?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
tests/krb5: Clarify checksum type assertion message
[Samba.git] / source3 / smbd / smbXsrv_session.c
blob0e5b16e958c32a3b47dfa1e87e32e607d3771fcf
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2011-2012
5 Copyright (C) Michael Adam 2012
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "system/filesys.h"
23 #include <tevent.h>
24 #include "lib/util/server_id.h"
25 #include "smbd/smbd.h"
26 #include "smbd/globals.h"
27 #include "dbwrap/dbwrap.h"
28 #include "dbwrap/dbwrap_rbt.h"
29 #include "dbwrap/dbwrap_open.h"
30 #include "dbwrap/dbwrap_watch.h"
31 #include "session.h"
32 #include "auth.h"
33 #include "auth/gensec/gensec.h"
34 #include "../lib/tsocket/tsocket.h"
35 #include "../libcli/security/security.h"
36 #include "messages.h"
37 #include "lib/util/util_tdb.h"
38 #include "librpc/gen_ndr/ndr_smbXsrv.h"
39 #include "serverid.h"
40 #include "lib/util/tevent_ntstatus.h"
41
42 struct smbXsrv_session_table {
43 struct {
44 struct db_context *db_ctx;
45 uint32_t lowest_id;
46 uint32_t highest_id;
47 uint32_t max_sessions;
48 uint32_t num_sessions;
49 } local;
50 struct {
51 struct db_context *db_ctx;
52 } global;
53 };
54
55 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
56
57 NTSTATUS smbXsrv_session_global_init(struct messaging_context *msg_ctx)
58 {
59 char *global_path = NULL;
60 struct db_context *backend = NULL;
61 struct db_context *db_ctx = NULL;
62
63 if (smbXsrv_session_global_db_ctx != NULL) {
64 return NT_STATUS_OK;
65 }
66
67 /*
68 * This contains secret information like session keys!
69 */
70 global_path = lock_path(talloc_tos(), "smbXsrv_session_global.tdb");
71 if (global_path == NULL) {
72 return NT_STATUS_NO_MEMORY;
73 }
74
75 backend = db_open(NULL, global_path,
76 0, /* hash_size */
77 TDB_DEFAULT |
78 TDB_CLEAR_IF_FIRST |
79 TDB_INCOMPATIBLE_HASH,
80 O_RDWR | O_CREAT, 0600,
81 DBWRAP_LOCK_ORDER_1,
82 DBWRAP_FLAG_NONE);
83 TALLOC_FREE(global_path);
84 if (backend == NULL) {
85 NTSTATUS status;
86
87 status = map_nt_error_from_unix_common(errno);
88
89 return status;
90 }
91
92 db_ctx = db_open_watched(NULL, &backend, global_messaging_context());
93 if (db_ctx == NULL) {
94 TALLOC_FREE(backend);
95 return NT_STATUS_NO_MEMORY;
96 }
97
98 smbXsrv_session_global_db_ctx = db_ctx;
99
100 return NT_STATUS_OK;
101 }
102
103 /*
104 * NOTE:
105 * We need to store the keys in big endian so that dbwrap_rbt's memcmp
106 * has the same result as integer comparison between the uint32_t
107 * values.
108 *
109 * TODO: implement string based key
110 */
111
112 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
113
114 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
115 uint8_t *key_buf)
116 {
117 TDB_DATA key;
118
119 RSIVAL(key_buf, 0, id);
120
121 key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
122
123 return key;
124 }
125
126 #if 0
127 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
128 {
129 if (id == NULL) {
130 return NT_STATUS_INVALID_PARAMETER;
131 }
132
133 if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
134 return NT_STATUS_INTERNAL_DB_CORRUPTION;
135 }
136
137 *id = RIVAL(key.dptr, 0);
138
139 return NT_STATUS_OK;
140 }
141 #endif
142
143 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
144
145 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
146 uint8_t *key_buf)
147 {
148 TDB_DATA key;
149
150 RSIVAL(key_buf, 0, id);
151
152 key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
153
154 return key;
155 }
156
157 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
158 {
159 if (id == NULL) {
160 return NT_STATUS_INVALID_PARAMETER;
161 }
162
163 if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
164 return NT_STATUS_INTERNAL_DB_CORRUPTION;
165 }
166
167 *id = RIVAL(key.dptr, 0);
168
169 return NT_STATUS_OK;
170 }
171
172 static struct db_record *smbXsrv_session_global_fetch_locked(
173 struct db_context *db,
174 uint32_t id,
175 TALLOC_CTX *mem_ctx)
176 {
177 TDB_DATA key;
178 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
179 struct db_record *rec = NULL;
180
181 key = smbXsrv_session_global_id_to_key(id, key_buf);
182
183 rec = dbwrap_fetch_locked(db, mem_ctx, key);
184
185 if (rec == NULL) {
186 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
187 hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
188 }
189
190 return rec;
191 }
192
193 static struct db_record *smbXsrv_session_local_fetch_locked(
194 struct db_context *db,
195 uint32_t id,
196 TALLOC_CTX *mem_ctx)
197 {
198 TDB_DATA key;
199 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
200 struct db_record *rec = NULL;
201
202 key = smbXsrv_session_local_id_to_key(id, key_buf);
203
204 rec = dbwrap_fetch_locked(db, mem_ctx, key);
205
206 if (rec == NULL) {
207 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
208 hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
209 }
210
211 return rec;
212 }
213
214 static void smbXsrv_session_close_loop(struct tevent_req *subreq);
215
216 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
217 uint32_t lowest_id,
218 uint32_t highest_id,
219 uint32_t max_sessions)
220 {
221 struct smbXsrv_client *client = conn->client;
222 struct smbXsrv_session_table *table;
223 NTSTATUS status;
224 struct tevent_req *subreq;
225 uint64_t max_range;
226
227 if (lowest_id > highest_id) {
228 return NT_STATUS_INTERNAL_ERROR;
229 }
230
231 max_range = highest_id;
232 max_range -= lowest_id;
233 max_range += 1;
234
235 if (max_sessions > max_range) {
236 return NT_STATUS_INTERNAL_ERROR;
237 }
238
239 table = talloc_zero(client, struct smbXsrv_session_table);
240 if (table == NULL) {
241 return NT_STATUS_NO_MEMORY;
242 }
243
244 table->local.db_ctx = db_open_rbt(table);
245 if (table->local.db_ctx == NULL) {
246 TALLOC_FREE(table);
247 return NT_STATUS_NO_MEMORY;
248 }
249 table->local.lowest_id = lowest_id;
250 table->local.highest_id = highest_id;
251 table->local.max_sessions = max_sessions;
252
253 status = smbXsrv_session_global_init(client->msg_ctx);
254 if (!NT_STATUS_IS_OK(status)) {
255 TALLOC_FREE(table);
256 return status;
257 }
258
259 table->global.db_ctx = smbXsrv_session_global_db_ctx;
260
261 subreq = messaging_read_send(table,
262 client->raw_ev_ctx,
263 client->msg_ctx,
264 MSG_SMBXSRV_SESSION_CLOSE);
265 if (subreq == NULL) {
266 TALLOC_FREE(table);
267 return NT_STATUS_NO_MEMORY;
268 }
269 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
270
271 client->session_table = table;
272 return NT_STATUS_OK;
273 }
274
275 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
276
277 static void smbXsrv_session_close_loop(struct tevent_req *subreq)
278 {
279 struct smbXsrv_client *client =
280 tevent_req_callback_data(subreq,
281 struct smbXsrv_client);
282 struct smbXsrv_session_table *table = client->session_table;
283 int ret;
284 struct messaging_rec *rec = NULL;
285 struct smbXsrv_session_closeB close_blob;
286 enum ndr_err_code ndr_err;
287 struct smbXsrv_session_close0 *close_info0 = NULL;
288 struct smbXsrv_session *session = NULL;
289 NTSTATUS status;
290 struct timeval tv = timeval_current();
291 NTTIME now = timeval_to_nttime(&tv);
292
293 ret = messaging_read_recv(subreq, talloc_tos(), &rec);
294 TALLOC_FREE(subreq);
295 if (ret != 0) {
296 goto next;
297 }
298
299 ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
300 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
301 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
302 status = ndr_map_error2ntstatus(ndr_err);
303 DEBUG(1,("smbXsrv_session_close_loop: "
