?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
lib: replace: Add strsep function (missing on Solaris).
[Samba.git] / source3 / smbd / smb2_server.c
blob2ea997e896eec906b33310a2068effca24584623
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "smbprofile.h"
29 #include "../lib/util/bitmap.h"
30 #include "../librpc/gen_ndr/krb5pac.h"
31 #include "lib/util/iov_buf.h"
32 #include "auth.h"
33 #include "lib/crypto/sha512.h"
34
35 static void smbd_smb2_connection_handler(struct tevent_context *ev,
36 struct tevent_fd *fde,
37 uint16_t flags,
38 void *private_data);
39 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn);
40
41 static const struct smbd_smb2_dispatch_table {
42 uint16_t opcode;
43 const char *name;
44 bool need_session;
45 bool need_tcon;
46 bool as_root;
47 uint16_t fileid_ofs;
48 bool allow_invalid_fileid;
49 } smbd_smb2_table[] = {
50 #define _OP(o) .opcode = o, .name = #o
51 {
52 _OP(SMB2_OP_NEGPROT),
53 .as_root = true,
54 },{
55 _OP(SMB2_OP_SESSSETUP),
56 .as_root = true,
57 },{
58 _OP(SMB2_OP_LOGOFF),
59 .need_session = true,
60 .as_root = true,
61 },{
62 _OP(SMB2_OP_TCON),
63 .need_session = true,
64 /*
65 * This call needs to be run as root.
66 *
67 * smbd_smb2_request_process_tcon()
68 * calls make_connection_snum(), which will call
69 * change_to_user(), when needed.
70 */
71 .as_root = true,
72 },{
73 _OP(SMB2_OP_TDIS),
74 .need_session = true,
75 .need_tcon = true,
76 .as_root = true,
77 },{
78 _OP(SMB2_OP_CREATE),
79 .need_session = true,
80 .need_tcon = true,
81 },{
82 _OP(SMB2_OP_CLOSE),
83 .need_session = true,
84 .need_tcon = true,
85 .fileid_ofs = 0x08,
86 },{
87 _OP(SMB2_OP_FLUSH),
88 .need_session = true,
89 .need_tcon = true,
90 .fileid_ofs = 0x08,
91 },{
92 _OP(SMB2_OP_READ),
93 .need_session = true,
94 .need_tcon = true,
95 .fileid_ofs = 0x10,
96 },{
97 _OP(SMB2_OP_WRITE),
98 .need_session = true,
99 .need_tcon = true,
100 .fileid_ofs = 0x10,
101 },{
102 _OP(SMB2_OP_LOCK),
103 .need_session = true,
104 .need_tcon = true,
105 .fileid_ofs = 0x08,
106 },{
107 _OP(SMB2_OP_IOCTL),
108 .need_session = true,
109 .need_tcon = true,
110 .fileid_ofs = 0x08,
111 .allow_invalid_fileid = true,
112 },{
113 _OP(SMB2_OP_CANCEL),
114 .as_root = true,
115 },{
116 _OP(SMB2_OP_KEEPALIVE),
117 .as_root = true,
118 },{
119 _OP(SMB2_OP_QUERY_DIRECTORY),
120 .need_session = true,
121 .need_tcon = true,
122 .fileid_ofs = 0x08,
123 },{
124 _OP(SMB2_OP_NOTIFY),
125 .need_session = true,
126 .need_tcon = true,
127 .fileid_ofs = 0x08,
128 },{
129 _OP(SMB2_OP_GETINFO),
130 .need_session = true,
131 .need_tcon = true,
132 .fileid_ofs = 0x18,
133 },{
134 _OP(SMB2_OP_SETINFO),
135 .need_session = true,
136 .need_tcon = true,
137 .fileid_ofs = 0x10,
138 },{
139 _OP(SMB2_OP_BREAK),
140 .need_session = true,
141 .need_tcon = true,
142 /*
143 * we do not set
144 * .fileid_ofs here
145 * as LEASE breaks does not
146 * have a file id
147 */
148 }
149 };
150
151 const char *smb2_opcode_name(uint16_t opcode)
152 {
153 if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
154 return "Bad SMB2 opcode";
155 }
156 return smbd_smb2_table[opcode].name;
157 }
158
159 static const struct smbd_smb2_dispatch_table *smbd_smb2_call(uint16_t opcode)
160 {
161 const struct smbd_smb2_dispatch_table *ret = NULL;
162
163 if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
164 return NULL;
165 }
166
167 ret = &smbd_smb2_table[opcode];
168
169 SMB_ASSERT(ret->opcode == opcode);
170
171 return ret;
172 }
173
174 static void print_req_vectors(const struct smbd_smb2_request *req)
175 {
176 int i;
177
178 for (i = 0; i < req->in.vector_count; i++) {
179 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
180 (unsigned int)i,
181 (unsigned int)req->in.vector[i].iov_len);
182 }
183 for (i = 0; i < req->out.vector_count; i++) {
184 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
185 (unsigned int)i,
186 (unsigned int)req->out.vector[i].iov_len);
187 }
188 }
189
190 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
191 {
192 if (size < (4 + SMB2_HDR_BODY)) {
193 return false;
194 }
195
196 if (IVAL(inbuf, 4) != SMB2_MAGIC) {
197 return false;
198 }
199
200 return true;
201 }
202
203 static NTSTATUS smbd_initialize_smb2(struct smbXsrv_connection *xconn)
204 {
205 TALLOC_FREE(xconn->transport.fde);
206
207 xconn->smb2.credits.seq_low = 0;
208 xconn->smb2.credits.seq_range = 1;
209 xconn->smb2.credits.granted = 1;
210 xconn->smb2.credits.max = lp_smb2_max_credits();
211 xconn->smb2.credits.bitmap = bitmap_talloc(xconn,
212 xconn->smb2.credits.max);
213 if (xconn->smb2.credits.bitmap == NULL) {
214 return NT_STATUS_NO_MEMORY;
215 }
216
217 xconn->transport.fde = tevent_add_fd(xconn->ev_ctx,
218 xconn,
219 xconn->transport.sock,
220 TEVENT_FD_READ,
221 smbd_smb2_connection_handler,
222 xconn);
223 if (xconn->transport.fde == NULL) {
224 return NT_STATUS_NO_MEMORY;
225 }
226
227 /* Ensure child is set to non-blocking mode */
228 set_blocking(xconn->transport.sock, false);
229 return NT_STATUS_OK;
230 }
231
232 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
233 #define _smb2_setlen(_buf,len) do { \
234 uint8_t *buf = (uint8_t *)_buf; \
235 buf[0] = 0; \
236 buf[1] = ((len)&0xFF0000)>>16; \
237 buf[2] = ((len)&0xFF00)>>8; \
238 buf[3] = (len)&0xFF; \
239 } while (0)
240
241 static bool smb2_setup_nbt_length(struct iovec *vector, int count)
242 {
243 ssize_t len;
244
245 if (count == 0) {
246 return false;
247 }
248
249 len = iov_buflen(vector+1, count-1);
250
251 if ((len == -1) || (len > 0xFFFFFF)) {
252 return false;
253 }
254
255 _smb2_setlen(vector[0].iov_base, len);
256 return true;
257 }
258
259 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
260 {
261 if (req->first_key.length > 0) {
262 data_blob_clear_free(&req->first_key);
263 }
264 if (req->last_key.length > 0) {
265 data_blob_clear_free(&req->last_key);
266 }
267 return 0;
268 }
269
270 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
271 {
272 TALLOC_CTX *mem_pool;
273 struct smbd_smb2_request *req;
274
275 #if 0
276 /* Enable this to find subtle valgrind errors. */
277 mem_pool = talloc_init("smbd_smb2_request_allocate");
278 #else
279 mem_pool = talloc_tos();
280 #endif
281 if (mem_pool == NULL) {
282 return NULL;
283 }
284
285 req = talloc_zero(mem_pool, struct smbd_smb2_request);
286 if (req == NULL) {
287 talloc_free(mem_pool);
288 return NULL;
289 }
290 talloc_reparent(mem_pool, mem_ctx, req);
291 #if 0
292 TALLOC_FREE(mem_pool);
293 #endif
294
295 req->last_session_id = UINT64_MAX;
296 req->last_tid = UINT32_MAX;
297
298 talloc_set_destructor(req, smbd_smb2_request_destructor);
299
300 return req;
301 }
302
303 static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *xconn,
304 NTTIME now,
305 uint8_t *buf,
306 size_t buflen,
307 struct smbd_smb2_request *req,
308 struct iovec **piov,
309 int *pnum_iov)
310 {
311 TALLOC_CTX *mem_ctx = req;
312 struct iovec *iov;
313 int num_iov = 1;
314 size_t taken = 0;
315 uint8_t *first_hdr = buf;
316 size_t verified_buflen = 0;
317 uint8_t *tf = NULL;
318 size_t tf_len = 0;
319
320 /*
321 * Note: index '0' is reserved for the transport protocol
322 */
323 iov = req->in._vector;
324
325 while (taken < buflen) {
326 size_t len = buflen - taken;
327 uint8_t *hdr = first_hdr + taken;
328 struct iovec *cur;
329 size_t full_size;
330 size_t next_command_ofs;
331 uint16_t body_size;
332 uint8_t *body = NULL;
333 uint32_t dyn_size;
334 uint8_t *dyn = NULL;
335 struct iovec *iov_alloc = NULL;
336
337 if (iov != req->in._vector) {
338 iov_alloc = iov;
339 }
340
341 if (verified_buflen > taken) {
342 len = verified_buflen - taken;
343 } else {
344 tf = NULL;
345 tf_len = 0;
346 }
347
348 if (len < 4) {
349 DEBUG(10, ("%d bytes left, expected at least %d\n",
350 (int)len, 4));
351 goto inval;
352 }
353 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
354 struct smbXsrv_session *s = NULL;
355 uint64_t uid;
356 struct iovec tf_iov[2];
357 NTSTATUS status;
358 size_t enc_len;
359
360 if (xconn->protocol < PROTOCOL_SMB2_24) {
361 DEBUG(10, ("Got SMB2_TRANSFORM header, "
362 "but dialect[0x%04X] is used\n",
363 xconn->smb2.server.dialect));
364 goto inval;
365 }
366
367 if (xconn->smb2.server.cipher == 0) {
368 DEBUG(10, ("Got SMB2_TRANSFORM header, "
369 "but not negotiated "
370 "client[0x%08X] server[0x%08X]\n",
371 xconn->smb2.client.capabilities,
372 xconn->smb2.server.capabilities));
373 goto inval;
374 }
375
376 if (len < SMB2_TF_HDR_SIZE) {
377 DEBUG(1, ("%d bytes left, expected at least %d\n",
378 (int)len, SMB2_TF_HDR_SIZE));
379 goto inval;
380 }
381 tf = hdr;
382 tf_len = SMB2_TF_HDR_SIZE;
383 taken += tf_len;
384
385 hdr = first_hdr + taken;
386 enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
387 uid = BVAL(tf, SMB2_TF_SESSION_ID);
388
389 if (len < SMB2_TF_HDR_SIZE + enc_len) {
390 DEBUG(1, ("%d bytes left, expected at least %d\n",
391 (int)len,
392 (int)(SMB2_TF_HDR_SIZE + enc_len)));
393 goto inval;
394 }
395
396 status = smb2srv_session_lookup(xconn, uid, now, &s);
397 if (s == NULL) {
398 DEBUG(1, ("invalid session[%llu] in "
399 "SMB2_TRANSFORM header\n",
400 (unsigned long long)uid));
401 TALLOC_FREE(iov_alloc);
402 return NT_STATUS_USER_SESSION_DELETED;
403 }
404
405 tf_iov[0].iov_base = (void *)tf;
406 tf_iov[0].iov_len = tf_len;
407 tf_iov[1].iov_base = (void *)hdr;
408 tf_iov[1].iov_len = enc_len;
409
410 status = smb2_signing_decrypt_pdu(s->global->decryption_key,
411 xconn->smb2.server.cipher,
412 tf_iov, 2);
413 if (!NT_STATUS_IS_OK(status)) {
414 TALLOC_FREE(iov_alloc);
415 return status;
416 }
417
418 verified_buflen = taken + enc_len;
419 len = enc_len;
420 }
421
422 /*
423 * We need the header plus the body length field
424 */
425
426 if (len < SMB2_HDR_BODY + 2) {
427 DEBUG(10, ("%d bytes left, expected at least %d\n",
428 (int)len, SMB2_HDR_BODY));
429 goto inval;
430 }
431 if (IVAL(hdr, 0) != SMB2_MAGIC) {
432 DEBUG(10, ("Got non-SMB2 PDU: %x\n",
433 IVAL(hdr, 0)));
434 goto inval;
435 }
436 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
437 DEBUG(10, ("Got HDR len %d, expected %d\n",
438 SVAL(hdr, 4), SMB2_HDR_BODY));
439 goto inval;
440 }
441
442 full_size = len;
443 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
444 body_size = SVAL(hdr, SMB2_HDR_BODY);
445
446 if (next_command_ofs != 0) {
447 if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
448 goto inval;
449 }
450 if (next_command_ofs > full_size) {
451 goto inval;
452 }
453 full_size = next_command_ofs;
454 }
455 if (body_size < 2) {
456 goto inval;
457 }
458 body_size &= 0xfffe;
459
460 if (body_size > (full_size - SMB2_HDR_BODY)) {
461 /*
462 * let the caller handle the error
463 */
464 body_size = full_size - SMB2_HDR_BODY;
465 }
466 body = hdr + SMB2_HDR_BODY;
467 dyn = body + body_size;
468 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
469
470 if (num_iov >= ARRAY_SIZE(req->in._vector)) {
471 struct iovec *iov_tmp = NULL;
472
473 iov_tmp = talloc_realloc(mem_ctx, iov_alloc,
474 struct iovec,
475 num_iov +
476 SMBD_SMB2_NUM_IOV_PER_REQ);
477 if (iov_tmp == NULL) {
478 TALLOC_FREE(iov_alloc);
479 return NT_STATUS_NO_MEMORY;
480 }
481
482 if (iov_alloc == NULL) {
483 memcpy(iov_tmp,
484 req->in._vector,
485 sizeof(req->in._vector));
486 }
487
488 iov = iov_tmp;
489 }
490 cur = &iov[num_iov];
491 num_iov += SMBD_SMB2_NUM_IOV_PER_REQ;
492
493 cur[SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
494 cur[SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
