1535         struct tevent_req *req;
1536         struct smb2srv_session_shutdown_state *state;
1537         struct tevent_req *subreq;
1538         struct smbXsrv_connection *xconn = NULL;
1539         size_t len = 0;
1540
1541         /*
1542          * Make sure that no new request will be able to use this session.
1543          */
1544         session->status = NT_STATUS_USER_SESSION_DELETED;
1545
1546         req = tevent_req_create(mem_ctx, &state,
1547                                 struct smb2srv_session_shutdown_state);
1548         if (req == NULL) {
1549                 return NULL;
1550         }
1551
1552         state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1553         if (tevent_req_nomem(state->wait_queue, req)) {
1554                 return tevent_req_post(req, ev);
1555         }
1556
1557         for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1558                 struct smbd_smb2_request *preq;
1559
1560                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1561                         if (preq == current_req) {
1562                                 /* Can't cancel current request. */
1563                                 continue;
1564                         }
1565                         if (preq->session != session) {
1566                                 /* Request on different session. */
1567                                 continue;
1568                         }
1569
1570                         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1571                                 preq->session = NULL;
1572                                 /*
1573                                  * If we no longer have a session we can't
1574                                  * sign or encrypt replies.
1575                                  */
1576                                 preq->do_signing = false;
1577                                 preq->do_encryption = false;
1578                                 preq->preauth = NULL;
1579
1580                                 if (preq->subreq != NULL) {
1581                                         tevent_req_cancel(preq->subreq);
1582                                 }
1583                                 continue;
1584                         }
1585
1586                         /*
1587                          * Never cancel anything in a compound
1588                          * request. Way too hard to deal with
1589                          * the result.
1590                          */
1591                         if (!preq->compound_related && preq->subreq != NULL) {
1592                                 tevent_req_cancel(preq->subreq);
1593                         }
1594
1595                         /*
1596                          * Now wait until the request is finished.
1597                          *
1598                          * We don't set a callback, as we just want to block the
1599                          * wait queue and the talloc_free() of the request will
1600                          * remove the item from the wait queue.
1601                          */
1602                         subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1603                         if (tevent_req_nomem(subreq, req)) {
1604                                 return tevent_req_post(req, ev);
1605                         }
1606                 }
1607         }
1608
1609         len = tevent_queue_length(state->wait_queue);
1610         if (len == 0) {
1611                 tevent_req_done(req);
1612                 return tevent_req_post(req, ev);
1613         }
1614
1615         /*
1616          * Now we add our own waiter to the end of the queue,
1617          * this way we get notified when all pending requests are finished
1618          * and send to the socket.
1619          */
1620         subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1621         if (tevent_req_nomem(subreq, req)) {
1622                 return tevent_req_post(req, ev);
1623         }
1624         tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1625
1626         return req;
1627 }
1628
1629 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1630 {
1631         struct tevent_req *req =
1632                 tevent_req_callback_data(subreq,
1633                 struct tevent_req);
1634
1635         tevent_queue_wait_recv(subreq);
1636         TALLOC_FREE(subreq);
1637
1638         tevent_req_done(req);
1639 }
1640
1641 NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1642 {
1643         return tevent_req_simple_recv_ntstatus(req);
1644 }
1645
1646 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1647 {
1648         struct smbXsrv_session_table *table;
1649         struct db_record *local_rec = NULL;
1650         struct db_record *global_rec = NULL;
1651         struct smbd_server_connection *sconn = NULL;
1652         NTSTATUS status;
1653         NTSTATUS error = NT_STATUS_OK;
1654
1655         if (session->table == NULL) {
1656                 return NT_STATUS_OK;
1657         }
1658
1659         table = session->table;
1660         session->table = NULL;
1661
1662         sconn = session->client->sconn;
1663         session->client = NULL;
1664         session->status = NT_STATUS_USER_SESSION_DELETED;
1665
1666         global_rec = session->global->db_rec;
1667         session->global->db_rec = NULL;
1668         if (global_rec == NULL) {
1669                 global_rec = smbXsrv_session_global_fetch_locked(
1670                                         table->global.db_ctx,
1671                                         session->global->session_global_id,
1672                                         session->global /* TALLOC_CTX */);
1673                 if (global_rec == NULL) {
1674                         error = NT_STATUS_INTERNAL_ERROR;
1675                 }
1676         }
1677
1678         if (global_rec != NULL) {
1679                 status = dbwrap_record_delete(global_rec);
1680                 if (!NT_STATUS_IS_OK(status)) {
1681                         TDB_DATA key = dbwrap_record_get_key(global_rec);
1682
1683                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1684                                   "failed to delete global key '%s': %s\n",