304 "ndr_pull_struct_blob - %s\n",
305 nt_errstr(status)));
306 goto next;
307 }
308
309 DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
310 if (DEBUGLVL(10)) {
311 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
312 }
313
314 if (close_blob.version != SMBXSRV_VERSION_0) {
315 DEBUG(0,("smbXsrv_session_close_loop: "
316 "ignore invalid version %u\n", close_blob.version));
317 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
318 goto next;
319 }
320
321 close_info0 = close_blob.info.info0;
322 if (close_info0 == NULL) {
323 DEBUG(0,("smbXsrv_session_close_loop: "
324 "ignore NULL info %u\n", close_blob.version));
325 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
326 goto next;
327 }
328
329 status = smb2srv_session_lookup_client(client,
330 close_info0->old_session_wire_id,
331 now, &session);
332 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
333 DEBUG(4,("smbXsrv_session_close_loop: "
334 "old_session_wire_id %llu not found\n",
335 (unsigned long long)close_info0->old_session_wire_id));
336 if (DEBUGLVL(4)) {
337 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
338 }
339 goto next;
340 }
341 if (!NT_STATUS_IS_OK(status) &&
342 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
343 !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
344 DEBUG(1,("smbXsrv_session_close_loop: "
345 "old_session_wire_id %llu - %s\n",
346 (unsigned long long)close_info0->old_session_wire_id,
347 nt_errstr(status)));
348 if (DEBUGLVL(1)) {
349 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
350 }
351 goto next;
352 }
353
354 if (session->global->session_global_id != close_info0->old_session_global_id) {
355 DEBUG(1,("smbXsrv_session_close_loop: "
356 "old_session_wire_id %llu - global %u != %u\n",
357 (unsigned long long)close_info0->old_session_wire_id,
358 session->global->session_global_id,
359 close_info0->old_session_global_id));
360 if (DEBUGLVL(1)) {
361 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
362 }
363 goto next;
364 }
365
366 if (session->global->creation_time != close_info0->old_creation_time) {
367 DEBUG(1,("smbXsrv_session_close_loop: "
368 "old_session_wire_id %llu - "
369 "creation %s (%llu) != %s (%llu)\n",
370 (unsigned long long)close_info0->old_session_wire_id,
371 nt_time_string(rec, session->global->creation_time),
372 (unsigned long long)session->global->creation_time,
373 nt_time_string(rec, close_info0->old_creation_time),
374 (unsigned long long)close_info0->old_creation_time));
375 if (DEBUGLVL(1)) {
376 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
377 }
378 goto next;
379 }
380
381 subreq = smb2srv_session_shutdown_send(session, client->raw_ev_ctx,
382 session, NULL);
383 if (subreq == NULL) {
384 status = NT_STATUS_NO_MEMORY;
385 DEBUG(0, ("smbXsrv_session_close_loop: "
386 "smb2srv_session_shutdown_send(%llu) failed: %s\n",
387 (unsigned long long)session->global->session_wire_id,
388 nt_errstr(status)));
389 if (DEBUGLVL(1)) {
390 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
391 }
392 goto next;
393 }
394 tevent_req_set_callback(subreq,
395 smbXsrv_session_close_shutdown_done,
396 session);
397
398 next:
399 TALLOC_FREE(rec);
400
401 subreq = messaging_read_send(table,
402 client->raw_ev_ctx,
403 client->msg_ctx,
404 MSG_SMBXSRV_SESSION_CLOSE);
405 if (subreq == NULL) {
406 const char *r;
407 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
408 exit_server_cleanly(r);
409 return;
410 }
411 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
412 }
413
414 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
415 {
416 struct smbXsrv_session *session =
417 tevent_req_callback_data(subreq,
418 struct smbXsrv_session);
419 NTSTATUS status;
420
421 status = smb2srv_session_shutdown_recv(subreq);
422 TALLOC_FREE(subreq);
423 if (!NT_STATUS_IS_OK(status)) {
424 DEBUG(0, ("smbXsrv_session_close_loop: "
425 "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
426 (unsigned long long)session->global->session_wire_id,
427 nt_errstr(status)));
428 }
429
430 status = smbXsrv_session_logoff(session);
431 if (!NT_STATUS_IS_OK(status)) {
432 DEBUG(0, ("smbXsrv_session_close_loop: "
433 "smbXsrv_session_logoff(%llu) failed: %s\n",
434 (unsigned long long)session->global->session_wire_id,
435 nt_errstr(status)));
436 }
437
438 TALLOC_FREE(session);
439 }
440
441 struct smb1srv_session_local_allocate_state {
442 const uint32_t lowest_id;
443 const uint32_t highest_id;
444 uint32_t last_id;
445 uint32_t useable_id;
446 NTSTATUS status;
447 };
448
449 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
450 void *private_data)
451 {
452 struct smb1srv_session_local_allocate_state *state =
453 (struct smb1srv_session_local_allocate_state *)private_data;
454 TDB_DATA key = dbwrap_record_get_key(rec);
455 uint32_t id = 0;
456 NTSTATUS status;
457
458 status = smbXsrv_session_local_key_to_id(key, &id);
459 if (!NT_STATUS_IS_OK(status)) {
460 state->status = status;
461 return -1;
462 }
463
464 if (id <= state->last_id) {
465 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
466 return -1;
467 }
468 state->last_id = id;
469
470 if (id > state->useable_id) {
471 state->status = NT_STATUS_OK;
472 return -1;
473 }
474
475 if (state->useable_id == state->highest_id) {
476 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
477 return -1;
478 }
479
480 state->useable_id +=1;
481 return 0;
482 }
483
484 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
485 uint32_t lowest_id,
486 uint32_t highest_id,
487 TALLOC_CTX *mem_ctx,
488 struct db_record **_rec,
489 uint32_t *_id)
490 {
491 struct smb1srv_session_local_allocate_state state = {
492 .lowest_id = lowest_id,
493 .highest_id = highest_id,
494 .last_id = 0,
495 .useable_id = lowest_id,
496 .status = NT_STATUS_INTERNAL_ERROR,
497 };
498 uint32_t i;
499 uint32_t range;
500 NTSTATUS status;
501 int count = 0;
502
503 *_rec = NULL;
504 *_id = 0;
505
506 if (lowest_id > highest_id) {
507 return NT_STATUS_INSUFFICIENT_RESOURCES;
508 }
509
510 /*
511 * first we try randomly
512 */
513 range = (highest_id - lowest_id) + 1;
514
515 for (i = 0; i < (range / 2); i++) {
516 uint32_t id;
517 TDB_DATA val;
518 struct db_record *rec = NULL;
519
520 id = generate_random() % range;
521 id += lowest_id;
522
523 if (id < lowest_id) {
524 id = lowest_id;
525 }
526 if (id > highest_id) {
527 id = highest_id;
528 }
529
530 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
531 if (rec == NULL) {
532 return NT_STATUS_INSUFFICIENT_RESOURCES;
533 }
534
535 val = dbwrap_record_get_value(rec);
536 if (val.dsize != 0) {
537 TALLOC_FREE(rec);
538 continue;
539 }
540
541 *_rec = rec;
542 *_id = id;
543 return NT_STATUS_OK;
544 }
545
546 /*
547 * if the range is almost full,
548 * we traverse the whole table
549 * (this relies on sorted behavior of dbwrap_rbt)
550 */
551 status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
552 &state, &count);
553 if (NT_STATUS_IS_OK(status)) {
554 if (NT_STATUS_IS_OK(state.status)) {
555 return NT_STATUS_INTERNAL_ERROR;
556 }
557
558 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
559 return state.status;
560 }
561
562 if (state.useable_id <= state.highest_id) {
563 state.status = NT_STATUS_OK;
564 } else {
565 return NT_STATUS_INSUFFICIENT_RESOURCES;
566 }
567 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
568 /*
569 * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
570 *
571 * If we get anything else it is an error, because it
572 * means we did not manage to find a free slot in
573 * the db.
