?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smbXsrv_session: Use struct initialization
[Samba.git] / source3 / smbd / smbXsrv_session.c
blob33ce70210a1a553b9eb1083208b4f92ab40caf5e
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2011-2012
5 Copyright (C) Michael Adam 2012
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbXsrv_session.h"
23 #include "system/filesys.h"
24 #include <tevent.h>
25 #include "lib/util/server_id.h"
26 #include "smbd/smbd.h"
27 #include "smbd/globals.h"
28 #include "dbwrap/dbwrap.h"
29 #include "dbwrap/dbwrap_rbt.h"
30 #include "dbwrap/dbwrap_open.h"
31 #include "dbwrap/dbwrap_watch.h"
32 #include "session.h"
33 #include "auth.h"
34 #include "auth/gensec/gensec.h"
35 #include "../lib/tsocket/tsocket.h"
36 #include "../libcli/security/security.h"
37 #include "messages.h"
38 #include "lib/util/util_tdb.h"
39 #include "librpc/gen_ndr/ndr_smbXsrv.h"
40 #include "serverid.h"
41 #include "lib/util/tevent_ntstatus.h"
42 #include "lib/global_contexts.h"
43 #include "source3/include/util_tdb.h"
44
45 struct smbXsrv_session_table {
46 struct {
47 struct db_context *db_ctx;
48 uint32_t lowest_id;
49 uint32_t highest_id;
50 uint32_t max_sessions;
51 uint32_t num_sessions;
52 } local;
53 struct {
54 struct db_context *db_ctx;
55 } global;
56 };
57
58 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
59
60 NTSTATUS smbXsrv_session_global_init(struct messaging_context *msg_ctx)
61 {
62 char *global_path = NULL;
63 struct db_context *backend = NULL;
64 struct db_context *db_ctx = NULL;
65
66 if (smbXsrv_session_global_db_ctx != NULL) {
67 return NT_STATUS_OK;
68 }
69
70 /*
71 * This contains secret information like session keys!
72 */
73 global_path = lock_path(talloc_tos(), "smbXsrv_session_global.tdb");
74 if (global_path == NULL) {
75 return NT_STATUS_NO_MEMORY;
76 }
77
78 backend = db_open(NULL, global_path,
79 SMBD_VOLATILE_TDB_HASH_SIZE,
80 SMBD_VOLATILE_TDB_FLAGS,
81 O_RDWR | O_CREAT, 0600,
82 DBWRAP_LOCK_ORDER_1,
83 DBWRAP_FLAG_NONE);
84 TALLOC_FREE(global_path);
85 if (backend == NULL) {
86 NTSTATUS status;
87
88 status = map_nt_error_from_unix_common(errno);
89
90 return status;
91 }
92
93 db_ctx = db_open_watched(NULL, &backend, global_messaging_context());
94 if (db_ctx == NULL) {
95 TALLOC_FREE(backend);
96 return NT_STATUS_NO_MEMORY;
97 }
98
99 smbXsrv_session_global_db_ctx = db_ctx;
100
101 return NT_STATUS_OK;
102 }
103
104 /*
105 * NOTE:
106 * We need to store the keys in big endian so that dbwrap_rbt's memcmp
107 * has the same result as integer comparison between the uint32_t
108 * values.
109 *
110 * TODO: implement string based key
111 */
112
113 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
114
115 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
116 uint8_t *key_buf)
117 {
118 TDB_DATA key;
119
120 RSIVAL(key_buf, 0, id);
121
122 key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
123
124 return key;
125 }
126
127 #if 0
128 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
129 {
130 if (id == NULL) {
131 return NT_STATUS_INVALID_PARAMETER;
132 }
133
134 if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
135 return NT_STATUS_INTERNAL_DB_CORRUPTION;
136 }
137
138 *id = RIVAL(key.dptr, 0);
139
140 return NT_STATUS_OK;
141 }
142 #endif
143
144 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
145
146 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
147 uint8_t *key_buf)
148 {
149 TDB_DATA key;
150
151 RSIVAL(key_buf, 0, id);
152
153 key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
154
155 return key;
156 }
157
158 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
159 {
160 if (id == NULL) {
161 return NT_STATUS_INVALID_PARAMETER;
162 }
163
164 if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
165 return NT_STATUS_INTERNAL_DB_CORRUPTION;
166 }
167
168 *id = RIVAL(key.dptr, 0);
169
170 return NT_STATUS_OK;
171 }
172
173 static struct db_record *smbXsrv_session_global_fetch_locked(
174 struct db_context *db,
175 uint32_t id,
176 TALLOC_CTX *mem_ctx)
177 {
178 TDB_DATA key;
179 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
180 struct db_record *rec = NULL;
181
182 key = smbXsrv_session_global_id_to_key(id, key_buf);
183
184 rec = dbwrap_fetch_locked(db, mem_ctx, key);
185
186 if (rec == NULL) {
187 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
188 tdb_data_dbg(key));
189 }
190
191 return rec;
192 }
193
194 static struct db_record *smbXsrv_session_local_fetch_locked(
195 struct db_context *db,
196 uint32_t id,
197 TALLOC_CTX *mem_ctx)
198 {
199 TDB_DATA key;
200 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
201 struct db_record *rec = NULL;
202
203 key = smbXsrv_session_local_id_to_key(id, key_buf);
204
205 rec = dbwrap_fetch_locked(db, mem_ctx, key);
206
207 if (rec == NULL) {
208 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
209 tdb_data_dbg(key));
210 }
211
212 return rec;
213 }
214
215 static void smbXsrv_session_close_loop(struct tevent_req *subreq);
216
217 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
218 uint32_t lowest_id,
219 uint32_t highest_id,
220 uint32_t max_sessions)
221 {
222 struct smbXsrv_client *client = conn->client;
223 struct smbXsrv_session_table *table;
224 NTSTATUS status;
225 struct tevent_req *subreq;
226 uint64_t max_range;
227
228 if (lowest_id > highest_id) {
229 return NT_STATUS_INTERNAL_ERROR;
230 }
231
232 max_range = highest_id;
233 max_range -= lowest_id;
234 max_range += 1;
235
236 if (max_sessions > max_range) {
237 return NT_STATUS_INTERNAL_ERROR;
238 }
239
240 table = talloc_zero(client, struct smbXsrv_session_table);
241 if (table == NULL) {
242 return NT_STATUS_NO_MEMORY;
243 }
244
245 table->local.db_ctx = db_open_rbt(table);
246 if (table->local.db_ctx == NULL) {
247 TALLOC_FREE(table);
248 return NT_STATUS_NO_MEMORY;
249 }
250 table->local.lowest_id = lowest_id;
251 table->local.highest_id = highest_id;
252 table->local.max_sessions = max_sessions;
253
254 status = smbXsrv_session_global_init(client->msg_ctx);
255 if (!NT_STATUS_IS_OK(status)) {
256 TALLOC_FREE(table);
257 return status;
258 }
259
260 table->global.db_ctx = smbXsrv_session_global_db_ctx;
261
262 subreq = messaging_read_send(table,
263 client->raw_ev_ctx,
264 client->msg_ctx,
265 MSG_SMBXSRV_SESSION_CLOSE);
266 if (subreq == NULL) {
267 TALLOC_FREE(table);
268 return NT_STATUS_NO_MEMORY;
269 }
270 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
271
272 client->session_table = table;
273 return NT_STATUS_OK;
274 }
275
276 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
277
278 static void smbXsrv_session_close_loop(struct tevent_req *subreq)
279 {
280 struct smbXsrv_client *client =
281 tevent_req_callback_data(subreq,
282 struct smbXsrv_client);
283 struct smbXsrv_session_table *table = client->session_table;
284 int ret;
285 struct messaging_rec *rec = NULL;
286 struct smbXsrv_session_closeB close_blob;
287 enum ndr_err_code ndr_err;
288 struct smbXsrv_session_close0 *close_info0 = NULL;
289 struct smbXsrv_session *session = NULL;
290 NTSTATUS status;
291 struct timeval tv = timeval_current();
292 NTTIME now = timeval_to_nttime(&tv);
293
294 ret = messaging_read_recv(subreq, talloc_tos(), &rec);
295 TALLOC_FREE(subreq);
296 if (ret != 0) {
297 goto next;
298 }
299
300 ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
301 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
302 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
303 status = ndr_map_error2ntstatus(ndr_err);
304 DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status));
305 goto next;
306 }
307
308 DBG_DEBUG("MSG_SMBXSRV_SESSION_CLOSE\n");
309 if (DEBUGLVL(DBGLVL_DEBUG)) {
310 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
311 }
312
313 if (close_blob.version != SMBXSRV_VERSION_0) {
314 DBG_ERR("ignore invalid version %u\n", close_blob.version);
315 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
316 goto next;
317 }
318
319 close_info0 = close_blob.info.info0;
320 if (close_info0 == NULL) {
321 DBG_ERR("ignore NULL info %u\n", close_blob.version);
322 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
323 goto next;
324 }
325
326 status = smb2srv_session_lookup_client(client,
327 close_info0->old_session_wire_id,
328 now, &session);
329 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
330 DBG_INFO("old_session_wire_id %" PRIu64 " not found\n",
331 close_info0->old_session_wire_id);
332 if (DEBUGLVL(DBGLVL_INFO)) {
333 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
334 }
335 goto next;
336 }
337 if (!NT_STATUS_IS_OK(status) &&
338 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
