2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "smbprofile.h"
30 #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)
32 static const char *smb2_names
[] = {
54 const char *smb2_opcode_name(uint16_t opcode
)
57 return "Bad SMB2 opcode";
59 return smb2_names
[opcode
];
62 static void print_req_vectors(struct smbd_smb2_request
*req
)
66 for (i
= 0; i
< req
->in
.vector_count
; i
++) {
67 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
69 (unsigned int)req
->in
.vector
[i
].iov_len
);
71 for (i
= 0; i
< req
->out
.vector_count
; i
++) {
72 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
74 (unsigned int)req
->out
.vector
[i
].iov_len
);
78 bool smbd_is_smb2_header(const uint8_t *inbuf
, size_t size
)
80 if (size
< (4 + SMB2_HDR_BODY
)) {
84 if (IVAL(inbuf
, 4) != SMB2_MAGIC
) {
91 static NTSTATUS
smbd_initialize_smb2(struct smbd_server_connection
*sconn
)
96 TALLOC_FREE(sconn
->smb1
.fde
);
98 sconn
->smb2
.event_ctx
= smbd_event_context();
100 sconn
->smb2
.recv_queue
= tevent_queue_create(sconn
, "smb2 recv queue");
101 if (sconn
->smb2
.recv_queue
== NULL
) {
102 return NT_STATUS_NO_MEMORY
;
105 sconn
->smb2
.send_queue
= tevent_queue_create(sconn
, "smb2 send queue");
106 if (sconn
->smb2
.send_queue
== NULL
) {
107 return NT_STATUS_NO_MEMORY
;
110 sconn
->smb2
.sessions
.idtree
= idr_init(sconn
);
111 if (sconn
->smb2
.sessions
.idtree
== NULL
) {
112 return NT_STATUS_NO_MEMORY
;
114 sconn
->smb2
.sessions
.limit
= 0x0000FFFE;
115 sconn
->smb2
.sessions
.list
= NULL
;
116 sconn
->smb2
.seqnum_low
= 0;
117 sconn
->smb2
.credits_granted
= 0;
118 sconn
->smb2
.max_credits
= lp_smb2_max_credits();
119 sconn
->smb2
.credits_bitmap
= bitmap_talloc(sconn
,
120 DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR
*sconn
->smb2
.max_credits
);
121 if (sconn
->smb2
.credits_bitmap
== NULL
) {
122 return NT_STATUS_NO_MEMORY
;
125 ret
= tstream_bsd_existing_socket(sconn
, sconn
->sock
,
126 &sconn
->smb2
.stream
);
128 status
= map_nt_error_from_unix(errno
);
132 /* Ensure child is set to non-blocking mode */
133 set_blocking(sconn
->sock
, false);
137 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
138 #define _smb2_setlen(_buf,len) do { \
139 uint8_t *buf = (uint8_t *)_buf; \
141 buf[1] = ((len)&0xFF0000)>>16; \
142 buf[2] = ((len)&0xFF00)>>8; \
143 buf[3] = (len)&0xFF; \
146 static void smb2_setup_nbt_length(struct iovec
*vector
, int count
)
151 for (i
=1; i
< count
; i
++) {
152 len
+= vector
[i
].iov_len
;
155 _smb2_setlen(vector
[0].iov_base
, len
);
158 static int smbd_smb2_request_parent_destructor(struct smbd_smb2_request
**req
)
161 (*req
)->parent
= NULL
;
162 (*req
)->mem_pool
= NULL
;
168 static int smbd_smb2_request_destructor(struct smbd_smb2_request
*req
)
172 talloc_free(req
->mem_pool
);
178 static struct smbd_smb2_request
*smbd_smb2_request_allocate(TALLOC_CTX
*mem_ctx
)
180 TALLOC_CTX
*mem_pool
;
181 struct smbd_smb2_request
**parent
;
182 struct smbd_smb2_request
*req
;
185 /* Enable this to find subtle valgrind errors. */
186 mem_pool
= talloc_init("smbd_smb2_request_allocate");
188 mem_pool
= talloc_pool(mem_ctx
, 8192);
190 if (mem_pool
== NULL
) {
194 parent
= talloc(mem_pool
, struct smbd_smb2_request
*);
195 if (parent
== NULL
) {
196 talloc_free(mem_pool
);
200 req
= talloc_zero(parent
, struct smbd_smb2_request
);
202 talloc_free(mem_pool
);
206 req
->mem_pool
= mem_pool
;
207 req
->parent
= parent
;
209 talloc_set_destructor(parent
, smbd_smb2_request_parent_destructor
);
210 talloc_set_destructor(req
, smbd_smb2_request_destructor
);
215 static NTSTATUS
smbd_smb2_request_create(struct smbd_server_connection
*sconn
,
216 const uint8_t *inbuf
, size_t size
,
217 struct smbd_smb2_request
**_req
)
219 struct smbd_smb2_request
*req
;
220 uint32_t protocol_version
;
221 const uint8_t *inhdr
= NULL
;
224 uint32_t next_command_ofs
;
226 if (size
< (4 + SMB2_HDR_BODY
+ 2)) {
227 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size
));
228 return NT_STATUS_INVALID_PARAMETER
;
233 protocol_version
= IVAL(inhdr
, SMB2_HDR_PROTOCOL_ID
);
234 if (protocol_version
!= SMB2_MAGIC
) {
235 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
237 return NT_STATUS_INVALID_PARAMETER
;
240 cmd
= SVAL(inhdr
, SMB2_HDR_OPCODE
);
241 if (cmd
!= SMB2_OP_NEGPROT
) {
242 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
244 return NT_STATUS_INVALID_PARAMETER
;
247 next_command_ofs
= IVAL(inhdr
, SMB2_HDR_NEXT_COMMAND
);
248 if (next_command_ofs
!= 0) {
249 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
251 return NT_STATUS_INVALID_PARAMETER
;
254 req
= smbd_smb2_request_allocate(sconn
);
256 return NT_STATUS_NO_MEMORY
;
260 talloc_steal(req
, inbuf
);
262 req
->in
.vector
= talloc_array(req
, struct iovec
, 4);
263 if (req
->in
.vector
== NULL
) {
265 return NT_STATUS_NO_MEMORY
;
267 req
->in
.vector_count
= 4;
269 memcpy(req
->in
.nbt_hdr
, inbuf
, 4);
272 req
->in
.vector
[0].iov_base
= (void *)req
->in
.nbt_hdr
;
273 req
->in
.vector
[0].iov_len
= 4;
274 ofs
+= req
->in
.vector
[0].iov_len
;
276 req
->in
.vector
[1].iov_base
= (void *)(inbuf
+ ofs
);
277 req
->in
.vector
[1].iov_len
= SMB2_HDR_BODY
;
278 ofs
+= req
->in
.vector
[1].iov_len
;
280 req
->in
.vector
[2].iov_base
= (void *)(inbuf
+ ofs
);
281 req
->in
.vector
[2].iov_len
= SVAL(inbuf
, ofs
) & 0xFFFE;
282 ofs
+= req
->in
.vector
[2].iov_len
;
285 return NT_STATUS_INVALID_PARAMETER
;
288 req
->in
.vector
[3].iov_base
= (void *)(inbuf
+ ofs
);
289 req
->in
.vector
[3].iov_len
= size
- ofs
;
290 ofs
+= req
->in
.vector
[3].iov_len
;
292 req
->current_idx
= 1;
298 static bool smb2_validate_message_id(struct smbd_server_connection
*sconn
,
299 const uint8_t *inhdr
)
301 uint64_t message_id
= BVAL(inhdr
, SMB2_HDR_MESSAGE_ID
);
302 struct bitmap
*credits_bm
= sconn
->smb2
.credits_bitmap
;
303 uint16_t opcode
= IVAL(inhdr
, SMB2_HDR_OPCODE
);
304 unsigned int bitmap_offset
;
306 if (opcode
== SMB2_OP_CANCEL
) {
307 /* SMB2_CANCEL requests by definition resend messageids. */
311 if (message_id
< sconn
->smb2
.seqnum_low
||
312 message_id
> (sconn
->smb2
.seqnum_low
+
313 (sconn
->smb2
.max_credits
* DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR
))) {
314 DEBUG(0,("smb2_validate_message_id: bad message_id "
315 "%llu (low = %llu, max = %lu)\n",
316 (unsigned long long)message_id
,
317 (unsigned long long)sconn
->smb2
.seqnum_low
,
318 (unsigned long)sconn
->smb2
.max_credits
));
322 /* client just used a credit. */
323 SMB_ASSERT(sconn
->smb2
.credits_granted
> 0);
324 sconn
->smb2
.credits_granted
-= 1;
326 /* Mark the message_id as seen in the bitmap. */
327 bitmap_offset
= (unsigned int)(message_id
%
328 (uint64_t)(sconn
->smb2
.max_credits
* DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR
));
329 if (bitmap_query(credits_bm
, bitmap_offset
)) {
330 DEBUG(0,("smb2_validate_message_id: duplicate message_id "
