?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: smbd: Make extract_snapshot_token() a wrapper for extract_snapshot_token_internal().
[Samba.git] / source3 / smbd / smbXsrv_session.c
blobcf09b56803a11abd2fb10c6d6f2e01748fa35379
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2011-2012
5 Copyright (C) Michael Adam 2012
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "system/filesys.h"
23 #include <tevent.h>
24 #include "lib/util/server_id.h"
25 #include "smbd/smbd.h"
26 #include "smbd/globals.h"
27 #include "dbwrap/dbwrap.h"
28 #include "dbwrap/dbwrap_rbt.h"
29 #include "dbwrap/dbwrap_open.h"
30 #include "dbwrap/dbwrap_watch.h"
31 #include "session.h"
32 #include "auth.h"
33 #include "auth/gensec/gensec.h"
34 #include "../lib/tsocket/tsocket.h"
35 #include "../libcli/security/security.h"
36 #include "messages.h"
37 #include "lib/util/util_tdb.h"
38 #include "librpc/gen_ndr/ndr_smbXsrv.h"
39 #include "serverid.h"
40 #include "lib/util/tevent_ntstatus.h"
41 #include "lib/global_contexts.h"
42
43 struct smbXsrv_session_table {
44 struct {
45 struct db_context *db_ctx;
46 uint32_t lowest_id;
47 uint32_t highest_id;
48 uint32_t max_sessions;
49 uint32_t num_sessions;
50 } local;
51 struct {
52 struct db_context *db_ctx;
53 } global;
54 };
55
56 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
57
58 NTSTATUS smbXsrv_session_global_init(struct messaging_context *msg_ctx)
59 {
60 char *global_path = NULL;
61 struct db_context *backend = NULL;
62 struct db_context *db_ctx = NULL;
63
64 if (smbXsrv_session_global_db_ctx != NULL) {
65 return NT_STATUS_OK;
66 }
67
68 /*
69 * This contains secret information like session keys!
70 */
71 global_path = lock_path(talloc_tos(), "smbXsrv_session_global.tdb");
72 if (global_path == NULL) {
73 return NT_STATUS_NO_MEMORY;
74 }
75
76 backend = db_open(NULL, global_path,
77 0, /* hash_size */
78 TDB_DEFAULT |
79 TDB_CLEAR_IF_FIRST |
80 TDB_VOLATILE |
81 TDB_INCOMPATIBLE_HASH,
82 O_RDWR | O_CREAT, 0600,
83 DBWRAP_LOCK_ORDER_1,
84 DBWRAP_FLAG_NONE);
85 TALLOC_FREE(global_path);
86 if (backend == NULL) {
87 NTSTATUS status;
88
89 status = map_nt_error_from_unix_common(errno);
90
91 return status;
92 }
93
94 db_ctx = db_open_watched(NULL, &backend, global_messaging_context());
95 if (db_ctx == NULL) {
96 TALLOC_FREE(backend);
97 return NT_STATUS_NO_MEMORY;
98 }
99
100 smbXsrv_session_global_db_ctx = db_ctx;
101
102 return NT_STATUS_OK;
103 }
104
105 /*
106 * NOTE:
107 * We need to store the keys in big endian so that dbwrap_rbt's memcmp
108 * has the same result as integer comparison between the uint32_t
109 * values.
110 *
111 * TODO: implement string based key
112 */
113
114 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
115
116 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
117 uint8_t *key_buf)
118 {
119 TDB_DATA key;
120
121 RSIVAL(key_buf, 0, id);
122
123 key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
124
125 return key;
126 }
127
128 #if 0
129 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
130 {
131 if (id == NULL) {
132 return NT_STATUS_INVALID_PARAMETER;
133 }
134
135 if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
136 return NT_STATUS_INTERNAL_DB_CORRUPTION;
137 }
138
139 *id = RIVAL(key.dptr, 0);
140
141 return NT_STATUS_OK;
142 }
143 #endif
144
145 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
146
147 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
148 uint8_t *key_buf)
149 {
150 TDB_DATA key;
151
152 RSIVAL(key_buf, 0, id);
153
154 key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
155
156 return key;
157 }
158
159 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
160 {
161 if (id == NULL) {
162 return NT_STATUS_INVALID_PARAMETER;
163 }
164
165 if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
166 return NT_STATUS_INTERNAL_DB_CORRUPTION;
167 }
168
169 *id = RIVAL(key.dptr, 0);
170
171 return NT_STATUS_OK;
172 }
173
174 static struct db_record *smbXsrv_session_global_fetch_locked(
175 struct db_context *db,
176 uint32_t id,
177 TALLOC_CTX *mem_ctx)
178 {
179 TDB_DATA key;
180 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
181 struct db_record *rec = NULL;
182
183 key = smbXsrv_session_global_id_to_key(id, key_buf);
184
185 rec = dbwrap_fetch_locked(db, mem_ctx, key);
186
187 if (rec == NULL) {
188 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
189 hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
190 }
191
192 return rec;
193 }
194
195 static struct db_record *smbXsrv_session_local_fetch_locked(
196 struct db_context *db,
197 uint32_t id,
198 TALLOC_CTX *mem_ctx)
199 {
200 TDB_DATA key;
201 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
202 struct db_record *rec = NULL;
203
204 key = smbXsrv_session_local_id_to_key(id, key_buf);
205
206 rec = dbwrap_fetch_locked(db, mem_ctx, key);
207
208 if (rec == NULL) {
209 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
210 hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
211 }
212
213 return rec;
214 }
215
216 static void smbXsrv_session_close_loop(struct tevent_req *subreq);
217
218 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
219 uint32_t lowest_id,
220 uint32_t highest_id,
221 uint32_t max_sessions)
222 {
223 struct smbXsrv_client *client = conn->client;
224 struct smbXsrv_session_table *table;
225 NTSTATUS status;
226 struct tevent_req *subreq;
227 uint64_t max_range;
228
229 if (lowest_id > highest_id) {
230 return NT_STATUS_INTERNAL_ERROR;
231 }
232
233 max_range = highest_id;
234 max_range -= lowest_id;
235 max_range += 1;
236
237 if (max_sessions > max_range) {
238 return NT_STATUS_INTERNAL_ERROR;
239 }
240
241 table = talloc_zero(client, struct smbXsrv_session_table);
242 if (table == NULL) {
243 return NT_STATUS_NO_MEMORY;
244 }
245
246 table->local.db_ctx = db_open_rbt(table);
247 if (table->local.db_ctx == NULL) {
248 TALLOC_FREE(table);
249 return NT_STATUS_NO_MEMORY;
250 }
251 table->local.lowest_id = lowest_id;
252 table->local.highest_id = highest_id;
253 table->local.max_sessions = max_sessions;
254
255 status = smbXsrv_session_global_init(client->msg_ctx);
256 if (!NT_STATUS_IS_OK(status)) {
257 TALLOC_FREE(table);
258 return status;
259 }
260
261 table->global.db_ctx = smbXsrv_session_global_db_ctx;
262
263 subreq = messaging_read_send(table,
264 client->raw_ev_ctx,
265 client->msg_ctx,
266 MSG_SMBXSRV_SESSION_CLOSE);
267 if (subreq == NULL) {
268 TALLOC_FREE(table);
269 return NT_STATUS_NO_MEMORY;
270 }
271 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
272
273 client->session_table = table;
274 return NT_STATUS_OK;
275 }
276
277 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
278
279 static void smbXsrv_session_close_loop(struct tevent_req *subreq)
280 {
281 struct smbXsrv_client *client =
282 tevent_req_callback_data(subreq,
283 struct smbXsrv_client);
284 struct smbXsrv_session_table *table = client->session_table;
285 int ret;
286 struct messaging_rec *rec = NULL;
287 struct smbXsrv_session_closeB close_blob;
288 enum ndr_err_code ndr_err;
289 struct smbXsrv_session_close0 *close_info0 = NULL;
290 struct smbXsrv_session *session = NULL;
291 NTSTATUS status;
292 struct timeval tv = timeval_current();
293 NTTIME now = timeval_to_nttime(&tv);
294
295 ret = messaging_read_recv(subreq, talloc_tos(), &rec);
296 TALLOC_FREE(subreq);
297 if (ret != 0) {
298 goto next;
299 }
300
301 ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
302 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
303 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
304 status = ndr_map_error2ntstatus(ndr_err);
305 DEBUG(1,("smbXsrv_session_close_loop: "
306 "ndr_pull_struct_blob - %s\n",
307 nt_errstr(status)));
308 goto next;
309 }
310
311 DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
312 if (DEBUGLVL(10)) {
313 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
314 }
315
316 if (close_blob.version != SMBXSRV_VERSION_0) {
317 DEBUG(0,("smbXsrv_session_close_loop: "
318 "ignore invalid version %u\n", close_blob.version));
319 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
320 goto next;
321 }
322
323 close_info0 = close_blob.info.info0;
324 if (close_info0 == NULL) {
325 DEBUG(0,("smbXsrv_session_close_loop: "
326 "ignore NULL info %u\n", close_blob.version));
327 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
328 goto next;
329 }
330
331 status = smb2srv_session_lookup_client(client,
332 close_info0->old_session_wire_id,
333 now, &session);
334 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
335 DEBUG(4,("smbXsrv_session_close_loop: "
336 "old_session_wire_id %llu not found\n",
337 (unsigned long long)close_info0->old_session_wire_id));
338 if (DEBUGLVL(4)) {
339 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
340 }
341 goto next;
342 }
343 if (!NT_STATUS_IS_OK(status) &&
344 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