339 !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
340 DBG_WARNING("old_session_wire_id %" PRIu64 " - %s\n",
341 close_info0->old_session_wire_id,
342 nt_errstr(status));
343 if (DEBUGLVL(DBGLVL_WARNING)) {
344 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
345 }
346 goto next;
347 }
348
349 if (session->global->session_global_id != close_info0->old_session_global_id) {
350 DBG_WARNING("old_session_wire_id %" PRIu64 " - "
351 "global %" PRIu32 " != %" PRIu32 "\n",
352 close_info0->old_session_wire_id,
353 session->global->session_global_id,
354 close_info0->old_session_global_id);
355 if (DEBUGLVL(DBGLVL_WARNING)) {
356 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
357 }
358 goto next;
359 }
360
361 if (session->global->creation_time != close_info0->old_creation_time) {
362 DBG_WARNING("old_session_wire_id %" PRIu64 " - "
363 "creation %s (%" PRIu64 ") != %s (%" PRIu64 ")\n",
364 close_info0->old_session_wire_id,
365 nt_time_string(rec,
366 session->global->creation_time),
367 session->global->creation_time,
368 nt_time_string(rec,
369 close_info0->old_creation_time),
370 close_info0->old_creation_time);
371 if (DEBUGLVL(DBGLVL_WARNING)) {
372 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
373 }
374 goto next;
375 }
376
377 subreq = smb2srv_session_shutdown_send(session, client->raw_ev_ctx,
378 session, NULL);
379 if (subreq == NULL) {
380 status = NT_STATUS_NO_MEMORY;
381 DBG_ERR("smb2srv_session_shutdown_send(%" PRIu64
382 ") failed: %s\n",
383 session->global->session_wire_id,
384 nt_errstr(status));
385 if (DEBUGLVL(DBGLVL_WARNING)) {
386 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
387 }
388 goto next;
389 }
390 tevent_req_set_callback(subreq,
391 smbXsrv_session_close_shutdown_done,
392 session);
393
394 next:
395 TALLOC_FREE(rec);
396
397 subreq = messaging_read_send(table,
398 client->raw_ev_ctx,
399 client->msg_ctx,
400 MSG_SMBXSRV_SESSION_CLOSE);
401 if (subreq == NULL) {
402 const char *r;
403 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
404 exit_server_cleanly(r);
405 return;
406 }
407 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
408 }
409
410 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
411 {
412 struct smbXsrv_session *session =
413 tevent_req_callback_data(subreq,
414 struct smbXsrv_session);
415 NTSTATUS status;
416
417 status = smb2srv_session_shutdown_recv(subreq);
418 TALLOC_FREE(subreq);
419 if (!NT_STATUS_IS_OK(status)) {
420 DBG_ERR("smb2srv_session_shutdown_recv(%" PRIu64
421 ") failed: %s\n",
422 session->global->session_wire_id,
423 nt_errstr(status));
424 }
425
426 status = smbXsrv_session_logoff(session);
427 if (!NT_STATUS_IS_OK(status)) {
428 DBG_ERR("smbXsrv_session_logoff(%" PRIu64 ") failed: %s\n",
429 session->global->session_wire_id,
430 nt_errstr(status));
431 }
432
433 TALLOC_FREE(session);
434 }
435
436 struct smb1srv_session_local_allocate_state {
437 const uint32_t lowest_id;
438 const uint32_t highest_id;
439 uint32_t last_id;
440 uint32_t useable_id;
441 NTSTATUS status;
442 };
443
444 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
445 void *private_data)
446 {
447 struct smb1srv_session_local_allocate_state *state =
448 (struct smb1srv_session_local_allocate_state *)private_data;
449 TDB_DATA key = dbwrap_record_get_key(rec);
450 uint32_t id = 0;
451 NTSTATUS status;
452
453 status = smbXsrv_session_local_key_to_id(key, &id);
454 if (!NT_STATUS_IS_OK(status)) {
455 state->status = status;
456 return -1;
457 }
458
459 if (id <= state->last_id) {
460 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
461 return -1;
462 }
463 state->last_id = id;
464
465 if (id > state->useable_id) {
466 state->status = NT_STATUS_OK;
467 return -1;
468 }
469
470 if (state->useable_id == state->highest_id) {
471 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
472 return -1;
473 }
474
475 state->useable_id +=1;
476 return 0;
477 }
478
479 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
480 uint32_t lowest_id,
481 uint32_t highest_id,
482 TALLOC_CTX *mem_ctx,
483 struct db_record **_rec,
484 uint32_t *_id)
485 {
486 struct smb1srv_session_local_allocate_state state = {
487 .lowest_id = lowest_id,
488 .highest_id = highest_id,
489 .last_id = 0,
490 .useable_id = lowest_id,
491 .status = NT_STATUS_INTERNAL_ERROR,
492 };
493 uint32_t i;
494 uint32_t range;
495 NTSTATUS status;
496 int count = 0;
497
498 *_rec = NULL;
499 *_id = 0;
500
501 if (lowest_id > highest_id) {
502 return NT_STATUS_INSUFFICIENT_RESOURCES;
503 }
504
505 /*
506 * first we try randomly
507 */
508 range = (highest_id - lowest_id) + 1;
509
510 for (i = 0; i < (range / 2); i++) {
511 uint32_t id;
512 TDB_DATA val;
513 struct db_record *rec = NULL;
514
515 id = generate_random() % range;
516 id += lowest_id;
517
518 if (id < lowest_id) {
519 id = lowest_id;
520 }
521 if (id > highest_id) {
522 id = highest_id;
523 }
524
525 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
526 if (rec == NULL) {
527 return NT_STATUS_INSUFFICIENT_RESOURCES;
528 }
529
530 val = dbwrap_record_get_value(rec);
531 if (val.dsize != 0) {
532 TALLOC_FREE(rec);
533 continue;
534 }
535
536 *_rec = rec;
537 *_id = id;
538 return NT_STATUS_OK;
539 }
540
541 /*
542 * if the range is almost full,
543 * we traverse the whole table
544 * (this relies on sorted behavior of dbwrap_rbt)
545 */
546 status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
547 &state, &count);
548 if (NT_STATUS_IS_OK(status)) {
549 if (NT_STATUS_IS_OK(state.status)) {
550 return NT_STATUS_INTERNAL_ERROR;
551 }
552
553 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
554 return state.status;
555 }
556
557 if (state.useable_id <= state.highest_id) {
558 state.status = NT_STATUS_OK;
559 } else {
560 return NT_STATUS_INSUFFICIENT_RESOURCES;
561 }
562 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
563 /*
564 * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
565 *
566 * If we get anything else it is an error, because it
567 * means we did not manage to find a free slot in
568 * the db.
569 */
570 return NT_STATUS_INSUFFICIENT_RESOURCES;
571 }
572
573 if (NT_STATUS_IS_OK(state.status)) {
574 uint32_t id;
575 TDB_DATA val;
576 struct db_record *rec = NULL;
577
578 id = state.useable_id;
579
580 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
581 if (rec == NULL) {
582 return NT_STATUS_INSUFFICIENT_RESOURCES;
583 }
584
585 val = dbwrap_record_get_value(rec);
586 if (val.dsize != 0) {
587 TALLOC_FREE(rec);
588 return NT_STATUS_INTERNAL_DB_CORRUPTION;
589 }
590
591 *_rec = rec;
592 *_id = id;
593 return NT_STATUS_OK;
594 }
595
596 return state.status;
597 }
598
599 struct smbXsrv_session_local_fetch_state {
600 struct smbXsrv_session *session;
601 NTSTATUS status;
602 };
603
604 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
605 void *private_data)
606 {
607 struct smbXsrv_session_local_fetch_state *state =
608 (struct smbXsrv_session_local_fetch_state *)private_data;
609 void *ptr;
610
611 if (data.dsize != sizeof(ptr)) {
612 state->status = NT_STATUS_INTERNAL_DB_ERROR;
613 return;
614 }
615
616 memcpy(&ptr, data.dptr, data.dsize);
617 state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
618 state->status = NT_STATUS_OK;
619 }
620
621 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
622 /* conn: optional */
623 struct smbXsrv_connection *conn,
624 uint32_t session_local_id,
625 NTTIME now,
626 struct smbXsrv_session **_session)
627 {
628 struct smbXsrv_session_local_fetch_state state = {
629 .session = NULL,
630 .status = NT_STATUS_INTERNAL_ERROR,
631 };
632 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
633 TDB_DATA key;
634 NTSTATUS status;
635
636 *_session = NULL;
637
638 if (session_local_id == 0) {
639 return NT_STATUS_USER_SESSION_DELETED;
640 }
641
642 if (table == NULL) {
643 /* this might happen before the end of negprot */
644 return NT_STATUS_USER_SESSION_DELETED;
645 }
646
647 if (table->local.db_ctx == NULL) {
648 return NT_STATUS_INTERNAL_ERROR;
649 }
650
651 key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
652
653 status = dbwrap_parse_record(table->local.db_ctx, key,
654 smbXsrv_session_local_fetch_parser,
655 &state);
656 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
657 return NT_STATUS_USER_SESSION_DELETED;
658 } else if (!NT_STATUS_IS_OK(status)) {
659 return status;
660 }
661 if (!NT_STATUS_IS_OK(state.status)) {
662 return state.status;
663 }
664
665 if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
666 return NT_STATUS_USER_SESSION_DELETED;
667 }
668
669 /*
670 * If a connection is specified check if the session is
671 * valid on the channel.