331 "%llu (bm offset %u)\n",
332 (unsigned long long)message_id
,
336 bitmap_set(credits_bm
, bitmap_offset
);
338 if (message_id
== sconn
->smb2
.seqnum_low
+ 1) {
339 /* Move the window forward by all the message_id's
341 while (bitmap_query(credits_bm
, bitmap_offset
)) {
342 DEBUG(10,("smb2_validate_message_id: clearing "
343 "id %llu (position %u) from bitmap\n",
344 (unsigned long long)(sconn
->smb2
.seqnum_low
+ 1),
346 bitmap_clear(credits_bm
, bitmap_offset
);
347 sconn
->smb2
.seqnum_low
+= 1;
348 bitmap_offset
= (bitmap_offset
+ 1) %
349 (sconn
->smb2
.max_credits
* DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR
);
356 static NTSTATUS
smbd_smb2_request_validate(struct smbd_smb2_request
*req
)
360 bool compound_related
= false;
362 count
= req
->in
.vector_count
;
365 /* It's not a SMB2 request */
366 return NT_STATUS_INVALID_PARAMETER
;
369 for (idx
=1; idx
< count
; idx
+= 3) {
370 const uint8_t *inhdr
= NULL
;
373 if (req
->in
.vector
[idx
].iov_len
!= SMB2_HDR_BODY
) {
374 return NT_STATUS_INVALID_PARAMETER
;
377 if (req
->in
.vector
[idx
+1].iov_len
< 2) {
378 return NT_STATUS_INVALID_PARAMETER
;
381 inhdr
= (const uint8_t *)req
->in
.vector
[idx
].iov_base
;
383 /* Check the SMB2 header */
384 if (IVAL(inhdr
, SMB2_HDR_PROTOCOL_ID
) != SMB2_MAGIC
) {
385 return NT_STATUS_INVALID_PARAMETER
;
388 if (!smb2_validate_message_id(req
->sconn
, inhdr
)) {
389 return NT_STATUS_INVALID_PARAMETER
;
392 flags
= IVAL(inhdr
, SMB2_HDR_FLAGS
);
395 * the 1st request should never have the
396 * SMB2_HDR_FLAG_CHAINED flag set
398 if (flags
& SMB2_HDR_FLAG_CHAINED
) {
399 req
->next_status
= NT_STATUS_INVALID_PARAMETER
;
402 } else if (idx
== 4) {
404 * the 2nd request triggers related vs. unrelated
405 * compounded requests
407 if (flags
& SMB2_HDR_FLAG_CHAINED
) {
408 compound_related
= true;
410 } else if (idx
> 4) {
413 * It seems the this tests are wrong
414 * see the SMB2-COMPOUND test
418 * all other requests should match the 2nd one
420 if (flags
& SMB2_HDR_FLAG_CHAINED
) {
421 if (!compound_related
) {
423 NT_STATUS_INVALID_PARAMETER
;
427 if (compound_related
) {
429 NT_STATUS_INVALID_PARAMETER
;
440 static void smb2_set_operation_credit(struct smbd_server_connection
*sconn
,
441 const struct iovec
*in_vector
,
442 struct iovec
*out_vector
)
444 uint8_t *outhdr
= (uint8_t *)out_vector
->iov_base
;
445 uint16_t credits_requested
= 0;
446 uint16_t credits_granted
= 0;
448 if (in_vector
!= NULL
) {
449 const uint8_t *inhdr
= (const uint8_t *)in_vector
->iov_base
;
450 credits_requested
= SVAL(inhdr
, SMB2_HDR_CREDIT
);
453 SMB_ASSERT(sconn
->smb2
.max_credits
>= sconn
->smb2
.credits_granted
);
455 /* Remember what we gave out. */
456 credits_granted
= MIN(credits_requested
, (sconn
->smb2
.max_credits
-
457 sconn
->smb2
.credits_granted
));
459 if (credits_granted
== 0 && sconn
->smb2
.credits_granted
== 0) {
460 /* First negprot packet, or ensure the client credits can
461 never drop to zero. */
465 SSVAL(outhdr
, SMB2_HDR_CREDIT
, credits_granted
);
466 sconn
->smb2
.credits_granted
+= credits_granted
;
468 DEBUG(10,("smb2_set_operation_credit: requested %u, "
469 "granted %u, total granted %u\n",
470 (unsigned int)credits_requested
,
471 (unsigned int)credits_granted
,
472 (unsigned int)sconn
->smb2
.credits_granted
));
475 static void smb2_calculate_credits(const struct smbd_smb2_request
*inreq
,
476 struct smbd_smb2_request
*outreq
)
480 count
= outreq
->out
.vector_count
;
482 for (idx
=1; idx
< count
; idx
+= 3) {
483 smb2_set_operation_credit(outreq
->sconn
,
484 &inreq
->in
.vector
[idx
],
485 &outreq
->out
.vector
[idx
]);
489 static NTSTATUS
smbd_smb2_request_setup_out(struct smbd_smb2_request
*req
)
491 struct iovec
*vector
;
495 count
= req
->in
.vector_count
;
496 vector
= talloc_zero_array(req
, struct iovec
, count
);
497 if (vector
== NULL
) {
498 return NT_STATUS_NO_MEMORY
;
501 vector
[0].iov_base
= req
->out
.nbt_hdr
;
502 vector
[0].iov_len
= 4;
503 SIVAL(req
->out
.nbt_hdr
, 0, 0);
505 for (idx
=1; idx
< count
; idx
+= 3) {
506 const uint8_t *inhdr
= NULL
;
508 uint8_t *outhdr
= NULL
;
509 uint8_t *outbody
= NULL
;
510 uint32_t next_command_ofs
= 0;
511 struct iovec
*current
= &vector
[idx
];
513 if ((idx
+ 3) < count
) {
514 /* we have a next command -
515 * setup for the error case. */
516 next_command_ofs
= SMB2_HDR_BODY
+ 9;
519 inhdr
= (const uint8_t *)req
->in
.vector
[idx
].iov_base
;
520 in_flags
= IVAL(inhdr
, SMB2_HDR_FLAGS
);
522 outhdr
= talloc_zero_array(vector
, uint8_t,
524 if (outhdr
== NULL
) {
525 return NT_STATUS_NO_MEMORY
;
528 outbody
= outhdr
+ SMB2_HDR_BODY
;
530 current
[0].iov_base
= (void *)outhdr
;
531 current
[0].iov_len
= SMB2_HDR_BODY
;
533 current
[1].iov_base
= (void *)outbody
;
534 current
[1].iov_len
= 8;
536 current
[2].iov_base
= NULL
;
537 current
[2].iov_len
= 0;
539 /* setup the SMB2 header */
540 SIVAL(outhdr
, SMB2_HDR_PROTOCOL_ID
, SMB2_MAGIC
);
541 SSVAL(outhdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
542 SSVAL(outhdr
, SMB2_HDR_EPOCH
, 0);
543 SIVAL(outhdr
, SMB2_HDR_STATUS
,
544 NT_STATUS_V(NT_STATUS_INTERNAL_ERROR
));
545 SSVAL(outhdr
, SMB2_HDR_OPCODE
,
546 SVAL(inhdr
, SMB2_HDR_OPCODE
));
547 SIVAL(outhdr
, SMB2_HDR_FLAGS
,
548 IVAL(inhdr
, SMB2_HDR_FLAGS
) | SMB2_HDR_FLAG_REDIRECT
);
549 SIVAL(outhdr
, SMB2_HDR_NEXT_COMMAND
, next_command_ofs
);
550 SBVAL(outhdr
, SMB2_HDR_MESSAGE_ID
,
551 BVAL(inhdr
, SMB2_HDR_MESSAGE_ID
));
552 SIVAL(outhdr
, SMB2_HDR_PID
,
553 IVAL(inhdr
, SMB2_HDR_PID
));
554 SIVAL(outhdr
, SMB2_HDR_TID
,
555 IVAL(inhdr
, SMB2_HDR_TID
));
556 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
,
557 BVAL(inhdr
, SMB2_HDR_SESSION_ID
));
558 memset(outhdr
+ SMB2_HDR_SIGNATURE
, 0, 16);
560 /* setup error body header */
561 SSVAL(outbody
, 0x00, 0x08 + 1);
562 SSVAL(outbody
, 0x02, 0);
563 SIVAL(outbody
, 0x04, 0);
566 req
->out
.vector
= vector
;
567 req
->out
.vector_count
= count
;
569 /* setup the length of the NBT packet */
570 smb2_setup_nbt_length(req
->out
.vector
, req
->out
.vector_count
);
572 DLIST_ADD_END(req
->sconn
->smb2
.requests
, req
, struct smbd_smb2_request
*);
577 void smbd_server_connection_terminate_ex(struct smbd_server_connection
*sconn
,
579 const char *location
)
581 DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
583 exit_server_cleanly(reason
);
586 static bool dup_smb2_vec3(TALLOC_CTX
*ctx
,
587 struct iovec
*outvec
,
588 const struct iovec
*srcvec
)
590 /* vec[0] is always boilerplate and must
591 * be allocated with size OUTVEC_ALLOC_SIZE. */
593 outvec
[0].iov_base
= talloc_memdup(ctx
,
596 if (!outvec
[0].iov_base
) {
599 outvec
[0].iov_len
= SMB2_HDR_BODY
;
602 * If this is a "standard" vec[1] of length 8,
603 * pointing to srcvec[0].iov_base + SMB2_HDR_BODY,
604 * then duplicate this. Else use talloc_memdup().