495 cur[SMBD_SMB2_HDR_IOV_OFS].iov_base = hdr;
496 cur[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
497 cur[SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
498 cur[SMBD_SMB2_BODY_IOV_OFS].iov_len = body_size;
499 cur[SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
500 cur[SMBD_SMB2_DYN_IOV_OFS].iov_len = dyn_size;
501
502 taken += full_size;
503 }
504
505 *piov = iov;
506 *pnum_iov = num_iov;
507 return NT_STATUS_OK;
508
509 inval:
510 if (iov != req->in._vector) {
511 TALLOC_FREE(iov);
512 }
513 return NT_STATUS_INVALID_PARAMETER;
514 }
515
516 static NTSTATUS smbd_smb2_request_create(struct smbXsrv_connection *xconn,
517 const uint8_t *_inpdu, size_t size,
518 struct smbd_smb2_request **_req)
519 {
520 struct smbd_server_connection *sconn = xconn->client->sconn;
521 struct smbd_smb2_request *req;
522 uint32_t protocol_version;
523 uint8_t *inpdu = NULL;
524 const uint8_t *inhdr = NULL;
525 uint16_t cmd;
526 uint32_t next_command_ofs;
527 NTSTATUS status;
528 NTTIME now;
529
530 if (size < (SMB2_HDR_BODY + 2)) {
531 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
532 return NT_STATUS_INVALID_PARAMETER;
533 }
534
535 inhdr = _inpdu;
536
537 protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
538 if (protocol_version != SMB2_MAGIC) {
539 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
540 protocol_version));
541 return NT_STATUS_INVALID_PARAMETER;
542 }
543
544 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
545 if (cmd != SMB2_OP_NEGPROT) {
546 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
547 cmd));
548 return NT_STATUS_INVALID_PARAMETER;
549 }
550
551 next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
552 if (next_command_ofs != 0) {
553 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
554 next_command_ofs));
555 return NT_STATUS_INVALID_PARAMETER;
556 }
557
558 req = smbd_smb2_request_allocate(xconn);
559 if (req == NULL) {
560 return NT_STATUS_NO_MEMORY;
561 }
562 req->sconn = sconn;
563 req->xconn = xconn;
564
565 inpdu = talloc_memdup(req, _inpdu, size);
566 if (inpdu == NULL) {
567 return NT_STATUS_NO_MEMORY;
568 }
569
570 req->request_time = timeval_current();
571 now = timeval_to_nttime(&req->request_time);
572
573 status = smbd_smb2_inbuf_parse_compound(xconn,
574 now,
575 inpdu,
576 size,
577 req, &req->in.vector,
578 &req->in.vector_count);
579 if (!NT_STATUS_IS_OK(status)) {
580 TALLOC_FREE(req);
581 return status;
582 }
583
584 req->current_idx = 1;
585
586 *_req = req;
587 return NT_STATUS_OK;
588 }
589
590 static bool smb2_validate_sequence_number(struct smbXsrv_connection *xconn,
591 uint64_t message_id, uint64_t seq_id)
592 {
593 struct bitmap *credits_bm = xconn->smb2.credits.bitmap;
594 unsigned int offset;
595 uint64_t seq_tmp;
596
597 seq_tmp = xconn->smb2.credits.seq_low;
598 if (seq_id < seq_tmp) {
599 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
600 "%llu (sequence id %llu) "
601 "(granted = %u, low = %llu, range = %u)\n",
602 (unsigned long long)message_id,
603 (unsigned long long)seq_id,
604 (unsigned int)xconn->smb2.credits.granted,
605 (unsigned long long)xconn->smb2.credits.seq_low,
606 (unsigned int)xconn->smb2.credits.seq_range));
607 return false;
608 }
609
610 seq_tmp += xconn->smb2.credits.seq_range;
611 if (seq_id >= seq_tmp) {
612 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
613 "%llu (sequence id %llu) "
614 "(granted = %u, low = %llu, range = %u)\n",
615 (unsigned long long)message_id,
616 (unsigned long long)seq_id,
617 (unsigned int)xconn->smb2.credits.granted,
618 (unsigned long long)xconn->smb2.credits.seq_low,
619 (unsigned int)xconn->smb2.credits.seq_range));
620 return false;
621 }
622
623 offset = seq_id % xconn->smb2.credits.max;
624
625 if (bitmap_query(credits_bm, offset)) {
626 DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
627 "%llu (sequence id %llu) "
628 "(granted = %u, low = %llu, range = %u) "
629 "(bm offset %u)\n",
630 (unsigned long long)message_id,
631 (unsigned long long)seq_id,
632 (unsigned int)xconn->smb2.credits.granted,
633 (unsigned long long)xconn->smb2.credits.seq_low,
634 (unsigned int)xconn->smb2.credits.seq_range,
635 offset));
636 return false;
637 }
638
639 /* Mark the message_ids as seen in the bitmap. */
640 bitmap_set(credits_bm, offset);
641
642 if (seq_id != xconn->smb2.credits.seq_low) {
643 return true;
644 }
645
646 /*
647 * Move the window forward by all the message_id's
648 * already seen.
649 */
650 while (bitmap_query(credits_bm, offset)) {
651 DEBUG(10,("smb2_validate_sequence_number: clearing "
652 "id %llu (position %u) from bitmap\n",
653 (unsigned long long)(xconn->smb2.credits.seq_low),
654 offset));
655 bitmap_clear(credits_bm, offset);
656
657 xconn->smb2.credits.seq_low += 1;
658 xconn->smb2.credits.seq_range -= 1;
659 offset = xconn->smb2.credits.seq_low % xconn->smb2.credits.max;
660 }
661
662 return true;
663 }
664
665 static bool smb2_validate_message_id(struct smbXsrv_connection *xconn,
666 const uint8_t *inhdr)
667 {
668 uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
669 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
670 uint16_t credit_charge = 1;
671 uint64_t i;
672
673 if (opcode == SMB2_OP_CANCEL) {
674 /* SMB2_CANCEL requests by definition resend messageids. */
675 return true;
676 }
677
678 if (xconn->smb2.credits.multicredit) {
679 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
680 credit_charge = MAX(credit_charge, 1);
681 }
682
683 DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
684 "credits_granted %llu, "
685 "seqnum low/range: %llu/%llu\n",
686 (unsigned long long) message_id,
687 (unsigned long long) credit_charge,
688 (unsigned long long) xconn->smb2.credits.granted,
689 (unsigned long long) xconn->smb2.credits.seq_low,
690 (unsigned long long) xconn->smb2.credits.seq_range));
691
692 if (xconn->smb2.credits.granted < credit_charge) {
693 DEBUG(0, ("smb2_validate_message_id: client used more "
694 "credits than granted, mid %llu, charge %llu, "
695 "credits_granted %llu, "
696 "seqnum low/range: %llu/%llu\n",
697 (unsigned long long) message_id,
698 (unsigned long long) credit_charge,
699 (unsigned long long) xconn->smb2.credits.granted,
700 (unsigned long long) xconn->smb2.credits.seq_low,
701 (unsigned long long) xconn->smb2.credits.seq_range));
702 return false;
703 }
704
705 /*
706 * now check the message ids
707 *
708 * for multi-credit requests we need to check all current mid plus
709 * the implicit mids caused by the credit charge
710 * e.g. current mid = 15, charge 5 => mark 15-19 as used
711 */
712
713 for (i = 0; i <= (credit_charge-1); i++) {
714 uint64_t id = message_id + i;
715 bool ok;
716
717 DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
718 (unsigned long long)message_id,
719 credit_charge,
720 (unsigned long long)id));
721
722 ok = smb2_validate_sequence_number(xconn, message_id, id);
723 if (!ok) {
724 return false;
725 }
726 }
727
728 /* substract used credits */
729 xconn->smb2.credits.granted -= credit_charge;
730
731 return true;
732 }
733
734 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
735 {
736 int count;
737 int idx;
738
739 count = req->in.vector_count;
740
741 if (count < 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
742 /* It's not a SMB2 request */
743 return NT_STATUS_INVALID_PARAMETER;
744 }
745
746 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
747 struct iovec *hdr = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
748 struct iovec *body = SMBD_SMB2_IDX_BODY_IOV(req,in,idx);
749 const uint8_t *inhdr = NULL;
750
751 if (hdr->iov_len != SMB2_HDR_BODY) {
752 return NT_STATUS_INVALID_PARAMETER;
753 }
754
755 if (body->iov_len < 2) {
756 return NT_STATUS_INVALID_PARAMETER;
757 }
758
759 inhdr = (const uint8_t *)hdr->iov_base;
760
761 /* Check the SMB2 header */
762 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
763 return NT_STATUS_INVALID_PARAMETER;
764 }
765
766 if (!smb2_validate_message_id(req->xconn, inhdr)) {
767 return NT_STATUS_INVALID_PARAMETER;
768 }
769 }
770
771 return NT_STATUS_OK;
772 }
773
774 static void smb2_set_operation_credit(struct smbXsrv_connection *xconn,
775 const struct iovec *in_vector,
776 struct iovec *out_vector)
777 {
778 const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
779 uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
780 uint16_t credit_charge = 1;
781 uint16_t credits_requested;
782 uint32_t out_flags;
783 uint16_t cmd;
784 NTSTATUS out_status;
785 uint16_t credits_granted = 0;
786 uint64_t credits_possible;
787 uint16_t current_max_credits;
788
789 /*
790 * first we grant only 1/16th of the max range.
791 *
792 * Windows also starts with the 1/16th and then grants
793 * more later. I was only able to trigger higher
794 * values, when using a very high credit charge.
795 *
796 * TODO: scale up depending on load, free memory
797 * or other stuff.
798 * Maybe also on the relationship between number
799 * of requests and the used sequence number.
800 * Which means we would grant more credits
801 * for client which use multi credit requests.
802 */
803 current_max_credits = xconn->smb2.credits.max / 16;
804 current_max_credits = MAX(current_max_credits, 1);
805
806 if (xconn->smb2.credits.multicredit) {
807 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
808 credit_charge = MAX(credit_charge, 1);
809 }
810
811 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
812 credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
813 credits_requested = MAX(credits_requested, 1);
814 out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
815 out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
816
817 SMB_ASSERT(xconn->smb2.credits.max >= xconn->smb2.credits.granted);
818
819 if (xconn->smb2.credits.max < credit_charge) {
820 smbd_server_connection_terminate(xconn,
821 "client error: credit charge > max credits\n");
822 return;
823 }
824
825 if (out_flags & SMB2_HDR_FLAG_ASYNC) {
826 /*
827 * In case we already send an async interim
828 * response, we should not grant
829 * credits on the final response.
830 */
831 credits_granted = 0;
832 } else {
833 uint16_t additional_possible =
834 xconn->smb2.credits.max - credit_charge;
835 uint16_t additional_max = 0;
836 uint16_t additional_credits = credits_requested - 1;
837
838 switch (cmd) {
839 case SMB2_OP_NEGPROT:
840 break;
841 case SMB2_OP_SESSSETUP:
842 /*
843 * Windows 2012 RC1 starts to grant
844 * additional credits
845 * with a successful session setup
846 */
847 if (NT_STATUS_IS_OK(out_status)) {
848 additional_max = 32;
849 }
850 break;
851 default:
852 /*
853 * We match windows and only grant additional credits
854 * in chunks of 32.
855 */
856 additional_max = 32;
857 break;
858 }
859
860 additional_max = MIN(additional_max, additional_possible);
861 additional_credits = MIN(additional_credits, additional_max);
862
863 credits_granted = credit_charge + additional_credits;
864 }
865
866 /*
867 * sequence numbers should not wrap
868 *
869 * 1. calculate the possible credits until
870 * the sequence numbers start to wrap on 64-bit.
871 *
872 * 2. UINT64_MAX is used for Break Notifications.
873 *
874 * 2. truncate the possible credits to the maximum
875 * credits we want to grant to the client in total.
876 *
877 * 3. remove the range we'll already granted to the client
878 * this makes sure the client consumes the lowest sequence
879 * number, before we can grant additional credits.