345 !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
346 DEBUG(1,("smbXsrv_session_close_loop: "
347 "old_session_wire_id %llu - %s\n",
348 (unsigned long long)close_info0->old_session_wire_id,
349 nt_errstr(status)));
350 if (DEBUGLVL(1)) {
351 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
352 }
353 goto next;
354 }
355
356 if (session->global->session_global_id != close_info0->old_session_global_id) {
357 DEBUG(1,("smbXsrv_session_close_loop: "
358 "old_session_wire_id %llu - global %u != %u\n",
359 (unsigned long long)close_info0->old_session_wire_id,
360 session->global->session_global_id,
361 close_info0->old_session_global_id));
362 if (DEBUGLVL(1)) {
363 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
364 }
365 goto next;
366 }
367
368 if (session->global->creation_time != close_info0->old_creation_time) {
369 DEBUG(1,("smbXsrv_session_close_loop: "
370 "old_session_wire_id %llu - "
371 "creation %s (%llu) != %s (%llu)\n",
372 (unsigned long long)close_info0->old_session_wire_id,
373 nt_time_string(rec, session->global->creation_time),
374 (unsigned long long)session->global->creation_time,
375 nt_time_string(rec, close_info0->old_creation_time),
376 (unsigned long long)close_info0->old_creation_time));
377 if (DEBUGLVL(1)) {
378 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
379 }
380 goto next;
381 }
382
383 subreq = smb2srv_session_shutdown_send(session, client->raw_ev_ctx,
384 session, NULL);
385 if (subreq == NULL) {
386 status = NT_STATUS_NO_MEMORY;
387 DEBUG(0, ("smbXsrv_session_close_loop: "
388 "smb2srv_session_shutdown_send(%llu) failed: %s\n",
389 (unsigned long long)session->global->session_wire_id,
390 nt_errstr(status)));
391 if (DEBUGLVL(1)) {
392 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
393 }
394 goto next;
395 }
396 tevent_req_set_callback(subreq,
397 smbXsrv_session_close_shutdown_done,
398 session);
399
400 next:
401 TALLOC_FREE(rec);
402
403 subreq = messaging_read_send(table,
404 client->raw_ev_ctx,
405 client->msg_ctx,
406 MSG_SMBXSRV_SESSION_CLOSE);
407 if (subreq == NULL) {
408 const char *r;
409 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
410 exit_server_cleanly(r);
411 return;
412 }
413 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
414 }
415
416 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
417 {
418 struct smbXsrv_session *session =
419 tevent_req_callback_data(subreq,
420 struct smbXsrv_session);
421 NTSTATUS status;
422
423 status = smb2srv_session_shutdown_recv(subreq);
424 TALLOC_FREE(subreq);
425 if (!NT_STATUS_IS_OK(status)) {
426 DEBUG(0, ("smbXsrv_session_close_loop: "
427 "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
428 (unsigned long long)session->global->session_wire_id,
429 nt_errstr(status)));
430 }
431
432 status = smbXsrv_session_logoff(session);
433 if (!NT_STATUS_IS_OK(status)) {
434 DEBUG(0, ("smbXsrv_session_close_loop: "
435 "smbXsrv_session_logoff(%llu) failed: %s\n",
436 (unsigned long long)session->global->session_wire_id,
437 nt_errstr(status)));
438 }
439
440 TALLOC_FREE(session);
441 }
442
443 struct smb1srv_session_local_allocate_state {
444 const uint32_t lowest_id;
445 const uint32_t highest_id;
446 uint32_t last_id;
447 uint32_t useable_id;
448 NTSTATUS status;
449 };
450
451 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
452 void *private_data)
453 {
454 struct smb1srv_session_local_allocate_state *state =
455 (struct smb1srv_session_local_allocate_state *)private_data;
456 TDB_DATA key = dbwrap_record_get_key(rec);
457 uint32_t id = 0;
458 NTSTATUS status;
459
460 status = smbXsrv_session_local_key_to_id(key, &id);
461 if (!NT_STATUS_IS_OK(status)) {
462 state->status = status;
463 return -1;
464 }
465
466 if (id <= state->last_id) {
467 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
468 return -1;
469 }
470 state->last_id = id;
471
472 if (id > state->useable_id) {
473 state->status = NT_STATUS_OK;
474 return -1;
475 }
476
477 if (state->useable_id == state->highest_id) {
478 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
479 return -1;
480 }
481
482 state->useable_id +=1;
483 return 0;
484 }
485
486 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
487 uint32_t lowest_id,
488 uint32_t highest_id,
489 TALLOC_CTX *mem_ctx,
490 struct db_record **_rec,
491 uint32_t *_id)
492 {
493 struct smb1srv_session_local_allocate_state state = {
494 .lowest_id = lowest_id,
495 .highest_id = highest_id,
496 .last_id = 0,
497 .useable_id = lowest_id,
498 .status = NT_STATUS_INTERNAL_ERROR,
499 };
500 uint32_t i;
501 uint32_t range;
502 NTSTATUS status;
503 int count = 0;
504
505 *_rec = NULL;
506 *_id = 0;
507
508 if (lowest_id > highest_id) {
509 return NT_STATUS_INSUFFICIENT_RESOURCES;
510 }
511
512 /*
513 * first we try randomly
514 */
515 range = (highest_id - lowest_id) + 1;
516
517 for (i = 0; i < (range / 2); i++) {
518 uint32_t id;
519 TDB_DATA val;
520 struct db_record *rec = NULL;
521
522 id = generate_random() % range;
523 id += lowest_id;
524
525 if (id < lowest_id) {
526 id = lowest_id;
527 }
528 if (id > highest_id) {
529 id = highest_id;
530 }
531
532 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
533 if (rec == NULL) {
534 return NT_STATUS_INSUFFICIENT_RESOURCES;
535 }
536
537 val = dbwrap_record_get_value(rec);
538 if (val.dsize != 0) {
539 TALLOC_FREE(rec);
540 continue;
541 }
542
543 *_rec = rec;
544 *_id = id;
545 return NT_STATUS_OK;
546 }
547
548 /*
549 * if the range is almost full,
550 * we traverse the whole table
551 * (this relies on sorted behavior of dbwrap_rbt)
552 */
553 status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
554 &state, &count);
555 if (NT_STATUS_IS_OK(status)) {
556 if (NT_STATUS_IS_OK(state.status)) {
557 return NT_STATUS_INTERNAL_ERROR;
558 }
559
560 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
561 return state.status;
562 }
563
564 if (state.useable_id <= state.highest_id) {
565 state.status = NT_STATUS_OK;
566 } else {
567 return NT_STATUS_INSUFFICIENT_RESOURCES;
568 }
569 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
570 /*
571 * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
572 *
573 * If we get anything else it is an error, because it
574 * means we did not manage to find a free slot in
575 * the db.
576 */
577 return NT_STATUS_INSUFFICIENT_RESOURCES;
578 }
579
580 if (NT_STATUS_IS_OK(state.status)) {
581 uint32_t id;
582 TDB_DATA val;
583 struct db_record *rec = NULL;
584
585 id = state.useable_id;
586
587 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
588 if (rec == NULL) {
589 return NT_STATUS_INSUFFICIENT_RESOURCES;
590 }
591
592 val = dbwrap_record_get_value(rec);
593 if (val.dsize != 0) {
594 TALLOC_FREE(rec);
595 return NT_STATUS_INTERNAL_DB_CORRUPTION;
596 }
597
598 *_rec = rec;
599 *_id = id;
600 return NT_STATUS_OK;
601 }
602
603 return state.status;
604 }
605
606 struct smbXsrv_session_local_fetch_state {
607 struct smbXsrv_session *session;
608 NTSTATUS status;
609 };
610
611 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
612 void *private_data)
613 {
614 struct smbXsrv_session_local_fetch_state *state =
615 (struct smbXsrv_session_local_fetch_state *)private_data;
616 void *ptr;
617
618 if (data.dsize != sizeof(ptr)) {
619 state->status = NT_STATUS_INTERNAL_DB_ERROR;
620 return;
621 }
622
623 memcpy(&ptr, data.dptr, data.dsize);
624 state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
625 state->status = NT_STATUS_OK;
626 }
627
628 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
629 /* conn: optional */
630 struct smbXsrv_connection *conn,
631 uint32_t session_local_id,
632 NTTIME now,
633 struct smbXsrv_session **_session)
634 {
635 struct smbXsrv_session_local_fetch_state state = {
636 .session = NULL,
637 .status = NT_STATUS_INTERNAL_ERROR,
638 };
639 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
640 TDB_DATA key;
641 NTSTATUS status;
642
643 *_session = NULL;
644
645 if (session_local_id == 0) {
646 return NT_STATUS_USER_SESSION_DELETED;
647 }
648
649 if (table == NULL) {
650 /* this might happen before the end of negprot */
651 return NT_STATUS_USER_SESSION_DELETED;
652 }
653
654 if (table->local.db_ctx == NULL) {
655 return NT_STATUS_INTERNAL_ERROR;
656 }
657
658 key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
659
660 status = dbwrap_parse_record(table->local.db_ctx, key,
661 smbXsrv_session_local_fetch_parser,
662 &state);
663 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
664 return NT_STATUS_USER_SESSION_DELETED;
665 } else if (!NT_STATUS_IS_OK(status)) {
666 return status;
667 }
668 if (!NT_STATUS_IS_OK(state.status)) {
669 return state.status;
670 }
671
672 if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
673 return NT_STATUS_USER_SESSION_DELETED;
674 }
675
676 /*
677 * If a connection is specified check if the session is
678 * valid on the channel.
