2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../lib/tsocket/tsocket.h"
28 #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)
30 static const char *smb2_names
[] = {
52 const char *smb2_opcode_name(uint16_t opcode
)
55 return "Bad SMB2 opcode";
57 return smb2_names
[opcode
];
60 static void print_req_vectors(struct smbd_smb2_request
*req
)
64 for (i
= 0; i
< req
->in
.vector_count
; i
++) {
65 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
67 (unsigned int)req
->in
.vector
[i
].iov_len
);
69 for (i
= 0; i
< req
->out
.vector_count
; i
++) {
70 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
72 (unsigned int)req
->out
.vector
[i
].iov_len
);
76 bool smbd_is_smb2_header(const uint8_t *inbuf
, size_t size
)
78 if (size
< (4 + SMB2_HDR_BODY
)) {
82 if (IVAL(inbuf
, 4) != SMB2_MAGIC
) {
89 static NTSTATUS
smbd_initialize_smb2(struct smbd_server_connection
*sconn
)
94 TALLOC_FREE(sconn
->smb1
.fde
);
96 sconn
->smb2
.event_ctx
= smbd_event_context();
98 sconn
->smb2
.recv_queue
= tevent_queue_create(sconn
, "smb2 recv queue");
99 if (sconn
->smb2
.recv_queue
== NULL
) {
100 return NT_STATUS_NO_MEMORY
;
103 sconn
->smb2
.send_queue
= tevent_queue_create(sconn
, "smb2 send queue");
104 if (sconn
->smb2
.send_queue
== NULL
) {
105 return NT_STATUS_NO_MEMORY
;
108 sconn
->smb2
.sessions
.idtree
= idr_init(sconn
);
109 if (sconn
->smb2
.sessions
.idtree
== NULL
) {
110 return NT_STATUS_NO_MEMORY
;
112 sconn
->smb2
.sessions
.limit
= 0x0000FFFE;
113 sconn
->smb2
.sessions
.list
= NULL
;
114 sconn
->smb2
.seqnum_low
= 0;
115 sconn
->smb2
.credits_granted
= 0;
116 sconn
->smb2
.max_credits
= lp_smb2_max_credits();
117 sconn
->smb2
.credits_bitmap
= bitmap_talloc(sconn
,
118 DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR
*sconn
->smb2
.max_credits
);
119 if (sconn
->smb2
.credits_bitmap
== NULL
) {
120 return NT_STATUS_NO_MEMORY
;
123 ret
= tstream_bsd_existing_socket(sconn
, sconn
->sock
,
124 &sconn
->smb2
.stream
);
126 status
= map_nt_error_from_unix(errno
);
130 /* Ensure child is set to non-blocking mode */
131 set_blocking(sconn
->sock
, false);
135 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
136 #define _smb2_setlen(_buf,len) do { \
137 uint8_t *buf = (uint8_t *)_buf; \
139 buf[1] = ((len)&0xFF0000)>>16; \
140 buf[2] = ((len)&0xFF00)>>8; \
141 buf[3] = (len)&0xFF; \
144 static void smb2_setup_nbt_length(struct iovec
*vector
, int count
)
149 for (i
=1; i
< count
; i
++) {
150 len
+= vector
[i
].iov_len
;
153 _smb2_setlen(vector
[0].iov_base
, len
);
156 static int smbd_smb2_request_parent_destructor(struct smbd_smb2_request
**req
)
159 (*req
)->parent
= NULL
;
160 (*req
)->mem_pool
= NULL
;
166 static int smbd_smb2_request_destructor(struct smbd_smb2_request
*req
)
170 talloc_free(req
->mem_pool
);
176 static struct smbd_smb2_request
*smbd_smb2_request_allocate(TALLOC_CTX
*mem_ctx
)
178 TALLOC_CTX
*mem_pool
;
179 struct smbd_smb2_request
**parent
;
180 struct smbd_smb2_request
*req
;
183 /* Enable this to find subtle valgrind errors. */
184 mem_pool
= talloc_init("smbd_smb2_request_allocate");
186 mem_pool
= talloc_pool(mem_ctx
, 8192);
188 if (mem_pool
== NULL
) {
192 parent
= talloc(mem_pool
, struct smbd_smb2_request
*);
193 if (parent
== NULL
) {
194 talloc_free(mem_pool
);
198 req
= talloc_zero(parent
, struct smbd_smb2_request
);
200 talloc_free(mem_pool
);
204 req
->mem_pool
= mem_pool
;
205 req
->parent
= parent
;
207 talloc_set_destructor(parent
, smbd_smb2_request_parent_destructor
);
208 talloc_set_destructor(req
, smbd_smb2_request_destructor
);
213 static NTSTATUS
smbd_smb2_request_create(struct smbd_server_connection
*sconn
,
214 const uint8_t *inbuf
, size_t size
,
215 struct smbd_smb2_request
**_req
)
217 struct smbd_smb2_request
*req
;
218 uint32_t protocol_version
;
219 const uint8_t *inhdr
= NULL
;
222 uint32_t next_command_ofs
;
224 if (size
< (4 + SMB2_HDR_BODY
+ 2)) {
225 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size
));
226 return NT_STATUS_INVALID_PARAMETER
;
231 protocol_version
= IVAL(inhdr
, SMB2_HDR_PROTOCOL_ID
);
232 if (protocol_version
!= SMB2_MAGIC
) {
233 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
235 return NT_STATUS_INVALID_PARAMETER
;
238 cmd
= SVAL(inhdr
, SMB2_HDR_OPCODE
);
239 if (cmd
!= SMB2_OP_NEGPROT
) {
240 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
242 return NT_STATUS_INVALID_PARAMETER
;
245 next_command_ofs
= IVAL(inhdr
, SMB2_HDR_NEXT_COMMAND
);
246 if (next_command_ofs
!= 0) {
247 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
249 return NT_STATUS_INVALID_PARAMETER
;
252 req
= smbd_smb2_request_allocate(sconn
);
254 return NT_STATUS_NO_MEMORY
;
258 talloc_steal(req
, inbuf
);
260 req
->in
.vector
= talloc_array(req
, struct iovec
, 4);
261 if (req
->in
.vector
== NULL
) {
263 return NT_STATUS_NO_MEMORY
;
265 req
->in
.vector_count
= 4;
267 memcpy(req
->in
.nbt_hdr
, inbuf
, 4);
270 req
->in
.vector
[0].iov_base
= (void *)req
->in
.nbt_hdr
;
271 req
->in
.vector
[0].iov_len
= 4;
272 ofs
+= req
->in
.vector
[0].iov_len
;
274 req
->in
.vector
[1].iov_base
= (void *)(inbuf
+ ofs
);
275 req
->in
.vector
[1].iov_len
= SMB2_HDR_BODY
;
276 ofs
+= req
->in
.vector
[1].iov_len
;
278 req
->in
.vector
[2].iov_base
= (void *)(inbuf
+ ofs
);
279 req
->in
.vector
[2].iov_len
= SVAL(inbuf
, ofs
) & 0xFFFE;
280 ofs
+= req
->in
.vector
[2].iov_len
;
283 return NT_STATUS_INVALID_PARAMETER
;
286 req
->in
.vector
[3].iov_base
= (void *)(inbuf
+ ofs
);
287 req
->in
.vector
[3].iov_len
= size
- ofs
;
288 ofs
+= req
->in
.vector
[3].iov_len
;
290 req
->current_idx
= 1;
296 static bool smb2_validate_message_id(struct smbd_server_connection
*sconn
,
297 const uint8_t *inhdr
)
299 uint64_t message_id
= BVAL(inhdr
, SMB2_HDR_MESSAGE_ID
);
300 struct bitmap
*credits_bm
= sconn
->smb2
.credits_bitmap
;
301 uint16_t opcode
= IVAL(inhdr
, SMB2_HDR_OPCODE
);
302 unsigned int bitmap_offset
;
304 if (opcode
== SMB2_OP_CANCEL
) {
305 /* SMB2_CANCEL requests by definition resend messageids. */
309 if (message_id
< sconn
->smb2
.seqnum_low
||
310 message_id
> (sconn
->smb2
.seqnum_low
+
311 (sconn
->smb2
.max_credits
* DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR
))) {
312 DEBUG(0,("smb2_validate_message_id: bad message_id "
313 "%llu (low = %llu, max = %lu)\n",
314 (unsigned long long)message_id
,
315 (unsigned long long)sconn
->smb2
.seqnum_low
,
316 (unsigned long)sconn
->smb2
.max_credits
));
320 /* client just used a credit. */
321 SMB_ASSERT(sconn
->smb2
.credits_granted
> 0);
322 sconn
->smb2
.credits_granted
-= 1;
324 /* Mark the message_id as seen in the bitmap. */
325 bitmap_offset
= (unsigned int)(message_id
%
326 (uint64_t)(sconn
->smb2
.max_credits
* DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR
));
327 if (bitmap_query(credits_bm
, bitmap_offset
)) {