880 */
881 credits_possible = UINT64_MAX - xconn->smb2.credits.seq_low;
882 if (credits_possible > 0) {
883 /* remove UINT64_MAX */
884 credits_possible -= 1;
885 }
886 credits_possible = MIN(credits_possible, current_max_credits);
887 credits_possible -= xconn->smb2.credits.seq_range;
888
889 credits_granted = MIN(credits_granted, credits_possible);
890
891 SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
892 xconn->smb2.credits.granted += credits_granted;
893 xconn->smb2.credits.seq_range += credits_granted;
894
895 DEBUG(10,("smb2_set_operation_credit: requested %u, charge %u, "
896 "granted %u, current possible/max %u/%u, "
897 "total granted/max/low/range %u/%u/%llu/%u\n",
898 (unsigned int)credits_requested,
899 (unsigned int)credit_charge,
900 (unsigned int)credits_granted,
901 (unsigned int)credits_possible,
902 (unsigned int)current_max_credits,
903 (unsigned int)xconn->smb2.credits.granted,
904 (unsigned int)xconn->smb2.credits.max,
905 (unsigned long long)xconn->smb2.credits.seq_low,
906 (unsigned int)xconn->smb2.credits.seq_range));
907 }
908
909 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
910 struct smbd_smb2_request *outreq)
911 {
912 int count, idx;
913 uint16_t total_credits = 0;
914
915 count = outreq->out.vector_count;
916
917 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
918 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(inreq,in,idx);
919 struct iovec *outhdr_v = SMBD_SMB2_IDX_HDR_IOV(outreq,out,idx);
920 uint8_t *outhdr = (uint8_t *)outhdr_v->iov_base;
921
922 smb2_set_operation_credit(outreq->xconn, inhdr_v, outhdr_v);
923
924 /* To match Windows, count up what we
925 just granted. */
926 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
927 /* Set to zero in all but the last reply. */
928 if (idx + SMBD_SMB2_NUM_IOV_PER_REQ < count) {
929 SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
930 } else {
931 SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
932 }
933 }
934 }
935
936 DATA_BLOB smbd_smb2_generate_outbody(struct smbd_smb2_request *req, size_t size)
937 {
938 if (req->current_idx <= 1) {
939 if (size <= sizeof(req->out._body)) {
940 return data_blob_const(req->out._body, size);
941 }
942 }
943
944 return data_blob_talloc(req, NULL, size);
945 }
946
947 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
948 {
949 struct smbXsrv_connection *xconn = req->xconn;
950 TALLOC_CTX *mem_ctx;
951 struct iovec *vector;
952 int count;
953 int idx;
954 bool ok;
955
956 count = req->in.vector_count;
957 if (count <= ARRAY_SIZE(req->out._vector)) {
958 mem_ctx = req;
959 vector = req->out._vector;
960 } else {
961 vector = talloc_zero_array(req, struct iovec, count);
962 if (vector == NULL) {
963 return NT_STATUS_NO_MEMORY;
964 }
965 mem_ctx = vector;
966 }
967
968 vector[0].iov_base = req->out.nbt_hdr;
969 vector[0].iov_len = 4;
970 SIVAL(req->out.nbt_hdr, 0, 0);
971
972 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
973 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
974 const uint8_t *inhdr = (const uint8_t *)inhdr_v->iov_base;
975 uint8_t *outhdr = NULL;
976 uint8_t *outbody = NULL;
977 uint32_t next_command_ofs = 0;
978 struct iovec *current = &vector[idx];
979
980 if ((idx + SMBD_SMB2_NUM_IOV_PER_REQ) < count) {
981 /* we have a next command -
982 * setup for the error case. */
983 next_command_ofs = SMB2_HDR_BODY + 9;
984 }
985
986 if (idx == 1) {
987 outhdr = req->out._hdr;
988 } else {
989 outhdr = talloc_zero_array(mem_ctx, uint8_t,
990 OUTVEC_ALLOC_SIZE);
991 if (outhdr == NULL) {
992 return NT_STATUS_NO_MEMORY;
993 }
994 }
995
996 outbody = outhdr + SMB2_HDR_BODY;
997
998 /*
999 * SMBD_SMB2_TF_IOV_OFS might be used later
1000 */
1001 current[SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
1002 current[SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
1003
1004 current[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)outhdr;
1005 current[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1006
1007 current[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)outbody;
1008 current[SMBD_SMB2_BODY_IOV_OFS].iov_len = 8;
1009
1010 current[SMBD_SMB2_DYN_IOV_OFS].iov_base = NULL;
1011 current[SMBD_SMB2_DYN_IOV_OFS].iov_len = 0;
1012
1013 /* setup the SMB2 header */
1014 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1015 SSVAL(outhdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1016 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
1017 SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
1018 SIVAL(outhdr, SMB2_HDR_STATUS,
1019 NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
1020 SSVAL(outhdr, SMB2_HDR_OPCODE,
1021 SVAL(inhdr, SMB2_HDR_OPCODE));
1022 SIVAL(outhdr, SMB2_HDR_FLAGS,
1023 IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
1024 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
1025 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
1026 BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
1027 SIVAL(outhdr, SMB2_HDR_PID,
1028 IVAL(inhdr, SMB2_HDR_PID));
1029 SIVAL(outhdr, SMB2_HDR_TID,
1030 IVAL(inhdr, SMB2_HDR_TID));
1031 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
1032 BVAL(inhdr, SMB2_HDR_SESSION_ID));
1033 memcpy(outhdr + SMB2_HDR_SIGNATURE,
1034 inhdr + SMB2_HDR_SIGNATURE, 16);
1035
1036 /* setup error body header */
1037 SSVAL(outbody, 0x00, 0x08 + 1);
1038 SSVAL(outbody, 0x02, 0);
1039 SIVAL(outbody, 0x04, 0);
1040 }
1041
1042 req->out.vector = vector;
1043 req->out.vector_count = count;
1044
1045 /* setup the length of the NBT packet */
1046 ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
1047 if (!ok) {
1048 return NT_STATUS_INVALID_PARAMETER_MIX;
1049 }
1050
1051 DLIST_ADD_END(xconn->smb2.requests, req, struct smbd_smb2_request *);
1052
1053 return NT_STATUS_OK;
1054 }
1055
1056 void smbd_server_connection_terminate_ex(struct smbXsrv_connection *xconn,
1057 const char *reason,
1058 const char *location)
1059 {
1060 DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
1061 reason, location));
1062 exit_server_cleanly(reason);
1063 }
1064
1065 static bool dup_smb2_vec4(TALLOC_CTX *ctx,
1066 struct iovec *outvec,
1067 const struct iovec *srcvec)
1068 {
1069 const uint8_t *srctf;
1070 size_t srctf_len;
1071 const uint8_t *srchdr;
1072 size_t srchdr_len;
1073 const uint8_t *srcbody;
1074 size_t srcbody_len;
1075 const uint8_t *expected_srcbody;
1076 const uint8_t *srcdyn;
1077 size_t srcdyn_len;
1078 const uint8_t *expected_srcdyn;
1079 uint8_t *dsttf;
1080 uint8_t *dsthdr;
1081 uint8_t *dstbody;
1082 uint8_t *dstdyn;
1083
1084 srctf = (const uint8_t *)srcvec[SMBD_SMB2_TF_IOV_OFS].iov_base;
1085 srctf_len = srcvec[SMBD_SMB2_TF_IOV_OFS].iov_len;
1086 srchdr = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
1087 srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
1088 srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
1089 srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
1090 expected_srcbody = srchdr + SMB2_HDR_BODY;
1091 srcdyn = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
1092 srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
1093 expected_srcdyn = srcbody + 8;
1094
1095 if ((srctf_len != SMB2_TF_HDR_SIZE) && (srctf_len != 0)) {
1096 return false;
1097 }
1098
1099 if (srchdr_len != SMB2_HDR_BODY) {
1100 return false;
1101 }
1102
1103 if (srctf_len == SMB2_TF_HDR_SIZE) {
1104 dsttf = talloc_memdup(ctx, srctf, SMB2_TF_HDR_SIZE);
1105 if (dsttf == NULL) {
1106 return false;
1107 }
1108 } else {
1109 dsttf = NULL;
1110 }
1111 outvec[SMBD_SMB2_TF_IOV_OFS].iov_base = (void *)dsttf;
1112 outvec[SMBD_SMB2_TF_IOV_OFS].iov_len = srctf_len;
1113
1114 /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
1115 * be allocated with size OUTVEC_ALLOC_SIZE. */
1116
1117 dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
1118 if (dsthdr == NULL) {
1119 return false;
1120 }
1121 outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
1122 outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1123
1124 /*
1125 * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
1126 * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
1127 * then duplicate this. Else use talloc_memdup().
1128 */
1129
1130 if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
1131 dstbody = dsthdr + SMB2_HDR_BODY;
1132 } else {
1133 dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
1134 if (dstbody == NULL) {
1135 return false;
1136 }
1137 }
1138 outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
1139 outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
1140
1141 /*
1142 * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
1143 * pointing to
1144 * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
1145 * then duplicate this. Else use talloc_memdup().
1146 */
1147
1148 if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
1149 dstdyn = dsthdr + SMB2_HDR_BODY + 8;
1150 } else if (srcdyn == NULL) {
1151 dstdyn = NULL;
1152 } else {
1153 dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
1154 if (dstdyn == NULL) {
1155 return false;
1156 }
1157 }
1158 outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
1159 outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
1160
1161 return true;
1162 }
1163
1164 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
1165 {
1166 struct smbd_smb2_request *newreq = NULL;
1167 struct iovec *outvec = NULL;
1168 int count = req->out.vector_count;
1169 int i;
1170 bool ok;
1171
1172 newreq = smbd_smb2_request_allocate(req->xconn);
1173 if (!newreq) {
1174 return NULL;
1175 }
1176
1177 newreq->sconn = req->sconn;
1178 newreq->xconn = req->xconn;
1179 newreq->session = req->session;
1180 newreq->do_encryption = req->do_encryption;
1181 newreq->do_signing = req->do_signing;
1182 newreq->current_idx = req->current_idx;
1183
1184 outvec = talloc_zero_array(newreq, struct iovec, count);
1185 if (!outvec) {
1186 TALLOC_FREE(newreq);
1187 return NULL;
1188 }
1189 newreq->out.vector = outvec;
1190 newreq->out.vector_count = count;
1191
1192 /* Setup the outvec's identically to req. */
1193 outvec[0].iov_base = newreq->out.nbt_hdr;
1194 outvec[0].iov_len = 4;
1195 memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
1196
1197 /* Setup the vectors identically to the ones in req. */
1198 for (i = 1; i < count; i += SMBD_SMB2_NUM_IOV_PER_REQ) {
1199 if (!dup_smb2_vec4(outvec, &outvec[i], &req->out.vector[i])) {
1200 break;
1201 }
1202 }
1203
1204 if (i < count) {
1205 /* Alloc failed. */
1206 TALLOC_FREE(newreq);
1207 return NULL;
1208 }
1209
1210 ok = smb2_setup_nbt_length(newreq->out.vector,
1211 newreq->out.vector_count);
1212 if (!ok) {
1213 TALLOC_FREE(newreq);
1214 return NULL;
1215 }
1216
1217 return newreq;
1218 }
1219
1220 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
1221 {
1222 struct smbXsrv_connection *xconn = req->xconn;
1223 int first_idx = 1;
1224 struct iovec *firsttf = NULL;
1225 struct iovec *outhdr_v = NULL;
1226 uint8_t *outhdr = NULL;
1227 struct smbd_smb2_request *nreq = NULL;
1228 NTSTATUS status;
1229 bool ok;
1230
1231 /* Create a new smb2 request we'll use
1232 for the interim return. */
1233 nreq = dup_smb2_req(req);
1234 if (!nreq) {
1235 return NT_STATUS_NO_MEMORY;
1236 }
1237
1238 /* Lose the last X out vectors. They're the
1239 ones we'll be using for the async reply. */
1240 nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
1241
1242 ok = smb2_setup_nbt_length(nreq->out.vector,
1243 nreq->out.vector_count);
1244 if (!ok) {
1245 return NT_STATUS_INVALID_PARAMETER_MIX;
1246 }
1247
1248 /* Step back to the previous reply. */
1249 nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
1250 firsttf = SMBD_SMB2_IDX_TF_IOV(nreq,out,first_idx);
1251 outhdr_v = SMBD_SMB2_OUT_HDR_IOV(nreq);
1252 outhdr = SMBD_SMB2_OUT_HDR_PTR(nreq);
1253 /* And end the chain. */
1254 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
1255
1256 /* Calculate outgoing credits */
1257 smb2_calculate_credits(req, nreq);
1258
1259 if (DEBUGLEVEL >= 10) {
1260 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
1261 (unsigned int)nreq->current_idx );
1262 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
1263 (unsigned int)nreq->out.vector_count );
1264 print_req_vectors(nreq);
1265 }
1266
1267 /*
1268 * As we have changed the header (SMB2_HDR_NEXT_COMMAND),
1269 * we need to sign/encrypt here with the last/first key we remembered
1270 */
1271 if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
1272 status = smb2_signing_encrypt_pdu(req->first_key,
1273 xconn->smb2.server.cipher,
1274 firsttf,
1275 nreq->out.vector_count - first_idx);
1276 if (!NT_STATUS_IS_OK(status)) {
1277 return status;
1278 }
1279 } else if (req->last_key.length > 0) {
1280 status = smb2_signing_sign_pdu(req->last_key,
1281 xconn->protocol,
1282 outhdr_v,
1283 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1284 if (!NT_STATUS_IS_OK(status)) {
1285 return status;
1286 }
1287 }
1288
1289 nreq->queue_entry.mem_ctx = nreq;
1290 nreq->queue_entry.vector = nreq->out.vector;
1291 nreq->queue_entry.count = nreq->out.vector_count;
1292 DLIST_ADD_END(xconn->smb2.send_queue, &nreq->queue_entry, NULL);
1293 xconn->smb2.send_queue_len++;
1294
1295 status = smbd_smb2_flush_send_queue(xconn);
1296 if (!NT_STATUS_IS_OK(status)) {
1297 return status;
1298 }
1299
1300 return NT_STATUS_OK;
1301 }
1302
1303 struct smbd_smb2_request_pending_state {
1304 struct smbd_smb2_send_queue queue_entry;
1305 uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
1306 struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
1307 };
1308
1309 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1310 struct tevent_timer *te,
1311 struct timeval current_time,
1312 void *private_data);
1313
1314 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
1315 struct tevent_req *subreq,
1316 uint32_t defer_time)
1317 {
1318 NTSTATUS status;
1319 struct timeval defer_endtime;
1320 uint8_t *outhdr = NULL;
1321 uint32_t flags;
1322
1323 if (!tevent_req_is_in_progress(subreq)) {
1324 /*
1325 * This is a performance optimization,
1326 * it avoids one tevent_loop iteration,
1327 * which means we avoid one
1328 * talloc_stackframe_pool/talloc_free pair.
1329 */
1330 tevent_req_notify_callback(subreq);
1331 return NT_STATUS_OK;
1332 }
1333
1334 req->subreq = subreq;
1335 subreq = NULL;
1336
1337 if (req->async_te) {
1338 /* We're already async. */
1339 return NT_STATUS_OK;
1340 }
1341
1342 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1343 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1344 if (flags & SMB2_HDR_FLAG_ASYNC) {
1345 /* We're already async. */
1346 return NT_STATUS_OK;
1347 }
1348
1349 if (req->in.vector_count > req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
1350 /*
1351 * We're trying to go async in a compound request
1352 * chain. This is only allowed for opens that cause an
1353 * oplock break or for the last operation in the
1354 * chain, otherwise it is not allowed. See
1355 * [MS-SMB2].pdf note <206> on Section 3.3.5.2.7.
1356 */
1357 const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1358
1359 if (SVAL(inhdr, SMB2_HDR_OPCODE) != SMB2_OP_CREATE) {
1360 /*
1361 * Cancel the outstanding request.
1362 */
1363 bool ok = tevent_req_cancel(req->subreq);
1364 if (ok) {
1365 return NT_STATUS_OK;
1366 }
1367 TALLOC_FREE(req->subreq);
1368 return smbd_smb2_request_error(req,
1369 NT_STATUS_INTERNAL_ERROR);
1370 }
1371 }
1372
1373 if (DEBUGLEVEL >= 10) {
1374 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
1375 (unsigned int)req->current_idx );
1376 print_req_vectors(req);
1377 }
1378
1379 if (req->current_idx > 1) {
1380 /*
1381 * We're going async in a compound
1382 * chain after the first request has
1383 * already been processed. Send an
1384 * interim response containing the
1385 * set of replies already generated.
1386 */
1387 int idx = req->current_idx;
1388
1389 status = smb2_send_async_interim_response(req);
1390 if (!NT_STATUS_IS_OK(status)) {
1391 return status;
1392 }
1393 if (req->first_key.length > 0) {
1394 data_blob_clear_free(&req->first_key);
1395 }
1396
1397 req->current_idx = 1;
1398
1399 /*
1400 * Re-arrange the in.vectors to remove what
1401 * we just sent.
