?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
WHATSNEW: mention initial support for SMB3
[Samba/gebeck_regimport.git] / source3 / smbd / smb2_server.c
blob0abd4fcd64060adbd452b5aaced73873e58e8f2c
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "smbprofile.h"
29 #include "../lib/util/bitmap.h"
30 #include "../librpc/gen_ndr/krb5pac.h"
31 #include "auth.h"
32
33 #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)
34
35 static const char *smb2_names[] = {
36 "SMB2_NEGPROT",
37 "SMB2_SESSSETUP",
38 "SMB2_LOGOFF",
39 "SMB2_TCON",
40 "SMB2_TDIS",
41 "SMB2_CREATE",
42 "SMB2_CLOSE",
43 "SMB2_FLUSH",
44 "SMB2_READ",
45 "SMB2_WRITE",
46 "SMB2_LOCK",
47 "SMB2_IOCTL",
48 "SMB2_CANCEL",
49 "SMB2_KEEPALIVE",
50 "SMB2_FIND",
51 "SMB2_NOTIFY",
52 "SMB2_GETINFO",
53 "SMB2_SETINFO",
54 "SMB2_BREAK"
55 };
56
57 const char *smb2_opcode_name(uint16_t opcode)
58 {
59 if (opcode > 0x12) {
60 return "Bad SMB2 opcode";
61 }
62 return smb2_names[opcode];
63 }
64
65 static void print_req_vectors(struct smbd_smb2_request *req)
66 {
67 int i;
68
69 for (i = 0; i < req->in.vector_count; i++) {
70 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
71 (unsigned int)i,
72 (unsigned int)req->in.vector[i].iov_len);
73 }
74 for (i = 0; i < req->out.vector_count; i++) {
75 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
76 (unsigned int)i,
77 (unsigned int)req->out.vector[i].iov_len);
78 }
79 }
80
81 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
82 {
83 if (size < (4 + SMB2_HDR_BODY)) {
84 return false;
85 }
86
87 if (IVAL(inbuf, 4) != SMB2_MAGIC) {
88 return false;
89 }
90
91 return true;
92 }
93
94 static NTSTATUS smbd_initialize_smb2(struct smbd_server_connection *sconn)
95 {
96 NTSTATUS status;
97 int ret;
98
99 TALLOC_FREE(sconn->smb1.fde);
100
101 sconn->smb2.recv_queue = tevent_queue_create(sconn, "smb2 recv queue");
102 if (sconn->smb2.recv_queue == NULL) {
103 return NT_STATUS_NO_MEMORY;
104 }
105
106 sconn->smb2.send_queue = tevent_queue_create(sconn, "smb2 send queue");
107 if (sconn->smb2.send_queue == NULL) {
108 return NT_STATUS_NO_MEMORY;
109 }
110
111 sconn->smb2.seqnum_low = 0;
112 sconn->smb2.seqnum_range = 1;
113 sconn->smb2.credits_granted = 1;
114 sconn->smb2.max_credits = lp_smb2_max_credits();
115 sconn->smb2.credits_bitmap = bitmap_talloc(sconn,
116 sconn->smb2.max_credits);
117 if (sconn->smb2.credits_bitmap == NULL) {
118 return NT_STATUS_NO_MEMORY;
119 }
120
121 ret = tstream_bsd_existing_socket(sconn, sconn->sock,
122 &sconn->smb2.stream);
123 if (ret == -1) {
124 status = map_nt_error_from_unix(errno);
125 return status;
126 }
127
128 /* Ensure child is set to non-blocking mode */
129 set_blocking(sconn->sock, false);
130 return NT_STATUS_OK;
131 }
132
133 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
134 #define _smb2_setlen(_buf,len) do { \
135 uint8_t *buf = (uint8_t *)_buf; \
136 buf[0] = 0; \
137 buf[1] = ((len)&0xFF0000)>>16; \
138 buf[2] = ((len)&0xFF00)>>8; \
139 buf[3] = (len)&0xFF; \
140 } while (0)
141
142 static void smb2_setup_nbt_length(struct iovec *vector, int count)
143 {
144 size_t len = 0;
145 int i;
146
147 for (i=1; i < count; i++) {
148 len += vector[i].iov_len;
149 }
150
151 _smb2_setlen(vector[0].iov_base, len);
152 }
153
154 static int smbd_smb2_request_parent_destructor(struct smbd_smb2_request **req)
155 {
156 if (*req) {
157 (*req)->parent = NULL;
158 (*req)->mem_pool = NULL;
159 }
160
161 return 0;
162 }
163
164 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
165 {
166 if (req->parent) {
167 *req->parent = NULL;
168 talloc_free(req->mem_pool);
169 }
170
171 return 0;
172 }
173
174 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
175 {
176 TALLOC_CTX *mem_pool;
177 struct smbd_smb2_request **parent;
178 struct smbd_smb2_request *req;
179
180 #if 0
181 /* Enable this to find subtle valgrind errors. */
182 mem_pool = talloc_init("smbd_smb2_request_allocate");
183 #else
184 mem_pool = talloc_pool(mem_ctx, 8192);
185 #endif
186 if (mem_pool == NULL) {
187 return NULL;
188 }
189
190 parent = talloc(mem_pool, struct smbd_smb2_request *);
191 if (parent == NULL) {
192 talloc_free(mem_pool);
193 return NULL;
194 }
195
196 req = talloc_zero(parent, struct smbd_smb2_request);
197 if (req == NULL) {
198 talloc_free(mem_pool);
199 return NULL;
200 }
201 *parent = req;
202 req->mem_pool = mem_pool;
203 req->parent = parent;
204
205 req->last_session_id = UINT64_MAX;
206 req->last_tid = UINT32_MAX;
207
208 talloc_set_destructor(parent, smbd_smb2_request_parent_destructor);
209 talloc_set_destructor(req, smbd_smb2_request_destructor);
210
211 return req;
212 }
213
214 static NTSTATUS smbd_smb2_request_create(struct smbd_server_connection *sconn,
215 const uint8_t *inbuf, size_t size,
216 struct smbd_smb2_request **_req)
217 {
218 struct smbd_smb2_request *req;
219 uint32_t protocol_version;
220 const uint8_t *inhdr = NULL;
221 off_t ofs = 0;
222 uint16_t cmd;
223 uint32_t next_command_ofs;
224
225 if (size < (4 + SMB2_HDR_BODY + 2)) {
226 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
227 return NT_STATUS_INVALID_PARAMETER;
228 }
229
230 inhdr = inbuf + 4;
231
232 protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
233 if (protocol_version != SMB2_MAGIC) {
234 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
235 protocol_version));
236 return NT_STATUS_INVALID_PARAMETER;
237 }
238
239 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
240 if (cmd != SMB2_OP_NEGPROT) {
241 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
242 cmd));
243 return NT_STATUS_INVALID_PARAMETER;
244 }
245
246 next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
247 if (next_command_ofs != 0) {
248 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
249 next_command_ofs));
250 return NT_STATUS_INVALID_PARAMETER;
251 }
252
253 req = smbd_smb2_request_allocate(sconn);
254 if (req == NULL) {
255 return NT_STATUS_NO_MEMORY;
256 }
257 req->sconn = sconn;
258
259 talloc_steal(req, inbuf);
260
261 req->in.vector = talloc_array(req, struct iovec, 4);
262 if (req->in.vector == NULL) {
263 TALLOC_FREE(req);
264 return NT_STATUS_NO_MEMORY;
265 }
266 req->in.vector_count = 4;
267
268 memcpy(req->in.nbt_hdr, inbuf, 4);
269
270 ofs = 0;
271 req->in.vector[0].iov_base = discard_const_p(void, req->in.nbt_hdr);
272 req->in.vector[0].iov_len = 4;
273 ofs += req->in.vector[0].iov_len;
274
275 req->in.vector[1].iov_base = discard_const_p(void, (inbuf + ofs));
276 req->in.vector[1].iov_len = SMB2_HDR_BODY;
277 ofs += req->in.vector[1].iov_len;
278
279 req->in.vector[2].iov_base = discard_const_p(void, (inbuf + ofs));
280 req->in.vector[2].iov_len = SVAL(inbuf, ofs) & 0xFFFE;
281 ofs += req->in.vector[2].iov_len;
282
283 if (ofs > size) {
284 return NT_STATUS_INVALID_PARAMETER;
285 }
286
287 req->in.vector[3].iov_base = discard_const_p(void, (inbuf + ofs));
288 req->in.vector[3].iov_len = size - ofs;
289 ofs += req->in.vector[3].iov_len;
290
291 req->current_idx = 1;
292
293 *_req = req;
294 return NT_STATUS_OK;
295 }
296
297 static bool smb2_validate_sequence_number(struct smbd_server_connection *sconn,
298 uint64_t message_id, uint64_t seq_id)
299 {
300 struct bitmap *credits_bm = sconn->smb2.credits_bitmap;
301 unsigned int offset;
302
303 if (seq_id < sconn->smb2.seqnum_low) {
304 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
305 "%llu (sequence id %llu) "
306 "(granted = %u, low = %llu, range = %u)\n",
307 (unsigned long long)message_id,
308 (unsigned long long)seq_id,
309 (unsigned int)sconn->smb2.credits_granted,
310 (unsigned long long)sconn->smb2.seqnum_low,
311 (unsigned int)sconn->smb2.seqnum_range));
312 return false;
313 }
314
315 if (seq_id >= sconn->smb2.seqnum_low + sconn->smb2.seqnum_range) {
316 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
317 "%llu (sequence id %llu) "
318 "(granted = %u, low = %llu, range = %u)\n",
319 (unsigned long long)message_id,
320 (unsigned long long)seq_id,
321 (unsigned int)sconn->smb2.credits_granted,
322 (unsigned long long)sconn->smb2.seqnum_low,
323 (unsigned int)sconn->smb2.seqnum_range));
324 return false;
325 }
326
327 offset = seq_id % sconn->smb2.max_credits;
328
329 if (bitmap_query(credits_bm, offset)) {
330 DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
331 "%llu (sequence id %llu) "
332 "(granted = %u, low = %llu, range = %u) "
333 "(bm offset %u)\n",
334 (unsigned long long)message_id,
335 (unsigned long long)seq_id,
336 (unsigned int)sconn->smb2.credits_granted,
337 (unsigned long long)sconn->smb2.seqnum_low,
338 (unsigned int)sconn->smb2.seqnum_range,
339 offset));
340 return false;
341 }
342
343 /* Mark the message_ids as seen in the bitmap. */
344 bitmap_set(credits_bm, offset);
345
346 if (seq_id != sconn->smb2.seqnum_low) {
347 return true;
348 }
349
350 /*
351 * Move the window forward by all the message_id's
352 * already seen.