328 DEBUG(0,("smb2_validate_message_id: duplicate message_id "
329 "%llu (bm offset %u)\n",
330 (unsigned long long)message_id
,
334 bitmap_set(credits_bm
, bitmap_offset
);
336 if (message_id
== sconn
->smb2
.seqnum_low
+ 1) {
337 /* Move the window forward by all the message_id's
339 while (bitmap_query(credits_bm
, bitmap_offset
)) {
340 DEBUG(10,("smb2_validate_message_id: clearing "
341 "id %llu (position %u) from bitmap\n",
342 (unsigned long long)(sconn
->smb2
.seqnum_low
+ 1),
344 bitmap_clear(credits_bm
, bitmap_offset
);
345 sconn
->smb2
.seqnum_low
+= 1;
346 bitmap_offset
= (bitmap_offset
+ 1) %
347 (sconn
->smb2
.max_credits
* DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR
);
354 static NTSTATUS
smbd_smb2_request_validate(struct smbd_smb2_request
*req
)
358 bool compound_related
= false;
360 count
= req
->in
.vector_count
;
363 /* It's not a SMB2 request */
364 return NT_STATUS_INVALID_PARAMETER
;
367 for (idx
=1; idx
< count
; idx
+= 3) {
368 const uint8_t *inhdr
= NULL
;
371 if (req
->in
.vector
[idx
].iov_len
!= SMB2_HDR_BODY
) {
372 return NT_STATUS_INVALID_PARAMETER
;
375 if (req
->in
.vector
[idx
+1].iov_len
< 2) {
376 return NT_STATUS_INVALID_PARAMETER
;
379 inhdr
= (const uint8_t *)req
->in
.vector
[idx
].iov_base
;
381 /* Check the SMB2 header */
382 if (IVAL(inhdr
, SMB2_HDR_PROTOCOL_ID
) != SMB2_MAGIC
) {
383 return NT_STATUS_INVALID_PARAMETER
;
386 if (!smb2_validate_message_id(req
->sconn
, inhdr
)) {
387 return NT_STATUS_INVALID_PARAMETER
;
390 flags
= IVAL(inhdr
, SMB2_HDR_FLAGS
);
393 * the 1st request should never have the
394 * SMB2_HDR_FLAG_CHAINED flag set
396 if (flags
& SMB2_HDR_FLAG_CHAINED
) {
397 req
->next_status
= NT_STATUS_INVALID_PARAMETER
;
400 } else if (idx
== 4) {
402 * the 2nd request triggers related vs. unrelated
403 * compounded requests
405 if (flags
& SMB2_HDR_FLAG_CHAINED
) {
406 compound_related
= true;
408 } else if (idx
> 4) {
411 * It seems the this tests are wrong
412 * see the SMB2-COMPOUND test
416 * all other requests should match the 2nd one
418 if (flags
& SMB2_HDR_FLAG_CHAINED
) {
419 if (!compound_related
) {
421 NT_STATUS_INVALID_PARAMETER
;
425 if (compound_related
) {
427 NT_STATUS_INVALID_PARAMETER
;
438 static void smb2_set_operation_credit(struct smbd_server_connection
*sconn
,
439 const struct iovec
*in_vector
,
440 struct iovec
*out_vector
)
442 uint8_t *outhdr
= (uint8_t *)out_vector
->iov_base
;
443 uint16_t credits_requested
= 0;
444 uint16_t credits_granted
= 0;
446 if (in_vector
!= NULL
) {
447 const uint8_t *inhdr
= (const uint8_t *)in_vector
->iov_base
;
448 credits_requested
= SVAL(inhdr
, SMB2_HDR_CREDIT
);
451 SMB_ASSERT(sconn
->smb2
.max_credits
>= sconn
->smb2
.credits_granted
);
453 /* Remember what we gave out. */
454 credits_granted
= MIN(credits_requested
, (sconn
->smb2
.max_credits
-
455 sconn
->smb2
.credits_granted
));
457 if (credits_granted
== 0 && sconn
->smb2
.credits_granted
== 0) {
458 /* First negprot packet, or ensure the client credits can
459 never drop to zero. */
463 SSVAL(outhdr
, SMB2_HDR_CREDIT
, credits_granted
);
464 sconn
->smb2
.credits_granted
+= credits_granted
;
466 DEBUG(10,("smb2_set_operation_credit: requested %u, "
467 "granted %u, total granted %u\n",
468 (unsigned int)credits_requested
,
469 (unsigned int)credits_granted
,
470 (unsigned int)sconn
->smb2
.credits_granted
));
473 static void smb2_calculate_credits(const struct smbd_smb2_request
*inreq
,
474 struct smbd_smb2_request
*outreq
)
478 count
= outreq
->out
.vector_count
;
480 for (idx
=1; idx
< count
; idx
+= 3) {
481 smb2_set_operation_credit(outreq
->sconn
,
482 &inreq
->in
.vector
[idx
],
483 &outreq
->out
.vector
[idx
]);
487 static NTSTATUS
smbd_smb2_request_setup_out(struct smbd_smb2_request
*req
)
489 struct iovec
*vector
;
493 count
= req
->in
.vector_count
;
494 vector
= talloc_zero_array(req
, struct iovec
, count
);
495 if (vector
== NULL
) {
496 return NT_STATUS_NO_MEMORY
;
499 vector
[0].iov_base
= req
->out
.nbt_hdr
;
500 vector
[0].iov_len
= 4;
501 SIVAL(req
->out
.nbt_hdr
, 0, 0);
503 for (idx
=1; idx
< count
; idx
+= 3) {
504 const uint8_t *inhdr
= NULL
;
506 uint8_t *outhdr
= NULL
;
507 uint8_t *outbody
= NULL
;
508 uint32_t next_command_ofs
= 0;
509 struct iovec
*current
= &vector
[idx
];
511 if ((idx
+ 3) < count
) {
512 /* we have a next command -
513 * setup for the error case. */
514 next_command_ofs
= SMB2_HDR_BODY
+ 9;
517 inhdr
= (const uint8_t *)req
->in
.vector
[idx
].iov_base
;
518 in_flags
= IVAL(inhdr
, SMB2_HDR_FLAGS
);
520 outhdr
= talloc_zero_array(vector
, uint8_t,
522 if (outhdr
== NULL
) {
523 return NT_STATUS_NO_MEMORY
;
526 outbody
= outhdr
+ SMB2_HDR_BODY
;
528 current
[0].iov_base
= (void *)outhdr
;
529 current
[0].iov_len
= SMB2_HDR_BODY
;
531 current
[1].iov_base
= (void *)outbody
;
532 current
[1].iov_len
= 8;
534 current
[2].iov_base
= NULL
;
535 current
[2].iov_len
= 0;
537 /* setup the SMB2 header */
538 SIVAL(outhdr
, SMB2_HDR_PROTOCOL_ID
, SMB2_MAGIC
);
539 SSVAL(outhdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
540 SSVAL(outhdr
, SMB2_HDR_EPOCH
, 0);
541 SIVAL(outhdr
, SMB2_HDR_STATUS
,
542 NT_STATUS_V(NT_STATUS_INTERNAL_ERROR
));
543 SSVAL(outhdr
, SMB2_HDR_OPCODE
,
544 SVAL(inhdr
, SMB2_HDR_OPCODE
));
545 SIVAL(outhdr
, SMB2_HDR_FLAGS
,
546 IVAL(inhdr
, SMB2_HDR_FLAGS
) | SMB2_HDR_FLAG_REDIRECT
);
547 SIVAL(outhdr
, SMB2_HDR_NEXT_COMMAND
, next_command_ofs
);
548 SBVAL(outhdr
, SMB2_HDR_MESSAGE_ID
,
549 BVAL(inhdr
, SMB2_HDR_MESSAGE_ID
));
550 SIVAL(outhdr
, SMB2_HDR_PID
,
551 IVAL(inhdr
, SMB2_HDR_PID
));
552 SIVAL(outhdr
, SMB2_HDR_TID
,
553 IVAL(inhdr
, SMB2_HDR_TID
));
554 SBVAL(outhdr
, SMB2_HDR_SESSION_ID
,
555 BVAL(inhdr
, SMB2_HDR_SESSION_ID
));
556 memset(outhdr
+ SMB2_HDR_SIGNATURE
, 0, 16);
558 /* setup error body header */
559 SSVAL(outbody
, 0x00, 0x08 + 1);
560 SSVAL(outbody
, 0x02, 0);
561 SIVAL(outbody
, 0x04, 0);
564 req
->out
.vector
= vector
;
565 req
->out
.vector_count
= count
;
567 /* setup the length of the NBT packet */
568 smb2_setup_nbt_length(req
->out
.vector
, req
->out
.vector_count
);
570 DLIST_ADD_END(req
->sconn
->smb2
.requests
, req
, struct smbd_smb2_request
*);
575 void smbd_server_connection_terminate_ex(struct smbd_server_connection
*sconn
,
577 const char *location
)
579 DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
581 exit_server_cleanly(reason
);
584 static bool dup_smb2_vec3(TALLOC_CTX
*ctx
,
585 struct iovec
*outvec
,
586 const struct iovec
*srcvec
)
588 /* vec[0] is always boilerplate and must
589 * be allocated with size OUTVEC_ALLOC_SIZE. */
591 outvec
[0].iov_base
= talloc_memdup(ctx
,
594 if (!outvec
[0].iov_base
) {
597 outvec
[0].iov_len
= SMB2_HDR_BODY
;
600 * If this is a "standard" vec[1] of length 8,
601 * pointing to srcvec[0].iov_base + SMB2_HDR_BODY,
602 * then duplicate this. Else use talloc_memdup().
