?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smb2_server: add SMB3 encryption support
[Samba/gebeck_regimport.git] / source3 / smbd / smb2_server.c
blob106e6acd0b21ae3846f03ddb18123c1f20e18eb2
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "smbprofile.h"
29 #include "../lib/util/bitmap.h"
30 #include "../librpc/gen_ndr/krb5pac.h"
31 #include "auth.h"
32
33 #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)
34
35 static const struct smbd_smb2_dispatch_table {
36 uint16_t opcode;
37 const char *name;
38 bool need_session;
39 bool need_tcon;
40 bool as_root;
41 uint16_t fileid_ofs;
42 bool allow_invalid_fileid;
43 } smbd_smb2_table[] = {
44 #define _OP(o) .opcode = o, .name = #o
45 {
46 _OP(SMB2_OP_NEGPROT),
47 .as_root = true,
48 },{
49 _OP(SMB2_OP_SESSSETUP),
50 .as_root = true,
51 },{
52 _OP(SMB2_OP_LOGOFF),
53 .need_session = true,
54 .as_root = true,
55 },{
56 _OP(SMB2_OP_TCON),
57 .need_session = true,
58 /*
59 * This call needs to be run as root.
60 *
61 * smbd_smb2_request_process_tcon()
62 * calls make_connection_snum(), which will call
63 * change_to_user(), when needed.
64 */
65 .as_root = true,
66 },{
67 _OP(SMB2_OP_TDIS),
68 .need_session = true,
69 .need_tcon = true,
70 .as_root = true,
71 },{
72 _OP(SMB2_OP_CREATE),
73 .need_session = true,
74 .need_tcon = true,
75 },{
76 _OP(SMB2_OP_CLOSE),
77 .need_session = true,
78 .need_tcon = true,
79 .fileid_ofs = 0x08,
80 },{
81 _OP(SMB2_OP_FLUSH),
82 .need_session = true,
83 .need_tcon = true,
84 .fileid_ofs = 0x08,
85 },{
86 _OP(SMB2_OP_READ),
87 .need_session = true,
88 .need_tcon = true,
89 .fileid_ofs = 0x10,
90 },{
91 _OP(SMB2_OP_WRITE),
92 .need_session = true,
93 .need_tcon = true,
94 .fileid_ofs = 0x10,
95 },{
96 _OP(SMB2_OP_LOCK),
97 .need_session = true,
98 .need_tcon = true,
99 .fileid_ofs = 0x08,
100 },{
101 _OP(SMB2_OP_IOCTL),
102 .need_session = true,
103 .need_tcon = true,
104 .fileid_ofs = 0x08,
105 .allow_invalid_fileid = true,
106 },{
107 _OP(SMB2_OP_CANCEL),
108 .as_root = true,
109 },{
110 _OP(SMB2_OP_KEEPALIVE),
111 .as_root = true,
112 },{
113 _OP(SMB2_OP_FIND),
114 .need_session = true,
115 .need_tcon = true,
116 .fileid_ofs = 0x08,
117 },{
118 _OP(SMB2_OP_NOTIFY),
119 .need_session = true,
120 .need_tcon = true,
121 .fileid_ofs = 0x08,
122 },{
123 _OP(SMB2_OP_GETINFO),
124 .need_session = true,
125 .need_tcon = true,
126 .fileid_ofs = 0x18,
127 },{
128 _OP(SMB2_OP_SETINFO),
129 .need_session = true,
130 .need_tcon = true,
131 .fileid_ofs = 0x10,
132 },{
133 _OP(SMB2_OP_BREAK),
134 .need_session = true,
135 .need_tcon = true,
136 /*
137 * we do not set
138 * .fileid_ofs here
139 * as LEASE breaks does not
140 * have a file id
141 */
142 }
143 };
144
145 const char *smb2_opcode_name(uint16_t opcode)
146 {
147 if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
148 return "Bad SMB2 opcode";
149 }
150 return smbd_smb2_table[opcode].name;
151 }
152
153 static const struct smbd_smb2_dispatch_table *smbd_smb2_call(uint16_t opcode)
154 {
155 const struct smbd_smb2_dispatch_table *ret = NULL;
156
157 if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
158 return NULL;
159 }
160
161 ret = &smbd_smb2_table[opcode];
162
163 SMB_ASSERT(ret->opcode == opcode);
164
165 return ret;
166 }
167
168 static void print_req_vectors(const struct smbd_smb2_request *req)
169 {
170 int i;
171
172 for (i = 0; i < req->in.vector_count; i++) {
173 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
174 (unsigned int)i,
175 (unsigned int)req->in.vector[i].iov_len);
176 }
177 for (i = 0; i < req->out.vector_count; i++) {
178 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
179 (unsigned int)i,
180 (unsigned int)req->out.vector[i].iov_len);
181 }
182 }
183
184 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
185 {
186 if (size < (4 + SMB2_HDR_BODY)) {
187 return false;
188 }
189
190 if (IVAL(inbuf, 4) != SMB2_MAGIC) {
191 return false;
192 }
193
194 return true;
195 }
196
197 static NTSTATUS smbd_initialize_smb2(struct smbd_server_connection *sconn)
198 {
199 NTSTATUS status;
200 int ret;
201
202 TALLOC_FREE(sconn->smb1.fde);
203
204 sconn->smb2.recv_queue = tevent_queue_create(sconn, "smb2 recv queue");
205 if (sconn->smb2.recv_queue == NULL) {
206 return NT_STATUS_NO_MEMORY;
207 }
208
209 sconn->smb2.send_queue = tevent_queue_create(sconn, "smb2 send queue");
210 if (sconn->smb2.send_queue == NULL) {
211 return NT_STATUS_NO_MEMORY;
212 }
213
214 sconn->smb2.seqnum_low = 0;
215 sconn->smb2.seqnum_range = 1;
216 sconn->smb2.credits_granted = 1;
217 sconn->smb2.max_credits = lp_smb2_max_credits();
218 sconn->smb2.credits_bitmap = bitmap_talloc(sconn,
219 sconn->smb2.max_credits);
220 if (sconn->smb2.credits_bitmap == NULL) {
221 return NT_STATUS_NO_MEMORY;
222 }
223
224 ret = tstream_bsd_existing_socket(sconn, sconn->sock,
225 &sconn->smb2.stream);
226 if (ret == -1) {
227 status = map_nt_error_from_unix(errno);
228 return status;
229 }
230
231 /* Ensure child is set to non-blocking mode */
232 set_blocking(sconn->sock, false);
233 return NT_STATUS_OK;
234 }
235
236 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
237 #define _smb2_setlen(_buf,len) do { \
238 uint8_t *buf = (uint8_t *)_buf; \
239 buf[0] = 0; \
240 buf[1] = ((len)&0xFF0000)>>16; \
241 buf[2] = ((len)&0xFF00)>>8; \
242 buf[3] = (len)&0xFF; \
243 } while (0)
244
245 static void smb2_setup_nbt_length(struct iovec *vector, int count)
246 {
247 size_t len = 0;
248 int i;
249
250 for (i=1; i < count; i++) {
251 len += vector[i].iov_len;
252 }
253
254 _smb2_setlen(vector[0].iov_base, len);
255 }
256
257 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
258 {
259 data_blob_clear_free(&req->first_key);
260 data_blob_clear_free(&req->last_key);
261 return 0;
262 }
263
264 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
265 {
266 TALLOC_CTX *mem_pool;
267 struct smbd_smb2_request *req;
268
269 #if 0
270 /* Enable this to find subtle valgrind errors. */
271 mem_pool = talloc_init("smbd_smb2_request_allocate");
272 #else
273 mem_pool = talloc_pool(mem_ctx, 8192);
274 #endif
275 if (mem_pool == NULL) {
276 return NULL;
277 }
278
279 req = talloc_zero(mem_pool, struct smbd_smb2_request);
280 if (req == NULL) {
281 talloc_free(mem_pool);
282 return NULL;
283 }
284 talloc_reparent(mem_pool, mem_ctx, req);
285 TALLOC_FREE(mem_pool);
286
287 req->last_session_id = UINT64_MAX;
288 req->last_tid = UINT32_MAX;
289
290 talloc_set_destructor(req, smbd_smb2_request_destructor);
291
292 return req;
293 }
294
295 static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *conn,
296 NTTIME now,
297 uint8_t *buf,
298 size_t buflen,
299 TALLOC_CTX *mem_ctx,
300 struct iovec **piov,
301 int *pnum_iov)
302 {
303 struct iovec *iov;
304 int num_iov = 1;
305 size_t taken = 0;
306 uint8_t *first_hdr = buf;
307 size_t verified_buflen = 0;
308 uint8_t *tf = NULL;
309 size_t tf_len = 0;
310
311 /*
312 * Note: index '0' is reserved for the transport protocol
313 */
314 iov = talloc_zero_array(mem_ctx, struct iovec, num_iov);
315 if (iov == NULL) {
316 return NT_STATUS_NO_MEMORY;
317 }
318
319 while (taken < buflen) {
320 size_t len = buflen - taken;
321 uint8_t *hdr = first_hdr + taken;
322 struct iovec *cur;
323 size_t full_size;
324 size_t next_command_ofs;
325 uint16_t body_size;
326 uint8_t *body = NULL;
327 uint32_t dyn_size;
328 uint8_t *dyn = NULL;
329 struct iovec *iov_tmp;
330
331 if (verified_buflen > taken) {
332 len = verified_buflen - taken;
333 } else {
334 tf = NULL;
335 tf_len = 0;
336 }
337
338 if (len < 4) {
339 DEBUG(10, ("%d bytes left, expected at least %d\n",
340 (int)len, 4));
341 goto inval;
342 }
343 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
344 struct smbXsrv_session *s = NULL;
345 uint64_t uid;
346 struct iovec tf_iov[2];
347 NTSTATUS status;
348 size_t enc_len;
349
350 if (conn->protocol < PROTOCOL_SMB2_24) {
351 DEBUG(10, ("Got SMB2_TRANSFORM header, "
352 "but dialect[0x%04X] is used\n",
353 conn->smb2.server.dialect));
354 goto inval;
355 }
356
357 if (!(conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
358 DEBUG(10, ("Got SMB2_TRANSFORM header, "
359 "but not negotiated "
360 "client[0x%08X] server[0x%08X]\n",
361 conn->smb2.client.capabilities,
362 conn->smb2.server.capabilities));
363 goto inval;
364 }
365
366 if (len < SMB2_TF_HDR_SIZE) {
367 DEBUG(1, ("%d bytes left, expected at least %d\n",
368 (int)len, SMB2_TF_HDR_SIZE));
369 goto inval;
370 }
371 tf = hdr;
372 tf_len = SMB2_TF_HDR_SIZE;
373 taken += tf_len;
374
375 hdr = first_hdr + taken;
376 enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
377 uid = BVAL(tf, SMB2_TF_SESSION_ID);
378
379 if (len < SMB2_TF_HDR_SIZE + enc_len) {
380 DEBUG(1, ("%d bytes left, expected at least %d\n",
381 (int)len,
382 (int)(SMB2_TF_HDR_SIZE + enc_len)));
383 goto inval;
384 }
385
386 status = smb2srv_session_lookup(conn, uid, now, &s);
387 if (s == NULL) {
388 DEBUG(1, ("invalid session[%llu] in "
389 "SMB2_TRANSFORM header\n",
390 (unsigned long long)uid));
391 TALLOC_FREE(iov);
392 return NT_STATUS_USER_SESSION_DELETED;
393 }
394
395 tf_iov[0].iov_base = (void *)tf;
396 tf_iov[0].iov_len = tf_len;
397 tf_iov[1].iov_base = (void *)hdr;
398 tf_iov[1].iov_len = enc_len;
399
400 status = smb2_signing_decrypt_pdu(s->global->decryption_key,
401 conn->protocol,
402 tf_iov, 2);
403 if (!NT_STATUS_IS_OK(status)) {
404 TALLOC_FREE(iov);
405 return status;
406 }
407
408 verified_buflen = taken + enc_len;
409 len = enc_len;
410 }
411
412 /*
413 * We need the header plus the body length field
414 */
415
416 if (len < SMB2_HDR_BODY + 2) {
417 DEBUG(10, ("%d bytes left, expected at least %d\n",
418 (int)len, SMB2_HDR_BODY));
419 goto inval;
420 }
421 if (IVAL(hdr, 0) != SMB2_MAGIC) {
422 DEBUG(10, ("Got non-SMB2 PDU: %x\n",
423 IVAL(hdr, 0)));
424 goto inval;
425 }
426 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
427 DEBUG(10, ("Got HDR len %d, expected %d\n",
428 SVAL(hdr, 4), SMB2_HDR_BODY));
429 goto inval;
430 }
431
432 full_size = len;
433 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
434 body_size = SVAL(hdr, SMB2_HDR_BODY);
435
436 if (next_command_ofs != 0) {
437 if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
438 goto inval;
439 }
440 if (next_command_ofs > full_size) {
441 goto inval;
442 }
443 full_size = next_command_ofs;
444 }
445 if (body_size < 2) {
446 goto inval;
447 }
448 body_size &= 0xfffe;
449
450 if (body_size > (full_size - SMB2_HDR_BODY)) {
451 /*
452 * let the caller handle the error
453 */
454 body_size = full_size - SMB2_HDR_BODY;
455 }
456 body = hdr + SMB2_HDR_BODY;
457 dyn = body + body_size;
458 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
459
460 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
461 num_iov + SMBD_SMB2_NUM_IOV_PER_REQ);
462 if (iov_tmp == NULL) {
463 TALLOC_FREE(iov);
464 return NT_STATUS_NO_MEMORY;
465 }
466 iov = iov_tmp;
467 cur = &iov[num_iov];