353 */
354 while (bitmap_query(credits_bm, offset)) {
355 DEBUG(10,("smb2_validate_sequence_number: clearing "
356 "id %llu (position %u) from bitmap\n",
357 (unsigned long long)(sconn->smb2.seqnum_low),
358 offset));
359 bitmap_clear(credits_bm, offset);
360
361 sconn->smb2.seqnum_low += 1;
362 sconn->smb2.seqnum_range -= 1;
363 offset = sconn->smb2.seqnum_low % sconn->smb2.max_credits;
364 }
365
366 return true;
367 }
368
369 static bool smb2_validate_message_id(struct smbd_server_connection *sconn,
370 const uint8_t *inhdr)
371 {
372 uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
373 uint16_t opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
374 uint16_t credit_charge = 1;
375 uint64_t i;
376
377 if (opcode == SMB2_OP_CANCEL) {
378 /* SMB2_CANCEL requests by definition resend messageids. */
379 return true;
380 }
381
382 if (sconn->smb2.supports_multicredit) {
383 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
384 credit_charge = MAX(credit_charge, 1);
385 }
386
387 DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
388 "credits_granted %llu, "
389 "seqnum low/range: %llu/%llu\n",
390 (unsigned long long) message_id,
391 (unsigned long long) credit_charge,
392 (unsigned long long) sconn->smb2.credits_granted,
393 (unsigned long long) sconn->smb2.seqnum_low,
394 (unsigned long long) sconn->smb2.seqnum_range));
395
396 if (sconn->smb2.credits_granted < credit_charge) {
397 DEBUG(0, ("smb2_validate_message_id: client used more "
398 "credits than granted, mid %llu, charge %llu, "
399 "credits_granted %llu, "
400 "seqnum low/range: %llu/%llu\n",
401 (unsigned long long) message_id,
402 (unsigned long long) credit_charge,
403 (unsigned long long) sconn->smb2.credits_granted,
404 (unsigned long long) sconn->smb2.seqnum_low,
405 (unsigned long long) sconn->smb2.seqnum_range));
406 return false;
407 }
408
409 /*
410 * now check the message ids
411 *
412 * for multi-credit requests we need to check all current mid plus
413 * the implicit mids caused by the credit charge
414 * e.g. current mid = 15, charge 5 => mark 15-19 as used
415 */
416
417 for (i = 0; i <= (credit_charge-1); i++) {
418 uint64_t id = message_id + i;
419 bool ok;
420
421 DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
422 (unsigned long long)message_id,
423 credit_charge,
424 (unsigned long long)id));
425
426 ok = smb2_validate_sequence_number(sconn, message_id, id);
427 if (!ok) {
428 return false;
429 }
430 }
431
432 /* substract used credits */
433 sconn->smb2.credits_granted -= credit_charge;
434
435 return true;
436 }
437
438 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
439 {
440 int count;
441 int idx;
442
443 count = req->in.vector_count;
444
445 if (count < 4) {
446 /* It's not a SMB2 request */
447 return NT_STATUS_INVALID_PARAMETER;
448 }
449
450 for (idx=1; idx < count; idx += 3) {
451 const uint8_t *inhdr = NULL;
452 uint32_t flags;
453
454 if (req->in.vector[idx].iov_len != SMB2_HDR_BODY) {
455 return NT_STATUS_INVALID_PARAMETER;
456 }
457
458 if (req->in.vector[idx+1].iov_len < 2) {
459 return NT_STATUS_INVALID_PARAMETER;
460 }
461
462 inhdr = (const uint8_t *)req->in.vector[idx].iov_base;
463
464 /* Check the SMB2 header */
465 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
466 return NT_STATUS_INVALID_PARAMETER;
467 }
468
469 if (!smb2_validate_message_id(req->sconn, inhdr)) {
470 return NT_STATUS_INVALID_PARAMETER;
471 }
472
473 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
474 if (idx == 1) {
475 /*
476 * the 1st request should never have the
477 * SMB2_HDR_FLAG_CHAINED flag set
478 */
479 if (flags & SMB2_HDR_FLAG_CHAINED) {
480 req->next_status = NT_STATUS_INVALID_PARAMETER;
481 return NT_STATUS_OK;
482 }
483 } else if (idx == 4) {
484 /*
485 * the 2nd request triggers related vs. unrelated
486 * compounded requests
487 */
488 if (flags & SMB2_HDR_FLAG_CHAINED) {
489 req->compound_related = true;
490 }
491 } else if (idx > 4) {
492 #if 0
493 /*
494 * It seems the this tests are wrong
495 * see the SMB2-COMPOUND test
496 */
497
498 /*
499 * all other requests should match the 2nd one
500 */
501 if (flags & SMB2_HDR_FLAG_CHAINED) {
502 if (!req->compound_related) {
503 req->next_status =
504 NT_STATUS_INVALID_PARAMETER;
505 return NT_STATUS_OK;
506 }
507 } else {
508 if (req->compound_related) {
509 req->next_status =
510 NT_STATUS_INVALID_PARAMETER;
511 return NT_STATUS_OK;
512 }
513 }
514 #endif
515 }
516 }
517
518 return NT_STATUS_OK;
519 }
520
521 static void smb2_set_operation_credit(struct smbd_server_connection *sconn,
522 const struct iovec *in_vector,
523 struct iovec *out_vector)
524 {
525 const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
526 uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
527 uint16_t credit_charge = 1;
528 uint16_t credits_requested;
529 uint32_t out_flags;
530 uint16_t cmd;
531 NTSTATUS out_status;
532 uint16_t credits_granted = 0;
533 uint64_t credits_possible;
534 uint16_t current_max_credits;
535
536 /*
537 * first we grant only 1/16th of the max range.
538 *
539 * Windows also starts with the 1/16th and then grants
540 * more later. I was only able to trigger higher
541 * values, when using a verify high credit charge.
542 *
543 * TODO: scale up depending one load, free memory
544 * or other stuff.
545 * Maybe also on the relationship between number
546 * of requests and the used sequence number.
547 * Which means we would grant more credits
548 * for client which use multi credit requests.
549 */
550 current_max_credits = sconn->smb2.max_credits / 16;
551 current_max_credits = MAX(current_max_credits, 1);
552
553 if (sconn->smb2.supports_multicredit) {
554 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
555 credit_charge = MAX(credit_charge, 1);
556 }
557
558 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
559 credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
560 out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
561 out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
562
563 SMB_ASSERT(sconn->smb2.max_credits >= sconn->smb2.credits_granted);
564 SMB_ASSERT(sconn->smb2.max_credits >= credit_charge);
565
566 if (out_flags & SMB2_HDR_FLAG_ASYNC) {
567 /*
568 * In case we already send an async interim
569 * response, we should not grant
570 * credits on the final response.
571 */
572 credits_granted = 0;
573 } else if (credits_requested > 0) {
574 uint16_t additional_max = 0;
575 uint16_t additional_credits = credits_requested - 1;
576
577 switch (cmd) {
578 case SMB2_OP_NEGPROT:
579 break;
580 case SMB2_OP_SESSSETUP:
581 /*
582 * Windows 2012 RC1 starts to grant
583 * additional credits
584 * with a successful session setup
585 */
586 if (NT_STATUS_IS_OK(out_status)) {
587 additional_max = 32;
588 }
589 break;
590 default:
591 /*
592 * We match windows and only grant additional credits
593 * in chunks of 32.
594 */
595 additional_max = 32;
596 break;
597 }
598
599 additional_credits = MIN(additional_credits, additional_max);
600
601 credits_granted = credit_charge + additional_credits;
602 } else if (sconn->smb2.credits_granted == 0) {
603 /*
604 * Make sure the client has always at least one credit
605 */
606 credits_granted = 1;
607 }
608
609 /*
610 * sequence numbers should not wrap
611 *
612 * 1. calculate the possible credits until
613 * the sequence numbers start to wrap on 64-bit.
614 *
615 * 2. UINT64_MAX is used for Break Notifications.
616 *
617 * 2. truncate the possible credits to the maximum
618 * credits we want to grant to the client in total.
619 *
620 * 3. remove the range we'll already granted to the client
621 * this makes sure the client consumes the lowest sequence
622 * number, before we can grant additional credits.
623 */
624 credits_possible = UINT64_MAX - sconn->smb2.seqnum_low;
625 if (credits_possible > 0) {
626 /* remove UINT64_MAX */
627 credits_possible -= 1;
628 }
629 credits_possible = MIN(credits_possible, current_max_credits);
630 credits_possible -= sconn->smb2.seqnum_range;
631
632 credits_granted = MIN(credits_granted, credits_possible);
633
634 SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
635 sconn->smb2.credits_granted += credits_granted;
636 sconn->smb2.seqnum_range += credits_granted;
637
638 DEBUG(10,("smb2_set_operation_credit: requested %u, charge %u, "
639 "granted %u, current possible/max %u/%u, "
640 "total granted/max/low/range %u/%u/%llu/%u\n",
641 (unsigned int)credits_requested,
642 (unsigned int)credit_charge,
643 (unsigned int)credits_granted,
644 (unsigned int)credits_possible,
645 (unsigned int)current_max_credits,
646 (unsigned int)sconn->smb2.credits_granted,
647 (unsigned int)sconn->smb2.max_credits,
648 (unsigned long long)sconn->smb2.seqnum_low,
649 (unsigned int)sconn->smb2.seqnum_range));
650 }
651
652 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
653 struct smbd_smb2_request *outreq)
654 {
655 int count, idx;
656 uint16_t total_credits = 0;
657
658 count = outreq->out.vector_count;
659
660 for (idx=1; idx < count; idx += 3) {
661 uint8_t *outhdr = (uint8_t *)outreq->out.vector[idx].iov_base;
662 smb2_set_operation_credit(outreq->sconn,
663 &inreq->in.vector[idx],
664 &outreq->out.vector[idx]);
665 /* To match Windows, count up what we
666 just granted. */
667 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
668 /* Set to zero in all but the last reply. */
669 if (idx + 3 < count) {
670 SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
671 } else {
672 SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
673 }
674 }
675 }
676
677 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
678 {
679 struct iovec *vector;
680 int count;
681 int idx;
682
683 req->request_time = timeval_current();
684
685 count = req->in.vector_count;
686 vector = talloc_zero_array(req, struct iovec, count);
687 if (vector == NULL) {
688 return NT_STATUS_NO_MEMORY;
689 }
690
691 vector[0].iov_base = req->out.nbt_hdr;
692 vector[0].iov_len = 4;
693 SIVAL(req->out.nbt_hdr, 0, 0);
694
695 for (idx=1; idx < count; idx += 3) {
696 const uint8_t *inhdr = NULL;
697 uint8_t *outhdr = NULL;
698 uint8_t *outbody = NULL;
699 uint32_t next_command_ofs = 0;
700 struct iovec *current = &vector[idx];
701
702 if ((idx + 3) < count) {
703 /* we have a next command -
704 * setup for the error case. */
705 next_command_ofs = SMB2_HDR_BODY + 9;
706 }
707
708 inhdr = (const uint8_t *)req->in.vector[idx].iov_base;
709
710 outhdr = talloc_zero_array(vector, uint8_t,
711 OUTVEC_ALLOC_SIZE);
712 if (outhdr == NULL) {
713 return NT_STATUS_NO_MEMORY;
714 }
715
716 outbody = outhdr + SMB2_HDR_BODY;
717
718 current[0].iov_base = (void *)outhdr;
719 current[0].iov_len = SMB2_HDR_BODY;
720
721 current[1].iov_base = (void *)outbody;
722 current[1].iov_len = 8;
723
724 current[2].iov_base = NULL;
725 current[2].iov_len = 0;
726
727 /* setup the SMB2 header */
728 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
729 SSVAL(outhdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
730 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
731 SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
732 SIVAL(outhdr, SMB2_HDR_STATUS,
733 NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
734 SSVAL(outhdr, SMB2_HDR_OPCODE,
735 SVAL(inhdr, SMB2_HDR_OPCODE));
736 SIVAL(outhdr, SMB2_HDR_FLAGS,
737 IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
738 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
739 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
740 BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
741 SIVAL(outhdr, SMB2_HDR_PID,
742 IVAL(inhdr, SMB2_HDR_PID));
743 SIVAL(outhdr, SMB2_HDR_TID,
744 IVAL(inhdr, SMB2_HDR_TID));
745 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
746 BVAL(inhdr, SMB2_HDR_SESSION_ID));
747 memcpy(outhdr + SMB2_HDR_SIGNATURE,
748 inhdr + SMB2_HDR_SIGNATURE, 16);
749
750 /* setup error body header */
751 SSVAL(outbody, 0x00, 0x08 + 1);
752 SSVAL(outbody, 0x02, 0);
753 SIVAL(outbody, 0x04, 0);
754 }
755
756 req->out.vector = vector;
757 req->out.vector_count = count;
758
759 /* setup the length of the NBT packet */
760 smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
761
762 DLIST_ADD_END(req->sconn->smb2.requests, req, struct smbd_smb2_request *);
763
764 return NT_STATUS_OK;
765 }
766
767 void smbd_server_connection_terminate_ex(struct smbd_server_connection *sconn,
768 const char *reason,
769 const char *location)
770 {
771 DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
772 reason, location));
773 exit_server_cleanly(reason);
774 }
775
776 static bool dup_smb2_vec3(TALLOC_CTX *ctx,
777 struct iovec *outvec,
778 const struct iovec *srcvec)
779 {
780 /* vec[0] is always boilerplate and must
781 * be allocated with size OUTVEC_ALLOC_SIZE. */
782
783 outvec[0].iov_base = talloc_memdup(ctx,
784 srcvec[0].iov_base,
785 OUTVEC_ALLOC_SIZE);
786 if (!outvec[0].iov_base) {
787 return false;
788 }
789 outvec[0].iov_len = SMB2_HDR_BODY;
790
791 /*
792 * If this is a "standard" vec[1] of length 8,
793 * pointing to srcvec[0].iov_base + SMB2_HDR_BODY,
794 * then duplicate this. Else use talloc_memdup().