605 if (srcvec
[1].iov_len
== 8 &&
606 srcvec
[1].iov_base
==
607 ((uint8_t *)srcvec
[0].iov_base
) +
609 outvec
[1].iov_base
= ((uint8_t *)outvec
[1].iov_base
) +
611 outvec
[1].iov_len
= 8;
613 outvec
[1].iov_base
= talloc_memdup(ctx
,
616 if (!outvec
[1].iov_base
) {
619 outvec
[1].iov_len
= srcvec
[1].iov_len
;
623 * If this is a "standard" vec[2] of length 1,
624 * pointing to srcvec[0].iov_base + (OUTVEC_ALLOC_SIZE - 1)
625 * then duplicate this. Else use talloc_memdup().
628 if (srcvec
[2].iov_base
&&
630 if (srcvec
[2].iov_base
==
631 ((uint8_t *)srcvec
[0].iov_base
) +
632 (OUTVEC_ALLOC_SIZE
- 1) &&
633 srcvec
[2].iov_len
== 1) {
634 /* Common SMB2 error packet case. */
635 outvec
[2].iov_base
= ((uint8_t *)outvec
[0].iov_base
) +
636 (OUTVEC_ALLOC_SIZE
- 1);
638 outvec
[2].iov_base
= talloc_memdup(ctx
,
641 if (!outvec
[2].iov_base
) {
645 outvec
[2].iov_len
= srcvec
[2].iov_len
;
647 outvec
[2].iov_base
= NULL
;
648 outvec
[2].iov_len
= 0;
653 static struct smbd_smb2_request
*dup_smb2_req(const struct smbd_smb2_request
*req
)
655 struct smbd_smb2_request
*newreq
= NULL
;
656 struct iovec
*outvec
= NULL
;
657 int count
= req
->out
.vector_count
;
660 newreq
= smbd_smb2_request_allocate(req
->sconn
);
665 newreq
->sconn
= req
->sconn
;
666 newreq
->do_signing
= req
->do_signing
;
667 newreq
->current_idx
= req
->current_idx
;
668 newreq
->async
= false;
669 newreq
->cancelled
= false;
671 outvec
= talloc_zero_array(newreq
, struct iovec
, count
);
676 newreq
->out
.vector
= outvec
;
677 newreq
->out
.vector_count
= count
;
679 /* Setup the outvec's identically to req. */
680 outvec
[0].iov_base
= newreq
->out
.nbt_hdr
;
681 outvec
[0].iov_len
= 4;
682 memcpy(newreq
->out
.nbt_hdr
, req
->out
.nbt_hdr
, 4);
684 /* Setup the vectors identically to the ones in req. */
685 for (i
= 1; i
< count
; i
+= 3) {
686 if (!dup_smb2_vec3(outvec
, &outvec
[i
], &req
->out
.vector
[i
])) {
697 smb2_setup_nbt_length(newreq
->out
.vector
,
698 newreq
->out
.vector_count
);
703 static void smbd_smb2_request_writev_done(struct tevent_req
*subreq
);
705 static NTSTATUS
smb2_send_async_interim_response(const struct smbd_smb2_request
*req
)
708 uint8_t *outhdr
= NULL
;
709 struct smbd_smb2_request
*nreq
= NULL
;
711 /* Create a new smb2 request we'll use
712 for the interim return. */
713 nreq
= dup_smb2_req(req
);
715 return NT_STATUS_NO_MEMORY
;
718 /* Lose the last 3 out vectors. They're the
719 ones we'll be using for the async reply. */
720 nreq
->out
.vector_count
-= 3;
722 smb2_setup_nbt_length(nreq
->out
.vector
,
723 nreq
->out
.vector_count
);
725 /* Step back to the previous reply. */
726 i
= nreq
->current_idx
- 3;
727 outhdr
= (uint8_t *)nreq
->out
.vector
[i
].iov_base
;
728 /* And end the chain. */
729 SIVAL(outhdr
, SMB2_HDR_NEXT_COMMAND
, 0);
731 /* Calculate outgoing credits */
732 smb2_calculate_credits(req
, nreq
);
734 /* Re-sign if needed. */
735 if (nreq
->do_signing
) {
737 status
= smb2_signing_sign_pdu(nreq
->session
->session_key
,
738 &nreq
->out
.vector
[i
], 3);
739 if (!NT_STATUS_IS_OK(status
)) {
743 if (DEBUGLEVEL
>= 10) {
744 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
745 (unsigned int)nreq
->current_idx
);
746 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
747 (unsigned int)nreq
->out
.vector_count
);
748 print_req_vectors(nreq
);
750 nreq
->subreq
= tstream_writev_queue_send(nreq
,
751 nreq
->sconn
->smb2
.event_ctx
,
752 nreq
->sconn
->smb2
.stream
,
753 nreq
->sconn
->smb2
.send_queue
,
755 nreq
->out
.vector_count
);
757 if (nreq
->subreq
== NULL
) {
758 return NT_STATUS_NO_MEMORY
;
761 tevent_req_set_callback(nreq
->subreq
,
762 smbd_smb2_request_writev_done
,
768 struct smbd_smb2_request_pending_state
{
769 struct smbd_server_connection
*sconn
;
770 uint8_t buf
[4 + SMB2_HDR_BODY
+ 0x08 + 1];
771 struct iovec vector
[3];
774 static void smbd_smb2_request_pending_writev_done(struct tevent_req
*subreq
)
776 struct smbd_smb2_request_pending_state
*state
=
777 tevent_req_callback_data(subreq
,
778 struct smbd_smb2_request_pending_state
);
779 struct smbd_server_connection
*sconn
= state
->sconn
;
783 ret
= tstream_writev_queue_recv(subreq
, &sys_errno
);
786 NTSTATUS status
= map_nt_error_from_unix(sys_errno
);
787 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
794 NTSTATUS
smbd_smb2_request_pending_queue(struct smbd_smb2_request
*req
,
795 struct tevent_req
*subreq
)
798 struct smbd_smb2_request_pending_state
*state
= NULL
;
799 int i
= req
->current_idx
;
800 uint8_t *reqhdr
= NULL
;
802 uint8_t *body
= NULL
;
804 uint64_t message_id
= 0;
805 uint64_t async_id
= 0;
806 struct iovec
*outvec
= NULL
;
808 if (!tevent_req_is_in_progress(subreq
)) {
812 req
->subreq
= subreq
;
816 /* We're already async. */
820 if (req
->in
.vector_count
> i
+ 3) {
822 * We're trying to go async in a compound
823 * request chain. This is not allowed.
824 * Cancel the outstanding request.
826 tevent_req_cancel(req
->subreq
);
827 return smbd_smb2_request_error(req
,
828 NT_STATUS_INSUFFICIENT_RESOURCES
);
831 if (DEBUGLEVEL
>= 10) {
832 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
833 (unsigned int)req
->current_idx
);
834 print_req_vectors(req
);
837 if (req
->out
.vector_count
> 4) {
838 /* This is a compound reply. We
839 * must do an interim response
840 * followed by the async response
843 status
= smb2_send_async_interim_response(req
);
844 if (!NT_STATUS_IS_OK(status
)) {
849 /* Don't return an intermediate packet on a pipe read/write. */
850 if (req
->tcon
&& req
->tcon
->compat_conn
&& IS_IPC(req
->tcon
->compat_conn
)) {
854 reqhdr
= (uint8_t *)req
->out
.vector
[i
].iov_base
;
855 flags
= (IVAL(reqhdr
, SMB2_HDR_FLAGS
) & ~SMB2_HDR_FLAG_CHAINED
);
856 message_id
= BVAL(reqhdr
, SMB2_HDR_MESSAGE_ID
);
857 async_id
= message_id
; /* keep it simple for now... */
860 * What we send is identical to a smbd_smb2_request_error
861 * packet with an error status of STATUS_PENDING. Make use
862 * of this fact sometime when refactoring. JRA.