574 */
575 return NT_STATUS_INSUFFICIENT_RESOURCES;
576 }
577
578 if (NT_STATUS_IS_OK(state.status)) {
579 uint32_t id;
580 TDB_DATA val;
581 struct db_record *rec = NULL;
582
583 id = state.useable_id;
584
585 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
586 if (rec == NULL) {
587 return NT_STATUS_INSUFFICIENT_RESOURCES;
588 }
589
590 val = dbwrap_record_get_value(rec);
591 if (val.dsize != 0) {
592 TALLOC_FREE(rec);
593 return NT_STATUS_INTERNAL_DB_CORRUPTION;
594 }
595
596 *_rec = rec;
597 *_id = id;
598 return NT_STATUS_OK;
599 }
600
601 return state.status;
602 }
603
604 struct smbXsrv_session_local_fetch_state {
605 struct smbXsrv_session *session;
606 NTSTATUS status;
607 };
608
609 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
610 void *private_data)
611 {
612 struct smbXsrv_session_local_fetch_state *state =
613 (struct smbXsrv_session_local_fetch_state *)private_data;
614 void *ptr;
615
616 if (data.dsize != sizeof(ptr)) {
617 state->status = NT_STATUS_INTERNAL_DB_ERROR;
618 return;
619 }
620
621 memcpy(&ptr, data.dptr, data.dsize);
622 state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
623 state->status = NT_STATUS_OK;
624 }
625
626 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
627 /* conn: optional */
628 struct smbXsrv_connection *conn,
629 uint32_t session_local_id,
630 NTTIME now,
631 struct smbXsrv_session **_session)
632 {
633 struct smbXsrv_session_local_fetch_state state = {
634 .session = NULL,
635 .status = NT_STATUS_INTERNAL_ERROR,
636 };
637 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
638 TDB_DATA key;
639 NTSTATUS status;
640
641 *_session = NULL;
642
643 if (session_local_id == 0) {
644 return NT_STATUS_USER_SESSION_DELETED;
645 }
646
647 if (table == NULL) {
648 /* this might happen before the end of negprot */
649 return NT_STATUS_USER_SESSION_DELETED;
650 }
651
652 if (table->local.db_ctx == NULL) {
653 return NT_STATUS_INTERNAL_ERROR;
654 }
655
656 key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
657
658 status = dbwrap_parse_record(table->local.db_ctx, key,
659 smbXsrv_session_local_fetch_parser,
660 &state);
661 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
662 return NT_STATUS_USER_SESSION_DELETED;
663 } else if (!NT_STATUS_IS_OK(status)) {
664 return status;
665 }
666 if (!NT_STATUS_IS_OK(state.status)) {
667 return state.status;
668 }
669
670 if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
671 return NT_STATUS_USER_SESSION_DELETED;
672 }
673
674 /*
675 * If a connection is specified check if the session is
676 * valid on the channel.
677 */
678 if (conn != NULL) {
679 struct smbXsrv_channel_global0 *c = NULL;
680
681 status = smbXsrv_session_find_channel(state.session, conn, &c);
682 if (!NT_STATUS_IS_OK(status)) {
683 return status;
684 }
685 }
686
687 state.session->idle_time = now;
688
689 if (!NT_STATUS_IS_OK(state.session->status)) {
690 *_session = state.session;
691 return state.session->status;
692 }
693
694 if (now > state.session->global->expiration_time) {
695 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
696 }
697
698 *_session = state.session;
699 return state.session->status;
700 }
701
702 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
703 {
704 return 0;
705 }
706
707 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
708 bool *is_free,
709 bool *was_free,
710 TALLOC_CTX *mem_ctx,
711 struct smbXsrv_session_global0 **_g);
712
713 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
714 TALLOC_CTX *mem_ctx,
715 struct smbXsrv_session_global0 **_global)
716 {
717 uint32_t i;
718 struct smbXsrv_session_global0 *global = NULL;
719 uint32_t last_free = 0;
720 const uint32_t min_tries = 3;
721
722 *_global = NULL;
723
724 global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
725 if (global == NULL) {
726 return NT_STATUS_NO_MEMORY;
727 }
728 talloc_set_destructor(global, smbXsrv_session_global_destructor);
729
730 /*
731 * Here we just randomly try the whole 32-bit space
732 *
733 * We use just 32-bit, because we want to reuse the
734 * ID for SRVSVC.
735 */
736 for (i = 0; i < UINT32_MAX; i++) {
737 bool is_free = false;
738 bool was_free = false;
739 uint32_t id;
740
741 if (i >= min_tries && last_free != 0) {
742 id = last_free;
743 } else {
744 id = generate_random();
745 }
746 if (id == 0) {
747 id++;
748 }
749 if (id == UINT32_MAX) {
750 id--;
751 }
752
753 global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
754 mem_ctx);
755 if (global->db_rec == NULL) {
756 talloc_free(global);
757 return NT_STATUS_INSUFFICIENT_RESOURCES;
758 }
759
760 smbXsrv_session_global_verify_record(global->db_rec,
761 &is_free,
762 &was_free,
763 NULL, NULL);
764
765 if (!is_free) {
766 TALLOC_FREE(global->db_rec);
767 continue;
768 }
769
770 if (!was_free && i < min_tries) {
771 /*
772 * The session_id is free now,
773 * but was not free before.
774 *
775 * This happens if a smbd crashed
776 * and did not cleanup the record.
777 *
778 * If this is one of our first tries,
779 * then we try to find a real free one.
780 */
781 if (last_free == 0) {
782 last_free = id;
783 }
784 TALLOC_FREE(global->db_rec);
785 continue;
786 }
787
788 global->session_global_id = id;
789
790 *_global = global;
791 return NT_STATUS_OK;
792 }
793
794 /* should not be reached */
795 talloc_free(global);
796 return NT_STATUS_INTERNAL_ERROR;
797 }
798
799 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
800 bool *is_free,
801 bool *was_free,
802 TALLOC_CTX *mem_ctx,
803 struct smbXsrv_session_global0 **_g)
804 {
805 TDB_DATA key;
806 TDB_DATA val;
807 DATA_BLOB blob;
808 struct smbXsrv_session_globalB global_blob;
809 enum ndr_err_code ndr_err;
810 struct smbXsrv_session_global0 *global = NULL;
811 bool exists;
812 TALLOC_CTX *frame = talloc_stackframe();
813
814 *is_free = false;
815
816 if (was_free) {
817 *was_free = false;
818 }
819 if (_g) {
820 *_g = NULL;
821 }
822
823 key = dbwrap_record_get_key(db_rec);
824
825 val = dbwrap_record_get_value(db_rec);
826 if (val.dsize == 0) {
827 TALLOC_FREE(frame);
828 *is_free = true;
829 if (was_free) {
830 *was_free = true;
831 }
832 return;
833 }
834
835 blob = data_blob_const(val.dptr, val.dsize);
836
837 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
838 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
839 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
840 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
841 DEBUG(1,("smbXsrv_session_global_verify_record: "
842 "key '%s' ndr_pull_struct_blob - %s\n",
843 hex_encode_talloc(frame, key.dptr, key.dsize),
844 nt_errstr(status)));
845 TALLOC_FREE(frame);
846 *is_free = true;
847 if (was_free) {
848 *was_free = true;
849 }
850 return;
851 }
852
853 DEBUG(10,("smbXsrv_session_global_verify_record\n"));
854 if (DEBUGLVL(10)) {
855 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
856 }
857
858 if (global_blob.version != SMBXSRV_VERSION_0) {
859 DEBUG(0,("smbXsrv_session_global_verify_record: "
860 "key '%s' use unsupported version %u\n",
861 hex_encode_talloc(frame, key.dptr, key.dsize),
862 global_blob.version));
863 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
864 TALLOC_FREE(frame);
865 *is_free = true;
866 if (was_free) {
867 *was_free = true;
868 }
869 return;
870 }
871
872 global = global_blob.info.info0;
873
874 exists = serverid_exists(&global->channels[0].server_id);
875 if (!exists) {
876 struct server_id_buf idbuf;
877 DEBUG(2,("smbXsrv_session_global_verify_record: "
878 "key '%s' server_id %s does not exist.\n",
879 hex_encode_talloc(frame, key.dptr, key.dsize),
880 server_id_str_buf(global->channels[0].server_id,
881 &idbuf)));
882 if (DEBUGLVL(2)) {
883 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
884 }
885 TALLOC_FREE(frame);
886 dbwrap_record_delete(db_rec);
887 *is_free = true;
888 return;
889 }
890
891 if (_g) {
892 *_g = talloc_move(mem_ctx, &global);
893 }
894 TALLOC_FREE(frame);
895 }
896
897 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
898 {
899 struct smbXsrv_session_globalB global_blob;
900 DATA_BLOB blob = data_blob_null;
901 TDB_DATA key;
902 TDB_DATA val;
903 NTSTATUS status;
904 enum ndr_err_code ndr_err;
905
906 /*
907 * TODO: if we use other versions than '0'
908 * we would add glue code here, that would be able to
909 * store the information in the old format.