795 */
796
797 if (srcvec[1].iov_len == 8 &&
798 srcvec[1].iov_base ==
799 ((uint8_t *)srcvec[0].iov_base) +
800 SMB2_HDR_BODY) {
801 outvec[1].iov_base = ((uint8_t *)outvec[0].iov_base) +
802 SMB2_HDR_BODY;
803 outvec[1].iov_len = 8;
804 } else {
805 outvec[1].iov_base = talloc_memdup(ctx,
806 srcvec[1].iov_base,
807 srcvec[1].iov_len);
808 if (!outvec[1].iov_base) {
809 return false;
810 }
811 outvec[1].iov_len = srcvec[1].iov_len;
812 }
813
814 /*
815 * If this is a "standard" vec[2] of length 1,
816 * pointing to srcvec[0].iov_base + (OUTVEC_ALLOC_SIZE - 1)
817 * then duplicate this. Else use talloc_memdup().
818 */
819
820 if (srcvec[2].iov_base &&
821 srcvec[2].iov_len) {
822 if (srcvec[2].iov_base ==
823 ((uint8_t *)srcvec[0].iov_base) +
824 (OUTVEC_ALLOC_SIZE - 1) &&
825 srcvec[2].iov_len == 1) {
826 /* Common SMB2 error packet case. */
827 outvec[2].iov_base = ((uint8_t *)outvec[0].iov_base) +
828 (OUTVEC_ALLOC_SIZE - 1);
829 } else {
830 outvec[2].iov_base = talloc_memdup(ctx,
831 srcvec[2].iov_base,
832 srcvec[2].iov_len);
833 if (!outvec[2].iov_base) {
834 return false;
835 }
836 }
837 outvec[2].iov_len = srcvec[2].iov_len;
838 } else {
839 outvec[2].iov_base = NULL;
840 outvec[2].iov_len = 0;
841 }
842 return true;
843 }
844
845 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
846 {
847 struct smbd_smb2_request *newreq = NULL;
848 struct iovec *outvec = NULL;
849 int count = req->out.vector_count;
850 int i;
851
852 newreq = smbd_smb2_request_allocate(req->sconn);
853 if (!newreq) {
854 return NULL;
855 }
856
857 newreq->sconn = req->sconn;
858 newreq->session = req->session;
859 newreq->do_signing = req->do_signing;
860 newreq->current_idx = req->current_idx;
861
862 outvec = talloc_zero_array(newreq, struct iovec, count);
863 if (!outvec) {
864 TALLOC_FREE(newreq);
865 return NULL;
866 }
867 newreq->out.vector = outvec;
868 newreq->out.vector_count = count;
869
870 /* Setup the outvec's identically to req. */
871 outvec[0].iov_base = newreq->out.nbt_hdr;
872 outvec[0].iov_len = 4;
873 memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
874
875 /* Setup the vectors identically to the ones in req. */
876 for (i = 1; i < count; i += 3) {
877 if (!dup_smb2_vec3(outvec, &outvec[i], &req->out.vector[i])) {
878 break;
879 }
880 }
881
882 if (i < count) {
883 /* Alloc failed. */
884 TALLOC_FREE(newreq);
885 return NULL;
886 }
887
888 smb2_setup_nbt_length(newreq->out.vector,
889 newreq->out.vector_count);
890
891 return newreq;
892 }
893
894 static void smbd_smb2_request_writev_done(struct tevent_req *subreq);
895
896 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
897 {
898 int i = 0;
899 uint8_t *outhdr = NULL;
900 struct smbd_smb2_request *nreq = NULL;
901
902 /* Create a new smb2 request we'll use
903 for the interim return. */
904 nreq = dup_smb2_req(req);
905 if (!nreq) {
906 return NT_STATUS_NO_MEMORY;
907 }
908
909 /* Lose the last 3 out vectors. They're the
910 ones we'll be using for the async reply. */
911 nreq->out.vector_count -= 3;
912
913 smb2_setup_nbt_length(nreq->out.vector,
914 nreq->out.vector_count);
915
916 /* Step back to the previous reply. */
917 i = nreq->current_idx - 3;
918 outhdr = (uint8_t *)nreq->out.vector[i].iov_base;
919 /* And end the chain. */
920 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
921
922 /* Calculate outgoing credits */
923 smb2_calculate_credits(req, nreq);
924
925 /* Re-sign if needed. */
926 if (nreq->do_signing) {
927 NTSTATUS status;
928 struct smbXsrv_session *x = nreq->session;
929 struct smbXsrv_connection *conn = x->connection;
930 DATA_BLOB signing_key = x->global->channels[0].signing_key;
931
932 status = smb2_signing_sign_pdu(signing_key,
933 conn->protocol,
934 &nreq->out.vector[i], 3);
935 if (!NT_STATUS_IS_OK(status)) {
936 return status;
937 }
938 }
939 if (DEBUGLEVEL >= 10) {
940 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
941 (unsigned int)nreq->current_idx );
942 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
943 (unsigned int)nreq->out.vector_count );
944 print_req_vectors(nreq);
945 }
946 nreq->subreq = tstream_writev_queue_send(nreq,
947 nreq->sconn->ev_ctx,
948 nreq->sconn->smb2.stream,
949 nreq->sconn->smb2.send_queue,
950 nreq->out.vector,
951 nreq->out.vector_count);
952
953 if (nreq->subreq == NULL) {
954 return NT_STATUS_NO_MEMORY;
955 }
956
957 tevent_req_set_callback(nreq->subreq,
958 smbd_smb2_request_writev_done,
959 nreq);
960
961 return NT_STATUS_OK;
962 }
963
964 struct smbd_smb2_request_pending_state {
965 struct smbd_server_connection *sconn;
966 uint8_t buf[4 + SMB2_HDR_BODY + 0x08 + 1];
967 struct iovec vector[3];
968 };
969
970 static void smbd_smb2_request_pending_writev_done(struct tevent_req *subreq)
971 {
972 struct smbd_smb2_request_pending_state *state =
973 tevent_req_callback_data(subreq,
974 struct smbd_smb2_request_pending_state);
975 struct smbd_server_connection *sconn = state->sconn;
976 int ret;
977 int sys_errno;
978
979 ret = tstream_writev_queue_recv(subreq, &sys_errno);
980 TALLOC_FREE(subreq);
981 if (ret == -1) {
982 NTSTATUS status = map_nt_error_from_unix(sys_errno);
983 smbd_server_connection_terminate(sconn, nt_errstr(status));
984 return;
985 }
986
987 TALLOC_FREE(state);
988 }
989
990 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
991 struct tevent_timer *te,
992 struct timeval current_time,
993 void *private_data);
994
995 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
996 struct tevent_req *subreq,
997 uint32_t defer_time)
998 {
999 NTSTATUS status;
1000 int i = req->current_idx;
1001 struct timeval defer_endtime;
1002 uint8_t *outhdr = NULL;
1003 uint32_t flags;
1004
1005 if (!tevent_req_is_in_progress(subreq)) {
1006 return NT_STATUS_OK;
1007 }
1008
1009 req->subreq = subreq;
1010 subreq = NULL;
1011
1012 if (req->async_te) {
1013 /* We're already async. */
1014 return NT_STATUS_OK;
1015 }
1016
1017 outhdr = (uint8_t *)req->out.vector[i].iov_base;
1018 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1019 if (flags & SMB2_HDR_FLAG_ASYNC) {
1020 /* We're already async. */
1021 return NT_STATUS_OK;
1022 }
1023
1024 if (req->in.vector_count > i + 3) {
1025 /*
1026 * We're trying to go async in a compound
1027 * request chain. This is not allowed.
1028 * Cancel the outstanding request.
1029 */
1030 tevent_req_cancel(req->subreq);
1031 return smbd_smb2_request_error(req,
1032 NT_STATUS_INSUFFICIENT_RESOURCES);
1033 }
1034
1035 if (DEBUGLEVEL >= 10) {
1036 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
1037 (unsigned int)req->current_idx );
1038 print_req_vectors(req);
1039 }
1040
1041 if (req->out.vector_count > 4) {
1042 struct iovec *outvec = NULL;
1043
1044 /* This is a compound reply. We
1045 * must do an interim response
1046 * followed by the async response
1047 * to match W2K8R2.
1048 */
1049 status = smb2_send_async_interim_response(req);
1050 if (!NT_STATUS_IS_OK(status)) {
1051 return status;
1052 }
1053
1054 /*
1055 * We're splitting off the last SMB2
1056 * request in a compound set, and the
1057 * smb2_send_async_interim_response()
1058 * call above just sent all the replies
1059 * for the previous SMB2 requests in
1060 * this compound set. So we're no longer
1061 * in the "compound_related_in_progress"
1062 * state, and this is no longer a compound
1063 * request.
1064 */
1065 req->compound_related = false;
1066 req->sconn->smb2.compound_related_in_progress = false;
1067
1068 /* Re-arrange the in.vectors. */
1069 req->in.vector[1] = req->in.vector[i];
1070 req->in.vector[2] = req->in.vector[i+1];
1071 req->in.vector[3] = req->in.vector[i+2];
1072 req->in.vector_count = 4;
1073
1074 /* Reset the new in size. */
1075 smb2_setup_nbt_length(req->in.vector, 4);
1076
1077 /* Now recreate the out.vectors. */
1078 outvec = talloc_zero_array(req, struct iovec, 4);
1079 if (!outvec) {
1080 return NT_STATUS_NO_MEMORY;
1081 }
1082
1083 /* 0 is always boilerplate and must
1084 * be of size 4 for the length field. */
1085
1086 outvec[0].iov_base = req->out.nbt_hdr;
1087 outvec[0].iov_len = 4;
1088 SIVAL(req->out.nbt_hdr, 0, 0);
1089
1090 if (!dup_smb2_vec3(outvec, &outvec[1], &req->out.vector[i])) {
1091 return NT_STATUS_NO_MEMORY;
1092 }
1093
1094 TALLOC_FREE(req->out.vector);
1095
1096 req->out.vector = outvec;
1097
1098 req->current_idx = 1;
1099 req->out.vector_count = 4;
1100
1101 outhdr = (uint8_t *)req->out.vector[1].iov_base;
1102 flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
1103 SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
1104 }
1105
1106 defer_endtime = timeval_current_ofs_usec(defer_time);
1107 req->async_te = tevent_add_timer(req->sconn->ev_ctx,
1108 req, defer_endtime,
1109 smbd_smb2_request_pending_timer,
1110 req);
1111 if (req->async_te == NULL) {
1112 return NT_STATUS_NO_MEMORY;
1113 }
1114
1115 return NT_STATUS_OK;
1116 }
1117
1118 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1119 struct tevent_timer *te,
1120 struct timeval current_time,
1121 void *private_data)
1122 {
1123 struct smbd_smb2_request *req =
1124 talloc_get_type_abort(private_data,
1125 struct smbd_smb2_request);
1126 struct smbd_smb2_request_pending_state *state = NULL;
1127 int i = req->current_idx;
1128 uint8_t *outhdr = NULL;
1129 const uint8_t *inhdr = NULL;
1130 uint8_t *hdr = NULL;
1131 uint8_t *body = NULL;
1132 uint32_t flags = 0;
1133 uint64_t message_id = 0;
1134 uint64_t async_id = 0;
1135 struct tevent_req *subreq = NULL;
1136
1137 TALLOC_FREE(req->async_te);
1138
1139 /* Ensure our final reply matches the interim one. */
1140 inhdr = (const uint8_t *)req->in.vector[1].iov_base;
1141 outhdr = (uint8_t *)req->out.vector[1].iov_base;
1142 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1143 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1144
1145 async_id = message_id; /* keep it simple for now... */
1146
1147 SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1148 SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
1149
1150 DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1151 "going async\n",
1152 smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
1153 (unsigned long long)async_id ));
1154
1155 /*
1156 * What we send is identical to a smbd_smb2_request_error
1157 * packet with an error status of STATUS_PENDING. Make use
1158 * of this fact sometime when refactoring. JRA.