679 */
680 if (conn != NULL) {
681 struct smbXsrv_channel_global0 *c = NULL;
682
683 status = smbXsrv_session_find_channel(state.session, conn, &c);
684 if (!NT_STATUS_IS_OK(status)) {
685 return status;
686 }
687 }
688
689 state.session->idle_time = now;
690
691 if (!NT_STATUS_IS_OK(state.session->status)) {
692 *_session = state.session;
693 return state.session->status;
694 }
695
696 if (now > state.session->global->expiration_time) {
697 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
698 }
699
700 *_session = state.session;
701 return state.session->status;
702 }
703
704 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
705 {
706 return 0;
707 }
708
709 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
710 bool *is_free,
711 bool *was_free,
712 TALLOC_CTX *mem_ctx,
713 struct smbXsrv_session_global0 **_g,
714 uint32_t *pseqnum);
715
716 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
717 TALLOC_CTX *mem_ctx,
718 struct smbXsrv_session_global0 **_global)
719 {
720 uint32_t i;
721 struct smbXsrv_session_global0 *global = NULL;
722 uint32_t last_free = 0;
723 const uint32_t min_tries = 3;
724
725 *_global = NULL;
726
727 global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
728 if (global == NULL) {
729 return NT_STATUS_NO_MEMORY;
730 }
731 talloc_set_destructor(global, smbXsrv_session_global_destructor);
732
733 /*
734 * Here we just randomly try the whole 32-bit space
735 *
736 * We use just 32-bit, because we want to reuse the
737 * ID for SRVSVC.
738 */
739 for (i = 0; i < UINT32_MAX; i++) {
740 bool is_free = false;
741 bool was_free = false;
742 uint32_t id;
743
744 if (i >= min_tries && last_free != 0) {
745 id = last_free;
746 } else {
747 id = generate_random();
748 }
749 if (id == 0) {
750 id++;
751 }
752 if (id == UINT32_MAX) {
753 id--;
754 }
755
756 global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
757 mem_ctx);
758 if (global->db_rec == NULL) {
759 talloc_free(global);
760 return NT_STATUS_INSUFFICIENT_RESOURCES;
761 }
762
763 smbXsrv_session_global_verify_record(global->db_rec,
764 &is_free,
765 &was_free,
766 NULL, NULL, NULL);
767
768 if (!is_free) {
769 TALLOC_FREE(global->db_rec);
770 continue;
771 }
772
773 if (!was_free && i < min_tries) {
774 /*
775 * The session_id is free now,
776 * but was not free before.
777 *
778 * This happens if a smbd crashed
779 * and did not cleanup the record.
780 *
781 * If this is one of our first tries,
782 * then we try to find a real free one.
783 */
784 if (last_free == 0) {
785 last_free = id;
786 }
787 TALLOC_FREE(global->db_rec);
788 continue;
789 }
790
791 global->session_global_id = id;
792
793 *_global = global;
794 return NT_STATUS_OK;
795 }
796
797 /* should not be reached */
798 talloc_free(global);
799 return NT_STATUS_INTERNAL_ERROR;
800 }
801
802 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
803 bool *is_free,
804 bool *was_free,
805 TALLOC_CTX *mem_ctx,
806 struct smbXsrv_session_global0 **_g,
807 uint32_t *pseqnum)
808 {
809 TDB_DATA key;
810 TDB_DATA val;
811 DATA_BLOB blob;
812 struct smbXsrv_session_globalB global_blob;
813 enum ndr_err_code ndr_err;
814 struct smbXsrv_session_global0 *global = NULL;
815 bool exists;
816 TALLOC_CTX *frame = talloc_stackframe();
817
818 *is_free = false;
819
820 if (was_free) {
821 *was_free = false;
822 }
823 if (_g) {
824 *_g = NULL;
825 }
826 if (pseqnum) {
827 *pseqnum = 0;
828 }
829
830 key = dbwrap_record_get_key(db_rec);
831
832 val = dbwrap_record_get_value(db_rec);
833 if (val.dsize == 0) {
834 TALLOC_FREE(frame);
835 *is_free = true;
836 if (was_free) {
837 *was_free = true;
838 }
839 return;
840 }
841
842 blob = data_blob_const(val.dptr, val.dsize);
843
844 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
845 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
846 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
847 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
848 DEBUG(1,("smbXsrv_session_global_verify_record: "
849 "key '%s' ndr_pull_struct_blob - %s\n",
850 hex_encode_talloc(frame, key.dptr, key.dsize),
851 nt_errstr(status)));
852 TALLOC_FREE(frame);
853 *is_free = true;
854 if (was_free) {
855 *was_free = true;
856 }
857 return;
858 }
859
860 DEBUG(10,("smbXsrv_session_global_verify_record\n"));
861 if (DEBUGLVL(10)) {
862 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
863 }
864
865 if (global_blob.version != SMBXSRV_VERSION_0) {
866 DEBUG(0,("smbXsrv_session_global_verify_record: "
867 "key '%s' use unsupported version %u\n",
868 hex_encode_talloc(frame, key.dptr, key.dsize),
869 global_blob.version));
870 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
871 TALLOC_FREE(frame);
872 *is_free = true;
873 if (was_free) {
874 *was_free = true;
875 }
876 return;
877 }
878
879 global = global_blob.info.info0;
880
881 #define __BLOB_KEEP_SECRET(__blob) do { \
882 if ((__blob).length != 0) { \
883 talloc_keep_secret((__blob).data); \
884 } \
885 } while(0)
886 {
887 uint32_t i;
888 __BLOB_KEEP_SECRET(global->application_key_blob);
889 __BLOB_KEEP_SECRET(global->signing_key_blob);
890 __BLOB_KEEP_SECRET(global->encryption_key_blob);
891 __BLOB_KEEP_SECRET(global->decryption_key_blob);
892 for (i = 0; i < global->num_channels; i++) {
893 __BLOB_KEEP_SECRET(global->channels[i].signing_key_blob);
894 }
895 }
896 #undef __BLOB_KEEP_SECRET
897
898 exists = serverid_exists(&global->channels[0].server_id);
899 if (!exists) {
900 struct server_id_buf idbuf;
901 DEBUG(2,("smbXsrv_session_global_verify_record: "
902 "key '%s' server_id %s does not exist.\n",
903 hex_encode_talloc(frame, key.dptr, key.dsize),
904 server_id_str_buf(global->channels[0].server_id,
905 &idbuf)));
906 if (DEBUGLVL(2)) {
907 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
908 }
909 TALLOC_FREE(frame);
910 dbwrap_record_delete(db_rec);
911 *is_free = true;
912 return;
913 }
914
915 if (_g) {
916 *_g = talloc_move(mem_ctx, &global);
917 }
918 if (pseqnum) {
919 *pseqnum = global_blob.seqnum;
920 }
921 TALLOC_FREE(frame);
922 }
923
924 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
925 {
926 struct smbXsrv_session_globalB global_blob;
927 DATA_BLOB blob = data_blob_null;
928 TDB_DATA key;
929 TDB_DATA val;
930 NTSTATUS status;
931 enum ndr_err_code ndr_err;
932
933 /*
934 * TODO: if we use other versions than '0'
935 * we would add glue code here, that would be able to
936 * store the information in the old format.
937 */
938
939 if (global->db_rec == NULL) {
940 return NT_STATUS_INTERNAL_ERROR;
941 }
942
943 key = dbwrap_record_get_key(global->db_rec);
944 val = dbwrap_record_get_value(global->db_rec);
945
946 ZERO_STRUCT(global_blob);
947 global_blob.version = smbXsrv_version_global_current();
948 if (val.dsize >= 8) {
949 global_blob.seqnum = IVAL(val.dptr, 4);
950 }
951 global_blob.seqnum += 1;
952 global_blob.info.info0 = global;
953
954 ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
955 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
956 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
957 status = ndr_map_error2ntstatus(ndr_err);
958 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
959 hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
960 nt_errstr(status)));
961 TALLOC_FREE(global->db_rec);
962 return status;
963 }
964
965 val = make_tdb_data(blob.data, blob.length);
966 status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
967 if (!NT_STATUS_IS_OK(status)) {
968 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
969 hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
970 nt_errstr(status)));
971 TALLOC_FREE(global->db_rec);
972 return status;
973 }
974
975 if (DEBUGLVL(10)) {
976 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
977 hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
978 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
979 }
980
981 TALLOC_FREE(global->db_rec);
982
983 return NT_STATUS_OK;
984 }
985
986 struct smb2srv_session_close_previous_state {
987 struct tevent_context *ev;
988 struct smbXsrv_connection *connection;
989 struct dom_sid *current_sid;
990 uint64_t previous_session_id;
991 uint64_t current_session_id;
992 struct db_record *db_rec;
993 uint64_t watch_instance;
994 uint32_t last_seqnum;
995 };
996
997 static void smb2srv_session_close_previous_cleanup(struct tevent_req *req,
998 enum tevent_req_state req_state)
999 {
1000 struct smb2srv_session_close_previous_state *state =
1001 tevent_req_data(req,
1002 struct smb2srv_session_close_previous_state);
1003
1004 if (state->db_rec != NULL) {
1005 dbwrap_watched_watch_remove_instance(state->db_rec,
1006 state->watch_instance);
1007 state->watch_instance = 0;
1008 TALLOC_FREE(state->db_rec);
1009 }
1010 }
1011
1012 static void smb2srv_session_close_previous_check(struct tevent_req *req);
1013 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
1014
1015 struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
1016 struct tevent_context *ev,
1017 struct smbXsrv_connection *conn,
1018 struct auth_session_info *session_info,
1019 uint64_t previous_session_id,
1020 uint64_t current_session_id)
1021 {
1022 struct tevent_req *req;
1023 struct smb2srv_session_close_previous_state *state;
1024 uint32_t global_id = previous_session_id & UINT32_MAX;
1025 uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
1026 struct smbXsrv_session_table *table = conn->client->session_table;
1027 struct security_token *current_token = NULL;
1028
1029 req = tevent_req_create(mem_ctx, &state,
1030 struct smb2srv_session_close_previous_state);
1031 if (req == NULL) {
1032 return NULL;
1033 }
1034 state->ev = ev;
1035 state->connection = conn;
1036 state->previous_session_id = previous_session_id;
1037 state->current_session_id = current_session_id;
1038
1039 tevent_req_set_cleanup_fn(req, smb2srv_session_close_previous_cleanup);
1040
1041 if (global_zeros != 0) {
1042 tevent_req_done(req);
1043 return tevent_req_post(req, ev);
1044 }
1045
1046 if (session_info == NULL) {
1047 tevent_req_done(req);
1048 return tevent_req_post(req, ev);
1049 }
1050 current_token = session_info->security_token;
1051
1052 if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
1053 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
1054 }
1055
1056 if (state->current_sid == NULL) {
1057 tevent_req_done(req);
1058 return tevent_req_post(req, ev);
1059 }
1060
1061 if (!security_token_has_nt_authenticated_users(current_token)) {
1062 /* TODO */
1063 tevent_req_done(req);
1064 return tevent_req_post(req, ev);
1065 }
1066
1067 state->db_rec = smbXsrv_session_global_fetch_locked(
1068 table->global.db_ctx,
1069 global_id,
1070 state /* TALLOC_CTX */);
1071 if (state->db_rec == NULL) {
1072 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1073 return tevent_req_post(req, ev);
1074 }
1075
1076 smb2srv_session_close_previous_check(req);
1077 if (!tevent_req_is_in_progress(req)) {
1078 return tevent_req_post(req, ev);
1079 }
1080
1081 return req;
1082 }
1083
1084 static void smb2srv_session_close_previous_check(struct tevent_req *req)
1085 {
1086 struct smb2srv_session_close_previous_state *state =
1087 tevent_req_data(req,
1088 struct smb2srv_session_close_previous_state);
1089 struct smbXsrv_connection *conn = state->connection;
1090 DATA_BLOB blob;
1091 struct security_token *previous_token = NULL;
1092 struct smbXsrv_session_global0 *global = NULL;
1093 enum ndr_err_code ndr_err;
1094 struct smbXsrv_session_close0 close_info0;
1095 struct smbXsrv_session_closeB close_blob;
1096 struct tevent_req *subreq = NULL;
1097 NTSTATUS status;
1098 bool is_free = false;
1099 uint32_t seqnum = 0;
1100
1101 smbXsrv_session_global_verify_record(state->db_rec,
1102 &is_free,
1103 NULL,
1104 state,
1105 &global,
1106 &seqnum);
1107
1108 if (is_free) {
1109 tevent_req_done(req);
1110 return;
1111 }
1112
1113 if (global->auth_session_info == NULL) {
1114 tevent_req_done(req);
1115 return;
1116 }
1117
1118 previous_token = global->auth_session_info->security_token;
1119
1120 if (!security_token_is_sid(previous_token, state->current_sid)) {
1121 tevent_req_done(req);
1122 return;
1123 }
1124
1125 /*
1126 * If the record changed, but we are not happy with the change yet,
1127 * we better remove ourself from the waiter list
1128 * (most likely the first position)
1129 * and re-add us at the end of the list.
