?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
negoex.idl: use DATA_BLOB for negoex_BYTE_VECTOR
[Samba.git] / source3 / smbd / smbXsrv_session.c
blob9f8520a2725a27a9ade54e5ddcedab6d3d195c1a
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2011-2012
5 Copyright (C) Michael Adam 2012
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "system/filesys.h"
23 #include <tevent.h>
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "dbwrap/dbwrap.h"
27 #include "dbwrap/dbwrap_rbt.h"
28 #include "dbwrap/dbwrap_open.h"
29 #include "dbwrap/dbwrap_watch.h"
30 #include "session.h"
31 #include "auth.h"
32 #include "auth/gensec/gensec.h"
33 #include "../lib/tsocket/tsocket.h"
34 #include "../libcli/security/security.h"
35 #include "messages.h"
36 #include "lib/util/util_tdb.h"
37 #include "librpc/gen_ndr/ndr_smbXsrv.h"
38 #include "serverid.h"
39 #include "lib/util/tevent_ntstatus.h"
40
41 struct smbXsrv_session_table {
42 struct {
43 struct db_context *db_ctx;
44 uint32_t lowest_id;
45 uint32_t highest_id;
46 uint32_t max_sessions;
47 uint32_t num_sessions;
48 } local;
49 struct {
50 struct db_context *db_ctx;
51 } global;
52 };
53
54 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
55
56 NTSTATUS smbXsrv_session_global_init(void)
57 {
58 char *global_path = NULL;
59 struct db_context *db_ctx = NULL;
60
61 if (smbXsrv_session_global_db_ctx != NULL) {
62 return NT_STATUS_OK;
63 }
64
65 /*
66 * This contains secret information like session keys!
67 */
68 global_path = lock_path("smbXsrv_session_global.tdb");
69 if (global_path == NULL) {
70 return NT_STATUS_NO_MEMORY;
71 }
72
73 db_ctx = db_open(NULL, global_path,
74 0, /* hash_size */
75 TDB_DEFAULT |
76 TDB_CLEAR_IF_FIRST |
77 TDB_INCOMPATIBLE_HASH,
78 O_RDWR | O_CREAT, 0600,
79 DBWRAP_LOCK_ORDER_1,
80 DBWRAP_FLAG_NONE);
81 TALLOC_FREE(global_path);
82 if (db_ctx == NULL) {
83 NTSTATUS status;
84
85 status = map_nt_error_from_unix_common(errno);
86
87 return status;
88 }
89
90 smbXsrv_session_global_db_ctx = db_ctx;
91
92 return NT_STATUS_OK;
93 }
94
95 /*
96 * NOTE:
97 * We need to store the keys in big endian so that dbwrap_rbt's memcmp
98 * has the same result as integer comparison between the uint32_t
99 * values.
100 *
101 * TODO: implement string based key
102 */
103
104 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
105
106 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
107 uint8_t *key_buf)
108 {
109 TDB_DATA key;
110
111 RSIVAL(key_buf, 0, id);
112
113 key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
114
115 return key;
116 }
117
118 #if 0
119 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
120 {
121 if (id == NULL) {
122 return NT_STATUS_INVALID_PARAMETER;
123 }
124
125 if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
126 return NT_STATUS_INTERNAL_DB_CORRUPTION;
127 }
128
129 *id = RIVAL(key.dptr, 0);
130
131 return NT_STATUS_OK;
132 }
133 #endif
134
135 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
136
137 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
138 uint8_t *key_buf)
139 {
140 TDB_DATA key;
141
142 RSIVAL(key_buf, 0, id);
143
144 key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
145
146 return key;
147 }
148
149 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
150 {
151 if (id == NULL) {
152 return NT_STATUS_INVALID_PARAMETER;
153 }
154
155 if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
156 return NT_STATUS_INTERNAL_DB_CORRUPTION;
157 }
158
159 *id = RIVAL(key.dptr, 0);
160
161 return NT_STATUS_OK;
162 }
163
164 static void smbXsrv_session_close_loop(struct tevent_req *subreq);
165
166 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
167 uint32_t lowest_id,
168 uint32_t highest_id,
169 uint32_t max_sessions)
170 {
171 struct smbXsrv_client *client = conn->client;
172 struct smbXsrv_session_table *table;
173 NTSTATUS status;
174 struct tevent_req *subreq;
175 uint64_t max_range;
176
177 if (lowest_id > highest_id) {
178 return NT_STATUS_INTERNAL_ERROR;
179 }
180
181 max_range = highest_id;
182 max_range -= lowest_id;
183 max_range += 1;
184
185 if (max_sessions > max_range) {
186 return NT_STATUS_INTERNAL_ERROR;
187 }
188
189 table = talloc_zero(client, struct smbXsrv_session_table);
190 if (table == NULL) {
191 return NT_STATUS_NO_MEMORY;
192 }
193
194 table->local.db_ctx = db_open_rbt(table);
195 if (table->local.db_ctx == NULL) {
196 TALLOC_FREE(table);
197 return NT_STATUS_NO_MEMORY;
198 }
199 table->local.lowest_id = lowest_id;
200 table->local.highest_id = highest_id;
201 table->local.max_sessions = max_sessions;
202
203 status = smbXsrv_session_global_init();
204 if (!NT_STATUS_IS_OK(status)) {
205 TALLOC_FREE(table);
206 return status;
207 }
208
209 table->global.db_ctx = smbXsrv_session_global_db_ctx;
210
211 dbwrap_watch_db(table->global.db_ctx, client->msg_ctx);
212
213 subreq = messaging_read_send(table, client->ev_ctx, client->msg_ctx,
214 MSG_SMBXSRV_SESSION_CLOSE);
215 if (subreq == NULL) {
216 TALLOC_FREE(table);
217 return NT_STATUS_NO_MEMORY;
218 }
219 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
220
221 client->session_table = table;
222 return NT_STATUS_OK;
223 }
224
225 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
226
227 static void smbXsrv_session_close_loop(struct tevent_req *subreq)
228 {
229 struct smbXsrv_client *client =
230 tevent_req_callback_data(subreq,
231 struct smbXsrv_client);
232 struct smbXsrv_session_table *table = client->session_table;
233 int ret;
234 struct messaging_rec *rec = NULL;
235 struct smbXsrv_session_closeB close_blob;
236 enum ndr_err_code ndr_err;
237 struct smbXsrv_session_close0 *close_info0 = NULL;
238 struct smbXsrv_session *session = NULL;
239 NTSTATUS status;
240 struct timeval tv = timeval_current();
241 NTTIME now = timeval_to_nttime(&tv);
242
243 ret = messaging_read_recv(subreq, talloc_tos(), &rec);
244 TALLOC_FREE(subreq);
245 if (ret != 0) {
246 goto next;
247 }
248
249 ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
250 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
251 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
252 status = ndr_map_error2ntstatus(ndr_err);
253 DEBUG(1,("smbXsrv_session_close_loop: "
254 "ndr_pull_struct_blob - %s\n",
255 nt_errstr(status)));
256 goto next;
257 }
258
259 DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
260 if (DEBUGLVL(10)) {
261 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
262 }
263
264 if (close_blob.version != SMBXSRV_VERSION_0) {
265 DEBUG(0,("smbXsrv_session_close_loop: "
266 "ignore invalid version %u\n", close_blob.version));
267 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
268 goto next;
269 }
270
271 close_info0 = close_blob.info.info0;
272 if (close_info0 == NULL) {
273 DEBUG(0,("smbXsrv_session_close_loop: "
274 "ignore NULL info %u\n", close_blob.version));
275 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
276 goto next;
277 }