1159 */
1160
1161 state = talloc_zero(req->sconn, struct smbd_smb2_request_pending_state);
1162 if (state == NULL) {
1163 smbd_server_connection_terminate(req->sconn,
1164 nt_errstr(NT_STATUS_NO_MEMORY));
1165 return;
1166 }
1167 state->sconn = req->sconn;
1168
1169 state->vector[0].iov_base = (void *)state->buf;
1170 state->vector[0].iov_len = 4;
1171
1172 state->vector[1].iov_base = state->buf + 4;
1173 state->vector[1].iov_len = SMB2_HDR_BODY;
1174
1175 state->vector[2].iov_base = state->buf + 4 + SMB2_HDR_BODY;
1176 state->vector[2].iov_len = 9;
1177
1178 smb2_setup_nbt_length(state->vector, 3);
1179
1180 hdr = (uint8_t *)state->vector[1].iov_base;
1181 body = (uint8_t *)state->vector[2].iov_base;
1182
1183 SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1184 SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1185 SSVAL(hdr, SMB2_HDR_EPOCH, 0);
1186 SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
1187 SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
1188
1189 SIVAL(hdr, SMB2_HDR_FLAGS, flags);
1190 SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
1191 SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
1192 SBVAL(hdr, SMB2_HDR_PID, async_id);
1193 SBVAL(hdr, SMB2_HDR_SESSION_ID,
1194 BVAL(outhdr, SMB2_HDR_SESSION_ID));
1195 memcpy(hdr+SMB2_HDR_SIGNATURE,
1196 outhdr+SMB2_HDR_SIGNATURE, 16);
1197
1198 SSVAL(body, 0x00, 0x08 + 1);
1199
1200 SCVAL(body, 0x02, 0);
1201 SCVAL(body, 0x03, 0);
1202 SIVAL(body, 0x04, 0);
1203 /* Match W2K8R2... */
1204 SCVAL(body, 0x08, 0x21);
1205
1206 /* Ensure we correctly go through crediting. Grant
1207 the credits now, and zero credits on the final
1208 response. */
1209 smb2_set_operation_credit(req->sconn,
1210 &req->in.vector[i],
1211 &state->vector[1]);
1212
1213 SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1214
1215 if (req->do_signing) {
1216 NTSTATUS status;
1217 struct smbXsrv_session *x = req->session;
1218 struct smbXsrv_connection *conn = x->connection;
1219 DATA_BLOB signing_key = x->global->channels[0].signing_key;
1220
1221 status = smb2_signing_sign_pdu(signing_key,
1222 conn->protocol,
1223 &state->vector[1], 2);
1224 if (!NT_STATUS_IS_OK(status)) {
1225 smbd_server_connection_terminate(req->sconn,
1226 nt_errstr(status));
1227 return;
1228 }
1229 }
1230
1231 subreq = tstream_writev_queue_send(state,
1232 state->sconn->ev_ctx,
1233 state->sconn->smb2.stream,
1234 state->sconn->smb2.send_queue,
1235 state->vector,
1236 3);
1237 if (subreq == NULL) {
1238 smbd_server_connection_terminate(state->sconn,
1239 nt_errstr(NT_STATUS_NO_MEMORY));
1240 return;
1241 }
1242 tevent_req_set_callback(subreq,
1243 smbd_smb2_request_pending_writev_done,
1244 state);
1245 }
1246
1247 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
1248 {
1249 struct smbd_server_connection *sconn = req->sconn;
1250 struct smbd_smb2_request *cur;
1251 const uint8_t *inhdr;
1252 int i = req->current_idx;
1253 uint32_t flags;
1254 uint64_t search_message_id;
1255 uint64_t search_async_id;
1256 uint64_t found_id;
1257
1258 inhdr = (const uint8_t *)req->in.vector[i].iov_base;
1259
1260 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1261 search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1262 search_async_id = BVAL(inhdr, SMB2_HDR_PID);
1263
1264 /*
1265 * we don't need the request anymore
1266 * cancel requests never have a response
1267 */
1268 DLIST_REMOVE(req->sconn->smb2.requests, req);
1269 TALLOC_FREE(req);
1270
1271 for (cur = sconn->smb2.requests; cur; cur = cur->next) {
1272 const uint8_t *outhdr;
1273 uint64_t message_id;
1274 uint64_t async_id;
1275
1276 i = cur->current_idx;
1277
1278 outhdr = (const uint8_t *)cur->out.vector[i].iov_base;
1279
1280 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1281 async_id = BVAL(outhdr, SMB2_HDR_PID);
1282
1283 if (flags & SMB2_HDR_FLAG_ASYNC) {
1284 if (search_async_id == async_id) {
1285 found_id = async_id;
1286 break;
1287 }
1288 } else {
1289 if (search_message_id == message_id) {
1290 found_id = message_id;
1291 break;
1292 }
1293 }
1294 }
1295
1296 if (cur && cur->subreq) {
1297 inhdr = (const uint8_t *)cur->in.vector[i].iov_base;
1298 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1299 "cancel opcode[%s] mid %llu\n",
1300 smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
1301 (unsigned long long)found_id ));
1302 tevent_req_cancel(cur->subreq);
1303 }
1304
1305 return NT_STATUS_OK;
1306 }
1307
1308 /*************************************************************
1309 Ensure an incoming tid is a valid one for us to access.
1310 Change to the associated uid credentials and chdir to the
1311 valid tid directory.
1312 *************************************************************/
1313
1314 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
1315 {
1316 const uint8_t *inhdr;
1317 int i = req->current_idx;
1318 uint32_t in_flags;
1319 uint32_t in_tid;
1320 struct smbXsrv_tcon0 *tcon;
1321 NTSTATUS status;
1322 NTTIME now = timeval_to_nttime(&req->request_time);
1323
1324 req->tcon = NULL;
1325
1326 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
1327
1328 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1329 in_tid = IVAL(inhdr, SMB2_HDR_TID);
1330
1331 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1332 in_tid = req->last_tid;
1333 }
1334
1335 status = smb2srv_tcon_lookup(req->session,
1336 in_tid, now, &tcon);
1337 if (!NT_STATUS_IS_OK(status)) {
1338 return status;
1339 }
1340
1341 if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
1342 return NT_STATUS_ACCESS_DENIED;
1343 }
1344
1345 /* should we pass FLAG_CASELESS_PATHNAMES here? */
1346 if (!set_current_service(tcon->compat, 0, true)) {
1347 return NT_STATUS_ACCESS_DENIED;
1348 }
1349
1350 req->tcon = tcon;
1351 req->last_tid = in_tid;
1352
1353 return NT_STATUS_OK;
1354 }
1355
1356 /*************************************************************
1357 Ensure an incoming session_id is a valid one for us to access.
1358 *************************************************************/
1359
1360 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
1361 {
1362 const uint8_t *inhdr;
1363 int i = req->current_idx;
1364 uint32_t in_flags;
1365 uint16_t in_opcode;
1366 uint64_t in_session_id;
1367 struct smbXsrv_session *session = NULL;
1368 struct auth_session_info *session_info;
1369 NTSTATUS status;
1370 NTTIME now = timeval_to_nttime(&req->request_time);
1371
1372 req->session = NULL;
1373 req->tcon = NULL;
1374
1375 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
1376
1377 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1378 in_opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
1379 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
1380
1381 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1382 in_session_id = req->last_session_id;
1383 }
1384
1385 /* lookup an existing session */
1386 status = smb2srv_session_lookup(req->sconn->conn,
1387 in_session_id, now,
1388 &session);
1389 if (session) {
1390 req->session = session;
1391 req->last_session_id = in_session_id;
1392 }
1393 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1394 switch (in_opcode) {
1395 case SMB2_OP_SESSSETUP:
1396 status = NT_STATUS_OK;
1397 break;
1398 default:
1399 break;
1400 }
1401 }
1402 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1403 switch (in_opcode) {
1404 case SMB2_OP_TCON:
1405 case SMB2_OP_CREATE:
1406 case SMB2_OP_GETINFO:
1407 case SMB2_OP_SETINFO:
1408 return NT_STATUS_INVALID_HANDLE;
1409 default:
1410 /*
1411 * Notice the check for
1412 * (session_info == NULL)
1413 * below.
1414 */
1415 status = NT_STATUS_OK;
1416 break;
1417 }
1418 }
1419 if (!NT_STATUS_IS_OK(status)) {
1420 return status;
1421 }
1422
1423 session_info = session->global->auth_session_info;
1424 if (session_info == NULL) {
1425 return NT_STATUS_INVALID_HANDLE;
1426 }
1427
1428 set_current_user_info(session_info->unix_info->sanitized_username,
1429 session_info->unix_info->unix_name,
1430 session_info->info->domain_name);
1431
1432 return NT_STATUS_OK;
1433 }
1434
1435 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
1436 uint32_t data_length)
1437 {
1438 uint16_t needed_charge;
1439 uint16_t credit_charge = 1;
1440 const uint8_t *inhdr;
1441 int i = req->current_idx;
1442
1443 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
1444
1445 if (req->sconn->smb2.supports_multicredit) {
1446 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
1447 credit_charge = MAX(credit_charge, 1);
1448 }
1449
1450 needed_charge = (data_length - 1)/ 65536 + 1;
1451
1452 DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
1453 (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
1454 credit_charge, needed_charge));
1455
1456 if (needed_charge > credit_charge) {
1457 DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
1458 credit_charge, needed_charge));
1459 return NT_STATUS_INVALID_PARAMETER;
1460 }
1461
1462 return NT_STATUS_OK;
1463 }
1464
1465 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
1466 size_t expected_body_size)
1467 {
1468 const uint8_t *inhdr;
1469 uint16_t opcode;
1470 const uint8_t *inbody;
1471 int i = req->current_idx;
1472 size_t body_size;
1473 size_t min_dyn_size = expected_body_size & 0x00000001;
1474
1475 /*
1476 * The following should be checked already.
1477 */
1478 if ((i+2) > req->in.vector_count) {
1479 return NT_STATUS_INTERNAL_ERROR;
1480 }
1481 if (req->in.vector[i+0].iov_len != SMB2_HDR_BODY) {
1482 return NT_STATUS_INTERNAL_ERROR;
1483 }
1484 if (req->in.vector[i+1].iov_len < 2) {
1485 return NT_STATUS_INTERNAL_ERROR;
1486 }
1487
1488 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
1489 opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1490
1491 switch (opcode) {
1492 case SMB2_OP_IOCTL:
1493 case SMB2_OP_GETINFO:
1494 min_dyn_size = 0;
1495 break;
1496 }
1497
1498 /*
1499 * Now check the expected body size,
1500 * where the last byte might be in the
1501 * dynamic section..