672 */
673 if (conn != NULL) {
674 struct smbXsrv_channel_global0 *c = NULL;
675
676 status = smbXsrv_session_find_channel(state.session, conn, &c);
677 if (!NT_STATUS_IS_OK(status)) {
678 return status;
679 }
680 }
681
682 state.session->idle_time = now;
683
684 if (!NT_STATUS_IS_OK(state.session->status)) {
685 *_session = state.session;
686 return state.session->status;
687 }
688
689 if (now > state.session->global->expiration_time) {
690 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
691 }
692
693 *_session = state.session;
694 return state.session->status;
695 }
696
697 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
698 {
699 return 0;
700 }
701
702 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
703 bool *is_free,
704 bool *was_free,
705 TALLOC_CTX *mem_ctx,
706 struct smbXsrv_session_global0 **_g,
707 uint32_t *pseqnum);
708
709 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
710 TALLOC_CTX *mem_ctx,
711 struct smbXsrv_session_global0 **_global)
712 {
713 uint32_t i;
714 struct smbXsrv_session_global0 *global = NULL;
715 uint32_t last_free = 0;
716 const uint32_t min_tries = 3;
717
718 *_global = NULL;
719
720 global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
721 if (global == NULL) {
722 return NT_STATUS_NO_MEMORY;
723 }
724 talloc_set_destructor(global, smbXsrv_session_global_destructor);
725
726 /*
727 * Here we just randomly try the whole 32-bit space
728 *
729 * We use just 32-bit, because we want to reuse the
730 * ID for SRVSVC.
731 */
732 for (i = 0; i < UINT32_MAX; i++) {
733 bool is_free = false;
734 bool was_free = false;
735 uint32_t id;
736
737 if (i >= min_tries && last_free != 0) {
738 id = last_free;
739 } else {
740 id = generate_random();
741 }
742 if (id == 0) {
743 id++;
744 }
745 if (id == UINT32_MAX) {
746 id--;
747 }
748
749 global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
750 mem_ctx);
751 if (global->db_rec == NULL) {
752 talloc_free(global);
753 return NT_STATUS_INSUFFICIENT_RESOURCES;
754 }
755
756 smbXsrv_session_global_verify_record(global->db_rec,
757 &is_free,
758 &was_free,
759 NULL, NULL, NULL);
760
761 if (!is_free) {
762 TALLOC_FREE(global->db_rec);
763 continue;
764 }
765
766 if (!was_free && i < min_tries) {
767 /*
768 * The session_id is free now,
769 * but was not free before.
770 *
771 * This happens if a smbd crashed
772 * and did not cleanup the record.
773 *
774 * If this is one of our first tries,
775 * then we try to find a real free one.
776 */
777 if (last_free == 0) {
778 last_free = id;
779 }
780 TALLOC_FREE(global->db_rec);
781 continue;
782 }
783
784 global->session_global_id = id;
785
786 *_global = global;
787 return NT_STATUS_OK;
788 }
789
790 /* should not be reached */
791 talloc_free(global);
792 return NT_STATUS_INTERNAL_ERROR;
793 }
794
795 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
796 bool *is_free,
797 bool *was_free,
798 TALLOC_CTX *mem_ctx,
799 struct smbXsrv_session_global0 **_g,
800 uint32_t *pseqnum)
801 {
802 TDB_DATA key;
803 TDB_DATA val;
804 DATA_BLOB blob;
805 struct smbXsrv_session_globalB global_blob;
806 enum ndr_err_code ndr_err;
807 struct smbXsrv_session_global0 *global = NULL;
808 bool exists;
809 TALLOC_CTX *frame = talloc_stackframe();
810
811 *is_free = false;
812
813 if (was_free) {
814 *was_free = false;
815 }
816 if (_g) {
817 *_g = NULL;
818 }
819 if (pseqnum) {
820 *pseqnum = 0;
821 }
822
823 key = dbwrap_record_get_key(db_rec);
824
825 val = dbwrap_record_get_value(db_rec);
826 if (val.dsize == 0) {
827 TALLOC_FREE(frame);
828 *is_free = true;
829 if (was_free) {
830 *was_free = true;
831 }
832 return;
833 }
834
835 blob = data_blob_const(val.dptr, val.dsize);
836
837 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
838 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
839 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
840 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
841 DBG_WARNING("key '%s' ndr_pull_struct_blob - %s\n",
842 tdb_data_dbg(key),
843 nt_errstr(status));
844 TALLOC_FREE(frame);
845 *is_free = true;
846 if (was_free) {
847 *was_free = true;
848 }
849 return;
850 }
851
852 DBG_DEBUG("smbXsrv_session_global_verify_record\n");
853 if (DEBUGLVL(DBGLVL_DEBUG)) {
854 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
855 }
856
857 if (global_blob.version != SMBXSRV_VERSION_0) {
858 DBG_ERR("key '%s' use unsupported version %u\n",
859 tdb_data_dbg(key),
860 global_blob.version);
861 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
862 TALLOC_FREE(frame);
863 *is_free = true;
864 if (was_free) {
865 *was_free = true;
866 }
867 return;
868 }
869
870 global = global_blob.info.info0;
871
872 #define __BLOB_KEEP_SECRET(__blob) do { \
873 if ((__blob).length != 0) { \
874 talloc_keep_secret((__blob).data); \
875 } \
876 } while(0)
877 {
878 uint32_t i;
879 __BLOB_KEEP_SECRET(global->application_key_blob);
880 __BLOB_KEEP_SECRET(global->signing_key_blob);
881 __BLOB_KEEP_SECRET(global->encryption_key_blob);
882 __BLOB_KEEP_SECRET(global->decryption_key_blob);
883 for (i = 0; i < global->num_channels; i++) {
884 __BLOB_KEEP_SECRET(global->channels[i].signing_key_blob);
885 }
886 }
887 #undef __BLOB_KEEP_SECRET
888
889 exists = serverid_exists(&global->channels[0].server_id);
890 if (!exists) {
891 struct server_id_buf idbuf;
892 DBG_NOTICE("key '%s' server_id %s does not exist.\n",
893 tdb_data_dbg(key),
894 server_id_str_buf(global->channels[0].server_id,
895 &idbuf));
896 if (DEBUGLVL(DBGLVL_NOTICE)) {
897 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
898 }
899 TALLOC_FREE(frame);
900 dbwrap_record_delete(db_rec);
901 *is_free = true;
902 return;
903 }
904
905 if (_g) {
906 *_g = talloc_move(mem_ctx, &global);
907 }
908 if (pseqnum) {
909 *pseqnum = global_blob.seqnum;
910 }
911 TALLOC_FREE(frame);
912 }
913
914 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
915 {
916 struct smbXsrv_session_globalB global_blob;
917 DATA_BLOB blob = data_blob_null;
918 TDB_DATA key;
919 TDB_DATA val;
920 NTSTATUS status;
921 enum ndr_err_code ndr_err;
922
923 /*
924 * TODO: if we use other versions than '0'
925 * we would add glue code here, that would be able to
926 * store the information in the old format.
927 */
928
929 if (global->db_rec == NULL) {
930 return NT_STATUS_INTERNAL_ERROR;
931 }
932
933 key = dbwrap_record_get_key(global->db_rec);
934 val = dbwrap_record_get_value(global->db_rec);
935
936 global_blob = (struct smbXsrv_session_globalB){
937 .version = smbXsrv_version_global_current(),
938 .info.info0 = global,
939 };
940
941 if (val.dsize >= 8) {
942 global_blob.seqnum = IVAL(val.dptr, 4);
943 }
944 global_blob.seqnum += 1;
945
946 ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
947 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
948 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
949 status = ndr_map_error2ntstatus(ndr_err);
950 DBG_WARNING("key '%s' ndr_push - %s\n",
951 tdb_data_dbg(key),
952 nt_errstr(status));
953 TALLOC_FREE(global->db_rec);
954 return status;
955 }
956
957 val = make_tdb_data(blob.data, blob.length);
958 status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
959 if (!NT_STATUS_IS_OK(status)) {
960 DBG_WARNING("key '%s' store - %s\n",
961 tdb_data_dbg(key),
962 nt_errstr(status));
963 TALLOC_FREE(global->db_rec);
964 return status;
965 }
966
967 if (DEBUGLVL(DBGLVL_DEBUG)) {
968 DBG_DEBUG("key '%s' stored\n", tdb_data_dbg(key));
969 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
970 }
971
972 TALLOC_FREE(global->db_rec);
973
974 return NT_STATUS_OK;
975 }
976
977 struct smb2srv_session_close_previous_state {
978 struct tevent_context *ev;
979 struct smbXsrv_connection *connection;
980 struct dom_sid *current_sid;
981 uint64_t previous_session_id;
982 uint64_t current_session_id;
983 struct db_record *db_rec;
984 uint64_t watch_instance;
985 uint32_t last_seqnum;
986 };
987
988 static void smb2srv_session_close_previous_cleanup(struct tevent_req *req,
989 enum tevent_req_state req_state)
990 {
991 struct smb2srv_session_close_previous_state *state =
992 tevent_req_data(req,
993 struct smb2srv_session_close_previous_state);
994
995 if (state->db_rec != NULL) {
996 dbwrap_watched_watch_remove_instance(state->db_rec,
997 state->watch_instance);
998 state->watch_instance = 0;
999 TALLOC_FREE(state->db_rec);
1000 }
1001 }
1002
1003 static void smb2srv_session_close_previous_check(struct tevent_req *req);
1004 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
1005
1006 struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
1007 struct tevent_context *ev,
1008 struct smbXsrv_connection *conn,
1009 struct auth_session_info *session_info,
1010 uint64_t previous_session_id,
1011 uint64_t current_session_id)
1012 {
1013 struct tevent_req *req;
1014 struct smb2srv_session_close_previous_state *state;
1015 uint32_t global_id = previous_session_id & UINT32_MAX;
1016 uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
1017 struct smbXsrv_session_table *table = conn->client->session_table;
1018 struct security_token *current_token = NULL;
1019
1020 req = tevent_req_create(mem_ctx, &state,
1021 struct smb2srv_session_close_previous_state);
1022 if (req == NULL) {
1023 return NULL;
1024 }
1025 state->ev = ev;
1026 state->connection = conn;
1027 state->previous_session_id = previous_session_id;
1028 state->current_session_id = current_session_id;
1029
1030 tevent_req_set_cleanup_fn(req, smb2srv_session_close_previous_cleanup);
1031
1032 if (global_zeros != 0) {
1033 tevent_req_done(req);
1034 return tevent_req_post(req, ev);
1035 }
1036
1037 if (session_info == NULL) {
1038 tevent_req_done(req);
1039 return tevent_req_post(req, ev);
1040 }
1041 current_token = session_info->security_token;
1042
1043 if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
1044 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
1045 }
1046
1047 if (state->current_sid == NULL) {
1048 tevent_req_done(req);
1049 return tevent_req_post(req, ev);
1050 }
1051
1052 if (!security_token_has_nt_authenticated_users(current_token)) {
1053 /* TODO */
1054 tevent_req_done(req);
1055 return tevent_req_post(req, ev);
1056 }
1057
1058 state->db_rec = smbXsrv_session_global_fetch_locked(
1059 table->global.db_ctx,
1060 global_id,
1061 state /* TALLOC_CTX */);
1062 if (state->db_rec == NULL) {
1063 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1064 return tevent_req_post(req, ev);
1065 }
1066
1067 smb2srv_session_close_previous_check(req);
1068 if (!tevent_req_is_in_progress(req)) {
1069 return tevent_req_post(req, ev);
1070 }
1071
1072 return req;
1073 }
1074
1075 static void smb2srv_session_close_previous_check(struct tevent_req *req)
1076 {
1077 struct smb2srv_session_close_previous_state *state =
1078 tevent_req_data(req,
1079 struct smb2srv_session_close_previous_state);
1080 struct smbXsrv_connection *conn = state->connection;
1081 DATA_BLOB blob;
1082 struct security_token *previous_token = NULL;
1083 struct smbXsrv_session_global0 *global = NULL;
1084 enum ndr_err_code ndr_err;
1085 struct smbXsrv_session_close0 close_info0;
1086 struct smbXsrv_session_closeB close_blob;
1087 struct tevent_req *subreq = NULL;
1088 NTSTATUS status;
1089 bool is_free = false;
1090 uint32_t seqnum = 0;
1091
1092 smbXsrv_session_global_verify_record(state->db_rec,
1093 &is_free,
1094 NULL,
1095 state,
1096 &global,
1097 &seqnum);
1098
1099 if (is_free) {
1100 tevent_req_done(req);
1101 return;
1102 }
1103
1104 if (global->auth_session_info == NULL) {
1105 tevent_req_done(req);
1106 return;
1107 }
1108
1109 previous_token = global->auth_session_info->security_token;
1110
1111 if (!security_token_is_sid(previous_token, state->current_sid)) {
1112 tevent_req_done(req);
1113 return;
1114 }
1115
1116 /*
1117 * If the record changed, but we are not happy with the change yet,
1118 * we better remove ourself from the waiter list
1119 * (most likely the first position)
1120 * and re-add us at the end of the list.