607 if (srcvec
[1].iov_len
== 8 &&
608 srcvec
[1].iov_base
==
609 ((uint8_t *)srcvec
[0].iov_base
) +
611 outvec
[1].iov_base
= ((uint8_t *)outvec
[0].iov_base
) +
613 outvec
[1].iov_len
= 8;
615 outvec
[1].iov_base
= talloc_memdup(ctx
,
618 if (!outvec
[1].iov_base
) {
621 outvec
[1].iov_len
= srcvec
[1].iov_len
;
625 * If this is a "standard" vec[2] of length 1,
626 * pointing to srcvec[0].iov_base + (OUTVEC_ALLOC_SIZE - 1)
627 * then duplicate this. Else use talloc_memdup().
630 if (srcvec
[2].iov_base
&&
632 if (srcvec
[2].iov_base
==
633 ((uint8_t *)srcvec
[0].iov_base
) +
634 (OUTVEC_ALLOC_SIZE
- 1) &&
635 srcvec
[2].iov_len
== 1) {
636 /* Common SMB2 error packet case. */
637 outvec
[2].iov_base
= ((uint8_t *)outvec
[0].iov_base
) +
638 (OUTVEC_ALLOC_SIZE
- 1);
640 outvec
[2].iov_base
= talloc_memdup(ctx
,
643 if (!outvec
[2].iov_base
) {
647 outvec
[2].iov_len
= srcvec
[2].iov_len
;
649 outvec
[2].iov_base
= NULL
;
650 outvec
[2].iov_len
= 0;
655 static struct smbd_smb2_request
*dup_smb2_req(const struct smbd_smb2_request
*req
)
657 struct smbd_smb2_request
*newreq
= NULL
;
658 struct iovec
*outvec
= NULL
;
659 int count
= req
->out
.vector_count
;
662 newreq
= smbd_smb2_request_allocate(req
->sconn
);
667 newreq
->sconn
= req
->sconn
;
668 newreq
->session
= req
->session
;
669 newreq
->do_signing
= req
->do_signing
;
670 newreq
->current_idx
= req
->current_idx
;
671 newreq
->async
= false;
672 newreq
->cancelled
= false;
673 /* Note we are leaving:
677 uninitialized as NULL here as
678 they're not used in the interim
679 response code. JRA. */
681 outvec
= talloc_zero_array(newreq
, struct iovec
, count
);
686 newreq
->out
.vector
= outvec
;
687 newreq
->out
.vector_count
= count
;
689 /* Setup the outvec's identically to req. */
690 outvec
[0].iov_base
= newreq
->out
.nbt_hdr
;
691 outvec
[0].iov_len
= 4;
692 memcpy(newreq
->out
.nbt_hdr
, req
->out
.nbt_hdr
, 4);
694 /* Setup the vectors identically to the ones in req. */
695 for (i
= 1; i
< count
; i
+= 3) {
696 if (!dup_smb2_vec3(outvec
, &outvec
[i
], &req
->out
.vector
[i
])) {
707 smb2_setup_nbt_length(newreq
->out
.vector
,
708 newreq
->out
.vector_count
);
713 static void smbd_smb2_request_writev_done(struct tevent_req
*subreq
);
715 static NTSTATUS
smb2_send_async_interim_response(const struct smbd_smb2_request
*req
)
718 uint8_t *outhdr
= NULL
;
719 struct smbd_smb2_request
*nreq
= NULL
;
721 /* Create a new smb2 request we'll use
722 for the interim return. */
723 nreq
= dup_smb2_req(req
);
725 return NT_STATUS_NO_MEMORY
;
728 /* Lose the last 3 out vectors. They're the
729 ones we'll be using for the async reply. */
730 nreq
->out
.vector_count
-= 3;
732 smb2_setup_nbt_length(nreq
->out
.vector
,
733 nreq
->out
.vector_count
);
735 /* Step back to the previous reply. */
736 i
= nreq
->current_idx
- 3;
737 outhdr
= (uint8_t *)nreq
->out
.vector
[i
].iov_base
;
738 /* And end the chain. */
739 SIVAL(outhdr
, SMB2_HDR_NEXT_COMMAND
, 0);
741 /* Calculate outgoing credits */
742 smb2_calculate_credits(req
, nreq
);
744 /* Re-sign if needed. */
745 if (nreq
->do_signing
) {
747 status
= smb2_signing_sign_pdu(nreq
->session
->session_key
,
748 &nreq
->out
.vector
[i
], 3);
749 if (!NT_STATUS_IS_OK(status
)) {
753 if (DEBUGLEVEL
>= 10) {
754 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
755 (unsigned int)nreq
->current_idx
);
756 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
757 (unsigned int)nreq
->out
.vector_count
);
758 print_req_vectors(nreq
);
760 nreq
->subreq
= tstream_writev_queue_send(nreq
,
761 nreq
->sconn
->smb2
.event_ctx
,
762 nreq
->sconn
->smb2
.stream
,
763 nreq
->sconn
->smb2
.send_queue
,
765 nreq
->out
.vector_count
);
767 if (nreq
->subreq
== NULL
) {
768 return NT_STATUS_NO_MEMORY
;
771 tevent_req_set_callback(nreq
->subreq
,
772 smbd_smb2_request_writev_done
,
778 struct smbd_smb2_request_pending_state
{
779 struct smbd_server_connection
*sconn
;
780 uint8_t buf
[4 + SMB2_HDR_BODY
+ 0x08 + 1];
781 struct iovec vector
[3];
784 static void smbd_smb2_request_pending_writev_done(struct tevent_req
*subreq
)
786 struct smbd_smb2_request_pending_state
*state
=
787 tevent_req_callback_data(subreq
,
788 struct smbd_smb2_request_pending_state
);
789 struct smbd_server_connection
*sconn
= state
->sconn
;
793 ret
= tstream_writev_queue_recv(subreq
, &sys_errno
);
796 NTSTATUS status
= map_nt_error_from_unix(sys_errno
);
797 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
804 NTSTATUS
smbd_smb2_request_pending_queue(struct smbd_smb2_request
*req
,
805 struct tevent_req
*subreq
)
808 struct smbd_smb2_request_pending_state
*state
= NULL
;
809 int i
= req
->current_idx
;
810 uint8_t *reqhdr
= NULL
;
812 uint8_t *body
= NULL
;
814 uint64_t message_id
= 0;
815 uint64_t async_id
= 0;
816 struct iovec
*outvec
= NULL
;
818 if (!tevent_req_is_in_progress(subreq
)) {
822 req
->subreq
= subreq
;
826 /* We're already async. */
830 if (req
->in
.vector_count
> i
+ 3) {
832 * We're trying to go async in a compound
833 * request chain. This is not allowed.
834 * Cancel the outstanding request.
836 tevent_req_cancel(req
->subreq
);
837 return smbd_smb2_request_error(req
,
838 NT_STATUS_INSUFFICIENT_RESOURCES
);
841 if (DEBUGLEVEL
>= 10) {
842 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
843 (unsigned int)req
->current_idx
);
844 print_req_vectors(req
);
847 if (req
->out
.vector_count
> 4) {
848 /* This is a compound reply. We
849 * must do an interim response
850 * followed by the async response
853 status
= smb2_send_async_interim_response(req
);
854 if (!NT_STATUS_IS_OK(status
)) {
859 /* Don't return an intermediate packet on a pipe read/write. */
860 if (req
->tcon
&& req
->tcon
->compat_conn
&& IS_IPC(req
->tcon
->compat_conn
)) {
864 reqhdr
= (uint8_t *)req
->out
.vector
[i
].iov_base
;
865 flags
= (IVAL(reqhdr
, SMB2_HDR_FLAGS
) & ~SMB2_HDR_FLAG_CHAINED
);
866 message_id
= BVAL(reqhdr
, SMB2_HDR_MESSAGE_ID
);
867 async_id
= message_id
; /* keep it simple for now... */
870 * What we send is identical to a smbd_smb2_request_error
871 * packet with an error status of STATUS_PENDING. Make use
872 * of this fact sometime when refactoring. JRA.