910 */
911
912 if (global->db_rec == NULL) {
913 return NT_STATUS_INTERNAL_ERROR;
914 }
915
916 key = dbwrap_record_get_key(global->db_rec);
917 val = dbwrap_record_get_value(global->db_rec);
918
919 ZERO_STRUCT(global_blob);
920 global_blob.version = smbXsrv_version_global_current();
921 if (val.dsize >= 8) {
922 global_blob.seqnum = IVAL(val.dptr, 4);
923 }
924 global_blob.seqnum += 1;
925 global_blob.info.info0 = global;
926
927 ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
928 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
929 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
930 status = ndr_map_error2ntstatus(ndr_err);
931 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
932 hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
933 nt_errstr(status)));
934 TALLOC_FREE(global->db_rec);
935 return status;
936 }
937
938 val = make_tdb_data(blob.data, blob.length);
939 status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
940 if (!NT_STATUS_IS_OK(status)) {
941 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
942 hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
943 nt_errstr(status)));
944 TALLOC_FREE(global->db_rec);
945 return status;
946 }
947
948 if (DEBUGLVL(10)) {
949 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
950 hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
951 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
952 }
953
954 TALLOC_FREE(global->db_rec);
955
956 return NT_STATUS_OK;
957 }
958
959 struct smb2srv_session_close_previous_state {
960 struct tevent_context *ev;
961 struct smbXsrv_connection *connection;
962 struct dom_sid *current_sid;
963 uint64_t previous_session_id;
964 uint64_t current_session_id;
965 struct db_record *db_rec;
966 };
967
968 static void smb2srv_session_close_previous_check(struct tevent_req *req);
969 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
970
971 struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
972 struct tevent_context *ev,
973 struct smbXsrv_connection *conn,
974 struct auth_session_info *session_info,
975 uint64_t previous_session_id,
976 uint64_t current_session_id)
977 {
978 struct tevent_req *req;
979 struct smb2srv_session_close_previous_state *state;
980 uint32_t global_id = previous_session_id & UINT32_MAX;
981 uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
982 struct smbXsrv_session_table *table = conn->client->session_table;
983 struct security_token *current_token = NULL;
984
985 req = tevent_req_create(mem_ctx, &state,
986 struct smb2srv_session_close_previous_state);
987 if (req == NULL) {
988 return NULL;
989 }
990 state->ev = ev;
991 state->connection = conn;
992 state->previous_session_id = previous_session_id;
993 state->current_session_id = current_session_id;
994
995 if (global_zeros != 0) {
996 tevent_req_done(req);
997 return tevent_req_post(req, ev);
998 }
999
1000 if (session_info == NULL) {
1001 tevent_req_done(req);
1002 return tevent_req_post(req, ev);
1003 }
1004 current_token = session_info->security_token;
1005
1006 if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
1007 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
1008 }
1009
1010 if (state->current_sid == NULL) {
1011 tevent_req_done(req);
1012 return tevent_req_post(req, ev);
1013 }
1014
1015 if (!security_token_has_nt_authenticated_users(current_token)) {
1016 /* TODO */
1017 tevent_req_done(req);
1018 return tevent_req_post(req, ev);
1019 }
1020
1021 state->db_rec = smbXsrv_session_global_fetch_locked(
1022 table->global.db_ctx,
1023 global_id,
1024 state /* TALLOC_CTX */);
1025 if (state->db_rec == NULL) {
1026 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1027 return tevent_req_post(req, ev);
1028 }
1029
1030 smb2srv_session_close_previous_check(req);
1031 if (!tevent_req_is_in_progress(req)) {
1032 return tevent_req_post(req, ev);
1033 }
1034
1035 return req;
1036 }
1037
1038 static void smb2srv_session_close_previous_check(struct tevent_req *req)
1039 {
1040 struct smb2srv_session_close_previous_state *state =
1041 tevent_req_data(req,
1042 struct smb2srv_session_close_previous_state);
1043 struct smbXsrv_connection *conn = state->connection;
1044 DATA_BLOB blob;
1045 struct security_token *previous_token = NULL;
1046 struct smbXsrv_session_global0 *global = NULL;
1047 enum ndr_err_code ndr_err;
1048 struct smbXsrv_session_close0 close_info0;
1049 struct smbXsrv_session_closeB close_blob;
1050 struct tevent_req *subreq = NULL;
1051 NTSTATUS status;
1052 bool is_free = false;
1053
1054 smbXsrv_session_global_verify_record(state->db_rec,
1055 &is_free,
1056 NULL,
1057 state,
1058 &global);
1059
1060 if (is_free) {
1061 TALLOC_FREE(state->db_rec);
1062 tevent_req_done(req);
1063 return;
1064 }
1065
1066 if (global->auth_session_info == NULL) {
1067 TALLOC_FREE(state->db_rec);
1068 tevent_req_done(req);
1069 return;
1070 }
1071
1072 previous_token = global->auth_session_info->security_token;
1073
1074 if (!security_token_is_sid(previous_token, state->current_sid)) {
1075 TALLOC_FREE(state->db_rec);
1076 tevent_req_done(req);
1077 return;
1078 }
1079
1080 subreq = dbwrap_watched_watch_send(state, state->ev, state->db_rec,
1081 (struct server_id){0});
1082 if (tevent_req_nomem(subreq, req)) {
1083 TALLOC_FREE(state->db_rec);
1084 return;
1085 }
1086 tevent_req_set_callback(subreq,
1087 smb2srv_session_close_previous_modified,
1088 req);
1089
1090 close_info0.old_session_global_id = global->session_global_id;
1091 close_info0.old_session_wire_id = global->session_wire_id;
1092 close_info0.old_creation_time = global->creation_time;
1093 close_info0.new_session_wire_id = state->current_session_id;
1094
1095 ZERO_STRUCT(close_blob);
1096 close_blob.version = smbXsrv_version_global_current();
1097 close_blob.info.info0 = &close_info0;
1098
1099 ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1100 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1101 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1102 TALLOC_FREE(state->db_rec);
1103 status = ndr_map_error2ntstatus(ndr_err);
1104 DEBUG(1,("smb2srv_session_close_previous_check: "
1105 "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1106 (unsigned long long)close_info0.old_session_wire_id,
1107 (unsigned long long)close_info0.new_session_wire_id,
1108 nt_errstr(status)));
1109 tevent_req_nterror(req, status);
1110 return;
1111 }
1112
1113 status = messaging_send(conn->client->msg_ctx,
1114 global->channels[0].server_id,
1115 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1116 TALLOC_FREE(state->db_rec);
1117 if (tevent_req_nterror(req, status)) {
1118 return;
1119 }
1120
1121 TALLOC_FREE(global);
1122 return;
1123 }
1124
1125 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1126 {
1127 struct tevent_req *req =
1128 tevent_req_callback_data(subreq,
1129 struct tevent_req);
1130 struct smb2srv_session_close_previous_state *state =
1131 tevent_req_data(req,
1132 struct smb2srv_session_close_previous_state);
1133 uint32_t global_id;
1134 NTSTATUS status;
1135
1136 status = dbwrap_watched_watch_recv(subreq, NULL, NULL);
1137 TALLOC_FREE(subreq);
1138 if (tevent_req_nterror(req, status)) {
1139 return;
1140 }
1141
1142 global_id = state->previous_session_id & UINT32_MAX;
1143
1144 state->db_rec = smbXsrv_session_global_fetch_locked(
1145 state->connection->client->session_table->global.db_ctx,
1146 global_id, state /* TALLOC_CTX */);
1147
1148 smb2srv_session_close_previous_check(req);
1149 }
1150
1151 NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1152 {
1153 NTSTATUS status;
1154
1155 if (tevent_req_is_nterror(req, &status)) {
1156 tevent_req_received(req);
1157 return status;
1158 }
1159
1160 tevent_req_received(req);
1161 return NT_STATUS_OK;
1162 }
1163
1164 static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1165 {
1166 NTSTATUS status;
1167 struct smbXsrv_connection *xconn = NULL;
1168
1169 if (session->client != NULL) {
1170 xconn = session->client->connections;
1171 }
1172
1173 for (; xconn != NULL; xconn = xconn->next) {
1174 struct smbd_smb2_request *preq;
1175
1176 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1177 if (preq->session != session) {
1178 continue;
1179 }
1180
1181 preq->session = NULL;
1182 /*
1183 * If we no longer have a session we can't
1184 * sign or encrypt replies.