1130 *
1131 * This gives other waiters a change
1132 * to make progress.
1133 *
1134 * Otherwise we'll keep our waiter instance alive,
1135 * keep waiting (most likely at first position).
1136 * It means the order of watchers stays fair.
1137 */
1138 if (state->last_seqnum != seqnum) {
1139 state->last_seqnum = seqnum;
1140 dbwrap_watched_watch_remove_instance(state->db_rec,
1141 state->watch_instance);
1142 state->watch_instance =
1143 dbwrap_watched_watch_add_instance(state->db_rec);
1144 }
1145
1146 subreq = dbwrap_watched_watch_send(state, state->ev, state->db_rec,
1147 state->watch_instance,
1148 (struct server_id){0});
1149 if (tevent_req_nomem(subreq, req)) {
1150 return;
1151 }
1152 tevent_req_set_callback(subreq,
1153 smb2srv_session_close_previous_modified,
1154 req);
1155
1156 close_info0.old_session_global_id = global->session_global_id;
1157 close_info0.old_session_wire_id = global->session_wire_id;
1158 close_info0.old_creation_time = global->creation_time;
1159 close_info0.new_session_wire_id = state->current_session_id;
1160
1161 ZERO_STRUCT(close_blob);
1162 close_blob.version = smbXsrv_version_global_current();
1163 close_blob.info.info0 = &close_info0;
1164
1165 ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1166 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1167 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1168 status = ndr_map_error2ntstatus(ndr_err);
1169 DEBUG(1,("smb2srv_session_close_previous_check: "
1170 "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1171 (unsigned long long)close_info0.old_session_wire_id,
1172 (unsigned long long)close_info0.new_session_wire_id,
1173 nt_errstr(status)));
1174 tevent_req_nterror(req, status);
1175 return;
1176 }
1177
1178 status = messaging_send(conn->client->msg_ctx,
1179 global->channels[0].server_id,
1180 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1181 TALLOC_FREE(global);
1182 if (tevent_req_nterror(req, status)) {
1183 return;
1184 }
1185
1186 TALLOC_FREE(state->db_rec);
1187 return;
1188 }
1189
1190 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1191 {
1192 struct tevent_req *req =
1193 tevent_req_callback_data(subreq,
1194 struct tevent_req);
1195 struct smb2srv_session_close_previous_state *state =
1196 tevent_req_data(req,
1197 struct smb2srv_session_close_previous_state);
1198 uint32_t global_id;
1199 NTSTATUS status;
1200 uint64_t instance = 0;
1201
1202 status = dbwrap_watched_watch_recv(subreq, &instance, NULL, NULL);
1203 TALLOC_FREE(subreq);
1204 if (tevent_req_nterror(req, status)) {
1205 return;
1206 }
1207
1208 state->watch_instance = instance;
1209
1210 global_id = state->previous_session_id & UINT32_MAX;
1211
1212 state->db_rec = smbXsrv_session_global_fetch_locked(
1213 state->connection->client->session_table->global.db_ctx,
1214 global_id, state /* TALLOC_CTX */);
1215 if (state->db_rec == NULL) {
1216 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1217 return;
1218 }
1219
1220 smb2srv_session_close_previous_check(req);
1221 }
1222
1223 NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1224 {
1225 NTSTATUS status;
1226
1227 if (tevent_req_is_nterror(req, &status)) {
1228 tevent_req_received(req);
1229 return status;
1230 }
1231
1232 tevent_req_received(req);
1233 return NT_STATUS_OK;
1234 }
1235
1236 static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1237 {
1238 NTSTATUS status;
1239 struct smbXsrv_connection *xconn = NULL;
1240
1241 if (session->client != NULL) {
1242 xconn = session->client->connections;
1243 }
1244
1245 for (; xconn != NULL; xconn = xconn->next) {
1246 struct smbd_smb2_request *preq;
1247
1248 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1249 if (preq->session != session) {
1250 continue;
1251 }
1252
1253 preq->session = NULL;
1254 /*
1255 * If we no longer have a session we can't
1256 * sign or encrypt replies.