865 state
= talloc_zero(req
->sconn
, struct smbd_smb2_request_pending_state
);
867 return NT_STATUS_NO_MEMORY
;
869 state
->sconn
= req
->sconn
;
871 state
->vector
[0].iov_base
= (void *)state
->buf
;
872 state
->vector
[0].iov_len
= 4;
874 state
->vector
[1].iov_base
= state
->buf
+ 4;
875 state
->vector
[1].iov_len
= SMB2_HDR_BODY
;
877 state
->vector
[2].iov_base
= state
->buf
+ 4 + SMB2_HDR_BODY
;
878 state
->vector
[2].iov_len
= 9;
880 smb2_setup_nbt_length(state
->vector
, 3);
882 hdr
= (uint8_t *)state
->vector
[1].iov_base
;
883 body
= (uint8_t *)state
->vector
[2].iov_base
;
885 SIVAL(hdr
, SMB2_HDR_PROTOCOL_ID
, SMB2_MAGIC
);
886 SSVAL(hdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
887 SSVAL(hdr
, SMB2_HDR_EPOCH
, 0);
888 SIVAL(hdr
, SMB2_HDR_STATUS
, NT_STATUS_V(STATUS_PENDING
));
889 SSVAL(hdr
, SMB2_HDR_OPCODE
, SVAL(reqhdr
, SMB2_HDR_OPCODE
));
891 SIVAL(hdr
, SMB2_HDR_FLAGS
, flags
| SMB2_HDR_FLAG_ASYNC
);
892 SIVAL(hdr
, SMB2_HDR_NEXT_COMMAND
, 0);
893 SBVAL(hdr
, SMB2_HDR_MESSAGE_ID
, message_id
);
894 SBVAL(hdr
, SMB2_HDR_PID
, async_id
);
895 SBVAL(hdr
, SMB2_HDR_SESSION_ID
,
896 BVAL(reqhdr
, SMB2_HDR_SESSION_ID
));
897 memset(hdr
+SMB2_HDR_SIGNATURE
, 0, 16);
899 SSVAL(body
, 0x00, 0x08 + 1);
901 SCVAL(body
, 0x02, 0);
902 SCVAL(body
, 0x03, 0);
903 SIVAL(body
, 0x04, 0);
904 /* Match W2K8R2... */
905 SCVAL(body
, 0x08, 0x21);
907 /* Ensure we correctly go through crediting. Grant
908 the credits now, and zero credits on the final
910 smb2_set_operation_credit(req
->sconn
,
914 if (req
->do_signing
) {
915 status
= smb2_signing_sign_pdu(req
->session
->session_key
,
917 if (!NT_STATUS_IS_OK(status
)) {
922 subreq
= tstream_writev_queue_send(state
,
923 req
->sconn
->smb2
.event_ctx
,
924 req
->sconn
->smb2
.stream
,
925 req
->sconn
->smb2
.send_queue
,
929 if (subreq
== NULL
) {
930 return NT_STATUS_NO_MEMORY
;
933 tevent_req_set_callback(subreq
,
934 smbd_smb2_request_pending_writev_done
,
937 /* Note we're going async with this request. */
941 * Now manipulate req so that the outstanding async request
942 * is the only one left in the struct smbd_smb2_request.
945 if (req
->current_idx
== 1) {
946 /* There was only one. */
950 /* Re-arrange the in.vectors. */
951 req
->in
.vector
[1] = req
->in
.vector
[i
];
952 req
->in
.vector
[2] = req
->in
.vector
[i
+1];
953 req
->in
.vector
[3] = req
->in
.vector
[i
+2];
954 req
->in
.vector_count
= 4;
955 /* Reset the new in size. */
956 smb2_setup_nbt_length(req
->in
.vector
, 4);
958 /* Now recreate the out.vectors. */
959 outvec
= talloc_zero_array(req
, struct iovec
, 4);
961 return NT_STATUS_NO_MEMORY
;
964 /* 0 is always boilerplate and must
965 * be of size 4 for the length field. */
967 outvec
[0].iov_base
= req
->out
.nbt_hdr
;
968 outvec
[0].iov_len
= 4;
969 SIVAL(req
->out
.nbt_hdr
, 0, 0);
971 if (!dup_smb2_vec3(outvec
, &outvec
[1], &req
->out
.vector
[i
])) {
972 return NT_STATUS_NO_MEMORY
;
975 TALLOC_FREE(req
->out
.vector
);
977 req
->out
.vector
= outvec
;
979 req
->current_idx
= 1;
980 req
->out
.vector_count
= 4;
984 smb2_setup_nbt_length(req
->out
.vector
,
985 req
->out
.vector_count
);
987 /* Ensure our final reply matches the interim one. */
988 reqhdr
= (uint8_t *)req
->out
.vector
[1].iov_base
;
989 SIVAL(reqhdr
, SMB2_HDR_FLAGS
, flags
| SMB2_HDR_FLAG_ASYNC
);
990 SBVAL(reqhdr
, SMB2_HDR_PID
, async_id
);
993 const uint8_t *inhdr
=
994 (const uint8_t *)req
->in
.vector
[1].iov_base
;
995 DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
997 smb2_opcode_name((uint16_t)IVAL(inhdr
, SMB2_HDR_OPCODE
)),
998 (unsigned long long)async_id
));
1000 return NT_STATUS_OK
;
1003 static NTSTATUS
smbd_smb2_request_process_cancel(struct smbd_smb2_request
*req
)
1005 struct smbd_server_connection
*sconn
= req
->sconn
;
1006 struct smbd_smb2_request
*cur
;
1007 const uint8_t *inhdr
;
1008 int i
= req
->current_idx
;
1010 uint64_t search_message_id
;
1011 uint64_t search_async_id
;
1014 inhdr
= (const uint8_t *)req
->in
.vector
[i
].iov_base
;
1016 flags
= IVAL(inhdr
, SMB2_HDR_FLAGS
);
1017 search_message_id
= BVAL(inhdr
, SMB2_HDR_MESSAGE_ID
);
1018 search_async_id
= BVAL(inhdr
, SMB2_HDR_PID
);
1021 * we don't need the request anymore
1022 * cancel requests never have a response
1024 DLIST_REMOVE(req
->sconn
->smb2
.requests
, req
);
1027 for (cur
= sconn
->smb2
.requests
; cur
; cur
= cur
->next
) {
1028 const uint8_t *outhdr
;
1029 uint64_t message_id
;
1032 i
= cur
->current_idx
;
1034 outhdr
= (const uint8_t *)cur
->out
.vector
[i
].iov_base
;
1036 message_id
= BVAL(outhdr
, SMB2_HDR_MESSAGE_ID
);
1037 async_id
= BVAL(outhdr
, SMB2_HDR_PID
);
1039 if (flags
& SMB2_HDR_FLAG_ASYNC
) {
1040 if (search_async_id
== async_id
) {
1041 found_id
= async_id
;
1045 if (search_message_id
== message_id
) {
1046 found_id
= message_id
;
1052 if (cur
&& cur
->subreq
) {
1053 inhdr
= (const uint8_t *)cur
->in
.vector
[i
].iov_base
;
1054 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1055 "cancel opcode[%s] mid %llu\n",
1056 smb2_opcode_name((uint16_t)IVAL(inhdr
, SMB2_HDR_OPCODE
)),
1057 (unsigned long long)found_id
));
1058 tevent_req_cancel(cur
->subreq
);
1061 return NT_STATUS_OK
;
1064 NTSTATUS
smbd_smb2_request_dispatch(struct smbd_smb2_request
*req
)
1066 const uint8_t *inhdr
;
1067 int i
= req
->current_idx
;
1072 NTSTATUS session_status
;
1073 uint32_t allowed_flags
;
1074 NTSTATUS return_value
;
1076 inhdr
= (const uint8_t *)req
->in
.vector
[i
].iov_base
;
1078 /* TODO: verify more things */
1080 flags
= IVAL(inhdr
, SMB2_HDR_FLAGS
);
1081 opcode
= IVAL(inhdr
, SMB2_HDR_OPCODE
);
1082 mid
= BVAL(inhdr
, SMB2_HDR_MESSAGE_ID
);
1083 DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
1084 smb2_opcode_name(opcode
),
1085 (unsigned long long)mid
));
1087 allowed_flags
= SMB2_HDR_FLAG_CHAINED
|
1088 SMB2_HDR_FLAG_SIGNED
|
1090 if (opcode
== SMB2_OP_CANCEL
) {
1091 allowed_flags
|= SMB2_HDR_FLAG_ASYNC
;
1093 if ((flags
& ~allowed_flags
) != 0) {
1094 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
1097 session_status
= smbd_smb2_request_check_session(req
);
1099 req
->do_signing
= false;
1100 if (flags
& SMB2_HDR_FLAG_SIGNED
) {
1101 if (!NT_STATUS_IS_OK(session_status
)) {
1102 return smbd_smb2_request_error(req
, session_status
);
1105 req
->do_signing
= true;
1106 status
= smb2_signing_check_pdu(req
->session
->session_key
,
1107 &req
->in
.vector
[i
], 3);
1108 if (!NT_STATUS_IS_OK(status
)) {
1109 return smbd_smb2_request_error(req
, status
);
1111 } else if (req
->session
&& req
->session
->do_signing
) {
1112 return smbd_smb2_request_error(req
, NT_STATUS_ACCESS_DENIED
);
1115 if (flags
& SMB2_HDR_FLAG_CHAINED
) {
1117 * This check is mostly for giving the correct error code
1118 * for compounded requests.