1121 *
1122 * This gives other waiters a change
1123 * to make progress.
1124 *
1125 * Otherwise we'll keep our waiter instance alive,
1126 * keep waiting (most likely at first position).
1127 * It means the order of watchers stays fair.
1128 */
1129 if (state->last_seqnum != seqnum) {
1130 state->last_seqnum = seqnum;
1131 dbwrap_watched_watch_remove_instance(state->db_rec,
1132 state->watch_instance);
1133 state->watch_instance =
1134 dbwrap_watched_watch_add_instance(state->db_rec);
1135 }
1136
1137 subreq = dbwrap_watched_watch_send(state, state->ev, state->db_rec,
1138 state->watch_instance,
1139 (struct server_id){0});
1140 if (tevent_req_nomem(subreq, req)) {
1141 return;
1142 }
1143 tevent_req_set_callback(subreq,
1144 smb2srv_session_close_previous_modified,
1145 req);
1146
1147 close_info0 = (struct smbXsrv_session_close0){
1148 .old_session_global_id = global->session_global_id,
1149 .old_session_wire_id = global->session_wire_id,
1150 .old_creation_time = global->creation_time,
1151 .new_session_wire_id = state->current_session_id,
1152 };
1153
1154 close_blob = (struct smbXsrv_session_closeB){
1155 .version = smbXsrv_version_global_current(),
1156 .info.info0 = &close_info0,
1157 };
1158
1159 ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1160 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1161 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1162 status = ndr_map_error2ntstatus(ndr_err);
1163 DBG_WARNING("old_session[%" PRIu64 "] "
1164 "new_session[%" PRIu64 "] ndr_push - %s\n",
1165 close_info0.old_session_wire_id,
1166 close_info0.new_session_wire_id,
1167 nt_errstr(status));
1168 tevent_req_nterror(req, status);
1169 return;
1170 }
1171
1172 status = messaging_send(conn->client->msg_ctx,
1173 global->channels[0].server_id,
1174 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1175 TALLOC_FREE(global);
1176 if (tevent_req_nterror(req, status)) {
1177 return;
1178 }
1179
1180 TALLOC_FREE(state->db_rec);
1181 return;
1182 }
1183
1184 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1185 {
1186 struct tevent_req *req =
1187 tevent_req_callback_data(subreq,
1188 struct tevent_req);
1189 struct smb2srv_session_close_previous_state *state =
1190 tevent_req_data(req,
1191 struct smb2srv_session_close_previous_state);
1192 uint32_t global_id;
1193 NTSTATUS status;
1194 uint64_t instance = 0;
1195
1196 status = dbwrap_watched_watch_recv(subreq, &instance, NULL, NULL);
1197 TALLOC_FREE(subreq);
1198 if (tevent_req_nterror(req, status)) {
1199 return;
1200 }
1201
1202 state->watch_instance = instance;
1203
1204 global_id = state->previous_session_id & UINT32_MAX;
1205
1206 state->db_rec = smbXsrv_session_global_fetch_locked(
1207 state->connection->client->session_table->global.db_ctx,
1208 global_id, state /* TALLOC_CTX */);
1209 if (state->db_rec == NULL) {
1210 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1211 return;
1212 }
1213
1214 smb2srv_session_close_previous_check(req);
1215 }
1216
1217 NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1218 {
1219 NTSTATUS status;
1220
1221 if (tevent_req_is_nterror(req, &status)) {
1222 tevent_req_received(req);
1223 return status;
1224 }
1225
1226 tevent_req_received(req);
1227 return NT_STATUS_OK;
1228 }
1229
1230 static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1231 {
1232 NTSTATUS status;
1233 struct smbXsrv_connection *xconn = NULL;
1234
1235 if (session->client != NULL) {
1236 xconn = session->client->connections;
1237 }
1238
1239 for (; xconn != NULL; xconn = xconn->next) {
1240 struct smbd_smb2_request *preq;
1241
1242 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1243 if (preq->session != session) {
1244 continue;
1245 }
1246
1247 preq->session = NULL;
1248 /*
1249 * If we no longer have a session we can't
1250 * sign or encrypt replies.
1251 */
1252 preq->do_signing = false;
1253 preq->do_encryption = false;
1254 preq->preauth = NULL;
1255 }
1256 }
1257
1258 status = smbXsrv_session_logoff(session);
1259 return status;
1260 }
1261
1262 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1263 {
1264 NTSTATUS status;
1265
1266 DBG_DEBUG("destructing session(%" PRIu64 ")\n",
1267 session->global->session_wire_id);
1268
1269 status = smbXsrv_session_clear_and_logoff(session);
1270 if (!NT_STATUS_IS_OK(status)) {
1271 DBG_ERR("smbXsrv_session_logoff() failed: %s\n",
1272 nt_errstr(status));
1273 }
1274
1275 TALLOC_FREE(session->global);
1276
1277 return 0;
1278 }
1279
1280 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1281 NTTIME now,
1282 struct smbXsrv_session **_session)
1283 {
1284 struct smbXsrv_session_table *table = conn->client->session_table;
1285 struct db_record *local_rec = NULL;
1286 struct smbXsrv_session *session = NULL;
1287 void *ptr = NULL;
1288 TDB_DATA val;
1289 struct smbXsrv_session_global0 *global = NULL;
1290 struct smbXsrv_channel_global0 *channel = NULL;
1291 NTSTATUS status;
1292
1293 if (table->local.num_sessions >= table->local.max_sessions) {
1294 return NT_STATUS_INSUFFICIENT_RESOURCES;
1295 }
1296
1297 session = talloc_zero(table, struct smbXsrv_session);
1298 if (session == NULL) {
1299 return NT_STATUS_NO_MEMORY;
1300 }
1301 session->table = table;
1302 session->idle_time = now;
1303 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1304 session->client = conn->client;
1305 session->homes_snum = -1;
1306
1307 status = smbXsrv_session_global_allocate(table->global.db_ctx,
1308 session,
1309 &global);
1310 if (!NT_STATUS_IS_OK(status)) {
1311 TALLOC_FREE(session);
1312 return status;
1313 }
1314 session->global = global;
1315
1316 if (conn->protocol >= PROTOCOL_SMB2_02) {
1317 uint64_t id = global->session_global_id;
1318
1319 global->connection_dialect = conn->smb2.server.dialect;
1320 global->client_guid = conn->smb2.client.guid;
1321
1322 global->session_wire_id = id;
1323
1324 status = smb2srv_tcon_table_init(session);
1325 if (!NT_STATUS_IS_OK(status)) {
1326 TALLOC_FREE(session);
1327 return status;
1328 }
1329
1330 session->local_id = global->session_global_id;
1331
1332 local_rec = smbXsrv_session_local_fetch_locked(
1333 table->local.db_ctx,
1334 session->local_id,
1335 session /* TALLOC_CTX */);
1336 if (local_rec == NULL) {
1337 TALLOC_FREE(session);
1338 return NT_STATUS_NO_MEMORY;
1339 }
1340
1341 val = dbwrap_record_get_value(local_rec);
1342 if (val.dsize != 0) {
1343 TALLOC_FREE(session);
1344 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1345 }
1346 } else {
1347
1348 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1349 table->local.lowest_id,
1350 table->local.highest_id,
1351 session,
1352 &local_rec,
1353 &session->local_id);
1354 if (!NT_STATUS_IS_OK(status)) {
1355 TALLOC_FREE(session);
1356 return status;
1357 }
1358
1359 global->session_wire_id = session->local_id;
1360 }
1361
1362 global->creation_time = now;
1363 global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1364
1365 status = smbXsrv_session_add_channel(session, conn, now, &channel);
1366 if (!NT_STATUS_IS_OK(status)) {
1367 TALLOC_FREE(session);
1368 return status;
1369 }
1370
1371 ptr = session;
1372 val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1373 status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1374 TALLOC_FREE(local_rec);
1375 if (!NT_STATUS_IS_OK(status)) {
1376 TALLOC_FREE(session);
1377 return status;
1378 }
1379 table->local.num_sessions += 1;
1380
1381 talloc_set_destructor(session, smbXsrv_session_destructor);
1382
1383 status = smbXsrv_session_global_store(global);