278
279 status = smb2srv_session_lookup_client(client,
280 close_info0->old_session_wire_id,
281 now, &session);
282 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
283 DEBUG(4,("smbXsrv_session_close_loop: "
284 "old_session_wire_id %llu not found\n",
285 (unsigned long long)close_info0->old_session_wire_id));
286 if (DEBUGLVL(4)) {
287 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
288 }
289 goto next;
290 }
291 if (!NT_STATUS_IS_OK(status) &&
292 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
293 !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
294 DEBUG(1,("smbXsrv_session_close_loop: "
295 "old_session_wire_id %llu - %s\n",
296 (unsigned long long)close_info0->old_session_wire_id,
297 nt_errstr(status)));
298 if (DEBUGLVL(1)) {
299 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
300 }
301 goto next;
302 }
303
304 if (session->global->session_global_id != close_info0->old_session_global_id) {
305 DEBUG(1,("smbXsrv_session_close_loop: "
306 "old_session_wire_id %llu - global %u != %u\n",
307 (unsigned long long)close_info0->old_session_wire_id,
308 session->global->session_global_id,
309 close_info0->old_session_global_id));
310 if (DEBUGLVL(1)) {
311 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
312 }
313 goto next;
314 }
315
316 if (session->global->creation_time != close_info0->old_creation_time) {
317 DEBUG(1,("smbXsrv_session_close_loop: "
318 "old_session_wire_id %llu - "
319 "creation %s (%llu) != %s (%llu)\n",
320 (unsigned long long)close_info0->old_session_wire_id,
321 nt_time_string(rec, session->global->creation_time),
322 (unsigned long long)session->global->creation_time,
323 nt_time_string(rec, close_info0->old_creation_time),
324 (unsigned long long)close_info0->old_creation_time));
325 if (DEBUGLVL(1)) {
326 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
327 }
328 goto next;
329 }
330
331 subreq = smb2srv_session_shutdown_send(session, client->ev_ctx,
332 session, NULL);
333 if (subreq == NULL) {
334 status = NT_STATUS_NO_MEMORY;
335 DEBUG(0, ("smbXsrv_session_close_loop: "
336 "smb2srv_session_shutdown_send(%llu) failed: %s\n",
337 (unsigned long long)session->global->session_wire_id,
338 nt_errstr(status)));
339 if (DEBUGLVL(1)) {
340 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
341 }
342 goto next;
343 }
344 tevent_req_set_callback(subreq,
345 smbXsrv_session_close_shutdown_done,
346 session);
347
348 next:
349 TALLOC_FREE(rec);
350
351 subreq = messaging_read_send(table, client->ev_ctx, client->msg_ctx,
352 MSG_SMBXSRV_SESSION_CLOSE);
353 if (subreq == NULL) {
354 const char *r;
355 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
356 exit_server_cleanly(r);
357 return;
358 }
359 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
360 }
361
362 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
363 {
364 struct smbXsrv_session *session =
365 tevent_req_callback_data(subreq,
366 struct smbXsrv_session);
367 NTSTATUS status;
368
369 status = smb2srv_session_shutdown_recv(subreq);
370 TALLOC_FREE(subreq);
371 if (!NT_STATUS_IS_OK(status)) {
372 DEBUG(0, ("smbXsrv_session_close_loop: "
373 "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
374 (unsigned long long)session->global->session_wire_id,
375 nt_errstr(status)));
376 }
377
378 status = smbXsrv_session_logoff(session);
379 if (!NT_STATUS_IS_OK(status)) {
380 DEBUG(0, ("smbXsrv_session_close_loop: "
381 "smbXsrv_session_logoff(%llu) failed: %s\n",
382 (unsigned long long)session->global->session_wire_id,
383 nt_errstr(status)));
384 }
385
386 TALLOC_FREE(session);
387 }
388
389 struct smb1srv_session_local_allocate_state {
390 const uint32_t lowest_id;
391 const uint32_t highest_id;
392 uint32_t last_id;
393 uint32_t useable_id;
394 NTSTATUS status;
395 };
396
397 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
398 void *private_data)
399 {
400 struct smb1srv_session_local_allocate_state *state =
401 (struct smb1srv_session_local_allocate_state *)private_data;
402 TDB_DATA key = dbwrap_record_get_key(rec);
403 uint32_t id = 0;
404 NTSTATUS status;
405
406 status = smbXsrv_session_local_key_to_id(key, &id);
407 if (!NT_STATUS_IS_OK(status)) {
408 state->status = status;
409 return -1;
410 }
411
412 if (id <= state->last_id) {
413 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
414 return -1;
415 }
416 state->last_id = id;
417
418 if (id > state->useable_id) {
419 state->status = NT_STATUS_OK;
420 return -1;
421 }
422
423 if (state->useable_id == state->highest_id) {
424 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
425 return -1;
426 }
427
428 state->useable_id +=1;
429 return 0;
430 }
431
432 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
433 uint32_t lowest_id,
434 uint32_t highest_id,
435 TALLOC_CTX *mem_ctx,
436 struct db_record **_rec,
437 uint32_t *_id)
438 {
439 struct smb1srv_session_local_allocate_state state = {
440 .lowest_id = lowest_id,
441 .highest_id = highest_id,
442 .last_id = 0,
443 .useable_id = lowest_id,
444 .status = NT_STATUS_INTERNAL_ERROR,
445 };
446 uint32_t i;
447 uint32_t range;
448 NTSTATUS status;
449 int count = 0;
450
451 *_rec = NULL;
452 *_id = 0;
453
454 if (lowest_id > highest_id) {
455 return NT_STATUS_INSUFFICIENT_RESOURCES;
456 }
457
458 /*
459 * first we try randomly
460 */
461 range = (highest_id - lowest_id) + 1;
462
463 for (i = 0; i < (range / 2); i++) {
464 uint32_t id;
465 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
466 TDB_DATA key;
467 TDB_DATA val;
468 struct db_record *rec = NULL;
469
470 id = generate_random() % range;
471 id += lowest_id;
472
473 if (id < lowest_id) {
474 id = lowest_id;
475 }
476 if (id > highest_id) {
477 id = highest_id;
478 }
479
480 key = smbXsrv_session_local_id_to_key(id, key_buf);
481
482 rec = dbwrap_fetch_locked(db, mem_ctx, key);
483 if (rec == NULL) {
484 return NT_STATUS_INSUFFICIENT_RESOURCES;
485 }
486
487 val = dbwrap_record_get_value(rec);
488 if (val.dsize != 0) {
489 TALLOC_FREE(rec);
490 continue;
491 }
492
493 *_rec = rec;
494 *_id = id;
495 return NT_STATUS_OK;
496 }
497
498 /*
499 * if the range is almost full,
500 * we traverse the whole table
501 * (this relies on sorted behavior of dbwrap_rbt)
502 */
503 status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
504 &state, &count);
505 if (NT_STATUS_IS_OK(status)) {
506 if (NT_STATUS_IS_OK(state.status)) {
507 return NT_STATUS_INTERNAL_ERROR;
508 }
509
510 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
511 return state.status;
512 }
513
514 if (state.useable_id <= state.highest_id) {
515 state.status = NT_STATUS_OK;
516 } else {
517 return NT_STATUS_INSUFFICIENT_RESOURCES;
518 }
519 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
520 /*
521 * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
522 *
523 * If we get anything else it is an error, because it
524 * means we did not manage to find a free slot in
525 * the db.