1120 * TODO: we may need to move this after the session
1123 if (!NT_STATUS_IS_OK(req
->next_status
)) {
1124 return smbd_smb2_request_error(req
, req
->next_status
);
1127 req
->compat_chain_fsp
= NULL
;
1131 case SMB2_OP_NEGPROT
:
1133 START_PROFILE(smb2_negprot
);
1134 return_value
= smbd_smb2_request_process_negprot(req
);
1135 END_PROFILE(smb2_negprot
);
1139 case SMB2_OP_SESSSETUP
:
1141 START_PROFILE(smb2_sesssetup
);
1142 return_value
= smbd_smb2_request_process_sesssetup(req
);
1143 END_PROFILE(smb2_sesssetup
);
1147 case SMB2_OP_LOGOFF
:
1148 if (!NT_STATUS_IS_OK(session_status
)) {
1149 return_value
= smbd_smb2_request_error(req
, session_status
);
1154 START_PROFILE(smb2_logoff
);
1155 return_value
= smbd_smb2_request_process_logoff(req
);
1156 END_PROFILE(smb2_logoff
);
1161 if (!NT_STATUS_IS_OK(session_status
)) {
1162 return_value
= smbd_smb2_request_error(req
, session_status
);
1165 status
= smbd_smb2_request_check_session(req
);
1166 if (!NT_STATUS_IS_OK(status
)) {
1167 return_value
= smbd_smb2_request_error(req
, status
);
1172 START_PROFILE(smb2_tcon
);
1173 return_value
= smbd_smb2_request_process_tcon(req
);
1174 END_PROFILE(smb2_tcon
);
1179 if (!NT_STATUS_IS_OK(session_status
)) {
1180 return_value
= smbd_smb2_request_error(req
, session_status
);
1183 status
= smbd_smb2_request_check_tcon(req
);
1184 if (!NT_STATUS_IS_OK(status
)) {
1185 return_value
= smbd_smb2_request_error(req
, status
);
1190 START_PROFILE(smb2_tdis
);
1191 return_value
= smbd_smb2_request_process_tdis(req
);
1192 END_PROFILE(smb2_tdis
);
1196 case SMB2_OP_CREATE
:
1197 if (!NT_STATUS_IS_OK(session_status
)) {
1198 return_value
= smbd_smb2_request_error(req
, session_status
);
1201 status
= smbd_smb2_request_check_tcon(req
);
1202 if (!NT_STATUS_IS_OK(status
)) {
1203 return_value
= smbd_smb2_request_error(req
, status
);
1208 START_PROFILE(smb2_create
);
1209 return_value
= smbd_smb2_request_process_create(req
);
1210 END_PROFILE(smb2_create
);
1215 if (!NT_STATUS_IS_OK(session_status
)) {
1216 return_value
= smbd_smb2_request_error(req
, session_status
);
1219 status
= smbd_smb2_request_check_tcon(req
);
1220 if (!NT_STATUS_IS_OK(status
)) {
1221 return_value
= smbd_smb2_request_error(req
, status
);
1226 START_PROFILE(smb2_close
);
1227 return_value
= smbd_smb2_request_process_close(req
);
1228 END_PROFILE(smb2_close
);
1233 if (!NT_STATUS_IS_OK(session_status
)) {
1234 return_value
= smbd_smb2_request_error(req
, session_status
);
1237 status
= smbd_smb2_request_check_tcon(req
);
1238 if (!NT_STATUS_IS_OK(status
)) {
1239 return_value
= smbd_smb2_request_error(req
, status
);
1244 START_PROFILE(smb2_flush
);
1245 return_value
= smbd_smb2_request_process_flush(req
);
1246 END_PROFILE(smb2_flush
);
1251 if (!NT_STATUS_IS_OK(session_status
)) {
1252 return_value
= smbd_smb2_request_error(req
, session_status
);
1255 status
= smbd_smb2_request_check_tcon(req
);
1256 if (!NT_STATUS_IS_OK(status
)) {
1257 return_value
= smbd_smb2_request_error(req
, status
);
1262 START_PROFILE(smb2_read
);
1263 return_value
= smbd_smb2_request_process_read(req
);
1264 END_PROFILE(smb2_read
);
1269 if (!NT_STATUS_IS_OK(session_status
)) {
1270 return_value
= smbd_smb2_request_error(req
, session_status
);
1273 status
= smbd_smb2_request_check_tcon(req
);
1274 if (!NT_STATUS_IS_OK(status
)) {
1275 return_value
= smbd_smb2_request_error(req
, status
);
1280 START_PROFILE(smb2_write
);
1281 return_value
= smbd_smb2_request_process_write(req
);
1282 END_PROFILE(smb2_write
);
1287 if (!NT_STATUS_IS_OK(session_status
)) {
1288 /* Too ugly to live ? JRA. */
1289 if (NT_STATUS_EQUAL(session_status
,NT_STATUS_USER_SESSION_DELETED
)) {
1290 session_status
= NT_STATUS_FILE_CLOSED
;
1292 return_value
= smbd_smb2_request_error(req
, session_status
);
1295 status
= smbd_smb2_request_check_tcon(req
);
1296 if (!NT_STATUS_IS_OK(status
)) {
1297 /* Too ugly to live ? JRA. */
1298 if (NT_STATUS_EQUAL(status
,NT_STATUS_NETWORK_NAME_DELETED
)) {
1299 status
= NT_STATUS_FILE_CLOSED
;
1301 return_value
= smbd_smb2_request_error(req
, status
);
1306 START_PROFILE(smb2_lock
);
1307 return_value
= smbd_smb2_request_process_lock(req
);
1308 END_PROFILE(smb2_lock
);
1313 if (!NT_STATUS_IS_OK(session_status
)) {
1314 return_value
= smbd_smb2_request_error(req
, session_status
);
1317 status
= smbd_smb2_request_check_tcon(req
);
1318 if (!NT_STATUS_IS_OK(status
)) {
1319 return_value
= smbd_smb2_request_error(req
, status
);
1324 START_PROFILE(smb2_ioctl
);
1325 return_value
= smbd_smb2_request_process_ioctl(req
);
1326 END_PROFILE(smb2_ioctl
);
1330 case SMB2_OP_CANCEL
:
1332 START_PROFILE(smb2_cancel
);
1333 return_value
= smbd_smb2_request_process_cancel(req
);
1334 END_PROFILE(smb2_cancel
);
1338 case SMB2_OP_KEEPALIVE
:
1339 {START_PROFILE(smb2_keepalive
);
1340 return_value
= smbd_smb2_request_process_keepalive(req
);
1341 END_PROFILE(smb2_keepalive
);}
1345 if (!NT_STATUS_IS_OK(session_status
)) {
1346 return_value
= smbd_smb2_request_error(req
, session_status
);
1349 status
= smbd_smb2_request_check_tcon(req
);
1350 if (!NT_STATUS_IS_OK(status
)) {
1351 return_value
= smbd_smb2_request_error(req
, status
);
1356 START_PROFILE(smb2_find
);
1357 return_value
= smbd_smb2_request_process_find(req
);
1358 END_PROFILE(smb2_find
);
1362 case SMB2_OP_NOTIFY
:
1363 if (!NT_STATUS_IS_OK(session_status
)) {
1364 return_value
= smbd_smb2_request_error(req
, session_status
);
1367 status
= smbd_smb2_request_check_tcon(req
);
1368 if (!NT_STATUS_IS_OK(status
)) {
1369 return_value
= smbd_smb2_request_error(req
, status
);
1374 START_PROFILE(smb2_notify
);
1375 return_value
= smbd_smb2_request_process_notify(req
);
1376 END_PROFILE(smb2_notify
);
1380 case SMB2_OP_GETINFO
:
1381 if (!NT_STATUS_IS_OK(session_status
)) {
1382 return_value
= smbd_smb2_request_error(req
, session_status
);
1385 status
= smbd_smb2_request_check_tcon(req
);
1386 if (!NT_STATUS_IS_OK(status
)) {
1387 return_value
= smbd_smb2_request_error(req
, status
);
1392 START_PROFILE(smb2_getinfo
);
1393 return_value
= smbd_smb2_request_process_getinfo(req
);
1394 END_PROFILE(smb2_getinfo
);
1398 case SMB2_OP_SETINFO
:
1399 if (!NT_STATUS_IS_OK(session_status
)) {
1400 return_value
= smbd_smb2_request_error(req
, session_status
);
1403 status
= smbd_smb2_request_check_tcon(req
);
1404 if (!NT_STATUS_IS_OK(status
)) {
1405 return_value
= smbd_smb2_request_error(req
, status
);
1410 START_PROFILE(smb2_setinfo
);
1411 return_value
= smbd_smb2_request_process_setinfo(req
);
1412 END_PROFILE(smb2_setinfo
);
1417 if (!NT_STATUS_IS_OK(session_status
)) {
1418 return_value
= smbd_smb2_request_error(req
, session_status
);
1421 status
= smbd_smb2_request_check_tcon(req
);