1502 */
1503 if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
1504 return NT_STATUS_INVALID_PARAMETER;
1505 }
1506 if (req->in.vector[i+2].iov_len < min_dyn_size) {
1507 return NT_STATUS_INVALID_PARAMETER;
1508 }
1509
1510 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
1511
1512 body_size = SVAL(inbody, 0x00);
1513 if (body_size != expected_body_size) {
1514 return NT_STATUS_INVALID_PARAMETER;
1515 }
1516
1517 return NT_STATUS_OK;
1518 }
1519
1520 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
1521 {
1522 const uint8_t *inhdr;
1523 int i = req->current_idx;
1524 uint16_t opcode;
1525 uint32_t flags;
1526 uint64_t mid;
1527 NTSTATUS status;
1528 NTSTATUS session_status;
1529 uint32_t allowed_flags;
1530 NTSTATUS return_value;
1531 struct smbXsrv_session *x = NULL;
1532 bool signing_required = false;
1533
1534 inhdr = (const uint8_t *)req->in.vector[i].iov_base;
1535
1536 /* TODO: verify more things */
1537
1538 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1539 opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
1540 mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1541 DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
1542 smb2_opcode_name(opcode),
1543 (unsigned long long)mid));
1544
1545 if (get_Protocol() >= PROTOCOL_SMB2_02) {
1546 /*
1547 * once the protocol is negotiated
1548 * SMB2_OP_NEGPROT is not allowed anymore
1549 */
1550 if (opcode == SMB2_OP_NEGPROT) {
1551 /* drop the connection */
1552 return NT_STATUS_INVALID_PARAMETER;
1553 }
1554 } else {
1555 /*
1556 * if the protocol is not negotiated yet
1557 * only SMB2_OP_NEGPROT is allowed.
1558 */
1559 if (opcode != SMB2_OP_NEGPROT) {
1560 /* drop the connection */
1561 return NT_STATUS_INVALID_PARAMETER;
1562 }
1563 }
1564
1565 allowed_flags = SMB2_HDR_FLAG_CHAINED |
1566 SMB2_HDR_FLAG_SIGNED |
1567 SMB2_HDR_FLAG_DFS;
1568 if (opcode == SMB2_OP_CANCEL) {
1569 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
1570 }
1571 if ((flags & ~allowed_flags) != 0) {
1572 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
1573 }
1574
1575 /*
1576 * Check if the client provided a valid session id,
1577 * if so smbd_smb2_request_check_session() calls
1578 * set_current_user_info().
1579 *
1580 * As some command don't require a valid session id
1581 * we defer the check of the session_status
1582 */
1583 session_status = smbd_smb2_request_check_session(req);
1584 x = req->session;
1585
1586 if (x != NULL) {
1587 signing_required = x->global->signing_required;
1588
1589 if (opcode == SMB2_OP_SESSSETUP &&
1590 x->global->channels[0].signing_key.length) {
1591 signing_required = true;
1592 }
1593 }
1594
1595 req->do_signing = false;
1596 if (flags & SMB2_HDR_FLAG_SIGNED) {
1597 struct smbXsrv_connection *conn = x->connection;
1598 DATA_BLOB signing_key = x->global->channels[0].signing_key;
1599
1600 if (!NT_STATUS_IS_OK(session_status)) {
1601 return smbd_smb2_request_error(req, session_status);
1602 }
1603
1604 req->do_signing = true;
1605 status = smb2_signing_check_pdu(signing_key,
1606 conn->protocol,
1607 &req->in.vector[i], 3);
1608 if (!NT_STATUS_IS_OK(status)) {
1609 return smbd_smb2_request_error(req, status);
1610 }
1611 } else if (opcode == SMB2_OP_CANCEL) {
1612 /* Cancel requests are allowed to skip the signing */
1613 } else if (signing_required) {
1614 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
1615 }
1616
1617 if (flags & SMB2_HDR_FLAG_CHAINED) {
1618 /*
1619 * This check is mostly for giving the correct error code
1620 * for compounded requests.
1621 *
1622 * TODO: we may need to move this after the session
1623 * and tcon checks.
1624 */
1625 if (!NT_STATUS_IS_OK(req->next_status)) {
1626 return smbd_smb2_request_error(req, req->next_status);
1627 }
1628 } else {
1629 req->compat_chain_fsp = NULL;
1630 }
1631
1632 if (req->compound_related) {
1633 req->sconn->smb2.compound_related_in_progress = true;
1634 }
1635
1636 switch (opcode) {
1637 case SMB2_OP_NEGPROT:
1638 /* This call needs to be run as root */
1639 change_to_root_user();
1640
1641 {
1642 START_PROFILE(smb2_negprot);
1643 return_value = smbd_smb2_request_process_negprot(req);
1644 END_PROFILE(smb2_negprot);
1645 }
1646 break;
1647
1648 case SMB2_OP_SESSSETUP:
1649 /* This call needs to be run as root */
1650 change_to_root_user();
1651
1652 {
1653 START_PROFILE(smb2_sesssetup);
1654 return_value = smbd_smb2_request_process_sesssetup(req);
1655 END_PROFILE(smb2_sesssetup);
1656 }
1657 break;
1658
1659 case SMB2_OP_LOGOFF:
1660 if (!NT_STATUS_IS_OK(session_status)) {
1661 return_value = smbd_smb2_request_error(req, session_status);
1662 break;
1663 }
1664
1665 /* This call needs to be run as root */
1666 change_to_root_user();
1667
1668 {
1669 START_PROFILE(smb2_logoff);
1670 return_value = smbd_smb2_request_process_logoff(req);
1671 END_PROFILE(smb2_logoff);
1672 }
1673 break;
1674
1675 case SMB2_OP_TCON:
1676 if (!NT_STATUS_IS_OK(session_status)) {
1677 return_value = smbd_smb2_request_error(req, session_status);
1678 break;
1679 }
1680
1681 /*
1682 * This call needs to be run as root.
1683 *
1684 * smbd_smb2_request_process_tcon()
1685 * calls make_connection_snum(), which will call
1686 * change_to_user(), when needed.
1687 */
1688 change_to_root_user();
1689
1690 {
1691 START_PROFILE(smb2_tcon);
1692 return_value = smbd_smb2_request_process_tcon(req);
1693 END_PROFILE(smb2_tcon);
1694 }
1695 break;
1696
1697 case SMB2_OP_TDIS:
1698 if (!NT_STATUS_IS_OK(session_status)) {
1699 return_value = smbd_smb2_request_error(req, session_status);
1700 break;
1701 }
1702 /*
1703 * This call needs to be run as user.
1704 *
1705 * smbd_smb2_request_check_tcon()
1706 * calls change_to_user() on success.
1707 */
1708 status = smbd_smb2_request_check_tcon(req);
1709 if (!NT_STATUS_IS_OK(status)) {
1710 return_value = smbd_smb2_request_error(req, status);
1711 break;
1712 }
1713 /* This call needs to be run as root */
1714 change_to_root_user();
1715
1716
1717 {
1718 START_PROFILE(smb2_tdis);
1719 return_value = smbd_smb2_request_process_tdis(req);
1720 END_PROFILE(smb2_tdis);
1721 }
1722 break;
1723
1724 case SMB2_OP_CREATE:
1725 if (!NT_STATUS_IS_OK(session_status)) {
1726 return_value = smbd_smb2_request_error(req, session_status);
1727 break;
1728 }
1729 /*
1730 * This call needs to be run as user.
1731 *
1732 * smbd_smb2_request_check_tcon()
1733 * calls change_to_user() on success.
1734 */
1735 status = smbd_smb2_request_check_tcon(req);
1736 if (!NT_STATUS_IS_OK(status)) {
1737 return_value = smbd_smb2_request_error(req, status);
1738 break;
1739 }
1740
1741 {
1742 START_PROFILE(smb2_create);
1743 return_value = smbd_smb2_request_process_create(req);
1744 END_PROFILE(smb2_create);
1745 }
1746 break;
1747
1748 case SMB2_OP_CLOSE:
1749 if (!NT_STATUS_IS_OK(session_status)) {
1750 return_value = smbd_smb2_request_error(req, session_status);
1751 break;
1752 }
1753 /*
1754 * This call needs to be run as user.
1755 *
1756 * smbd_smb2_request_check_tcon()
1757 * calls change_to_user() on success.
1758 */
1759 status = smbd_smb2_request_check_tcon(req);
1760 if (!NT_STATUS_IS_OK(status)) {
1761 return_value = smbd_smb2_request_error(req, status);
1762 break;
1763 }
1764
1765 {
1766 START_PROFILE(smb2_close);
1767 return_value = smbd_smb2_request_process_close(req);
1768 END_PROFILE(smb2_close);
1769 }
1770 break;
1771
1772 case SMB2_OP_FLUSH:
1773 if (!NT_STATUS_IS_OK(session_status)) {
1774 return_value = smbd_smb2_request_error(req, session_status);
1775 break;
1776 }
1777 /*
1778 * This call needs to be run as user.
1779 *
1780 * smbd_smb2_request_check_tcon()
1781 * calls change_to_user() on success.
1782 */
1783 status = smbd_smb2_request_check_tcon(req);
1784 if (!NT_STATUS_IS_OK(status)) {
1785 return_value = smbd_smb2_request_error(req, status);
1786 break;
1787 }
1788
1789 {
1790 START_PROFILE(smb2_flush);
1791 return_value = smbd_smb2_request_process_flush(req);
1792 END_PROFILE(smb2_flush);
1793 }
1794 break;
1795
1796 case SMB2_OP_READ:
1797 if (!NT_STATUS_IS_OK(session_status)) {
1798 return_value = smbd_smb2_request_error(req, session_status);
1799 break;
1800 }
1801 /*
1802 * This call needs to be run as user.
1803 *
1804 * smbd_smb2_request_check_tcon()
1805 * calls change_to_user() on success.
1806 */
1807 status = smbd_smb2_request_check_tcon(req);
1808 if (!NT_STATUS_IS_OK(status)) {
1809 return_value = smbd_smb2_request_error(req, status);
1810 break;
1811 }
1812
1813 {
1814 START_PROFILE(smb2_read);
1815 return_value = smbd_smb2_request_process_read(req);
1816 END_PROFILE(smb2_read);
1817 }
1818 break;
1819
1820 case SMB2_OP_WRITE:
1821 if (!NT_STATUS_IS_OK(session_status)) {
1822 return_value = smbd_smb2_request_error(req, session_status);
1823 break;
1824 }
1825 /*
1826 * This call needs to be run as user.
1827 *
1828 * smbd_smb2_request_check_tcon()
1829 * calls change_to_user() on success.
1830 */
1831 status = smbd_smb2_request_check_tcon(req);
1832 if (!NT_STATUS_IS_OK(status)) {
1833 return_value = smbd_smb2_request_error(req, status);
1834 break;
1835 }
1836
1837 {
1838 START_PROFILE(smb2_write);
1839 return_value = smbd_smb2_request_process_write(req);
1840 END_PROFILE(smb2_write);
1841 }
1842 break;
1843
1844 case SMB2_OP_LOCK:
1845 if (!NT_STATUS_IS_OK(session_status)) {
1846 /* Too ugly to live ? JRA. */
1847 if (NT_STATUS_EQUAL(session_status,NT_STATUS_USER_SESSION_DELETED)) {
1848 session_status = NT_STATUS_FILE_CLOSED;
1849 }
1850 return_value = smbd_smb2_request_error(req, session_status);
1851 break;
1852 }
1853 /*
1854 * This call needs to be run as user.
1855 *
1856 * smbd_smb2_request_check_tcon()
1857 * calls change_to_user() on success.
1858 */
1859 status = smbd_smb2_request_check_tcon(req);
1860 if (!NT_STATUS_IS_OK(status)) {
1861 /* Too ugly to live ? JRA. */
1862 if (NT_STATUS_EQUAL(status,NT_STATUS_NETWORK_NAME_DELETED)) {
1863 status = NT_STATUS_FILE_CLOSED;
1864 }
1865 return_value = smbd_smb2_request_error(req, status);
1866 break;
1867 }
1868
1869 {
1870 START_PROFILE(smb2_lock);
1871 return_value = smbd_smb2_request_process_lock(req);
1872 END_PROFILE(smb2_lock);
1873 }
1874 break;
1875
1876 case SMB2_OP_IOCTL:
1877 if (!NT_STATUS_IS_OK(session_status)) {
1878 return_value = smbd_smb2_request_error(req, session_status);
1879 break;
1880 }
1881 /*
1882 * This call needs to be run as user.
1883 *
1884 * smbd_smb2_request_check_tcon()
1885 * calls change_to_user() on success.