1402 */
1403 memmove(&req->in.vector[1],
1404 &req->in.vector[idx],
1405 sizeof(req->in.vector[0])*(req->in.vector_count - idx));
1406 req->in.vector_count = 1 + (req->in.vector_count - idx);
1407
1408 /* Re-arrange the out.vectors to match. */
1409 memmove(&req->out.vector[1],
1410 &req->out.vector[idx],
1411 sizeof(req->out.vector[0])*(req->out.vector_count - idx));
1412 req->out.vector_count = 1 + (req->out.vector_count - idx);
1413
1414 if (req->in.vector_count == 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
1415 /*
1416 * We only have one remaining request as
1417 * we've processed everything else.
1418 * This is no longer a compound request.
1419 */
1420 req->compound_related = false;
1421 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1422 flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
1423 SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
1424 }
1425 }
1426 if (req->last_key.length > 0) {
1427 data_blob_clear_free(&req->last_key);
1428 }
1429
1430 defer_endtime = timeval_current_ofs_usec(defer_time);
1431 req->async_te = tevent_add_timer(req->sconn->ev_ctx,
1432 req, defer_endtime,
1433 smbd_smb2_request_pending_timer,
1434 req);
1435 if (req->async_te == NULL) {
1436 return NT_STATUS_NO_MEMORY;
1437 }
1438
1439 return NT_STATUS_OK;
1440 }
1441
1442 static DATA_BLOB smbd_smb2_signing_key(struct smbXsrv_session *session,
1443 struct smbXsrv_connection *xconn)
1444 {
1445 struct smbXsrv_channel_global0 *c = NULL;
1446 NTSTATUS status;
1447 DATA_BLOB key = data_blob_null;
1448
1449 status = smbXsrv_session_find_channel(session, xconn, &c);
1450 if (NT_STATUS_IS_OK(status)) {
1451 key = c->signing_key;
1452 }
1453
1454 if (key.length == 0) {
1455 key = session->global->signing_key;
1456 }
1457
1458 return key;
1459 }
1460
1461 static NTSTATUS smb2_get_new_nonce(struct smbXsrv_session *session,
1462 uint64_t *new_nonce_high,
1463 uint64_t *new_nonce_low)
1464 {
1465 uint64_t nonce_high;
1466 uint64_t nonce_low;
1467
1468 session->nonce_low += 1;
1469 if (session->nonce_low == 0) {
1470 session->nonce_low += 1;
1471 session->nonce_high += 1;
1472 }
1473
1474 /*
1475 * CCM and GCM algorithms must never have their
1476 * nonce wrap, or the security of the whole
1477 * communication and the keys is destroyed.
1478 * We must drop the connection once we have
1479 * transfered too much data.
1480 *
1481 * NOTE: We assume nonces greater than 8 bytes.
1482 */
1483 if (session->nonce_high >= session->nonce_high_max) {
1484 return NT_STATUS_ENCRYPTION_FAILED;
1485 }
1486
1487 nonce_high = session->nonce_high_random;
1488 nonce_high += session->nonce_high;
1489 nonce_low = session->nonce_low;
1490
1491 *new_nonce_high = nonce_high;
1492 *new_nonce_low = nonce_low;
1493 return NT_STATUS_OK;
1494 }
1495
1496 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1497 struct tevent_timer *te,
1498 struct timeval current_time,
1499 void *private_data)
1500 {
1501 struct smbd_smb2_request *req =
1502 talloc_get_type_abort(private_data,
1503 struct smbd_smb2_request);
1504 struct smbXsrv_connection *xconn = req->xconn;
1505 struct smbd_smb2_request_pending_state *state = NULL;
1506 uint8_t *outhdr = NULL;
1507 const uint8_t *inhdr = NULL;
1508 uint8_t *tf = NULL;
1509 size_t tf_len = 0;
1510 uint8_t *hdr = NULL;
1511 uint8_t *body = NULL;
1512 uint8_t *dyn = NULL;
1513 uint32_t flags = 0;
1514 uint64_t session_id = 0;
1515 uint64_t message_id = 0;
1516 uint64_t nonce_high = 0;
1517 uint64_t nonce_low = 0;
1518 uint64_t async_id = 0;
1519 NTSTATUS status;
1520 bool ok;
1521
1522 TALLOC_FREE(req->async_te);
1523
1524 /* Ensure our final reply matches the interim one. */
1525 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1526 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1527 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1528 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1529 session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
1530
1531 async_id = message_id; /* keep it simple for now... */
1532
1533 SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1534 SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
1535
1536 DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1537 "going async\n",
1538 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1539 (unsigned long long)async_id ));
1540
1541 /*
1542 * What we send is identical to a smbd_smb2_request_error
1543 * packet with an error status of STATUS_PENDING. Make use
1544 * of this fact sometime when refactoring. JRA.
1545 */
1546
1547 state = talloc_zero(req->xconn, struct smbd_smb2_request_pending_state);
1548 if (state == NULL) {
1549 smbd_server_connection_terminate(xconn,
1550 nt_errstr(NT_STATUS_NO_MEMORY));
1551 return;
1552 }
1553
1554 tf = state->buf + NBT_HDR_SIZE;
1555 tf_len = SMB2_TF_HDR_SIZE;
1556
1557 hdr = tf + SMB2_TF_HDR_SIZE;
1558 body = hdr + SMB2_HDR_BODY;
1559 dyn = body + 8;
1560
1561 if (req->do_encryption) {
1562 status = smb2_get_new_nonce(req->session,
1563 &nonce_high,
1564 &nonce_low);
1565 if (!NT_STATUS_IS_OK(status)) {
1566 smbd_server_connection_terminate(xconn,
1567 nt_errstr(status));
1568 return;
1569 }
1570 }
1571
1572 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
1573 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
1574 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
1575 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
1576
1577 SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1578 SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1579 SSVAL(hdr, SMB2_HDR_EPOCH, 0);
1580 SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
1581 SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
1582
1583 SIVAL(hdr, SMB2_HDR_FLAGS, flags);
1584 SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
1585 SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
1586 SBVAL(hdr, SMB2_HDR_PID, async_id);
1587 SBVAL(hdr, SMB2_HDR_SESSION_ID,
1588 BVAL(outhdr, SMB2_HDR_SESSION_ID));
1589 memcpy(hdr+SMB2_HDR_SIGNATURE,
1590 outhdr+SMB2_HDR_SIGNATURE, 16);
1591
1592 SSVAL(body, 0x00, 0x08 + 1);
1593
1594 SCVAL(body, 0x02, 0);
1595 SCVAL(body, 0x03, 0);
1596 SIVAL(body, 0x04, 0);
1597 /* Match W2K8R2... */
1598 SCVAL(dyn, 0x00, 0x21);
1599
1600 state->vector[0].iov_base = (void *)state->buf;
1601 state->vector[0].iov_len = NBT_HDR_SIZE;
1602
1603 if (req->do_encryption) {
1604 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
1605 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
1606 } else {
1607 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
1608 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
1609 }
1610
1611 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base = hdr;
1612 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1613
1614 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
1615 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len = 8;
1616
1617 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
1618 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len = 1;
1619
1620 ok = smb2_setup_nbt_length(state->vector,
1621 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
1622 if (!ok) {
1623 smbd_server_connection_terminate(
1624 xconn, nt_errstr(NT_STATUS_INTERNAL_ERROR));
1625 return;
1626 }
1627
1628 /* Ensure we correctly go through crediting. Grant
1629 the credits now, and zero credits on the final
1630 response. */
1631 smb2_set_operation_credit(req->xconn,
1632 SMBD_SMB2_IN_HDR_IOV(req),
1633 &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
1634
1635 SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1636
1637 if (DEBUGLVL(10)) {
1638 int i;
1639
1640 for (i = 0; i < ARRAY_SIZE(state->vector); i++) {
1641 dbgtext("\tstate->vector[%u/%u].iov_len = %u\n",
1642 (unsigned int)i,
1643 (unsigned int)ARRAY_SIZE(state->vector),
1644 (unsigned int)state->vector[i].iov_len);
1645 }
1646 }
1647
1648 if (req->do_encryption) {
1649 struct smbXsrv_session *x = req->session;
1650 DATA_BLOB encryption_key = x->global->encryption_key;
1651
1652 status = smb2_signing_encrypt_pdu(encryption_key,
1653 xconn->smb2.server.cipher,
1654 &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
1655 SMBD_SMB2_NUM_IOV_PER_REQ);
1656 if (!NT_STATUS_IS_OK(status)) {
1657 smbd_server_connection_terminate(xconn,
1658 nt_errstr(status));
1659 return;
1660 }
1661 } else if (req->do_signing) {
1662 struct smbXsrv_session *x = req->session;
1663 DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
1664
1665 status = smb2_signing_sign_pdu(signing_key,
1666 xconn->protocol,
1667 &state->vector[1+SMBD_SMB2_HDR_IOV_OFS],
1668 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1669 if (!NT_STATUS_IS_OK(status)) {
1670 smbd_server_connection_terminate(xconn,
1671 nt_errstr(status));
1672 return;
1673 }
1674 }
1675
1676 state->queue_entry.mem_ctx = state;
1677 state->queue_entry.vector = state->vector;
1678 state->queue_entry.count = ARRAY_SIZE(state->vector);
1679 DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry, NULL);
1680 xconn->smb2.send_queue_len++;
1681
1682 status = smbd_smb2_flush_send_queue(xconn);
1683 if (!NT_STATUS_IS_OK(status)) {
1684 smbd_server_connection_terminate(xconn,
1685 nt_errstr(status));
1686 return;
1687 }
1688 }
1689
1690 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
1691 {
1692 struct smbXsrv_connection *xconn = req->xconn;
1693 struct smbd_smb2_request *cur;
1694 const uint8_t *inhdr;
1695 uint32_t flags;
1696 uint64_t search_message_id;
1697 uint64_t search_async_id;
1698 uint64_t found_id;
1699
1700 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1701
1702 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1703 search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1704 search_async_id = BVAL(inhdr, SMB2_HDR_PID);
1705
1706 /*
1707 * we don't need the request anymore
1708 * cancel requests never have a response
1709 */
1710 DLIST_REMOVE(xconn->smb2.requests, req);
1711 TALLOC_FREE(req);
1712
1713 for (cur = xconn->smb2.requests; cur; cur = cur->next) {
1714 const uint8_t *outhdr;
1715 uint64_t message_id;
1716 uint64_t async_id;
1717
1718 if (cur->compound_related) {
1719 /*
1720 * Never cancel anything in a compound request.
1721 * Way too hard to deal with the result.
1722 */
1723 continue;
1724 }
1725
1726 outhdr = SMBD_SMB2_OUT_HDR_PTR(cur);
1727
1728 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1729 async_id = BVAL(outhdr, SMB2_HDR_PID);
1730
1731 if (flags & SMB2_HDR_FLAG_ASYNC) {
1732 if (search_async_id == async_id) {
1733 found_id = async_id;
1734 break;
1735 }
1736 } else {
1737 if (search_message_id == message_id) {
1738 found_id = message_id;
1739 break;
1740 }
1741 }
1742 }
1743
1744 if (cur && cur->subreq) {
1745 inhdr = SMBD_SMB2_IN_HDR_PTR(cur);
1746 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1747 "cancel opcode[%s] mid %llu\n",
1748 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1749 (unsigned long long)found_id ));
1750 tevent_req_cancel(cur->subreq);
1751 }
1752
1753 return NT_STATUS_OK;
1754 }
1755
1756 /*************************************************************
1757 Ensure an incoming tid is a valid one for us to access.
1758 Change to the associated uid credentials and chdir to the
1759 valid tid directory.
1760 *************************************************************/
1761
1762 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
1763 {
1764 const uint8_t *inhdr;
1765 uint32_t in_flags;
1766 uint32_t in_tid;
1767 struct smbXsrv_tcon *tcon;
1768 NTSTATUS status;
1769 NTTIME now = timeval_to_nttime(&req->request_time);
1770
1771 req->tcon = NULL;
1772
1773 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1774
1775 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1776 in_tid = IVAL(inhdr, SMB2_HDR_TID);
1777
1778 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1779 in_tid = req->last_tid;
1780 }
1781
1782 req->last_tid = 0;
1783
1784 status = smb2srv_tcon_lookup(req->session,
1785 in_tid, now, &tcon);
1786 if (!NT_STATUS_IS_OK(status)) {
1787 return status;
1788 }
1789
1790 if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
1791 return NT_STATUS_ACCESS_DENIED;
1792 }
1793
1794 /* should we pass FLAG_CASELESS_PATHNAMES here? */
1795 if (!set_current_service(tcon->compat, 0, true)) {
1796 return NT_STATUS_ACCESS_DENIED;
1797 }
1798
1799 req->tcon = tcon;
1800 req->last_tid = in_tid;
1801
1802 return NT_STATUS_OK;
1803 }
1804
1805 /*************************************************************
1806 Ensure an incoming session_id is a valid one for us to access.
1807 *************************************************************/
1808
1809 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
1810 {
1811 const uint8_t *inhdr;
1812 uint32_t in_flags;
1813 uint16_t in_opcode;
1814 uint64_t in_session_id;
1815 struct smbXsrv_session *session = NULL;
1816 struct auth_session_info *session_info;
1817 NTSTATUS status;
1818 NTTIME now = timeval_to_nttime(&req->request_time);
1819
1820 req->session = NULL;
1821 req->tcon = NULL;
1822
1823 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1824
1825 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1826 in_opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1827 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
1828
1829 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1830 in_session_id = req->last_session_id;
1831 }
1832
1833 req->last_session_id = 0;
1834
1835 /* lookup an existing session */
1836 status = smb2srv_session_lookup(req->xconn,
1837 in_session_id, now,
1838 &session);
1839 if (session) {
1840 req->session = session;
1841 req->last_session_id = in_session_id;
1842 }
1843 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1844 switch (in_opcode) {
1845 case SMB2_OP_SESSSETUP:
1846 status = NT_STATUS_OK;
1847 break;
1848 default:
1849 break;
1850 }
1851 }
1852 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1853 switch (in_opcode) {
1854 case SMB2_OP_TCON:
1855 case SMB2_OP_CREATE:
1856 case SMB2_OP_GETINFO:
1857 case SMB2_OP_SETINFO:
1858 return NT_STATUS_INVALID_HANDLE;
1859 default:
1860 /*
1861 * Notice the check for
1862 * (session_info == NULL)
1863 * below.