1384 if (!NT_STATUS_IS_OK(status)) {
1385 DBG_ERR("global_id (0x%08x) store failed - %s\n",
1386 session->global->session_global_id,
1387 nt_errstr(status));
1388 TALLOC_FREE(session);
1389 return status;
1390 }
1391
1392 if (DEBUGLVL(DBGLVL_DEBUG)) {
1393 struct smbXsrv_sessionB session_blob = {
1394 .version = SMBXSRV_VERSION_0,
1395 .info.info0 = session,
1396 };
1397
1398 DBG_DEBUG("global_id (0x%08x) stored\n",
1399 session->global->session_global_id);
1400 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1401 }
1402
1403 *_session = session;
1404 return NT_STATUS_OK;
1405 }
1406
1407 NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1408 struct smbXsrv_connection *conn,
1409 NTTIME now,
1410 struct smbXsrv_channel_global0 **_c)
1411 {
1412 struct smbXsrv_session_global0 *global = session->global;
1413 struct smbXsrv_channel_global0 *c = NULL;
1414
1415 if (global->num_channels > 31) {
1416 /*
1417 * Windows allow up to 32 channels
1418 */
1419 return NT_STATUS_INSUFFICIENT_RESOURCES;
1420 }
1421
1422 c = talloc_realloc(global,
1423 global->channels,
1424 struct smbXsrv_channel_global0,
1425 global->num_channels + 1);
1426 if (c == NULL) {
1427 return NT_STATUS_NO_MEMORY;
1428 }
1429 global->channels = c;
1430
1431 c = &global->channels[global->num_channels];
1432
1433 *c = (struct smbXsrv_channel_global0){
1434 .server_id = messaging_server_id(conn->client->msg_ctx),
1435 .channel_id = conn->channel_id,
1436 .creation_time = now,
1437 .connection = conn,
1438 };
1439
1440 c->local_address = tsocket_address_string(conn->local_address,
1441 global->channels);
1442 if (c->local_address == NULL) {
1443 return NT_STATUS_NO_MEMORY;
1444 }
1445 c->remote_address = tsocket_address_string(conn->remote_address,
1446 global->channels);
1447 if (c->remote_address == NULL) {
1448 return NT_STATUS_NO_MEMORY;
1449 }
1450 c->remote_name = talloc_strdup(global->channels,
1451 conn->remote_hostname);
1452 if (c->remote_name == NULL) {
1453 return NT_STATUS_NO_MEMORY;
1454 }
1455
1456 global->num_channels += 1;
1457
1458 *_c = c;
1459 return NT_STATUS_OK;
1460 }
1461
1462 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1463 {
1464 struct smbXsrv_session_table *table = session->table;
1465 NTSTATUS status;
1466
1467 if (session->global->db_rec != NULL) {
1468 DBG_ERR("smbXsrv_session_update(0x%08x): "
1469 "Called with db_rec != NULL'\n",
1470 session->global->session_global_id);
1471 return NT_STATUS_INTERNAL_ERROR;
1472 }
1473
1474 if (table == NULL) {
1475 DBG_ERR("smbXsrv_session_update(0x%08x): "
1476 "Called with table == NULL'\n",
1477 session->global->session_global_id);
1478 return NT_STATUS_INTERNAL_ERROR;
1479 }
1480
1481 session->global->db_rec = smbXsrv_session_global_fetch_locked(
1482 table->global.db_ctx,
1483 session->global->session_global_id,
1484 session->global /* TALLOC_CTX */);
1485 if (session->global->db_rec == NULL) {
1486 return NT_STATUS_INTERNAL_DB_ERROR;
1487 }
1488
1489 status = smbXsrv_session_global_store(session->global);
1490 if (!NT_STATUS_IS_OK(status)) {
1491 DBG_ERR("global_id (0x%08x) store failed - %s\n",
1492 session->global->session_global_id,
1493 nt_errstr(status));
1494 return status;
1495 }
1496
1497 if (DEBUGLVL(DBGLVL_DEBUG)) {
1498 struct smbXsrv_sessionB session_blob = {
1499 .version = SMBXSRV_VERSION_0,
1500 .info.info0 = session,
1501 };
1502
1503 DBG_DEBUG("global_id (0x%08x) stored\n",
1504 session->global->session_global_id);
1505 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1506 }
1507
1508 return NT_STATUS_OK;
1509 }
1510
1511 NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1512 const struct smbXsrv_connection *conn,
1513 struct smbXsrv_channel_global0 **_c)
1514 {
1515 uint32_t i;
1516
1517 for (i=0; i < session->global->num_channels; i++) {
1518 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1519
1520 if (c->channel_id != conn->channel_id) {
1521 continue;
1522 }
1523
1524 if (c->connection != conn) {
1525 continue;
1526 }
1527
1528 *_c = c;
1529 return NT_STATUS_OK;
1530 }
1531
1532 return NT_STATUS_USER_SESSION_DELETED;
1533 }
1534
1535 NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1536 const struct smbXsrv_connection *conn,
1537 NTTIME now,
1538 struct smbXsrv_session_auth0 **_a)
1539 {
1540 struct smbXsrv_session_auth0 *a;
1541
1542 for (a = session->pending_auth; a != NULL; a = a->next) {
1543 if (a->channel_id != conn->channel_id) {
1544 continue;
1545 }
1546
1547 if (a->connection == conn) {
1548 if (now != 0) {
1549 a->idle_time = now;
1550 }
1551 *_a = a;
1552 return NT_STATUS_OK;
1553 }
1554 }
1555
1556 return NT_STATUS_USER_SESSION_DELETED;
1557 }
1558
1559 static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1560 {
1561 if (a->session == NULL) {
1562 return 0;
1563 }
1564
1565 DLIST_REMOVE(a->session->pending_auth, a);
1566 a->session = NULL;
1567 return 0;
1568 }
1569
1570 NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1571 struct smbXsrv_connection *conn,
1572 NTTIME now,
1573 uint8_t in_flags,
1574 uint8_t in_security_mode,
1575 struct smbXsrv_session_auth0 **_a)
1576 {
1577 struct smbXsrv_session_auth0 *a;
1578 NTSTATUS status;
1579
1580 status = smbXsrv_session_find_auth(session, conn, 0, &a);
1581 if (NT_STATUS_IS_OK(status)) {
1582 return NT_STATUS_INTERNAL_ERROR;
1583 }
1584
1585 a = talloc(session, struct smbXsrv_session_auth0);
1586 if (a == NULL) {
1587 return NT_STATUS_NO_MEMORY;
1588 }
1589
1590 *a = (struct smbXsrv_session_auth0){
1591 .session = session,
1592 .connection = conn,
1593 .in_flags = in_flags,
1594 .in_security_mode = in_security_mode,
1595 .creation_time = now,
1596 .idle_time = now,
1597 .channel_id = conn->channel_id,
1598 };
1599
1600 if (conn->protocol >= PROTOCOL_SMB3_11) {
1601 a->preauth = talloc(a, struct smbXsrv_preauth);
1602 if (a->preauth == NULL) {
1603 TALLOC_FREE(session);
1604 return NT_STATUS_NO_MEMORY;
1605 }
1606 *a->preauth = conn->smb2.preauth;
1607 }
1608
1609 talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1610 DLIST_ADD_END(session->pending_auth, a);
1611
1612 *_a = a;
1613 return NT_STATUS_OK;
1614 }
1615
1616 static void smbXsrv_session_remove_channel_done(struct tevent_req *subreq);
1617
1618 NTSTATUS smbXsrv_session_remove_channel(struct smbXsrv_session *session,
1619 struct smbXsrv_connection *xconn)
1620 {
1621 struct smbXsrv_session_auth0 *a = NULL;
1622 struct smbXsrv_channel_global0 *c = NULL;
1623 NTSTATUS status;
1624 bool need_update = false;
1625
1626 status = smbXsrv_session_find_auth(session, xconn, 0, &a);
1627 if (!NT_STATUS_IS_OK(status)) {
1628 a = NULL;
1629 }
1630 status = smbXsrv_session_find_channel(session, xconn, &c);
1631 if (!NT_STATUS_IS_OK(status)) {
1632 c = NULL;
1633 }
1634
1635 if (a != NULL) {
1636 smbXsrv_session_auth0_destructor(a);
1637 a->connection = NULL;
1638 need_update = true;
1639 }
1640
1641 if (c != NULL) {
1642 struct smbXsrv_session_global0 *global = session->global;
1643 ptrdiff_t n;
1644
1645 n = (c - global->channels);
1646 if (n >= global->num_channels || n < 0) {
1647 return NT_STATUS_INTERNAL_ERROR;
1648 }
1649 ARRAY_DEL_ELEMENT(global->channels, n, global->num_channels);
1650 global->num_channels--;
1651 if (global->num_channels == 0) {
1652 struct smbXsrv_client *client = session->client;
1653 struct tevent_queue *xconn_wait_queue =
1654 xconn->transport.shutdown_wait_queue;
1655 struct tevent_req *subreq = NULL;
1656
1657 /*
1658 * Let the connection wait until the session is
1659 * destroyed.