526 */
527 return NT_STATUS_INSUFFICIENT_RESOURCES;
528 }
529
530 if (NT_STATUS_IS_OK(state.status)) {
531 uint32_t id;
532 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
533 TDB_DATA key;
534 TDB_DATA val;
535 struct db_record *rec = NULL;
536
537 id = state.useable_id;
538
539 key = smbXsrv_session_local_id_to_key(id, key_buf);
540
541 rec = dbwrap_fetch_locked(db, mem_ctx, key);
542 if (rec == NULL) {
543 return NT_STATUS_INSUFFICIENT_RESOURCES;
544 }
545
546 val = dbwrap_record_get_value(rec);
547 if (val.dsize != 0) {
548 TALLOC_FREE(rec);
549 return NT_STATUS_INTERNAL_DB_CORRUPTION;
550 }
551
552 *_rec = rec;
553 *_id = id;
554 return NT_STATUS_OK;
555 }
556
557 return state.status;
558 }
559
560 struct smbXsrv_session_local_fetch_state {
561 struct smbXsrv_session *session;
562 NTSTATUS status;
563 };
564
565 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
566 void *private_data)
567 {
568 struct smbXsrv_session_local_fetch_state *state =
569 (struct smbXsrv_session_local_fetch_state *)private_data;
570 void *ptr;
571
572 if (data.dsize != sizeof(ptr)) {
573 state->status = NT_STATUS_INTERNAL_DB_ERROR;
574 return;
575 }
576
577 memcpy(&ptr, data.dptr, data.dsize);
578 state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
579 state->status = NT_STATUS_OK;
580 }
581
582 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
583 /* conn: optional */
584 struct smbXsrv_connection *conn,
585 uint32_t session_local_id,
586 NTTIME now,
587 struct smbXsrv_session **_session)
588 {
589 struct smbXsrv_session_local_fetch_state state = {
590 .session = NULL,
591 .status = NT_STATUS_INTERNAL_ERROR,
592 };
593 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
594 TDB_DATA key;
595 NTSTATUS status;
596
597 *_session = NULL;
598
599 if (session_local_id == 0) {
600 return NT_STATUS_USER_SESSION_DELETED;
601 }
602
603 if (table == NULL) {
604 /* this might happen before the end of negprot */
605 return NT_STATUS_USER_SESSION_DELETED;
606 }
607
608 if (table->local.db_ctx == NULL) {
609 return NT_STATUS_INTERNAL_ERROR;
610 }
611
612 key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
613
614 status = dbwrap_parse_record(table->local.db_ctx, key,
615 smbXsrv_session_local_fetch_parser,
616 &state);
617 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
618 return NT_STATUS_USER_SESSION_DELETED;
619 } else if (!NT_STATUS_IS_OK(status)) {
620 return status;
621 }
622 if (!NT_STATUS_IS_OK(state.status)) {
623 return state.status;
624 }
625
626 if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
627 return NT_STATUS_USER_SESSION_DELETED;
628 }
629
630 /*
631 * If a connection is specified check if the session is
632 * valid on the channel.
633 */
634 if (conn != NULL) {
635 struct smbXsrv_channel_global0 *c = NULL;
636
637 status = smbXsrv_session_find_channel(state.session, conn, &c);
638 if (!NT_STATUS_IS_OK(status)) {
639 return status;
640 }
641 }
642
643 state.session->idle_time = now;
644
645 if (!NT_STATUS_IS_OK(state.session->status)) {
646 *_session = state.session;
647 return state.session->status;
648 }
649
650 if (now > state.session->global->expiration_time) {
651 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
652 }
653
654 *_session = state.session;
655 return state.session->status;
656 }
657
658 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
659 {
660 return 0;
661 }
662
663 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
664 bool *is_free,
665 bool *was_free,
666 TALLOC_CTX *mem_ctx,
667 struct smbXsrv_session_global0 **_g);
668
669 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
670 TALLOC_CTX *mem_ctx,
671 struct smbXsrv_session_global0 **_global)
672 {
673 uint32_t i;
674 struct smbXsrv_session_global0 *global = NULL;
675 uint32_t last_free = 0;
676 const uint32_t min_tries = 3;
677
678 *_global = NULL;
679
680 global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
681 if (global == NULL) {
682 return NT_STATUS_NO_MEMORY;
683 }
684 talloc_set_destructor(global, smbXsrv_session_global_destructor);
685
686 /*
687 * Here we just randomly try the whole 32-bit space
688 *
689 * We use just 32-bit, because we want to reuse the
690 * ID for SRVSVC.
691 */
692 for (i = 0; i < UINT32_MAX; i++) {
693 bool is_free = false;
694 bool was_free = false;
695 uint32_t id;
696 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
697 TDB_DATA key;
698
699 if (i >= min_tries && last_free != 0) {
700 id = last_free;
701 } else {
702 id = generate_random();
703 }
704 if (id == 0) {
705 id++;
706 }
707 if (id == UINT32_MAX) {
708 id--;
709 }
710
711 key = smbXsrv_session_global_id_to_key(id, key_buf);
712
713 global->db_rec = dbwrap_fetch_locked(db, mem_ctx, key);
714 if (global->db_rec == NULL) {
715 talloc_free(global);
716 return NT_STATUS_INSUFFICIENT_RESOURCES;
717 }
718
719 smbXsrv_session_global_verify_record(global->db_rec,
720 &is_free,
721 &was_free,
722 NULL, NULL);
723
724 if (!is_free) {
725 TALLOC_FREE(global->db_rec);
726 continue;
727 }
728
729 if (!was_free && i < min_tries) {
730 /*
731 * The session_id is free now,
732 * but was not free before.
733 *
734 * This happens if a smbd crashed
735 * and did not cleanup the record.
736 *
737 * If this is one of our first tries,
738 * then we try to find a real free one.