1422 if (!NT_STATUS_IS_OK(status
)) {
1423 return_value
= smbd_smb2_request_error(req
, status
);
1428 START_PROFILE(smb2_break
);
1429 return_value
= smbd_smb2_request_process_break(req
);
1430 END_PROFILE(smb2_break
);
1435 return_value
= smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
1438 return return_value
;
1441 static NTSTATUS
smbd_smb2_request_reply(struct smbd_smb2_request
*req
)
1443 struct tevent_req
*subreq
;
1444 int i
= req
->current_idx
;
1448 req
->current_idx
+= 3;
1450 if (req
->current_idx
< req
->out
.vector_count
) {
1452 * We must process the remaining compound
1453 * SMB2 requests before any new incoming SMB2
1454 * requests. This is because incoming SMB2
1455 * requests may include a cancel for a
1456 * compound request we haven't processed
1459 struct tevent_immediate
*im
= tevent_create_immediate(req
);
1461 return NT_STATUS_NO_MEMORY
;
1463 tevent_schedule_immediate(im
,
1464 req
->sconn
->smb2
.event_ctx
,
1465 smbd_smb2_request_dispatch_immediate
,
1467 return NT_STATUS_OK
;
1470 smb2_setup_nbt_length(req
->out
.vector
, req
->out
.vector_count
);
1472 /* Set credit for this operation (zero credits if this
1473 is a final reply for an async operation). */
1474 smb2_set_operation_credit(req
->sconn
,
1475 req
->async
? NULL
: &req
->in
.vector
[i
],
1476 &req
->out
.vector
[i
]);
1478 if (req
->do_signing
) {
1480 status
= smb2_signing_sign_pdu(req
->session
->session_key
,
1481 &req
->out
.vector
[i
], 3);
1482 if (!NT_STATUS_IS_OK(status
)) {
1487 if (DEBUGLEVEL
>= 10) {
1488 dbgtext("smbd_smb2_request_reply: sending...\n");
1489 print_req_vectors(req
);
1492 /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
1493 if (req
->out
.vector_count
== 4 &&
1494 req
->out
.vector
[3].iov_base
== NULL
&&
1495 req
->out
.vector
[3].iov_len
!= 0) {
1496 /* Dynamic part is NULL. Chop it off,
1497 We're going to send it via sendfile. */
1498 req
->out
.vector_count
-= 1;
1501 subreq
= tstream_writev_queue_send(req
,
1502 req
->sconn
->smb2
.event_ctx
,
1503 req
->sconn
->smb2
.stream
,
1504 req
->sconn
->smb2
.send_queue
,
1506 req
->out
.vector_count
);
1507 if (subreq
== NULL
) {
1508 return NT_STATUS_NO_MEMORY
;
1510 tevent_req_set_callback(subreq
, smbd_smb2_request_writev_done
, req
);
1512 * We're done with this request -
1513 * move it off the "being processed" queue.
1515 DLIST_REMOVE(req
->sconn
->smb2
.requests
, req
);
1517 return NT_STATUS_OK
;
1520 void smbd_smb2_request_dispatch_immediate(struct tevent_context
*ctx
,
1521 struct tevent_immediate
*im
,
1524 struct smbd_smb2_request
*req
= talloc_get_type_abort(private_data
,
1525 struct smbd_smb2_request
);
1526 struct smbd_server_connection
*sconn
= req
->sconn
;
1531 if (DEBUGLEVEL
>= 10) {
1532 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
1533 req
->current_idx
, req
->in
.vector_count
));
1534 print_req_vectors(req
);
1537 status
= smbd_smb2_request_dispatch(req
);
1538 if (!NT_STATUS_IS_OK(status
)) {
1539 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
1544 static void smbd_smb2_request_writev_done(struct tevent_req
*subreq
)
1546 struct smbd_smb2_request
*req
= tevent_req_callback_data(subreq
,
1547 struct smbd_smb2_request
);
1548 struct smbd_server_connection
*sconn
= req
->sconn
;
1552 ret
= tstream_writev_queue_recv(subreq
, &sys_errno
);
1553 TALLOC_FREE(subreq
);
1556 NTSTATUS status
= map_nt_error_from_unix(sys_errno
);
1557 DEBUG(2,("smbd_smb2_request_writev_done: client write error %s\n",
1558 nt_errstr(status
)));
1559 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
1564 NTSTATUS
smbd_smb2_request_done_ex(struct smbd_smb2_request
*req
,
1566 DATA_BLOB body
, DATA_BLOB
*dyn
,
1567 const char *location
)
1570 int i
= req
->current_idx
;
1571 uint32_t next_command_ofs
;
1573 DEBUG(10,("smbd_smb2_request_done_ex: "
1574 "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
1575 i
, nt_errstr(status
), (unsigned int)body
.length
,
1577 (unsigned int)(dyn
? dyn
->length
: 0),
1580 if (body
.length
< 2) {
1581 return smbd_smb2_request_error(req
, NT_STATUS_INTERNAL_ERROR
);
1584 if ((body
.length
% 2) != 0) {
1585 return smbd_smb2_request_error(req
, NT_STATUS_INTERNAL_ERROR
);
1588 outhdr
= (uint8_t *)req
->out
.vector
[i
].iov_base
;
1590 next_command_ofs
= IVAL(outhdr
, SMB2_HDR_NEXT_COMMAND
);
1591 SIVAL(outhdr
, SMB2_HDR_STATUS
, NT_STATUS_V(status
));
1593 req
->out
.vector
[i
+1].iov_base
= (void *)body
.data
;
1594 req
->out
.vector
[i
+1].iov_len
= body
.length
;
1597 req
->out
.vector
[i
+2].iov_base
= (void *)dyn
->data
;
1598 req
->out
.vector
[i
+2].iov_len
= dyn
->length
;
1600 req
->out
.vector
[i
+2].iov_base
= NULL
;
1601 req
->out
.vector
[i
+2].iov_len
= 0;
1604 /* see if we need to recalculate the offset to the next response */
1605 if (next_command_ofs
> 0) {
1606 next_command_ofs
= SMB2_HDR_BODY
;
1607 next_command_ofs
+= req
->out
.vector
[i
+1].iov_len
;
1608 next_command_ofs
+= req
->out
.vector
[i
+2].iov_len
;
1611 if ((next_command_ofs
% 8) != 0) {
1612 size_t pad_size
= 8 - (next_command_ofs
% 8);
1613 if (req
->out
.vector
[i
+2].iov_len
== 0) {
1615 * if the dyn buffer is empty
1616 * we can use it to add padding
1620 pad
= talloc_zero_array(req
->out
.vector
,
1623 return smbd_smb2_request_error(req
,
1624 NT_STATUS_NO_MEMORY
);
1627 req
->out
.vector
[i
+2].iov_base
= (void *)pad
;
1628 req
->out
.vector
[i
+2].iov_len
= pad_size
;
1631 * For now we copy the dynamic buffer
1632 * and add the padding to the new buffer
1639 old_size
= req
->out
.vector
[i
+2].iov_len
;
1640 old_dyn
= (uint8_t *)req
->out
.vector
[i
+2].iov_base
;
1642 new_size
= old_size
+ pad_size
;
1643 new_dyn
= talloc_zero_array(req
->out
.vector
,
1645 if (new_dyn
== NULL
) {
1646 return smbd_smb2_request_error(req
,
1647 NT_STATUS_NO_MEMORY
);
1650 memcpy(new_dyn
, old_dyn
, old_size
);
1651 memset(new_dyn
+ old_size
, 0, pad_size
);
1653 req
->out
.vector
[i
+2].iov_base
= (void *)new_dyn
;
1654 req
->out
.vector
[i
+2].iov_len
= new_size
;
1656 next_command_ofs
+= pad_size
;
1659 SIVAL(outhdr
, SMB2_HDR_NEXT_COMMAND
, next_command_ofs
);
1661 return smbd_smb2_request_reply(req
);
1664 NTSTATUS
smbd_smb2_request_error_ex(struct smbd_smb2_request
*req
,
1667 const char *location
)
1670 int i
= req
->current_idx
;
1671 uint8_t *outhdr
= (uint8_t *)req
->out
.vector
[i
].iov_base
;
1673 DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
1674 i
, nt_errstr(status
), info
? " +info" : "",
1677 body
.data
= outhdr
+ SMB2_HDR_BODY
;
1679 SSVAL(body
.data
, 0, 9);
1682 SIVAL(body
.data
, 0x04, info
->length
);
1684 /* Allocated size of req->out.vector[i].iov_base
1685 * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
1686 * 1 byte without having to do an alloc.