468 num_iov += SMBD_SMB2_NUM_IOV_PER_REQ;
469
470 cur[SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
471 cur[SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
472 cur[SMBD_SMB2_HDR_IOV_OFS].iov_base = hdr;
473 cur[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
474 cur[SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
475 cur[SMBD_SMB2_BODY_IOV_OFS].iov_len = body_size;
476 cur[SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
477 cur[SMBD_SMB2_DYN_IOV_OFS].iov_len = dyn_size;
478
479 taken += full_size;
480 }
481
482 *piov = iov;
483 *pnum_iov = num_iov;
484 return NT_STATUS_OK;
485
486 inval:
487 TALLOC_FREE(iov);
488 return NT_STATUS_INVALID_PARAMETER;
489 }
490
491 static NTSTATUS smbd_smb2_request_create(struct smbd_server_connection *sconn,
492 uint8_t *inbuf, size_t size,
493 struct smbd_smb2_request **_req)
494 {
495 struct smbd_smb2_request *req;
496 uint32_t protocol_version;
497 const uint8_t *inhdr = NULL;
498 uint16_t cmd;
499 uint32_t next_command_ofs;
500 NTSTATUS status;
501 NTTIME now;
502
503 if (size < (4 + SMB2_HDR_BODY + 2)) {
504 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
505 return NT_STATUS_INVALID_PARAMETER;
506 }
507
508 inhdr = inbuf + 4;
509
510 protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
511 if (protocol_version != SMB2_MAGIC) {
512 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
513 protocol_version));
514 return NT_STATUS_INVALID_PARAMETER;
515 }
516
517 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
518 if (cmd != SMB2_OP_NEGPROT) {
519 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
520 cmd));
521 return NT_STATUS_INVALID_PARAMETER;
522 }
523
524 next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
525 if (next_command_ofs != 0) {
526 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
527 next_command_ofs));
528 return NT_STATUS_INVALID_PARAMETER;
529 }
530
531 req = smbd_smb2_request_allocate(sconn);
532 if (req == NULL) {
533 return NT_STATUS_NO_MEMORY;
534 }
535 req->sconn = sconn;
536
537 talloc_steal(req, inbuf);
538
539 req->request_time = timeval_current();
540 now = timeval_to_nttime(&req->request_time);
541
542 status = smbd_smb2_inbuf_parse_compound(sconn->conn,
543 now,
544 inbuf + NBT_HDR_SIZE,
545 size - NBT_HDR_SIZE,
546 req, &req->in.vector,
547 &req->in.vector_count);
548 if (!NT_STATUS_IS_OK(status)) {
549 TALLOC_FREE(req);
550 return status;
551 }
552
553 req->current_idx = 1;
554
555 *_req = req;
556 return NT_STATUS_OK;
557 }
558
559 static bool smb2_validate_sequence_number(struct smbd_server_connection *sconn,
560 uint64_t message_id, uint64_t seq_id)
561 {
562 struct bitmap *credits_bm = sconn->smb2.credits_bitmap;
563 unsigned int offset;
564
565 if (seq_id < sconn->smb2.seqnum_low) {
566 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
567 "%llu (sequence id %llu) "
568 "(granted = %u, low = %llu, range = %u)\n",
569 (unsigned long long)message_id,
570 (unsigned long long)seq_id,
571 (unsigned int)sconn->smb2.credits_granted,
572 (unsigned long long)sconn->smb2.seqnum_low,
573 (unsigned int)sconn->smb2.seqnum_range));
574 return false;
575 }
576
577 if (seq_id >= sconn->smb2.seqnum_low + sconn->smb2.seqnum_range) {
578 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
579 "%llu (sequence id %llu) "
580 "(granted = %u, low = %llu, range = %u)\n",
581 (unsigned long long)message_id,
582 (unsigned long long)seq_id,
583 (unsigned int)sconn->smb2.credits_granted,
584 (unsigned long long)sconn->smb2.seqnum_low,
585 (unsigned int)sconn->smb2.seqnum_range));
586 return false;
587 }
588
589 offset = seq_id % sconn->smb2.max_credits;
590
591 if (bitmap_query(credits_bm, offset)) {
592 DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
593 "%llu (sequence id %llu) "
594 "(granted = %u, low = %llu, range = %u) "
595 "(bm offset %u)\n",
596 (unsigned long long)message_id,
597 (unsigned long long)seq_id,
598 (unsigned int)sconn->smb2.credits_granted,
599 (unsigned long long)sconn->smb2.seqnum_low,
600 (unsigned int)sconn->smb2.seqnum_range,
601 offset));
602 return false;
603 }
604
605 /* Mark the message_ids as seen in the bitmap. */
606 bitmap_set(credits_bm, offset);
607
608 if (seq_id != sconn->smb2.seqnum_low) {
609 return true;
610 }
611
612 /*
613 * Move the window forward by all the message_id's
614 * already seen.
615 */
616 while (bitmap_query(credits_bm, offset)) {
617 DEBUG(10,("smb2_validate_sequence_number: clearing "
618 "id %llu (position %u) from bitmap\n",
619 (unsigned long long)(sconn->smb2.seqnum_low),
620 offset));
621 bitmap_clear(credits_bm, offset);
622
623 sconn->smb2.seqnum_low += 1;
624 sconn->smb2.seqnum_range -= 1;
625 offset = sconn->smb2.seqnum_low % sconn->smb2.max_credits;
626 }
627
628 return true;
629 }
630
631 static bool smb2_validate_message_id(struct smbd_server_connection *sconn,
632 const uint8_t *inhdr)
633 {
634 uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
635 uint16_t opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
636 uint16_t credit_charge = 1;
637 uint64_t i;
638
639 if (opcode == SMB2_OP_CANCEL) {
640 /* SMB2_CANCEL requests by definition resend messageids. */
641 return true;
642 }
643
644 if (sconn->smb2.supports_multicredit) {
645 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
646 credit_charge = MAX(credit_charge, 1);
647 }
648
649 DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
650 "credits_granted %llu, "
651 "seqnum low/range: %llu/%llu\n",
652 (unsigned long long) message_id,
653 (unsigned long long) credit_charge,
654 (unsigned long long) sconn->smb2.credits_granted,
655 (unsigned long long) sconn->smb2.seqnum_low,
656 (unsigned long long) sconn->smb2.seqnum_range));
657
658 if (sconn->smb2.credits_granted < credit_charge) {
659 DEBUG(0, ("smb2_validate_message_id: client used more "
660 "credits than granted, mid %llu, charge %llu, "
661 "credits_granted %llu, "
662 "seqnum low/range: %llu/%llu\n",
663 (unsigned long long) message_id,
664 (unsigned long long) credit_charge,
665 (unsigned long long) sconn->smb2.credits_granted,
666 (unsigned long long) sconn->smb2.seqnum_low,
667 (unsigned long long) sconn->smb2.seqnum_range));
668 return false;
669 }
670
671 /*
672 * now check the message ids
673 *
674 * for multi-credit requests we need to check all current mid plus
675 * the implicit mids caused by the credit charge
676 * e.g. current mid = 15, charge 5 => mark 15-19 as used
677 */
678
679 for (i = 0; i <= (credit_charge-1); i++) {
680 uint64_t id = message_id + i;
681 bool ok;
682
683 DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
684 (unsigned long long)message_id,
685 credit_charge,
686 (unsigned long long)id));
687
688 ok = smb2_validate_sequence_number(sconn, message_id, id);
689 if (!ok) {
690 return false;
691 }
692 }
693
694 /* substract used credits */
695 sconn->smb2.credits_granted -= credit_charge;
696
697 return true;
698 }
699
700 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
701 {
702 int count;
703 int idx;
704
705 count = req->in.vector_count;
706
707 if (count < 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
708 /* It's not a SMB2 request */
709 return NT_STATUS_INVALID_PARAMETER;
710 }
711
712 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
713 struct iovec *hdr = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
714 struct iovec *body = SMBD_SMB2_IDX_BODY_IOV(req,in,idx);
715 const uint8_t *inhdr = NULL;
716 uint32_t flags;
717
718 if (hdr->iov_len != SMB2_HDR_BODY) {
719 return NT_STATUS_INVALID_PARAMETER;
720 }
721
722 if (body->iov_len < 2) {
723 return NT_STATUS_INVALID_PARAMETER;
724 }
725
726 inhdr = (const uint8_t *)hdr->iov_base;
727
728 /* Check the SMB2 header */
729 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
730 return NT_STATUS_INVALID_PARAMETER;
731 }
732
733 if (!smb2_validate_message_id(req->sconn, inhdr)) {
734 return NT_STATUS_INVALID_PARAMETER;
735 }
736
737 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
738 if (idx < SMBD_SMB2_NUM_IOV_PER_REQ) {
739 /*
740 * the 1st request should never have the
741 * SMB2_HDR_FLAG_CHAINED flag set
742 */
743 if (flags & SMB2_HDR_FLAG_CHAINED) {
744 req->next_status = NT_STATUS_INVALID_PARAMETER;
745 return NT_STATUS_OK;
746 }
747 } else if (idx < 2*SMBD_SMB2_NUM_IOV_PER_REQ) {
748 /*
749 * the 2nd request triggers related vs. unrelated
750 * compounded requests
751 */
752 if (flags & SMB2_HDR_FLAG_CHAINED) {
753 req->compound_related = true;
754 }
755 } else {
756 #if 0
757 /*
758 * It seems the this tests are wrong
759 * see the SMB2-COMPOUND test
760 */
761
762 /*
763 * all other requests should match the 2nd one
764 */
765 if (flags & SMB2_HDR_FLAG_CHAINED) {
766 if (!req->compound_related) {
767 req->next_status =
768 NT_STATUS_INVALID_PARAMETER;
769 return NT_STATUS_OK;
770 }
771 } else {
772 if (req->compound_related) {
773 req->next_status =
774 NT_STATUS_INVALID_PARAMETER;
775 return NT_STATUS_OK;
776 }
777 }
778 #endif
779 }
780 }
781
782 return NT_STATUS_OK;
783 }
784
785 static void smb2_set_operation_credit(struct smbd_server_connection *sconn,
786 const struct iovec *in_vector,
787 struct iovec *out_vector)
788 {
789 const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
790 uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
791 uint16_t credit_charge = 1;
792 uint16_t credits_requested;
793 uint32_t out_flags;
794 uint16_t cmd;
795 NTSTATUS out_status;
796 uint16_t credits_granted = 0;
797 uint64_t credits_possible;
798 uint16_t current_max_credits;
799
800 /*
801 * first we grant only 1/16th of the max range.
802 *
803 * Windows also starts with the 1/16th and then grants
804 * more later. I was only able to trigger higher
805 * values, when using a verify high credit charge.
806 *
807 * TODO: scale up depending one load, free memory
808 * or other stuff.
809 * Maybe also on the relationship between number
810 * of requests and the used sequence number.
811 * Which means we would grant more credits
812 * for client which use multi credit requests.
813 */
814 current_max_credits = sconn->smb2.max_credits / 16;
815 current_max_credits = MAX(current_max_credits, 1);
816
817 if (sconn->smb2.supports_multicredit) {
818 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
819 credit_charge = MAX(credit_charge, 1);
820 }
821
822 cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
823 credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
824 out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
825 out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
826
827 SMB_ASSERT(sconn->smb2.max_credits >= sconn->smb2.credits_granted);
828 SMB_ASSERT(sconn->smb2.max_credits >= credit_charge);
829
830 if (out_flags & SMB2_HDR_FLAG_ASYNC) {
831 /*
832 * In case we already send an async interim
833 * response, we should not grant
834 * credits on the final response.