1185 */
1186 preq->do_signing = false;
1187 preq->do_encryption = false;
1188 preq->preauth = NULL;
1189 }
1190 }
1191
1192 status = smbXsrv_session_logoff(session);
1193 return status;
1194 }
1195
1196 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1197 {
1198 NTSTATUS status;
1199
1200 status = smbXsrv_session_clear_and_logoff(session);
1201 if (!NT_STATUS_IS_OK(status)) {
1202 DEBUG(0, ("smbXsrv_session_destructor: "
1203 "smbXsrv_session_logoff() failed: %s\n",
1204 nt_errstr(status)));
1205 }
1206
1207 TALLOC_FREE(session->global);
1208
1209 return 0;
1210 }
1211
1212 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1213 NTTIME now,
1214 struct smbXsrv_session **_session)
1215 {
1216 struct smbXsrv_session_table *table = conn->client->session_table;
1217 struct db_record *local_rec = NULL;
1218 struct smbXsrv_session *session = NULL;
1219 void *ptr = NULL;
1220 TDB_DATA val;
1221 struct smbXsrv_session_global0 *global = NULL;
1222 struct smbXsrv_channel_global0 *channel = NULL;
1223 NTSTATUS status;
1224
1225 if (table->local.num_sessions >= table->local.max_sessions) {
1226 return NT_STATUS_INSUFFICIENT_RESOURCES;
1227 }
1228
1229 session = talloc_zero(table, struct smbXsrv_session);
1230 if (session == NULL) {
1231 return NT_STATUS_NO_MEMORY;
1232 }
1233 session->table = table;
1234 session->idle_time = now;
1235 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1236 session->client = conn->client;
1237 session->homes_snum = -1;
1238
1239 status = smbXsrv_session_global_allocate(table->global.db_ctx,
1240 session,
1241 &global);
1242 if (!NT_STATUS_IS_OK(status)) {
1243 TALLOC_FREE(session);
1244 return status;
1245 }
1246 session->global = global;
1247
1248 if (conn->protocol >= PROTOCOL_SMB2_02) {
1249 uint64_t id = global->session_global_id;
1250
1251 global->connection_dialect = conn->smb2.server.dialect;
1252
1253 global->session_wire_id = id;
1254
1255 status = smb2srv_tcon_table_init(session);
1256 if (!NT_STATUS_IS_OK(status)) {
1257 TALLOC_FREE(session);
1258 return status;
1259 }
1260
1261 session->local_id = global->session_global_id;
1262
1263 local_rec = smbXsrv_session_local_fetch_locked(
1264 table->local.db_ctx,
1265 session->local_id,
1266 session /* TALLOC_CTX */);
1267 if (local_rec == NULL) {
1268 TALLOC_FREE(session);
1269 return NT_STATUS_NO_MEMORY;
1270 }
1271
1272 val = dbwrap_record_get_value(local_rec);
1273 if (val.dsize != 0) {
1274 TALLOC_FREE(session);
1275 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1276 }
1277 } else {
1278
1279 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1280 table->local.lowest_id,
1281 table->local.highest_id,
1282 session,
1283 &local_rec,
1284 &session->local_id);
1285 if (!NT_STATUS_IS_OK(status)) {
1286 TALLOC_FREE(session);
1287 return status;
1288 }
1289
1290 global->session_wire_id = session->local_id;
1291 }
1292
1293 global->creation_time = now;
1294 global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1295
1296 status = smbXsrv_session_add_channel(session, conn, now, &channel);
1297 if (!NT_STATUS_IS_OK(status)) {
1298 TALLOC_FREE(session);
1299 return status;
1300 }
1301
1302 ptr = session;
1303 val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1304 status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1305 TALLOC_FREE(local_rec);
1306 if (!NT_STATUS_IS_OK(status)) {
1307 TALLOC_FREE(session);
1308 return status;
1309 }
1310 table->local.num_sessions += 1;
1311
1312 talloc_set_destructor(session, smbXsrv_session_destructor);
1313
1314 status = smbXsrv_session_global_store(global);
1315 if (!NT_STATUS_IS_OK(status)) {
1316 DEBUG(0,("smbXsrv_session_create: "
1317 "global_id (0x%08x) store failed - %s\n",
1318 session->global->session_global_id,
1319 nt_errstr(status)));
1320 TALLOC_FREE(session);
1321 return status;
1322 }
1323
1324 if (DEBUGLVL(10)) {
1325 struct smbXsrv_sessionB session_blob = {
1326 .version = SMBXSRV_VERSION_0,
1327 .info.info0 = session,
1328 };
1329
1330 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1331 session->global->session_global_id));
1332 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1333 }
1334
1335 *_session = session;
1336 return NT_STATUS_OK;
1337 }
1338
1339 NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1340 struct smbXsrv_connection *conn,
1341 NTTIME now,
1342 struct smbXsrv_channel_global0 **_c)
1343 {
1344 struct smbXsrv_session_global0 *global = session->global;
1345 struct smbXsrv_channel_global0 *c = NULL;
1346
1347 if (global->num_channels > 31) {
1348 /*
1349 * Windows allow up to 32 channels
1350 */
1351 return NT_STATUS_INSUFFICIENT_RESOURCES;
1352 }
1353
1354 c = talloc_realloc(global,
1355 global->channels,
1356 struct smbXsrv_channel_global0,
1357 global->num_channels + 1);
1358 if (c == NULL) {
1359 return NT_STATUS_NO_MEMORY;
1360 }
1361 global->channels = c;
1362
1363 c = &global->channels[global->num_channels];
1364 ZERO_STRUCTP(c);
1365
1366 c->server_id = messaging_server_id(conn->client->msg_ctx);
1367 c->channel_id = conn->channel_id;
1368 c->creation_time = now;
1369 c->local_address = tsocket_address_string(conn->local_address,
1370 global->channels);
1371 if (c->local_address == NULL) {
1372 return NT_STATUS_NO_MEMORY;
1373 }
1374 c->remote_address = tsocket_address_string(conn->remote_address,
1375 global->channels);
1376 if (c->remote_address == NULL) {
1377 return NT_STATUS_NO_MEMORY;
1378 }
1379 c->remote_name = talloc_strdup(global->channels,
1380 conn->remote_hostname);
1381 if (c->remote_name == NULL) {
1382 return NT_STATUS_NO_MEMORY;
1383 }
1384 c->connection = conn;
1385
1386 global->num_channels += 1;
1387
1388 *_c = c;
1389 return NT_STATUS_OK;
1390 }
1391
1392 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1393 {
1394 struct smbXsrv_session_table *table = session->table;
1395 NTSTATUS status;
1396
1397 if (session->global->db_rec != NULL) {
1398 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1399 "Called with db_rec != NULL'\n",
1400 session->global->session_global_id));
1401 return NT_STATUS_INTERNAL_ERROR;
1402 }
1403
1404 session->global->db_rec = smbXsrv_session_global_fetch_locked(
1405 table->global.db_ctx,
1406 session->global->session_global_id,
1407 session->global /* TALLOC_CTX */);
1408 if (session->global->db_rec == NULL) {
1409 return NT_STATUS_INTERNAL_DB_ERROR;
1410 }
1411
1412 status = smbXsrv_session_global_store(session->global);
1413 if (!NT_STATUS_IS_OK(status)) {
1414 DEBUG(0,("smbXsrv_session_update: "
1415 "global_id (0x%08x) store failed - %s\n",
1416 session->global->session_global_id,
1417 nt_errstr(status)));
1418 return status;
1419 }
1420
1421 if (DEBUGLVL(10)) {
1422 struct smbXsrv_sessionB session_blob = {
1423 .version = SMBXSRV_VERSION_0,
1424 .info.info0 = session,
1425 };
1426
1427 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1428 session->global->session_global_id));
1429 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1430 }
1431
1432 return NT_STATUS_OK;
1433 }
1434
1435 NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1436 const struct smbXsrv_connection *conn,
1437 struct smbXsrv_channel_global0 **_c)
1438 {
1439 uint32_t i;
1440
1441 for (i=0; i < session->global->num_channels; i++) {
1442 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1443
1444 if (c->channel_id != conn->channel_id) {
1445 continue;
1446 }
1447
1448 if (c->connection != conn) {
1449 continue;
1450 }
1451
1452 *_c = c;
1453 return NT_STATUS_OK;
1454 }
1455
1456 return NT_STATUS_USER_SESSION_DELETED;
1457 }
1458
1459 NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1460 const struct smbXsrv_connection *conn,
1461 NTTIME now,
1462 struct smbXsrv_session_auth0 **_a)
1463 {
1464 struct smbXsrv_session_auth0 *a;
1465
1466 for (a = session->pending_auth; a != NULL; a = a->next) {
1467 if (a->channel_id != conn->channel_id) {
1468 continue;
1469 }
1470
1471 if (a->connection == conn) {
1472 if (now != 0) {
1473 a->idle_time = now;
1474 }
1475 *_a = a;
1476 return NT_STATUS_OK;
1477 }
1478 }
1479
1480 return NT_STATUS_USER_SESSION_DELETED;
1481 }
1482
1483 static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1484 {
1485 if (a->session == NULL) {
1486 return 0;
1487 }
1488
1489 DLIST_REMOVE(a->session->pending_auth, a);
1490 a->session = NULL;
1491 return 0;
1492 }
1493
1494 NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1495 struct smbXsrv_connection *conn,
1496 NTTIME now,
1497 uint8_t in_flags,
1498 uint8_t in_security_mode,
1499 struct smbXsrv_session_auth0 **_a)
1500 {
1501 struct smbXsrv_session_auth0 *a;
1502 NTSTATUS status;
1503
1504 status = smbXsrv_session_find_auth(session, conn, 0, &a);
1505 if (NT_STATUS_IS_OK(status)) {
1506 return NT_STATUS_INTERNAL_ERROR;
1507 }
1508
1509 a = talloc_zero(session, struct smbXsrv_session_auth0);
1510 if (a == NULL) {
1511 return NT_STATUS_NO_MEMORY;
1512 }
1513 a->session = session;
1514 a->connection = conn;
1515 a->in_flags = in_flags;
1516 a->in_security_mode = in_security_mode;
1517 a->creation_time = now;
1518 a->idle_time = now;
1519 a->channel_id = conn->channel_id;
1520
1521 if (conn->protocol >= PROTOCOL_SMB3_10) {
1522 a->preauth = talloc(a, struct smbXsrv_preauth);
1523 if (a->preauth == NULL) {
1524 TALLOC_FREE(session);
1525 return NT_STATUS_NO_MEMORY;
1526 }
1527 *a->preauth = conn->smb2.preauth;
1528 }
1529
1530 talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1531 DLIST_ADD_END(session->pending_auth, a);
1532
1533 *_a = a;
1534 return NT_STATUS_OK;
1535 }
1536
1537 struct smb2srv_session_shutdown_state {
1538 struct tevent_queue *wait_queue;
1539 };
1540
1541 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1542
1543 struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1544 struct tevent_context *ev,
1545 struct smbXsrv_session *session,
1546 struct smbd_smb2_request *current_req)
1547 {
1548 struct tevent_req *req;
1549 struct smb2srv_session_shutdown_state *state;
1550 struct tevent_req *subreq;
1551 struct smbXsrv_connection *xconn = NULL;
1552 size_t len = 0;
1553
1554 /*
1555 * Make sure that no new request will be able to use this session.
