2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2012
5 Copyright (C) Michael Adam 2012
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "smbXsrv_open.h"
23 #include "system/filesys.h"
24 #include "lib/util/server_id.h"
25 #include "smbd/smbd.h"
26 #include "smbd/globals.h"
27 #include "dbwrap/dbwrap.h"
28 #include "dbwrap/dbwrap_rbt.h"
29 #include "dbwrap/dbwrap_open.h"
30 #include "../libcli/security/security.h"
32 #include "lib/util/util_tdb.h"
33 #include "librpc/gen_ndr/ndr_smbXsrv.h"
35 #include "source3/include/util_tdb.h"
36 #include "lib/util/idtree_random.h"
37 #include "lib/util/time_basic.h"
39 struct smbXsrv_open_table
{
41 struct idr_context
*idr
;
42 struct db_context
*replay_cache_db_ctx
;
49 struct db_context
*db_ctx
;
53 static struct db_context
*smbXsrv_open_global_db_ctx
= NULL
;
55 NTSTATUS
smbXsrv_open_global_init(void)
57 char *global_path
= NULL
;
58 struct db_context
*db_ctx
= NULL
;
60 if (smbXsrv_open_global_db_ctx
!= NULL
) {
64 global_path
= lock_path(talloc_tos(), "smbXsrv_open_global.tdb");
65 if (global_path
== NULL
) {
66 return NT_STATUS_NO_MEMORY
;
69 db_ctx
= db_open(NULL
, global_path
,
70 SMBD_VOLATILE_TDB_HASH_SIZE
,
71 SMBD_VOLATILE_TDB_FLAGS
,
72 O_RDWR
| O_CREAT
, 0600,
75 TALLOC_FREE(global_path
);
77 NTSTATUS status
= map_nt_error_from_unix_common(errno
);
81 smbXsrv_open_global_db_ctx
= db_ctx
;
88 * We need to store the keys in big endian so that dbwrap_rbt's memcmp
89 * has the same result as integer comparison between the uint32_t
92 * TODO: implement string based key
95 struct smbXsrv_open_global_key_buf
{ uint8_t buf
[sizeof(uint32_t)]; };
97 static TDB_DATA
smbXsrv_open_global_id_to_key(
98 uint32_t id
, struct smbXsrv_open_global_key_buf
*key_buf
)
100 RSIVAL(key_buf
->buf
, 0, id
);
103 .dptr
= key_buf
->buf
,
104 .dsize
= sizeof(key_buf
->buf
),
108 static NTSTATUS
smbXsrv_open_table_init(struct smbXsrv_connection
*conn
,
113 struct smbXsrv_client
*client
= conn
->client
;
114 struct smbXsrv_open_table
*table
;
118 if (lowest_id
> highest_id
) {
119 return NT_STATUS_INTERNAL_ERROR
;
122 max_range
= highest_id
;
123 max_range
-= lowest_id
;
126 if (max_opens
> max_range
) {
127 return NT_STATUS_INTERNAL_ERROR
;
130 table
= talloc_zero(client
, struct smbXsrv_open_table
);
132 return NT_STATUS_NO_MEMORY
;
135 table
->local
.idr
= idr_init(table
);
136 if (table
->local
.idr
== NULL
) {
138 return NT_STATUS_NO_MEMORY
;
140 table
->local
.replay_cache_db_ctx
= db_open_rbt(table
);
141 if (table
->local
.replay_cache_db_ctx
== NULL
) {
143 return NT_STATUS_NO_MEMORY
;
145 table
->local
.lowest_id
= lowest_id
;
146 table
->local
.highest_id
= highest_id
;
147 table
->local
.max_opens
= max_opens
;
149 status
= smbXsrv_open_global_init();
150 if (!NT_STATUS_IS_OK(status
)) {
155 table
->global
.db_ctx
= smbXsrv_open_global_db_ctx
;
157 client
->open_table
= table
;
161 static NTSTATUS
smbXsrv_open_local_lookup(struct smbXsrv_open_table
*table
,
162 uint32_t open_local_id
,
163 uint32_t open_global_id
,
165 struct smbXsrv_open
**_open
)
167 struct smbXsrv_open
*op
= NULL
;
171 if (open_local_id
== 0) {
172 return NT_STATUS_FILE_CLOSED
;
176 /* this might happen before the end of negprot */
177 return NT_STATUS_FILE_CLOSED
;
180 if (table
->local
.idr
== NULL
) {
181 return NT_STATUS_INTERNAL_ERROR
;
184 op
= idr_find(table
->local
.idr
, open_local_id
);
186 return NT_STATUS_FILE_CLOSED
;
189 if (open_global_id
== 0) {
190 /* make the global check a no-op for SMB1 */
191 open_global_id
= op
->global
->open_global_id
;
194 if (op
->global
->open_global_id
!= open_global_id
) {
195 return NT_STATUS_FILE_CLOSED
;
206 static NTSTATUS
smbXsrv_open_global_parse_record(
210 struct smbXsrv_open_global0
**global
)
212 DATA_BLOB blob
= data_blob_const(val
.dptr
, val
.dsize
);
213 struct smbXsrv_open_globalB global_blob
;
214 enum ndr_err_code ndr_err
;
216 TALLOC_CTX
*frame
= talloc_stackframe();
218 ndr_err
= ndr_pull_struct_blob(&blob
, frame
, &global_blob
,
219 (ndr_pull_flags_fn_t
)ndr_pull_smbXsrv_open_globalB
);
220 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
221 DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
222 "key '%s' ndr_pull_struct_blob - %s\n",
224 ndr_errstr(ndr_err
)));
225 status
= ndr_map_error2ntstatus(ndr_err
);
230 if (CHECK_DEBUGLVL(10)) {
231 NDR_PRINT_DEBUG(smbXsrv_open_globalB
, &global_blob
);
234 if (global_blob
.version
!= SMBXSRV_VERSION_0
) {
235 status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
236 DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
237 "key '%s' unsupported version - %d - %s\n",
239 (int)global_blob
.version
,
244 if (global_blob
.info
.info0
== NULL
) {
245 status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