1660 *
1661 * We don't set a callback, as we just want to block the
1662 * wait queue and the talloc_free() of the session will
1663 * remove the item from the wait queue in order
1664 * to remove allow the connection to disappear.
1665 */
1666 if (xconn_wait_queue != NULL) {
1667 subreq = tevent_queue_wait_send(session,
1668 client->raw_ev_ctx,
1669 xconn_wait_queue);
1670 if (subreq == NULL) {
1671 status = NT_STATUS_NO_MEMORY;
1672 DBG_ERR("tevent_queue_wait_send() "
1673 "session(%" PRIu64
1674 ") failed: %s\n",
1675 session->global
1676 ->session_wire_id,
1677 nt_errstr(status));
1678 return status;
1679 }
1680 }
1681
1682 /*
1683 * This is guaranteed to set
1684 * session->status = NT_STATUS_USER_SESSION_DELETED
1685 * even if NULL is returned.
1686 */
1687 subreq = smb2srv_session_shutdown_send(session,
1688 client->raw_ev_ctx,
1689 session,
1690 NULL);
1691 if (subreq == NULL) {
1692 status = NT_STATUS_NO_MEMORY;
1693 DBG_ERR("smb2srv_session_shutdown_send("
1694 "%" PRIu64 " failed: %s\n",
1695 session->global->session_wire_id,
1696 nt_errstr(status));
1697 return status;
1698 }
1699 tevent_req_set_callback(subreq,
1700 smbXsrv_session_remove_channel_done,
1701 session);
1702 }
1703 need_update = true;
1704 }
1705
1706 if (!need_update) {
1707 return NT_STATUS_OK;
1708 }
1709
1710 return smbXsrv_session_update(session);
1711 }
1712
1713 static void smbXsrv_session_remove_channel_done(struct tevent_req *subreq)
1714 {
1715 struct smbXsrv_session *session =
1716 tevent_req_callback_data(subreq,
1717 struct smbXsrv_session);
1718 NTSTATUS status;
1719
1720 status = smb2srv_session_shutdown_recv(subreq);
1721 TALLOC_FREE(subreq);
1722 if (!NT_STATUS_IS_OK(status)) {
1723 DBG_ERR("smb2srv_session_shutdown_recv(%" PRIu64
1724 ") failed: %s\n",
1725 session->global->session_wire_id,
1726 nt_errstr(status));
1727 }
1728
1729 status = smbXsrv_session_logoff(session);
1730 if (!NT_STATUS_IS_OK(status)) {
1731 DBG_ERR("smbXsrv_session_logoff(%" PRIu64 ") failed: %s\n",
1732 session->global->session_wire_id,
1733 nt_errstr(status));
1734 }
1735
1736 TALLOC_FREE(session);
1737 }
1738
1739 struct smb2srv_session_shutdown_state {
1740 struct tevent_queue *wait_queue;
1741 };
1742
1743 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1744
1745 struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1746 struct tevent_context *ev,
1747 struct smbXsrv_session *session,
1748 struct smbd_smb2_request *current_req)
1749 {
1750 struct tevent_req *req;
1751 struct smb2srv_session_shutdown_state *state;
1752 struct tevent_req *subreq;
1753 struct smbXsrv_connection *xconn = NULL;
1754 size_t len = 0;
1755
1756 /*
1757 * Make sure that no new request will be able to use this session.
1758 */
1759 session->status = NT_STATUS_USER_SESSION_DELETED;
1760
1761 req = tevent_req_create(mem_ctx, &state,
1762 struct smb2srv_session_shutdown_state);
1763 if (req == NULL) {
1764 return NULL;
1765 }
1766
1767 state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1768 if (tevent_req_nomem(state->wait_queue, req)) {
1769 return tevent_req_post(req, ev);
1770 }
1771
1772 for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1773 struct smbd_smb2_request *preq;
1774
1775 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1776 if (preq == current_req) {
1777 /* Can't cancel current request. */
1778 continue;
1779 }
1780 if (preq->session != session) {
1781 /* Request on different session. */
1782 continue;
1783 }
1784
1785 if (preq->subreq != NULL) {
1786 tevent_req_cancel(preq->subreq);
1787 }
1788
1789 /*
1790 * Now wait until the request is finished.
1791 *
1792 * We don't set a callback, as we just want to block the
1793 * wait queue and the talloc_free() of the request will
1794 * remove the item from the wait queue.
1795 */
1796 subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1797 if (tevent_req_nomem(subreq, req)) {
1798 return tevent_req_post(req, ev);
1799 }
1800 }
1801 }
1802
1803 len = tevent_queue_length(state->wait_queue);
1804 if (len == 0) {
1805 tevent_req_done(req);
1806 return tevent_req_post(req, ev);
1807 }
1808
1809 /*
1810 * Now we add our own waiter to the end of the queue,
1811 * this way we get notified when all pending requests are finished
1812 * and send to the socket.
1813 */
1814 subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1815 if (tevent_req_nomem(subreq, req)) {
1816 return tevent_req_post(req, ev);
1817 }
1818 tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1819
1820 return req;
1821 }
1822
1823 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1824 {
1825 struct tevent_req *req =
1826 tevent_req_callback_data(subreq,
1827 struct tevent_req);
1828
1829 tevent_queue_wait_recv(subreq);
1830 TALLOC_FREE(subreq);
1831
1832 tevent_req_done(req);
1833 }
1834
1835 NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1836 {
1837 return tevent_req_simple_recv_ntstatus(req);
1838 }
1839
1840 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1841 {
1842 struct smbXsrv_session_table *table;
1843 struct db_record *local_rec = NULL;
1844 struct db_record *global_rec = NULL;
1845 struct smbd_server_connection *sconn = NULL;
1846 NTSTATUS status;
1847 NTSTATUS error = NT_STATUS_OK;
1848
1849 if (session->table == NULL) {
1850 return NT_STATUS_OK;
1851 }
1852
1853 table = session->table;
1854 session->table = NULL;
1855
1856 sconn = session->client->sconn;
1857 session->client = NULL;
1858 session->status = NT_STATUS_USER_SESSION_DELETED;
1859
1860 /*
1861 * For SMB2 this is a bit redundant as files are also close
1862 * below via smb2srv_tcon_disconnect_all() -> ... ->
1863 * smbXsrv_tcon_disconnect() -> close_cnum() ->
1864 * file_close_conn().
1865 */
1866 file_close_user(sconn, session->global->session_wire_id);
1867
1868 if (session->tcon_table != NULL) {
1869 /*
1870 * Note: We only have a tcon_table for SMB2.
1871 */
1872 status = smb2srv_tcon_disconnect_all(session);
1873 if (!NT_STATUS_IS_OK(status)) {
1874 DBG_ERR("smbXsrv_session_logoff(0x%08x): "
1875 "smb2srv_tcon_disconnect_all() failed: %s\n",
1876 session->global->session_global_id,
1877 nt_errstr(status));
1878 error = status;
1879 }
1880 }
1881
1882 invalidate_vuid(sconn, session->global->session_wire_id);
1883
1884 global_rec = session->global->db_rec;
1885 session->global->db_rec = NULL;
1886 if (global_rec == NULL) {
1887 global_rec = smbXsrv_session_global_fetch_locked(
1888 table->global.db_ctx,
1889 session->global->session_global_id,
1890 session->global /* TALLOC_CTX */);
1891 if (global_rec == NULL) {
1892 error = NT_STATUS_INTERNAL_ERROR;
1893 }
1894 }
1895
1896 if (global_rec != NULL) {
1897 status = dbwrap_record_delete(global_rec);
1898 if (!NT_STATUS_IS_OK(status)) {
1899 TDB_DATA key = dbwrap_record_get_key(global_rec);
1900
1901 DBG_ERR("smbXsrv_session_logoff(0x%08x): "
1902 "failed to delete global key '%s': %s\n",
1903 session->global->session_global_id,
1904 tdb_data_dbg(key),
1905 nt_errstr(status));
1906 error = status;
1907 }
1908 }
1909 TALLOC_FREE(global_rec);
1910
1911 local_rec = session->db_rec;
1912 if (local_rec == NULL) {
1913 local_rec = smbXsrv_session_local_fetch_locked(
1914 table->local.db_ctx,
1915 session->local_id,
1916 session /* TALLOC_CTX */);
1917 if (local_rec == NULL) {
1918 error = NT_STATUS_INTERNAL_ERROR;
1919 }
1920 }
1921
1922 if (local_rec != NULL) {
1923 status = dbwrap_record_delete(local_rec);
1924 if (!NT_STATUS_IS_OK(status)) {
1925 TDB_DATA key = dbwrap_record_get_key(local_rec);
1926
1927 DBG_ERR("smbXsrv_session_logoff(0x%08x): "
1928 "failed to delete local key '%s': %s\n",
1929 session->global->session_global_id,
1930 tdb_data_dbg(key),
1931 nt_errstr(status));
1932 error = status;
1933 }
1934 table->local.num_sessions -= 1;
1935 }
1936 if (session->db_rec == NULL) {
1937 TALLOC_FREE(local_rec);
1938 }
1939 session->db_rec = NULL;
1940
1941 return error;
1942 }
1943
1944 struct smbXsrv_session_logoff_all_state {
1945 NTSTATUS first_status;
1946 int errors;
1947 };
1948
1949 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1950 void *private_data);
1951
1952 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_client *client)
1953 {
1954 struct smbXsrv_session_table *table = client->session_table;
1955 struct smbXsrv_session_logoff_all_state state = {};
1956 NTSTATUS status;
1957 int count = 0;
1958