739 */
740 if (last_free == 0) {
741 last_free = id;
742 }
743 TALLOC_FREE(global->db_rec);
744 continue;
745 }
746
747 global->session_global_id = id;
748
749 *_global = global;
750 return NT_STATUS_OK;
751 }
752
753 /* should not be reached */
754 talloc_free(global);
755 return NT_STATUS_INTERNAL_ERROR;
756 }
757
758 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
759 bool *is_free,
760 bool *was_free,
761 TALLOC_CTX *mem_ctx,
762 struct smbXsrv_session_global0 **_g)
763 {
764 TDB_DATA key;
765 TDB_DATA val;
766 DATA_BLOB blob;
767 struct smbXsrv_session_globalB global_blob;
768 enum ndr_err_code ndr_err;
769 struct smbXsrv_session_global0 *global = NULL;
770 bool exists;
771 TALLOC_CTX *frame = talloc_stackframe();
772
773 *is_free = false;
774
775 if (was_free) {
776 *was_free = false;
777 }
778 if (_g) {
779 *_g = NULL;
780 }
781
782 key = dbwrap_record_get_key(db_rec);
783
784 val = dbwrap_record_get_value(db_rec);
785 if (val.dsize == 0) {
786 TALLOC_FREE(frame);
787 *is_free = true;
788 if (was_free) {
789 *was_free = true;
790 }
791 return;
792 }
793
794 blob = data_blob_const(val.dptr, val.dsize);
795
796 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
797 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
798 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
799 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
800 DEBUG(1,("smbXsrv_session_global_verify_record: "
801 "key '%s' ndr_pull_struct_blob - %s\n",
802 hex_encode_talloc(frame, key.dptr, key.dsize),
803 nt_errstr(status)));
804 TALLOC_FREE(frame);
805 return;
806 }
807
808 DEBUG(10,("smbXsrv_session_global_verify_record\n"));
809 if (DEBUGLVL(10)) {
810 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
811 }
812
813 if (global_blob.version != SMBXSRV_VERSION_0) {
814 DEBUG(0,("smbXsrv_session_global_verify_record: "
815 "key '%s' use unsupported version %u\n",
816 hex_encode_talloc(frame, key.dptr, key.dsize),
817 global_blob.version));
818 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
819 TALLOC_FREE(frame);
820 return;
821 }
822
823 global = global_blob.info.info0;
824
825 exists = serverid_exists(&global->channels[0].server_id);
826 if (!exists) {
827 struct server_id_buf idbuf;
828 DEBUG(2,("smbXsrv_session_global_verify_record: "
829 "key '%s' server_id %s does not exist.\n",
830 hex_encode_talloc(frame, key.dptr, key.dsize),
831 server_id_str_buf(global->channels[0].server_id,
832 &idbuf)));
833 if (DEBUGLVL(2)) {
834 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
835 }
836 TALLOC_FREE(frame);
837 dbwrap_record_delete(db_rec);
838 *is_free = true;
839 return;
840 }
841
842 if (_g) {
843 *_g = talloc_move(mem_ctx, &global);
844 }
845 TALLOC_FREE(frame);
846 }
847
848 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
849 {
850 struct smbXsrv_session_globalB global_blob;
851 DATA_BLOB blob = data_blob_null;
852 TDB_DATA key;
853 TDB_DATA val;
854 NTSTATUS status;
855 enum ndr_err_code ndr_err;
856
857 /*
858 * TODO: if we use other versions than '0'
859 * we would add glue code here, that would be able to
860 * store the information in the old format.
861 */
862
863 if (global->db_rec == NULL) {
864 return NT_STATUS_INTERNAL_ERROR;
865 }
866
867 key = dbwrap_record_get_key(global->db_rec);
868 val = dbwrap_record_get_value(global->db_rec);
869
870 ZERO_STRUCT(global_blob);
871 global_blob.version = smbXsrv_version_global_current();
872 if (val.dsize >= 8) {
873 global_blob.seqnum = IVAL(val.dptr, 4);
874 }
875 global_blob.seqnum += 1;
876 global_blob.info.info0 = global;
877
878 ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
879 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
880 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
881 status = ndr_map_error2ntstatus(ndr_err);
882 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
883 hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
884 nt_errstr(status)));
885 TALLOC_FREE(global->db_rec);
886 return status;
887 }
888
889 val = make_tdb_data(blob.data, blob.length);
890 status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
891 if (!NT_STATUS_IS_OK(status)) {
892 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
893 hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
894 nt_errstr(status)));
895 TALLOC_FREE(global->db_rec);
896 return status;
897 }
898
899 if (DEBUGLVL(10)) {
900 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
901 hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
902 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
903 }
904
905 TALLOC_FREE(global->db_rec);
906
907 return NT_STATUS_OK;
908 }
909
910 struct smb2srv_session_close_previous_state {
911 struct tevent_context *ev;
912 struct smbXsrv_connection *connection;
913 struct dom_sid *current_sid;
914 uint64_t current_session_id;
915 struct db_record *db_rec;
916 };
917
918 static void smb2srv_session_close_previous_check(struct tevent_req *req);
919 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
920
921 struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
922 struct tevent_context *ev,
923 struct smbXsrv_connection *conn,
924 struct auth_session_info *session_info,
925 uint64_t previous_session_id,
926 uint64_t current_session_id)
927 {
928 struct tevent_req *req;
929 struct smb2srv_session_close_previous_state *state;
930 uint32_t global_id = previous_session_id & UINT32_MAX;
931 uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
932 struct smbXsrv_session_table *table = conn->client->session_table;
933 struct security_token *current_token = NULL;
934 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
935 TDB_DATA key;
936
937 req = tevent_req_create(mem_ctx, &state,
938 struct smb2srv_session_close_previous_state);
939 if (req == NULL) {
940 return NULL;
941 }
942 state->ev = ev;
943 state->connection = conn;
944 state->current_session_id = current_session_id;
945
946 if (global_zeros != 0) {
947 tevent_req_done(req);
948 return tevent_req_post(req, ev);
949 }
950
951 if (session_info == NULL) {
952 tevent_req_done(req);
953 return tevent_req_post(req, ev);
954 }
955 current_token = session_info->security_token;
956
957 if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
958 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
959 }
960
961 if (state->current_sid == NULL) {
962 tevent_req_done(req);
963 return tevent_req_post(req, ev);
964 }
965
966 if (!security_token_has_nt_authenticated_users(current_token)) {
967 /* TODO */
968 tevent_req_done(req);
969 return tevent_req_post(req, ev);
970 }
971
972 key = smbXsrv_session_global_id_to_key(global_id, key_buf);
973
974 state->db_rec = dbwrap_fetch_locked(table->global.db_ctx,
975 state, key);
976 if (state->db_rec == NULL) {
977 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
978 return tevent_req_post(req, ev);
979 }
980
981 smb2srv_session_close_previous_check(req);
982 if (!tevent_req_is_in_progress(req)) {
983 return tevent_req_post(req, ev);
984 }
985
986 return req;
987 }
988
989 static void smb2srv_session_close_previous_check(struct tevent_req *req)
990 {
991 struct smb2srv_session_close_previous_state *state =