835 */
836 credits_granted = 0;
837 } else if (credits_requested > 0) {
838 uint16_t additional_max = 0;
839 uint16_t additional_credits = credits_requested - 1;
840
841 switch (cmd) {
842 case SMB2_OP_NEGPROT:
843 break;
844 case SMB2_OP_SESSSETUP:
845 /*
846 * Windows 2012 RC1 starts to grant
847 * additional credits
848 * with a successful session setup
849 */
850 if (NT_STATUS_IS_OK(out_status)) {
851 additional_max = 32;
852 }
853 break;
854 default:
855 /*
856 * We match windows and only grant additional credits
857 * in chunks of 32.
858 */
859 additional_max = 32;
860 break;
861 }
862
863 additional_credits = MIN(additional_credits, additional_max);
864
865 credits_granted = credit_charge + additional_credits;
866 } else if (sconn->smb2.credits_granted == 0) {
867 /*
868 * Make sure the client has always at least one credit
869 */
870 credits_granted = 1;
871 }
872
873 /*
874 * sequence numbers should not wrap
875 *
876 * 1. calculate the possible credits until
877 * the sequence numbers start to wrap on 64-bit.
878 *
879 * 2. UINT64_MAX is used for Break Notifications.
880 *
881 * 2. truncate the possible credits to the maximum
882 * credits we want to grant to the client in total.
883 *
884 * 3. remove the range we'll already granted to the client
885 * this makes sure the client consumes the lowest sequence
886 * number, before we can grant additional credits.
887 */
888 credits_possible = UINT64_MAX - sconn->smb2.seqnum_low;
889 if (credits_possible > 0) {
890 /* remove UINT64_MAX */
891 credits_possible -= 1;
892 }
893 credits_possible = MIN(credits_possible, current_max_credits);
894 credits_possible -= sconn->smb2.seqnum_range;
895
896 credits_granted = MIN(credits_granted, credits_possible);
897
898 SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
899 sconn->smb2.credits_granted += credits_granted;
900 sconn->smb2.seqnum_range += credits_granted;
901
902 DEBUG(10,("smb2_set_operation_credit: requested %u, charge %u, "
903 "granted %u, current possible/max %u/%u, "
904 "total granted/max/low/range %u/%u/%llu/%u\n",
905 (unsigned int)credits_requested,
906 (unsigned int)credit_charge,
907 (unsigned int)credits_granted,
908 (unsigned int)credits_possible,
909 (unsigned int)current_max_credits,
910 (unsigned int)sconn->smb2.credits_granted,
911 (unsigned int)sconn->smb2.max_credits,
912 (unsigned long long)sconn->smb2.seqnum_low,
913 (unsigned int)sconn->smb2.seqnum_range));
914 }
915
916 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
917 struct smbd_smb2_request *outreq)
918 {
919 int count, idx;
920 uint16_t total_credits = 0;
921
922 count = outreq->out.vector_count;
923
924 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
925 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(inreq,in,idx);
926 struct iovec *outhdr_v = SMBD_SMB2_IDX_HDR_IOV(outreq,out,idx);
927 uint8_t *outhdr = (uint8_t *)outhdr_v->iov_base;
928
929 smb2_set_operation_credit(outreq->sconn, inhdr_v, outhdr_v);
930
931 /* To match Windows, count up what we
932 just granted. */
933 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
934 /* Set to zero in all but the last reply. */
935 if (idx + SMBD_SMB2_NUM_IOV_PER_REQ < count) {
936 SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
937 } else {
938 SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
939 }
940 }
941 }
942
943 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
944 {
945 struct iovec *vector;
946 int count;
947 int idx;
948
949 count = req->in.vector_count;
950 vector = talloc_zero_array(req, struct iovec, count);
951 if (vector == NULL) {
952 return NT_STATUS_NO_MEMORY;
953 }
954
955 vector[0].iov_base = req->out.nbt_hdr;
956 vector[0].iov_len = 4;
957 SIVAL(req->out.nbt_hdr, 0, 0);
958
959 for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
960 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
961 const uint8_t *inhdr = (const uint8_t *)inhdr_v->iov_base;
962 uint8_t *outhdr = NULL;
963 uint8_t *outbody = NULL;
964 uint32_t next_command_ofs = 0;
965 struct iovec *current = &vector[idx];
966
967 if ((idx + SMBD_SMB2_NUM_IOV_PER_REQ) < count) {
968 /* we have a next command -
969 * setup for the error case. */
970 next_command_ofs = SMB2_HDR_BODY + 9;
971 }
972
973 outhdr = talloc_zero_array(vector, uint8_t,
974 OUTVEC_ALLOC_SIZE);
975 if (outhdr == NULL) {
976 return NT_STATUS_NO_MEMORY;
977 }
978
979 outbody = outhdr + SMB2_HDR_BODY;
980
981 /*
982 * SMBD_SMB2_TF_IOV_OFS might be used later
983 */
984 current[SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
985 current[SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
986
987 current[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)outhdr;
988 current[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
989
990 current[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)outbody;
991 current[SMBD_SMB2_BODY_IOV_OFS].iov_len = 8;
992
993 current[SMBD_SMB2_DYN_IOV_OFS].iov_base = NULL;
994 current[SMBD_SMB2_DYN_IOV_OFS].iov_len = 0;
995
996 /* setup the SMB2 header */
997 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
998 SSVAL(outhdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
999 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
1000 SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
1001 SIVAL(outhdr, SMB2_HDR_STATUS,
1002 NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
1003 SSVAL(outhdr, SMB2_HDR_OPCODE,
1004 SVAL(inhdr, SMB2_HDR_OPCODE));
1005 SIVAL(outhdr, SMB2_HDR_FLAGS,
1006 IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
1007 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
1008 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
1009 BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
1010 SIVAL(outhdr, SMB2_HDR_PID,
1011 IVAL(inhdr, SMB2_HDR_PID));
1012 SIVAL(outhdr, SMB2_HDR_TID,
1013 IVAL(inhdr, SMB2_HDR_TID));
1014 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
1015 BVAL(inhdr, SMB2_HDR_SESSION_ID));
1016 memcpy(outhdr + SMB2_HDR_SIGNATURE,
1017 inhdr + SMB2_HDR_SIGNATURE, 16);
1018
1019 /* setup error body header */
1020 SSVAL(outbody, 0x00, 0x08 + 1);
1021 SSVAL(outbody, 0x02, 0);
1022 SIVAL(outbody, 0x04, 0);
1023 }
1024
1025 req->out.vector = vector;
1026 req->out.vector_count = count;
1027
1028 /* setup the length of the NBT packet */
1029 smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
1030
1031 DLIST_ADD_END(req->sconn->smb2.requests, req, struct smbd_smb2_request *);
1032
1033 return NT_STATUS_OK;
1034 }
1035
1036 void smbd_server_connection_terminate_ex(struct smbd_server_connection *sconn,
1037 const char *reason,
1038 const char *location)
1039 {
1040 DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
1041 reason, location));
1042 exit_server_cleanly(reason);
1043 }
1044
1045 static bool dup_smb2_vec4(TALLOC_CTX *ctx,
1046 struct iovec *outvec,
1047 const struct iovec *srcvec)
1048 {
1049 const uint8_t *srctf;
1050 size_t srctf_len;
1051 const uint8_t *srchdr;
1052 size_t srchdr_len;
1053 const uint8_t *srcbody;
1054 size_t srcbody_len;
1055 const uint8_t *expected_srcbody;
1056 const uint8_t *srcdyn;
1057 size_t srcdyn_len;
1058 const uint8_t *expected_srcdyn;
1059 uint8_t *dsttf;
1060 uint8_t *dsthdr;
1061 uint8_t *dstbody;
1062 uint8_t *dstdyn;
1063
1064 srctf = (const uint8_t *)srcvec[SMBD_SMB2_TF_IOV_OFS].iov_base;
1065 srctf_len = srcvec[SMBD_SMB2_TF_IOV_OFS].iov_len;
1066 srchdr = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
1067 srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
1068 srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
1069 srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
1070 expected_srcbody = srchdr + SMB2_HDR_BODY;
1071 srcdyn = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
1072 srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
1073 expected_srcdyn = srcbody + 8;
1074
1075 if ((srctf_len != SMB2_TF_HDR_SIZE) && (srctf_len != 0)) {
1076 return false;
1077 }
1078
1079 if (srchdr_len != SMB2_HDR_BODY) {
1080 return false;
1081 }
1082
1083 if (srctf_len == SMB2_TF_HDR_SIZE) {
1084 dsttf = talloc_memdup(ctx, srctf, SMB2_TF_HDR_SIZE);
1085 if (dsttf == NULL) {
1086 return false;
1087 }
1088 } else {
1089 dsttf = NULL;
1090 }
1091 outvec[SMBD_SMB2_TF_IOV_OFS].iov_base = (void *)dsttf;
1092 outvec[SMBD_SMB2_TF_IOV_OFS].iov_len = srctf_len;
1093
1094 /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
1095 * be allocated with size OUTVEC_ALLOC_SIZE. */
1096
1097 dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
1098 if (dsthdr == NULL) {
1099 return false;
1100 }
1101 outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
1102 outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1103
1104 /*
1105 * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
1106 * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
1107 * then duplicate this. Else use talloc_memdup().
1108 */
1109
1110 if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
1111 dstbody = dsthdr + SMB2_HDR_BODY;
1112 } else {
1113 dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
1114 if (dstbody == NULL) {
1115 return false;
1116 }
1117 }
1118 outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
1119 outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
1120
1121 /*
1122 * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
1123 * pointing to
1124 * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
1125 * then duplicate this. Else use talloc_memdup().