1959 if (table == NULL) {
1960 DBG_DEBUG("empty session_table, nothing to do.\n");
1961 return NT_STATUS_OK;
1962 }
1963
1964 status = dbwrap_traverse(table->local.db_ctx,
1965 smbXsrv_session_logoff_all_callback,
1966 &state, &count);
1967 if (!NT_STATUS_IS_OK(status)) {
1968 DBG_ERR("dbwrap_traverse() failed: %s\n", nt_errstr(status));
1969 return status;
1970 }
1971
1972 if (!NT_STATUS_IS_OK(state.first_status)) {
1973 DBG_ERR("count[%d] errors[%d] first[%s]\n",
1974 count,
1975 state.errors,
1976 nt_errstr(state.first_status));
1977 return state.first_status;
1978 }
1979
1980 return NT_STATUS_OK;
1981 }
1982
1983 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1984 void *private_data)
1985 {
1986 struct smbXsrv_session_logoff_all_state *state =
1987 (struct smbXsrv_session_logoff_all_state *)private_data;
1988 TDB_DATA val;
1989 void *ptr = NULL;
1990 struct smbXsrv_session *session = NULL;
1991 NTSTATUS status;
1992
1993 val = dbwrap_record_get_value(local_rec);
1994 if (val.dsize != sizeof(ptr)) {
1995 status = NT_STATUS_INTERNAL_ERROR;
1996 if (NT_STATUS_IS_OK(state->first_status)) {
1997 state->first_status = status;
1998 }
1999 state->errors++;
2000 return 0;
2001 }
2002
2003 memcpy(&ptr, val.dptr, val.dsize);
2004 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
2005
2006 session->db_rec = local_rec;
2007 status = smbXsrv_session_clear_and_logoff(session);
2008 session->db_rec = NULL;
2009 if (!NT_STATUS_IS_OK(status)) {
2010 if (NT_STATUS_IS_OK(state->first_status)) {
2011 state->first_status = status;
2012 }
2013 state->errors++;
2014 return 0;
2015 }
2016
2017 return 0;
2018 }
2019
2020 struct smbXsrv_session_local_trav_state {
2021 NTSTATUS status;
2022 int (*caller_cb)(struct smbXsrv_session *session,
2023 void *caller_data);
2024 void *caller_data;
2025 };
2026
2027 static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
2028 void *private_data);
2029
2030 NTSTATUS smbXsrv_session_local_traverse(
2031 struct smbXsrv_client *client,
2032 int (*caller_cb)(struct smbXsrv_session *session,
2033 void *caller_data),
2034 void *caller_data)
2035 {
2036 struct smbXsrv_session_table *table = client->session_table;
2037 struct smbXsrv_session_local_trav_state state;
2038 NTSTATUS status;
2039 int count = 0;
2040
2041 state = (struct smbXsrv_session_local_trav_state) {
2042 .status = NT_STATUS_OK,
2043 .caller_cb = caller_cb,
2044 .caller_data = caller_data,
2045 };
2046
2047 if (table == NULL) {
2048 DBG_DEBUG("empty session_table, nothing to do.\n");
2049 return NT_STATUS_OK;
2050 }
2051
2052 status = dbwrap_traverse(table->local.db_ctx,
2053 smbXsrv_session_local_traverse_cb,
2054 &state,
2055 &count);
2056 if (!NT_STATUS_IS_OK(status)) {
2057 DBG_ERR("dbwrap_traverse() failed: %s\n", nt_errstr(status));
2058 return status;
2059 }
2060 if (!NT_STATUS_IS_OK(state.status)) {
2061 DBG_ERR("count[%d] status[%s]\n",
2062 count, nt_errstr(state.status));
2063 return state.status;
2064 }
2065
2066 return NT_STATUS_OK;
2067 }
2068
2069 static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
2070 void *private_data)
2071 {
2072 struct smbXsrv_session_local_trav_state *state =
2073 (struct smbXsrv_session_local_trav_state *)private_data;
2074 TDB_DATA val;
2075 void *ptr = NULL;
2076 struct smbXsrv_session *session = NULL;
2077 int ret;
2078
2079 val = dbwrap_record_get_value(local_rec);
2080 if (val.dsize != sizeof(ptr)) {
2081 state->status = NT_STATUS_INTERNAL_ERROR;
2082 return -1;
2083 }
2084
2085 memcpy(&ptr, val.dptr, val.dsize);
2086 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
2087
2088 session->db_rec = local_rec;
2089 ret = state->caller_cb(session, state->caller_data);
2090 session->db_rec = NULL;
2091
2092 return ret;
2093 }
2094
2095 struct smbXsrv_session_disconnect_xconn_state {
2096 struct smbXsrv_connection *xconn;
2097 NTSTATUS first_status;
2098 int errors;
2099 };
2100
2101 static int smbXsrv_session_disconnect_xconn_callback(struct db_record *local_rec,
2102 void *private_data);
2103
2104 NTSTATUS smbXsrv_session_disconnect_xconn(struct smbXsrv_connection *xconn)
2105 {
2106 struct smbXsrv_client *client = xconn->client;
2107 struct smbXsrv_session_table *table = client->session_table;
2108 struct smbXsrv_session_disconnect_xconn_state state = {
2109 .xconn = xconn,
2110 };
2111 NTSTATUS status;
2112 int count = 0;
2113
2114 if (table == NULL) {
2115 DBG_ERR("empty session_table, nothing to do.\n");
2116 return NT_STATUS_OK;
2117 }
2118
2119 status = dbwrap_traverse(table->local.db_ctx,
2120 smbXsrv_session_disconnect_xconn_callback,
2121 &state, &count);
2122 if (!NT_STATUS_IS_OK(status)) {
2123 DBG_ERR("dbwrap_traverse() failed: %s\n",
2124 nt_errstr(status));
2125 return status;
2126 }
2127
2128 if (!NT_STATUS_IS_OK(state.first_status)) {
2129 DBG_ERR("count[%d] errors[%d] first[%s]\n",
2130 count, state.errors,
2131 nt_errstr(state.first_status));
2132 return state.first_status;
2133 }
2134
2135 return NT_STATUS_OK;
2136 }
2137
2138 static int smbXsrv_session_disconnect_xconn_callback(struct db_record *local_rec,
2139 void *private_data)
2140 {
2141 struct smbXsrv_session_disconnect_xconn_state *state =
2142 (struct smbXsrv_session_disconnect_xconn_state *)private_data;
2143 TDB_DATA val;
2144 void *ptr = NULL;
2145 struct smbXsrv_session *session = NULL;
2146 NTSTATUS status;
2147
2148 val = dbwrap_record_get_value(local_rec);
2149 if (val.dsize != sizeof(ptr)) {
2150 status = NT_STATUS_INTERNAL_ERROR;
2151 if (NT_STATUS_IS_OK(state->first_status)) {
2152 state->first_status = status;
2153 }
2154 state->errors++;
2155 return 0;
2156 }
2157
2158 memcpy(&ptr, val.dptr, val.dsize);
2159 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
2160
2161 session->db_rec = local_rec;
2162 status = smbXsrv_session_remove_channel(session, state->xconn);
2163 session->db_rec = NULL;
2164 if (!NT_STATUS_IS_OK(status)) {
2165 if (NT_STATUS_IS_OK(state->first_status)) {
2166 state->first_status = status;
2167 }
2168 state->errors++;
2169 }
2170
2171 return 0;
2172 }
2173
2174 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
2175 {
2176 /*
2177 * Allow a range from 1..65534 with 65534 values.
2178 */
2179 return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
2180 UINT16_MAX - 1);
2181 }
2182
2183 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
2184 uint16_t vuid, NTTIME now,
2185 struct smbXsrv_session **session)
2186 {
2187 struct smbXsrv_session_table *table = conn->client->session_table;
2188 uint32_t local_id = vuid;
2189
2190 return smbXsrv_session_local_lookup(table, conn, local_id, now,
2191 session);
2192 }
2193
2194 NTSTATUS smbXsrv_session_info_lookup(struct smbXsrv_client *client,
2195 uint64_t session_wire_id,
2196 struct auth_session_info **si)
2197 {
2198 struct smbXsrv_session_table *table = client->session_table;
2199 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
2200 struct smbXsrv_session_local_fetch_state state = {
2201 .session = NULL,
2202 .status = NT_STATUS_INTERNAL_ERROR,
2203 };
2204 TDB_DATA key;
2205 NTSTATUS status;
2206
2207 if (session_wire_id == 0) {
2208 return NT_STATUS_USER_SESSION_DELETED;
2209 }
2210
2211 if (table == NULL) {
2212 /* this might happen before the end of negprot */
2213 return NT_STATUS_USER_SESSION_DELETED;
2214 }
2215
2216 if (table->local.db_ctx == NULL) {
2217 return NT_STATUS_INTERNAL_ERROR;
2218 }
2219
2220 key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
2221
2222 status = dbwrap_parse_record(table->local.db_ctx, key,
2223 smbXsrv_session_local_fetch_parser,
2224 &state);
2225 if (!NT_STATUS_IS_OK(status)) {
2226 return status;
2227 }
2228 if (!NT_STATUS_IS_OK(state.status)) {
2229 return state.status;
2230 }
2231 if (state.session->global->auth_session_info == NULL) {
2232 return NT_STATUS_USER_SESSION_DELETED;
2233 }
2234
2235 *si = state.session->global->auth_session_info;
2236 return NT_STATUS_OK;
2237 }
2238
2239 /*
2240 * In memory of get_valid_user_struct()
2241 *
2242 * This function is similar to smbXsrv_session_local_lookup() and it's wrappers,
2243 * but it doesn't implement the state checks of
2244 * those. get_valid_smbXsrv_session() is NOT meant to be called to validate the
2245 * session wire-id of incoming SMB requests, it MUST only be used in later
2246 * internal processing where the session wire-id has already been validated.