992 tevent_req_data(req,
993 struct smb2srv_session_close_previous_state);
994 struct smbXsrv_connection *conn = state->connection;
995 DATA_BLOB blob;
996 struct security_token *previous_token = NULL;
997 struct smbXsrv_session_global0 *global = NULL;
998 enum ndr_err_code ndr_err;
999 struct smbXsrv_session_close0 close_info0;
1000 struct smbXsrv_session_closeB close_blob;
1001 struct tevent_req *subreq = NULL;
1002 NTSTATUS status;
1003 bool is_free = false;
1004
1005 smbXsrv_session_global_verify_record(state->db_rec,
1006 &is_free,
1007 NULL,
1008 state,
1009 &global);
1010
1011 if (is_free) {
1012 TALLOC_FREE(state->db_rec);
1013 tevent_req_done(req);
1014 return;
1015 }
1016
1017 if (global->auth_session_info == NULL) {
1018 TALLOC_FREE(state->db_rec);
1019 tevent_req_done(req);
1020 return;
1021 }
1022
1023 previous_token = global->auth_session_info->security_token;
1024
1025 if (!security_token_is_sid(previous_token, state->current_sid)) {
1026 TALLOC_FREE(state->db_rec);
1027 tevent_req_done(req);
1028 return;
1029 }
1030
1031 subreq = dbwrap_record_watch_send(state, state->ev,
1032 state->db_rec, conn->msg_ctx);
1033 if (tevent_req_nomem(subreq, req)) {
1034 TALLOC_FREE(state->db_rec);
1035 return;
1036 }
1037 tevent_req_set_callback(subreq,
1038 smb2srv_session_close_previous_modified,
1039 req);
1040
1041 close_info0.old_session_global_id = global->session_global_id;
1042 close_info0.old_session_wire_id = global->session_wire_id;
1043 close_info0.old_creation_time = global->creation_time;
1044 close_info0.new_session_wire_id = state->current_session_id;
1045
1046 ZERO_STRUCT(close_blob);
1047 close_blob.version = smbXsrv_version_global_current();
1048 close_blob.info.info0 = &close_info0;
1049
1050 ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1051 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1052 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1053 TALLOC_FREE(state->db_rec);
1054 status = ndr_map_error2ntstatus(ndr_err);
1055 DEBUG(1,("smb2srv_session_close_previous_check: "
1056 "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1057 (unsigned long long)close_info0.old_session_wire_id,
1058 (unsigned long long)close_info0.new_session_wire_id,
1059 nt_errstr(status)));
1060 tevent_req_nterror(req, status);
1061 return;
1062 }
1063
1064 status = messaging_send(conn->msg_ctx,
1065 global->channels[0].server_id,
1066 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1067 TALLOC_FREE(state->db_rec);
1068 if (tevent_req_nterror(req, status)) {
1069 return;
1070 }
1071
1072 TALLOC_FREE(global);
1073 return;
1074 }
1075
1076 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1077 {
1078 struct tevent_req *req =
1079 tevent_req_callback_data(subreq,
1080 struct tevent_req);
1081 struct smb2srv_session_close_previous_state *state =
1082 tevent_req_data(req,
1083 struct smb2srv_session_close_previous_state);
1084 NTSTATUS status;
1085
1086 status = dbwrap_record_watch_recv(subreq, state, &state->db_rec);
1087 TALLOC_FREE(subreq);
1088 if (tevent_req_nterror(req, status)) {
1089 return;
1090 }
1091
1092 smb2srv_session_close_previous_check(req);
1093 }
1094
1095 NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1096 {
1097 NTSTATUS status;
1098
1099 if (tevent_req_is_nterror(req, &status)) {
1100 tevent_req_received(req);
1101 return status;
1102 }
1103
1104 tevent_req_received(req);
1105 return NT_STATUS_OK;
1106 }
1107
1108 static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1109 {
1110 NTSTATUS status;
1111 struct smbXsrv_connection *xconn = NULL;
1112
1113 if (session->client != NULL) {
1114 xconn = session->client->connections;
1115 }
1116
1117 for (; xconn != NULL; xconn = xconn->next) {
1118 struct smbd_smb2_request *preq;
1119
1120 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1121 if (preq->session != session) {
1122 continue;
1123 }
1124
1125 preq->session = NULL;
1126 /*
1127 * If we no longer have a session we can't
1128 * sign or encrypt replies.
1129 */
1130 preq->do_signing = false;
1131 preq->do_encryption = false;
1132 preq->preauth = NULL;
1133 }
1134 }
1135
1136 status = smbXsrv_session_logoff(session);
1137 return status;
1138 }
1139
1140 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1141 {
1142 NTSTATUS status;
1143
1144 status = smbXsrv_session_clear_and_logoff(session);
1145 if (!NT_STATUS_IS_OK(status)) {
1146 DEBUG(0, ("smbXsrv_session_destructor: "
1147 "smbXsrv_session_logoff() failed: %s\n",
1148 nt_errstr(status)));
1149 }
1150
1151 TALLOC_FREE(session->global);
1152
1153 return 0;
1154 }
1155
1156 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1157 NTTIME now,
1158 struct smbXsrv_session **_session)
1159 {
1160 struct smbXsrv_session_table *table = conn->client->session_table;
1161 struct db_record *local_rec = NULL;
1162 struct smbXsrv_session *session = NULL;
1163 void *ptr = NULL;
1164 TDB_DATA val;
1165 struct smbXsrv_session_global0 *global = NULL;
1166 struct smbXsrv_channel_global0 *channel = NULL;
1167 NTSTATUS status;
1168
1169 if (table->local.num_sessions >= table->local.max_sessions) {
1170 return NT_STATUS_INSUFFICIENT_RESOURCES;
1171 }
1172
1173 session = talloc_zero(table, struct smbXsrv_session);
1174 if (session == NULL) {
1175 return NT_STATUS_NO_MEMORY;
1176 }
1177 session->table = table;
1178 session->idle_time = now;
1179 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1180 session->client = conn->client;
1181
1182 status = smbXsrv_session_global_allocate(table->global.db_ctx,
1183 session,
1184 &global);
1185 if (!NT_STATUS_IS_OK(status)) {
1186 TALLOC_FREE(session);
1187 return status;
1188 }
1189 session->global = global;
1190
1191 if (conn->protocol >= PROTOCOL_SMB2_02) {
1192 uint64_t id = global->session_global_id;
1193 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
1194 TDB_DATA key;
1195
1196 global->connection_dialect = conn->smb2.server.dialect;
1197
1198 global->session_wire_id = id;
1199
1200 status = smb2srv_tcon_table_init(session);
1201 if (!NT_STATUS_IS_OK(status)) {
1202 TALLOC_FREE(session);
1203 return status;
1204 }
1205
1206 session->local_id = global->session_global_id;
1207
1208 key = smbXsrv_session_local_id_to_key(session->local_id, key_buf);
1209
1210 local_rec = dbwrap_fetch_locked(table->local.db_ctx,
1211 session, key);
1212 if (local_rec == NULL) {
1213 TALLOC_FREE(session);
1214 return NT_STATUS_NO_MEMORY;
1215 }
1216
1217 val = dbwrap_record_get_value(local_rec);
1218 if (val.dsize != 0) {
1219 TALLOC_FREE(session);
1220 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1221 }
1222 } else {
1223
1224 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1225 table->local.lowest_id,
1226 table->local.highest_id,
1227 session,
1228 &local_rec,
1229 &session->local_id);
1230 if (!NT_STATUS_IS_OK(status)) {
1231 TALLOC_FREE(session);
1232 return status;
1233 }
1234
1235 global->session_wire_id = session->local_id;
1236 }
1237
1238 global->creation_time = now;
1239 global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1240
1241 status = smbXsrv_session_add_channel(session, conn, &channel);
1242 if (!NT_STATUS_IS_OK(status)) {
1243 TALLOC_FREE(session);