1556 */
1557 session->status = NT_STATUS_USER_SESSION_DELETED;
1558
1559 req = tevent_req_create(mem_ctx, &state,
1560 struct smb2srv_session_shutdown_state);
1561 if (req == NULL) {
1562 return NULL;
1563 }
1564
1565 state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1566 if (tevent_req_nomem(state->wait_queue, req)) {
1567 return tevent_req_post(req, ev);
1568 }
1569
1570 for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1571 struct smbd_smb2_request *preq;
1572
1573 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1574 if (preq == current_req) {
1575 /* Can't cancel current request. */
1576 continue;
1577 }
1578 if (preq->session != session) {
1579 /* Request on different session. */
1580 continue;
1581 }
1582
1583 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1584 preq->session = NULL;
1585 /*
1586 * If we no longer have a session we can't
1587 * sign or encrypt replies.
1588 */
1589 preq->do_signing = false;
1590 preq->do_encryption = false;
1591 preq->preauth = NULL;
1592
1593 if (preq->subreq != NULL) {
1594 tevent_req_cancel(preq->subreq);
1595 }
1596 continue;
1597 }
1598
1599 /*
1600 * Never cancel anything in a compound
1601 * request. Way too hard to deal with
1602 * the result.
1603 */
1604 if (!preq->compound_related && preq->subreq != NULL) {
1605 tevent_req_cancel(preq->subreq);
1606 }
1607
1608 /*
1609 * Now wait until the request is finished.
1610 *
1611 * We don't set a callback, as we just want to block the
1612 * wait queue and the talloc_free() of the request will
1613 * remove the item from the wait queue.
1614 */
1615 subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1616 if (tevent_req_nomem(subreq, req)) {
1617 return tevent_req_post(req, ev);
1618 }
1619 }
1620 }
1621
1622 len = tevent_queue_length(state->wait_queue);
1623 if (len == 0) {
1624 tevent_req_done(req);
1625 return tevent_req_post(req, ev);
1626 }
1627
1628 /*
1629 * Now we add our own waiter to the end of the queue,
1630 * this way we get notified when all pending requests are finished
1631 * and send to the socket.
1632 */
1633 subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1634 if (tevent_req_nomem(subreq, req)) {
1635 return tevent_req_post(req, ev);
1636 }
1637 tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1638
1639 return req;
1640 }
1641
1642 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1643 {
1644 struct tevent_req *req =
1645 tevent_req_callback_data(subreq,
1646 struct tevent_req);
1647
1648 tevent_queue_wait_recv(subreq);
1649 TALLOC_FREE(subreq);
1650
1651 tevent_req_done(req);
1652 }
1653
1654 NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1655 {
1656 return tevent_req_simple_recv_ntstatus(req);
1657 }
1658
1659 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1660 {
1661 struct smbXsrv_session_table *table;
1662 struct db_record *local_rec = NULL;
1663 struct db_record *global_rec = NULL;
1664 struct smbd_server_connection *sconn = NULL;
1665 NTSTATUS status;
1666 NTSTATUS error = NT_STATUS_OK;
1667
1668 if (session->table == NULL) {
1669 return NT_STATUS_OK;
1670 }
1671
1672 table = session->table;
1673 session->table = NULL;
1674
1675 sconn = session->client->sconn;
1676 session->client = NULL;
1677 session->status = NT_STATUS_USER_SESSION_DELETED;
1678
1679 /*
1680 * For SMB2 this is a bit redundant as files are also close
1681 * below via smb2srv_tcon_disconnect_all() -> ... ->
1682 * smbXsrv_tcon_disconnect() -> close_cnum() ->
1683 * file_close_conn().
1684 */
1685 file_close_user(sconn, session->global->session_wire_id);
1686
1687 if (session->tcon_table != NULL) {
1688 /*
1689 * Note: We only have a tcon_table for SMB2.