246 DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
247 "key '%s' info0 NULL pointer - %s\n",
253 *global
= talloc_move(mem_ctx
, &global_blob
.info
.info0
);
254 status
= NT_STATUS_OK
;
260 static NTSTATUS
smbXsrv_open_global_verify_record(
264 struct smbXsrv_open_global0
**_global0
)
266 struct smbXsrv_open_global0
*global0
= NULL
;
267 struct server_id_buf buf
;
270 if (val
.dsize
== 0) {
271 return NT_STATUS_NOT_FOUND
;
274 status
= smbXsrv_open_global_parse_record(mem_ctx
, key
, val
, &global0
);
275 if (!NT_STATUS_IS_OK(status
)) {
276 DBG_WARNING("smbXsrv_open_global_parse_record for %s failed: "
284 if (server_id_is_disconnected(&global0
->server_id
)) {
287 if (serverid_exists(&global0
->server_id
)) {
291 DBG_WARNING("smbd %s did not clean up record %s\n",
292 server_id_str_buf(global0
->server_id
, &buf
),
295 return NT_STATUS_FATAL_APP_EXIT
;
298 static NTSTATUS
smbXsrv_open_global_store(
299 struct db_record
*rec
,
302 struct smbXsrv_open_global0
*global
)
304 struct smbXsrv_open_globalB global_blob
;
305 DATA_BLOB blob
= data_blob_null
;
306 TDB_DATA val
= { .dptr
= NULL
, };
308 enum ndr_err_code ndr_err
;
311 * TODO: if we use other versions than '0'
312 * we would add glue code here, that would be able to
313 * store the information in the old format.
316 global_blob
= (struct smbXsrv_open_globalB
) {
317 .version
= smbXsrv_version_global_current(),
320 if (oldval
.dsize
>= 8) {
321 global_blob
.seqnum
= IVAL(oldval
.dptr
, 4);
323 global_blob
.seqnum
+= 1;
324 global_blob
.info
.info0
= global
;
326 ndr_err
= ndr_push_struct_blob(&blob
, talloc_tos(), &global_blob
,
327 (ndr_push_flags_fn_t
)ndr_push_smbXsrv_open_globalB
);
328 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
329 DBG_WARNING("key '%s' ndr_push - %s\n",
331 ndr_map_error2string(ndr_err
));
332 return ndr_map_error2ntstatus(ndr_err
);
335 val
= make_tdb_data(blob
.data
, blob
.length
);
336 status
= dbwrap_record_store(rec
, val
, TDB_REPLACE
);
337 TALLOC_FREE(blob
.data
);
338 if (!NT_STATUS_IS_OK(status
)) {
339 DBG_WARNING("key '%s' store - %s\n",
345 if (CHECK_DEBUGLVL(10)) {
346 DBG_DEBUG("key '%s' stored\n", tdb_data_dbg(key
));
347 NDR_PRINT_DEBUG(smbXsrv_open_globalB
, &global_blob
);
353 struct smbXsrv_open_global_allocate_state
{
355 struct smbXsrv_open_global0
*global
;
359 static void smbXsrv_open_global_allocate_fn(
360 struct db_record
*rec
, TDB_DATA oldval
, void *private_data
)
362 struct smbXsrv_open_global_allocate_state
*state
= private_data
;
363 struct smbXsrv_open_global0
*global
= state
->global
;
364 struct smbXsrv_open_global0
*tmp_global0
= NULL
;
365 TDB_DATA key
= dbwrap_record_get_key(rec
);
367 state
->status
= smbXsrv_open_global_verify_record(
368 key
, oldval
, talloc_tos(), &tmp_global0
);
370 if (NT_STATUS_IS_OK(state
->status
)) {
372 * Found an existing record
374 TALLOC_FREE(tmp_global0
);
375 state
->status
= NT_STATUS_RETRY
;
379 if (NT_STATUS_EQUAL(state
->status
, NT_STATUS_NOT_FOUND
)) {
381 * Found an empty slot
383 global
->open_global_id
= state
->id
;
384 global
->open_persistent_id
= state
->id
;
386 state
->status
= smbXsrv_open_global_store(
387 rec
, key
, (TDB_DATA
) { .dsize
= 0, }, state
->global
);
388 if (!NT_STATUS_IS_OK(state
->status
)) {
389 DBG_WARNING("smbXsrv_open_global_store() for "
390 "id %"PRIu32
" failed: %s\n",
392 nt_errstr(state
->status
));
397 if (NT_STATUS_EQUAL(state
->status
, NT_STATUS_FATAL_APP_EXIT
)) {
400 TALLOC_FREE(tmp_global0
);
405 status
= dbwrap_record_delete(rec
);
406 if (!NT_STATUS_IS_OK(status
)) {
407 DBG_WARNING("dbwrap_record_delete() failed "
408 "for record %"PRIu32
": %s\n",
411 state
->status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
418 static NTSTATUS
smbXsrv_open_global_allocate(
419 struct db_context
*db
, struct smbXsrv_open_global0
*global
)
421 struct smbXsrv_open_global_allocate_state state
= {
425 uint32_t last_free
= 0;
426 const uint32_t min_tries
= 3;
429 * Here we just randomly try the whole 32-bit space
431 * We use just 32-bit, because we want to reuse the
434 for (i
= 0; i
< UINT32_MAX
; i
++) {
435 struct smbXsrv_open_global_key_buf key_buf
;
439 if (i
>= min_tries
&& last_free
!= 0) {
440 state
.id
= last_free
;
442 generate_nonce_buffer(
443 (uint8_t *)&state
.id
, sizeof(state
.id
));
444 state
.id
= MAX(state
.id
, 1);
445 state
.id
= MIN(state
.id
, UINT32_MAX
-1);
448 key
= smbXsrv_open_global_id_to_key(state
.id
, &key_buf
);
450 status
= dbwrap_do_locked(
451 db
, key
, smbXsrv_open_global_allocate_fn
, &state
);
453 if (!NT_STATUS_IS_OK(status
)) {
454 DBG_WARNING("dbwrap_do_locked() failed: %s\n",
456 return NT_STATUS_INTERNAL_DB_ERROR
;
459 if (NT_STATUS_IS_OK(state
.status
)) {
461 * Found an empty slot, done.