875 state
= talloc_zero(req
->sconn
, struct smbd_smb2_request_pending_state
);
877 return NT_STATUS_NO_MEMORY
;
879 state
->sconn
= req
->sconn
;
881 state
->vector
[0].iov_base
= (void *)state
->buf
;
882 state
->vector
[0].iov_len
= 4;
884 state
->vector
[1].iov_base
= state
->buf
+ 4;
885 state
->vector
[1].iov_len
= SMB2_HDR_BODY
;
887 state
->vector
[2].iov_base
= state
->buf
+ 4 + SMB2_HDR_BODY
;
888 state
->vector
[2].iov_len
= 9;
890 smb2_setup_nbt_length(state
->vector
, 3);
892 hdr
= (uint8_t *)state
->vector
[1].iov_base
;
893 body
= (uint8_t *)state
->vector
[2].iov_base
;
895 SIVAL(hdr
, SMB2_HDR_PROTOCOL_ID
, SMB2_MAGIC
);
896 SSVAL(hdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
897 SSVAL(hdr
, SMB2_HDR_EPOCH
, 0);
898 SIVAL(hdr
, SMB2_HDR_STATUS
, NT_STATUS_V(STATUS_PENDING
));
899 SSVAL(hdr
, SMB2_HDR_OPCODE
, SVAL(reqhdr
, SMB2_HDR_OPCODE
));
901 SIVAL(hdr
, SMB2_HDR_FLAGS
, flags
| SMB2_HDR_FLAG_ASYNC
);
902 SIVAL(hdr
, SMB2_HDR_NEXT_COMMAND
, 0);
903 SBVAL(hdr
, SMB2_HDR_MESSAGE_ID
, message_id
);
904 SBVAL(hdr
, SMB2_HDR_PID
, async_id
);
905 SBVAL(hdr
, SMB2_HDR_SESSION_ID
,
906 BVAL(reqhdr
, SMB2_HDR_SESSION_ID
));
907 memset(hdr
+SMB2_HDR_SIGNATURE
, 0, 16);
909 SSVAL(body
, 0x00, 0x08 + 1);
911 SCVAL(body
, 0x02, 0);
912 SCVAL(body
, 0x03, 0);
913 SIVAL(body
, 0x04, 0);
914 /* Match W2K8R2... */
915 SCVAL(body
, 0x08, 0x21);
917 /* Ensure we correctly go through crediting. Grant
918 the credits now, and zero credits on the final
920 smb2_set_operation_credit(req
->sconn
,
924 if (req
->do_signing
) {
925 status
= smb2_signing_sign_pdu(req
->session
->session_key
,
927 if (!NT_STATUS_IS_OK(status
)) {
932 subreq
= tstream_writev_queue_send(state
,
933 req
->sconn
->smb2
.event_ctx
,
934 req
->sconn
->smb2
.stream
,
935 req
->sconn
->smb2
.send_queue
,
939 if (subreq
== NULL
) {
940 return NT_STATUS_NO_MEMORY
;
943 tevent_req_set_callback(subreq
,
944 smbd_smb2_request_pending_writev_done
,
947 /* Note we're going async with this request. */
951 * Now manipulate req so that the outstanding async request
952 * is the only one left in the struct smbd_smb2_request.
955 if (req
->current_idx
== 1) {
956 /* There was only one. */
960 /* Re-arrange the in.vectors. */
961 req
->in
.vector
[1] = req
->in
.vector
[i
];
962 req
->in
.vector
[2] = req
->in
.vector
[i
+1];
963 req
->in
.vector
[3] = req
->in
.vector
[i
+2];
964 req
->in
.vector_count
= 4;
965 /* Reset the new in size. */
966 smb2_setup_nbt_length(req
->in
.vector
, 4);
968 /* Now recreate the out.vectors. */
969 outvec
= talloc_zero_array(req
, struct iovec
, 4);
971 return NT_STATUS_NO_MEMORY
;
974 /* 0 is always boilerplate and must
975 * be of size 4 for the length field. */
977 outvec
[0].iov_base
= req
->out
.nbt_hdr
;
978 outvec
[0].iov_len
= 4;
979 SIVAL(req
->out
.nbt_hdr
, 0, 0);
981 if (!dup_smb2_vec3(outvec
, &outvec
[1], &req
->out
.vector
[i
])) {
982 return NT_STATUS_NO_MEMORY
;
985 TALLOC_FREE(req
->out
.vector
);
987 req
->out
.vector
= outvec
;
989 req
->current_idx
= 1;
990 req
->out
.vector_count
= 4;
994 smb2_setup_nbt_length(req
->out
.vector
,
995 req
->out
.vector_count
);
997 /* Ensure our final reply matches the interim one. */
998 reqhdr
= (uint8_t *)req
->out
.vector
[1].iov_base
;
999 SIVAL(reqhdr
, SMB2_HDR_FLAGS
, flags
| SMB2_HDR_FLAG_ASYNC
);
1000 SBVAL(reqhdr
, SMB2_HDR_PID
, async_id
);
1003 const uint8_t *inhdr
=
1004 (const uint8_t *)req
->in
.vector
[1].iov_base
;
1005 DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1007 smb2_opcode_name((uint16_t)IVAL(inhdr
, SMB2_HDR_OPCODE
)),
1008 (unsigned long long)async_id
));
1010 return NT_STATUS_OK
;
1013 static NTSTATUS
smbd_smb2_request_process_cancel(struct smbd_smb2_request
*req
)
1015 struct smbd_server_connection
*sconn
= req
->sconn
;
1016 struct smbd_smb2_request
*cur
;
1017 const uint8_t *inhdr
;
1018 int i
= req
->current_idx
;
1020 uint64_t search_message_id
;
1021 uint64_t search_async_id
;
1024 inhdr
= (const uint8_t *)req
->in
.vector
[i
].iov_base
;
1026 flags
= IVAL(inhdr
, SMB2_HDR_FLAGS
);
1027 search_message_id
= BVAL(inhdr
, SMB2_HDR_MESSAGE_ID
);
1028 search_async_id
= BVAL(inhdr
, SMB2_HDR_PID
);
1031 * we don't need the request anymore
1032 * cancel requests never have a response
1034 DLIST_REMOVE(req
->sconn
->smb2
.requests
, req
);
1037 for (cur
= sconn
->smb2
.requests
; cur
; cur
= cur
->next
) {
1038 const uint8_t *outhdr
;
1039 uint64_t message_id
;
1042 i
= cur
->current_idx
;
1044 outhdr
= (const uint8_t *)cur
->out
.vector
[i
].iov_base
;
1046 message_id
= BVAL(outhdr
, SMB2_HDR_MESSAGE_ID
);
1047 async_id
= BVAL(outhdr
, SMB2_HDR_PID
);
1049 if (flags
& SMB2_HDR_FLAG_ASYNC
) {
1050 if (search_async_id
== async_id
) {
1051 found_id
= async_id
;
1055 if (search_message_id
== message_id
) {
1056 found_id
= message_id
;
1062 if (cur
&& cur
->subreq
) {
1063 inhdr
= (const uint8_t *)cur
->in
.vector
[i
].iov_base
;
1064 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1065 "cancel opcode[%s] mid %llu\n",
1066 smb2_opcode_name((uint16_t)IVAL(inhdr
, SMB2_HDR_OPCODE
)),
1067 (unsigned long long)found_id
));
1068 tevent_req_cancel(cur
->subreq
);
1071 return NT_STATUS_OK
;
1074 NTSTATUS
smbd_smb2_request_dispatch(struct smbd_smb2_request
*req
)
1076 const uint8_t *inhdr
;
1077 int i
= req
->current_idx
;
1082 NTSTATUS session_status
;
1083 uint32_t allowed_flags
;
1084 NTSTATUS return_value
;
1086 inhdr
= (const uint8_t *)req
->in
.vector
[i
].iov_base
;
1088 /* TODO: verify more things */
1090 flags
= IVAL(inhdr
, SMB2_HDR_FLAGS
);
1091 opcode
= IVAL(inhdr
, SMB2_HDR_OPCODE
);
1092 mid
= BVAL(inhdr
, SMB2_HDR_MESSAGE_ID
);
1093 DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
1094 smb2_opcode_name(opcode
),
1095 (unsigned long long)mid
));
1097 allowed_flags
= SMB2_HDR_FLAG_CHAINED
|
1098 SMB2_HDR_FLAG_SIGNED
|
1100 if (opcode
== SMB2_OP_CANCEL
) {
1101 allowed_flags
|= SMB2_HDR_FLAG_ASYNC
;
1103 if ((flags
& ~allowed_flags
) != 0) {
1104 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
1107 session_status
= smbd_smb2_request_check_session(req
);
1109 req
->do_signing
= false;
1110 if (flags
& SMB2_HDR_FLAG_SIGNED
) {
1111 if (!NT_STATUS_IS_OK(session_status
)) {
1112 return smbd_smb2_request_error(req
, session_status
);
1115 req
->do_signing
= true;
1116 status
= smb2_signing_check_pdu(req
->session
->session_key
,
1117 &req
->in
.vector
[i
], 3);
1118 if (!NT_STATUS_IS_OK(status
)) {
1119 return smbd_smb2_request_error(req
, status
);
1121 } else if (req
->session
&& req
->session
->do_signing
) {
1122 return smbd_smb2_request_error(req
, NT_STATUS_ACCESS_DENIED
);
1125 if (flags
& SMB2_HDR_FLAG_CHAINED
) {
1127 * This check is mostly for giving the correct error code
1128 * for compounded requests.