1690 */
1691 status = smb2srv_tcon_disconnect_all(session);
1692 if (!NT_STATUS_IS_OK(status)) {
1693 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1694 "smb2srv_tcon_disconnect_all() failed: %s\n",
1695 session->global->session_global_id,
1696 nt_errstr(status)));
1697 error = status;
1698 }
1699 }
1700
1701 invalidate_vuid(sconn, session->global->session_wire_id);
1702
1703 global_rec = session->global->db_rec;
1704 session->global->db_rec = NULL;
1705 if (global_rec == NULL) {
1706 global_rec = smbXsrv_session_global_fetch_locked(
1707 table->global.db_ctx,
1708 session->global->session_global_id,
1709 session->global /* TALLOC_CTX */);
1710 if (global_rec == NULL) {
1711 error = NT_STATUS_INTERNAL_ERROR;
1712 }
1713 }
1714
1715 if (global_rec != NULL) {
1716 status = dbwrap_record_delete(global_rec);
1717 if (!NT_STATUS_IS_OK(status)) {
1718 TDB_DATA key = dbwrap_record_get_key(global_rec);
1719
1720 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1721 "failed to delete global key '%s': %s\n",
1722 session->global->session_global_id,
1723 hex_encode_talloc(global_rec, key.dptr,
1724 key.dsize),
1725 nt_errstr(status)));
1726 error = status;
1727 }
1728 }
1729 TALLOC_FREE(global_rec);
1730
1731 local_rec = session->db_rec;
1732 if (local_rec == NULL) {
1733 local_rec = smbXsrv_session_local_fetch_locked(
1734 table->local.db_ctx,
1735 session->local_id,
1736 session /* TALLOC_CTX */);
1737 if (local_rec == NULL) {
1738 error = NT_STATUS_INTERNAL_ERROR;
1739 }
1740 }
1741
1742 if (local_rec != NULL) {
1743 status = dbwrap_record_delete(local_rec);
1744 if (!NT_STATUS_IS_OK(status)) {
1745 TDB_DATA key = dbwrap_record_get_key(local_rec);
1746
1747 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1748 "failed to delete local key '%s': %s\n",
1749 session->global->session_global_id,
1750 hex_encode_talloc(local_rec, key.dptr,
1751 key.dsize),
1752 nt_errstr(status)));
1753 error = status;
1754 }
1755 table->local.num_sessions -= 1;
1756 }
1757 if (session->db_rec == NULL) {
1758 TALLOC_FREE(local_rec);
1759 }
1760 session->db_rec = NULL;
1761
1762 return error;
1763 }
1764
1765 struct smbXsrv_session_logoff_all_state {
1766 NTSTATUS first_status;
1767 int errors;
1768 };
1769
1770 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1771 void *private_data);
1772
1773 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_client *client)
1774 {
1775 struct smbXsrv_session_table *table = client->session_table;
1776 struct smbXsrv_session_logoff_all_state state;
1777 NTSTATUS status;
1778 int count = 0;
1779
1780 if (table == NULL) {
1781 DEBUG(10, ("smbXsrv_session_logoff_all: "
1782 "empty session_table, nothing to do.\n"));
1783 return NT_STATUS_OK;
1784 }
1785
1786 ZERO_STRUCT(state);
1787
1788 status = dbwrap_traverse(table->local.db_ctx,
1789 smbXsrv_session_logoff_all_callback,
1790 &state, &count);
1791 if (!NT_STATUS_IS_OK(status)) {
1792 DEBUG(0, ("smbXsrv_session_logoff_all: "
1793 "dbwrap_traverse() failed: %s\n",
1794 nt_errstr(status)));
1795 return status;
1796 }
1797
1798 if (!NT_STATUS_IS_OK(state.first_status)) {
1799 DEBUG(0, ("smbXsrv_session_logoff_all: "
1800 "count[%d] errors[%d] first[%s]\n",
1801 count, state.errors,
1802 nt_errstr(state.first_status)));
1803 return state.first_status;
1804 }
1805
1806 return NT_STATUS_OK;
1807 }
1808
1809 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1810 void *private_data)
1811 {
1812 struct smbXsrv_session_logoff_all_state *state =
1813 (struct smbXsrv_session_logoff_all_state *)private_data;
1814 TDB_DATA val;
1815 void *ptr = NULL;
1816 struct smbXsrv_session *session = NULL;
1817 NTSTATUS status;
1818
1819 val = dbwrap_record_get_value(local_rec);
1820 if (val.dsize != sizeof(ptr)) {
1821 status = NT_STATUS_INTERNAL_ERROR;
1822 if (NT_STATUS_IS_OK(state->first_status)) {
1823 state->first_status = status;
1824 }
1825 state->errors++;
1826 return 0;
1827 }
1828
1829 memcpy(&ptr, val.dptr, val.dsize);
1830 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1831
1832 session->db_rec = local_rec;
1833
1834 status = smbXsrv_session_clear_and_logoff(session);
1835 if (!NT_STATUS_IS_OK(status)) {
1836 if (NT_STATUS_IS_OK(state->first_status)) {
1837 state->first_status = status;
1838 }
1839 state->errors++;
1840 return 0;
1841 }
1842
1843 return 0;
1844 }
1845
1846 struct smbXsrv_session_local_trav_state {
1847 NTSTATUS status;
1848 int (*caller_cb)(struct smbXsrv_session *session,
1849 void *caller_data);
1850 void *caller_data;
1851 };
1852
1853 static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
1854 void *private_data);
1855
1856 NTSTATUS smbXsrv_session_local_traverse(
1857 struct smbXsrv_client *client,
1858 int (*caller_cb)(struct smbXsrv_session *session,
1859 void *caller_data),
1860 void *caller_data)
1861 {
1862 struct smbXsrv_session_table *table = client->session_table;
1863 struct smbXsrv_session_local_trav_state state;
1864 NTSTATUS status;
1865 int count = 0;
1866
1867 state = (struct smbXsrv_session_local_trav_state) {
1868 .status = NT_STATUS_OK,
1869 .caller_cb = caller_cb,
1870 .caller_data = caller_data,
1871 };
1872
1873 if (table == NULL) {
1874 DBG_DEBUG("empty session_table, nothing to do.\n");
1875 return NT_STATUS_OK;
1876 }
1877
1878 status = dbwrap_traverse(table->local.db_ctx,
1879 smbXsrv_session_local_traverse_cb,
1880 &state,
1881 &count);
1882 if (!NT_STATUS_IS_OK(status)) {
1883 DBG_ERR("dbwrap_traverse() failed: %s\n", nt_errstr(status));
1884 return status;
1885 }
1886 if (!NT_STATUS_IS_OK(state.status)) {
1887 DBG_ERR("count[%d] status[%s]\n",
1888 count, nt_errstr(state.status));
1889 return state.status;
1890 }
1891
1892 return NT_STATUS_OK;
1893 }
1894
1895 static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
1896 void *private_data)
1897 {
1898 struct smbXsrv_session_local_trav_state *state =
1899 (struct smbXsrv_session_local_trav_state *)private_data;
1900 TDB_DATA val;
1901 void *ptr = NULL;
1902 struct smbXsrv_session *session = NULL;
1903
1904 val = dbwrap_record_get_value(local_rec);
1905 if (val.dsize != sizeof(ptr)) {
1906 state->status = NT_STATUS_INTERNAL_ERROR;
1907 return -1;
1908 }
1909
1910 memcpy(&ptr, val.dptr, val.dsize);
1911 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1912 session->db_rec = local_rec;
1913
1914 return state->caller_cb(session, state->caller_data);
1915 }
1916
1917 struct smbXsrv_session_disconnect_xconn_state {
1918 struct smbXsrv_connection *xconn;
1919 NTSTATUS first_status;
1920 int errors;
1921 };
1922
1923 static int smbXsrv_session_disconnect_xconn_callback(struct db_record *local_rec,
1924 void *private_data);
1925
1926 NTSTATUS smbXsrv_session_disconnect_xconn(struct smbXsrv_connection *xconn)
1927 {
1928 struct smbXsrv_client *client = xconn->client;
1929 struct smbXsrv_session_table *table = client->session_table;
1930 struct smbXsrv_session_disconnect_xconn_state state;
1931 NTSTATUS status;
1932 int count = 0;
1933
1934 if (table == NULL) {
1935 DBG_ERR("empty session_table, nothing to do.\n");
1936 return NT_STATUS_OK;
1937 }
1938
1939 ZERO_STRUCT(state);
1940 state.xconn = xconn;
1941
1942 status = dbwrap_traverse(table->local.db_ctx,
1943 smbXsrv_session_disconnect_xconn_callback,
1944 &state, &count);
1945 if (!NT_STATUS_IS_OK(status)) {
1946 DBG_ERR("dbwrap_traverse() failed: %s\n",
1947 nt_errstr(status));
1948 return status;
1949 }
1950
1951 if (!NT_STATUS_IS_OK(state.first_status)) {
1952 DBG_ERR("count[%d] errors[%d] first[%s]\n",
1953 count, state.errors,
1954 nt_errstr(state.first_status));
1955 return state.first_status;
1956 }
1957
1958 return NT_STATUS_OK;
1959 }
1960
1961 static int smbXsrv_session_disconnect_xconn_callback(struct db_record *local_rec,
1962 void *private_data)
1963 {
1964 struct smbXsrv_session_disconnect_xconn_state *state =
1965 (struct smbXsrv_session_disconnect_xconn_state *)private_data;
1966 TDB_DATA val;
1967 void *ptr = NULL;
1968 struct smbXsrv_session *session = NULL;
1969 struct smbXsrv_session_auth0 *a = NULL;
1970 struct smbXsrv_channel_global0 *c = NULL;
1971 NTSTATUS status;
1972 bool need_update = false;
1973
1974 val = dbwrap_record_get_value(local_rec);
1975 if (val.dsize != sizeof(ptr)) {
1976 status = NT_STATUS_INTERNAL_ERROR;
1977 if (NT_STATUS_IS_OK(state->first_status)) {
1978 state->first_status = status;
1979 }
1980 state->errors++;
1981 return 0;
1982 }
1983
1984 memcpy(&ptr, val.dptr, val.dsize);
1985 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1986
1987 session->db_rec = local_rec;
1988
1989 status = smbXsrv_session_find_auth(session, state->xconn, 0, &a);
1990 if (!NT_STATUS_IS_OK(status)) {
1991 a = NULL;
1992 }
1993 status = smbXsrv_session_find_channel(session, state->xconn, &c);
1994 if (!NT_STATUS_IS_OK(status)) {
1995 c = NULL;
1996 }
1997 if (session->global->num_channels <= 1) {
1998 /*
1999 * The last channel is treated different
2000 */
2001 c = NULL;
2002 }
2003
2004 if (a != NULL) {
2005 smbXsrv_session_auth0_destructor(a);
2006 a->connection = NULL;
2007 need_update = true;
2008 }
2009
2010 if (c != NULL) {
2011 struct smbXsrv_session_global0 *global = session->global;
2012 ptrdiff_t n;
2013
2014 n = (c - global->channels);
2015 if (n >= global->num_channels || n < 0) {
2016 status = NT_STATUS_INTERNAL_ERROR;
2017 if (NT_STATUS_IS_OK(state->first_status)) {
2018 state->first_status = status;
2019 }
2020 state->errors++;
2021 return 0;
2022 }
2023 ARRAY_DEL_ELEMENT(global->channels, n, global->num_channels);
2024 global->num_channels--;
2025 need_update = true;
2026 }
2027
2028 if (need_update) {
2029 status = smbXsrv_session_update(session);
2030 if (NT_STATUS_IS_OK(state->first_status)) {
2031 state->first_status = status;
2032 }
2033 state->errors++;
2034 }
2035
2036 return 0;
2037 }
2038
2039 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
2040 {
2041 /*
2042 * Allow a range from 1..65534 with 65534 values.