1886 */
1887 status = smbd_smb2_request_check_tcon(req);
1888 if (!NT_STATUS_IS_OK(status)) {
1889 return_value = smbd_smb2_request_error(req, status);
1890 break;
1891 }
1892
1893 {
1894 START_PROFILE(smb2_ioctl);
1895 return_value = smbd_smb2_request_process_ioctl(req);
1896 END_PROFILE(smb2_ioctl);
1897 }
1898 break;
1899
1900 case SMB2_OP_CANCEL:
1901 /*
1902 * This call needs to be run as root
1903 *
1904 * That is what we also do in the SMB1 case.
1905 */
1906 change_to_root_user();
1907
1908 {
1909 START_PROFILE(smb2_cancel);
1910 return_value = smbd_smb2_request_process_cancel(req);
1911 END_PROFILE(smb2_cancel);
1912 }
1913 break;
1914
1915 case SMB2_OP_KEEPALIVE:
1916 /* This call needs to be run as root */
1917 change_to_root_user();
1918
1919 {
1920 START_PROFILE(smb2_keepalive);
1921 return_value = smbd_smb2_request_process_keepalive(req);
1922 END_PROFILE(smb2_keepalive);
1923 }
1924 break;
1925
1926 case SMB2_OP_FIND:
1927 if (!NT_STATUS_IS_OK(session_status)) {
1928 return_value = smbd_smb2_request_error(req, session_status);
1929 break;
1930 }
1931 /*
1932 * This call needs to be run as user.
1933 *
1934 * smbd_smb2_request_check_tcon()
1935 * calls change_to_user() on success.
1936 */
1937 status = smbd_smb2_request_check_tcon(req);
1938 if (!NT_STATUS_IS_OK(status)) {
1939 return_value = smbd_smb2_request_error(req, status);
1940 break;
1941 }
1942
1943 {
1944 START_PROFILE(smb2_find);
1945 return_value = smbd_smb2_request_process_find(req);
1946 END_PROFILE(smb2_find);
1947 }
1948 break;
1949
1950 case SMB2_OP_NOTIFY:
1951 if (!NT_STATUS_IS_OK(session_status)) {
1952 return_value = smbd_smb2_request_error(req, session_status);
1953 break;
1954 }
1955 /*
1956 * This call needs to be run as user.
1957 *
1958 * smbd_smb2_request_check_tcon()
1959 * calls change_to_user() on success.
1960 */
1961 status = smbd_smb2_request_check_tcon(req);
1962 if (!NT_STATUS_IS_OK(status)) {
1963 return_value = smbd_smb2_request_error(req, status);
1964 break;
1965 }
1966
1967 {
1968 START_PROFILE(smb2_notify);
1969 return_value = smbd_smb2_request_process_notify(req);
1970 END_PROFILE(smb2_notify);
1971 }
1972 break;
1973
1974 case SMB2_OP_GETINFO:
1975 if (!NT_STATUS_IS_OK(session_status)) {
1976 return_value = smbd_smb2_request_error(req, session_status);
1977 break;
1978 }
1979 /*
1980 * This call needs to be run as user.
1981 *
1982 * smbd_smb2_request_check_tcon()
1983 * calls change_to_user() on success.
1984 */
1985 status = smbd_smb2_request_check_tcon(req);
1986 if (!NT_STATUS_IS_OK(status)) {
1987 return_value = smbd_smb2_request_error(req, status);
1988 break;
1989 }
1990
1991 {
1992 START_PROFILE(smb2_getinfo);
1993 return_value = smbd_smb2_request_process_getinfo(req);
1994 END_PROFILE(smb2_getinfo);
1995 }
1996 break;
1997
1998 case SMB2_OP_SETINFO:
1999 if (!NT_STATUS_IS_OK(session_status)) {
2000 return_value = smbd_smb2_request_error(req, session_status);
2001 break;
2002 }
2003 /*
2004 * This call needs to be run as user.
2005 *
2006 * smbd_smb2_request_check_tcon()
2007 * calls change_to_user() on success.
2008 */
2009 status = smbd_smb2_request_check_tcon(req);
2010 if (!NT_STATUS_IS_OK(status)) {
2011 return_value = smbd_smb2_request_error(req, status);
2012 break;
2013 }
2014
2015 {
2016 START_PROFILE(smb2_setinfo);
2017 return_value = smbd_smb2_request_process_setinfo(req);
2018 END_PROFILE(smb2_setinfo);
2019 }
2020 break;
2021
2022 case SMB2_OP_BREAK:
2023 if (!NT_STATUS_IS_OK(session_status)) {
2024 return_value = smbd_smb2_request_error(req, session_status);
2025 break;
2026 }
2027 /*
2028 * This call needs to be run as user.
2029 *
2030 * smbd_smb2_request_check_tcon()
2031 * calls change_to_user() on success.
2032 */
2033 status = smbd_smb2_request_check_tcon(req);
2034 if (!NT_STATUS_IS_OK(status)) {
2035 return_value = smbd_smb2_request_error(req, status);
2036 break;
2037 }
2038
2039 {
2040 START_PROFILE(smb2_break);
2041 return_value = smbd_smb2_request_process_break(req);
2042 END_PROFILE(smb2_break);
2043 }
2044 break;
2045
2046 default:
2047 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2048 break;
2049 }
2050 return return_value;
2051 }
2052
2053 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
2054 {
2055 struct tevent_req *subreq;
2056 int i = req->current_idx;
2057
2058 req->subreq = NULL;
2059 TALLOC_FREE(req->async_te);
2060
2061 req->current_idx += 3;
2062
2063 if (req->current_idx < req->out.vector_count) {
2064 /*
2065 * We must process the remaining compound
2066 * SMB2 requests before any new incoming SMB2
2067 * requests. This is because incoming SMB2
2068 * requests may include a cancel for a
2069 * compound request we haven't processed
2070 * yet.
2071 */
2072 struct tevent_immediate *im = tevent_create_immediate(req);
2073 if (!im) {
2074 return NT_STATUS_NO_MEMORY;
2075 }
2076 tevent_schedule_immediate(im,
2077 req->sconn->ev_ctx,
2078 smbd_smb2_request_dispatch_immediate,
2079 req);
2080 return NT_STATUS_OK;
2081 }
2082
2083 if (req->compound_related) {
2084 req->sconn->smb2.compound_related_in_progress = false;
2085 }
2086
2087 smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
2088
2089 /* Set credit for these operations (zero credits if this
2090 is a final reply for an async operation). */
2091 smb2_calculate_credits(req, req);
2092
2093 if (req->do_signing) {
2094 NTSTATUS status;
2095 struct smbXsrv_session *x = req->session;
2096 struct smbXsrv_connection *conn = x->connection;
2097 DATA_BLOB signing_key = x->global->channels[0].signing_key;
2098
2099 status = smb2_signing_sign_pdu(signing_key,
2100 conn->protocol,
2101 &req->out.vector[i], 3);
2102 if (!NT_STATUS_IS_OK(status)) {
2103 return status;
2104 }
2105 }
2106
2107 if (DEBUGLEVEL >= 10) {
2108 dbgtext("smbd_smb2_request_reply: sending...\n");
2109 print_req_vectors(req);
2110 }
2111
2112 /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
2113 if (req->out.vector_count == 4 &&
2114 req->out.vector[3].iov_base == NULL &&
2115 req->out.vector[3].iov_len != 0) {
2116 /* Dynamic part is NULL. Chop it off,
2117 We're going to send it via sendfile. */
2118 req->out.vector_count -= 1;
2119 }
2120
2121 subreq = tstream_writev_queue_send(req,
2122 req->sconn->ev_ctx,
2123 req->sconn->smb2.stream,
2124 req->sconn->smb2.send_queue,
2125 req->out.vector,
2126 req->out.vector_count);
2127 if (subreq == NULL) {
2128 return NT_STATUS_NO_MEMORY;
2129 }
2130 tevent_req_set_callback(subreq, smbd_smb2_request_writev_done, req);
2131 /*
2132 * We're done with this request -
2133 * move it off the "being processed" queue.
2134 */
2135 DLIST_REMOVE(req->sconn->smb2.requests, req);
2136
2137 return NT_STATUS_OK;
2138 }
2139
2140 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn);
2141
2142 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
2143 struct tevent_immediate *im,
2144 void *private_data)
2145 {
2146 struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
2147 struct smbd_smb2_request);
2148 struct smbd_server_connection *sconn = req->sconn;
2149 NTSTATUS status;
2150
2151 TALLOC_FREE(im);
2152
2153 if (DEBUGLEVEL >= 10) {
2154 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
2155 req->current_idx, req->in.vector_count));
2156 print_req_vectors(req);
2157 }
2158
2159 status = smbd_smb2_request_dispatch(req);
2160 if (!NT_STATUS_IS_OK(status)) {
2161 smbd_server_connection_terminate(sconn, nt_errstr(status));
2162 return;
2163 }
2164
2165 status = smbd_smb2_request_next_incoming(sconn);
2166 if (!NT_STATUS_IS_OK(status)) {
2167 smbd_server_connection_terminate(sconn, nt_errstr(status));
2168 return;
2169 }
2170 }
2171
2172 static void smbd_smb2_request_writev_done(struct tevent_req *subreq)
2173 {
2174 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
2175 struct smbd_smb2_request);
2176 struct smbd_server_connection *sconn = req->sconn;
2177 int ret;
2178 int sys_errno;
2179 NTSTATUS status;
2180
2181 ret = tstream_writev_queue_recv(subreq, &sys_errno);
2182 TALLOC_FREE(subreq);
2183 TALLOC_FREE(req);
2184 if (ret == -1) {
2185 status = map_nt_error_from_unix(sys_errno);
2186 DEBUG(2,("smbd_smb2_request_writev_done: client write error %s\n",
2187 nt_errstr(status)));
2188 smbd_server_connection_terminate(sconn, nt_errstr(status));
2189 return;
2190 }
2191
2192 status = smbd_smb2_request_next_incoming(sconn);
2193 if (!NT_STATUS_IS_OK(status)) {
2194 smbd_server_connection_terminate(sconn, nt_errstr(status));
2195 return;
2196 }
2197 }
2198
2199 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
2200 NTSTATUS status,
2201 DATA_BLOB body, DATA_BLOB *dyn,
2202 const char *location)
2203 {
2204 uint8_t *outhdr;
2205 int i = req->current_idx;
2206 uint32_t next_command_ofs;
2207
2208 DEBUG(10,("smbd_smb2_request_done_ex: "
2209 "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
2210 i, nt_errstr(status), (unsigned int)body.length,
2211 dyn ? "yes": "no",
2212 (unsigned int)(dyn ? dyn->length : 0),
2213 location));
2214
2215 if (body.length < 2) {
2216 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2217 }
2218
2219 if ((body.length % 2) != 0) {
2220 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2221 }
2222
2223 outhdr = (uint8_t *)req->out.vector[i].iov_base;
2224
2225 next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
2226 SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
2227
2228 req->out.vector[i+1].iov_base = (void *)body.data;
2229 req->out.vector[i+1].iov_len = body.length;
2230
2231 if (dyn) {
2232 req->out.vector[i+2].iov_base = (void *)dyn->data;
2233 req->out.vector[i+2].iov_len = dyn->length;
2234 } else {
2235 req->out.vector[i+2].iov_base = NULL;
2236 req->out.vector[i+2].iov_len = 0;
2237 }
2238
2239 /* see if we need to recalculate the offset to the next response */
2240 if (next_command_ofs > 0) {
2241 next_command_ofs = SMB2_HDR_BODY;
2242 next_command_ofs += req->out.vector[i+1].iov_len;
2243 next_command_ofs += req->out.vector[i+2].iov_len;
2244 }
2245
2246 if ((next_command_ofs % 8) != 0) {
2247 size_t pad_size = 8 - (next_command_ofs % 8);
2248 if (req->out.vector[i+2].iov_len == 0) {
2249 /*
2250 * if the dyn buffer is empty
2251 * we can use it to add padding
2252 */
2253 uint8_t *pad;
2254
2255 pad = talloc_zero_array(req->out.vector,
2256 uint8_t, pad_size);
2257 if (pad == NULL) {
2258 return smbd_smb2_request_error(req,
2259 NT_STATUS_NO_MEMORY);
2260 }
2261
2262 req->out.vector[i+2].iov_base = (void *)pad;
2263 req->out.vector[i+2].iov_len = pad_size;
2264 } else {
2265 /*
2266 * For now we copy the dynamic buffer
2267 * and add the padding to the new buffer
2268 */
2269 size_t old_size;
2270 uint8_t *old_dyn;
2271 size_t new_size;
2272 uint8_t *new_dyn;
2273
2274 old_size = req->out.vector[i+2].iov_len;
2275 old_dyn = (uint8_t *)req->out.vector[i+2].iov_base;
2276
2277 new_size = old_size + pad_size;
2278 new_dyn = talloc_zero_array(req->out.vector,
2279 uint8_t, new_size);
2280 if (new_dyn == NULL) {
2281 return smbd_smb2_request_error(req,
2282 NT_STATUS_NO_MEMORY);
2283 }
2284
2285 memcpy(new_dyn, old_dyn, old_size);
2286 memset(new_dyn + old_size, 0, pad_size);
2287
2288 req->out.vector[i+2].iov_base = (void *)new_dyn;
2289 req->out.vector[i+2].iov_len = new_size;
2290 }
2291 next_command_ofs += pad_size;
2292 }
2293
2294 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
2295
2296 return smbd_smb2_request_reply(req);
2297 }
2298
2299 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
2300 NTSTATUS status,
2301 DATA_BLOB *info,
2302 const char *location)
2303 {
2304 DATA_BLOB body;
2305 int i = req->current_idx;
2306 uint8_t *outhdr = (uint8_t *)req->out.vector[i].iov_base;
2307
2308 DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
2309 i, nt_errstr(status), info ? " +info" : "",
2310 location));
2311
2312 body.data = outhdr + SMB2_HDR_BODY;
2313 body.length = 8;
2314 SSVAL(body.data, 0, 9);
2315
2316 if (info) {
2317 SIVAL(body.data, 0x04, info->length);
2318 } else {
2319 /* Allocated size of req->out.vector[i].iov_base
2320 * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
2321 * 1 byte without having to do an alloc.