1864 */
1865 status = NT_STATUS_OK;
1866 break;
1867 }
1868 }
1869 if (!NT_STATUS_IS_OK(status)) {
1870 return status;
1871 }
1872
1873 session_info = session->global->auth_session_info;
1874 if (session_info == NULL) {
1875 return NT_STATUS_INVALID_HANDLE;
1876 }
1877
1878 if (in_session_id != req->xconn->client->last_session_id) {
1879 req->xconn->client->last_session_id = in_session_id;
1880 set_current_user_info(session_info->unix_info->sanitized_username,
1881 session_info->unix_info->unix_name,
1882 session_info->info->domain_name);
1883 }
1884
1885 return NT_STATUS_OK;
1886 }
1887
1888 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
1889 uint32_t data_length)
1890 {
1891 struct smbXsrv_connection *xconn = req->xconn;
1892 uint16_t needed_charge;
1893 uint16_t credit_charge = 1;
1894 const uint8_t *inhdr;
1895
1896 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1897
1898 if (xconn->smb2.credits.multicredit) {
1899 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
1900 credit_charge = MAX(credit_charge, 1);
1901 }
1902
1903 needed_charge = (data_length - 1)/ 65536 + 1;
1904
1905 DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
1906 (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
1907 credit_charge, needed_charge));
1908
1909 if (needed_charge > credit_charge) {
1910 DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
1911 credit_charge, needed_charge));
1912 return NT_STATUS_INVALID_PARAMETER;
1913 }
1914
1915 return NT_STATUS_OK;
1916 }
1917
1918 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
1919 size_t expected_body_size)
1920 {
1921 struct iovec *inhdr_v;
1922 const uint8_t *inhdr;
1923 uint16_t opcode;
1924 const uint8_t *inbody;
1925 size_t body_size;
1926 size_t min_dyn_size = expected_body_size & 0x00000001;
1927 int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
1928
1929 /*
1930 * The following should be checked already.
1931 */
1932 if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
1933 return NT_STATUS_INTERNAL_ERROR;
1934 }
1935 if (req->current_idx > max_idx) {
1936 return NT_STATUS_INTERNAL_ERROR;
1937 }
1938
1939 inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
1940 if (inhdr_v->iov_len != SMB2_HDR_BODY) {
1941 return NT_STATUS_INTERNAL_ERROR;
1942 }
1943 if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
1944 return NT_STATUS_INTERNAL_ERROR;
1945 }
1946
1947 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1948 opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1949
1950 switch (opcode) {
1951 case SMB2_OP_IOCTL:
1952 case SMB2_OP_GETINFO:
1953 min_dyn_size = 0;
1954 break;
1955 case SMB2_OP_WRITE:
1956 if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) {
1957 if (req->smb1req->unread_bytes < min_dyn_size) {
1958 return NT_STATUS_INVALID_PARAMETER;
1959 }
1960
1961 min_dyn_size = 0;
1962 }
1963 break;
1964 }
1965
1966 /*
1967 * Now check the expected body size,
1968 * where the last byte might be in the
1969 * dynamic section..
1970 */
1971 if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
1972 return NT_STATUS_INVALID_PARAMETER;
1973 }
1974 if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
1975 return NT_STATUS_INVALID_PARAMETER;
1976 }
1977
1978 inbody = SMBD_SMB2_IN_BODY_PTR(req);
1979
1980 body_size = SVAL(inbody, 0x00);
1981 if (body_size != expected_body_size) {
1982 return NT_STATUS_INVALID_PARAMETER;
1983 }
1984
1985 return NT_STATUS_OK;
1986 }
1987
1988 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
1989 {
1990 struct smbXsrv_connection *xconn = req->xconn;
1991 const struct smbd_smb2_dispatch_table *call = NULL;
1992 const struct iovec *intf_v = SMBD_SMB2_IN_TF_IOV(req);
1993 const uint8_t *inhdr;
1994 uint16_t opcode;
1995 uint32_t flags;
1996 uint64_t mid;
1997 NTSTATUS status;
1998 NTSTATUS session_status;
1999 uint32_t allowed_flags;
2000 NTSTATUS return_value;
2001 struct smbXsrv_session *x = NULL;
2002 bool signing_required = false;
2003 bool encryption_desired = false;
2004 bool encryption_required = false;
2005
2006 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2007
2008 DO_PROFILE_INC(request);
2009
2010 /* TODO: verify more things */
2011
2012 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2013 opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2014 mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
2015 DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
2016 smb2_opcode_name(opcode),
2017 (unsigned long long)mid));
2018
2019 if (xconn->protocol >= PROTOCOL_SMB2_02) {
2020 /*
2021 * once the protocol is negotiated
2022 * SMB2_OP_NEGPROT is not allowed anymore
2023 */
2024 if (opcode == SMB2_OP_NEGPROT) {
2025 /* drop the connection */
2026 return NT_STATUS_INVALID_PARAMETER;
2027 }
2028 } else {
2029 /*
2030 * if the protocol is not negotiated yet
2031 * only SMB2_OP_NEGPROT is allowed.
2032 */
2033 if (opcode != SMB2_OP_NEGPROT) {
2034 /* drop the connection */
2035 return NT_STATUS_INVALID_PARAMETER;
2036 }
2037 }
2038
2039 /*
2040 * Check if the client provided a valid session id,
2041 * if so smbd_smb2_request_check_session() calls
2042 * set_current_user_info().
2043 *
2044 * As some command don't require a valid session id
2045 * we defer the check of the session_status
2046 */
2047 session_status = smbd_smb2_request_check_session(req);
2048 x = req->session;
2049 if (x != NULL) {
2050 signing_required = x->global->signing_required;
2051 encryption_desired = x->encryption_desired;
2052 encryption_required = x->global->encryption_required;
2053 }
2054
2055 req->do_signing = false;
2056 req->do_encryption = false;
2057 req->was_encrypted = false;
2058 if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
2059 const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
2060 uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
2061
2062 if (x != NULL && x->global->session_wire_id != tf_session_id) {
2063 DEBUG(0,("smbd_smb2_request_dispatch: invalid session_id"
2064 "in SMB2_HDR[%llu], SMB2_TF[%llu]\n",
2065 (unsigned long long)x->global->session_wire_id,
2066 (unsigned long long)tf_session_id));
2067 /*
2068 * TODO: windows allows this...
2069 * should we drop the connection?
2070 *
2071 * For now we just return ACCESS_DENIED
2072 * (Windows clients never trigger this)
2073 * and wait for an update of [MS-SMB2].
2074 */
2075 return smbd_smb2_request_error(req,
2076 NT_STATUS_ACCESS_DENIED);
2077 }
2078
2079 req->was_encrypted = true;
2080 }
2081
2082 if (encryption_required && !req->was_encrypted) {
2083 return smbd_smb2_request_error(req,
2084 NT_STATUS_ACCESS_DENIED);
2085 }
2086
2087 call = smbd_smb2_call(opcode);
2088 if (call == NULL) {
2089 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2090 }
2091
2092 allowed_flags = SMB2_HDR_FLAG_CHAINED |
2093 SMB2_HDR_FLAG_SIGNED |
2094 SMB2_HDR_FLAG_DFS;
2095 if (xconn->protocol >= PROTOCOL_SMB3_11) {
2096 allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
2097 }
2098 if (opcode == SMB2_OP_NEGPROT) {
2099 if (lp_server_max_protocol() >= PROTOCOL_SMB3_11) {
2100 allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
2101 }
2102 }
2103 if (opcode == SMB2_OP_CANCEL) {
2104 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
2105 }
2106 if ((flags & ~allowed_flags) != 0) {
2107 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2108 }
2109
2110 if (flags & SMB2_HDR_FLAG_CHAINED) {
2111 /*
2112 * This check is mostly for giving the correct error code
2113 * for compounded requests.
2114 */
2115 if (!NT_STATUS_IS_OK(session_status)) {
2116 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2117 }
2118 } else {
2119 req->compat_chain_fsp = NULL;
2120 }
2121
2122 if (req->was_encrypted) {
2123 signing_required = false;
2124 } else if (signing_required || (flags & SMB2_HDR_FLAG_SIGNED)) {
2125 DATA_BLOB signing_key = data_blob_null;
2126
2127 if (x == NULL) {
2128 /*
2129 * MS-SMB2: 3.3.5.2.4 Verifying the Signature.
2130 * If the SMB2 header of the SMB2 NEGOTIATE
2131 * request has the SMB2_FLAGS_SIGNED bit set in the
2132 * Flags field, the server MUST fail the request
2133 * with STATUS_INVALID_PARAMETER.
2134 *
2135 * Microsoft test tool checks this.
2136 */
2137
2138 if ((opcode == SMB2_OP_NEGPROT) &&
2139 (flags & SMB2_HDR_FLAG_SIGNED)) {
2140 status = NT_STATUS_INVALID_PARAMETER;
2141 } else {
2142 status = NT_STATUS_USER_SESSION_DELETED;
2143 }
2144 return smbd_smb2_request_error(req, status);
2145 }
2146
2147 signing_key = smbd_smb2_signing_key(x, xconn);
2148
2149 /*
2150 * If we have a signing key, we should
2151 * sign the response
2152 */
2153 if (signing_key.length > 0) {
2154 req->do_signing = true;
2155 }
2156
2157 status = smb2_signing_check_pdu(signing_key,
2158 xconn->protocol,
2159 SMBD_SMB2_IN_HDR_IOV(req),
2160 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2161 if (!NT_STATUS_IS_OK(status)) {
2162 return smbd_smb2_request_error(req, status);
2163 }
2164
2165 /*
2166 * Now that we know the request was correctly signed
2167 * we have to sign the response too.
2168 */
2169 req->do_signing = true;
2170
2171 if (!NT_STATUS_IS_OK(session_status)) {
2172 return smbd_smb2_request_error(req, session_status);
2173 }
2174 } else if (opcode == SMB2_OP_CANCEL) {
2175 /* Cancel requests are allowed to skip the signing */
2176 } else if (signing_required) {
2177 /*
2178 * If signing is required we try to sign
2179 * a possible error response
2180 */
2181 req->do_signing = true;
2182 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
2183 }
2184
2185 if (flags & SMB2_HDR_FLAG_CHAINED) {
2186 req->compound_related = true;
2187 }
2188
2189 if (call->need_session) {
2190 if (!NT_STATUS_IS_OK(session_status)) {
2191 return smbd_smb2_request_error(req, session_status);
2192 }
2193 }
2194
2195 if (call->need_tcon) {
2196 SMB_ASSERT(call->need_session);
2197
2198 /*
2199 * This call needs to be run as user.
2200 *
2201 * smbd_smb2_request_check_tcon()
2202 * calls change_to_user() on success.