463 DBG_DEBUG("Found slot %"PRIu32
"\n", state
.id
);
467 if (NT_STATUS_EQUAL(state
.status
, NT_STATUS_FATAL_APP_EXIT
)) {
469 if ((i
< min_tries
) && (last_free
== 0)) {
471 * Remember "id" as free but also try
472 * others to not recycle ids too
475 last_free
= state
.id
;
480 if (NT_STATUS_EQUAL(state
.status
, NT_STATUS_RETRY
)) {
482 * Normal collision, try next
484 DBG_DEBUG("Found record for id %"PRIu32
"\n",
489 DBG_WARNING("smbXsrv_open_global_allocate_fn() failed: %s\n",
490 nt_errstr(state
.status
));
494 /* should not be reached */
495 return NT_STATUS_INTERNAL_ERROR
;
498 static int smbXsrv_open_destructor(struct smbXsrv_open
*op
)
502 status
= smbXsrv_open_close(op
, 0);
503 if (!NT_STATUS_IS_OK(status
)) {
504 DEBUG(0, ("smbXsrv_open_destructor: "
505 "smbXsrv_open_close() failed - %s\n",
509 TALLOC_FREE(op
->global
);
514 NTSTATUS
smbXsrv_open_create(struct smbXsrv_connection
*conn
,
515 struct auth_session_info
*session_info
,
517 struct smbXsrv_open
**_open
)
519 struct smbXsrv_open_table
*table
= conn
->client
->open_table
;
520 struct smbXsrv_open
*op
= NULL
;
521 struct smbXsrv_open_global0
*global
= NULL
;
523 struct dom_sid
*current_sid
= NULL
;
524 struct security_token
*current_token
= NULL
;
527 if (session_info
== NULL
) {
528 return NT_STATUS_INVALID_HANDLE
;
530 current_token
= session_info
->security_token
;
532 if ((current_token
== NULL
) ||
533 (current_token
->num_sids
<= PRIMARY_USER_SID_INDEX
)) {
534 return NT_STATUS_INVALID_HANDLE
;
536 current_sid
= ¤t_token
->sids
[PRIMARY_USER_SID_INDEX
];
538 if (table
->local
.num_opens
>= table
->local
.max_opens
) {
539 return NT_STATUS_INSUFFICIENT_RESOURCES
;
542 op
= talloc_zero(table
, struct smbXsrv_open
);
544 return NT_STATUS_NO_MEMORY
;
547 op
->status
= NT_STATUS_OK
; /* TODO: start with INTERNAL_ERROR */
550 global
= talloc_zero(op
, struct smbXsrv_open_global0
);
551 if (global
== NULL
) {
553 return NT_STATUS_NO_MEMORY
;
558 * We mark every slot as invalid using 0xFF.
559 * Valid values are masked with 0xF.
561 memset(global
->lock_sequence_array
, 0xFF,
562 sizeof(global
->lock_sequence_array
));
564 local_id
= idr_get_new_random(
567 table
->local
.lowest_id
,
568 table
->local
.highest_id
);
569 if (local_id
== -1) {
571 return NT_STATUS_INSUFFICIENT_RESOURCES
;
573 op
->local_id
= local_id
;
575 global
->open_volatile_id
= op
->local_id
;
577 global
->server_id
= messaging_server_id(conn
->client
->msg_ctx
);
578 global
->open_time
= now
;
579 global
->open_owner
= *current_sid
;
580 if (conn
->protocol
>= PROTOCOL_SMB2_10
) {
581 global
->client_guid
= conn
->smb2
.client
.guid
;
584 status
= smbXsrv_open_global_allocate(table
->global
.db_ctx
,
586 if (!NT_STATUS_IS_OK(status
)) {
587 int ret
= idr_remove(table
->local
.idr
, local_id
);
588 SMB_ASSERT(ret
== 0);
590 DBG_WARNING("smbXsrv_open_global_allocate() failed: %s\n",
596 table
->local
.num_opens
+= 1;
597 talloc_set_destructor(op
, smbXsrv_open_destructor
);
599 if (CHECK_DEBUGLVL(10)) {
600 struct smbXsrv_openB open_blob
= {
601 .version
= SMBXSRV_VERSION_0
,
605 DEBUG(10,("smbXsrv_open_create: global_id (0x%08x) stored\n",
606 op
->global
->open_global_id
));
607 NDR_PRINT_DEBUG(smbXsrv_openB
, &open_blob
);
614 static NTSTATUS
smbXsrv_open_set_replay_cache(struct smbXsrv_open
*op
)
616 struct GUID
*create_guid
;
617 struct GUID_txt_buf buf
;
619 struct db_context
*db
= op
->table
->local
.replay_cache_db_ctx
;
620 struct smbXsrv_open_replay_cache rc
= {
621 .idle_time
= op
->idle_time
,
622 .local_id
= op
->local_id
,
624 uint8_t data
[SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE
] = { 0 };
625 DATA_BLOB blob
= { .data
= data
, .length
= sizeof(data
), };
626 enum ndr_err_code ndr_err
;
630 if (!(op
->flags
& SMBXSRV_OPEN_NEED_REPLAY_CACHE
)) {
634 if (op
->flags
& SMBXSRV_OPEN_HAVE_REPLAY_CACHE
) {
638 create_guid
= &op
->global
->create_guid
;
639 guid_string
= GUID_buf_string(create_guid
, &buf
);
641 ndr_err
= ndr_push_struct_into_fixed_blob(&blob
, &rc
,
642 (ndr_push_flags_fn_t