2322 */
2323 info = talloc_zero_array(req->out.vector,
2324 DATA_BLOB,
2325 1);
2326 if (!info) {
2327 return NT_STATUS_NO_MEMORY;
2328 }
2329 info->data = ((uint8_t *)outhdr) +
2330 OUTVEC_ALLOC_SIZE - 1;
2331 info->length = 1;
2332 SCVAL(info->data, 0, 0);
2333 }
2334
2335 /*
2336 * if a request fails, all other remaining
2337 * compounded requests should fail too
2338 */
2339 req->next_status = NT_STATUS_INVALID_PARAMETER;
2340
2341 return smbd_smb2_request_done_ex(req, status, body, info, __location__);
2342 }
2343
2344
2345 struct smbd_smb2_send_oplock_break_state {
2346 struct smbd_server_connection *sconn;
2347 uint8_t buf[4 + SMB2_HDR_BODY + 0x18];
2348 struct iovec vector;
2349 };
2350
2351 static void smbd_smb2_oplock_break_writev_done(struct tevent_req *subreq);
2352
2353 NTSTATUS smbd_smb2_send_oplock_break(struct smbd_server_connection *sconn,
2354 uint64_t file_id_persistent,
2355 uint64_t file_id_volatile,
2356 uint8_t oplock_level)
2357 {
2358 struct smbd_smb2_send_oplock_break_state *state;
2359 struct tevent_req *subreq;
2360 uint8_t *hdr;
2361 uint8_t *body;
2362
2363 state = talloc(sconn, struct smbd_smb2_send_oplock_break_state);
2364 if (state == NULL) {
2365 return NT_STATUS_NO_MEMORY;
2366 }
2367 state->sconn = sconn;
2368
2369 state->vector.iov_base = (void *)state->buf;
2370 state->vector.iov_len = sizeof(state->buf);
2371
2372 _smb2_setlen(state->buf, sizeof(state->buf) - 4);
2373 hdr = state->buf + 4;
2374 body = hdr + SMB2_HDR_BODY;
2375
2376 SIVAL(hdr, 0, SMB2_MAGIC);
2377 SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
2378 SSVAL(hdr, SMB2_HDR_EPOCH, 0);
2379 SIVAL(hdr, SMB2_HDR_STATUS, 0);
2380 SSVAL(hdr, SMB2_HDR_OPCODE, SMB2_OP_BREAK);
2381 SSVAL(hdr, SMB2_HDR_CREDIT, 0);
2382 SIVAL(hdr, SMB2_HDR_FLAGS, SMB2_HDR_FLAG_REDIRECT);
2383 SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
2384 SBVAL(hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
2385 SIVAL(hdr, SMB2_HDR_PID, 0);
2386 SIVAL(hdr, SMB2_HDR_TID, 0);
2387 SBVAL(hdr, SMB2_HDR_SESSION_ID, 0);
2388 memset(hdr+SMB2_HDR_SIGNATURE, 0, 16);
2389
2390 SSVAL(body, 0x00, 0x18);
2391
2392 SCVAL(body, 0x02, oplock_level);
2393 SCVAL(body, 0x03, 0); /* reserved */
2394 SIVAL(body, 0x04, 0); /* reserved */
2395 SBVAL(body, 0x08, file_id_persistent);
2396 SBVAL(body, 0x10, file_id_volatile);
2397
2398 subreq = tstream_writev_queue_send(state,
2399 sconn->ev_ctx,
2400 sconn->smb2.stream,
2401 sconn->smb2.send_queue,
2402 &state->vector, 1);
2403 if (subreq == NULL) {
2404 return NT_STATUS_NO_MEMORY;
2405 }
2406 tevent_req_set_callback(subreq,
2407 smbd_smb2_oplock_break_writev_done,
2408 state);
2409
2410 return NT_STATUS_OK;
2411 }
2412
2413 static void smbd_smb2_oplock_break_writev_done(struct tevent_req *subreq)
2414 {
2415 struct smbd_smb2_send_oplock_break_state *state =
2416 tevent_req_callback_data(subreq,
2417 struct smbd_smb2_send_oplock_break_state);
2418 struct smbd_server_connection *sconn = state->sconn;
2419 int ret;
2420 int sys_errno;
2421
2422 ret = tstream_writev_queue_recv(subreq, &sys_errno);
2423 TALLOC_FREE(subreq);
2424 if (ret == -1) {
2425 NTSTATUS status = map_nt_error_from_unix(sys_errno);
2426 smbd_server_connection_terminate(sconn, nt_errstr(status));
2427 return;
2428 }
2429
2430 TALLOC_FREE(state);
2431 }
2432
2433 struct smbd_smb2_request_read_state {
2434 size_t missing;
2435 bool asked_for_header;
2436 struct smbd_smb2_request *smb2_req;
2437 };
2438
2439 static int smbd_smb2_request_next_vector(struct tstream_context *stream,
2440 void *private_data,
2441 TALLOC_CTX *mem_ctx,
2442 struct iovec **_vector,
2443 size_t *_count);
2444 static void smbd_smb2_request_read_done(struct tevent_req *subreq);
2445
2446 static struct tevent_req *smbd_smb2_request_read_send(TALLOC_CTX *mem_ctx,
2447 struct tevent_context *ev,
2448 struct smbd_server_connection *sconn)
2449 {
2450 struct tevent_req *req;
2451 struct smbd_smb2_request_read_state *state;
2452 struct tevent_req *subreq;
2453
2454 req = tevent_req_create(mem_ctx, &state,
2455 struct smbd_smb2_request_read_state);
2456 if (req == NULL) {
2457 return NULL;
2458 }
2459 state->missing = 0;
2460 state->asked_for_header = false;
2461
2462 state->smb2_req = smbd_smb2_request_allocate(state);
2463 if (tevent_req_nomem(state->smb2_req, req)) {
2464 return tevent_req_post(req, ev);
2465 }
2466 state->smb2_req->sconn = sconn;
2467
2468 subreq = tstream_readv_pdu_queue_send(state, ev, sconn->smb2.stream,
2469 sconn->smb2.recv_queue,
2470 smbd_smb2_request_next_vector,
2471 state);
2472 if (tevent_req_nomem(subreq, req)) {
2473 return tevent_req_post(req, ev);
2474 }
2475 tevent_req_set_callback(subreq, smbd_smb2_request_read_done, req);
2476
2477 return req;
2478 }
2479
2480 static int smbd_smb2_request_next_vector(struct tstream_context *stream,
2481 void *private_data,
2482 TALLOC_CTX *mem_ctx,
2483 struct iovec **_vector,
2484 size_t *_count)
2485 {
2486 struct smbd_smb2_request_read_state *state =
2487 talloc_get_type_abort(private_data,
2488 struct smbd_smb2_request_read_state);
2489 struct smbd_smb2_request *req = state->smb2_req;
2490 struct iovec *vector;
2491 int idx = req->in.vector_count;
2492 size_t len = 0;
2493 uint8_t *buf = NULL;
2494
2495 if (req->in.vector_count == 0) {
2496 /*
2497 * first we need to get the NBT header
2498 */
2499 req->in.vector = talloc_array(req, struct iovec,
2500 req->in.vector_count + 1);
2501 if (req->in.vector == NULL) {
2502 return -1;
2503 }
2504 req->in.vector_count += 1;
2505
2506 req->in.vector[idx].iov_base = (void *)req->in.nbt_hdr;
2507 req->in.vector[idx].iov_len = 4;
2508
2509 vector = talloc_array(mem_ctx, struct iovec, 1);
2510 if (vector == NULL) {
2511 return -1;
2512 }
2513
2514 vector[0] = req->in.vector[idx];
2515
2516 *_vector = vector;
2517 *_count = 1;
2518 return 0;
2519 }
2520
2521 if (req->in.vector_count == 1) {
2522 /*
2523 * Now we analyze the NBT header
2524 */
2525 state->missing = smb2_len(req->in.vector[0].iov_base);
2526
2527 if (state->missing == 0) {
2528 /* if there're no remaining bytes, we're done */
2529 *_vector = NULL;
2530 *_count = 0;
2531 return 0;
2532 }
2533
2534 req->in.vector = talloc_realloc(req, req->in.vector,
2535 struct iovec,
2536 req->in.vector_count + 1);
2537 if (req->in.vector == NULL) {
2538 return -1;
2539 }
2540 req->in.vector_count += 1;
2541
2542 if (CVAL(req->in.vector[0].iov_base, 0) != 0) {
2543 /*
2544 * it's a special NBT message,
2545 * so get all remaining bytes
2546 */
2547 len = state->missing;
2548 } else if (state->missing < (SMB2_HDR_BODY + 2)) {
2549 /*
2550 * it's an invalid message, just read what we can get
2551 * and let the caller handle the error
2552 */
2553 len = state->missing;
2554 } else {
2555 /*
2556 * We assume it's a SMB2 request,
2557 * and we first get the header and the
2558 * first 2 bytes (the struct size) of the body
2559 */
2560 len = SMB2_HDR_BODY + 2;
2561
2562 state->asked_for_header = true;
2563 }
2564
2565 state->missing -= len;
2566
2567 buf = talloc_array(req->in.vector, uint8_t, len);
2568 if (buf == NULL) {
2569 return -1;
2570 }
2571
2572 req->in.vector[idx].iov_base = (void *)buf;
2573 req->in.vector[idx].iov_len = len;
2574
2575 vector = talloc_array(mem_ctx, struct iovec, 1);
2576 if (vector == NULL) {
2577 return -1;
2578 }
2579
2580 vector[0] = req->in.vector[idx];
2581
2582 *_vector = vector;
2583 *_count = 1;
2584 return 0;
2585 }
2586
2587 if (state->missing == 0) {
2588 /* if there're no remaining bytes, we're done */
2589 *_vector = NULL;
2590 *_count = 0;
2591 return 0;
2592 }
2593
2594 if (state->asked_for_header) {
2595 const uint8_t *hdr;
2596 size_t full_size;
2597 size_t next_command_ofs;
2598 size_t body_size;
2599 uint8_t *body;
2600 size_t dyn_size;
2601 uint8_t *dyn;
2602 bool invalid = false;
2603
2604 state->asked_for_header = false;
2605
2606 /*
2607 * We got the SMB2 header and the first 2 bytes
2608 * of the body. We fix the size to just the header
2609 * and manually copy the 2 first bytes to the body section
2610 */
2611 req->in.vector[idx-1].iov_len = SMB2_HDR_BODY;
2612 hdr = (const uint8_t *)req->in.vector[idx-1].iov_base;
2613
2614 /* allocate vectors for body and dynamic areas */
2615 req->in.vector = talloc_realloc(req, req->in.vector,
2616 struct iovec,
2617 req->in.vector_count + 2);
2618 if (req->in.vector == NULL) {
2619 return -1;
2620 }
2621 req->in.vector_count += 2;
2622
2623 full_size = state->missing + SMB2_HDR_BODY + 2;
2624 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
2625 body_size = SVAL(hdr, SMB2_HDR_BODY);
2626
2627 if (next_command_ofs != 0) {
2628 if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
2629 /*
2630 * this is invalid, just return a zero
2631 * body and let the caller deal with the error
2632 */
2633 invalid = true;
2634 } else if (next_command_ofs > full_size) {
2635 /*
2636 * this is invalid, just return a zero
2637 * body and let the caller deal with the error
2638 */
2639 invalid = true;
2640 } else {
2641 full_size = next_command_ofs;
2642 }
2643 }
2644
2645 if (!invalid) {
2646 if (body_size < 2) {
2647 /*
2648 * this is invalid, just return a zero
2649 * body and let the caller deal with the error
2650 */
2651 invalid = true;
2652 }
2653
2654 /*
2655 * Mask out the lowest bit, the "dynamic" part
2656 * of body_size.