1126 */
1127
1128 if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
1129 dstdyn = dsthdr + SMB2_HDR_BODY + 8;
1130 } else if (srcdyn == NULL) {
1131 dstdyn = NULL;
1132 } else {
1133 dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
1134 if (dstdyn == NULL) {
1135 return false;
1136 }
1137 }
1138 outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
1139 outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
1140
1141 return true;
1142 }
1143
1144 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
1145 {
1146 struct smbd_smb2_request *newreq = NULL;
1147 struct iovec *outvec = NULL;
1148 int count = req->out.vector_count;
1149 int i;
1150
1151 newreq = smbd_smb2_request_allocate(req->sconn);
1152 if (!newreq) {
1153 return NULL;
1154 }
1155
1156 newreq->sconn = req->sconn;
1157 newreq->session = req->session;
1158 newreq->do_encryption = req->do_encryption;
1159 newreq->do_signing = req->do_signing;
1160 newreq->current_idx = req->current_idx;
1161
1162 outvec = talloc_zero_array(newreq, struct iovec, count);
1163 if (!outvec) {
1164 TALLOC_FREE(newreq);
1165 return NULL;
1166 }
1167 newreq->out.vector = outvec;
1168 newreq->out.vector_count = count;
1169
1170 /* Setup the outvec's identically to req. */
1171 outvec[0].iov_base = newreq->out.nbt_hdr;
1172 outvec[0].iov_len = 4;
1173 memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
1174
1175 /* Setup the vectors identically to the ones in req. */
1176 for (i = 1; i < count; i += SMBD_SMB2_NUM_IOV_PER_REQ) {
1177 if (!dup_smb2_vec4(outvec, &outvec[i], &req->out.vector[i])) {
1178 break;
1179 }
1180 }
1181
1182 if (i < count) {
1183 /* Alloc failed. */
1184 TALLOC_FREE(newreq);
1185 return NULL;
1186 }
1187
1188 smb2_setup_nbt_length(newreq->out.vector,
1189 newreq->out.vector_count);
1190
1191 return newreq;
1192 }
1193
1194 static void smbd_smb2_request_writev_done(struct tevent_req *subreq);
1195
1196 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
1197 {
1198 struct smbXsrv_connection *conn = req->sconn->conn;
1199 int first_idx = 1;
1200 struct iovec *firsttf = NULL;
1201 struct iovec *outhdr_v = NULL;
1202 uint8_t *outhdr = NULL;
1203 struct smbd_smb2_request *nreq = NULL;
1204 NTSTATUS status;
1205
1206 /* Create a new smb2 request we'll use
1207 for the interim return. */
1208 nreq = dup_smb2_req(req);
1209 if (!nreq) {
1210 return NT_STATUS_NO_MEMORY;
1211 }
1212
1213 /* Lose the last X out vectors. They're the
1214 ones we'll be using for the async reply. */
1215 nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
1216
1217 smb2_setup_nbt_length(nreq->out.vector,
1218 nreq->out.vector_count);
1219
1220 /* Step back to the previous reply. */
1221 nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
1222 firsttf = SMBD_SMB2_IDX_TF_IOV(nreq,out,first_idx);
1223 outhdr_v = SMBD_SMB2_OUT_HDR_IOV(nreq);
1224 outhdr = SMBD_SMB2_OUT_HDR_PTR(nreq);
1225 /* And end the chain. */
1226 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
1227
1228 /* Calculate outgoing credits */
1229 smb2_calculate_credits(req, nreq);
1230
1231 if (DEBUGLEVEL >= 10) {
1232 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
1233 (unsigned int)nreq->current_idx );
1234 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
1235 (unsigned int)nreq->out.vector_count );
1236 print_req_vectors(nreq);
1237 }
1238
1239 /*
1240 * As we have changed the header (SMB2_HDR_NEXT_COMMAND),
1241 * we need to sign/encrypt here with the last/first key we remembered
1242 */
1243 if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
1244 status = smb2_signing_encrypt_pdu(req->first_key,
1245 conn->protocol,
1246 firsttf,
1247 nreq->out.vector_count - first_idx);
1248 if (!NT_STATUS_IS_OK(status)) {
1249 return status;
1250 }
1251 } else if (req->last_key.length > 0) {
1252 status = smb2_signing_sign_pdu(req->last_key,
1253 conn->protocol,
1254 outhdr_v,
1255 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1256 if (!NT_STATUS_IS_OK(status)) {
1257 return status;
1258 }
1259 }
1260
1261 nreq->subreq = tstream_writev_queue_send(nreq,
1262 nreq->sconn->ev_ctx,
1263 nreq->sconn->smb2.stream,
1264 nreq->sconn->smb2.send_queue,
1265 nreq->out.vector,
1266 nreq->out.vector_count);
1267
1268 if (nreq->subreq == NULL) {
1269 return NT_STATUS_NO_MEMORY;
1270 }
1271
1272 tevent_req_set_callback(nreq->subreq,
1273 smbd_smb2_request_writev_done,
1274 nreq);
1275
1276 return NT_STATUS_OK;
1277 }
1278
1279 struct smbd_smb2_request_pending_state {
1280 struct smbd_server_connection *sconn;
1281 uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
1282 struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
1283 };
1284
1285 static void smbd_smb2_request_pending_writev_done(struct tevent_req *subreq)
1286 {
1287 struct smbd_smb2_request_pending_state *state =
1288 tevent_req_callback_data(subreq,
1289 struct smbd_smb2_request_pending_state);
1290 struct smbd_server_connection *sconn = state->sconn;
1291 int ret;
1292 int sys_errno;
1293
1294 ret = tstream_writev_queue_recv(subreq, &sys_errno);
1295 TALLOC_FREE(subreq);
1296 if (ret == -1) {
1297 NTSTATUS status = map_nt_error_from_unix(sys_errno);
1298 smbd_server_connection_terminate(sconn, nt_errstr(status));
1299 return;
1300 }
1301
1302 TALLOC_FREE(state);
1303 }
1304
1305 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1306 struct tevent_timer *te,
1307 struct timeval current_time,
1308 void *private_data);
1309
1310 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
1311 struct tevent_req *subreq,
1312 uint32_t defer_time)
1313 {
1314 NTSTATUS status;
1315 int idx = req->current_idx;
1316 struct timeval defer_endtime;
1317 uint8_t *outhdr = NULL;
1318 uint32_t flags;
1319
1320 if (!tevent_req_is_in_progress(subreq)) {
1321 return NT_STATUS_OK;
1322 }
1323
1324 req->subreq = subreq;
1325 subreq = NULL;
1326
1327 if (req->async_te) {
1328 /* We're already async. */
1329 return NT_STATUS_OK;
1330 }
1331
1332 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1333 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1334 if (flags & SMB2_HDR_FLAG_ASYNC) {
1335 /* We're already async. */
1336 return NT_STATUS_OK;
1337 }
1338
1339 if (req->in.vector_count > idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
1340 /*
1341 * We're trying to go async in a compound
1342 * request chain. This is not allowed.
1343 * Cancel the outstanding request.
1344 */
1345 tevent_req_cancel(req->subreq);
1346 return smbd_smb2_request_error(req,
1347 NT_STATUS_INSUFFICIENT_RESOURCES);
1348 }
1349
1350 if (DEBUGLEVEL >= 10) {
1351 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
1352 (unsigned int)req->current_idx );
1353 print_req_vectors(req);
1354 }
1355
1356 if (req->out.vector_count >= (2*SMBD_SMB2_NUM_IOV_PER_REQ)) {
1357 /*
1358 * This is a compound reply. We
1359 * must do an interim response
1360 * followed by the async response
1361 * to match W2K8R2.
1362 */
1363 status = smb2_send_async_interim_response(req);
1364 if (!NT_STATUS_IS_OK(status)) {
1365 return status;
1366 }
1367 data_blob_clear_free(&req->first_key);
1368
1369 /*
1370 * We're splitting off the last SMB2
1371 * request in a compound set, and the
1372 * smb2_send_async_interim_response()
1373 * call above just sent all the replies
1374 * for the previous SMB2 requests in
1375 * this compound set. So we're no longer
1376 * in the "compound_related_in_progress"
1377 * state, and this is no longer a compound
1378 * request.
1379 */
1380 req->compound_related = false;
1381 req->sconn->smb2.compound_related_in_progress = false;
1382
1383 req->current_idx = 1;
1384
1385 /* Re-arrange the in.vectors. */
1386 memmove(&req->in.vector[req->current_idx],
1387 &req->in.vector[idx],
1388 sizeof(req->in.vector[0])*SMBD_SMB2_NUM_IOV_PER_REQ);
1389 req->in.vector_count = req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ;
1390
1391 /* Re-arrange the out.vectors. */
1392 memmove(&req->out.vector[req->current_idx],
1393 &req->out.vector[idx],
1394 sizeof(req->out.vector[0])*SMBD_SMB2_NUM_IOV_PER_REQ);
1395 req->out.vector_count = req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ;
1396
1397 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1398 flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
1399 SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
1400 }
1401 data_blob_clear_free(&req->last_key);
1402
1403 defer_endtime = timeval_current_ofs_usec(defer_time);
1404 req->async_te = tevent_add_timer(req->sconn->ev_ctx,
1405 req, defer_endtime,
1406 smbd_smb2_request_pending_timer,
1407 req);
1408 if (req->async_te == NULL) {
1409 return NT_STATUS_NO_MEMORY;
1410 }
1411
1412 return NT_STATUS_OK;
1413 }
1414
1415 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1416 struct tevent_timer *te,
1417 struct timeval current_time,
1418 void *private_data)
1419 {
1420 struct smbd_smb2_request *req =
1421 talloc_get_type_abort(private_data,
1422 struct smbd_smb2_request);
1423 struct smbd_smb2_request_pending_state *state = NULL;
1424 uint8_t *outhdr = NULL;
1425 const uint8_t *inhdr = NULL;
1426 uint8_t *tf = NULL;
1427 size_t tf_len = 0;
1428 uint8_t *hdr = NULL;
1429 uint8_t *body = NULL;
1430 uint8_t *dyn = NULL;
1431 uint32_t flags = 0;
1432 uint64_t session_id = 0;
1433 uint64_t message_id = 0;
1434 uint64_t nonce_high;
1435 uint64_t nonce_low;
1436 uint64_t async_id = 0;
1437 struct tevent_req *subreq = NULL;
1438
1439 TALLOC_FREE(req->async_te);
1440
1441 /* Ensure our final reply matches the interim one. */
1442 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1443 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1444 flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1445 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1446 session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
1447
1448 async_id = message_id; /* keep it simple for now... */
1449
1450 SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1451 SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
1452
1453 DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1454 "going async\n",
1455 smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
1456 (unsigned long long)async_id ));
1457
1458 /*
1459 * What we send is identical to a smbd_smb2_request_error
1460 * packet with an error status of STATUS_PENDING. Make use
1461 * of this fact sometime when refactoring. JRA.
1462 */
1463
1464 state = talloc_zero(req->sconn, struct smbd_smb2_request_pending_state);
1465 if (state == NULL) {
1466 smbd_server_connection_terminate(req->sconn,
1467 nt_errstr(NT_STATUS_NO_MEMORY));
1468 return;
1469 }
1470 state->sconn = req->sconn;
1471
1472 tf = state->buf + NBT_HDR_SIZE;
1473 tf_len = SMB2_TF_HDR_SIZE;
1474
1475 hdr = tf + SMB2_TF_HDR_SIZE;
1476 body = hdr + SMB2_HDR_BODY;
1477 dyn = body + 8;
1478
1479 /*
1480 * We may have 2 responses (PENDING, FINAL),
1481 * so alter the nonce.
1482 *
1483 * The PENDING response has the SMB2_HDR_FLAG_ASYNC bit
1484 * set.
1485 */
1486 nonce_high = session_id | SMB2_HDR_FLAG_ASYNC;
1487 nonce_low = message_id;
1488
1489 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
1490 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
1491 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
1492 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
1493
1494 SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1495 SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1496 SSVAL(hdr, SMB2_HDR_EPOCH, 0);
1497 SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
1498 SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
1499
1500 SIVAL(hdr, SMB2_HDR_FLAGS, flags);
1501 SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
1502 SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
1503 SBVAL(hdr, SMB2_HDR_PID, async_id);
1504 SBVAL(hdr, SMB2_HDR_SESSION_ID,
1505 BVAL(outhdr, SMB2_HDR_SESSION_ID));
1506 memcpy(hdr+SMB2_HDR_SIGNATURE,
1507 outhdr+SMB2_HDR_SIGNATURE, 16);
1508
1509 SSVAL(body, 0x00, 0x08 + 1);
1510
1511 SCVAL(body, 0x02, 0);
1512 SCVAL(body, 0x03, 0);
1513 SIVAL(body, 0x04, 0);
1514 /* Match W2K8R2... */
1515 SCVAL(dyn, 0x00, 0x21);
1516
1517 state->vector[0].iov_base = (void *)state->buf;
1518 state->vector[0].iov_len = NBT_HDR_SIZE;
1519
1520 if (req->do_encryption) {
1521 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
1522 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
1523 } else {
1524 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
1525 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
1526 }
1527
1528 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base = hdr;
1529 state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1530
1531 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
1532 state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len = 8;
1533
1534 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
1535 state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len = 1;
1536
1537 smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
1538
1539 /* Ensure we correctly go through crediting. Grant
1540 the credits now, and zero credits on the final
1541 response. */
1542 smb2_set_operation_credit(req->sconn,
1543 SMBD_SMB2_IN_HDR_IOV(req),
1544 &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
1545
1546 SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1547
1548 if (DEBUGLVL(10)) {
1549 int i;
1550
1551 for (i = 0; i < ARRAY_SIZE(state->vector); i++) {
1552 dbgtext("\tstate->vector[%u/%u].iov_len = %u\n",
1553 (unsigned int)i,
1554 (unsigned int)ARRAY_SIZE(state->vector),
1555 (unsigned int)state->vector[i].iov_len);
1556 dump_data(0, state->vector[i].iov_base, state->vector[i].iov_len);
1557 }
1558 }
1559
1560 if (req->do_encryption) {
1561 NTSTATUS status;
1562 struct smbXsrv_session *x = req->session;
1563 struct smbXsrv_connection *conn = x->connection;
1564 DATA_BLOB encryption_key = x->global->encryption_key;
1565
1566 status = smb2_signing_encrypt_pdu(encryption_key,
1567 conn->protocol,
1568 &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
1569 SMBD_SMB2_NUM_IOV_PER_REQ);
1570 if (!NT_STATUS_IS_OK(status)) {
1571 smbd_server_connection_terminate(req->sconn,
1572 nt_errstr(status));
1573 return;
1574 }
1575 } else if (req->do_signing) {
1576 NTSTATUS status;
1577 struct smbXsrv_session *x = req->session;
1578 struct smbXsrv_connection *conn = x->connection;
1579 DATA_BLOB signing_key = x->global->channels[0].signing_key;
1580
1581 status = smb2_signing_sign_pdu(signing_key,
1582 conn->protocol,
1583 &state->vector[1+SMBD_SMB2_HDR_IOV_OFS],
1584 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1585 if (!NT_STATUS_IS_OK(status)) {
1586 smbd_server_connection_terminate(req->sconn,
1587 nt_errstr(status));
1588 return;
1589 }
1590 }
1591
1592 subreq = tstream_writev_queue_send(state,
1593 state->sconn->ev_ctx,
1594 state->sconn->smb2.stream,
1595 state->sconn->smb2.send_queue,
1596 state->vector,
1597 ARRAY_SIZE(state->vector));
1598 if (subreq == NULL) {
1599 smbd_server_connection_terminate(state->sconn,
1600 nt_errstr(NT_STATUS_NO_MEMORY));
1601 return;
1602 }
1603 tevent_req_set_callback(subreq,
1604 smbd_smb2_request_pending_writev_done,
1605 state);
1606 }
1607
1608 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
1609 {
1610 struct smbd_server_connection *sconn = req->sconn;
1611 struct smbd_smb2_request *cur;
1612 const uint8_t *inhdr;
1613 uint32_t flags;
1614 uint64_t search_message_id;
1615 uint64_t search_async_id;
1616 uint64_t found_id;
1617
1618 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1619
1620 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1621 search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1622 search_async_id = BVAL(inhdr, SMB2_HDR_PID);
1623
1624 /*
1625 * we don't need the request anymore
1626 * cancel requests never have a response
1627 */
1628 DLIST_REMOVE(req->sconn->smb2.requests, req);
1629 TALLOC_FREE(req);
1630
1631 for (cur = sconn->smb2.requests; cur; cur = cur->next) {
1632 const uint8_t *outhdr;
1633 uint64_t message_id;
1634 uint64_t async_id;
1635
1636 outhdr = SMBD_SMB2_OUT_HDR_PTR(cur);
1637
1638 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1639 async_id = BVAL(outhdr, SMB2_HDR_PID);
1640
1641 if (flags & SMB2_HDR_FLAG_ASYNC) {
1642 if (search_async_id == async_id) {
1643 found_id = async_id;
1644 break;
1645 }
1646 } else {
1647 if (search_message_id == message_id) {
1648 found_id = message_id;
1649 break;
1650 }
1651 }
1652 }
1653
1654 if (cur && cur->subreq) {
1655 inhdr = SMBD_SMB2_IN_HDR_PTR(cur);
1656 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1657 "cancel opcode[%s] mid %llu\n",
1658 smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
1659 (unsigned long long)found_id ));
1660 tevent_req_cancel(cur->subreq);
1661 }
1662
1663 return NT_STATUS_OK;