)ndr_push_smbXsrv_open_replay_cache
);
643 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
644 status
= ndr_map_error2ntstatus(ndr_err
);
647 val
= make_tdb_data(blob
.data
, blob
.length
);
649 status
= dbwrap_store_bystring(db
, guid_string
, val
, TDB_REPLACE
);
651 if (NT_STATUS_IS_OK(status
)) {
652 op
->flags
|= SMBXSRV_OPEN_HAVE_REPLAY_CACHE
;
653 op
->flags
&= ~SMBXSRV_OPEN_NEED_REPLAY_CACHE
;
659 NTSTATUS
smbXsrv_open_purge_replay_cache(struct smbXsrv_client
*client
,
660 const struct GUID
*create_guid
)
662 struct GUID_txt_buf buf
;
664 struct db_context
*db
;
666 if (client
->open_table
== NULL
) {
670 db
= client
->open_table
->local
.replay_cache_db_ctx
;
672 guid_string
= GUID_buf_string(create_guid
, &buf
);
673 if (guid_string
== NULL
) {
674 return NT_STATUS_INVALID_PARAMETER
;
677 return dbwrap_purge_bystring(db
, guid_string
);
680 static NTSTATUS
smbXsrv_open_clear_replay_cache(struct smbXsrv_open
*op
)
682 struct GUID
*create_guid
;
683 struct GUID_txt_buf buf
;
685 struct db_context
*db
;
688 if (op
->table
== NULL
) {
692 db
= op
->table
->local
.replay_cache_db_ctx
;
694 if (!(op
->flags
& SMBXSRV_OPEN_HAVE_REPLAY_CACHE
)) {
698 create_guid
= &op
->global
->create_guid
;
699 if (GUID_all_zero(create_guid
)) {
703 guid_string
= GUID_buf_string(create_guid
, &buf
);
704 if (guid_string
== NULL
) {
705 return NT_STATUS_INVALID_PARAMETER
;
708 status
= dbwrap_purge_bystring(db
, guid_string
);
710 if (NT_STATUS_IS_OK(status
)) {
711 op
->flags
&= ~SMBXSRV_OPEN_HAVE_REPLAY_CACHE
;
717 struct smbXsrv_open_update_state
{
718 struct smbXsrv_open_global0
*global
;
722 static void smbXsrv_open_update_fn(
723 struct db_record
*rec
, TDB_DATA oldval
, void *private_data
)
725 struct smbXsrv_open_update_state
*state
= private_data
;
726 TDB_DATA key
= dbwrap_record_get_key(rec
);
728 state
->status
= smbXsrv_open_global_store(
729 rec
, key
, oldval
, state
->global
);
732 NTSTATUS
smbXsrv_open_update(struct smbXsrv_open
*op
)
734 struct smbXsrv_open_update_state state
= { .global
= op
->global
, };
735 struct smbXsrv_open_table
*table
= op
->table
;
736 struct smbXsrv_open_global_key_buf key_buf
;
737 TDB_DATA key
= smbXsrv_open_global_id_to_key(
738 op
->global
->open_global_id
, &key_buf
);
741 status
= dbwrap_do_locked(
742 table
->global
.db_ctx
, key
, smbXsrv_open_update_fn
, &state
);
743 if (!NT_STATUS_IS_OK(status
)) {
744 DBG_WARNING("global_id (0x%08x) dbwrap_do_locked failed: %s\n",
745 op
->global
->open_global_id
,
747 return NT_STATUS_INTERNAL_DB_ERROR
;
750 if (!NT_STATUS_IS_OK(state
.status
)) {
751 DBG_WARNING("global_id (0x%08x) smbXsrv_open_global_store "
753 op
->global
->open_global_id
,
754 nt_errstr(state
.status
));
758 status
= smbXsrv_open_set_replay_cache(op
);
759 if (!NT_STATUS_IS_OK(status
)) {
760 DBG_ERR("smbXsrv_open_set_replay_cache failed: %s\n",
765 if (CHECK_DEBUGLVL(10)) {
766 struct smbXsrv_openB open_blob
= {
767 .version
= SMBXSRV_VERSION_0
,
771 DEBUG(10,("smbXsrv_open_update: global_id (0x%08x) stored\n",
772 op
->global
->open_global_id
));
773 NDR_PRINT_DEBUG(smbXsrv_openB
, &open_blob
);
779 struct smbXsrv_open_close_state
{
780 struct smbXsrv_open
*op
;
784 static void smbXsrv_open_close_fn(
785 struct db_record
*rec
, TDB_DATA oldval
, void *private_data
)
787 struct smbXsrv_open_close_state
*state
= private_data
;
788 struct smbXsrv_open_global0
*global
= state
->op
->global
;
789 TDB_DATA key
= dbwrap_record_get_key(rec
);
791 if (global
->durable
) {
793 * Durable open -- we need to update the global part
794 * instead of deleting it
796 state
->status
= smbXsrv_open_global_store(
797 rec
, key
, oldval
, global
);
798 if (!NT_STATUS_IS_OK(state
->status
)) {
799 DBG_WARNING("failed to store global key '%s': %s\n",
801 nt_errstr(state
->status
));
805 if (CHECK_DEBUGLVL(10)) {
806 struct smbXsrv_openB open_blob
= {
807 .version
= SMBXSRV_VERSION_0
,
808 .info
.info0
= state
->op
,
811 DBG_DEBUG("(0x%08x) stored disconnect\n",
812 global
->open_global_id
);