1685                                   session->global->session_global_id,
1686                                   hex_encode_talloc(global_rec, key.dptr,
1687                                                     key.dsize),
1688                                   nt_errstr(status)));
1689                         error = status;
1690                 }
1691         }
1692         TALLOC_FREE(global_rec);
1693
1694         local_rec = session->db_rec;
1695         if (local_rec == NULL) {
1696                 local_rec = smbXsrv_session_local_fetch_locked(
1697                                                 table->local.db_ctx,
1698                                                 session->local_id,
1699                                                 session /* TALLOC_CTX */);
1700                 if (local_rec == NULL) {
1701                         error = NT_STATUS_INTERNAL_ERROR;
1702                 }
1703         }
1704
1705         if (local_rec != NULL) {
1706                 status = dbwrap_record_delete(local_rec);
1707                 if (!NT_STATUS_IS_OK(status)) {
1708                         TDB_DATA key = dbwrap_record_get_key(local_rec);
1709
1710                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1711                                   "failed to delete local key '%s': %s\n",
1712                                   session->global->session_global_id,
1713                                   hex_encode_talloc(local_rec, key.dptr,
1714                                                     key.dsize),
1715                                   nt_errstr(status)));
1716                         error = status;
1717                 }
1718                 table->local.num_sessions -= 1;
1719         }
1720         if (session->db_rec == NULL) {
1721                 TALLOC_FREE(local_rec);
1722         }
1723         session->db_rec = NULL;
1724
1725         if (session->compat) {
1726                 file_close_user(sconn, session->compat->vuid);
1727         }
1728
1729         if (session->tcon_table != NULL) {
1730                 /*
1731                  * Note: We only have a tcon_table for SMB2.
1732                  */
1733                 status = smb2srv_tcon_disconnect_all(session);
1734                 if (!NT_STATUS_IS_OK(status)) {
1735                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1736                                   "smb2srv_tcon_disconnect_all() failed: %s\n",
1737                                   session->global->session_global_id,
1738                                   nt_errstr(status)));
1739                         error = status;
1740                 }
1741         }
1742
1743         if (session->compat) {
1744                 invalidate_vuid(sconn, session->compat->vuid);
1745                 session->compat = NULL;
1746         }
1747
1748         return error;
1749 }
1750
1751 struct smbXsrv_session_logoff_all_state {
1752         NTSTATUS first_status;
1753         int errors;
1754 };
1755
1756 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1757                                                void *private_data);
1758
1759 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_connection *conn)
1760 {
1761         struct smbXsrv_session_table *table = conn->client->session_table;
1762         struct smbXsrv_session_logoff_all_state state;
1763         NTSTATUS status;
1764         int count = 0;
1765
1766         if (table == NULL) {
1767                 DEBUG(10, ("smbXsrv_session_logoff_all: "
1768                            "empty session_table, nothing to do.\n"));
1769                 return NT_STATUS_OK;
1770         }
1771
1772         ZERO_STRUCT(state);
1773
1774         status = dbwrap_traverse(table->local.db_ctx,
1775                                  smbXsrv_session_logoff_all_callback,
1776                                  &state, &count);
1777         if (!NT_STATUS_IS_OK(status)) {
1778                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1779                           "dbwrap_traverse() failed: %s\n",
1780                           nt_errstr(status)));
1781                 return status;
1782         }
1783
1784         if (!NT_STATUS_IS_OK(state.first_status)) {
1785                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1786                           "count[%d] errors[%d] first[%s]\n",
1787                           count, state.errors,
1788                           nt_errstr(state.first_status)));
1789                 return state.first_status;
1790         }
1791
1792         return NT_STATUS_OK;
1793 }
1794
1795 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1796                                                void *private_data)
1797 {
1798         struct smbXsrv_session_logoff_all_state *state =
1799                 (struct smbXsrv_session_logoff_all_state *)private_data;
1800         TDB_DATA val;
1801         void *ptr = NULL;
1802         struct smbXsrv_session *session = NULL;
1803         NTSTATUS status;
1804
1805         val = dbwrap_record_get_value(local_rec);
1806         if (val.dsize != sizeof(ptr)) {
1807                 status = NT_STATUS_INTERNAL_ERROR;
1808                 if (NT_STATUS_IS_OK(state->first_status)) {
1809                         state->first_status = status;
1810                 }
1811                 state->errors++;
1812                 return 0;
1813         }
1814
1815         memcpy(&ptr, val.dptr, val.dsize);
1816         session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1817
1818         session->db_rec = local_rec;
1819
1820         status = smbXsrv_session_clear_and_logoff(session);
1821         if (!NT_STATUS_IS_OK(status)) {
1822                 if (NT_STATUS_IS_OK(state->first_status)) {
1823                         state->first_status = status;
1824                 }
1825                 state->errors++;
1826                 return 0;
1827         }
1828
1829         return 0;
1830 }
1831
1832 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
1833 {
1834         /*
1835          * Allow a range from 1..65534 with 65534 values.