2657 */
2658 body_size &= ~1;
2659
2660 if (body_size > (full_size - SMB2_HDR_BODY)) {
2661 /*
2662 * this is invalid, just return a zero
2663 * body and let the caller deal with the error
2664 */
2665 invalid = true;
2666 }
2667 }
2668
2669 if (invalid) {
2670 /* the caller should check this */
2671 body_size = 2;
2672 }
2673
2674 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
2675
2676 state->missing -= (body_size - 2) + dyn_size;
2677
2678 body = talloc_array(req->in.vector, uint8_t, body_size);
2679 if (body == NULL) {
2680 return -1;
2681 }
2682
2683 dyn = talloc_array(req->in.vector, uint8_t, dyn_size);
2684 if (dyn == NULL) {
2685 return -1;
2686 }
2687
2688 req->in.vector[idx].iov_base = (void *)body;
2689 req->in.vector[idx].iov_len = body_size;
2690 req->in.vector[idx+1].iov_base = (void *)dyn;
2691 req->in.vector[idx+1].iov_len = dyn_size;
2692
2693 vector = talloc_array(mem_ctx, struct iovec, 2);
2694 if (vector == NULL) {
2695 return -1;
2696 }
2697
2698 /*
2699 * the first 2 bytes of the body were already fetched
2700 * together with the header
2701 */
2702 memcpy(body, hdr + SMB2_HDR_BODY, 2);
2703 vector[0].iov_base = body + 2;
2704 vector[0].iov_len = body_size - 2;
2705
2706 vector[1] = req->in.vector[idx+1];
2707
2708 *_vector = vector;
2709 *_count = 2;
2710 return 0;
2711 }
2712
2713 /*
2714 * when we endup here, we're looking for a new SMB2 request
2715 * next. And we ask for its header and the first 2 bytes of
2716 * the body (like we did for the first SMB2 request).
2717 */
2718
2719 req->in.vector = talloc_realloc(req, req->in.vector,
2720 struct iovec,
2721 req->in.vector_count + 1);
2722 if (req->in.vector == NULL) {
2723 return -1;
2724 }
2725 req->in.vector_count += 1;
2726
2727 /*
2728 * We assume it's a SMB2 request,
2729 * and we first get the header and the
2730 * first 2 bytes (the struct size) of the body
2731 */
2732 len = SMB2_HDR_BODY + 2;
2733
2734 if (len > state->missing) {
2735 /* let the caller handle the error */
2736 len = state->missing;
2737 }
2738
2739 state->missing -= len;
2740 state->asked_for_header = true;
2741
2742 buf = talloc_array(req->in.vector, uint8_t, len);
2743 if (buf == NULL) {
2744 return -1;
2745 }
2746
2747 req->in.vector[idx].iov_base = (void *)buf;
2748 req->in.vector[idx].iov_len = len;
2749
2750 vector = talloc_array(mem_ctx, struct iovec, 1);
2751 if (vector == NULL) {
2752 return -1;
2753 }
2754
2755 vector[0] = req->in.vector[idx];
2756
2757 *_vector = vector;
2758 *_count = 1;
2759 return 0;
2760 }
2761
2762 static void smbd_smb2_request_read_done(struct tevent_req *subreq)
2763 {
2764 struct tevent_req *req =
2765 tevent_req_callback_data(subreq,
2766 struct tevent_req);
2767 int ret;
2768 int sys_errno;
2769 NTSTATUS status;
2770
2771 ret = tstream_readv_pdu_queue_recv(subreq, &sys_errno);
2772 if (ret == -1) {
2773 status = map_nt_error_from_unix(sys_errno);
2774 tevent_req_nterror(req, status);
2775 return;
2776 }
2777
2778 tevent_req_done(req);
2779 }
2780
2781 static NTSTATUS smbd_smb2_request_read_recv(struct tevent_req *req,
2782 TALLOC_CTX *mem_ctx,
2783 struct smbd_smb2_request **_smb2_req)
2784 {
2785 struct smbd_smb2_request_read_state *state =
2786 tevent_req_data(req,
2787 struct smbd_smb2_request_read_state);
2788 NTSTATUS status;
2789
2790 if (tevent_req_is_nterror(req, &status)) {
2791 tevent_req_received(req);
2792 return status;
2793 }
2794
2795 talloc_steal(mem_ctx, state->smb2_req->mem_pool);
2796 *_smb2_req = state->smb2_req;
2797 tevent_req_received(req);
2798 return NT_STATUS_OK;
2799 }
2800
2801 static void smbd_smb2_request_incoming(struct tevent_req *subreq);
2802
2803 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn)
2804 {
2805 size_t max_send_queue_len;
2806 size_t cur_send_queue_len;
2807 struct tevent_req *subreq;
2808
2809 if (sconn->smb2.compound_related_in_progress) {
2810 /*
2811 * Can't read another until the related
2812 * compound is done.
2813 */
2814 return NT_STATUS_OK;
2815 }
2816
2817 if (tevent_queue_length(sconn->smb2.recv_queue) > 0) {
2818 /*
2819 * if there is already a smbd_smb2_request_read
2820 * pending, we are done.
2821 */
2822 return NT_STATUS_OK;
2823 }
2824
2825 max_send_queue_len = MAX(1, sconn->smb2.max_credits/16);
2826 cur_send_queue_len = tevent_queue_length(sconn->smb2.send_queue);
2827
2828 if (cur_send_queue_len > max_send_queue_len) {
2829 /*
2830 * if we have a lot of requests to send,
2831 * we wait until they are on the wire until we
2832 * ask for the next request.
2833 */
2834 return NT_STATUS_OK;
2835 }
2836
2837 /* ask for the next request */
2838 subreq = smbd_smb2_request_read_send(sconn, sconn->ev_ctx, sconn);
2839 if (subreq == NULL) {
2840 return NT_STATUS_NO_MEMORY;
2841 }
2842 tevent_req_set_callback(subreq, smbd_smb2_request_incoming, sconn);
2843
2844 return NT_STATUS_OK;
2845 }
2846
2847 void smbd_smb2_first_negprot(struct smbd_server_connection *sconn,
2848 const uint8_t *inbuf, size_t size)
2849 {
2850 NTSTATUS status;
2851 struct smbd_smb2_request *req = NULL;
2852
2853 DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
2854 (unsigned int)size));
2855
2856 status = smbd_initialize_smb2(sconn);
2857 if (!NT_STATUS_IS_OK(status)) {
2858 smbd_server_connection_terminate(sconn, nt_errstr(status));
2859 return;
2860 }
2861
2862 status = smbd_smb2_request_create(sconn, inbuf, size, &req);
2863 if (!NT_STATUS_IS_OK(status)) {
2864 smbd_server_connection_terminate(sconn, nt_errstr(status));
2865 return;
2866 }
2867
2868 status = smbd_smb2_request_validate(req);
2869 if (!NT_STATUS_IS_OK(status)) {
2870 smbd_server_connection_terminate(sconn, nt_errstr(status));
2871 return;
2872 }
2873
2874 status = smbd_smb2_request_setup_out(req);
2875 if (!NT_STATUS_IS_OK(status)) {
2876 smbd_server_connection_terminate(sconn, nt_errstr(status));
2877 return;
2878 }
2879
2880 status = smbd_smb2_request_dispatch(req);
2881 if (!NT_STATUS_IS_OK(status)) {
2882 smbd_server_connection_terminate(sconn, nt_errstr(status));
2883 return;
2884 }
2885
2886 status = smbd_smb2_request_next_incoming(sconn);
2887 if (!NT_STATUS_IS_OK(status)) {
2888 smbd_server_connection_terminate(sconn, nt_errstr(status));
2889 return;
2890 }
2891
2892 sconn->num_requests++;
2893 }
2894
2895 static void smbd_smb2_request_incoming(struct tevent_req *subreq)
2896 {
2897 struct smbd_server_connection *sconn = tevent_req_callback_data(subreq,
2898 struct smbd_server_connection);
2899 NTSTATUS status;
2900 struct smbd_smb2_request *req = NULL;
2901
2902 status = smbd_smb2_request_read_recv(subreq, sconn, &req);
2903 TALLOC_FREE(subreq);
2904 if (!NT_STATUS_IS_OK(status)) {
2905 DEBUG(2,("smbd_smb2_request_incoming: client read error %s\n",
2906 nt_errstr(status)));
2907 smbd_server_connection_terminate(sconn, nt_errstr(status));
2908 return;
2909 }
2910
2911 if (req->in.nbt_hdr[0] != 0x00) {
2912 DEBUG(1,("smbd_smb2_request_incoming: ignore NBT[0x%02X] msg\n",
2913 req->in.nbt_hdr[0]));
2914 TALLOC_FREE(req);
2915 goto next;
2916 }
2917
2918 req->current_idx = 1;
2919
2920 DEBUG(10,("smbd_smb2_request_incoming: idx[%d] of %d vectors\n",
2921 req->current_idx, req->in.vector_count));
2922
2923 status = smbd_smb2_request_validate(req);
2924 if (!NT_STATUS_IS_OK(status)) {
2925 smbd_server_connection_terminate(sconn, nt_errstr(status));
2926 return;
2927 }
2928
2929 status = smbd_smb2_request_setup_out(req);
2930 if (!NT_STATUS_IS_OK(status)) {
2931 smbd_server_connection_terminate(sconn, nt_errstr(status));
2932 return;
2933 }
2934
2935 status = smbd_smb2_request_dispatch(req);
2936 if (!NT_STATUS_IS_OK(status)) {
2937 smbd_server_connection_terminate(sconn, nt_errstr(status));
2938 return;
2939 }
2940
2941 next:
2942 status = smbd_smb2_request_next_incoming(sconn);
2943 if (!NT_STATUS_IS_OK(status)) {
2944 smbd_server_connection_terminate(sconn, nt_errstr(status));
2945 return;
2946 }
2947
2948 sconn->num_requests++;
2949
2950 /* The timeout_processing function isn't run nearly
2951 often enough to implement 'max log size' without
2952 overrunning the size of the file by many megabytes.
2953 This is especially true if we are running at debug
2954 level 10. Checking every 50 SMB2s is a nice
2955 tradeoff of performance vs log file size overrun. */
2956
2957 if ((sconn->num_requests % 50) == 0 &&
2958 need_to_check_log_size()) {
2959 change_to_root_user();
2960 check_log_size();
2961 }
2962 }
reg import