1130 * TODO: we may need to move this after the session
1133 if (!NT_STATUS_IS_OK(req
->next_status
)) {
1134 return smbd_smb2_request_error(req
, req
->next_status
);
1137 req
->compat_chain_fsp
= NULL
;
1141 case SMB2_OP_NEGPROT
:
1143 START_PROFILE(smb2_negprot
);
1144 return_value
= smbd_smb2_request_process_negprot(req
);
1145 END_PROFILE(smb2_negprot
);
1149 case SMB2_OP_SESSSETUP
:
1151 START_PROFILE(smb2_sesssetup
);
1152 return_value
= smbd_smb2_request_process_sesssetup(req
);
1153 END_PROFILE(smb2_sesssetup
);
1157 case SMB2_OP_LOGOFF
:
1158 if (!NT_STATUS_IS_OK(session_status
)) {
1159 return_value
= smbd_smb2_request_error(req
, session_status
);
1164 START_PROFILE(smb2_logoff
);
1165 return_value
= smbd_smb2_request_process_logoff(req
);
1166 END_PROFILE(smb2_logoff
);
1171 if (!NT_STATUS_IS_OK(session_status
)) {
1172 return_value
= smbd_smb2_request_error(req
, session_status
);
1175 status
= smbd_smb2_request_check_session(req
);
1176 if (!NT_STATUS_IS_OK(status
)) {
1177 return_value
= smbd_smb2_request_error(req
, status
);
1182 START_PROFILE(smb2_tcon
);
1183 return_value
= smbd_smb2_request_process_tcon(req
);
1184 END_PROFILE(smb2_tcon
);
1189 if (!NT_STATUS_IS_OK(session_status
)) {
1190 return_value
= smbd_smb2_request_error(req
, session_status
);
1193 status
= smbd_smb2_request_check_tcon(req
);
1194 if (!NT_STATUS_IS_OK(status
)) {
1195 return_value
= smbd_smb2_request_error(req
, status
);
1200 START_PROFILE(smb2_tdis
);
1201 return_value
= smbd_smb2_request_process_tdis(req
);
1202 END_PROFILE(smb2_tdis
);
1206 case SMB2_OP_CREATE
:
1207 if (!NT_STATUS_IS_OK(session_status
)) {
1208 return_value
= smbd_smb2_request_error(req
, session_status
);
1211 status
= smbd_smb2_request_check_tcon(req
);
1212 if (!NT_STATUS_IS_OK(status
)) {
1213 return_value
= smbd_smb2_request_error(req
, status
);
1218 START_PROFILE(smb2_create
);
1219 return_value
= smbd_smb2_request_process_create(req
);
1220 END_PROFILE(smb2_create
);
1225 if (!NT_STATUS_IS_OK(session_status
)) {
1226 return_value
= smbd_smb2_request_error(req
, session_status
);
1229 status
= smbd_smb2_request_check_tcon(req
);
1230 if (!NT_STATUS_IS_OK(status
)) {
1231 return_value
= smbd_smb2_request_error(req
, status
);
1236 START_PROFILE(smb2_close
);
1237 return_value
= smbd_smb2_request_process_close(req
);
1238 END_PROFILE(smb2_close
);
1243 if (!NT_STATUS_IS_OK(session_status
)) {
1244 return_value
= smbd_smb2_request_error(req
, session_status
);
1247 status
= smbd_smb2_request_check_tcon(req
);
1248 if (!NT_STATUS_IS_OK(status
)) {
1249 return_value
= smbd_smb2_request_error(req
, status
);
1254 START_PROFILE(smb2_flush
);
1255 return_value
= smbd_smb2_request_process_flush(req
);
1256 END_PROFILE(smb2_flush
);
1261 if (!NT_STATUS_IS_OK(session_status
)) {
1262 return_value
= smbd_smb2_request_error(req
, session_status
);
1265 status
= smbd_smb2_request_check_tcon(req
);
1266 if (!NT_STATUS_IS_OK(status
)) {
1267 return_value
= smbd_smb2_request_error(req
, status
);
1272 START_PROFILE(smb2_read
);
1273 return_value
= smbd_smb2_request_process_read(req
);
1274 END_PROFILE(smb2_read
);
1279 if (!NT_STATUS_IS_OK(session_status
)) {
1280 return_value
= smbd_smb2_request_error(req
, session_status
);
1283 status
= smbd_smb2_request_check_tcon(req
);
1284 if (!NT_STATUS_IS_OK(status
)) {
1285 return_value
= smbd_smb2_request_error(req
, status
);
1290 START_PROFILE(smb2_write
);
1291 return_value
= smbd_smb2_request_process_write(req
);
1292 END_PROFILE(smb2_write
);
1297 if (!NT_STATUS_IS_OK(session_status
)) {
1298 /* Too ugly to live ? JRA. */
1299 if (NT_STATUS_EQUAL(session_status
,NT_STATUS_USER_SESSION_DELETED
)) {
1300 session_status
= NT_STATUS_FILE_CLOSED
;
1302 return_value
= smbd_smb2_request_error(req
, session_status
);
1305 status
= smbd_smb2_request_check_tcon(req
);
1306 if (!NT_STATUS_IS_OK(status
)) {
1307 /* Too ugly to live ? JRA. */
1308 if (NT_STATUS_EQUAL(status
,NT_STATUS_NETWORK_NAME_DELETED
)) {
1309 status
= NT_STATUS_FILE_CLOSED
;
1311 return_value
= smbd_smb2_request_error(req
, status
);
1316 START_PROFILE(smb2_lock
);
1317 return_value
= smbd_smb2_request_process_lock(req
);
1318 END_PROFILE(smb2_lock
);
1323 if (!NT_STATUS_IS_OK(session_status
)) {
1324 return_value
= smbd_smb2_request_error(req
, session_status
);
1327 status
= smbd_smb2_request_check_tcon(req
);
1328 if (!NT_STATUS_IS_OK(status
)) {
1329 return_value
= smbd_smb2_request_error(req
, status
);
1334 START_PROFILE(smb2_ioctl
);
1335 return_value
= smbd_smb2_request_process_ioctl(req
);
1336 END_PROFILE(smb2_ioctl
);
1340 case SMB2_OP_CANCEL
:
1342 START_PROFILE(smb2_cancel
);
1343 return_value
= smbd_smb2_request_process_cancel(req
);
1344 END_PROFILE(smb2_cancel
);
1348 case SMB2_OP_KEEPALIVE
:
1349 {START_PROFILE(smb2_keepalive
);
1350 return_value
= smbd_smb2_request_process_keepalive(req
);
1351 END_PROFILE(smb2_keepalive
);}
1355 if (!NT_STATUS_IS_OK(session_status
)) {
1356 return_value
= smbd_smb2_request_error(req
, session_status
);
1359 status
= smbd_smb2_request_check_tcon(req
);
1360 if (!NT_STATUS_IS_OK(status
)) {
1361 return_value
= smbd_smb2_request_error(req
, status
);
1366 START_PROFILE(smb2_find
);
1367 return_value
= smbd_smb2_request_process_find(req
);
1368 END_PROFILE(smb2_find
);
1372 case SMB2_OP_NOTIFY
:
1373 if (!NT_STATUS_IS_OK(session_status
)) {
1374 return_value
= smbd_smb2_request_error(req
, session_status
);
1377 status
= smbd_smb2_request_check_tcon(req
);
1378 if (!NT_STATUS_IS_OK(status
)) {
1379 return_value
= smbd_smb2_request_error(req
, status
);
1384 START_PROFILE(smb2_notify
);
1385 return_value
= smbd_smb2_request_process_notify(req
);
1386 END_PROFILE(smb2_notify
);
1390 case SMB2_OP_GETINFO
:
1391 if (!NT_STATUS_IS_OK(session_status
)) {
1392 return_value
= smbd_smb2_request_error(req
, session_status
);
1395 status
= smbd_smb2_request_check_tcon(req
);
1396 if (!NT_STATUS_IS_OK(status
)) {
1397 return_value
= smbd_smb2_request_error(req
, status
);
1402 START_PROFILE(smb2_getinfo
);
1403 return_value
= smbd_smb2_request_process_getinfo(req
);
1404 END_PROFILE(smb2_getinfo
);
1408 case SMB2_OP_SETINFO
:
1409 if (!NT_STATUS_IS_OK(session_status
)) {
1410 return_value
= smbd_smb2_request_error(req
, session_status
);
1413 status
= smbd_smb2_request_check_tcon(req
);
1414 if (!NT_STATUS_IS_OK(status
)) {
1415 return_value
= smbd_smb2_request_error(req
, status
);
1420 START_PROFILE(smb2_setinfo
);
1421 return_value
= smbd_smb2_request_process_setinfo(req
);
1422 END_PROFILE(smb2_setinfo
);
1427 if (!NT_STATUS_IS_OK(session_status
)) {
1428 return_value
= smbd_smb2_request_error(req
, session_status
);
1431 status
= smbd_smb2_request_check_tcon(req
);