1664 }
1665
1666 /*************************************************************
1667 Ensure an incoming tid is a valid one for us to access.
1668 Change to the associated uid credentials and chdir to the
1669 valid tid directory.
1670 *************************************************************/
1671
1672 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
1673 {
1674 const uint8_t *inhdr;
1675 uint32_t in_flags;
1676 uint32_t in_tid;
1677 struct smbXsrv_tcon *tcon;
1678 NTSTATUS status;
1679 NTTIME now = timeval_to_nttime(&req->request_time);
1680
1681 req->tcon = NULL;
1682
1683 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1684
1685 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1686 in_tid = IVAL(inhdr, SMB2_HDR_TID);
1687
1688 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1689 in_tid = req->last_tid;
1690 }
1691
1692 status = smb2srv_tcon_lookup(req->session,
1693 in_tid, now, &tcon);
1694 if (!NT_STATUS_IS_OK(status)) {
1695 return status;
1696 }
1697
1698 if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
1699 return NT_STATUS_ACCESS_DENIED;
1700 }
1701
1702 /* should we pass FLAG_CASELESS_PATHNAMES here? */
1703 if (!set_current_service(tcon->compat, 0, true)) {
1704 return NT_STATUS_ACCESS_DENIED;
1705 }
1706
1707 req->tcon = tcon;
1708 req->last_tid = in_tid;
1709
1710 return NT_STATUS_OK;
1711 }
1712
1713 /*************************************************************
1714 Ensure an incoming session_id is a valid one for us to access.
1715 *************************************************************/
1716
1717 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
1718 {
1719 const uint8_t *inhdr;
1720 uint32_t in_flags;
1721 uint16_t in_opcode;
1722 uint64_t in_session_id;
1723 struct smbXsrv_session *session = NULL;
1724 struct auth_session_info *session_info;
1725 NTSTATUS status;
1726 NTTIME now = timeval_to_nttime(&req->request_time);
1727
1728 req->session = NULL;
1729 req->tcon = NULL;
1730
1731 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1732
1733 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1734 in_opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
1735 in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
1736
1737 if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1738 in_session_id = req->last_session_id;
1739 }
1740
1741 /* lookup an existing session */
1742 status = smb2srv_session_lookup(req->sconn->conn,
1743 in_session_id, now,
1744 &session);
1745 if (session) {
1746 req->session = session;
1747 req->last_session_id = in_session_id;
1748 }
1749 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1750 switch (in_opcode) {
1751 case SMB2_OP_SESSSETUP:
1752 status = NT_STATUS_OK;
1753 break;
1754 default:
1755 break;
1756 }
1757 }
1758 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1759 switch (in_opcode) {
1760 case SMB2_OP_TCON:
1761 case SMB2_OP_CREATE:
1762 case SMB2_OP_GETINFO:
1763 case SMB2_OP_SETINFO:
1764 return NT_STATUS_INVALID_HANDLE;
1765 default:
1766 /*
1767 * Notice the check for
1768 * (session_info == NULL)
1769 * below.
1770 */
1771 status = NT_STATUS_OK;
1772 break;
1773 }
1774 }
1775 if (!NT_STATUS_IS_OK(status)) {
1776 return status;
1777 }
1778
1779 session_info = session->global->auth_session_info;
1780 if (session_info == NULL) {
1781 return NT_STATUS_INVALID_HANDLE;
1782 }
1783
1784 set_current_user_info(session_info->unix_info->sanitized_username,
1785 session_info->unix_info->unix_name,
1786 session_info->info->domain_name);
1787
1788 return NT_STATUS_OK;
1789 }
1790
1791 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
1792 uint32_t data_length)
1793 {
1794 uint16_t needed_charge;
1795 uint16_t credit_charge = 1;
1796 const uint8_t *inhdr;
1797
1798 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1799
1800 if (req->sconn->smb2.supports_multicredit) {
1801 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
1802 credit_charge = MAX(credit_charge, 1);
1803 }
1804
1805 needed_charge = (data_length - 1)/ 65536 + 1;
1806
1807 DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
1808 (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
1809 credit_charge, needed_charge));
1810
1811 if (needed_charge > credit_charge) {
1812 DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
1813 credit_charge, needed_charge));
1814 return NT_STATUS_INVALID_PARAMETER;
1815 }
1816
1817 return NT_STATUS_OK;
1818 }
1819
1820 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
1821 size_t expected_body_size)
1822 {
1823 struct iovec *inhdr_v;
1824 const uint8_t *inhdr;
1825 uint16_t opcode;
1826 const uint8_t *inbody;
1827 size_t body_size;
1828 size_t min_dyn_size = expected_body_size & 0x00000001;
1829 int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
1830
1831 /*
1832 * The following should be checked already.
1833 */
1834 if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
1835 return NT_STATUS_INTERNAL_ERROR;
1836 }
1837 if (req->current_idx > max_idx) {
1838 return NT_STATUS_INTERNAL_ERROR;
1839 }
1840
1841 inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
1842 if (inhdr_v->iov_len != SMB2_HDR_BODY) {
1843 return NT_STATUS_INTERNAL_ERROR;
1844 }
1845 if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
1846 return NT_STATUS_INTERNAL_ERROR;
1847 }
1848
1849 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1850 opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1851
1852 switch (opcode) {
1853 case SMB2_OP_IOCTL:
1854 case SMB2_OP_GETINFO:
1855 min_dyn_size = 0;
1856 break;
1857 }
1858
1859 /*
1860 * Now check the expected body size,
1861 * where the last byte might be in the
1862 * dynamic section..
1863 */
1864 if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
1865 return NT_STATUS_INVALID_PARAMETER;
1866 }
1867 if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
1868 return NT_STATUS_INVALID_PARAMETER;
1869 }
1870
1871 inbody = SMBD_SMB2_IN_BODY_PTR(req);
1872
1873 body_size = SVAL(inbody, 0x00);
1874 if (body_size != expected_body_size) {
1875 return NT_STATUS_INVALID_PARAMETER;
1876 }
1877
1878 return NT_STATUS_OK;
1879 }
1880
1881 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
1882 {
1883 struct smbXsrv_connection *conn = req->sconn->conn;
1884 const struct smbd_smb2_dispatch_table *call = NULL;
1885 const struct iovec *intf_v = SMBD_SMB2_IN_TF_IOV(req);
1886 const uint8_t *inhdr;
1887 uint16_t opcode;
1888 uint32_t flags;
1889 uint64_t mid;
1890 NTSTATUS status;
1891 NTSTATUS session_status;
1892 uint32_t allowed_flags;
1893 NTSTATUS return_value;
1894 struct smbXsrv_session *x = NULL;
1895 bool signing_required = false;
1896 bool encryption_required = false;
1897
1898 inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1899
1900 /* TODO: verify more things */
1901
1902 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1903 opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
1904 mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1905 DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
1906 smb2_opcode_name(opcode),
1907 (unsigned long long)mid));
1908
1909 if (conn->protocol >= PROTOCOL_SMB2_02) {
1910 /*
1911 * once the protocol is negotiated
1912 * SMB2_OP_NEGPROT is not allowed anymore
1913 */
1914 if (opcode == SMB2_OP_NEGPROT) {
1915 /* drop the connection */
1916 return NT_STATUS_INVALID_PARAMETER;
1917 }
1918 } else {
1919 /*
1920 * if the protocol is not negotiated yet
1921 * only SMB2_OP_NEGPROT is allowed.
1922 */
1923 if (opcode != SMB2_OP_NEGPROT) {
1924 /* drop the connection */
1925 return NT_STATUS_INVALID_PARAMETER;
1926 }
1927 }
1928
1929 /*
1930 * Check if the client provided a valid session id,
1931 * if so smbd_smb2_request_check_session() calls
1932 * set_current_user_info().
1933 *
1934 * As some command don't require a valid session id
1935 * we defer the check of the session_status
1936 */
1937 session_status = smbd_smb2_request_check_session(req);
1938 x = req->session;
1939 if (x != NULL) {
1940 signing_required = x->global->signing_required;
1941 encryption_required = x->global->encryption_required;
1942
1943 if (opcode == SMB2_OP_SESSSETUP &&
1944 x->global->channels[0].signing_key.length) {
1945 signing_required = true;
1946 }
1947 }
1948
1949 req->do_signing = false;
1950 req->do_encryption = false;
1951 if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
1952 const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
1953 uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
1954
1955 if (x != NULL && x->global->session_wire_id != tf_session_id) {
1956 DEBUG(0,("smbd_smb2_request_dispatch: invalid session_id"
1957 "in SMB2_HDR[%llu], SMB2_TF[%llu]\n",
1958 (unsigned long long)x->global->session_wire_id,
1959 (unsigned long long)tf_session_id));
1960 /*
1961 * TODO: windows allows this...
1962 * should we drop the connection?
1963 *
1964 * For now we just return ACCESS_DENIED
1965 * (Windows clients never trigger this)
1966 * and wait for an update of [MS-SMB2].
1967 */
1968 return smbd_smb2_request_error(req,
1969 NT_STATUS_ACCESS_DENIED);
1970 }
1971
1972 req->do_encryption = true;
1973 }
1974
1975 if (encryption_required && !req->do_encryption) {
1976 return smbd_smb2_request_error(req,
1977 NT_STATUS_ACCESS_DENIED);
1978 }
1979
1980 call = smbd_smb2_call(opcode);
1981 if (call == NULL) {
1982 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
1983 }
1984
1985 allowed_flags = SMB2_HDR_FLAG_CHAINED |
1986 SMB2_HDR_FLAG_SIGNED |
1987 SMB2_HDR_FLAG_DFS;
1988 if (opcode == SMB2_OP_CANCEL) {
1989 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
1990 }
1991 if ((flags & ~allowed_flags) != 0) {
1992 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
1993 }
1994
1995 if (req->do_encryption) {
1996 signing_required = false;
1997 } else if (flags & SMB2_HDR_FLAG_SIGNED) {
1998 DATA_BLOB signing_key;
1999
2000 if (x == NULL) {
2001 return smbd_smb2_request_error(
2002 req, NT_STATUS_ACCESS_DENIED);
2003 }
2004
2005 signing_key = x->global->channels[0].signing_key;
2006
2007 /*
2008 * If we have a signing key, we should
2009 * sign the response
2010 */
2011 if (signing_key.length > 0) {
2012 req->do_signing = true;
2013 }
2014
2015 status = smb2_signing_check_pdu(signing_key,
2016 conn->protocol,
2017 SMBD_SMB2_IN_HDR_IOV(req),
2018 SMBD_SMB2_NUM_IOV_PER_REQ);
2019 if (!NT_STATUS_IS_OK(status)) {
2020 return smbd_smb2_request_error(req, status);
2021 }
2022
2023 /*
2024 * Now that we know the request was correctly signed
2025 * we have to sign the response too.