813 NDR_PRINT_DEBUG(smbXsrv_openB
, &open_blob
);
818 state
->status
= dbwrap_record_delete(rec
);
819 if (!NT_STATUS_IS_OK(state
->status
)) {
820 DBG_WARNING("failed to delete global key '%s': %s\n",
822 nt_errstr(state
->status
));
826 NTSTATUS
smbXsrv_open_close(struct smbXsrv_open
*op
, NTTIME now
)
828 struct smbXsrv_open_close_state state
= { .op
= op
, };
829 struct smbXsrv_open_global0
*global
= op
->global
;
830 struct smbXsrv_open_table
*table
;
832 NTSTATUS error
= NT_STATUS_OK
;
833 struct smbXsrv_open_global_key_buf key_buf
;
834 TDB_DATA key
= smbXsrv_open_global_id_to_key(
835 global
->open_global_id
, &key_buf
);
838 error
= smbXsrv_open_clear_replay_cache(op
);
839 if (!NT_STATUS_IS_OK(error
)) {
840 DBG_ERR("smbXsrv_open_clear_replay_cache failed: %s\n",
844 if (op
->table
== NULL
) {
851 op
->status
= NT_STATUS_FILE_CLOSED
;
852 global
->disconnect_time
= now
;
853 server_id_set_disconnected(&global
->server_id
);
855 status
= dbwrap_do_locked(
856 table
->global
.db_ctx
, key
, smbXsrv_open_close_fn
, &state
);
857 if (!NT_STATUS_IS_OK(status
)) {
858 DBG_WARNING("dbwrap_do_locked() for %s failed: %s\n",
862 } else if (!NT_STATUS_IS_OK(state
.status
)) {
863 DBG_WARNING("smbXsrv_open_close_fn() for %s failed: %s\n",
865 nt_errstr(state
.status
));
866 error
= state
.status
;
869 ret
= idr_remove(table
->local
.idr
, op
->local_id
);
870 SMB_ASSERT(ret
== 0);
872 table
->local
.num_opens
-= 1;
875 op
->compat
->op
= NULL
;
876 file_free(NULL
, op
->compat
);
883 NTSTATUS
smb1srv_open_table_init(struct smbXsrv_connection
*conn
)
888 * Allow a range from 1..65534.
890 * With real_max_open_files possible ids,
891 * truncated to the SMB1 limit of 16-bit.
893 * 0 and 0xFFFF are no valid ids.
895 max_opens
= conn
->client
->sconn
->real_max_open_files
;
896 max_opens
= MIN(max_opens
, UINT16_MAX
- 1);
898 return smbXsrv_open_table_init(conn
, 1, UINT16_MAX
- 1, max_opens
);
901 NTSTATUS
smb1srv_open_lookup(struct smbXsrv_connection
*conn
,
902 uint16_t fnum
, NTTIME now
,
903 struct smbXsrv_open
**_open
)
905 struct smbXsrv_open_table
*table
= conn
->client
->open_table
;
906 uint32_t local_id
= fnum
;
907 uint32_t global_id
= 0;
909 return smbXsrv_open_local_lookup(table
, local_id
, global_id
, now
, _open
);
912 NTSTATUS
smb2srv_open_table_init(struct smbXsrv_connection
*conn
)
918 * Allow a range from 1..4294967294.
920 * With real_max_open_files possible ids,
921 * truncated to 16-bit (the same as SMB1 for now).
923 * 0 and 0xFFFFFFFF are no valid ids.
925 * The usage of conn->sconn->real_max_open_files
926 * is the reason that we use one open table per
927 * transport connection (as we still have a 1:1 mapping
928 * between process and transport connection).
930 max_opens
= conn
->client
->sconn
->real_max_open_files
;
931 max_opens
= MIN(max_opens
, UINT16_MAX
- 1);
934 * idtree uses "int" for local IDs. Limit the maximum ID to
935 * what "int" can hold.
937 highest_id
= UINT32_MAX
-1;
938 highest_id
= MIN(highest_id
, INT_MAX
);
940 return smbXsrv_open_table_init(conn
, 1, highest_id
, max_opens
);
943 NTSTATUS
smb2srv_open_lookup(struct smbXsrv_connection
*conn
,
944 uint64_t persistent_id
,
945 uint64_t volatile_id
,
947 struct smbXsrv_open
**_open
)
949 struct smbXsrv_open_table
*table
= conn
->client
->open_table
;
950 uint32_t local_id
= volatile_id
& UINT32_MAX
;
951 uint64_t local_zeros
= volatile_id
& 0xFFFFFFFF00000000LLU
;
952 uint32_t global_id
= persistent_id
& UINT32_MAX
;
953 uint64_t global_zeros
= persistent_id
& 0xFFFFFFFF00000000LLU
;
956 if (local_zeros
!= 0) {
957 return NT_STATUS_FILE_CLOSED
;
960 if (global_zeros
!= 0) {
961 return NT_STATUS_FILE_CLOSED
;
964 if (global_id
== 0) {
965 return NT_STATUS_FILE_CLOSED
;
968 status
= smbXsrv_open_local_lookup(table
, local_id
, global_id
, now
,
970 if (!NT_STATUS_IS_OK(status
)) {
975 * Clear the replay cache for this create_guid if it exists:
976 * This is based on the assumption that this lookup will be
977 * triggered by a client request using the file-id for lookup.