1244 return status;
1245 }
1246
1247 ptr = session;
1248 val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1249 status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1250 TALLOC_FREE(local_rec);
1251 if (!NT_STATUS_IS_OK(status)) {
1252 TALLOC_FREE(session);
1253 return status;
1254 }
1255 table->local.num_sessions += 1;
1256
1257 talloc_set_destructor(session, smbXsrv_session_destructor);
1258
1259 status = smbXsrv_session_global_store(global);
1260 if (!NT_STATUS_IS_OK(status)) {
1261 DEBUG(0,("smbXsrv_session_create: "
1262 "global_id (0x%08x) store failed - %s\n",
1263 session->global->session_global_id,
1264 nt_errstr(status)));
1265 TALLOC_FREE(session);
1266 return status;
1267 }
1268
1269 if (DEBUGLVL(10)) {
1270 struct smbXsrv_sessionB session_blob;
1271
1272 ZERO_STRUCT(session_blob);
1273 session_blob.version = SMBXSRV_VERSION_0;
1274 session_blob.info.info0 = session;
1275
1276 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1277 session->global->session_global_id));
1278 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1279 }
1280
1281 *_session = session;
1282 return NT_STATUS_OK;
1283 }
1284
1285 NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1286 struct smbXsrv_connection *conn,
1287 struct smbXsrv_channel_global0 **_c)
1288 {
1289 struct smbXsrv_session_global0 *global = session->global;
1290 struct smbXsrv_channel_global0 *c = NULL;
1291
1292 if (global->num_channels > 31) {
1293 /*
1294 * Windows 2012 and 2012R2 allow up to 32 channels
1295 */
1296 return NT_STATUS_INSUFFICIENT_RESOURCES;
1297 }
1298
1299 c = talloc_realloc(global,
1300 global->channels,
1301 struct smbXsrv_channel_global0,
1302 global->num_channels + 1);
1303 if (c == NULL) {
1304 return NT_STATUS_NO_MEMORY;
1305 }
1306 global->channels = c;
1307
1308 c = &global->channels[global->num_channels];
1309 ZERO_STRUCTP(c);
1310
1311 c->server_id = messaging_server_id(conn->msg_ctx);
1312 c->local_address = tsocket_address_string(conn->local_address,
1313 global->channels);
1314 if (c->local_address == NULL) {
1315 return NT_STATUS_NO_MEMORY;
1316 }
1317 c->remote_address = tsocket_address_string(conn->remote_address,
1318 global->channels);
1319 if (c->remote_address == NULL) {
1320 return NT_STATUS_NO_MEMORY;
1321 }
1322 c->remote_name = talloc_strdup(global->channels,
1323 conn->remote_hostname);
1324 if (c->remote_name == NULL) {
1325 return NT_STATUS_NO_MEMORY;
1326 }
1327 c->connection = conn;
1328
1329 global->num_channels += 1;
1330
1331 *_c = c;
1332 return NT_STATUS_OK;
1333 }
1334
1335 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1336 {
1337 struct smbXsrv_session_table *table = session->table;
1338 NTSTATUS status;
1339 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
1340 TDB_DATA key;
1341
1342 if (session->global->db_rec != NULL) {
1343 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1344 "Called with db_rec != NULL'\n",
1345 session->global->session_global_id));
1346 return NT_STATUS_INTERNAL_ERROR;
1347 }
1348
1349 key = smbXsrv_session_global_id_to_key(
1350 session->global->session_global_id,
1351 key_buf);
1352
1353 session->global->db_rec = dbwrap_fetch_locked(table->global.db_ctx,
1354 session->global, key);
1355 if (session->global->db_rec == NULL) {
1356 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1357 "Failed to lock global key '%s'\n",
1358 session->global->session_global_id,
1359 hex_encode_talloc(talloc_tos(), key.dptr,
1360 key.dsize)));
1361 return NT_STATUS_INTERNAL_DB_ERROR;
1362 }
1363
1364 status = smbXsrv_session_global_store(session->global);
1365 if (!NT_STATUS_IS_OK(status)) {
1366 DEBUG(0,("smbXsrv_session_update: "
1367 "global_id (0x%08x) store failed - %s\n",
1368 session->global->session_global_id,
1369 nt_errstr(status)));
1370 return status;
1371 }
1372
1373 if (DEBUGLVL(10)) {
1374 struct smbXsrv_sessionB session_blob;
1375
1376 ZERO_STRUCT(session_blob);
1377 session_blob.version = SMBXSRV_VERSION_0;
1378 session_blob.info.info0 = session;
1379
1380 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1381 session->global->session_global_id));
1382 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1383 }
1384
1385 return NT_STATUS_OK;
1386 }
1387
1388 NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1389 const struct smbXsrv_connection *conn,
1390 struct smbXsrv_channel_global0 **_c)
1391 {
1392 uint32_t i;
1393
1394 for (i=0; i < session->global->num_channels; i++) {
1395 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1396
1397 if (c->connection == conn) {
1398 *_c = c;
1399 return NT_STATUS_OK;
1400 }
1401 }
1402
1403 return NT_STATUS_USER_SESSION_DELETED;
1404 }
1405
1406 NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1407 const struct smbXsrv_connection *conn,
1408 NTTIME now,
1409 struct smbXsrv_session_auth0 **_a)
1410 {
1411 struct smbXsrv_session_auth0 *a;
1412
1413 for (a = session->pending_auth; a != NULL; a = a->next) {
1414 if (a->connection == conn) {
1415 if (now != 0) {
1416 a->idle_time = now;
1417 }
1418 *_a = a;
1419 return NT_STATUS_OK;
1420 }
1421 }
1422
1423 return NT_STATUS_USER_SESSION_DELETED;
1424 }
1425
1426 static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1427 {
1428 if (a->session == NULL) {
1429 return 0;
1430 }
1431
1432 DLIST_REMOVE(a->session->pending_auth, a);
1433 a->session = NULL;
1434 return 0;
1435 }
1436
1437 NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1438 struct smbXsrv_connection *conn,
1439 NTTIME now,
1440 uint8_t in_flags,
1441 uint8_t in_security_mode,
1442 struct smbXsrv_session_auth0 **_a)
1443 {
1444 struct smbXsrv_session_auth0 *a;
1445 NTSTATUS status;
1446
1447 status = smbXsrv_session_find_auth(session, conn, 0, &a);
1448 if (NT_STATUS_IS_OK(status)) {
1449 return NT_STATUS_INTERNAL_ERROR;
1450 }
1451
1452 a = talloc_zero(session, struct smbXsrv_session_auth0);
1453 if (a == NULL) {
1454 return NT_STATUS_NO_MEMORY;
1455 }
1456 a->session = session;
1457 a->connection = conn;
1458 a->in_flags = in_flags;
1459 a->in_security_mode = in_security_mode;
1460 a->creation_time = now;
1461 a->idle_time = now;
1462
1463 if (conn->protocol >= PROTOCOL_SMB3_10) {
1464 a->preauth = talloc(a, struct smbXsrv_preauth);
1465 if (a->preauth == NULL) {
1466 TALLOC_FREE(session);
1467 return NT_STATUS_NO_MEMORY;
1468 }
1469 *a->preauth = conn->smb2.preauth;
1470 }
1471
1472 talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1473 DLIST_ADD_END(session->pending_auth, a, NULL);
1474
1475 *_a = a;
1476 return NT_STATUS_OK;
1477 }
1478
1479 struct smb2srv_session_shutdown_state {
1480 struct tevent_queue *wait_queue;
1481 };
1482
1483 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1484
1485 struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1486 struct tevent_context *ev,
1487 struct smbXsrv_session *session,
1488 struct smbd_smb2_request *current_req)
1489 {
1490 struct tevent_req *req;
1491 struct smb2srv_session_shutdown_state *state;
1492 struct tevent_req *subreq;
1493 struct smbXsrv_connection *xconn = NULL;
1494 size_t len = 0;
1495
1496 /*
1497 * Make sure that no new request will be able to use this session.