2203 */
2204 status = smbd_smb2_request_check_tcon(req);
2205 if (!NT_STATUS_IS_OK(status)) {
2206 return smbd_smb2_request_error(req, status);
2207 }
2208 if (req->tcon->encryption_desired) {
2209 encryption_desired = true;
2210 }
2211 if (req->tcon->global->encryption_required) {
2212 encryption_required = true;
2213 }
2214 if (encryption_required && !req->was_encrypted) {
2215 return smbd_smb2_request_error(req,
2216 NT_STATUS_ACCESS_DENIED);
2217 }
2218 }
2219
2220 if (req->was_encrypted || encryption_desired) {
2221 req->do_encryption = true;
2222 }
2223
2224 if (call->fileid_ofs != 0) {
2225 size_t needed = call->fileid_ofs + 16;
2226 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
2227 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
2228 uint64_t file_id_persistent;
2229 uint64_t file_id_volatile;
2230 struct files_struct *fsp;
2231
2232 SMB_ASSERT(call->need_tcon);
2233
2234 if (needed > body_size) {
2235 return smbd_smb2_request_error(req,
2236 NT_STATUS_INVALID_PARAMETER);
2237 }
2238
2239 file_id_persistent = BVAL(body, call->fileid_ofs + 0);
2240 file_id_volatile = BVAL(body, call->fileid_ofs + 8);
2241
2242 fsp = file_fsp_smb2(req, file_id_persistent, file_id_volatile);
2243 if (fsp == NULL) {
2244 if (!call->allow_invalid_fileid) {
2245 return smbd_smb2_request_error(req,
2246 NT_STATUS_FILE_CLOSED);
2247 }
2248
2249 if (file_id_persistent != UINT64_MAX) {
2250 return smbd_smb2_request_error(req,
2251 NT_STATUS_FILE_CLOSED);
2252 }
2253 if (file_id_volatile != UINT64_MAX) {
2254 return smbd_smb2_request_error(req,
2255 NT_STATUS_FILE_CLOSED);
2256 }
2257 }
2258 }
2259
2260 if (call->as_root) {
2261 SMB_ASSERT(call->fileid_ofs == 0);
2262 /* This call needs to be run as root */
2263 change_to_root_user();
2264 } else {
2265 SMB_ASSERT(call->need_tcon);
2266 }
2267
2268 #define _INBYTES(_r) \
2269 iov_buflen(SMBD_SMB2_IN_HDR_IOV(_r), SMBD_SMB2_NUM_IOV_PER_REQ-1)
2270
2271 switch (opcode) {
2272 case SMB2_OP_NEGPROT:
2273 SMBPROFILE_IOBYTES_ASYNC_START(smb2_negprot, profile_p,
2274 req->profile, _INBYTES(req));
2275 return_value = smbd_smb2_request_process_negprot(req);
2276 break;
2277
2278 case SMB2_OP_SESSSETUP:
2279 SMBPROFILE_IOBYTES_ASYNC_START(smb2_sesssetup, profile_p,
2280 req->profile, _INBYTES(req));
2281 return_value = smbd_smb2_request_process_sesssetup(req);
2282 break;
2283
2284 case SMB2_OP_LOGOFF:
2285 SMBPROFILE_IOBYTES_ASYNC_START(smb2_logoff, profile_p,
2286 req->profile, _INBYTES(req));
2287 return_value = smbd_smb2_request_process_logoff(req);
2288 break;
2289
2290 case SMB2_OP_TCON:
2291 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tcon, profile_p,
2292 req->profile, _INBYTES(req));
2293 return_value = smbd_smb2_request_process_tcon(req);
2294 break;
2295
2296 case SMB2_OP_TDIS:
2297 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tdis, profile_p,
2298 req->profile, _INBYTES(req));
2299 return_value = smbd_smb2_request_process_tdis(req);
2300 break;
2301
2302 case SMB2_OP_CREATE:
2303 if (req->subreq == NULL) {
2304 SMBPROFILE_IOBYTES_ASYNC_START(smb2_create, profile_p,
2305 req->profile, _INBYTES(req));
2306 } else {
2307 SMBPROFILE_IOBYTES_ASYNC_SET_BUSY(req->profile);
2308 }
2309 return_value = smbd_smb2_request_process_create(req);
2310 break;
2311
2312 case SMB2_OP_CLOSE:
2313 SMBPROFILE_IOBYTES_ASYNC_START(smb2_close, profile_p,
2314 req->profile, _INBYTES(req));
2315 return_value = smbd_smb2_request_process_close(req);
2316 break;
2317
2318 case SMB2_OP_FLUSH:
2319 SMBPROFILE_IOBYTES_ASYNC_START(smb2_flush, profile_p,
2320 req->profile, _INBYTES(req));
2321 return_value = smbd_smb2_request_process_flush(req);
2322 break;
2323
2324 case SMB2_OP_READ:
2325 SMBPROFILE_IOBYTES_ASYNC_START(smb2_read, profile_p,
2326 req->profile, _INBYTES(req));
2327 return_value = smbd_smb2_request_process_read(req);
2328 break;
2329
2330 case SMB2_OP_WRITE:
2331 SMBPROFILE_IOBYTES_ASYNC_START(smb2_write, profile_p,
2332 req->profile, _INBYTES(req));
2333 return_value = smbd_smb2_request_process_write(req);
2334 break;
2335
2336 case SMB2_OP_LOCK:
2337 SMBPROFILE_IOBYTES_ASYNC_START(smb2_lock, profile_p,
2338 req->profile, _INBYTES(req));
2339 return_value = smbd_smb2_request_process_lock(req);
2340 break;
2341
2342 case SMB2_OP_IOCTL:
2343 SMBPROFILE_IOBYTES_ASYNC_START(smb2_ioctl, profile_p,
2344 req->profile, _INBYTES(req));
2345 return_value = smbd_smb2_request_process_ioctl(req);
2346 break;
2347
2348 case SMB2_OP_CANCEL:
2349 SMBPROFILE_IOBYTES_ASYNC_START(smb2_cancel, profile_p,
2350 req->profile, _INBYTES(req));
2351 return_value = smbd_smb2_request_process_cancel(req);
2352 SMBPROFILE_IOBYTES_ASYNC_END(req->profile, 0);
2353 break;
2354
2355 case SMB2_OP_KEEPALIVE:
2356 SMBPROFILE_IOBYTES_ASYNC_START(smb2_keepalive, profile_p,
2357 req->profile, _INBYTES(req));
2358 return_value = smbd_smb2_request_process_keepalive(req);
2359 break;
2360
2361 case SMB2_OP_QUERY_DIRECTORY:
2362 SMBPROFILE_IOBYTES_ASYNC_START(smb2_find, profile_p,
2363 req->profile, _INBYTES(req));
2364 return_value = smbd_smb2_request_process_query_directory(req);
2365 break;
2366
2367 case SMB2_OP_NOTIFY:
2368 SMBPROFILE_IOBYTES_ASYNC_START(smb2_notify, profile_p,
2369 req->profile, _INBYTES(req));
2370 return_value = smbd_smb2_request_process_notify(req);
2371 break;
2372
2373 case SMB2_OP_GETINFO:
2374 SMBPROFILE_IOBYTES_ASYNC_START(smb2_getinfo, profile_p,
2375 req->profile, _INBYTES(req));
2376 return_value = smbd_smb2_request_process_getinfo(req);
2377 break;
2378
2379 case SMB2_OP_SETINFO:
2380 SMBPROFILE_IOBYTES_ASYNC_START(smb2_setinfo, profile_p,
2381 req->profile, _INBYTES(req));
2382 return_value = smbd_smb2_request_process_setinfo(req);
2383 break;
2384
2385 case SMB2_OP_BREAK:
2386 SMBPROFILE_IOBYTES_ASYNC_START(smb2_break, profile_p,
2387 req->profile, _INBYTES(req));
2388 return_value = smbd_smb2_request_process_break(req);
2389 break;
2390
2391 default:
2392 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2393 break;
2394 }
2395 return return_value;
2396 }
2397
2398 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
2399 {
2400 struct smbXsrv_connection *xconn = req->xconn;
2401 int first_idx = 1;
2402 struct iovec *firsttf = SMBD_SMB2_IDX_TF_IOV(req,out,first_idx);
2403 struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
2404 struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
2405 NTSTATUS status;
2406 bool ok;
2407
2408 req->subreq = NULL;
2409 TALLOC_FREE(req->async_te);
2410
2411 if (req->do_encryption &&
2412 (firsttf->iov_len == 0) &&
2413 (req->first_key.length == 0) &&
2414 (req->session != NULL) &&
2415 (req->session->global->encryption_key.length != 0))
2416 {
2417 DATA_BLOB encryption_key = req->session->global->encryption_key;
2418 uint8_t *tf;
2419 uint64_t session_id = req->session->global->session_wire_id;
2420 uint64_t nonce_high;
2421 uint64_t nonce_low;
2422
2423 status = smb2_get_new_nonce(req->session,
2424 &nonce_high,
2425 &nonce_low);
2426 if (!NT_STATUS_IS_OK(status)) {
2427 return status;
2428 }
2429
2430 /*
2431 * We need to place the SMB2_TRANSFORM header before the
2432 * first SMB2 header
2433 */
2434
2435 /*
2436 * we need to remember the encryption key
2437 * and defer the signing/encryption until
2438 * we are sure that we do not change
2439 * the header again.
2440 */
2441 req->first_key = data_blob_dup_talloc(req, encryption_key);
2442 if (req->first_key.data == NULL) {
2443 return NT_STATUS_NO_MEMORY;
2444 }
2445
2446 tf = talloc_zero_array(req, uint8_t,
2447 SMB2_TF_HDR_SIZE);
2448 if (tf == NULL) {
2449 return NT_STATUS_NO_MEMORY;
2450 }
2451
2452 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2453 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2454 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2455 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
2456
2457 firsttf->iov_base = (void *)tf;
2458 firsttf->iov_len = SMB2_TF_HDR_SIZE;
2459 }
2460
2461 if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
2462 (req->last_key.length > 0) &&
2463 (firsttf->iov_len == 0))
2464 {
2465 int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
2466 struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
2467
2468 /*
2469 * As we are sure the header of the last request in the
2470 * compound chain will not change, we can to sign here
2471 * with the last signing key we remembered.
2472 */
2473 status = smb2_signing_sign_pdu(req->last_key,
2474 xconn->protocol,
2475 lasthdr,
2476 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2477 if (!NT_STATUS_IS_OK(status)) {
2478 return status;
2479 }
2480 }
2481 if (req->last_key.length > 0) {
2482 data_blob_clear_free(&req->last_key);
2483 }
2484
2485 SMBPROFILE_IOBYTES_ASYNC_END(req->profile,
2486 iov_buflen(outhdr, SMBD_SMB2_NUM_IOV_PER_REQ-1));
2487
2488 req->current_idx += SMBD_SMB2_NUM_IOV_PER_REQ;
2489
2490 if (req->current_idx < req->out.vector_count) {
2491 /*
2492 * We must process the remaining compound
2493 * SMB2 requests before any new incoming SMB2
2494 * requests. This is because incoming SMB2
2495 * requests may include a cancel for a
2496 * compound request we haven't processed
2497 * yet.
2498 */
2499 struct tevent_immediate *im = tevent_create_immediate(req);
2500 if (!im) {
2501 return NT_STATUS_NO_MEMORY;
2502 }
2503
2504 if (req->do_signing && firsttf->iov_len == 0) {
2505 struct smbXsrv_session *x = req->session;
2506 DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
2507
2508 /*
2509 * we need to remember the signing key
2510 * and defer the signing until
2511 * we are sure that we do not change
2512 * the header again.
2513 */
2514 req->last_key = data_blob_dup_talloc(req, signing_key);
2515 if (req->last_key.data == NULL) {
2516 return NT_STATUS_NO_MEMORY;
2517 }
2518 }
2519
2520 tevent_schedule_immediate(im,
2521 req->sconn->ev_ctx,
2522 smbd_smb2_request_dispatch_immediate,
2523 req);
2524 return NT_STATUS_OK;
2525 }
2526
2527 if (req->compound_related) {
2528 req->compound_related = false;
2529 }
2530
2531 ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
2532 if (!ok) {
2533 return NT_STATUS_INVALID_PARAMETER_MIX;
2534 }
2535
2536 /* Set credit for these operations (zero credits if this
2537 is a final reply for an async operation). */
2538 smb2_calculate_credits(req, req);
2539
2540 /*
2541 * now check if we need to sign the current response
2542 */
2543 if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
2544 status = smb2_signing_encrypt_pdu(req->first_key,
2545 xconn->smb2.server.cipher,
2546 firsttf,
2547 req->out.vector_count - first_idx);
2548 if (!NT_STATUS_IS_OK(status)) {
2549 return status;
2550 }
2551 } else if (req->do_signing) {
2552 struct smbXsrv_session *x = req->session;
2553 DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
2554
2555 status = smb2_signing_sign_pdu(signing_key,
2556 xconn->protocol,
2557 outhdr,
2558 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2559 if (!NT_STATUS_IS_OK(status)) {
2560 return status;
2561 }
2562 }
2563 if (req->first_key.length > 0) {
2564 data_blob_clear_free(&req->first_key);
2565 }
2566
2567 if (req->preauth != NULL) {
2568 struct hc_sha512state sctx;
2569 int i;
2570
2571 samba_SHA512_Init(&sctx);
2572 samba_SHA512_Update(&sctx, req->preauth->sha512_value,
2573 sizeof(req->preauth->sha512_value));
2574 for (i = 1; i < req->in.vector_count; i++) {
2575 samba_SHA512_Update(&sctx,
2576 req->in.vector[i].iov_base,
2577 req->in.vector[i].iov_len);
2578 }
2579 samba_SHA512_Final(req->preauth->sha512_value, &sctx);
2580
2581 samba_SHA512_Init(&sctx);
2582 samba_SHA512_Update(&sctx, req->preauth->sha512_value,
2583 sizeof(req->preauth->sha512_value));
2584 for (i = 1; i < req->out.vector_count; i++) {
2585 samba_SHA512_Update(&sctx,
2586 req->out.vector[i].iov_base,
2587 req->out.vector[i].iov_len);
2588 }
2589 samba_SHA512_Final(req->preauth->sha512_value, &sctx);
2590
2591 req->preauth = NULL;
2592 }
2593
2594 /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
2595 if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
2596 outdyn->iov_base == NULL && outdyn->iov_len != 0) {
2597 /* Dynamic part is NULL. Chop it off,
2598 We're going to send it via sendfile. */
2599 req->out.vector_count -= 1;
2600 }
2601
2602 /*
2603 * We're done with this request -
2604 * move it off the "being processed" queue.
2605 */
2606 DLIST_REMOVE(xconn->smb2.requests, req);
2607
2608 req->queue_entry.mem_ctx = req;
2609 req->queue_entry.vector = req->out.vector;
2610 req->queue_entry.count = req->out.vector_count;
2611 DLIST_ADD_END(xconn->smb2.send_queue, &req->queue_entry, NULL);
2612 xconn->smb2.send_queue_len++;
2613
2614 status = smbd_smb2_flush_send_queue(xconn);
2615 if (!NT_STATUS_IS_OK(status)) {
2616 return status;
2617 }
2618
2619 return NT_STATUS_OK;
2620 }
2621
2622 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn);
2623
2624 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
2625 struct tevent_immediate *im,
2626 void *private_data)
2627 {
2628 struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
2629 struct smbd_smb2_request);
2630 struct smbXsrv_connection *xconn = req->xconn;
2631 NTSTATUS status;
2632
2633 TALLOC_FREE(im);
2634
2635 if (DEBUGLEVEL >= 10) {
2636 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
2637 req->current_idx, req->in.vector_count));
2638 print_req_vectors(req);
2639 }
2640
2641 status = smbd_smb2_request_dispatch(req);
2642 if (!NT_STATUS_IS_OK(status)) {
2643 smbd_server_connection_terminate(xconn, nt_errstr(status));
2644 return;
2645 }
2646
2647 status = smbd_smb2_request_next_incoming(xconn);
2648 if (!NT_STATUS_IS_OK(status)) {
2649 smbd_server_connection_terminate(xconn, nt_errstr(status));
2650 return;
2651 }
2652 }
2653
2654 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
2655 NTSTATUS status,
2656 DATA_BLOB body, DATA_BLOB *dyn,
2657 const char *location)
2658 {
2659 uint8_t *outhdr;
2660 struct iovec *outbody_v;
2661 struct iovec *outdyn_v;
2662 uint32_t next_command_ofs;
2663
2664 DEBUG(10,("smbd_smb2_request_done_ex: "
2665 "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
2666 req->current_idx, nt_errstr(status), (unsigned int)body.length,
2667 dyn ? "yes": "no",
2668 (unsigned int)(dyn ? dyn->length : 0),
2669 location));
2670
2671 if (body.length < 2) {
2672 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2673 }
2674
2675 if ((body.length % 2) != 0) {
2676 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2677 }
2678
2679 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2680 outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
2681 outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
2682
2683 next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
2684 SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
2685
2686 outbody_v->iov_base = (void *)body.data;
2687 outbody_v->iov_len = body.length;
2688
2689 if (dyn) {
2690 outdyn_v->iov_base = (void *)dyn->data;
2691 outdyn_v->iov_len = dyn->length;
2692 } else {
2693 outdyn_v->iov_base = NULL;
2694 outdyn_v->iov_len = 0;
2695 }
2696
2697 /*
2698 * See if we need to recalculate the offset to the next response
2699 *
2700 * Note that all responses may require padding (including the very last
2701 * one).