978 * Hence the client has proven that it has in fact seen the
979 * reply to its initial create call. So subsequent create replays
980 * should be treated as invalid. Hence the index for create_guid
981 * lookup needs to be removed.
983 status
= smbXsrv_open_clear_replay_cache(*_open
);
989 * This checks or marks the replay cache, we have the following
992 * 1. There is no record in the cache
993 * => we add the passes caller_req_guid as holder_req_guid
994 * together with local_id as 0.
995 * => We return STATUS_FWP_RESERVED in order to indicate
996 * that the caller holds the current reservation
998 * 2. There is a record in the cache and holder_req_guid
999 * is already the same as caller_req_guid and local_id is 0
1000 * => We return STATUS_FWP_RESERVED in order to indicate
1001 * that the caller holds the current reservation
1003 * 3. There is a record in the cache with a holder_req_guid
1004 * other than caller_req_guid (and local_id is 0):
1005 * => We return NT_STATUS_FILE_NOT_AVAILABLE to indicate
1006 * the original request is still pending
1008 * 4. There is a record in the cache with a zero holder_req_guid
1009 * and a valid local_id:
1010 * => We lookup the existing open by local_id
1011 * => We return NT_STATUS_OK together with the smbXsrv_open
1014 * With NT_STATUS_OK the caller can continue the replay processing.
1016 * With STATUS_FWP_RESERVED the caller should continue the normal
1019 * - smbXsrv_open_update()/smbXsrv_open_set_replay_cache()
1020 * will convert the record to a zero holder_req_guid
1021 * with a valid local_id.
1023 * - smbXsrv_open_purge_replay_cache() should cleanup
1026 * All other values should be returned to the client,
1027 * while NT_STATUS_FILE_NOT_AVAILABLE will trigger the
1028 * retry loop on the client.
1030 NTSTATUS
smb2srv_open_lookup_replay_cache(struct smbXsrv_connection
*conn
,
1031 struct GUID caller_req_guid
,
1032 struct GUID create_guid
,
1035 struct smbXsrv_open
**_open
)
1037 TALLOC_CTX
*frame
= talloc_stackframe();
1039 struct smbXsrv_open_table
*table
= conn
->client
->open_table
;
1040 struct db_context
*db
= table
->local
.replay_cache_db_ctx
;
1041 struct GUID_txt_buf tmp_guid_buf
;
1042 struct GUID_txt_buf _create_guid_buf
;
1043 const char *create_guid_str
= GUID_buf_string(&create_guid
, &_create_guid_buf
);
1044 TDB_DATA create_guid_key
= string_term_tdb_data(create_guid_str
);
1045 struct db_record
*db_rec
= NULL
;
1046 struct smbXsrv_open
*op
= NULL
;
1047 struct smbXsrv_open_replay_cache rc
= {
1048 .holder_req_guid
= caller_req_guid
,
1052 enum ndr_err_code ndr_err
;
1053 DATA_BLOB blob
= data_blob_null
;
1058 db_rec
= dbwrap_fetch_locked(db
, frame
, create_guid_key
);
1059 if (db_rec
== NULL
) {
1061 return NT_STATUS_INTERNAL_DB_ERROR
;
1064 val
= dbwrap_record_get_value(db_rec
);
1065 if (val
.dsize
== 0) {
1066 uint8_t data
[SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE
];
1068 blob
= data_blob_const(data
, ARRAY_SIZE(data
));
1069 ndr_err
= ndr_push_struct_into_fixed_blob(&blob
, &rc
,
1070 (ndr_push_flags_fn_t
)ndr_push_smbXsrv_open_replay_cache
);
1071 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1072 status
= ndr_map_error2ntstatus(ndr_err
);
1077 val
= make_tdb_data(blob
.data
, blob
.length
);
1078 status
= dbwrap_record_store(db_rec
, val
, TDB_REPLACE
);
1079 if (!NT_STATUS_IS_OK(status
)) {
1085 * We're the new holder
1089 return NT_STATUS_FWP_RESERVED
;
1092 if (val
.dsize
!= SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE
) {
1094 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
1097 blob
= data_blob_const(val
.dptr
, val
.dsize
);
1098 ndr_err
= ndr_pull_struct_blob_all_noalloc(&blob
, &rc
,
1099 (ndr_pull_flags_fn_t
)ndr_pull_smbXsrv_open_replay_cache
);
1100 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1101 status
= ndr_map_error2ntstatus(ndr_err
);
1105 if (rc
.local_id
!= 0) {
1106 if (GUID_equal(&rc
.holder_req_guid
, &caller_req_guid
)) {
1108 * This should not happen
1110 status
= NT_STATUS_INTERNAL_ERROR
;
1111 DBG_ERR("caller %s already holds local_id %u for create %s [%s] - %s\n",
1112 GUID_buf_string(&caller_req_guid
, &tmp_guid_buf
),
1113 (unsigned)rc
.local_id
,
1122 status
= smbXsrv_open_local_lookup(table
,
1127 if (!NT_STATUS_IS_OK(status
)) {
1128 DBG_ERR("holder %s stale for local_id %u for create %s [%s] - %s\n",
1129 GUID_buf_string(&rc
.holder_req_guid
, &tmp_guid_buf
),
1130 (unsigned)rc
.local_id
,
1140 * We found an open the caller can reuse.
1142 SMB_ASSERT(op
!= NULL
);
1145 return NT_STATUS_OK
;
1148 if (GUID_equal(&rc
.holder_req_guid
, &caller_req_guid
)) {
1150 * We're still the holder
1154 return NT_STATUS_FWP_RESERVED
;
1158 * The original request (or a former replay) is still
1159 * pending, ask the client to retry by sending FILE_NOT_AVAILABLE.