1688 info
= talloc_zero_array(req
->out
.vector
,
1692 return NT_STATUS_NO_MEMORY
;
1694 info
->data
= ((uint8_t *)outhdr
) +
1695 OUTVEC_ALLOC_SIZE
- 1;
1697 SCVAL(info
->data
, 0, 0);
1701 * if a request fails, all other remaining
1702 * compounded requests should fail too
1704 req
->next_status
= NT_STATUS_INVALID_PARAMETER
;
1706 return smbd_smb2_request_done_ex(req
, status
, body
, info
, __location__
);
1710 struct smbd_smb2_send_oplock_break_state
{
1711 struct smbd_server_connection
*sconn
;
1712 uint8_t buf
[4 + SMB2_HDR_BODY
+ 0x18];
1713 struct iovec vector
;
1716 static void smbd_smb2_oplock_break_writev_done(struct tevent_req
*subreq
);
1718 NTSTATUS
smbd_smb2_send_oplock_break(struct smbd_server_connection
*sconn
,
1719 uint64_t file_id_persistent
,
1720 uint64_t file_id_volatile
,
1721 uint8_t oplock_level
)
1723 struct smbd_smb2_send_oplock_break_state
*state
;
1724 struct tevent_req
*subreq
;
1728 state
= talloc(sconn
, struct smbd_smb2_send_oplock_break_state
);
1729 if (state
== NULL
) {
1730 return NT_STATUS_NO_MEMORY
;
1732 state
->sconn
= sconn
;
1734 state
->vector
.iov_base
= (void *)state
->buf
;
1735 state
->vector
.iov_len
= sizeof(state
->buf
);
1737 _smb2_setlen(state
->buf
, sizeof(state
->buf
) - 4);
1738 hdr
= state
->buf
+ 4;
1739 body
= hdr
+ SMB2_HDR_BODY
;
1741 SIVAL(hdr
, 0, SMB2_MAGIC
);
1742 SSVAL(hdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
1743 SSVAL(hdr
, SMB2_HDR_EPOCH
, 0);
1744 SIVAL(hdr
, SMB2_HDR_STATUS
, 0);
1745 SSVAL(hdr
, SMB2_HDR_OPCODE
, SMB2_OP_BREAK
);
1746 SSVAL(hdr
, SMB2_HDR_CREDIT
, 0);
1747 SIVAL(hdr
, SMB2_HDR_FLAGS
, SMB2_HDR_FLAG_REDIRECT
);
1748 SIVAL(hdr
, SMB2_HDR_NEXT_COMMAND
, 0);
1749 SBVAL(hdr
, SMB2_HDR_MESSAGE_ID
, UINT64_MAX
);
1750 SIVAL(hdr
, SMB2_HDR_PID
, 0);
1751 SIVAL(hdr
, SMB2_HDR_TID
, 0);
1752 SBVAL(hdr
, SMB2_HDR_SESSION_ID
, 0);
1753 memset(hdr
+SMB2_HDR_SIGNATURE
, 0, 16);
1755 SSVAL(body
, 0x00, 0x18);
1757 SCVAL(body
, 0x02, oplock_level
);
1758 SCVAL(body
, 0x03, 0); /* reserved */
1759 SIVAL(body
, 0x04, 0); /* reserved */
1760 SBVAL(body
, 0x08, file_id_persistent
);
1761 SBVAL(body
, 0x10, file_id_volatile
);
1763 subreq
= tstream_writev_queue_send(state
,
1764 sconn
->smb2
.event_ctx
,
1766 sconn
->smb2
.send_queue
,
1768 if (subreq
== NULL
) {
1769 return NT_STATUS_NO_MEMORY
;
1771 tevent_req_set_callback(subreq
,
1772 smbd_smb2_oplock_break_writev_done
,
1775 return NT_STATUS_OK
;
1778 static void smbd_smb2_oplock_break_writev_done(struct tevent_req
*subreq
)
1780 struct smbd_smb2_send_oplock_break_state
*state
=
1781 tevent_req_callback_data(subreq
,
1782 struct smbd_smb2_send_oplock_break_state
);
1783 struct smbd_server_connection
*sconn
= state
->sconn
;
1787 ret
= tstream_writev_queue_recv(subreq
, &sys_errno
);
1788 TALLOC_FREE(subreq
);
1790 NTSTATUS status
= map_nt_error_from_unix(sys_errno
);
1791 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
1798 struct smbd_smb2_request_read_state
{
1800 bool asked_for_header
;
1801 struct smbd_smb2_request
*smb2_req
;
1804 static int smbd_smb2_request_next_vector(struct tstream_context
*stream
,
1806 TALLOC_CTX
*mem_ctx
,
1807 struct iovec
**_vector
,
1809 static void smbd_smb2_request_read_done(struct tevent_req
*subreq
);
1811 static struct tevent_req
*smbd_smb2_request_read_send(TALLOC_CTX
*mem_ctx
,
1812 struct tevent_context
*ev
,
1813 struct smbd_server_connection
*sconn
)
1815 struct tevent_req
*req
;
1816 struct smbd_smb2_request_read_state
*state
;
1817 struct tevent_req
*subreq
;
1819 req
= tevent_req_create(mem_ctx
, &state
,
1820 struct smbd_smb2_request_read_state
);
1825 state
->asked_for_header
= false;
1827 state
->smb2_req
= smbd_smb2_request_allocate(state
);
1828 if (tevent_req_nomem(state
->smb2_req
, req
)) {
1829 return tevent_req_post(req
, ev
);
1831 state
->smb2_req
->sconn
= sconn
;
1833 subreq
= tstream_readv_pdu_queue_send(state
, ev
, sconn
->smb2
.stream
,
1834 sconn
->smb2
.recv_queue
,
1835 smbd_smb2_request_next_vector
,
1837 if (tevent_req_nomem(subreq
, req
)) {
1838 return tevent_req_post(req
, ev
);
1840 tevent_req_set_callback(subreq
, smbd_smb2_request_read_done
, req
);
1845 static int smbd_smb2_request_next_vector(struct tstream_context
*stream
,
1847 TALLOC_CTX
*mem_ctx
,
1848 struct iovec
**_vector
,
1851 struct smbd_smb2_request_read_state
*state
=
1852 talloc_get_type_abort(private_data
,
1853 struct smbd_smb2_request_read_state
);
1854 struct smbd_smb2_request
*req
= state
->smb2_req
;
1855 struct iovec
*vector
;
1856 int idx
= req
->in
.vector_count
;
1858 uint8_t *buf
= NULL
;
1860 if (req
->in
.vector_count
== 0) {
1862 * first we need to get the NBT header
1864 req
->in
.vector
= talloc_array(req
, struct iovec
,
1865 req
->in
.vector_count
+ 1);
1866 if (req
->in
.vector
== NULL
) {
1869 req
->in
.vector_count
+= 1;
1871 req
->in
.vector
[idx
].iov_base
= (void *)req
->in
.nbt_hdr
;
1872 req
->in
.vector
[idx
].iov_len
= 4;
1874 vector
= talloc_array(mem_ctx
, struct iovec
, 1);
1875 if (vector
== NULL
) {
1879 vector
[0] = req
->in
.vector
[idx
];
1886 if (req
->in
.vector_count
== 1) {
1888 * Now we analyze the NBT header
1890 state
->missing
= smb2_len(req
->in
.vector
[0].iov_base
);
1892 if (state
->missing
== 0) {
1893 /* if there're no remaining bytes, we're done */
1899 req
->in
.vector
= talloc_realloc(req
, req
->in
.vector
,
1901 req
->in
.vector_count
+ 1);
1902 if (req
->in
.vector
== NULL
) {
1905 req
->in
.vector_count
+= 1;
1907 if (CVAL(req
->in
.vector
[0].iov_base
, 0) != 0) {
1909 * it's a special NBT message,
1910 * so get all remaining bytes
1912 len
= state
->missing
;
1913 } else if (state
->missing
< (SMB2_HDR_BODY
+ 2)) {
1915 * it's an invalid message, just read what we can get
1916 * and let the caller handle the error
1918 len
= state
->missing
;
1921 * We assume it's a SMB2 request,
1922 * and we first get the header and the
1923 * first 2 bytes (the struct size) of the body
1925 len
= SMB2_HDR_BODY
+ 2;
1927 state
->asked_for_header
= true;
1930 state
->missing
-= len
;
1932 buf
= talloc_array(req
->in
.vector
, uint8_t, len
);
1937 req
->in
.vector
[idx
].iov_base
= (void *)buf
;
1938 req
->in
.vector
[idx
].iov_len
= len
;
1940 vector
= talloc_array(mem_ctx
, struct iovec
, 1);
1941 if (vector
== NULL
) {
1945 vector
[0] = req
->in
.vector
[idx
];
1952 if (state
->missing
== 0) {
1953 /* if there're no remaining bytes, we're done */
1959 if (state
->asked_for_header
) {
1962 size_t next_command_ofs
;
1967 bool invalid
= false;
1969 state
->asked_for_header
= false;
1972 * We got the SMB2 header and the first 2 bytes
1973 * of the body. We fix the size to just the header