2702 */
2703 if (req->out.vector_count >= (2 * SMBD_SMB2_NUM_IOV_PER_REQ)) {
2704 next_command_ofs = SMB2_HDR_BODY;
2705 next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
2706 next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
2707 }
2708
2709 if ((next_command_ofs % 8) != 0) {
2710 size_t pad_size = 8 - (next_command_ofs % 8);
2711 if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
2712 /*
2713 * if the dyn buffer is empty
2714 * we can use it to add padding
2715 */
2716 uint8_t *pad;
2717
2718 pad = talloc_zero_array(req,
2719 uint8_t, pad_size);
2720 if (pad == NULL) {
2721 return smbd_smb2_request_error(req,
2722 NT_STATUS_NO_MEMORY);
2723 }
2724
2725 outdyn_v->iov_base = (void *)pad;
2726 outdyn_v->iov_len = pad_size;
2727 } else {
2728 /*
2729 * For now we copy the dynamic buffer
2730 * and add the padding to the new buffer
2731 */
2732 size_t old_size;
2733 uint8_t *old_dyn;
2734 size_t new_size;
2735 uint8_t *new_dyn;
2736
2737 old_size = SMBD_SMB2_OUT_DYN_LEN(req);
2738 old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
2739
2740 new_size = old_size + pad_size;
2741 new_dyn = talloc_zero_array(req,
2742 uint8_t, new_size);
2743 if (new_dyn == NULL) {
2744 return smbd_smb2_request_error(req,
2745 NT_STATUS_NO_MEMORY);
2746 }
2747
2748 memcpy(new_dyn, old_dyn, old_size);
2749 memset(new_dyn + old_size, 0, pad_size);
2750
2751 outdyn_v->iov_base = (void *)new_dyn;
2752 outdyn_v->iov_len = new_size;
2753 }
2754 next_command_ofs += pad_size;
2755 }
2756
2757 if ((req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) >= req->out.vector_count) {
2758 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
2759 } else {
2760 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
2761 }
2762 return smbd_smb2_request_reply(req);
2763 }
2764
2765 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
2766 NTSTATUS status,
2767 DATA_BLOB *info,
2768 const char *location)
2769 {
2770 struct smbXsrv_connection *xconn = req->xconn;
2771 DATA_BLOB body;
2772 DATA_BLOB _dyn;
2773 uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2774 size_t unread_bytes = smbd_smb2_unread_bytes(req);
2775
2776 DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
2777 req->current_idx, nt_errstr(status), info ? " +info" : "",
2778 location));
2779
2780 if (unread_bytes) {
2781 /* Recvfile error. Drain incoming socket. */
2782 size_t ret;
2783
2784 errno = 0;
2785 ret = drain_socket(xconn->transport.sock, unread_bytes);
2786 if (ret != unread_bytes) {
2787 NTSTATUS error;
2788
2789 if (errno == 0) {
2790 error = NT_STATUS_IO_DEVICE_ERROR;
2791 } else {
2792 error = map_nt_error_from_unix_common(errno);
2793 }
2794
2795 DEBUG(2, ("Failed to drain %u bytes from SMB2 socket: "
2796 "ret[%u] errno[%d] => %s\n",
2797 (unsigned)unread_bytes,
2798 (unsigned)ret, errno, nt_errstr(error)));
2799 return error;
2800 }
2801 }
2802
2803 body.data = outhdr + SMB2_HDR_BODY;
2804 body.length = 8;
2805 SSVAL(body.data, 0, 9);
2806
2807 if (info) {
2808 SIVAL(body.data, 0x04, info->length);
2809 } else {
2810 /* Allocated size of req->out.vector[i].iov_base
2811 * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
2812 * 1 byte without having to do an alloc.
2813 */
2814 info = &_dyn;
2815 info->data = ((uint8_t *)outhdr) +
2816 OUTVEC_ALLOC_SIZE - 1;
2817 info->length = 1;
2818 SCVAL(info->data, 0, 0);
2819 }
2820
2821 /*
2822 * Note: Even if there is an error, continue to process the request.
2823 * per MS-SMB2.
2824 */
2825
2826 return smbd_smb2_request_done_ex(req, status, body, info, __location__);
2827 }
2828
2829
2830 struct smbd_smb2_send_break_state {
2831 struct smbd_smb2_send_queue queue_entry;
2832 uint8_t nbt_hdr[NBT_HDR_SIZE];
2833 uint8_t tf[SMB2_TF_HDR_SIZE];
2834 uint8_t hdr[SMB2_HDR_BODY];
2835 struct iovec vector[1+SMBD_SMB2_NUM_IOV_PER_REQ];
2836 uint8_t body[1];
2837 };
2838
2839 static NTSTATUS smbd_smb2_send_break(struct smbXsrv_connection *xconn,
2840 struct smbXsrv_session *session,
2841 struct smbXsrv_tcon *tcon,
2842 const uint8_t *body,
2843 size_t body_len)
2844 {
2845 struct smbd_smb2_send_break_state *state;
2846 bool do_encryption = false;
2847 uint64_t session_wire_id = 0;
2848 uint64_t nonce_high = 0;
2849 uint64_t nonce_low = 0;
2850 NTSTATUS status;
2851 size_t statelen;
2852 bool ok;
2853
2854 if (session != NULL) {
2855 session_wire_id = session->global->session_wire_id;
2856 do_encryption = session->encryption_desired;
2857 if (tcon->encryption_desired) {
2858 do_encryption = true;
2859 }
2860 }
2861
2862 statelen = offsetof(struct smbd_smb2_send_break_state, body) +
2863 body_len;
2864
2865 state = talloc_zero_size(xconn, statelen);
2866 if (state == NULL) {
2867 return NT_STATUS_NO_MEMORY;
2868 }
2869 talloc_set_name_const(state, "struct smbd_smb2_send_break_state");
2870
2871 if (do_encryption) {
2872 status = smb2_get_new_nonce(session,
2873 &nonce_high,
2874 &nonce_low);
2875 if (!NT_STATUS_IS_OK(status)) {
2876 return status;
2877 }
2878 }
2879
2880 SIVAL(state->tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2881 SBVAL(state->tf, SMB2_TF_NONCE+0, nonce_low);
2882 SBVAL(state->tf, SMB2_TF_NONCE+8, nonce_high);
2883 SBVAL(state->tf, SMB2_TF_SESSION_ID, session_wire_id);
2884
2885 SIVAL(state->hdr, 0, SMB2_MAGIC);
2886 SSVAL(state->hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
2887 SSVAL(state->hdr, SMB2_HDR_EPOCH, 0);
2888 SIVAL(state->hdr, SMB2_HDR_STATUS, 0);
2889 SSVAL(state->hdr, SMB2_HDR_OPCODE, SMB2_OP_BREAK);
2890 SSVAL(state->hdr, SMB2_HDR_CREDIT, 0);
2891 SIVAL(state->hdr, SMB2_HDR_FLAGS, SMB2_HDR_FLAG_REDIRECT);
2892 SIVAL(state->hdr, SMB2_HDR_NEXT_COMMAND, 0);
2893 SBVAL(state->hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
2894 SIVAL(state->hdr, SMB2_HDR_PID, 0);
2895 SIVAL(state->hdr, SMB2_HDR_TID, 0);
2896 SBVAL(state->hdr, SMB2_HDR_SESSION_ID, 0);
2897 memset(state->hdr+SMB2_HDR_SIGNATURE, 0, 16);
2898
2899 state->vector[0] = (struct iovec) {
2900 .iov_base = state->nbt_hdr,
2901 .iov_len = sizeof(state->nbt_hdr)
2902 };
2903
2904 if (do_encryption) {
2905 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
2906 .iov_base = state->tf,
2907 .iov_len = sizeof(state->tf)
2908 };
2909 } else {
2910 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
2911 .iov_base = NULL,
2912 .iov_len = 0
2913 };
2914 }
2915
2916 state->vector[1+SMBD_SMB2_HDR_IOV_OFS] = (struct iovec) {
2917 .iov_base = state->hdr,
2918 .iov_len = sizeof(state->hdr)
2919 };
2920
2921 memcpy(state->body, body, body_len);
2922
2923 state->vector[1+SMBD_SMB2_BODY_IOV_OFS] = (struct iovec) {
2924 .iov_base = state->body,
2925 .iov_len = body_len /* no sizeof(state->body) .. :-) */
2926 };
2927
2928 /*
2929 * state->vector[1+SMBD_SMB2_DYN_IOV_OFS] is NULL by talloc_zero above
2930 */
2931
2932 ok = smb2_setup_nbt_length(state->vector,
2933 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
2934 if (!ok) {
2935 return NT_STATUS_INVALID_PARAMETER_MIX;
2936 }
2937
2938 if (do_encryption) {
2939 DATA_BLOB encryption_key = session->global->encryption_key;
2940
2941 status = smb2_signing_encrypt_pdu(encryption_key,
2942 xconn->smb2.server.cipher,
2943 &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
2944 SMBD_SMB2_NUM_IOV_PER_REQ);
2945 if (!NT_STATUS_IS_OK(status)) {
2946 return status;
2947 }
2948 }
2949
2950 state->queue_entry.mem_ctx = state;
2951 state->queue_entry.vector = state->vector;
2952 state->queue_entry.count = ARRAY_SIZE(state->vector);
2953 DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry, NULL);
2954 xconn->smb2.send_queue_len++;
2955
2956 status = smbd_smb2_flush_send_queue(xconn);
2957 if (!NT_STATUS_IS_OK(status)) {
2958 return status;
2959 }
2960
2961 return NT_STATUS_OK;
2962 }
2963
2964 NTSTATUS smbd_smb2_send_oplock_break(struct smbXsrv_connection *xconn,
2965 struct smbXsrv_session *session,
2966 struct smbXsrv_tcon *tcon,
2967 struct smbXsrv_open *op,
2968 uint8_t oplock_level)
2969 {
2970 uint8_t body[0x18];
2971
2972 SSVAL(body, 0x00, sizeof(body));
2973 SCVAL(body, 0x02, oplock_level);
2974 SCVAL(body, 0x03, 0); /* reserved */
2975 SIVAL(body, 0x04, 0); /* reserved */
2976 SBVAL(body, 0x08, op->global->open_persistent_id);
2977 SBVAL(body, 0x10, op->global->open_volatile_id);
2978
2979 return smbd_smb2_send_break(xconn, session, tcon, body, sizeof(body));
2980 }
2981
2982 NTSTATUS smbd_smb2_send_lease_break(struct smbXsrv_connection *xconn,
2983 uint16_t new_epoch,
2984 uint32_t lease_flags,
2985 struct smb2_lease_key *lease_key,
2986 uint32_t current_lease_state,
2987 uint32_t new_lease_state)
2988 {
2989 uint8_t body[0x2c];
2990
2991 SSVAL(body, 0x00, sizeof(body));
2992 SSVAL(body, 0x02, new_epoch);
2993 SIVAL(body, 0x04, lease_flags);
2994 SBVAL(body, 0x08, lease_key->data[0]);
2995 SBVAL(body, 0x10, lease_key->data[1]);
2996 SIVAL(body, 0x18, current_lease_state);
2997 SIVAL(body, 0x1c, new_lease_state);
2998 SIVAL(body, 0x20, 0); /* BreakReason, MUST be 0 */
2999 SIVAL(body, 0x24, 0); /* AccessMaskHint, MUST be 0 */
3000 SIVAL(body, 0x28, 0); /* ShareMaskHint, MUST be 0 */
3001
3002 return smbd_smb2_send_break(xconn, NULL, NULL, body, sizeof(body));
3003 }
3004
3005 static bool is_smb2_recvfile_write(struct smbd_smb2_request_read_state *state)
3006 {
3007 NTSTATUS status;
3008 uint32_t flags;
3009 uint64_t file_id_persistent;
3010 uint64_t file_id_volatile;
3011 struct smbXsrv_open *op = NULL;
3012 struct files_struct *fsp = NULL;
3013 const uint8_t *body = NULL;
3014
3015 /*
3016 * This is only called with a pktbuf
3017 * of at least SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN
3018 * bytes
3019 */
3020
3021 if (IVAL(state->pktbuf, 0) == SMB2_TF_MAGIC) {
3022 /* Transform header. Cannot recvfile. */
3023 return false;
3024 }
3025 if (IVAL(state->pktbuf, 0) != SMB2_MAGIC) {
3026 /* Not SMB2. Normal error path will cope. */
3027 return false;
3028 }
3029 if (SVAL(state->pktbuf, 4) != SMB2_HDR_BODY) {
3030 /* Not SMB2. Normal error path will cope. */
3031 return false;
3032 }
3033 if (SVAL(state->pktbuf, SMB2_HDR_OPCODE) != SMB2_OP_WRITE) {
3034 /* Needs to be a WRITE. */
3035 return false;
3036 }
3037 if (IVAL(state->pktbuf, SMB2_HDR_NEXT_COMMAND) != 0) {
3038 /* Chained. Cannot recvfile. */
3039 return false;
3040 }
3041 flags = IVAL(state->pktbuf, SMB2_HDR_FLAGS);
3042 if (flags & SMB2_HDR_FLAG_CHAINED) {
3043 /* Chained. Cannot recvfile. */
3044 return false;
3045 }
3046 if (flags & SMB2_HDR_FLAG_SIGNED) {
3047 /* Signed. Cannot recvfile. */
3048 return false;
3049 }
3050
3051 body = &state->pktbuf[SMB2_HDR_BODY];
3052
3053 file_id_persistent = BVAL(body, 0x10);
3054 file_id_volatile = BVAL(body, 0x18);
3055
3056 status = smb2srv_open_lookup(state->req->xconn,
3057 file_id_persistent,
3058 file_id_volatile,
3059 0, /* now */
3060 &op);
3061 if (!NT_STATUS_IS_OK(status)) {
3062 return false;
3063 }
3064
3065 fsp = op->compat;
3066 if (fsp == NULL) {
3067 return false;
3068 }
3069 if (fsp->conn == NULL) {
3070 return false;
3071 }
3072
3073 if (IS_IPC(fsp->conn)) {
3074 return false;
3075 }
3076 if (IS_PRINT(fsp->conn)) {
3077 return false;
3078 }
3079
3080 DEBUG(10,("Doing recvfile write len = %u\n",
3081 (unsigned int)(state->pktfull - state->pktlen)));
3082
3083 return true;
3084 }
3085
3086 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn)
3087 {
3088 struct smbd_server_connection *sconn = xconn->client->sconn;
3089 struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
3090 size_t max_send_queue_len;
3091 size_t cur_send_queue_len;
3092
3093 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
3094 /*
3095 * we're not supposed to do any io
3096 */
3097 return NT_STATUS_OK;
3098 }
3099
3100 if (state->req != NULL) {
3101 /*
3102 * if there is already a tstream_readv_pdu
3103 * pending, we are done.
3104 */
3105 return NT_STATUS_OK;
3106 }
3107
3108 max_send_queue_len = MAX(1, xconn->smb2.credits.max/16);
3109 cur_send_queue_len = xconn->smb2.send_queue_len;
3110
3111 if (cur_send_queue_len > max_send_queue_len) {
3112 /*
3113 * if we have a lot of requests to send,
3114 * we wait until they are on the wire until we
3115 * ask for the next request.