1161 status
= NT_STATUS_FILE_NOT_AVAILABLE
;
1162 DBG_DEBUG("holder %s still pending for create %s [%s] - %s\n",
1163 GUID_buf_string(&rc
.holder_req_guid
, &tmp_guid_buf
),
1171 struct smb2srv_open_recreate_state
{
1172 struct smbXsrv_open
*op
;
1173 const struct GUID
*create_guid
;
1174 struct security_token
*current_token
;
1175 struct server_id me
;
1180 static void smb2srv_open_recreate_fn(
1181 struct db_record
*rec
, TDB_DATA oldval
, void *private_data
)
1183 struct smb2srv_open_recreate_state
*state
= private_data
;
1184 TDB_DATA key
= dbwrap_record_get_key(rec
);
1185 struct smbXsrv_open_global0
*global
= NULL
;
1187 state
->status
= smbXsrv_open_global_verify_record(
1188 key
, oldval
, state
->op
, &state
->op
->global
);
1189 if (!NT_STATUS_IS_OK(state
->status
)) {
1190 DBG_WARNING("smbXsrv_open_global_verify_record for %s "
1193 nt_errstr(state
->status
));
1196 global
= state
->op
->global
;
1199 * If the provided create_guid is NULL, this means that
1200 * the reconnect request was a v1 request. In that case
1201 * we should skip the create GUID verification, since
1202 * it is valid to v1-reconnect a v2-opened handle.
1204 if ((state
->create_guid
!= NULL
) &&
1205 !GUID_equal(&global
->create_guid
, state
->create_guid
)) {
1206 struct GUID_txt_buf buf1
, buf2
;
1207 DBG_NOTICE("%s != %s in %s\n",
1208 GUID_buf_string(&global
->create_guid
, &buf1
),
1209 GUID_buf_string(state
->create_guid
, &buf2
),
1214 if (!security_token_is_sid(
1215 state
->current_token
, &global
->open_owner
)) {
1216 struct dom_sid_buf buf
;
1217 DBG_NOTICE("global owner %s not in our token in %s\n",
1218 dom_sid_str_buf(&global
->open_owner
, &buf
),
1223 if (!global
->durable
) {
1224 DBG_NOTICE("%"PRIu64
"/%"PRIu64
" not durable in %s\n",
1225 global
->open_persistent_id
,
1226 global
->open_volatile_id
,
1231 global
->open_volatile_id
= state
->op
->local_id
;
1232 global
->server_id
= state
->me
;
1234 state
->status
= smbXsrv_open_global_store(rec
, key
, oldval
, global
);
1235 if (!NT_STATUS_IS_OK(state
->status
)) {
1236 DBG_WARNING("smbXsrv_open_global_store for %s failed: %s\n",
1238 nt_errstr(state
->status
));
1244 state
->status
= NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1247 NTSTATUS
smb2srv_open_recreate(struct smbXsrv_connection
*conn
,
1248 struct auth_session_info
*session_info
,
1249 uint64_t persistent_id
,
1250 const struct GUID
*create_guid
,
1252 struct smbXsrv_open
**_open
)
1254 struct smbXsrv_open_table
*table
= conn
->client
->open_table
;
1255 struct smb2srv_open_recreate_state state
= {
1256 .create_guid
= create_guid
,
1257 .me
= messaging_server_id(conn
->client
->msg_ctx
),
1259 struct smbXsrv_open_global_key_buf key_buf
;
1260 TDB_DATA key
= smbXsrv_open_global_id_to_key(
1261 persistent_id
& UINT32_MAX
, &key_buf
);
1265 if (session_info
== NULL
) {
1266 DEBUG(10, ("session_info=NULL\n"));
1267 return NT_STATUS_INVALID_HANDLE
;
1269 state
.current_token
= session_info
->security_token
;
1271 if (state
.current_token
== NULL
) {
1272 DEBUG(10, ("current_token=NULL\n"));
1273 return NT_STATUS_INVALID_HANDLE
;
1276 if ((persistent_id
& 0xFFFFFFFF00000000LLU
) != 0) {
1278 * We only use 32 bit for the persistent ID
1280 DBG_DEBUG("persistent_id=%"PRIx64
"\n", persistent_id
);
1281 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1284 if (table
->local
.num_opens
>= table
->local
.max_opens
) {
1285 return NT_STATUS_INSUFFICIENT_RESOURCES
;
1288 state
.op
= talloc_zero(table
, struct smbXsrv_open
);
1289 if (state
.op
== NULL
) {
1290 return NT_STATUS_NO_MEMORY
;
1292 state
.op
->table
= table
;
1294 local_id
= idr_get_new_random(
1297 table
->local
.lowest_id
,
1298 table
->local
.highest_id
);
1299 if (local_id
== -1) {
1300 TALLOC_FREE(state
.op
);
1301 return NT_STATUS_INSUFFICIENT_RESOURCES
;
1303 state
.op
->local_id
= local_id
;
1304 SMB_ASSERT(state
.op
->local_id
== local_id
); /* No coercion loss */
1306 table
->local
.num_opens
+= 1;
1308 state
.op
->idle_time
= now
;
1309 state
.op
->status
= NT_STATUS_FILE_CLOSED
;
1311 status
= dbwrap_do_locked(
1312 table
->global
.db_ctx
, key
, smb2srv_open_recreate_fn
, &state
);
1313 if (!NT_STATUS_IS_OK(status
)) {
1314 DBG_DEBUG("dbwrap_do_locked() for %s failed: %s\n",
1320 if (!NT_STATUS_IS_OK(state
.status
)) {
1321 status
= state
.status
;