1257 */
1258 preq->do_signing = false;
1259 preq->do_encryption = false;
1260 preq->preauth = NULL;
1261 }
1262 }
1263
1264 status = smbXsrv_session_logoff(session);
1265 return status;
1266 }
1267
1268 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1269 {
1270 NTSTATUS status;
1271
1272 DBG_DEBUG("destructing session(%llu)\n",
1273 (unsigned long long)session->global->session_wire_id);
1274
1275 status = smbXsrv_session_clear_and_logoff(session);
1276 if (!NT_STATUS_IS_OK(status)) {
1277 DEBUG(0, ("smbXsrv_session_destructor: "
1278 "smbXsrv_session_logoff() failed: %s\n",
1279 nt_errstr(status)));
1280 }
1281
1282 TALLOC_FREE(session->global);
1283
1284 return 0;
1285 }
1286
1287 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1288 NTTIME now,
1289 struct smbXsrv_session **_session)
1290 {
1291 struct smbXsrv_session_table *table = conn->client->session_table;
1292 struct db_record *local_rec = NULL;
1293 struct smbXsrv_session *session = NULL;
1294 void *ptr = NULL;
1295 TDB_DATA val;
1296 struct smbXsrv_session_global0 *global = NULL;
1297 struct smbXsrv_channel_global0 *channel = NULL;
1298 NTSTATUS status;
1299
1300 if (table->local.num_sessions >= table->local.max_sessions) {
1301 return NT_STATUS_INSUFFICIENT_RESOURCES;
1302 }
1303
1304 session = talloc_zero(table, struct smbXsrv_session);
1305 if (session == NULL) {
1306 return NT_STATUS_NO_MEMORY;
1307 }
1308 session->table = table;
1309 session->idle_time = now;
1310 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1311 session->client = conn->client;
1312 session->homes_snum = -1;
1313
1314 status = smbXsrv_session_global_allocate(table->global.db_ctx,
1315 session,
1316 &global);
1317 if (!NT_STATUS_IS_OK(status)) {
1318 TALLOC_FREE(session);
1319 return status;
1320 }
1321 session->global = global;
1322
1323 if (conn->protocol >= PROTOCOL_SMB2_02) {
1324 uint64_t id = global->session_global_id;
1325
1326 global->connection_dialect = conn->smb2.server.dialect;
1327
1328 global->session_wire_id = id;
1329
1330 status = smb2srv_tcon_table_init(session);
1331 if (!NT_STATUS_IS_OK(status)) {
1332 TALLOC_FREE(session);
1333 return status;
1334 }
1335
1336 session->local_id = global->session_global_id;
1337
1338 local_rec = smbXsrv_session_local_fetch_locked(
1339 table->local.db_ctx,
1340 session->local_id,
1341 session /* TALLOC_CTX */);
1342 if (local_rec == NULL) {
1343 TALLOC_FREE(session);
1344 return NT_STATUS_NO_MEMORY;
1345 }
1346
1347 val = dbwrap_record_get_value(local_rec);
1348 if (val.dsize != 0) {
1349 TALLOC_FREE(session);
1350 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1351 }
1352 } else {
1353
1354 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1355 table->local.lowest_id,
1356 table->local.highest_id,
1357 session,
1358 &local_rec,
1359 &session->local_id);
1360 if (!NT_STATUS_IS_OK(status)) {
1361 TALLOC_FREE(session);
1362 return status;
1363 }
1364
1365 global->session_wire_id = session->local_id;
1366 }
1367
1368 global->creation_time = now;
1369 global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1370
1371 status = smbXsrv_session_add_channel(session, conn, now, &channel);
1372 if (!NT_STATUS_IS_OK(status)) {
1373 TALLOC_FREE(session);
1374 return status;
1375 }
1376
1377 ptr = session;
1378 val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1379 status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1380 TALLOC_FREE(local_rec);
1381 if (!NT_STATUS_IS_OK(status)) {
1382 TALLOC_FREE(session);
1383 return status;
1384 }
1385 table->local.num_sessions += 1;
1386
1387 talloc_set_destructor(session, smbXsrv_session_destructor);
1388
1389 status = smbXsrv_session_global_store(global);
1390 if (!NT_STATUS_IS_OK(status)) {
1391 DEBUG(0,("smbXsrv_session_create: "
1392 "global_id (0x%08x) store failed - %s\n",
1393 session->global->session_global_id,
1394 nt_errstr(status)));
1395 TALLOC_FREE(session);
1396 return status;
1397 }
1398
1399 if (DEBUGLVL(10)) {
1400 struct smbXsrv_sessionB session_blob = {
1401 .version = SMBXSRV_VERSION_0,
1402 .info.info0 = session,
1403 };
1404
1405 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1406 session->global->session_global_id));
1407 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1408 }
1409
1410 *_session = session;
1411 return NT_STATUS_OK;
1412 }
1413
1414 NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1415 struct smbXsrv_connection *conn,
1416 NTTIME now,
1417 struct smbXsrv_channel_global0 **_c)
1418 {
1419 struct smbXsrv_session_global0 *global = session->global;
1420 struct smbXsrv_channel_global0 *c = NULL;
1421
1422 if (global->num_channels > 31) {
1423 /*
1424 * Windows allow up to 32 channels
1425 */
1426 return NT_STATUS_INSUFFICIENT_RESOURCES;
1427 }
1428
1429 c = talloc_realloc(global,
1430 global->channels,
1431 struct smbXsrv_channel_global0,
1432 global->num_channels + 1);
1433 if (c == NULL) {
1434 return NT_STATUS_NO_MEMORY;
1435 }
1436 global->channels = c;
1437
1438 c = &global->channels[global->num_channels];
1439 ZERO_STRUCTP(c);
1440
1441 c->server_id = messaging_server_id(conn->client->msg_ctx);
1442 c->channel_id = conn->channel_id;
1443 c->creation_time = now;
1444 c->local_address = tsocket_address_string(conn->local_address,
1445 global->channels);
1446 if (c->local_address == NULL) {
1447 return NT_STATUS_NO_MEMORY;
1448 }
1449 c->remote_address = tsocket_address_string(conn->remote_address,
1450 global->channels);
1451 if (c->remote_address == NULL) {
1452 return NT_STATUS_NO_MEMORY;
1453 }
1454 c->remote_name = talloc_strdup(global->channels,
1455 conn->remote_hostname);
1456 if (c->remote_name == NULL) {
1457 return NT_STATUS_NO_MEMORY;
1458 }
1459 c->connection = conn;
1460
1461 global->num_channels += 1;
1462
1463 *_c = c;
1464 return NT_STATUS_OK;
1465 }
1466
1467 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1468 {
1469 struct smbXsrv_session_table *table = session->table;
1470 NTSTATUS status;
1471
1472 if (session->global->db_rec != NULL) {
1473 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1474 "Called with db_rec != NULL'\n",
1475 session->global->session_global_id));
1476 return NT_STATUS_INTERNAL_ERROR;
1477 }
1478
1479 if (table == NULL) {
1480 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1481 "Called with table == NULL'\n",
1482 session->global->session_global_id));
1483 return NT_STATUS_INTERNAL_ERROR;
1484 }
1485
1486 session->global->db_rec = smbXsrv_session_global_fetch_locked(
1487 table->global.db_ctx,
1488 session->global->session_global_id,
1489 session->global /* TALLOC_CTX */);
1490 if (session->global->db_rec == NULL) {
1491 return NT_STATUS_INTERNAL_DB_ERROR;
1492 }
1493
1494 status = smbXsrv_session_global_store(session->global);
1495 if (!NT_STATUS_IS_OK(status)) {
1496 DEBUG(0,("smbXsrv_session_update: "
1497 "global_id (0x%08x) store failed - %s\n",
1498 session->global->session_global_id,
1499 nt_errstr(status)));
1500 return status;
1501 }
1502
1503 if (DEBUGLVL(10)) {
1504 struct smbXsrv_sessionB session_blob = {
1505 .version = SMBXSRV_VERSION_0,
1506 .info.info0 = session,
1507 };
1508
1509 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1510 session->global->session_global_id));
1511 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1512 }
1513
1514 return NT_STATUS_OK;
1515 }
1516
1517 NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1518 const struct smbXsrv_connection *conn,
1519 struct smbXsrv_channel_global0 **_c)
1520 {
1521 uint32_t i;
1522
1523 for (i=0; i < session->global->num_channels; i++) {
1524 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1525
1526 if (c->channel_id != conn->channel_id) {
1527 continue;
1528 }
1529
1530 if (c->connection != conn) {
1531 continue;
1532 }
1533
1534 *_c = c;
1535 return NT_STATUS_OK;
1536 }
1537
1538 return NT_STATUS_USER_SESSION_DELETED;
1539 }
1540
1541 NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1542 const struct smbXsrv_connection *conn,
1543 NTTIME now,
1544 struct smbXsrv_session_auth0 **_a)
1545 {
1546 struct smbXsrv_session_auth0 *a;
1547
1548 for (a = session->pending_auth; a != NULL; a = a->next) {
1549 if (a->channel_id != conn->channel_id) {
1550 continue;
1551 }
1552
1553 if (a->connection == conn) {
1554 if (now != 0) {
1555 a->idle_time = now;
1556 }
1557 *_a = a;
1558 return NT_STATUS_OK;
1559 }
1560 }
1561
1562 return NT_STATUS_USER_SESSION_DELETED;
1563 }
1564
1565 static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1566 {
1567 if (a->session == NULL) {
1568 return 0;
1569 }
1570
1571 DLIST_REMOVE(a->session->pending_auth, a);
1572 a->session = NULL;
1573 return 0;
1574 }
1575
1576 NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1577 struct smbXsrv_connection *conn,
1578 NTTIME now,
1579 uint8_t in_flags,
1580 uint8_t in_security_mode,
1581 struct smbXsrv_session_auth0 **_a)
1582 {
1583 struct smbXsrv_session_auth0 *a;
1584 NTSTATUS status;
1585
1586 status = smbXsrv_session_find_auth(session, conn, 0, &a);
1587 if (NT_STATUS_IS_OK(status)) {
1588 return NT_STATUS_INTERNAL_ERROR;
1589 }
1590
1591 a = talloc_zero(session, struct smbXsrv_session_auth0);
1592 if (a == NULL) {
1593 return NT_STATUS_NO_MEMORY;
1594 }
1595 a->session = session;
1596 a->connection = conn;
1597 a->in_flags = in_flags;
1598 a->in_security_mode = in_security_mode;
1599 a->creation_time = now;
1600 a->idle_time = now;
1601 a->channel_id = conn->channel_id;
1602
1603 if (conn->protocol >= PROTOCOL_SMB3_11) {
1604 a->preauth = talloc(a, struct smbXsrv_preauth);
1605 if (a->preauth == NULL) {
1606 TALLOC_FREE(session);
1607 return NT_STATUS_NO_MEMORY;
1608 }
1609 *a->preauth = conn->smb2.preauth;
1610 }
1611
1612 talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1613 DLIST_ADD_END(session->pending_auth, a);
1614
1615 *_a = a;
1616 return NT_STATUS_OK;
1617 }
1618
1619 static void smbXsrv_session_remove_channel_done(struct tevent_req *subreq);
1620
1621 NTSTATUS smbXsrv_session_remove_channel(struct smbXsrv_session *session,
1622 struct smbXsrv_connection *xconn)
1623 {
1624 struct smbXsrv_session_auth0 *a = NULL;
1625 struct smbXsrv_channel_global0 *c = NULL;
1626 NTSTATUS status;
1627 bool need_update = false;
1628
1629 status = smbXsrv_session_find_auth(session, xconn, 0, &a);
1630 if (!NT_STATUS_IS_OK(status)) {
1631 a = NULL;
1632 }
1633 status = smbXsrv_session_find_channel(session, xconn, &c);
1634 if (!NT_STATUS_IS_OK(status)) {
1635 c = NULL;
1636 }
1637
1638 if (a != NULL) {
1639 smbXsrv_session_auth0_destructor(a);
1640 a->connection = NULL;
1641 need_update = true;
1642 }
1643
1644 if (c != NULL) {
1645 struct smbXsrv_session_global0 *global = session->global;
1646 ptrdiff_t n;
1647
1648 n = (c - global->channels);
1649 if (n >= global->num_channels || n < 0) {
1650 return NT_STATUS_INTERNAL_ERROR;
1651 }
1652 ARRAY_DEL_ELEMENT(global->channels, n, global->num_channels);
1653 global->num_channels--;
1654 if (global->num_channels == 0) {
1655 struct smbXsrv_client *client = session->client;
1656 struct tevent_queue *xconn_wait_queue =
1657 xconn->transport.shutdown_wait_queue;
1658 struct tevent_req *subreq = NULL;
1659
1660 /*
1661 * Let the connection wait until the session is
1662 * destroyed.