2026 */
2027 req->do_signing = true;
2028
2029 if (!NT_STATUS_IS_OK(session_status)) {
2030 return smbd_smb2_request_error(req, session_status);
2031 }
2032 } else if (opcode == SMB2_OP_CANCEL) {
2033 /* Cancel requests are allowed to skip the signing */
2034 } else if (signing_required) {
2035 /*
2036 * If signing is required we try to sign
2037 * a possible error response
2038 */
2039 req->do_signing = true;
2040 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
2041 }
2042
2043 if (flags & SMB2_HDR_FLAG_CHAINED) {
2044 /*
2045 * This check is mostly for giving the correct error code
2046 * for compounded requests.
2047 *
2048 * TODO: we may need to move this after the session
2049 * and tcon checks.
2050 */
2051 if (!NT_STATUS_IS_OK(req->next_status)) {
2052 return smbd_smb2_request_error(req, req->next_status);
2053 }
2054 } else {
2055 req->compat_chain_fsp = NULL;
2056 }
2057
2058 if (req->compound_related) {
2059 req->sconn->smb2.compound_related_in_progress = true;
2060 }
2061
2062 if (call->need_session) {
2063 if (!NT_STATUS_IS_OK(session_status)) {
2064 return smbd_smb2_request_error(req, session_status);
2065 }
2066 }
2067
2068 if (call->need_tcon) {
2069 SMB_ASSERT(call->need_session);
2070
2071 /*
2072 * This call needs to be run as user.
2073 *
2074 * smbd_smb2_request_check_tcon()
2075 * calls change_to_user() on success.
2076 */
2077 status = smbd_smb2_request_check_tcon(req);
2078 if (!NT_STATUS_IS_OK(status)) {
2079 return smbd_smb2_request_error(req, status);
2080 }
2081 if (req->tcon->global->encryption_required) {
2082 encryption_required = true;
2083 }
2084 if (encryption_required && !req->do_encryption) {
2085 return smbd_smb2_request_error(req,
2086 NT_STATUS_ACCESS_DENIED);
2087 }
2088 }
2089
2090 if (call->fileid_ofs != 0) {
2091 size_t needed = call->fileid_ofs + 16;
2092 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
2093 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
2094 uint64_t file_id_persistent;
2095 uint64_t file_id_volatile;
2096 struct files_struct *fsp;
2097
2098 SMB_ASSERT(call->need_tcon);
2099
2100 if (needed > body_size) {
2101 return smbd_smb2_request_error(req,
2102 NT_STATUS_INVALID_PARAMETER);
2103 }
2104
2105 file_id_persistent = BVAL(body, call->fileid_ofs + 0);
2106 file_id_volatile = BVAL(body, call->fileid_ofs + 8);
2107
2108 fsp = file_fsp_smb2(req, file_id_persistent, file_id_volatile);
2109 if (fsp == NULL) {
2110 if (!call->allow_invalid_fileid) {
2111 return smbd_smb2_request_error(req,
2112 NT_STATUS_FILE_CLOSED);
2113 }
2114
2115 if (file_id_persistent != UINT64_MAX) {
2116 return smbd_smb2_request_error(req,
2117 NT_STATUS_FILE_CLOSED);
2118 }
2119 if (file_id_volatile != UINT64_MAX) {
2120 return smbd_smb2_request_error(req,
2121 NT_STATUS_FILE_CLOSED);
2122 }
2123 }
2124 }
2125
2126 if (call->as_root) {
2127 SMB_ASSERT(call->fileid_ofs == 0);
2128 /* This call needs to be run as root */
2129 change_to_root_user();
2130 } else {
2131 SMB_ASSERT(call->need_tcon);
2132 }
2133
2134 switch (opcode) {
2135 case SMB2_OP_NEGPROT:
2136 {
2137 START_PROFILE(smb2_negprot);
2138 return_value = smbd_smb2_request_process_negprot(req);
2139 END_PROFILE(smb2_negprot);
2140 }
2141 break;
2142
2143 case SMB2_OP_SESSSETUP:
2144 {
2145 START_PROFILE(smb2_sesssetup);
2146 return_value = smbd_smb2_request_process_sesssetup(req);
2147 END_PROFILE(smb2_sesssetup);
2148 }
2149 break;
2150
2151 case SMB2_OP_LOGOFF:
2152 {
2153 START_PROFILE(smb2_logoff);
2154 return_value = smbd_smb2_request_process_logoff(req);
2155 END_PROFILE(smb2_logoff);
2156 }
2157 break;
2158
2159 case SMB2_OP_TCON:
2160 {
2161 START_PROFILE(smb2_tcon);
2162 return_value = smbd_smb2_request_process_tcon(req);
2163 END_PROFILE(smb2_tcon);
2164 }
2165 break;
2166
2167 case SMB2_OP_TDIS:
2168 {
2169 START_PROFILE(smb2_tdis);
2170 return_value = smbd_smb2_request_process_tdis(req);
2171 END_PROFILE(smb2_tdis);
2172 }
2173 break;
2174
2175 case SMB2_OP_CREATE:
2176 {
2177 START_PROFILE(smb2_create);
2178 return_value = smbd_smb2_request_process_create(req);
2179 END_PROFILE(smb2_create);
2180 }
2181 break;
2182
2183 case SMB2_OP_CLOSE:
2184 {
2185 START_PROFILE(smb2_close);
2186 return_value = smbd_smb2_request_process_close(req);
2187 END_PROFILE(smb2_close);
2188 }
2189 break;
2190
2191 case SMB2_OP_FLUSH:
2192 {
2193 START_PROFILE(smb2_flush);
2194 return_value = smbd_smb2_request_process_flush(req);
2195 END_PROFILE(smb2_flush);
2196 }
2197 break;
2198
2199 case SMB2_OP_READ:
2200 {
2201 START_PROFILE(smb2_read);
2202 return_value = smbd_smb2_request_process_read(req);
2203 END_PROFILE(smb2_read);
2204 }
2205 break;
2206
2207 case SMB2_OP_WRITE:
2208 {
2209 START_PROFILE(smb2_write);
2210 return_value = smbd_smb2_request_process_write(req);
2211 END_PROFILE(smb2_write);
2212 }
2213 break;
2214
2215 case SMB2_OP_LOCK:
2216 {
2217 START_PROFILE(smb2_lock);
2218 return_value = smbd_smb2_request_process_lock(req);
2219 END_PROFILE(smb2_lock);
2220 }
2221 break;
2222
2223 case SMB2_OP_IOCTL:
2224 {
2225 START_PROFILE(smb2_ioctl);
2226 return_value = smbd_smb2_request_process_ioctl(req);
2227 END_PROFILE(smb2_ioctl);
2228 }
2229 break;
2230
2231 case SMB2_OP_CANCEL:
2232 {
2233 START_PROFILE(smb2_cancel);
2234 return_value = smbd_smb2_request_process_cancel(req);
2235 END_PROFILE(smb2_cancel);
2236 }
2237 break;
2238
2239 case SMB2_OP_KEEPALIVE:
2240 {
2241 START_PROFILE(smb2_keepalive);
2242 return_value = smbd_smb2_request_process_keepalive(req);
2243 END_PROFILE(smb2_keepalive);
2244 }
2245 break;
2246
2247 case SMB2_OP_FIND:
2248 {
2249 START_PROFILE(smb2_find);
2250 return_value = smbd_smb2_request_process_find(req);
2251 END_PROFILE(smb2_find);
2252 }
2253 break;
2254
2255 case SMB2_OP_NOTIFY:
2256 {
2257 START_PROFILE(smb2_notify);
2258 return_value = smbd_smb2_request_process_notify(req);
2259 END_PROFILE(smb2_notify);
2260 }
2261 break;
2262
2263 case SMB2_OP_GETINFO:
2264 {
2265 START_PROFILE(smb2_getinfo);
2266 return_value = smbd_smb2_request_process_getinfo(req);
2267 END_PROFILE(smb2_getinfo);
2268 }
2269 break;
2270
2271 case SMB2_OP_SETINFO:
2272 {
2273 START_PROFILE(smb2_setinfo);
2274 return_value = smbd_smb2_request_process_setinfo(req);
2275 END_PROFILE(smb2_setinfo);
2276 }
2277 break;
2278
2279 case SMB2_OP_BREAK:
2280 {
2281 START_PROFILE(smb2_break);
2282 return_value = smbd_smb2_request_process_break(req);
2283 END_PROFILE(smb2_break);
2284 }
2285 break;
2286
2287 default:
2288 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2289 break;
2290 }
2291 return return_value;
2292 }
2293
2294 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
2295 {
2296 struct smbXsrv_connection *conn = req->sconn->conn;
2297 struct tevent_req *subreq;
2298 int first_idx = 1;
2299 struct iovec *firsttf = SMBD_SMB2_IDX_TF_IOV(req,out,first_idx);
2300 struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
2301 struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
2302
2303 req->subreq = NULL;
2304 TALLOC_FREE(req->async_te);
2305
2306 if (req->do_encryption &&
2307 (firsttf->iov_len == 0) &&
2308 (req->first_key.length == 0) &&
2309 (req->session != NULL) &&
2310 (req->session->global->encryption_key.length != 0))
2311 {
2312 DATA_BLOB encryption_key = req->session->global->encryption_key;
2313 uint8_t *tf;
2314 const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2315 uint64_t session_id = req->session->global->session_wire_id;
2316 uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
2317 uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
2318 /*
2319 * We may have 2 responses (PENDING, FINAL),
2320 * so alter the nonce.
2321 *
2322 * The FINAL response has the SMB2_HDR_FLAG_ASYNC bit
2323 * cleared.
2324 */
2325 uint64_t nonce_high = session_id & ~SMB2_HDR_FLAG_ASYNC;
2326 uint64_t nonce_low = message_id;
2327
2328 if (nonce_low == 0) {
2329 nonce_low = async_id;
2330 }
2331
2332 /*
2333 * We need to place the SMB2_TRANSFORM header before the
2334 * first SMB2 header
2335 */
2336
2337 /*
2338 * we need to remember the encryption key
2339 * and defer the signing/encryption until
2340 * we are sure that we do not change
2341 * the header again.
2342 */
2343 req->first_key = data_blob_dup_talloc(req, encryption_key);
2344 if (req->first_key.data == NULL) {
2345 return NT_STATUS_NO_MEMORY;
2346 }
2347
2348 tf = talloc_zero_array(req->out.vector, uint8_t,
2349 SMB2_TF_HDR_SIZE);
2350 if (tf == NULL) {
2351 return NT_STATUS_NO_MEMORY;
2352 }
2353
2354 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2355 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2356 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2357 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
2358
2359 firsttf->iov_base = (void *)tf;
2360 firsttf->iov_len = SMB2_TF_HDR_SIZE;
2361 }
2362
2363 if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
2364 (req->last_key.length > 0) &&
2365 (firsttf->iov_len == 0))
2366 {
2367 int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
2368 struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
2369 NTSTATUS status;
2370
2371 /*
2372 * As we are sure the header of the last request in the
2373 * compound chain will not change, we can to sign here
2374 * with the last signing key we remembered.
2375 */
2376 status = smb2_signing_sign_pdu(req->last_key,
2377 conn->protocol,
2378 lasthdr,
2379 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2380 if (!NT_STATUS_IS_OK(status)) {
2381 return status;
2382 }
2383 }
2384 data_blob_clear_free(&req->last_key);
2385
2386 req->current_idx += SMBD_SMB2_NUM_IOV_PER_REQ;
2387
2388 if (req->current_idx < req->out.vector_count) {
2389 /*
2390 * We must process the remaining compound
2391 * SMB2 requests before any new incoming SMB2
2392 * requests. This is because incoming SMB2
2393 * requests may include a cancel for a
2394 * compound request we haven't processed
2395 * yet.
2396 */
2397 struct tevent_immediate *im = tevent_create_immediate(req);
2398 if (!im) {
2399 return NT_STATUS_NO_MEMORY;
2400 }
2401
2402 if (req->do_signing && firsttf->iov_len == 0) {
2403 struct smbXsrv_session *x = req->session;
2404 DATA_BLOB signing_key = x->global->channels[0].signing_key;
2405
2406 /*
2407 * we need to remember the signing key
2408 * and defer the signing until
2409 * we are sure that we do not change
2410 * the header again.