1498 */
1499 session->status = NT_STATUS_USER_SESSION_DELETED;
1500
1501 req = tevent_req_create(mem_ctx, &state,
1502 struct smb2srv_session_shutdown_state);
1503 if (req == NULL) {
1504 return NULL;
1505 }
1506
1507 state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1508 if (tevent_req_nomem(state->wait_queue, req)) {
1509 return tevent_req_post(req, ev);
1510 }
1511
1512 for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1513 struct smbd_smb2_request *preq;
1514
1515 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1516 if (preq == current_req) {
1517 /* Can't cancel current request. */
1518 continue;
1519 }
1520 if (preq->session != session) {
1521 /* Request on different session. */
1522 continue;
1523 }
1524
1525 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1526 preq->session = NULL;
1527 /*
1528 * If we no longer have a session we can't
1529 * sign or encrypt replies.
1530 */
1531 preq->do_signing = false;
1532 preq->do_encryption = false;
1533 preq->preauth = NULL;
1534
1535 if (preq->subreq != NULL) {
1536 tevent_req_cancel(preq->subreq);
1537 }
1538 continue;
1539 }
1540
1541 /*
1542 * Never cancel anything in a compound
1543 * request. Way too hard to deal with
1544 * the result.
1545 */
1546 if (!preq->compound_related && preq->subreq != NULL) {
1547 tevent_req_cancel(preq->subreq);
1548 }
1549
1550 /*
1551 * Now wait until the request is finished.
1552 *
1553 * We don't set a callback, as we just want to block the
1554 * wait queue and the talloc_free() of the request will
1555 * remove the item from the wait queue.
1556 */
1557 subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1558 if (tevent_req_nomem(subreq, req)) {
1559 return tevent_req_post(req, ev);
1560 }
1561 }
1562 }
1563
1564 len = tevent_queue_length(state->wait_queue);
1565 if (len == 0) {
1566 tevent_req_done(req);
1567 return tevent_req_post(req, ev);
1568 }
1569
1570 /*
1571 * Now we add our own waiter to the end of the queue,
1572 * this way we get notified when all pending requests are finished
1573 * and send to the socket.
1574 */
1575 subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1576 if (tevent_req_nomem(subreq, req)) {
1577 return tevent_req_post(req, ev);
1578 }
1579 tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1580
1581 return req;
1582 }
1583
1584 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1585 {
1586 struct tevent_req *req =
1587 tevent_req_callback_data(subreq,
1588 struct tevent_req);
1589
1590 tevent_queue_wait_recv(subreq);
1591 TALLOC_FREE(subreq);
1592
1593 tevent_req_done(req);
1594 }
1595
1596 NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1597 {
1598 return tevent_req_simple_recv_ntstatus(req);
1599 }
1600
1601 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1602 {
1603 struct smbXsrv_session_table *table;
1604 struct db_record *local_rec = NULL;
1605 struct db_record *global_rec = NULL;
1606 struct smbd_server_connection *sconn = NULL;
1607 NTSTATUS status;
1608 NTSTATUS error = NT_STATUS_OK;
1609
1610 if (session->table == NULL) {
1611 return NT_STATUS_OK;
1612 }
1613
1614 table = session->table;
1615 session->table = NULL;
1616
1617 sconn = session->client->sconn;
1618 session->client = NULL;
1619 session->status = NT_STATUS_USER_SESSION_DELETED;
1620
1621 global_rec = session->global->db_rec;
1622 session->global->db_rec = NULL;
1623 if (global_rec == NULL) {
1624 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
1625 TDB_DATA key;
1626
1627 key = smbXsrv_session_global_id_to_key(
1628 session->global->session_global_id,
1629 key_buf);
1630
1631 global_rec = dbwrap_fetch_locked(table->global.db_ctx,
1632 session->global, key);
1633 if (global_rec == NULL) {
1634 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1635 "Failed to lock global key '%s'\n",
1636 session->global->session_global_id,
1637 hex_encode_talloc(global_rec, key.dptr,
1638 key.dsize)));
1639 error = NT_STATUS_INTERNAL_ERROR;
1640 }
1641 }
1642
1643 if (global_rec != NULL) {
1644 status = dbwrap_record_delete(global_rec);
1645 if (!NT_STATUS_IS_OK(status)) {
1646 TDB_DATA key = dbwrap_record_get_key(global_rec);
1647
1648 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1649 "failed to delete global key '%s': %s\n",
1650 session->global->session_global_id,
1651 hex_encode_talloc(global_rec, key.dptr,
1652 key.dsize),
1653 nt_errstr(status)));
1654 error = status;
1655 }
1656 }
1657 TALLOC_FREE(global_rec);
1658
1659 local_rec = session->db_rec;
1660 if (local_rec == NULL) {
1661 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
1662 TDB_DATA key;
1663
1664 key = smbXsrv_session_local_id_to_key(session->local_id,
1665 key_buf);
1666
1667 local_rec = dbwrap_fetch_locked(table->local.db_ctx,
1668 session, key);
1669 if (local_rec == NULL) {
1670 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1671 "Failed to lock local key '%s'\n",
1672 session->global->session_global_id,
1673 hex_encode_talloc(local_rec, key.dptr,
1674 key.dsize)));
1675 error = NT_STATUS_INTERNAL_ERROR;
1676 }
1677 }
1678
1679 if (local_rec != NULL) {
1680 status = dbwrap_record_delete(local_rec);
1681 if (!NT_STATUS_IS_OK(status)) {
1682 TDB_DATA key = dbwrap_record_get_key(local_rec);
1683
1684 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1685 "failed to delete local key '%s': %s\n",
1686 session->global->session_global_id,
1687 hex_encode_talloc(local_rec, key.dptr,
1688 key.dsize),
1689 nt_errstr(status)));
1690 error = status;
1691 }
1692 table->local.num_sessions -= 1;
1693 }
1694 if (session->db_rec == NULL) {
1695 TALLOC_FREE(local_rec);
1696 }
1697 session->db_rec = NULL;
1698
1699 if (session->compat) {
1700 file_close_user(sconn, session->compat->vuid);
1701 }
1702
1703 if (session->tcon_table != NULL) {
1704 /*
1705 * Note: We only have a tcon_table for SMB2.