1432 if (!NT_STATUS_IS_OK(status
)) {
1433 return_value
= smbd_smb2_request_error(req
, status
);
1438 START_PROFILE(smb2_break
);
1439 return_value
= smbd_smb2_request_process_break(req
);
1440 END_PROFILE(smb2_break
);
1445 return_value
= smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
1448 return return_value
;
1451 static NTSTATUS
smbd_smb2_request_reply(struct smbd_smb2_request
*req
)
1453 struct tevent_req
*subreq
;
1454 int i
= req
->current_idx
;
1458 req
->current_idx
+= 3;
1460 if (req
->current_idx
< req
->out
.vector_count
) {
1462 * We must process the remaining compound
1463 * SMB2 requests before any new incoming SMB2
1464 * requests. This is because incoming SMB2
1465 * requests may include a cancel for a
1466 * compound request we haven't processed
1469 struct tevent_immediate
*im
= tevent_create_immediate(req
);
1471 return NT_STATUS_NO_MEMORY
;
1473 tevent_schedule_immediate(im
,
1474 req
->sconn
->smb2
.event_ctx
,
1475 smbd_smb2_request_dispatch_immediate
,
1477 return NT_STATUS_OK
;
1480 smb2_setup_nbt_length(req
->out
.vector
, req
->out
.vector_count
);
1482 /* Set credit for this operation (zero credits if this
1483 is a final reply for an async operation). */
1484 smb2_set_operation_credit(req
->sconn
,
1485 req
->async
? NULL
: &req
->in
.vector
[i
],
1486 &req
->out
.vector
[i
]);
1488 if (req
->do_signing
) {
1490 status
= smb2_signing_sign_pdu(req
->session
->session_key
,
1491 &req
->out
.vector
[i
], 3);
1492 if (!NT_STATUS_IS_OK(status
)) {
1497 if (DEBUGLEVEL
>= 10) {
1498 dbgtext("smbd_smb2_request_reply: sending...\n");
1499 print_req_vectors(req
);
1502 /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
1503 if (req
->out
.vector_count
== 4 &&
1504 req
->out
.vector
[3].iov_base
== NULL
&&
1505 req
->out
.vector
[3].iov_len
!= 0) {
1506 /* Dynamic part is NULL. Chop it off,
1507 We're going to send it via sendfile. */
1508 req
->out
.vector_count
-= 1;
1511 subreq
= tstream_writev_queue_send(req
,
1512 req
->sconn
->smb2
.event_ctx
,
1513 req
->sconn
->smb2
.stream
,
1514 req
->sconn
->smb2
.send_queue
,
1516 req
->out
.vector_count
);
1517 if (subreq
== NULL
) {
1518 return NT_STATUS_NO_MEMORY
;
1520 tevent_req_set_callback(subreq
, smbd_smb2_request_writev_done
, req
);
1522 * We're done with this request -
1523 * move it off the "being processed" queue.
1525 DLIST_REMOVE(req
->sconn
->smb2
.requests
, req
);
1527 return NT_STATUS_OK
;
1530 void smbd_smb2_request_dispatch_immediate(struct tevent_context
*ctx
,
1531 struct tevent_immediate
*im
,
1534 struct smbd_smb2_request
*req
= talloc_get_type_abort(private_data
,
1535 struct smbd_smb2_request
);
1536 struct smbd_server_connection
*sconn
= req
->sconn
;
1541 if (DEBUGLEVEL
>= 10) {
1542 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
1543 req
->current_idx
, req
->in
.vector_count
));
1544 print_req_vectors(req
);
1547 status
= smbd_smb2_request_dispatch(req
);
1548 if (!NT_STATUS_IS_OK(status
)) {
1549 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
1554 static void smbd_smb2_request_writev_done(struct tevent_req
*subreq
)
1556 struct smbd_smb2_request
*req
= tevent_req_callback_data(subreq
,
1557 struct smbd_smb2_request
);
1558 struct smbd_server_connection
*sconn
= req
->sconn
;
1562 ret
= tstream_writev_queue_recv(subreq
, &sys_errno
);
1563 TALLOC_FREE(subreq
);
1566 NTSTATUS status
= map_nt_error_from_unix(sys_errno
);
1567 DEBUG(2,("smbd_smb2_request_writev_done: client write error %s\n",
1568 nt_errstr(status
)));
1569 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
1574 NTSTATUS
smbd_smb2_request_done_ex(struct smbd_smb2_request
*req
,
1576 DATA_BLOB body
, DATA_BLOB
*dyn
,
1577 const char *location
)
1580 int i
= req
->current_idx
;
1581 uint32_t next_command_ofs
;
1583 DEBUG(10,("smbd_smb2_request_done_ex: "
1584 "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
1585 i
, nt_errstr(status
), (unsigned int)body
.length
,
1587 (unsigned int)(dyn
? dyn
->length
: 0),
1590 if (body
.length
< 2) {
1591 return smbd_smb2_request_error(req
, NT_STATUS_INTERNAL_ERROR
);
1594 if ((body
.length
% 2) != 0) {
1595 return smbd_smb2_request_error(req
, NT_STATUS_INTERNAL_ERROR
);
1598 outhdr
= (uint8_t *)req
->out
.vector
[i
].iov_base
;
1600 next_command_ofs
= IVAL(outhdr
, SMB2_HDR_NEXT_COMMAND
);
1601 SIVAL(outhdr
, SMB2_HDR_STATUS
, NT_STATUS_V(status
));
1603 req
->out
.vector
[i
+1].iov_base
= (void *)body
.data
;
1604 req
->out
.vector
[i
+1].iov_len
= body
.length
;
1607 req
->out
.vector
[i
+2].iov_base
= (void *)dyn
->data
;
1608 req
->out
.vector
[i
+2].iov_len
= dyn
->length
;
1610 req
->out
.vector
[i
+2].iov_base
= NULL
;
1611 req
->out
.vector
[i
+2].iov_len
= 0;
1614 /* see if we need to recalculate the offset to the next response */
1615 if (next_command_ofs
> 0) {
1616 next_command_ofs
= SMB2_HDR_BODY
;
1617 next_command_ofs
+= req
->out
.vector
[i
+1].iov_len
;
1618 next_command_ofs
+= req
->out
.vector
[i
+2].iov_len
;
1621 if ((next_command_ofs
% 8) != 0) {
1622 size_t pad_size
= 8 - (next_command_ofs
% 8);
1623 if (req
->out
.vector
[i
+2].iov_len
== 0) {
1625 * if the dyn buffer is empty
1626 * we can use it to add padding
1630 pad
= talloc_zero_array(req
->out
.vector
,
1633 return smbd_smb2_request_error(req
,
1634 NT_STATUS_NO_MEMORY
);
1637 req
->out
.vector
[i
+2].iov_base
= (void *)pad
;
1638 req
->out
.vector
[i
+2].iov_len
= pad_size
;
1641 * For now we copy the dynamic buffer
1642 * and add the padding to the new buffer
1649 old_size
= req
->out
.vector
[i
+2].iov_len
;
1650 old_dyn
= (uint8_t *)req
->out
.vector
[i
+2].iov_base
;
1652 new_size
= old_size
+ pad_size
;
1653 new_dyn
= talloc_zero_array(req
->out
.vector
,
1655 if (new_dyn
== NULL
) {
1656 return smbd_smb2_request_error(req
,
1657 NT_STATUS_NO_MEMORY
);
1660 memcpy(new_dyn
, old_dyn
, old_size
);
1661 memset(new_dyn
+ old_size
, 0, pad_size
);
1663 req
->out
.vector
[i
+2].iov_base
= (void *)new_dyn
;
1664 req
->out
.vector
[i
+2].iov_len
= new_size
;
1666 next_command_ofs
+= pad_size
;
1669 SIVAL(outhdr
, SMB2_HDR_NEXT_COMMAND
, next_command_ofs
);
1671 return smbd_smb2_request_reply(req
);
1674 NTSTATUS
smbd_smb2_request_error_ex(struct smbd_smb2_request
*req
,
1677 const char *location
)
1680 int i
= req
->current_idx
;
1681 uint8_t *outhdr
= (uint8_t *)req
->out
.vector
[i
].iov_base
;
1683 DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
1684 i
, nt_errstr(status
), info
? " +info" : "",
1687 body
.data
= outhdr
+ SMB2_HDR_BODY
;
1689 SSVAL(body
.data
, 0, 9);
1692 SIVAL(body
.data
, 0x04, info
->length
);
1694 /* Allocated size of req->out.vector[i].iov_base
1695 * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
1696 * 1 byte without having to do an alloc.