2043 */
2044 return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
2045 UINT16_MAX - 1);
2046 }
2047
2048 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
2049 uint16_t vuid, NTTIME now,
2050 struct smbXsrv_session **session)
2051 {
2052 struct smbXsrv_session_table *table = conn->client->session_table;
2053 uint32_t local_id = vuid;
2054
2055 return smbXsrv_session_local_lookup(table, conn, local_id, now,
2056 session);
2057 }
2058
2059 NTSTATUS smbXsrv_session_info_lookup(struct smbXsrv_client *client,
2060 uint64_t session_wire_id,
2061 struct auth_session_info **si)
2062 {
2063 struct smbXsrv_session_table *table = client->session_table;
2064 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
2065 struct smbXsrv_session_local_fetch_state state = {
2066 .session = NULL,
2067 .status = NT_STATUS_INTERNAL_ERROR,
2068 };
2069 TDB_DATA key;
2070 NTSTATUS status;
2071
2072 if (session_wire_id == 0) {
2073 return NT_STATUS_USER_SESSION_DELETED;
2074 }
2075
2076 if (table == NULL) {
2077 /* this might happen before the end of negprot */
2078 return NT_STATUS_USER_SESSION_DELETED;
2079 }
2080
2081 if (table->local.db_ctx == NULL) {
2082 return NT_STATUS_INTERNAL_ERROR;
2083 }
2084
2085 key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
2086
2087 status = dbwrap_parse_record(table->local.db_ctx, key,
2088 smbXsrv_session_local_fetch_parser,
2089 &state);
2090 if (!NT_STATUS_IS_OK(status)) {
2091 return status;
2092 }
2093 if (!NT_STATUS_IS_OK(state.status)) {
2094 return state.status;
2095 }
2096 if (state.session->global->auth_session_info == NULL) {
2097 return NT_STATUS_USER_SESSION_DELETED;
2098 }
2099
2100 *si = state.session->global->auth_session_info;
2101 return NT_STATUS_OK;
2102 }
2103
2104 /*
2105 * In memory of get_valid_user_struct()
2106 *
2107 * This function is similar to smbXsrv_session_local_lookup() and it's wrappers,
2108 * but it doesn't implement the state checks of
2109 * those. get_valid_smbXsrv_session() is NOT meant to be called to validate the
2110 * session wire-id of incoming SMB requests, it MUST only be used in later
2111 * internal processing where the session wire-id has already been validated.
2112 */
2113 NTSTATUS get_valid_smbXsrv_session(struct smbXsrv_client *client,
2114 uint64_t session_wire_id,
2115 struct smbXsrv_session **session)
2116 {
2117 struct smbXsrv_session_table *table = client->session_table;
2118 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
2119 struct smbXsrv_session_local_fetch_state state = {
2120 .session = NULL,
2121 .status = NT_STATUS_INTERNAL_ERROR,
2122 };
2123 TDB_DATA key;
2124 NTSTATUS status;
2125
2126 if (session_wire_id == 0) {
2127 return NT_STATUS_USER_SESSION_DELETED;
2128 }
2129
2130 if (table == NULL) {
2131 /* this might happen before the end of negprot */
2132 return NT_STATUS_USER_SESSION_DELETED;
2133 }
2134
2135 if (table->local.db_ctx == NULL) {
2136 return NT_STATUS_INTERNAL_ERROR;
2137 }
2138
2139 key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
2140
2141 status = dbwrap_parse_record(table->local.db_ctx, key,
2142 smbXsrv_session_local_fetch_parser,
2143 &state);
2144 if (!NT_STATUS_IS_OK(status)) {
2145 return status;
2146 }
2147 if (!NT_STATUS_IS_OK(state.status)) {
2148 return state.status;
2149 }
2150 if (state.session->global->auth_session_info == NULL) {
2151 return NT_STATUS_USER_SESSION_DELETED;
2152 }
2153
2154 *session = state.session;
2155 return NT_STATUS_OK;
2156 }
2157
2158 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
2159 {
2160 /*
2161 * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
2162 */
2163 return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
2164 UINT16_MAX - 1);
2165 }
2166
2167 static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
2168 /* conn: optional */
2169 struct smbXsrv_connection *conn,
2170 uint64_t session_id, NTTIME now,
2171 struct smbXsrv_session **session)
2172 {
2173 uint32_t local_id = session_id & UINT32_MAX;
2174 uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
2175
2176 if (local_zeros != 0) {
2177 return NT_STATUS_USER_SESSION_DELETED;
2178 }
2179
2180 return smbXsrv_session_local_lookup(table, conn, local_id, now,
2181 session);
2182 }
2183
2184 NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
2185 uint64_t session_id, NTTIME now,
2186 struct smbXsrv_session **session)
2187 {
2188 struct smbXsrv_session_table *table = conn->client->session_table;
2189 return smb2srv_session_lookup_raw(table, conn, session_id, now,
2190 session);
2191 }
2192
2193 NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
2194 uint64_t session_id, NTTIME now,
2195 struct smbXsrv_session **session)
2196 {
2197 struct smbXsrv_session_table *table = client->session_table;
2198 return smb2srv_session_lookup_raw(table, NULL, session_id, now,
2199 session);
2200 }
2201
2202 struct smbXsrv_session_global_traverse_state {
2203 int (*fn)(struct smbXsrv_session_global0 *, void *);
2204 void *private_data;
2205 };
2206
2207 static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
2208 {
2209 int ret = -1;
2210 struct smbXsrv_session_global_traverse_state *state =
2211 (struct smbXsrv_session_global_traverse_state*)data;
2212 TDB_DATA key = dbwrap_record_get_key(rec);
2213 TDB_DATA val = dbwrap_record_get_value(rec);
2214 DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
2215 struct smbXsrv_session_globalB global_blob;
2216 enum ndr_err_code ndr_err;
2217 TALLOC_CTX *frame = talloc_stackframe();
2218
2219 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
2220 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
2221 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2222 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
2223 "key '%s' ndr_pull_struct_blob - %s\n",
2224 hex_encode_talloc(frame, key.dptr, key.dsize),
2225 ndr_errstr(ndr_err)));
2226 goto done;
2227 }
2228
2229 if (global_blob.version != SMBXSRV_VERSION_0) {
2230 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
2231 "key '%s' unsupported version - %d\n",
2232 hex_encode_talloc(frame, key.dptr, key.dsize),
2233 (int)global_blob.version));
2234 goto done;
2235 }
2236
2237 if (global_blob.info.info0 == NULL) {
2238 DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
2239 "key '%s' info0 NULL pointer\n",
2240 hex_encode_talloc(frame, key.dptr, key.dsize)));
2241 goto done;
2242 }
2243
2244 global_blob.info.info0->db_rec = rec;
2245 ret = state->fn(global_blob.info.info0, state->private_data);
2246 done:
2247 TALLOC_FREE(frame);
2248 return ret;
2249 }
2250
2251 NTSTATUS smbXsrv_session_global_traverse(
2252 int (*fn)(struct smbXsrv_session_global0 *, void *),
2253 void *private_data)
2254 {
2255
2256 NTSTATUS status;
2257 int count = 0;
2258 struct smbXsrv_session_global_traverse_state state = {
2259 .fn = fn,
2260 .private_data = private_data,
2261 };
2262
2263 become_root();
2264 status = smbXsrv_session_global_init(NULL);
2265 if (!NT_STATUS_IS_OK(status)) {
2266 unbecome_root();
2267 DEBUG(0, ("Failed to initialize session_global: %s\n",
2268 nt_errstr(status)));
2269 return status;
2270 }
2271
2272 status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
2273 smbXsrv_session_global_traverse_fn,
2274 &state,
2275 &count);
2276 unbecome_root();
2277
2278 return status;
2279 }
Samba GIT mirror