2247 */
2248 NTSTATUS get_valid_smbXsrv_session(struct smbXsrv_client *client,
2249 uint64_t session_wire_id,
2250 struct smbXsrv_session **session)
2251 {
2252 struct smbXsrv_session_table *table = client->session_table;
2253 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
2254 struct smbXsrv_session_local_fetch_state state = {
2255 .session = NULL,
2256 .status = NT_STATUS_INTERNAL_ERROR,
2257 };
2258 TDB_DATA key;
2259 NTSTATUS status;
2260
2261 if (session_wire_id == 0) {
2262 return NT_STATUS_USER_SESSION_DELETED;
2263 }
2264
2265 if (table == NULL) {
2266 /* this might happen before the end of negprot */
2267 return NT_STATUS_USER_SESSION_DELETED;
2268 }
2269
2270 if (table->local.db_ctx == NULL) {
2271 return NT_STATUS_INTERNAL_ERROR;
2272 }
2273
2274 key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
2275
2276 status = dbwrap_parse_record(table->local.db_ctx, key,
2277 smbXsrv_session_local_fetch_parser,
2278 &state);
2279 if (!NT_STATUS_IS_OK(status)) {
2280 return status;
2281 }
2282 if (!NT_STATUS_IS_OK(state.status)) {
2283 return state.status;
2284 }
2285 if (state.session->global->auth_session_info == NULL) {
2286 return NT_STATUS_USER_SESSION_DELETED;
2287 }
2288
2289 *session = state.session;
2290 return NT_STATUS_OK;
2291 }
2292
2293 NTSTATUS smb2srv_session_lookup_global(struct smbXsrv_client *client,
2294 uint64_t session_wire_id,
2295 TALLOC_CTX *mem_ctx,
2296 struct smbXsrv_session **_session)
2297 {
2298 TALLOC_CTX *frame = talloc_stackframe();
2299 struct smbXsrv_session_table *table = client->session_table;
2300 uint32_t global_id = session_wire_id & UINT32_MAX;
2301 uint64_t global_zeros = session_wire_id & 0xFFFFFFFF00000000LLU;
2302 struct smbXsrv_session *session = NULL;
2303 struct db_record *global_rec = NULL;
2304 bool is_free = false;
2305 NTSTATUS status;
2306
2307 if (global_id == 0) {
2308 TALLOC_FREE(frame);
2309 return NT_STATUS_USER_SESSION_DELETED;
2310 }
2311 if (global_zeros != 0) {
2312 TALLOC_FREE(frame);
2313 return NT_STATUS_USER_SESSION_DELETED;
2314 }
2315
2316 if (table == NULL) {
2317 /* this might happen before the end of negprot */
2318 TALLOC_FREE(frame);
2319 return NT_STATUS_USER_SESSION_DELETED;
2320 }
2321
2322 if (table->global.db_ctx == NULL) {
2323 TALLOC_FREE(frame);
2324 return NT_STATUS_INTERNAL_ERROR;
2325 }
2326
2327 session = talloc_zero(mem_ctx, struct smbXsrv_session);
2328 if (session == NULL) {
2329 TALLOC_FREE(frame);
2330 return NT_STATUS_NO_MEMORY;
2331 }
2332 talloc_steal(frame, session);
2333
2334 session->client = client;
2335 session->status = NT_STATUS_BAD_LOGON_SESSION_STATE;
2336 session->local_id = global_id;
2337
2338 /*
2339 * This means smb2_get_new_nonce() will return
2340 * NT_STATUS_ENCRYPTION_FAILED.
2341 *
2342 * But we initialize some random parts just in case...
2343 */
2344 session->nonce_high_max = session->nonce_high = 0;
2345 generate_nonce_buffer((uint8_t *)&session->nonce_high_random,
2346 sizeof(session->nonce_high_random));
2347 generate_nonce_buffer((uint8_t *)&session->nonce_low,
2348 sizeof(session->nonce_low));
2349
2350 global_rec = smbXsrv_session_global_fetch_locked(table->global.db_ctx,
2351 global_id,
2352 frame);
2353 if (global_rec == NULL) {
2354 TALLOC_FREE(frame);
2355 return NT_STATUS_INTERNAL_DB_ERROR;
2356 }
2357
2358 smbXsrv_session_global_verify_record(global_rec,
2359 &is_free,
2360 NULL,
2361 session,
2362 &session->global,
2363 NULL);
2364 if (is_free) {
2365 TALLOC_FREE(frame);
2366 return NT_STATUS_USER_SESSION_DELETED;
2367 }
2368
2369 /*
2370 * We don't have channels on this session
2371 * and only the main signing key
2372 */
2373 session->global->num_channels = 0;
2374 status = smb2_signing_key_sign_create(session->global,
2375 session->global->signing_algo,
2376 NULL, /* no master key */
2377 NULL, /* derivations */
2378 &session->global->signing_key);
2379 if (!NT_STATUS_IS_OK(status)) {
2380 TALLOC_FREE(frame);
2381 return NT_STATUS_NO_MEMORY;
2382 }
2383 session->global->signing_key->blob = session->global->signing_key_blob;
2384 session->global->signing_flags = 0;
2385
2386 status = smb2_signing_key_cipher_create(session->global,
2387 session->global->encryption_cipher,
2388 NULL, /* no master key */
2389 NULL, /* derivations */
2390 &session->global->decryption_key);
2391 if (!NT_STATUS_IS_OK(status)) {
2392 TALLOC_FREE(frame);
2393 return NT_STATUS_NO_MEMORY;
2394 }
2395 session->global->decryption_key->blob = session->global->decryption_key_blob;
2396 session->global->encryption_flags = 0;
2397
2398 *_session = talloc_move(mem_ctx, &session);
2399 TALLOC_FREE(frame);
2400 return NT_STATUS_OK;
2401 }
2402
2403 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
2404 {
2405 /*
2406 * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
2407 */
2408 return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
2409 UINT16_MAX - 1);
2410 }
2411
2412 static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
2413 /* conn: optional */
2414 struct smbXsrv_connection *conn,
2415 uint64_t session_id, NTTIME now,
2416 struct smbXsrv_session **session)
2417 {
2418 uint32_t local_id = session_id & UINT32_MAX;
2419 uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
2420
2421 if (local_zeros != 0) {
2422 return NT_STATUS_USER_SESSION_DELETED;
2423 }
2424
2425 return smbXsrv_session_local_lookup(table, conn, local_id, now,
2426 session);
2427 }
2428
2429 NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
2430 uint64_t session_id, NTTIME now,
2431 struct smbXsrv_session **session)
2432 {
2433 struct smbXsrv_session_table *table = conn->client->session_table;
2434 return smb2srv_session_lookup_raw(table, conn, session_id, now,
2435 session);
2436 }
2437
2438 NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
2439 uint64_t session_id, NTTIME now,
2440 struct smbXsrv_session **session)
2441 {
2442 struct smbXsrv_session_table *table = client->session_table;
2443 return smb2srv_session_lookup_raw(table, NULL, session_id, now,
2444 session);
2445 }
2446
2447 struct smbXsrv_session_global_traverse_state {
2448 int (*fn)(struct smbXsrv_session_global0 *, void *);
2449 void *private_data;
2450 };
2451
2452 static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
2453 {
2454 int ret = -1;
2455 struct smbXsrv_session_global_traverse_state *state =
2456 (struct smbXsrv_session_global_traverse_state*)data;
2457 TDB_DATA key = dbwrap_record_get_key(rec);
2458 TDB_DATA val = dbwrap_record_get_value(rec);
2459 DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
2460 struct smbXsrv_session_globalB global_blob;
2461 enum ndr_err_code ndr_err;
2462 TALLOC_CTX *frame = talloc_stackframe();
2463
2464 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
2465 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
2466 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2467 DBG_WARNING("Invalid record in smbXsrv_session_global.tdb:"
2468 "key '%s' ndr_pull_struct_blob - %s\n",
2469 tdb_data_dbg(key),
2470 ndr_errstr(ndr_err));
2471 goto done;
2472 }
2473
2474 if (global_blob.version != SMBXSRV_VERSION_0) {
2475 DBG_WARNING("Invalid record in smbXsrv_session_global.tdb:"
2476 "key '%s' unsupported version - %d\n",
2477 tdb_data_dbg(key),
2478 (int)global_blob.version);
2479 goto done;
2480 }
2481
2482 if (global_blob.info.info0 == NULL) {
2483 DBG_WARNING("Invalid record in smbXsrv_tcon_global.tdb:"
2484 "key '%s' info0 NULL pointer\n",
2485 tdb_data_dbg(key));
2486 goto done;
2487 }
2488
2489 global_blob.info.info0->db_rec = rec;
2490 ret = state->fn(global_blob.info.info0, state->private_data);
2491 done:
2492 TALLOC_FREE(frame);
2493 return ret;
2494 }
2495
2496 NTSTATUS smbXsrv_session_global_traverse(
2497 int (*fn)(struct smbXsrv_session_global0 *, void *),
2498 void *private_data)
2499 {
2500
2501 NTSTATUS status;
2502 int count = 0;
2503 struct smbXsrv_session_global_traverse_state state = {
2504 .fn = fn,
2505 .private_data = private_data,
2506 };
2507
2508 become_root();
2509 status = smbXsrv_session_global_init(NULL);
2510 if (!NT_STATUS_IS_OK(status)) {
2511 unbecome_root();
2512 DBG_ERR("Failed to initialize session_global: %s\n",
2513 nt_errstr(status));
2514 return status;
2515 }
2516
2517 status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
2518 smbXsrv_session_global_traverse_fn,
2519 &state,
2520 &count);
2521 unbecome_root();
2522
2523 return status;
2524 }
Samba GIT mirror