1698 info
= talloc_zero_array(req
->out
.vector
,
1702 return NT_STATUS_NO_MEMORY
;
1704 info
->data
= ((uint8_t *)outhdr
) +
1705 OUTVEC_ALLOC_SIZE
- 1;
1707 SCVAL(info
->data
, 0, 0);
1711 * if a request fails, all other remaining
1712 * compounded requests should fail too
1714 req
->next_status
= NT_STATUS_INVALID_PARAMETER
;
1716 return smbd_smb2_request_done_ex(req
, status
, body
, info
, __location__
);
1720 struct smbd_smb2_send_oplock_break_state
{
1721 struct smbd_server_connection
*sconn
;
1722 uint8_t buf
[4 + SMB2_HDR_BODY
+ 0x18];
1723 struct iovec vector
;
1726 static void smbd_smb2_oplock_break_writev_done(struct tevent_req
*subreq
);
1728 NTSTATUS
smbd_smb2_send_oplock_break(struct smbd_server_connection
*sconn
,
1729 uint64_t file_id_persistent
,
1730 uint64_t file_id_volatile
,
1731 uint8_t oplock_level
)
1733 struct smbd_smb2_send_oplock_break_state
*state
;
1734 struct tevent_req
*subreq
;
1738 state
= talloc(sconn
, struct smbd_smb2_send_oplock_break_state
);
1739 if (state
== NULL
) {
1740 return NT_STATUS_NO_MEMORY
;
1742 state
->sconn
= sconn
;
1744 state
->vector
.iov_base
= (void *)state
->buf
;
1745 state
->vector
.iov_len
= sizeof(state
->buf
);
1747 _smb2_setlen(state
->buf
, sizeof(state
->buf
) - 4);
1748 hdr
= state
->buf
+ 4;
1749 body
= hdr
+ SMB2_HDR_BODY
;
1751 SIVAL(hdr
, 0, SMB2_MAGIC
);
1752 SSVAL(hdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
1753 SSVAL(hdr
, SMB2_HDR_EPOCH
, 0);
1754 SIVAL(hdr
, SMB2_HDR_STATUS
, 0);
1755 SSVAL(hdr
, SMB2_HDR_OPCODE
, SMB2_OP_BREAK
);
1756 SSVAL(hdr
, SMB2_HDR_CREDIT
, 0);
1757 SIVAL(hdr
, SMB2_HDR_FLAGS
, SMB2_HDR_FLAG_REDIRECT
);
1758 SIVAL(hdr
, SMB2_HDR_NEXT_COMMAND
, 0);
1759 SBVAL(hdr
, SMB2_HDR_MESSAGE_ID
, UINT64_MAX
);
1760 SIVAL(hdr
, SMB2_HDR_PID
, 0);
1761 SIVAL(hdr
, SMB2_HDR_TID
, 0);
1762 SBVAL(hdr
, SMB2_HDR_SESSION_ID
, 0);
1763 memset(hdr
+SMB2_HDR_SIGNATURE
, 0, 16);
1765 SSVAL(body
, 0x00, 0x18);
1767 SCVAL(body
, 0x02, oplock_level
);
1768 SCVAL(body
, 0x03, 0); /* reserved */
1769 SIVAL(body
, 0x04, 0); /* reserved */
1770 SBVAL(body
, 0x08, file_id_persistent
);
1771 SBVAL(body
, 0x10, file_id_volatile
);
1773 subreq
= tstream_writev_queue_send(state
,
1774 sconn
->smb2
.event_ctx
,
1776 sconn
->smb2
.send_queue
,
1778 if (subreq
== NULL
) {
1779 return NT_STATUS_NO_MEMORY
;
1781 tevent_req_set_callback(subreq
,
1782 smbd_smb2_oplock_break_writev_done
,
1785 return NT_STATUS_OK
;
1788 static void smbd_smb2_oplock_break_writev_done(struct tevent_req
*subreq
)
1790 struct smbd_smb2_send_oplock_break_state
*state
=
1791 tevent_req_callback_data(subreq
,
1792 struct smbd_smb2_send_oplock_break_state
);
1793 struct smbd_server_connection
*sconn
= state
->sconn
;
1797 ret
= tstream_writev_queue_recv(subreq
, &sys_errno
);
1798 TALLOC_FREE(subreq
);
1800 NTSTATUS status
= map_nt_error_from_unix(sys_errno
);
1801 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
1808 struct smbd_smb2_request_read_state
{
1810 bool asked_for_header
;
1811 struct smbd_smb2_request
*smb2_req
;
1814 static int smbd_smb2_request_next_vector(struct tstream_context
*stream
,
1816 TALLOC_CTX
*mem_ctx
,
1817 struct iovec
**_vector
,
1819 static void smbd_smb2_request_read_done(struct tevent_req
*subreq
);
1821 static struct tevent_req
*smbd_smb2_request_read_send(TALLOC_CTX
*mem_ctx
,
1822 struct tevent_context
*ev
,
1823 struct smbd_server_connection
*sconn
)
1825 struct tevent_req
*req
;
1826 struct smbd_smb2_request_read_state
*state
;
1827 struct tevent_req
*subreq
;
1829 req
= tevent_req_create(mem_ctx
, &state
,
1830 struct smbd_smb2_request_read_state
);
1835 state
->asked_for_header
= false;
1837 state
->smb2_req
= smbd_smb2_request_allocate(state
);
1838 if (tevent_req_nomem(state
->smb2_req
, req
)) {
1839 return tevent_req_post(req
, ev
);
1841 state
->smb2_req
->sconn
= sconn
;
1843 subreq
= tstream_readv_pdu_queue_send(state
, ev
, sconn
->smb2
.stream
,
1844 sconn
->smb2
.recv_queue
,
1845 smbd_smb2_request_next_vector
,
1847 if (tevent_req_nomem(subreq
, req
)) {
1848 return tevent_req_post(req
, ev
);
1850 tevent_req_set_callback(subreq
, smbd_smb2_request_read_done
, req
);
1855 static int smbd_smb2_request_next_vector(struct tstream_context
*stream
,
1857 TALLOC_CTX
*mem_ctx
,
1858 struct iovec
**_vector
,
1861 struct smbd_smb2_request_read_state
*state
=
1862 talloc_get_type_abort(private_data
,
1863 struct smbd_smb2_request_read_state
);
1864 struct smbd_smb2_request
*req
= state
->smb2_req
;
1865 struct iovec
*vector
;
1866 int idx
= req
->in
.vector_count
;
1868 uint8_t *buf
= NULL
;
1870 if (req
->in
.vector_count
== 0) {
1872 * first we need to get the NBT header
1874 req
->in
.vector
= talloc_array(req
, struct iovec
,
1875 req
->in
.vector_count
+ 1);
1876 if (req
->in
.vector
== NULL
) {
1879 req
->in
.vector_count
+= 1;
1881 req
->in
.vector
[idx
].iov_base
= (void *)req
->in
.nbt_hdr
;
1882 req
->in
.vector
[idx
].iov_len
= 4;
1884 vector
= talloc_array(mem_ctx
, struct iovec
, 1);
1885 if (vector
== NULL
) {
1889 vector
[0] = req
->in
.vector
[idx
];
1896 if (req
->in
.vector_count
== 1) {
1898 * Now we analyze the NBT header
1900 state
->missing
= smb2_len(req
->in
.vector
[0].iov_base
);
1902 if (state
->missing
== 0) {
1903 /* if there're no remaining bytes, we're done */
1909 req
->in
.vector
= talloc_realloc(req
, req
->in
.vector
,
1911 req
->in
.vector_count
+ 1);
1912 if (req
->in
.vector
== NULL
) {
1915 req
->in
.vector_count
+= 1;
1917 if (CVAL(req
->in
.vector
[0].iov_base
, 0) != 0) {
1919 * it's a special NBT message,
1920 * so get all remaining bytes
1922 len
= state
->missing
;
1923 } else if (state
->missing
< (SMB2_HDR_BODY
+ 2)) {
1925 * it's an invalid message, just read what we can get
1926 * and let the caller handle the error
1928 len
= state
->missing
;
1931 * We assume it's a SMB2 request,
1932 * and we first get the header and the
1933 * first 2 bytes (the struct size) of the body
1935 len
= SMB2_HDR_BODY
+ 2;
1937 state
->asked_for_header
= true;
1940 state
->missing
-= len
;
1942 buf
= talloc_array(req
->in
.vector
, uint8_t, len
);
1947 req
->in
.vector
[idx
].iov_base
= (void *)buf
;
1948 req
->in
.vector
[idx
].iov_len
= len
;
1950 vector
= talloc_array(mem_ctx
, struct iovec
, 1);
1951 if (vector
== NULL
) {
1955 vector
[0] = req
->in
.vector
[idx
];
1962 if (state
->missing
== 0) {
1963 /* if there're no remaining bytes, we're done */
1969 if (state
->asked_for_header
) {
1972 size_t next_command_ofs
;
1977 bool invalid
= false;
1979 state
->asked_for_header
= false;
1982 * We got the SMB2 header and the first 2 bytes
1983 * of the body. We fix the size to just the header