3116 */
3117 return NT_STATUS_OK;
3118 }
3119
3120 /* ask for the next request */
3121 ZERO_STRUCTP(state);
3122 state->req = smbd_smb2_request_allocate(xconn);
3123 if (state->req == NULL) {
3124 return NT_STATUS_NO_MEMORY;
3125 }
3126 state->req->sconn = sconn;
3127 state->req->xconn = xconn;
3128 state->min_recv_size = lp_min_receive_file_size();
3129
3130 TEVENT_FD_READABLE(xconn->transport.fde);
3131
3132 return NT_STATUS_OK;
3133 }
3134
3135 void smbd_smb2_first_negprot(struct smbXsrv_connection *xconn,
3136 const uint8_t *inpdu, size_t size)
3137 {
3138 struct smbd_server_connection *sconn = xconn->client->sconn;
3139 NTSTATUS status;
3140 struct smbd_smb2_request *req = NULL;
3141
3142 DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
3143 (unsigned int)size));
3144
3145 status = smbd_initialize_smb2(xconn);
3146 if (!NT_STATUS_IS_OK(status)) {
3147 smbd_server_connection_terminate(xconn, nt_errstr(status));
3148 return;
3149 }
3150
3151 status = smbd_smb2_request_create(xconn, inpdu, size, &req);
3152 if (!NT_STATUS_IS_OK(status)) {
3153 smbd_server_connection_terminate(xconn, nt_errstr(status));
3154 return;
3155 }
3156
3157 status = smbd_smb2_request_validate(req);
3158 if (!NT_STATUS_IS_OK(status)) {
3159 smbd_server_connection_terminate(xconn, nt_errstr(status));
3160 return;
3161 }
3162
3163 status = smbd_smb2_request_setup_out(req);
3164 if (!NT_STATUS_IS_OK(status)) {
3165 smbd_server_connection_terminate(xconn, nt_errstr(status));
3166 return;
3167 }
3168
3169 #ifdef WITH_PROFILE
3170 /*
3171 * this was already counted at the SMB1 layer =>
3172 * smbd_smb2_request_dispatch() should not count it twice.
3173 */
3174 if (profile_p->values.request_stats.count > 0) {
3175 profile_p->values.request_stats.count--;
3176 }
3177 #endif
3178 status = smbd_smb2_request_dispatch(req);
3179 if (!NT_STATUS_IS_OK(status)) {
3180 smbd_server_connection_terminate(xconn, nt_errstr(status));
3181 return;
3182 }
3183
3184 status = smbd_smb2_request_next_incoming(xconn);
3185 if (!NT_STATUS_IS_OK(status)) {
3186 smbd_server_connection_terminate(xconn, nt_errstr(status));
3187 return;
3188 }
3189
3190 sconn->num_requests++;
3191 }
3192
3193 static int socket_error_from_errno(int ret,
3194 int sys_errno,
3195 bool *retry)
3196 {
3197 *retry = false;
3198
3199 if (ret >= 0) {
3200 return 0;
3201 }
3202
3203 if (ret != -1) {
3204 return EIO;
3205 }
3206
3207 if (sys_errno == 0) {
3208 return EIO;
3209 }
3210
3211 if (sys_errno == EINTR) {
3212 *retry = true;
3213 return sys_errno;
3214 }
3215
3216 if (sys_errno == EINPROGRESS) {
3217 *retry = true;
3218 return sys_errno;
3219 }
3220
3221 if (sys_errno == EAGAIN) {
3222 *retry = true;
3223 return sys_errno;
3224 }
3225
3226 /* ENOMEM is retryable on Solaris/illumos, and possibly other systems. */
3227 if (sys_errno == ENOMEM) {
3228 *retry = true;
3229 return sys_errno;
3230 }
3231
3232 #ifdef EWOULDBLOCK
3233 #if EWOULDBLOCK != EAGAIN
3234 if (sys_errno == EWOULDBLOCK) {
3235 *retry = true;
3236 return sys_errno;
3237 }
3238 #endif
3239 #endif
3240
3241 return sys_errno;
3242 }
3243
3244 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn)
3245 {
3246 int ret;
3247 int err;
3248 bool retry;
3249
3250 if (xconn->smb2.send_queue == NULL) {
3251 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3252 return NT_STATUS_OK;
3253 }
3254
3255 while (xconn->smb2.send_queue != NULL) {
3256 struct smbd_smb2_send_queue *e = xconn->smb2.send_queue;
3257 bool ok;
3258
3259 if (e->sendfile_header != NULL) {
3260 NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
3261 size_t size = 0;
3262 size_t i = 0;
3263 uint8_t *buf;
3264
3265 for (i=0; i < e->count; i++) {
3266 size += e->vector[i].iov_len;
3267 }
3268
3269 if (size <= e->sendfile_header->length) {
3270 buf = e->sendfile_header->data;
3271 } else {
3272 buf = talloc_array(e->mem_ctx, uint8_t, size);
3273 if (buf == NULL) {
3274 return NT_STATUS_NO_MEMORY;
3275 }
3276 }
3277
3278 size = 0;
3279 for (i=0; i < e->count; i++) {
3280 memcpy(buf+size,
3281 e->vector[i].iov_base,
3282 e->vector[i].iov_len);
3283 size += e->vector[i].iov_len;
3284 }
3285
3286 e->sendfile_header->data = buf;
3287 e->sendfile_header->length = size;
3288 e->sendfile_status = &status;
3289 e->count = 0;
3290
3291 xconn->smb2.send_queue_len--;
3292 DLIST_REMOVE(xconn->smb2.send_queue, e);
3293 /*
3294 * This triggers the sendfile path via
3295 * the destructor.
3296 */
3297 talloc_free(e->mem_ctx);
3298
3299 if (!NT_STATUS_IS_OK(status)) {
3300 return status;
3301 }
3302 continue;
3303 }
3304
3305 ret = writev(xconn->transport.sock, e->vector, e->count);
3306 if (ret == 0) {
3307 /* propagate end of file */
3308 return NT_STATUS_INTERNAL_ERROR;
3309 }
3310 err = socket_error_from_errno(ret, errno, &retry);
3311 if (retry) {
3312 /* retry later */
3313 TEVENT_FD_WRITEABLE(xconn->transport.fde);
3314 return NT_STATUS_OK;
3315 }
3316 if (err != 0) {
3317 return map_nt_error_from_unix_common(err);
3318 }
3319
3320 ok = iov_advance(&e->vector, &e->count, ret);
3321 if (!ok) {
3322 return NT_STATUS_INTERNAL_ERROR;
3323 }
3324
3325 if (e->count > 0) {
3326 /* we have more to write */
3327 TEVENT_FD_WRITEABLE(xconn->transport.fde);
3328 return NT_STATUS_OK;
3329 }
3330
3331 xconn->smb2.send_queue_len--;
3332 DLIST_REMOVE(xconn->smb2.send_queue, e);
3333 talloc_free(e->mem_ctx);
3334 }
3335
3336 return NT_STATUS_OK;
3337 }
3338
3339 static NTSTATUS smbd_smb2_io_handler(struct smbXsrv_connection *xconn,
3340 uint16_t fde_flags)
3341 {
3342 struct smbd_server_connection *sconn = xconn->client->sconn;
3343 struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
3344 struct smbd_smb2_request *req = NULL;
3345 size_t min_recvfile_size = UINT32_MAX;
3346 int ret;
3347 int err;
3348 bool retry;
3349 NTSTATUS status;
3350 NTTIME now;
3351
3352 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
3353 /*
3354 * we're not supposed to do any io
3355 */
3356 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3357 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3358 return NT_STATUS_OK;
3359 }
3360
3361 if (fde_flags & TEVENT_FD_WRITE) {
3362 status = smbd_smb2_flush_send_queue(xconn);
3363 if (!NT_STATUS_IS_OK(status)) {
3364 return status;
3365 }
3366 }
3367
3368 if (!(fde_flags & TEVENT_FD_READ)) {
3369 return NT_STATUS_OK;
3370 }
3371
3372 if (state->req == NULL) {
3373 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3374 return NT_STATUS_OK;
3375 }
3376
3377 again:
3378 if (!state->hdr.done) {
3379 state->hdr.done = true;
3380
3381 state->vector.iov_base = (void *)state->hdr.nbt;
3382 state->vector.iov_len = NBT_HDR_SIZE;
3383 }
3384
3385 ret = readv(xconn->transport.sock, &state->vector, 1);
3386 if (ret == 0) {
3387 /* propagate end of file */
3388 return NT_STATUS_END_OF_FILE;
3389 }
3390 err = socket_error_from_errno(ret, errno, &retry);
3391 if (retry) {
3392 /* retry later */
3393 TEVENT_FD_READABLE(xconn->transport.fde);
3394 return NT_STATUS_OK;
3395 }
3396 if (err != 0) {
3397 return map_nt_error_from_unix_common(err);
3398 }
3399
3400 if (ret < state->vector.iov_len) {
3401 uint8_t *base;
3402 base = (uint8_t *)state->vector.iov_base;
3403 base += ret;
3404 state->vector.iov_base = (void *)base;
3405 state->vector.iov_len -= ret;
3406 /* we have more to read */
3407 TEVENT_FD_READABLE(xconn->transport.fde);
3408 return NT_STATUS_OK;
3409 }
3410
3411 if (state->pktlen > 0) {
3412 if (state->doing_receivefile && !is_smb2_recvfile_write(state)) {
3413 /*
3414 * Not a possible receivefile write.
3415 * Read the rest of the data.
3416 */
3417 state->doing_receivefile = false;
3418
3419 state->pktbuf = talloc_realloc(state->req,
3420 state->pktbuf,
3421 uint8_t,
3422 state->pktfull);
3423 if (state->pktbuf == NULL) {
3424 return NT_STATUS_NO_MEMORY;
3425 }
3426
3427 state->vector.iov_base = (void *)(state->pktbuf +
3428 state->pktlen);
3429 state->vector.iov_len = (state->pktfull -
3430 state->pktlen);
3431
3432 state->pktlen = state->pktfull;
3433 goto again;
3434 }
3435
3436 /*
3437 * Either this is a receivefile write so we've
3438 * done a short read, or if not we have all the data.
3439 */
3440 goto got_full;
3441 }
3442
3443 /*
3444 * Now we analyze the NBT header
3445 */
3446 if (state->hdr.nbt[0] != 0x00) {
3447 state->min_recv_size = 0;
3448 }
3449 state->pktfull = smb2_len(state->hdr.nbt);
3450 if (state->pktfull == 0) {
3451 goto got_full;
3452 }
3453
3454 if (state->min_recv_size != 0) {
3455 min_recvfile_size = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3456 min_recvfile_size += state->min_recv_size;
3457 }
3458
3459 if (state->pktfull > min_recvfile_size) {
3460 /*
3461 * Might be a receivefile write. Read the SMB2 HEADER +
3462 * SMB2_WRITE header first. Set 'doing_receivefile'
3463 * as we're *attempting* receivefile write. If this
3464 * turns out not to be a SMB2_WRITE request or otherwise
3465 * not suitable then we'll just read the rest of the data
3466 * the next time this function is called.
3467 */
3468 state->pktlen = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3469 state->doing_receivefile = true;
3470 } else {
3471 state->pktlen = state->pktfull;
3472 }
3473
3474 state->pktbuf = talloc_array(state->req, uint8_t, state->pktlen);
3475 if (state->pktbuf == NULL) {
3476 return NT_STATUS_NO_MEMORY;
3477 }
3478
3479 state->vector.iov_base = (void *)state->pktbuf;
3480 state->vector.iov_len = state->pktlen;
3481
3482 goto again;
3483
3484 got_full:
3485
3486 if (state->hdr.nbt[0] != 0x00) {
3487 DEBUG(1,("ignore NBT[0x%02X] msg\n",
3488 state->hdr.nbt[0]));
3489
3490 req = state->req;
3491 ZERO_STRUCTP(state);
3492 state->req = req;
3493 state->min_recv_size = lp_min_receive_file_size();
3494 req = NULL;
3495 goto again;
3496 }
3497
3498 req = state->req;
3499 state->req = NULL;
3500
3501 req->request_time = timeval_current();
3502 now = timeval_to_nttime(&req->request_time);
3503
3504 status = smbd_smb2_inbuf_parse_compound(xconn,
3505 now,
3506 state->pktbuf,
3507 state->pktlen,
3508 req,
3509 &req->in.vector,
3510 &req->in.vector_count);
3511 if (!NT_STATUS_IS_OK(status)) {
3512 return status;
3513 }
3514
3515 if (state->doing_receivefile) {
3516 req->smb1req = talloc_zero(req, struct smb_request);
3517 if (req->smb1req == NULL) {
3518 return NT_STATUS_NO_MEMORY;
3519 }
3520 req->smb1req->unread_bytes = state->pktfull - state->pktlen;
3521 }
3522
3523 ZERO_STRUCTP(state);
3524
3525 req->current_idx = 1;
3526
3527 DEBUG(10,("smbd_smb2_request idx[%d] of %d vectors\n",
3528 req->current_idx, req->in.vector_count));
3529
3530 status = smbd_smb2_request_validate(req);
3531 if (!NT_STATUS_IS_OK(status)) {
3532 return status;
3533 }
3534
3535 status = smbd_smb2_request_setup_out(req);
3536 if (!NT_STATUS_IS_OK(status)) {
3537 return status;
3538 }
3539
3540 status = smbd_smb2_request_dispatch(req);
3541 if (!NT_STATUS_IS_OK(status)) {
3542 return status;
3543 }
3544
3545 sconn->num_requests++;
3546
3547 /* The timeout_processing function isn't run nearly
3548 often enough to implement 'max log size' without
3549 overrunning the size of the file by many megabytes.
3550 This is especially true if we are running at debug
3551 level 10. Checking every 50 SMB2s is a nice
3552 tradeoff of performance vs log file size overrun. */
3553
3554 if ((sconn->num_requests % 50) == 0 &&
3555 need_to_check_log_size()) {
3556 change_to_root_user();
3557 check_log_size();
3558 }
3559
3560 status = smbd_smb2_request_next_incoming(xconn);
3561 if (!NT_STATUS_IS_OK(status)) {
3562 return status;
3563 }
3564
3565 return NT_STATUS_OK;
3566 }
3567
3568 static void smbd_smb2_connection_handler(struct tevent_context *ev,
3569 struct tevent_fd *fde,
3570 uint16_t flags,
3571 void *private_data)
3572 {
3573 struct smbXsrv_connection *xconn =
3574 talloc_get_type_abort(private_data,
3575 struct smbXsrv_connection);
3576 NTSTATUS status;
3577
3578 status = smbd_smb2_io_handler(xconn, flags);
3579 if (!NT_STATUS_IS_OK(status)) {
3580 smbd_server_connection_terminate(xconn, nt_errstr(status));
3581 return;
3582 }
3583 }
Samba GIT mirror