2411 */
2412 req->last_key = data_blob_dup_talloc(req, signing_key);
2413 if (req->last_key.data == NULL) {
2414 return NT_STATUS_NO_MEMORY;
2415 }
2416 }
2417
2418 tevent_schedule_immediate(im,
2419 req->sconn->ev_ctx,
2420 smbd_smb2_request_dispatch_immediate,
2421 req);
2422 return NT_STATUS_OK;
2423 }
2424
2425 if (req->compound_related) {
2426 req->sconn->smb2.compound_related_in_progress = false;
2427 }
2428
2429 smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
2430
2431 /* Set credit for these operations (zero credits if this
2432 is a final reply for an async operation). */
2433 smb2_calculate_credits(req, req);
2434
2435 /*
2436 * now check if we need to sign the current response
2437 */
2438 if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
2439 NTSTATUS status;
2440
2441 status = smb2_signing_encrypt_pdu(req->first_key,
2442 conn->protocol,
2443 firsttf,
2444 req->out.vector_count - first_idx);
2445 if (!NT_STATUS_IS_OK(status)) {
2446 return status;
2447 }
2448 } else if (req->do_signing) {
2449 NTSTATUS status;
2450 struct smbXsrv_session *x = req->session;
2451 DATA_BLOB signing_key = x->global->channels[0].signing_key;
2452
2453 status = smb2_signing_sign_pdu(signing_key,
2454 conn->protocol,
2455 outhdr,
2456 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2457 if (!NT_STATUS_IS_OK(status)) {
2458 return status;
2459 }
2460 }
2461 data_blob_clear_free(&req->first_key);
2462
2463 /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
2464 if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
2465 outdyn->iov_base == NULL && outdyn->iov_len != 0) {
2466 /* Dynamic part is NULL. Chop it off,
2467 We're going to send it via sendfile. */
2468 req->out.vector_count -= 1;
2469 }
2470
2471 subreq = tstream_writev_queue_send(req,
2472 req->sconn->ev_ctx,
2473 req->sconn->smb2.stream,
2474 req->sconn->smb2.send_queue,
2475 req->out.vector,
2476 req->out.vector_count);
2477 if (subreq == NULL) {
2478 return NT_STATUS_NO_MEMORY;
2479 }
2480 tevent_req_set_callback(subreq, smbd_smb2_request_writev_done, req);
2481 /*
2482 * We're done with this request -
2483 * move it off the "being processed" queue.
2484 */
2485 DLIST_REMOVE(req->sconn->smb2.requests, req);
2486
2487 return NT_STATUS_OK;
2488 }
2489
2490 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn);
2491
2492 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
2493 struct tevent_immediate *im,
2494 void *private_data)
2495 {
2496 struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
2497 struct smbd_smb2_request);
2498 struct smbd_server_connection *sconn = req->sconn;
2499 NTSTATUS status;
2500
2501 TALLOC_FREE(im);
2502
2503 if (DEBUGLEVEL >= 10) {
2504 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
2505 req->current_idx, req->in.vector_count));
2506 print_req_vectors(req);
2507 }
2508
2509 status = smbd_smb2_request_dispatch(req);
2510 if (!NT_STATUS_IS_OK(status)) {
2511 smbd_server_connection_terminate(sconn, nt_errstr(status));
2512 return;
2513 }
2514
2515 status = smbd_smb2_request_next_incoming(sconn);
2516 if (!NT_STATUS_IS_OK(status)) {
2517 smbd_server_connection_terminate(sconn, nt_errstr(status));
2518 return;
2519 }
2520 }
2521
2522 static void smbd_smb2_request_writev_done(struct tevent_req *subreq)
2523 {
2524 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
2525 struct smbd_smb2_request);
2526 struct smbd_server_connection *sconn = req->sconn;
2527 int ret;
2528 int sys_errno;
2529 NTSTATUS status;
2530
2531 ret = tstream_writev_queue_recv(subreq, &sys_errno);
2532 TALLOC_FREE(subreq);
2533 TALLOC_FREE(req);
2534 if (ret == -1) {
2535 status = map_nt_error_from_unix(sys_errno);
2536 DEBUG(2,("smbd_smb2_request_writev_done: client write error %s\n",
2537 nt_errstr(status)));
2538 smbd_server_connection_terminate(sconn, nt_errstr(status));
2539 return;
2540 }
2541
2542 status = smbd_smb2_request_next_incoming(sconn);
2543 if (!NT_STATUS_IS_OK(status)) {
2544 smbd_server_connection_terminate(sconn, nt_errstr(status));
2545 return;
2546 }
2547 }
2548
2549 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
2550 NTSTATUS status,
2551 DATA_BLOB body, DATA_BLOB *dyn,
2552 const char *location)
2553 {
2554 uint8_t *outhdr;
2555 struct iovec *outbody_v;
2556 struct iovec *outdyn_v;
2557 uint32_t next_command_ofs;
2558
2559 DEBUG(10,("smbd_smb2_request_done_ex: "
2560 "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
2561 req->current_idx, nt_errstr(status), (unsigned int)body.length,
2562 dyn ? "yes": "no",
2563 (unsigned int)(dyn ? dyn->length : 0),
2564 location));
2565
2566 if (body.length < 2) {
2567 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2568 }
2569
2570 if ((body.length % 2) != 0) {
2571 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2572 }
2573
2574 outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2575 outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
2576 outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
2577
2578 next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
2579 SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
2580
2581 outbody_v->iov_base = (void *)body.data;
2582 outbody_v->iov_len = body.length;
2583
2584 if (dyn) {
2585 outdyn_v->iov_base = (void *)dyn->data;
2586 outdyn_v->iov_len = dyn->length;
2587 } else {
2588 outdyn_v->iov_base = NULL;
2589 outdyn_v->iov_len = 0;
2590 }
2591
2592 /* see if we need to recalculate the offset to the next response */
2593 if (next_command_ofs > 0) {
2594 next_command_ofs = SMB2_HDR_BODY;
2595 next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
2596 next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
2597 }
2598
2599 if ((next_command_ofs % 8) != 0) {
2600 size_t pad_size = 8 - (next_command_ofs % 8);
2601 if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
2602 /*
2603 * if the dyn buffer is empty
2604 * we can use it to add padding
2605 */
2606 uint8_t *pad;
2607
2608 pad = talloc_zero_array(req->out.vector,
2609 uint8_t, pad_size);
2610 if (pad == NULL) {
2611 return smbd_smb2_request_error(req,
2612 NT_STATUS_NO_MEMORY);
2613 }
2614
2615 outdyn_v->iov_base = (void *)pad;
2616 outdyn_v->iov_len = pad_size;
2617 } else {
2618 /*
2619 * For now we copy the dynamic buffer
2620 * and add the padding to the new buffer
2621 */
2622 size_t old_size;
2623 uint8_t *old_dyn;
2624 size_t new_size;
2625 uint8_t *new_dyn;
2626
2627 old_size = SMBD_SMB2_OUT_DYN_LEN(req);
2628 old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
2629
2630 new_size = old_size + pad_size;
2631 new_dyn = talloc_zero_array(req->out.vector,
2632 uint8_t, new_size);
2633 if (new_dyn == NULL) {
2634 return smbd_smb2_request_error(req,
2635 NT_STATUS_NO_MEMORY);
2636 }
2637
2638 memcpy(new_dyn, old_dyn, old_size);
2639 memset(new_dyn + old_size, 0, pad_size);
2640
2641 outdyn_v->iov_base = (void *)new_dyn;
2642 outdyn_v->iov_len = new_size;
2643 }
2644 next_command_ofs += pad_size;
2645 }
2646
2647 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
2648
2649 return smbd_smb2_request_reply(req);
2650 }
2651
2652 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
2653 NTSTATUS status,
2654 DATA_BLOB *info,
2655 const char *location)
2656 {
2657 DATA_BLOB body;
2658 uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2659
2660 DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
2661 req->current_idx, nt_errstr(status), info ? " +info" : "",
2662 location));
2663
2664 body.data = outhdr + SMB2_HDR_BODY;
2665 body.length = 8;
2666 SSVAL(body.data, 0, 9);
2667
2668 if (info) {
2669 SIVAL(body.data, 0x04, info->length);
2670 } else {
2671 /* Allocated size of req->out.vector[i].iov_base
2672 * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
2673 * 1 byte without having to do an alloc.
2674 */
2675 info = talloc_zero_array(req->out.vector,
2676 DATA_BLOB,
2677 1);
2678 if (!info) {
2679 return NT_STATUS_NO_MEMORY;
2680 }
2681 info->data = ((uint8_t *)outhdr) +
2682 OUTVEC_ALLOC_SIZE - 1;
2683 info->length = 1;
2684 SCVAL(info->data, 0, 0);
2685 }
2686
2687 /*
2688 * if a request fails, all other remaining
2689 * compounded requests should fail too
2690 */
2691 req->next_status = NT_STATUS_INVALID_PARAMETER;
2692
2693 return smbd_smb2_request_done_ex(req, status, body, info, __location__);
2694 }
2695
2696
2697 struct smbd_smb2_send_oplock_break_state {
2698 struct smbd_server_connection *sconn;
2699 uint8_t buf[4 + SMB2_HDR_BODY + 0x18];
2700 struct iovec vector;
2701 };
2702
2703 static void smbd_smb2_oplock_break_writev_done(struct tevent_req *subreq);
2704
2705 NTSTATUS smbd_smb2_send_oplock_break(struct smbd_server_connection *sconn,
2706 uint64_t file_id_persistent,
2707 uint64_t file_id_volatile,
2708 uint8_t oplock_level)
2709 {
2710 struct smbd_smb2_send_oplock_break_state *state;
2711 struct tevent_req *subreq;
2712 uint8_t *hdr;
2713 uint8_t *body;
2714
2715 state = talloc(sconn, struct smbd_smb2_send_oplock_break_state);
2716 if (state == NULL) {
2717 return NT_STATUS_NO_MEMORY;
2718 }
2719 state->sconn = sconn;
2720
2721 state->vector.iov_base = (void *)state->buf;
2722 state->vector.iov_len = sizeof(state->buf);
2723
2724 _smb2_setlen(state->buf, sizeof(state->buf) - 4);
2725 hdr = state->buf + 4;
2726 body = hdr + SMB2_HDR_BODY;
2727
2728 SIVAL(hdr, 0, SMB2_MAGIC);
2729 SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
2730 SSVAL(hdr, SMB2_HDR_EPOCH, 0);
2731 SIVAL(hdr, SMB2_HDR_STATUS, 0);
2732 SSVAL(hdr, SMB2_HDR_OPCODE, SMB2_OP_BREAK);
2733 SSVAL(hdr, SMB2_HDR_CREDIT, 0);
2734 SIVAL(hdr, SMB2_HDR_FLAGS, SMB2_HDR_FLAG_REDIRECT);
2735 SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
2736 SBVAL(hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
2737 SIVAL(hdr, SMB2_HDR_PID, 0);
2738 SIVAL(hdr, SMB2_HDR_TID, 0);
2739 SBVAL(hdr, SMB2_HDR_SESSION_ID, 0);
2740 memset(hdr+SMB2_HDR_SIGNATURE, 0, 16);
2741
2742 SSVAL(body, 0x00, 0x18);
2743
2744 SCVAL(body, 0x02, oplock_level);
2745 SCVAL(body, 0x03, 0); /* reserved */
2746 SIVAL(body, 0x04, 0); /* reserved */
2747 SBVAL(body, 0x08, file_id_persistent);
2748 SBVAL(body, 0x10, file_id_volatile);
2749
2750 subreq = tstream_writev_queue_send(state,
2751 sconn->ev_ctx,
2752 sconn->smb2.stream,
2753 sconn->smb2.send_queue,
2754 &state->vector, 1);
2755 if (subreq == NULL) {
2756 return NT_STATUS_NO_MEMORY;
2757 }
2758 tevent_req_set_callback(subreq,
2759 smbd_smb2_oplock_break_writev_done,
2760 state);
2761
2762 return NT_STATUS_OK;
2763 }
2764
2765 static void smbd_smb2_oplock_break_writev_done(struct tevent_req *subreq)