1663 *
1664 * We don't set a callback, as we just want to block the
1665 * wait queue and the talloc_free() of the session will
1666 * remove the item from the wait queue in order
1667 * to remove allow the connection to disapear.
1668 */
1669 if (xconn_wait_queue != NULL) {
1670 subreq = tevent_queue_wait_send(session,
1671 client->raw_ev_ctx,
1672 xconn_wait_queue);
1673 if (subreq == NULL) {
1674 status = NT_STATUS_NO_MEMORY;
1675 DBG_ERR("tevent_queue_wait_send() session(%llu) failed: %s\n",
1676 (unsigned long long)session->global->session_wire_id,
1677 nt_errstr(status));
1678 return status;
1679 }
1680 }
1681
1682 /*
1683 * This is garanteed to set
1684 * session->status = NT_STATUS_USER_SESSION_DELETED
1685 * even if NULL is returned.
1686 */
1687 subreq = smb2srv_session_shutdown_send(session,
1688 client->raw_ev_ctx,
1689 session,
1690 NULL);
1691 if (subreq == NULL) {
1692 status = NT_STATUS_NO_MEMORY;
1693 DBG_ERR("smb2srv_session_shutdown_send(%llu) failed: %s\n",
1694 (unsigned long long)session->global->session_wire_id,
1695 nt_errstr(status));
1696 return status;
1697 }
1698 tevent_req_set_callback(subreq,
1699 smbXsrv_session_remove_channel_done,
1700 session);
1701 }
1702 need_update = true;
1703 }
1704
1705 if (!need_update) {
1706 return NT_STATUS_OK;
1707 }
1708
1709 return smbXsrv_session_update(session);
1710 }
1711
1712 static void smbXsrv_session_remove_channel_done(struct tevent_req *subreq)
1713 {
1714 struct smbXsrv_session *session =
1715 tevent_req_callback_data(subreq,
1716 struct smbXsrv_session);
1717 NTSTATUS status;
1718
1719 status = smb2srv_session_shutdown_recv(subreq);
1720 TALLOC_FREE(subreq);
1721 if (!NT_STATUS_IS_OK(status)) {
1722 DBG_ERR("smb2srv_session_shutdown_recv(%llu) failed: %s\n",
1723 (unsigned long long)session->global->session_wire_id,
1724 nt_errstr(status));
1725 }
1726
1727 status = smbXsrv_session_logoff(session);
1728 if (!NT_STATUS_IS_OK(status)) {
1729 DBG_ERR("smbXsrv_session_logoff(%llu) failed: %s\n",
1730 (unsigned long long)session->global->session_wire_id,
1731 nt_errstr(status));
1732 }
1733
1734 TALLOC_FREE(session);
1735 }
1736
1737 struct smb2srv_session_shutdown_state {
1738 struct tevent_queue *wait_queue;
1739 };
1740
1741 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1742
1743 struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1744 struct tevent_context *ev,
1745 struct smbXsrv_session *session,
1746 struct smbd_smb2_request *current_req)
1747 {
1748 struct tevent_req *req;
1749 struct smb2srv_session_shutdown_state *state;
1750 struct tevent_req *subreq;
1751 struct smbXsrv_connection *xconn = NULL;
1752 size_t len = 0;
1753
1754 /*
1755 * Make sure that no new request will be able to use this session.
1756 */
1757 session->status = NT_STATUS_USER_SESSION_DELETED;
1758
1759 req = tevent_req_create(mem_ctx, &state,
1760 struct smb2srv_session_shutdown_state);
1761 if (req == NULL) {
1762 return NULL;
1763 }
1764
1765 state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1766 if (tevent_req_nomem(state->wait_queue, req)) {
1767 return tevent_req_post(req, ev);
1768 }
1769
1770 for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1771 struct smbd_smb2_request *preq;
1772
1773 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1774 if (preq == current_req) {
1775 /* Can't cancel current request. */
1776 continue;
1777 }
1778 if (preq->session != session) {
1779 /* Request on different session. */
1780 continue;
1781 }
1782
1783 if (preq->subreq != NULL) {
1784 tevent_req_cancel(preq->subreq);
1785 }
1786
1787 /*
1788 * Now wait until the request is finished.
1789 *
1790 * We don't set a callback, as we just want to block the
1791 * wait queue and the talloc_free() of the request will
1792 * remove the item from the wait queue.
1793 */
1794 subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1795 if (tevent_req_nomem(subreq, req)) {
1796 return tevent_req_post(req, ev);
1797 }
1798 }
1799 }
1800
1801 len = tevent_queue_length(state->wait_queue);
1802 if (len == 0) {
1803 tevent_req_done(req);
1804 return tevent_req_post(req, ev);
1805 }
1806
1807 /*
1808 * Now we add our own waiter to the end of the queue,
1809 * this way we get notified when all pending requests are finished
1810 * and send to the socket.
1811 */
1812 subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1813 if (tevent_req_nomem(subreq, req)) {
1814 return tevent_req_post(req, ev);
1815 }
1816 tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1817
1818 return req;
1819 }
1820
1821 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1822 {
1823 struct tevent_req *req =
1824 tevent_req_callback_data(subreq,
1825 struct tevent_req);
1826
1827 tevent_queue_wait_recv(subreq);
1828 TALLOC_FREE(subreq);
1829
1830 tevent_req_done(req);
1831 }
1832
1833 NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1834 {
1835 return tevent_req_simple_recv_ntstatus(req);
1836 }
1837
1838 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1839 {
1840 struct smbXsrv_session_table *table;
1841 struct db_record *local_rec = NULL;
1842 struct db_record *global_rec = NULL;
1843 struct smbd_server_connection *sconn = NULL;
1844 NTSTATUS status;
1845 NTSTATUS error = NT_STATUS_OK;
1846
1847 if (session->table == NULL) {
1848 return NT_STATUS_OK;
1849 }
1850
1851 table = session->table;
1852 session->table = NULL;
1853
1854 sconn = session->client->sconn;
1855 session->client = NULL;
1856 session->status = NT_STATUS_USER_SESSION_DELETED;
1857
1858 /*
1859 * For SMB2 this is a bit redundant as files are also close
1860 * below via smb2srv_tcon_disconnect_all() -> ... ->
1861 * smbXsrv_tcon_disconnect() -> close_cnum() ->
1862 * file_close_conn().
1863 */
1864 file_close_user(sconn, session->global->session_wire_id);
1865
1866 if (session->tcon_table != NULL) {
1867 /*
1868 * Note: We only have a tcon_table for SMB2.
1869 */
1870 status = smb2srv_tcon_disconnect_all(session);
1871 if (!NT_STATUS_IS_OK(status)) {
1872 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1873 "smb2srv_tcon_disconnect_all() failed: %s\n",
1874 session->global->session_global_id,
1875 nt_errstr(status)));
1876 error = status;
1877 }
1878 }
1879
1880 invalidate_vuid(sconn, session->global->session_wire_id);
1881
1882 global_rec = session->global->db_rec;
1883 session->global->db_rec = NULL;
1884 if (global_rec == NULL) {
1885 global_rec = smbXsrv_session_global_fetch_locked(
1886 table->global.db_ctx,
1887 session->global->session_global_id,
1888 session->global /* TALLOC_CTX */);
1889 if (global_rec == NULL) {
1890 error = NT_STATUS_INTERNAL_ERROR;
1891 }
1892 }
1893
1894 if (global_rec != NULL) {
1895 status = dbwrap_record_delete(global_rec);
1896 if (!NT_STATUS_IS_OK(status)) {
1897 TDB_DATA key = dbwrap_record_get_key(global_rec);
1898
1899 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1900 "failed to delete global key '%s': %s\n",
1901 session->global->session_global_id,
1902 hex_encode_talloc(global_rec, key.dptr,
1903 key.dsize),
1904 nt_errstr(status)));
1905 error = status;
1906 }
1907 }
1908 TALLOC_FREE(global_rec);
1909
1910 local_rec = session->db_rec;
1911 if (local_rec == NULL) {
1912 local_rec = smbXsrv_session_local_fetch_locked(
1913 table->local.db_ctx,
1914 session->local_id,
1915 session /* TALLOC_CTX */);
1916 if (local_rec == NULL) {
1917 error = NT_STATUS_INTERNAL_ERROR;
1918 }
1919 }
1920
1921 if (local_rec != NULL) {
1922 status = dbwrap_record_delete(local_rec);
1923 if (!NT_STATUS_IS_OK(status)) {
1924 TDB_DATA key = dbwrap_record_get_key(local_rec);
1925
1926 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1927 "failed to delete local key '%s': %s\n",
1928 session->global->session_global_id,
1929 hex_encode_talloc(local_rec, key.dptr,
1930 key.dsize),
1931 nt_errstr(status)));
1932 error = status;
1933 }
1934 table->local.num_sessions -= 1;
1935 }
1936 if (session->db_rec == NULL) {
1937 TALLOC_FREE(local_rec);
1938 }
1939 session->db_rec = NULL;
1940
1941 return error;
1942 }
1943
1944 struct smbXsrv_session_logoff_all_state {
1945 NTSTATUS first_status;
1946 int errors;
1947 };
1948
1949 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1950 void *private_data);
1951
1952 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_client *client)
1953 {
1954 struct smbXsrv_session_table *table = client->session_table;
1955 struct smbXsrv_session_logoff_all_state state;
1956 NTSTATUS status;
1957 int count = 0;
1958
1959 if (table == NULL) {