1984 * and manually copy the 2 first bytes to the body section
1986 req
->in
.vector
[idx
-1].iov_len
= SMB2_HDR_BODY
;
1987 hdr
= (const uint8_t *)req
->in
.vector
[idx
-1].iov_base
;
1989 /* allocate vectors for body and dynamic areas */
1990 req
->in
.vector
= talloc_realloc(req
, req
->in
.vector
,
1992 req
->in
.vector_count
+ 2);
1993 if (req
->in
.vector
== NULL
) {
1996 req
->in
.vector_count
+= 2;
1998 full_size
= state
->missing
+ SMB2_HDR_BODY
+ 2;
1999 next_command_ofs
= IVAL(hdr
, SMB2_HDR_NEXT_COMMAND
);
2000 body_size
= SVAL(hdr
, SMB2_HDR_BODY
);
2002 if (next_command_ofs
!= 0) {
2003 if (next_command_ofs
< (SMB2_HDR_BODY
+ 2)) {
2005 * this is invalid, just return a zero
2006 * body and let the caller deal with the error
2009 } else if (next_command_ofs
> full_size
) {
2011 * this is invalid, just return a zero
2012 * body and let the caller deal with the error
2016 full_size
= next_command_ofs
;
2021 if (body_size
< 2) {
2023 * this is invalid, just return a zero
2024 * body and let the caller deal with the error
2029 if ((body_size
% 2) != 0) {
2033 if (body_size
> (full_size
- SMB2_HDR_BODY
)) {
2035 * this is invalid, just return a zero
2036 * body and let the caller deal with the error
2043 /* the caller should check this */
2047 dyn_size
= full_size
- (SMB2_HDR_BODY
+ body_size
);
2049 state
->missing
-= (body_size
- 2) + dyn_size
;
2051 body
= talloc_array(req
->in
.vector
, uint8_t, body_size
);
2056 dyn
= talloc_array(req
->in
.vector
, uint8_t, dyn_size
);
2061 req
->in
.vector
[idx
].iov_base
= (void *)body
;
2062 req
->in
.vector
[idx
].iov_len
= body_size
;
2063 req
->in
.vector
[idx
+1].iov_base
= (void *)dyn
;
2064 req
->in
.vector
[idx
+1].iov_len
= dyn_size
;
2066 vector
= talloc_array(mem_ctx
, struct iovec
, 2);
2067 if (vector
== NULL
) {
2072 * the first 2 bytes of the body were already fetched
2073 * together with the header
2075 memcpy(body
, hdr
+ SMB2_HDR_BODY
, 2);
2076 vector
[0].iov_base
= body
+ 2;
2077 vector
[0].iov_len
= body_size
- 2;
2079 vector
[1] = req
->in
.vector
[idx
+1];
2087 * when we endup here, we're looking for a new SMB2 request
2088 * next. And we ask for its header and the first 2 bytes of
2089 * the body (like we did for the first SMB2 request).
2092 req
->in
.vector
= talloc_realloc(req
, req
->in
.vector
,
2094 req
->in
.vector_count
+ 1);
2095 if (req
->in
.vector
== NULL
) {
2098 req
->in
.vector_count
+= 1;
2101 * We assume it's a SMB2 request,
2102 * and we first get the header and the
2103 * first 2 bytes (the struct size) of the body
2105 len
= SMB2_HDR_BODY
+ 2;
2107 if (len
> state
->missing
) {
2108 /* let the caller handle the error */
2109 len
= state
->missing
;
2112 state
->missing
-= len
;
2113 state
->asked_for_header
= true;
2115 buf
= talloc_array(req
->in
.vector
, uint8_t, len
);
2120 req
->in
.vector
[idx
].iov_base
= (void *)buf
;
2121 req
->in
.vector
[idx
].iov_len
= len
;
2123 vector
= talloc_array(mem_ctx
, struct iovec
, 1);
2124 if (vector
== NULL
) {
2128 vector
[0] = req
->in
.vector
[idx
];
2135 static void smbd_smb2_request_read_done(struct tevent_req
*subreq
)
2137 struct tevent_req
*req
=
2138 tevent_req_callback_data(subreq
,
2144 ret
= tstream_readv_pdu_queue_recv(subreq
, &sys_errno
);
2146 status
= map_nt_error_from_unix(sys_errno
);
2147 tevent_req_nterror(req
, status
);
2151 tevent_req_done(req
);
2154 static NTSTATUS
smbd_smb2_request_read_recv(struct tevent_req
*req
,
2155 TALLOC_CTX
*mem_ctx
,
2156 struct smbd_smb2_request
**_smb2_req
)
2158 struct smbd_smb2_request_read_state
*state
=
2159 tevent_req_data(req
,
2160 struct smbd_smb2_request_read_state
);
2163 if (tevent_req_is_nterror(req
, &status
)) {
2164 tevent_req_received(req
);
2168 talloc_steal(mem_ctx
, state
->smb2_req
->mem_pool
);
2169 *_smb2_req
= state
->smb2_req
;
2170 tevent_req_received(req
);
2171 return NT_STATUS_OK
;
2174 static void smbd_smb2_request_incoming(struct tevent_req
*subreq
);
2176 void smbd_smb2_first_negprot(struct smbd_server_connection
*sconn
,
2177 const uint8_t *inbuf
, size_t size
)
2180 struct smbd_smb2_request
*req
= NULL
;
2181 struct tevent_req
*subreq
;
2183 DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
2184 (unsigned int)size
));
2186 status
= smbd_initialize_smb2(sconn
);
2187 if (!NT_STATUS_IS_OK(status
)) {
2188 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2192 status
= smbd_smb2_request_create(sconn
, inbuf
, size
, &req
);
2193 if (!NT_STATUS_IS_OK(status
)) {
2194 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2198 status
= smbd_smb2_request_setup_out(req
);
2199 if (!NT_STATUS_IS_OK(status
)) {
2200 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2204 status
= smbd_smb2_request_dispatch(req
);
2205 if (!NT_STATUS_IS_OK(status
)) {
2206 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2210 /* ask for the next request */
2211 subreq
= smbd_smb2_request_read_send(sconn
, sconn
->smb2
.event_ctx
, sconn
);
2212 if (subreq
== NULL
) {
2213 smbd_server_connection_terminate(sconn
, "no memory for reading");
2216 tevent_req_set_callback(subreq
, smbd_smb2_request_incoming
, sconn
);
2219 static void smbd_smb2_request_incoming(struct tevent_req
*subreq
)
2221 struct smbd_server_connection
*sconn
= tevent_req_callback_data(subreq
,
2222 struct smbd_server_connection
);
2224 struct smbd_smb2_request
*req
= NULL
;
2226 status
= smbd_smb2_request_read_recv(subreq
, sconn
, &req
);
2227 TALLOC_FREE(subreq
);
2228 if (!NT_STATUS_IS_OK(status
)) {
2229 DEBUG(2,("smbd_smb2_request_incoming: client read error %s\n",
2230 nt_errstr(status
)));
2231 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2235 if (req
->in
.nbt_hdr
[0] != 0x00) {
2236 DEBUG(1,("smbd_smb2_request_incoming: ignore NBT[0x%02X] msg\n",
2237 req
->in
.nbt_hdr
[0]));
2242 req
->current_idx
= 1;
2244 DEBUG(10,("smbd_smb2_request_incoming: idx[%d] of %d vectors\n",
2245 req
->current_idx
, req
->in
.vector_count
));
2247 status
= smbd_smb2_request_validate(req
);
2248 if (!NT_STATUS_IS_OK(status
)) {
2249 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2253 status
= smbd_smb2_request_setup_out(req
);
2254 if (!NT_STATUS_IS_OK(status
)) {
2255 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2259 status
= smbd_smb2_request_dispatch(req
);
2260 if (!NT_STATUS_IS_OK(status
)) {
2261 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2266 /* ask for the next request (this constructs the main loop) */
2267 subreq
= smbd_smb2_request_read_send(sconn
, sconn
->smb2
.event_ctx
, sconn
);
2268 if (subreq
== NULL
) {
2269 smbd_server_connection_terminate(sconn
, "no memory for reading");
2272 tevent_req_set_callback(subreq
, smbd_smb2_request_incoming
, sconn
);