2766 {
2767 struct smbd_smb2_send_oplock_break_state *state =
2768 tevent_req_callback_data(subreq,
2769 struct smbd_smb2_send_oplock_break_state);
2770 struct smbd_server_connection *sconn = state->sconn;
2771 int ret;
2772 int sys_errno;
2773
2774 ret = tstream_writev_queue_recv(subreq, &sys_errno);
2775 TALLOC_FREE(subreq);
2776 if (ret == -1) {
2777 NTSTATUS status = map_nt_error_from_unix(sys_errno);
2778 smbd_server_connection_terminate(sconn, nt_errstr(status));
2779 return;
2780 }
2781
2782 TALLOC_FREE(state);
2783 }
2784
2785 struct smbd_smb2_request_read_state {
2786 struct tevent_context *ev;
2787 struct smbd_server_connection *sconn;
2788 struct smbd_smb2_request *smb2_req;
2789 struct {
2790 uint8_t nbt[NBT_HDR_SIZE];
2791 bool done;
2792 } hdr;
2793 size_t pktlen;
2794 uint8_t *pktbuf;
2795 };
2796
2797 static int smbd_smb2_request_next_vector(struct tstream_context *stream,
2798 void *private_data,
2799 TALLOC_CTX *mem_ctx,
2800 struct iovec **_vector,
2801 size_t *_count);
2802 static void smbd_smb2_request_read_done(struct tevent_req *subreq);
2803
2804 static struct tevent_req *smbd_smb2_request_read_send(TALLOC_CTX *mem_ctx,
2805 struct tevent_context *ev,
2806 struct smbd_server_connection *sconn)
2807 {
2808 struct tevent_req *req;
2809 struct smbd_smb2_request_read_state *state;
2810 struct tevent_req *subreq;
2811
2812 req = tevent_req_create(mem_ctx, &state,
2813 struct smbd_smb2_request_read_state);
2814 if (req == NULL) {
2815 return NULL;
2816 }
2817 state->ev = ev;
2818 state->sconn = sconn;
2819
2820 state->smb2_req = smbd_smb2_request_allocate(state);
2821 if (tevent_req_nomem(state->smb2_req, req)) {
2822 return tevent_req_post(req, ev);
2823 }
2824 state->smb2_req->sconn = sconn;
2825
2826 subreq = tstream_readv_pdu_queue_send(state->smb2_req,
2827 state->ev,
2828 state->sconn->smb2.stream,
2829 state->sconn->smb2.recv_queue,
2830 smbd_smb2_request_next_vector,
2831 state);
2832 if (tevent_req_nomem(subreq, req)) {
2833 return tevent_req_post(req, ev);
2834 }
2835 tevent_req_set_callback(subreq, smbd_smb2_request_read_done, req);
2836
2837 return req;
2838 }
2839
2840 static int smbd_smb2_request_next_vector(struct tstream_context *stream,
2841 void *private_data,
2842 TALLOC_CTX *mem_ctx,
2843 struct iovec **_vector,
2844 size_t *_count)
2845 {
2846 struct smbd_smb2_request_read_state *state =
2847 talloc_get_type_abort(private_data,
2848 struct smbd_smb2_request_read_state);
2849 struct iovec *vector;
2850
2851 if (state->pktlen > 0) {
2852 /* if there're no remaining bytes, we're done */
2853 *_vector = NULL;
2854 *_count = 0;
2855 return 0;
2856 }
2857
2858 if (!state->hdr.done) {
2859 /*
2860 * first we need to get the NBT header
2861 */
2862 vector = talloc_array(mem_ctx, struct iovec, 1);
2863 if (vector == NULL) {
2864 return -1;
2865 }
2866
2867 vector[0].iov_base = (void *)state->hdr.nbt;
2868 vector[0].iov_len = NBT_HDR_SIZE;
2869
2870 *_vector = vector;
2871 *_count = 1;
2872
2873 state->hdr.done = true;
2874 return 0;
2875 }
2876
2877 /*
2878 * Now we analyze the NBT header
2879 */
2880 state->pktlen = smb2_len(state->hdr.nbt);
2881
2882 if (state->pktlen == 0) {
2883 /* if there're no remaining bytes, we're done */
2884 *_vector = NULL;
2885 *_count = 0;
2886 return 0;
2887 }
2888
2889 state->pktbuf = talloc_array(state->smb2_req, uint8_t, state->pktlen);
2890 if (state->pktbuf == NULL) {
2891 return -1;
2892 }
2893
2894 vector = talloc_array(mem_ctx, struct iovec, 1);
2895 if (vector == NULL) {
2896 return -1;
2897 }
2898
2899 vector[0].iov_base = (void *)state->pktbuf;
2900 vector[0].iov_len = state->pktlen;
2901
2902 *_vector = vector;
2903 *_count = 1;
2904 return 0;
2905 }
2906
2907 static void smbd_smb2_request_read_done(struct tevent_req *subreq)
2908 {
2909 struct tevent_req *req =
2910 tevent_req_callback_data(subreq,
2911 struct tevent_req);
2912 struct smbd_smb2_request_read_state *state =
2913 tevent_req_data(req,
2914 struct smbd_smb2_request_read_state);
2915 int ret;
2916 int sys_errno;
2917 NTSTATUS status;
2918 NTTIME now;
2919
2920 ret = tstream_readv_pdu_queue_recv(subreq, &sys_errno);
2921 TALLOC_FREE(subreq);
2922 if (ret == -1) {
2923 status = map_nt_error_from_unix(sys_errno);
2924 tevent_req_nterror(req, status);
2925 return;
2926 }
2927
2928 if (state->hdr.nbt[0] != 0x00) {
2929 DEBUG(1,("smbd_smb2_request_read_done: ignore NBT[0x%02X] msg\n",
2930 state->hdr.nbt[0]));
2931
2932 ZERO_STRUCT(state->hdr);
2933 TALLOC_FREE(state->pktbuf);
2934 state->pktlen = 0;
2935
2936 subreq = tstream_readv_pdu_queue_send(state->smb2_req,
2937 state->ev,
2938 state->sconn->smb2.stream,
2939 state->sconn->smb2.recv_queue,
2940 smbd_smb2_request_next_vector,
2941 state);
2942 if (tevent_req_nomem(subreq, req)) {
2943 return;
2944 }
2945 tevent_req_set_callback(subreq, smbd_smb2_request_read_done, req);
2946 return;
2947 }
2948
2949 state->smb2_req->request_time = timeval_current();
2950 now = timeval_to_nttime(&state->smb2_req->request_time);
2951
2952 status = smbd_smb2_inbuf_parse_compound(state->smb2_req->sconn->conn,
2953 now,
2954 state->pktbuf,
2955 state->pktlen,
2956 state->smb2_req,
2957 &state->smb2_req->in.vector,
2958 &state->smb2_req->in.vector_count);
2959 if (tevent_req_nterror(req, status)) {
2960 return;
2961 }
2962
2963 state->smb2_req->current_idx = 1;
2964
2965 tevent_req_done(req);
2966 }
2967
2968 static NTSTATUS smbd_smb2_request_read_recv(struct tevent_req *req,
2969 TALLOC_CTX *mem_ctx,
2970 struct smbd_smb2_request **_smb2_req)
2971 {
2972 struct smbd_smb2_request_read_state *state =
2973 tevent_req_data(req,
2974 struct smbd_smb2_request_read_state);
2975 NTSTATUS status;
2976
2977 if (tevent_req_is_nterror(req, &status)) {
2978 tevent_req_received(req);
2979 return status;
2980 }
2981
2982 *_smb2_req = talloc_move(mem_ctx, &state->smb2_req);
2983 tevent_req_received(req);
2984 return NT_STATUS_OK;
2985 }
2986
2987 static void smbd_smb2_request_incoming(struct tevent_req *subreq);
2988
2989 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn)
2990 {
2991 size_t max_send_queue_len;
2992 size_t cur_send_queue_len;
2993 struct tevent_req *subreq;
2994
2995 if (sconn->smb2.compound_related_in_progress) {
2996 /*
2997 * Can't read another until the related
2998 * compound is done.
2999 */
3000 return NT_STATUS_OK;
3001 }
3002
3003 if (tevent_queue_length(sconn->smb2.recv_queue) > 0) {
3004 /*
3005 * if there is already a smbd_smb2_request_read
3006 * pending, we are done.
3007 */
3008 return NT_STATUS_OK;
3009 }
3010
3011 max_send_queue_len = MAX(1, sconn->smb2.max_credits/16);
3012 cur_send_queue_len = tevent_queue_length(sconn->smb2.send_queue);
3013
3014 if (cur_send_queue_len > max_send_queue_len) {
3015 /*
3016 * if we have a lot of requests to send,
3017 * we wait until they are on the wire until we
3018 * ask for the next request.
3019 */
3020 return NT_STATUS_OK;
3021 }
3022
3023 /* ask for the next request */
3024 subreq = smbd_smb2_request_read_send(sconn, sconn->ev_ctx, sconn);
3025 if (subreq == NULL) {
3026 return NT_STATUS_NO_MEMORY;
3027 }
3028 tevent_req_set_callback(subreq, smbd_smb2_request_incoming, sconn);
3029
3030 return NT_STATUS_OK;
3031 }
3032
3033 void smbd_smb2_first_negprot(struct smbd_server_connection *sconn,
3034 uint8_t *inbuf, size_t size)
3035 {
3036 NTSTATUS status;
3037 struct smbd_smb2_request *req = NULL;
3038
3039 DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
3040 (unsigned int)size));
3041
3042 status = smbd_initialize_smb2(sconn);
3043 if (!NT_STATUS_IS_OK(status)) {
3044 smbd_server_connection_terminate(sconn, nt_errstr(status));
3045 return;
3046 }
3047
3048 status = smbd_smb2_request_create(sconn, inbuf, size, &req);
3049 if (!NT_STATUS_IS_OK(status)) {
3050 smbd_server_connection_terminate(sconn, nt_errstr(status));
3051 return;
3052 }
3053
3054 status = smbd_smb2_request_validate(req);
3055 if (!NT_STATUS_IS_OK(status)) {
3056 smbd_server_connection_terminate(sconn, nt_errstr(status));
3057 return;
3058 }
3059
3060 status = smbd_smb2_request_setup_out(req);
3061 if (!NT_STATUS_IS_OK(status)) {
3062 smbd_server_connection_terminate(sconn, nt_errstr(status));
3063 return;
3064 }
3065
3066 status = smbd_smb2_request_dispatch(req);
3067 if (!NT_STATUS_IS_OK(status)) {
3068 smbd_server_connection_terminate(sconn, nt_errstr(status));
3069 return;
3070 }
3071
3072 status = smbd_smb2_request_next_incoming(sconn);
3073 if (!NT_STATUS_IS_OK(status)) {
3074 smbd_server_connection_terminate(sconn, nt_errstr(status));
3075 return;
3076 }
3077
3078 sconn->num_requests++;
3079 }
3080
3081 static void smbd_smb2_request_incoming(struct tevent_req *subreq)
3082 {
3083 struct smbd_server_connection *sconn = tevent_req_callback_data(subreq,
3084 struct smbd_server_connection);
3085 NTSTATUS status;
3086 struct smbd_smb2_request *req = NULL;
3087
3088 status = smbd_smb2_request_read_recv(subreq, sconn, &req);
3089 TALLOC_FREE(subreq);
3090 if (!NT_STATUS_IS_OK(status)) {
3091 DEBUG(2,("smbd_smb2_request_incoming: client read error %s\n",
3092 nt_errstr(status)));
3093 smbd_server_connection_terminate(sconn, nt_errstr(status));
3094 return;
3095 }
3096
3097 DEBUG(10,("smbd_smb2_request_incoming: idx[%d] of %d vectors\n",
3098 req->current_idx, req->in.vector_count));
3099
3100 status = smbd_smb2_request_validate(req);
3101 if (!NT_STATUS_IS_OK(status)) {
3102 smbd_server_connection_terminate(sconn, nt_errstr(status));
3103 return;
3104 }
3105
3106 status = smbd_smb2_request_setup_out(req);
3107 if (!NT_STATUS_IS_OK(status)) {
3108 smbd_server_connection_terminate(sconn, nt_errstr(status));
3109 return;
3110 }
3111
3112 status = smbd_smb2_request_dispatch(req);
3113 if (!NT_STATUS_IS_OK(status)) {
3114 smbd_server_connection_terminate(sconn, nt_errstr(status));
3115 return;
3116 }
3117
3118 status = smbd_smb2_request_next_incoming(sconn);
3119 if (!NT_STATUS_IS_OK(status)) {
3120 smbd_server_connection_terminate(sconn, nt_errstr(status));
3121 return;
3122 }
3123
3124 sconn->num_requests++;
3125
3126 /* The timeout_processing function isn't run nearly
3127 often enough to implement 'max log size' without
3128 overrunning the size of the file by many megabytes.
3129 This is especially true if we are running at debug
3130 level 10. Checking every 50 SMB2s is a nice
3131 tradeoff of performance vs log file size overrun. */
3132
3133 if ((sconn->num_requests % 50) == 0 &&
3134 need_to_check_log_size()) {
3135 change_to_root_user();
3136 check_log_size();
3137 }
3138 }
reg import