1960 DEBUG(10, ("smbXsrv_session_logoff_all: "
1961 "empty session_table, nothing to do.\n"));
1962 return NT_STATUS_OK;
1963 }
1964
1965 ZERO_STRUCT(state);
1966
1967 status = dbwrap_traverse(table->local.db_ctx,
1968 smbXsrv_session_logoff_all_callback,
1969 &state, &count);
1970 if (!NT_STATUS_IS_OK(status)) {
1971 DEBUG(0, ("smbXsrv_session_logoff_all: "
1972 "dbwrap_traverse() failed: %s\n",
1973 nt_errstr(status)));
1974 return status;
1975 }
1976
1977 if (!NT_STATUS_IS_OK(state.first_status)) {
1978 DEBUG(0, ("smbXsrv_session_logoff_all: "
1979 "count[%d] errors[%d] first[%s]\n",
1980 count, state.errors,
1981 nt_errstr(state.first_status)));
1982 return state.first_status;
1983 }
1984
1985 return NT_STATUS_OK;
1986 }
1987
1988 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1989 void *private_data)
1990 {
1991 struct smbXsrv_session_logoff_all_state *state =
1992 (struct smbXsrv_session_logoff_all_state *)private_data;
1993 TDB_DATA val;
1994 void *ptr = NULL;
1995 struct smbXsrv_session *session = NULL;
1996 NTSTATUS status;
1997
1998 val = dbwrap_record_get_value(local_rec);
1999 if (val.dsize != sizeof(ptr)) {
2000 status = NT_STATUS_INTERNAL_ERROR;
2001 if (NT_STATUS_IS_OK(state->first_status)) {
2002 state->first_status = status;
2003 }
2004 state->errors++;
2005 return 0;
2006 }
2007
2008 memcpy(&ptr, val.dptr, val.dsize);
2009 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
2010
2011 session->db_rec = local_rec;
2012 status = smbXsrv_session_clear_and_logoff(session);
2013 session->db_rec = NULL;
2014 if (!NT_STATUS_IS_OK(status)) {
2015 if (NT_STATUS_IS_OK(state->first_status)) {
2016 state->first_status = status;
2017 }
2018 state->errors++;
2019 return 0;
2020 }
2021
2022 return 0;
2023 }
2024
2025 struct smbXsrv_session_local_trav_state {
2026 NTSTATUS status;
2027 int (*caller_cb)(struct smbXsrv_session *session,
2028 void *caller_data);
2029 void *caller_data;
2030 };
2031
2032 static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
2033 void *private_data);
2034
2035 NTSTATUS smbXsrv_session_local_traverse(
2036 struct smbXsrv_client *client,
2037 int (*caller_cb)(struct smbXsrv_session *session,
2038 void *caller_data),
2039 void *caller_data)
2040 {
2041 struct smbXsrv_session_table *table = client->session_table;
2042 struct smbXsrv_session_local_trav_state state;
2043 NTSTATUS status;
2044 int count = 0;
2045
2046 state = (struct smbXsrv_session_local_trav_state) {
2047 .status = NT_STATUS_OK,
2048 .caller_cb = caller_cb,
2049 .caller_data = caller_data,
2050 };
2051
2052 if (table == NULL) {
2053 DBG_DEBUG("empty session_table, nothing to do.\n");
2054 return NT_STATUS_OK;
2055 }
2056
2057 status = dbwrap_traverse(table->local.db_ctx,
2058 smbXsrv_session_local_traverse_cb,
2059 &state,
2060 &count);
2061 if (!NT_STATUS_IS_OK(status)) {
2062 DBG_ERR("dbwrap_traverse() failed: %s\n", nt_errstr(status));
2063 return status;
2064 }
2065 if (!NT_STATUS_IS_OK(state.status)) {
2066 DBG_ERR("count[%d] status[%s]\n",
2067 count, nt_errstr(state.status));
2068 return state.status;
2069 }
2070
2071 return NT_STATUS_OK;
2072 }
2073
2074 static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
2075 void *private_data)
2076 {
2077 struct smbXsrv_session_local_trav_state *state =
2078 (struct smbXsrv_session_local_trav_state *)private_data;
2079 TDB_DATA val;
2080 void *ptr = NULL;
2081 struct smbXsrv_session *session = NULL;
2082 int ret;
2083
2084 val = dbwrap_record_get_value(local_rec);
2085 if (val.dsize != sizeof(ptr)) {
2086 state->status = NT_STATUS_INTERNAL_ERROR;
2087 return -1;
2088 }
2089
2090 memcpy(&ptr, val.dptr, val.dsize);
2091 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
2092
2093 session->db_rec = local_rec;
2094 ret = state->caller_cb(session, state->caller_data);
2095 session->db_rec = NULL;
2096
2097 return ret;
2098 }
2099
2100 struct smbXsrv_session_disconnect_xconn_state {
2101 struct smbXsrv_connection *xconn;
2102 NTSTATUS first_status;
2103 int errors;
2104 };
2105
2106 static int smbXsrv_session_disconnect_xconn_callback(struct db_record *local_rec,
2107 void *private_data);
2108
2109 NTSTATUS smbXsrv_session_disconnect_xconn(struct smbXsrv_connection *xconn)
2110 {
2111 struct smbXsrv_client *client = xconn->client;
2112 struct smbXsrv_session_table *table = client->session_table;
2113 struct smbXsrv_session_disconnect_xconn_state state;
2114 NTSTATUS status;
2115 int count = 0;
2116
2117 if (table == NULL) {
2118 DBG_ERR("empty session_table, nothing to do.\n");
2119 return NT_STATUS_OK;
2120 }
2121
2122 ZERO_STRUCT(state);
2123 state.xconn = xconn;
2124
2125 status = dbwrap_traverse(table->local.db_ctx,
2126 smbXsrv_session_disconnect_xconn_callback,
2127 &state, &count);
2128 if (!NT_STATUS_IS_OK(status)) {
2129 DBG_ERR("dbwrap_traverse() failed: %s\n",
2130 nt_errstr(status));
2131 return status;
2132 }
2133
2134 if (!NT_STATUS_IS_OK(state.first_status)) {
2135 DBG_ERR("count[%d] errors[%d] first[%s]\n",
2136 count, state.errors,
2137 nt_errstr(state.first_status));
2138 return state.first_status;
2139 }
2140
2141 return NT_STATUS_OK;
2142 }
2143
2144 static int smbXsrv_session_disconnect_xconn_callback(struct db_record *local_rec,
2145 void *private_data)
2146 {
2147 struct smbXsrv_session_disconnect_xconn_state *state =
2148 (struct smbXsrv_session_disconnect_xconn_state *)private_data;
2149 TDB_DATA val;
2150 void *ptr = NULL;
2151 struct smbXsrv_session *session = NULL;
2152 NTSTATUS status;
2153
2154 val = dbwrap_record_get_value(local_rec);
2155 if (val.dsize != sizeof(ptr)) {
2156 status = NT_STATUS_INTERNAL_ERROR;
2157 if (NT_STATUS_IS_OK(state->first_status)) {
2158 state->first_status = status;
2159 }
2160 state->errors++;
2161 return 0;
2162 }
2163
2164 memcpy(&ptr, val.dptr, val.dsize);
2165 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
2166
2167 session->db_rec = local_rec;
2168 status = smbXsrv_session_remove_channel(session, state->xconn);
2169 session->db_rec = NULL;
2170 if (!NT_STATUS_IS_OK(status)) {
2171 if (NT_STATUS_IS_OK(state->first_status)) {
2172 state->first_status = status;
2173 }
2174 state->errors++;
2175 }
2176
2177 return 0;
2178 }
2179
2180 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
2181 {
2182 /*
2183 * Allow a range from 1..65534 with 65534 values.
2184 */
2185 return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
2186 UINT16_MAX - 1);
2187 }
2188
2189 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
2190 uint16_t vuid, NTTIME now,
2191 struct smbXsrv_session **session)
2192 {
2193 struct smbXsrv_session_table *table = conn->client->session_table;
2194 uint32_t local_id = vuid;
2195
2196 return smbXsrv_session_local_lookup(table, conn, local_id, now,
2197 session);
2198 }
2199
2200 NTSTATUS smbXsrv_session_info_lookup(struct smbXsrv_client *client,
2201 uint64_t session_wire_id,
2202 struct auth_session_info **si)
2203 {
2204 struct smbXsrv_session_table *table = client->session_table;
2205 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
2206 struct smbXsrv_session_local_fetch_state state = {
2207 .session = NULL,
2208 .status = NT_STATUS_INTERNAL_ERROR,
2209 };
2210 TDB_DATA key;
2211 NTSTATUS status;
2212
2213 if (session_wire_id == 0) {
2214 return NT_STATUS_USER_SESSION_DELETED;
2215 }
2216
2217 if (table == NULL) {
2218 /* this might happen before the end of negprot */
2219 return NT_STATUS_USER_SESSION_DELETED;
2220 }
2221
2222 if (table->local.db_ctx == NULL) {
2223 return NT_STATUS_INTERNAL_ERROR;
2224 }
2225
2226 key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
2227
2228 status = dbwrap_parse_record(table->local.db_ctx, key,
2229 smbXsrv_session_local_fetch_parser,
2230 &state);
2231 if (!NT_STATUS_IS_OK(status)) {
2232 return status;
2233 }
2234 if (!NT_STATUS_IS_OK(state.status)) {
2235 return state.status;
2236 }
2237 if (state.session->global->auth_session_info == NULL) {
2238 return NT_STATUS_USER_SESSION_DELETED;
2239 }
2240
2241 *si = state.session->global->auth_session_info;
2242 return NT_STATUS_OK;
2243 }
2244
2245 /*
2246 * In memory of get_valid_user_struct()
2247 *
2248 * This function is similar to smbXsrv_session_local_lookup() and it's wrappers,
2249 * but it doesn't implement the state checks of
2250 * those. get_valid_smbXsrv_session() is NOT meant to be called to validate the
2251 * session wire-id of incoming SMB requests, it MUST only be used in later
2252 * internal processing where the session wire-id has already been validated.