1974 * and manually copy the 2 first bytes to the body section
1976 req
->in
.vector
[idx
-1].iov_len
= SMB2_HDR_BODY
;
1977 hdr
= (const uint8_t *)req
->in
.vector
[idx
-1].iov_base
;
1979 /* allocate vectors for body and dynamic areas */
1980 req
->in
.vector
= talloc_realloc(req
, req
->in
.vector
,
1982 req
->in
.vector_count
+ 2);
1983 if (req
->in
.vector
== NULL
) {
1986 req
->in
.vector_count
+= 2;
1988 full_size
= state
->missing
+ SMB2_HDR_BODY
+ 2;
1989 next_command_ofs
= IVAL(hdr
, SMB2_HDR_NEXT_COMMAND
);
1990 body_size
= SVAL(hdr
, SMB2_HDR_BODY
);
1992 if (next_command_ofs
!= 0) {
1993 if (next_command_ofs
< (SMB2_HDR_BODY
+ 2)) {
1995 * this is invalid, just return a zero
1996 * body and let the caller deal with the error
1999 } else if (next_command_ofs
> full_size
) {
2001 * this is invalid, just return a zero
2002 * body and let the caller deal with the error
2006 full_size
= next_command_ofs
;
2011 if (body_size
< 2) {
2013 * this is invalid, just return a zero
2014 * body and let the caller deal with the error
2019 if ((body_size
% 2) != 0) {
2023 if (body_size
> (full_size
- SMB2_HDR_BODY
)) {
2025 * this is invalid, just return a zero
2026 * body and let the caller deal with the error
2033 /* the caller should check this */
2037 dyn_size
= full_size
- (SMB2_HDR_BODY
+ body_size
);
2039 state
->missing
-= (body_size
- 2) + dyn_size
;
2041 body
= talloc_array(req
->in
.vector
, uint8_t, body_size
);
2046 dyn
= talloc_array(req
->in
.vector
, uint8_t, dyn_size
);
2051 req
->in
.vector
[idx
].iov_base
= (void *)body
;
2052 req
->in
.vector
[idx
].iov_len
= body_size
;
2053 req
->in
.vector
[idx
+1].iov_base
= (void *)dyn
;
2054 req
->in
.vector
[idx
+1].iov_len
= dyn_size
;
2056 vector
= talloc_array(mem_ctx
, struct iovec
, 2);
2057 if (vector
== NULL
) {
2062 * the first 2 bytes of the body were already fetched
2063 * together with the header
2065 memcpy(body
, hdr
+ SMB2_HDR_BODY
, 2);
2066 vector
[0].iov_base
= body
+ 2;
2067 vector
[0].iov_len
= body_size
- 2;
2069 vector
[1] = req
->in
.vector
[idx
+1];
2077 * when we endup here, we're looking for a new SMB2 request
2078 * next. And we ask for its header and the first 2 bytes of
2079 * the body (like we did for the first SMB2 request).
2082 req
->in
.vector
= talloc_realloc(req
, req
->in
.vector
,
2084 req
->in
.vector_count
+ 1);
2085 if (req
->in
.vector
== NULL
) {
2088 req
->in
.vector_count
+= 1;
2091 * We assume it's a SMB2 request,
2092 * and we first get the header and the
2093 * first 2 bytes (the struct size) of the body
2095 len
= SMB2_HDR_BODY
+ 2;
2097 if (len
> state
->missing
) {
2098 /* let the caller handle the error */
2099 len
= state
->missing
;
2102 state
->missing
-= len
;
2103 state
->asked_for_header
= true;
2105 buf
= talloc_array(req
->in
.vector
, uint8_t, len
);
2110 req
->in
.vector
[idx
].iov_base
= (void *)buf
;
2111 req
->in
.vector
[idx
].iov_len
= len
;
2113 vector
= talloc_array(mem_ctx
, struct iovec
, 1);
2114 if (vector
== NULL
) {
2118 vector
[0] = req
->in
.vector
[idx
];
2125 static void smbd_smb2_request_read_done(struct tevent_req
*subreq
)
2127 struct tevent_req
*req
=
2128 tevent_req_callback_data(subreq
,
2134 ret
= tstream_readv_pdu_queue_recv(subreq
, &sys_errno
);
2136 status
= map_nt_error_from_unix(sys_errno
);
2137 tevent_req_nterror(req
, status
);
2141 tevent_req_done(req
);
2144 static NTSTATUS
smbd_smb2_request_read_recv(struct tevent_req
*req
,
2145 TALLOC_CTX
*mem_ctx
,
2146 struct smbd_smb2_request
**_smb2_req
)
2148 struct smbd_smb2_request_read_state
*state
=
2149 tevent_req_data(req
,
2150 struct smbd_smb2_request_read_state
);
2153 if (tevent_req_is_nterror(req
, &status
)) {
2154 tevent_req_received(req
);
2158 talloc_steal(mem_ctx
, state
->smb2_req
->mem_pool
);
2159 *_smb2_req
= state
->smb2_req
;
2160 tevent_req_received(req
);
2161 return NT_STATUS_OK
;
2164 static void smbd_smb2_request_incoming(struct tevent_req
*subreq
);
2166 void smbd_smb2_first_negprot(struct smbd_server_connection
*sconn
,
2167 const uint8_t *inbuf
, size_t size
)
2170 struct smbd_smb2_request
*req
= NULL
;
2171 struct tevent_req
*subreq
;
2173 DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
2174 (unsigned int)size
));
2176 status
= smbd_initialize_smb2(sconn
);
2177 if (!NT_STATUS_IS_OK(status
)) {
2178 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2182 status
= smbd_smb2_request_create(sconn
, inbuf
, size
, &req
);
2183 if (!NT_STATUS_IS_OK(status
)) {
2184 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2188 status
= smbd_smb2_request_setup_out(req
);
2189 if (!NT_STATUS_IS_OK(status
)) {
2190 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2194 status
= smbd_smb2_request_dispatch(req
);
2195 if (!NT_STATUS_IS_OK(status
)) {
2196 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2200 /* ask for the next request */
2201 subreq
= smbd_smb2_request_read_send(sconn
, sconn
->smb2
.event_ctx
, sconn
);
2202 if (subreq
== NULL
) {
2203 smbd_server_connection_terminate(sconn
, "no memory for reading");
2206 tevent_req_set_callback(subreq
, smbd_smb2_request_incoming
, sconn
);
2209 static void smbd_smb2_request_incoming(struct tevent_req
*subreq
)
2211 struct smbd_server_connection
*sconn
= tevent_req_callback_data(subreq
,
2212 struct smbd_server_connection
);
2214 struct smbd_smb2_request
*req
= NULL
;
2216 status
= smbd_smb2_request_read_recv(subreq
, sconn
, &req
);
2217 TALLOC_FREE(subreq
);
2218 if (!NT_STATUS_IS_OK(status
)) {
2219 DEBUG(2,("smbd_smb2_request_incoming: client read error %s\n",
2220 nt_errstr(status
)));
2221 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2225 if (req
->in
.nbt_hdr
[0] != 0x00) {
2226 DEBUG(1,("smbd_smb2_request_incoming: ignore NBT[0x%02X] msg\n",
2227 req
->in
.nbt_hdr
[0]));
2232 req
->current_idx
= 1;
2234 DEBUG(10,("smbd_smb2_request_incoming: idx[%d] of %d vectors\n",
2235 req
->current_idx
, req
->in
.vector_count
));
2237 status
= smbd_smb2_request_validate(req
);
2238 if (!NT_STATUS_IS_OK(status
)) {
2239 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2243 status
= smbd_smb2_request_setup_out(req
);
2244 if (!NT_STATUS_IS_OK(status
)) {
2245 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2249 status
= smbd_smb2_request_dispatch(req
);
2250 if (!NT_STATUS_IS_OK(status
)) {
2251 smbd_server_connection_terminate(sconn
, nt_errstr(status
));
2256 /* ask for the next request (this constructs the main loop) */
2257 subreq
= smbd_smb2_request_read_send(sconn
, sconn
->smb2
.event_ctx
, sconn
);
2258 if (subreq
== NULL
) {
2259 smbd_server_connection_terminate(sconn
, "no memory for reading");
2262 tevent_req_set_callback(subreq
, smbd_smb2_request_incoming
, sconn
);