1322 DBG_DEBUG("smb2srv_open_recreate_fn for %s failed: %s\n",
1328 talloc_set_destructor(state
.op
, smbXsrv_open_destructor
);
1330 if (CHECK_DEBUGLVL(10)) {
1331 struct smbXsrv_openB open_blob
= {
1332 .info
.info0
= state
.op
,
1334 DBG_DEBUG("global_id (0x%08x) stored\n",
1335 state
.op
->global
->open_global_id
);
1336 NDR_PRINT_DEBUG(smbXsrv_openB
, &open_blob
);
1341 return NT_STATUS_OK
;
1343 table
->local
.num_opens
-= 1;
1345 ret
= idr_remove(table
->local
.idr
, state
.op
->local_id
);
1346 SMB_ASSERT(ret
== 0);
1347 TALLOC_FREE(state
.op
);
1351 struct smbXsrv_open_global_traverse_state
{
1352 int (*fn
)(struct db_record
*rec
, struct smbXsrv_open_global0
*, void *);
1356 static int smbXsrv_open_global_traverse_fn(struct db_record
*rec
, void *data
)
1358 struct smbXsrv_open_global_traverse_state
*state
=
1359 (struct smbXsrv_open_global_traverse_state
*)data
;
1360 struct smbXsrv_open_global0
*global
= NULL
;
1361 TDB_DATA key
= dbwrap_record_get_key(rec
);
1362 TDB_DATA val
= dbwrap_record_get_value(rec
);
1366 status
= smbXsrv_open_global_parse_record(
1367 talloc_tos(), key
, val
, &global
);
1368 if (!NT_STATUS_IS_OK(status
)) {
1372 ret
= state
->fn(rec
, global
, state
->private_data
);
1373 talloc_free(global
);
1377 NTSTATUS
smbXsrv_open_global_traverse(
1378 int (*fn
)(struct db_record
*rec
, struct smbXsrv_open_global0
*, void *),
1384 struct smbXsrv_open_global_traverse_state state
= {
1386 .private_data
= private_data
,
1390 status
= smbXsrv_open_global_init();
1391 if (!NT_STATUS_IS_OK(status
)) {
1393 DEBUG(0, ("Failed to initialize open_global: %s\n",
1394 nt_errstr(status
)));
1398 status
= dbwrap_traverse_read(smbXsrv_open_global_db_ctx
,
1399 smbXsrv_open_global_traverse_fn
,
1407 struct smbXsrv_open_cleanup_state
{
1412 static void smbXsrv_open_cleanup_fn(
1413 struct db_record
*rec
, TDB_DATA oldval
, void *private_data
)
1415 struct smbXsrv_open_cleanup_state
*state
= private_data
;
1416 struct smbXsrv_open_global0
*global
= NULL
;
1417 TDB_DATA key
= dbwrap_record_get_key(rec
);
1418 bool delete_open
= false;
1420 if (oldval
.dsize
== 0) {
1421 DBG_DEBUG("[global: 0x%08x] "
1422 "empty record in %s, skipping...\n",
1424 dbwrap_name(dbwrap_record_get_db(rec
)));
1425 state
->status
= NT_STATUS_OK
;
1429 state
->status
= smbXsrv_open_global_parse_record(
1430 talloc_tos(), key
, oldval
, &global
);
1431 if (!NT_STATUS_IS_OK(state
->status
)) {
1432 DBG_WARNING("[global: %x08x] "
1433 "smbXsrv_open_global_parse_record() in %s "
1434 "failed: %s, deleting record\n",
1436 dbwrap_name(dbwrap_record_get_db(rec
)),
1437 nt_errstr(state
->status
));
1442 if (server_id_is_disconnected(&global
->server_id
)) {
1443 struct timeval now
= timeval_current();
1444 struct timeval disconnect_time
;
1445 struct timeval_buf buf
;
1448 nttime_to_timeval(&disconnect_time
, global
->disconnect_time
);
1449 tdiff
= usec_time_diff(&now
, &disconnect_time
);
1450 delete_open
= (tdiff
>= 1000*global
->durable_timeout_msec
);
1452 DBG_DEBUG("[global: 0x%08x] "
1453 "disconnected at [%s] %"PRIi64
"s ago with "
1454 "timeout of %"PRIu32
"s -%s reached\n",
1456 timeval_str_buf(&disconnect_time
,
1461 global
->durable_timeout_msec
/ 1000,
1462 delete_open
? "" : " not");
1463 } else if (!serverid_exists(&global
->server_id
)) {
1464 struct server_id_buf idbuf
;
1465 DBG_DEBUG("[global: 0x%08x] "
1466 "server[%s] does not exist\n",
1468 server_id_str_buf(global
->server_id
, &idbuf
));
1473 state
->status
= NT_STATUS_OK
;
1477 state
->status
= dbwrap_record_delete(rec
);
1478 if (!NT_STATUS_IS_OK(state
->status
)) {
1479 DBG_WARNING("[global: 0x%08x] "
1480 "failed to delete record "
1483 dbwrap_name(dbwrap_record_get_db(rec
)),
1484 nt_errstr(state
->status
));
1488 DBG_DEBUG("[global: 0x%08x] "
1489 "deleted record from %s\n",
1491 dbwrap_name(dbwrap_record_get_db(rec
)));
1494 NTSTATUS
smbXsrv_open_cleanup(uint64_t persistent_id
)
1496 struct smbXsrv_open_cleanup_state state
= {
1497 .global_id
= persistent_id
& UINT32_MAX
,
1499 struct smbXsrv_open_global_key_buf key_buf
;
1500 TDB_DATA key
= smbXsrv_open_global_id_to_key(
1501 state
.global_id
, &key_buf
);
1504 status
= dbwrap_do_locked(
1505 smbXsrv_open_global_db_ctx
,
1507 smbXsrv_open_cleanup_fn
,
1509 if (!NT_STATUS_IS_OK(status
)) {
1510 DBG_DEBUG("[global: 0x%08x] dbwrap_do_locked failed: %s\n",
1516 return state
.status
;