2253 */
2254 NTSTATUS get_valid_smbXsrv_session(struct smbXsrv_client *client,
2255 uint64_t session_wire_id,
2256 struct smbXsrv_session **session)
2257 {
2258 struct smbXsrv_session_table *table = client->session_table;
2259 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
2260 struct smbXsrv_session_local_fetch_state state = {
2261 .session = NULL,
2262 .status = NT_STATUS_INTERNAL_ERROR,
2263 };
2264 TDB_DATA key;
2265 NTSTATUS status;
2266
2267 if (session_wire_id == 0) {
2268 return NT_STATUS_USER_SESSION_DELETED;
2269 }
2270
2271 if (table == NULL) {
2272 /* this might happen before the end of negprot */
2273 return NT_STATUS_USER_SESSION_DELETED;
2274 }
2275
2276 if (table->local.db_ctx == NULL) {
2277 return NT_STATUS_INTERNAL_ERROR;
2278 }
2279
2280 key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
2281
2282 status = dbwrap_parse_record(table->local.db_ctx, key,
2283 smbXsrv_session_local_fetch_parser,
2284 &state);
2285 if (!NT_STATUS_IS_OK(status)) {
2286 return status;
2287 }
2288 if (!NT_STATUS_IS_OK(state.status)) {
2289 return state.status;
2290 }
2291 if (state.session->global->auth_session_info == NULL) {
2292 return NT_STATUS_USER_SESSION_DELETED;
2293 }
2294
2295 *session = state.session;
2296 return NT_STATUS_OK;
2297 }
2298
2299 NTSTATUS smb2srv_session_lookup_global(struct smbXsrv_client *client,
2300 uint64_t session_wire_id,
2301 TALLOC_CTX *mem_ctx,
2302 struct smbXsrv_session **_session)
2303 {
2304 TALLOC_CTX *frame = talloc_stackframe();
2305 struct smbXsrv_session_table *table = client->session_table;
2306 uint32_t global_id = session_wire_id & UINT32_MAX;
2307 uint64_t global_zeros = session_wire_id & 0xFFFFFFFF00000000LLU;
2308 struct smbXsrv_session *session = NULL;
2309 struct db_record *global_rec = NULL;
2310 bool is_free = false;
2311 NTSTATUS status;
2312
2313 if (global_id == 0) {
2314 TALLOC_FREE(frame);
2315 return NT_STATUS_USER_SESSION_DELETED;
2316 }
2317 if (global_zeros != 0) {
2318 TALLOC_FREE(frame);
2319 return NT_STATUS_USER_SESSION_DELETED;
2320 }
2321
2322 if (table == NULL) {
2323 /* this might happen before the end of negprot */
2324 TALLOC_FREE(frame);
2325 return NT_STATUS_USER_SESSION_DELETED;
2326 }
2327
2328 if (table->global.db_ctx == NULL) {
2329 TALLOC_FREE(frame);
2330 return NT_STATUS_INTERNAL_ERROR;
2331 }
2332
2333 session = talloc_zero(mem_ctx, struct smbXsrv_session);
2334 if (session == NULL) {
2335 TALLOC_FREE(frame);
2336 return NT_STATUS_NO_MEMORY;
2337 }
2338 talloc_steal(frame, session);
2339
2340 session->client = client;
2341 session->status = NT_STATUS_BAD_LOGON_SESSION_STATE;
2342 session->local_id = global_id;
2343
2344 /*
2345 * This means smb2_get_new_nonce() will return
2346 * NT_STATUS_ENCRYPTION_FAILED.
2347 *
2348 * But we intialize some random parts just in case...
2349 */
2350 session->nonce_high_max = session->nonce_high = 0;
2351 generate_nonce_buffer((uint8_t *)&session->nonce_high_random,
2352 sizeof(session->nonce_high_random));
2353 generate_nonce_buffer((uint8_t *)&session->nonce_low,
2354 sizeof(session->nonce_low));
2355
2356 global_rec = smbXsrv_session_global_fetch_locked(table->global.db_ctx,
2357 global_id,
2358 frame);
2359 if (global_rec == NULL) {
2360 TALLOC_FREE(frame);
2361 return NT_STATUS_INTERNAL_DB_ERROR;
2362 }
2363
2364 smbXsrv_session_global_verify_record(global_rec,
2365 &is_free,
2366 NULL,
2367 session,
2368 &session->global,
2369 NULL);
2370 if (is_free) {
2371 TALLOC_FREE(frame);
2372 return NT_STATUS_USER_SESSION_DELETED;
2373 }
2374
2375 /*
2376 * We don't have channels on this session
2377 * and only the main signing key
2378 */
2379 session->global->num_channels = 0;
2380 status = smb2_signing_key_sign_create(session->global,
2381 session->global->signing_algo,
2382 NULL, /* no master key */
2383 NULL, /* derivations */
2384 &session->global->signing_key);
2385 if (!NT_STATUS_IS_OK(status)) {
2386 TALLOC_FREE(frame);
2387 return NT_STATUS_NO_MEMORY;
2388 }
2389 session->global->signing_key->blob = session->global->signing_key_blob;
2390 session->global->signing_flags = 0;
2391
2392 status = smb2_signing_key_cipher_create(session->global,
2393 session->global->encryption_cipher,
2394 NULL, /* no master key */
2395 NULL, /* derivations */
2396 &session->global->decryption_key);
2397 if (!NT_STATUS_IS_OK(status)) {
2398 TALLOC_FREE(frame);
2399 return NT_STATUS_NO_MEMORY;
2400 }
2401 session->global->decryption_key->blob = session->global->decryption_key_blob;
2402 session->global->encryption_flags = 0;
2403
2404 *_session = talloc_move(mem_ctx, &session);
2405 TALLOC_FREE(frame);
2406 return NT_STATUS_OK;
2407 }
2408
2409 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
2410 {
2411 /*
2412 * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
2413 */
2414 return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
2415 UINT16_MAX - 1);
2416 }
2417
2418 static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
2419 /* conn: optional */
2420 struct smbXsrv_connection *conn,
2421 uint64_t session_id, NTTIME now,
2422 struct smbXsrv_session **session)
2423 {
2424 uint32_t local_id = session_id & UINT32_MAX;
2425 uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
2426
2427 if (local_zeros != 0) {
2428 return NT_STATUS_USER_SESSION_DELETED;
2429 }
2430
2431 return smbXsrv_session_local_lookup(table, conn, local_id, now,
2432 session);
2433 }
2434
2435 NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
2436 uint64_t session_id, NTTIME now,
2437 struct smbXsrv_session **session)
2438 {
2439 struct smbXsrv_session_table *table = conn->client->session_table;
2440 return smb2srv_session_lookup_raw(table, conn, session_id, now,
2441 session);
2442 }
2443
2444 NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
2445 uint64_t session_id, NTTIME now,
2446 struct smbXsrv_session **session)
2447 {
2448 struct smbXsrv_session_table *table = client->session_table;
2449 return smb2srv_session_lookup_raw(table, NULL, session_id, now,
2450 session);
2451 }
2452
2453 struct smbXsrv_session_global_traverse_state {
2454 int (*fn)(struct smbXsrv_session_global0 *, void *);
2455 void *private_data;
2456 };
2457
2458 static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
2459 {
2460 int ret = -1;
2461 struct smbXsrv_session_global_traverse_state *state =
2462 (struct smbXsrv_session_global_traverse_state*)data;
2463 TDB_DATA key = dbwrap_record_get_key(rec);
2464 TDB_DATA val = dbwrap_record_get_value(rec);
2465 DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
2466 struct smbXsrv_session_globalB global_blob;
2467 enum ndr_err_code ndr_err;
2468 TALLOC_CTX *frame = talloc_stackframe();
2469
2470 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
2471 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
2472 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2473 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
2474 "key '%s' ndr_pull_struct_blob - %s\n",
2475 hex_encode_talloc(frame, key.dptr, key.dsize),
2476 ndr_errstr(ndr_err)));
2477 goto done;
2478 }
2479
2480 if (global_blob.version != SMBXSRV_VERSION_0) {
2481 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
2482 "key '%s' unsupported version - %d\n",
2483 hex_encode_talloc(frame, key.dptr, key.dsize),
2484 (int)global_blob.version));
2485 goto done;
2486 }
2487
2488 if (global_blob.info.info0 == NULL) {
2489 DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
2490 "key '%s' info0 NULL pointer\n",
2491 hex_encode_talloc(frame, key.dptr, key.dsize)));
2492 goto done;
2493 }
2494
2495 global_blob.info.info0->db_rec = rec;
2496 ret = state->fn(global_blob.info.info0, state->private_data);
2497 done:
2498 TALLOC_FREE(frame);
2499 return ret;
2500 }
2501
2502 NTSTATUS smbXsrv_session_global_traverse(
2503 int (*fn)(struct smbXsrv_session_global0 *, void *),
2504 void *private_data)
2505 {
2506
2507 NTSTATUS status;
2508 int count = 0;
2509 struct smbXsrv_session_global_traverse_state state = {
2510 .fn = fn,
2511 .private_data = private_data,
2512 };
2513
2514 become_root();
2515 status = smbXsrv_session_global_init(NULL);
2516 if (!NT_STATUS_IS_OK(status)) {
2517 unbecome_root();
2518 DEBUG(0, ("Failed to initialize session_global: %s\n",
2519 nt_errstr(status)));
2520 return status;
2521 }
2522
2523 status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
2524 smbXsrv_session_global_traverse_fn,
2525 &state,
2526 &count);
2527 unbecome_root();
2528
2529 return status;
2530 }
Samba GIT mirror