1836          */
1837         return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
1838                                           UINT16_MAX - 1);
1839 }
1840
1841 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
1842                                 uint16_t vuid, NTTIME now,
1843                                 struct smbXsrv_session **session)
1844 {
1845         struct smbXsrv_session_table *table = conn->client->session_table;
1846         uint32_t local_id = vuid;
1847
1848         return smbXsrv_session_local_lookup(table, conn, local_id, now,
1849                                             session);
1850 }
1851
1852 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
1853 {
1854         /*
1855          * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
1856          */
1857         return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
1858                                           UINT16_MAX - 1);
1859 }
1860
1861 static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
1862                                            /* conn: optional */
1863                                            struct smbXsrv_connection *conn,
1864                                            uint64_t session_id, NTTIME now,
1865                                            struct smbXsrv_session **session)
1866 {
1867         uint32_t local_id = session_id & UINT32_MAX;
1868         uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
1869
1870         if (local_zeros != 0) {
1871                 return NT_STATUS_USER_SESSION_DELETED;
1872         }
1873
1874         return smbXsrv_session_local_lookup(table, conn, local_id, now,
1875                                             session);
1876 }
1877
1878 NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
1879                                      uint64_t session_id, NTTIME now,
1880                                      struct smbXsrv_session **session)
1881 {
1882         struct smbXsrv_session_table *table = conn->client->session_table;
1883         return smb2srv_session_lookup_raw(table, conn, session_id, now,
1884                                           session);
1885 }
1886
1887 NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
1888                                        uint64_t session_id, NTTIME now,
1889                                        struct smbXsrv_session **session)
1890 {
1891         struct smbXsrv_session_table *table = client->session_table;
1892         return smb2srv_session_lookup_raw(table, NULL, session_id, now,
1893                                           session);
1894 }
1895
1896 struct smbXsrv_session_global_traverse_state {
1897         int (*fn)(struct smbXsrv_session_global0 *, void *);
1898         void *private_data;
1899 };
1900
1901 static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
1902 {
1903         int ret = -1;
1904         struct smbXsrv_session_global_traverse_state *state =
1905                 (struct smbXsrv_session_global_traverse_state*)data;
1906         TDB_DATA key = dbwrap_record_get_key(rec);
1907         TDB_DATA val = dbwrap_record_get_value(rec);
1908         DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
1909         struct smbXsrv_session_globalB global_blob;
1910         enum ndr_err_code ndr_err;
1911         TALLOC_CTX *frame = talloc_stackframe();
1912
1913         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
1914                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
1915         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1916                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1917                          "key '%s' ndr_pull_struct_blob - %s\n",
1918                          hex_encode_talloc(frame, key.dptr, key.dsize),
1919                          ndr_errstr(ndr_err)));
1920                 goto done;
1921         }
1922
1923         if (global_blob.version != SMBXSRV_VERSION_0) {
1924                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1925                          "key '%s' unsupported version - %d\n",
1926                          hex_encode_talloc(frame, key.dptr, key.dsize),
1927                          (int)global_blob.version));
1928                 goto done;
1929         }
1930
1931         global_blob.info.info0->db_rec = rec;
1932         ret = state->fn(global_blob.info.info0, state->private_data);
1933 done:
1934         TALLOC_FREE(frame);
1935         return ret;
1936 }
1937
1938 NTSTATUS smbXsrv_session_global_traverse(
1939                         int (*fn)(struct smbXsrv_session_global0 *, void *),
1940                         void *private_data)
1941 {
1942
1943         NTSTATUS status;
1944         int count = 0;
1945         struct smbXsrv_session_global_traverse_state state = {
1946                 .fn = fn,
1947                 .private_data = private_data,
1948         };
1949
1950         become_root();
1951         status = smbXsrv_session_global_init(NULL);
1952         if (!NT_STATUS_IS_OK(status)) {
1953                 unbecome_root();
1954                 DEBUG(0, ("Failed to initialize session_global: %s\n",
1955                           nt_errstr(status)));
1956                 return status;
1957         }
1958
1959         status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
1960                                       smbXsrv_session_global_traverse_fn,
1961                                       &state,
1962                                       &count);
1963         unbecome_root();
1964
1965         return status;
1966 }