1706 */
1707 status = smb2srv_tcon_disconnect_all(session);
1708 if (!NT_STATUS_IS_OK(status)) {
1709 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1710 "smb2srv_tcon_disconnect_all() failed: %s\n",
1711 session->global->session_global_id,
1712 nt_errstr(status)));
1713 error = status;
1714 }
1715 }
1716
1717 if (session->compat) {
1718 invalidate_vuid(sconn, session->compat->vuid);
1719 session->compat = NULL;
1720 }
1721
1722 return error;
1723 }
1724
1725 struct smbXsrv_session_logoff_all_state {
1726 NTSTATUS first_status;
1727 int errors;
1728 };
1729
1730 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1731 void *private_data);
1732
1733 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_connection *conn)
1734 {
1735 struct smbXsrv_session_table *table = conn->client->session_table;
1736 struct smbXsrv_session_logoff_all_state state;
1737 NTSTATUS status;
1738 int count = 0;
1739
1740 if (table == NULL) {
1741 DEBUG(10, ("smbXsrv_session_logoff_all: "
1742 "empty session_table, nothing to do.\n"));
1743 return NT_STATUS_OK;
1744 }
1745
1746 ZERO_STRUCT(state);
1747
1748 status = dbwrap_traverse(table->local.db_ctx,
1749 smbXsrv_session_logoff_all_callback,
1750 &state, &count);
1751 if (!NT_STATUS_IS_OK(status)) {
1752 DEBUG(0, ("smbXsrv_session_logoff_all: "
1753 "dbwrap_traverse() failed: %s\n",
1754 nt_errstr(status)));
1755 return status;
1756 }
1757
1758 if (!NT_STATUS_IS_OK(state.first_status)) {
1759 DEBUG(0, ("smbXsrv_session_logoff_all: "
1760 "count[%d] errors[%d] first[%s]\n",
1761 count, state.errors,
1762 nt_errstr(state.first_status)));
1763 return state.first_status;
1764 }
1765
1766 return NT_STATUS_OK;
1767 }
1768
1769 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1770 void *private_data)
1771 {
1772 struct smbXsrv_session_logoff_all_state *state =
1773 (struct smbXsrv_session_logoff_all_state *)private_data;
1774 TDB_DATA val;
1775 void *ptr = NULL;
1776 struct smbXsrv_session *session = NULL;
1777 NTSTATUS status;
1778
1779 val = dbwrap_record_get_value(local_rec);
1780 if (val.dsize != sizeof(ptr)) {
1781 status = NT_STATUS_INTERNAL_ERROR;
1782 if (NT_STATUS_IS_OK(state->first_status)) {
1783 state->first_status = status;
1784 }
1785 state->errors++;
1786 return 0;
1787 }
1788
1789 memcpy(&ptr, val.dptr, val.dsize);
1790 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1791
1792 session->db_rec = local_rec;
1793
1794 status = smbXsrv_session_clear_and_logoff(session);
1795 if (!NT_STATUS_IS_OK(status)) {
1796 if (NT_STATUS_IS_OK(state->first_status)) {
1797 state->first_status = status;
1798 }
1799 state->errors++;
1800 return 0;
1801 }
1802
1803 return 0;
1804 }
1805
1806 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
1807 {
1808 /*
1809 * Allow a range from 1..65534 with 65534 values.
1810 */
1811 return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
1812 UINT16_MAX - 1);
1813 }
1814
1815 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
1816 uint16_t vuid, NTTIME now,
1817 struct smbXsrv_session **session)
1818 {
1819 struct smbXsrv_session_table *table = conn->client->session_table;
1820 uint32_t local_id = vuid;
1821
1822 return smbXsrv_session_local_lookup(table, conn, local_id, now,
1823 session);
1824 }
1825
1826 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
1827 {
1828 /*
1829 * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
1830 */
1831 return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
1832 UINT16_MAX - 1);
1833 }
1834
1835 static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
1836 /* conn: optional */
1837 struct smbXsrv_connection *conn,
1838 uint64_t session_id, NTTIME now,
1839 struct smbXsrv_session **session)
1840 {
1841 uint32_t local_id = session_id & UINT32_MAX;
1842 uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
1843
1844 if (local_zeros != 0) {
1845 return NT_STATUS_USER_SESSION_DELETED;
1846 }
1847
1848 return smbXsrv_session_local_lookup(table, conn, local_id, now,
1849 session);
1850 }
1851
1852 NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
1853 uint64_t session_id, NTTIME now,
1854 struct smbXsrv_session **session)
1855 {
1856 struct smbXsrv_session_table *table = conn->client->session_table;
1857 return smb2srv_session_lookup_raw(table, conn, session_id, now,
1858 session);
1859 }
1860
1861 NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
1862 uint64_t session_id, NTTIME now,
1863 struct smbXsrv_session **session)
1864 {
1865 struct smbXsrv_session_table *table = client->session_table;
1866 return smb2srv_session_lookup_raw(table, NULL, session_id, now,
1867 session);
1868 }
1869
1870 struct smbXsrv_session_global_traverse_state {
1871 int (*fn)(struct smbXsrv_session_global0 *, void *);
1872 void *private_data;
1873 };
1874
1875 static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
1876 {
1877 int ret = -1;
1878 struct smbXsrv_session_global_traverse_state *state =
1879 (struct smbXsrv_session_global_traverse_state*)data;
1880 TDB_DATA key = dbwrap_record_get_key(rec);
1881 TDB_DATA val = dbwrap_record_get_value(rec);
1882 DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
1883 struct smbXsrv_session_globalB global_blob;
1884 enum ndr_err_code ndr_err;
1885 TALLOC_CTX *frame = talloc_stackframe();
1886
1887 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
1888 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
1889 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1890 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1891 "key '%s' ndr_pull_struct_blob - %s\n",
1892 hex_encode_talloc(frame, key.dptr, key.dsize),
1893 ndr_errstr(ndr_err)));
1894 goto done;
1895 }
1896
1897 if (global_blob.version != SMBXSRV_VERSION_0) {
1898 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1899 "key '%s' unsuported version - %d\n",
1900 hex_encode_talloc(frame, key.dptr, key.dsize),
1901 (int)global_blob.version));
1902 goto done;
1903 }
1904
1905 global_blob.info.info0->db_rec = rec;
1906 ret = state->fn(global_blob.info.info0, state->private_data);
1907 done:
1908 TALLOC_FREE(frame);
1909 return ret;
1910 }
1911
1912 NTSTATUS smbXsrv_session_global_traverse(
1913 int (*fn)(struct smbXsrv_session_global0 *, void *),
1914 void *private_data)
1915 {
1916
1917 NTSTATUS status;
1918 int count = 0;
1919 struct smbXsrv_session_global_traverse_state state = {
1920 .fn = fn,
1921 .private_data = private_data,
1922 };
1923
1924 become_root();
1925 status = smbXsrv_session_global_init();
1926 if (!NT_STATUS_IS_OK(status)) {
1927 unbecome_root();
1928 DEBUG(0, ("Failed to initialize session_global: %s\n",
1929 nt_errstr(status)));
1930 return status;
1931 }
1932
1933 status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
1934 smbXsrv_session_global_traverse_fn,
1935 &state,
1936 &count);
1937 unbecome_root();
1938
1939 return status;
1940 }
Samba GIT mirror