source: vendor/current/source3/smbd/smbXsrv_session.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 48.3 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2011-2012
5 Copyright (C) Michael Adam 2012
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22#include "system/filesys.h"
23#include <tevent.h>
24#include "smbd/smbd.h"
25#include "smbd/globals.h"
26#include "dbwrap/dbwrap.h"
27#include "dbwrap/dbwrap_rbt.h"
28#include "dbwrap/dbwrap_open.h"
29#include "dbwrap/dbwrap_watch.h"
30#include "session.h"
31#include "auth.h"
32#include "auth/gensec/gensec.h"
33#include "../lib/tsocket/tsocket.h"
34#include "../libcli/security/security.h"
35#include "messages.h"
36#include "lib/util/util_tdb.h"
37#include "librpc/gen_ndr/ndr_smbXsrv.h"
38#include "serverid.h"
39#include "lib/util/tevent_ntstatus.h"
40
41struct smbXsrv_session_table {
42 struct {
43 struct db_context *db_ctx;
44 uint32_t lowest_id;
45 uint32_t highest_id;
46 uint32_t max_sessions;
47 uint32_t num_sessions;
48 } local;
49 struct {
50 struct db_context *db_ctx;
51 } global;
52};
53
54static struct db_context *smbXsrv_session_global_db_ctx = NULL;
55
56NTSTATUS smbXsrv_session_global_init(void)
57{
58 char *global_path = NULL;
59 struct db_context *db_ctx = NULL;
60
61 if (smbXsrv_session_global_db_ctx != NULL) {
62 return NT_STATUS_OK;
63 }
64
65 /*
66 * This contains secret information like session keys!
67 */
68 global_path = lock_path("smbXsrv_session_global.tdb");
69 if (global_path == NULL) {
70 return NT_STATUS_NO_MEMORY;
71 }
72
73 db_ctx = db_open(NULL, global_path,
74 0, /* hash_size */
75 TDB_DEFAULT |
76 TDB_CLEAR_IF_FIRST |
77 TDB_INCOMPATIBLE_HASH,
78 O_RDWR | O_CREAT, 0600,
79 DBWRAP_LOCK_ORDER_1,
80 DBWRAP_FLAG_NONE);
81 TALLOC_FREE(global_path);
82 if (db_ctx == NULL) {
83 NTSTATUS status;
84
85 status = map_nt_error_from_unix_common(errno);
86
87 return status;
88 }
89
90 smbXsrv_session_global_db_ctx = db_ctx;
91
92 return NT_STATUS_OK;
93}
94
95/*
96 * NOTE:
97 * We need to store the keys in big endian so that dbwrap_rbt's memcmp
98 * has the same result as integer comparison between the uint32_t
99 * values.
100 *
101 * TODO: implement string based key
102 */
103
104#define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
105
106static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
107 uint8_t *key_buf)
108{
109 TDB_DATA key;
110
111 RSIVAL(key_buf, 0, id);
112
113 key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
114
115 return key;
116}
117
118#if 0
119static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
120{
121 if (id == NULL) {
122 return NT_STATUS_INVALID_PARAMETER;
123 }
124
125 if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
126 return NT_STATUS_INTERNAL_DB_CORRUPTION;
127 }
128
129 *id = RIVAL(key.dptr, 0);
130
131 return NT_STATUS_OK;
132}
133#endif
134
135#define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
136
137static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
138 uint8_t *key_buf)
139{
140 TDB_DATA key;
141
142 RSIVAL(key_buf, 0, id);
143
144 key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
145
146 return key;
147}
148
149static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
150{
151 if (id == NULL) {
152 return NT_STATUS_INVALID_PARAMETER;
153 }
154
155 if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
156 return NT_STATUS_INTERNAL_DB_CORRUPTION;
157 }
158
159 *id = RIVAL(key.dptr, 0);
160
161 return NT_STATUS_OK;
162}
163
164static struct db_record *smbXsrv_session_global_fetch_locked(
165 struct db_context *db,
166 uint32_t id,
167 TALLOC_CTX *mem_ctx)
168{
169 TDB_DATA key;
170 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
171 struct db_record *rec = NULL;
172
173 key = smbXsrv_session_global_id_to_key(id, key_buf);
174
175 rec = dbwrap_fetch_locked(db, mem_ctx, key);
176
177 if (rec == NULL) {
178 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
179 hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
180 }
181
182 return rec;
183}
184
185static struct db_record *smbXsrv_session_local_fetch_locked(
186 struct db_context *db,
187 uint32_t id,
188 TALLOC_CTX *mem_ctx)
189{
190 TDB_DATA key;
191 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
192 struct db_record *rec = NULL;
193
194 key = smbXsrv_session_local_id_to_key(id, key_buf);
195
196 rec = dbwrap_fetch_locked(db, mem_ctx, key);
197
198 if (rec == NULL) {
199 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
200 hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
201 }
202
203 return rec;
204}
205
206static void smbXsrv_session_close_loop(struct tevent_req *subreq);
207
208static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
209 uint32_t lowest_id,
210 uint32_t highest_id,
211 uint32_t max_sessions)
212{
213 struct smbXsrv_client *client = conn->client;
214 struct smbXsrv_session_table *table;
215 NTSTATUS status;
216 struct tevent_req *subreq;
217 uint64_t max_range;
218
219 if (lowest_id > highest_id) {
220 return NT_STATUS_INTERNAL_ERROR;
221 }
222
223 max_range = highest_id;
224 max_range -= lowest_id;
225 max_range += 1;
226
227 if (max_sessions > max_range) {
228 return NT_STATUS_INTERNAL_ERROR;
229 }
230
231 table = talloc_zero(client, struct smbXsrv_session_table);
232 if (table == NULL) {
233 return NT_STATUS_NO_MEMORY;
234 }
235
236 table->local.db_ctx = db_open_rbt(table);
237 if (table->local.db_ctx == NULL) {
238 TALLOC_FREE(table);
239 return NT_STATUS_NO_MEMORY;
240 }
241 table->local.lowest_id = lowest_id;
242 table->local.highest_id = highest_id;
243 table->local.max_sessions = max_sessions;
244
245 status = smbXsrv_session_global_init();
246 if (!NT_STATUS_IS_OK(status)) {
247 TALLOC_FREE(table);
248 return status;
249 }
250
251 table->global.db_ctx = smbXsrv_session_global_db_ctx;
252
253 dbwrap_watch_db(table->global.db_ctx, client->msg_ctx);
254
255 subreq = messaging_read_send(table, client->ev_ctx, client->msg_ctx,
256 MSG_SMBXSRV_SESSION_CLOSE);
257 if (subreq == NULL) {
258 TALLOC_FREE(table);
259 return NT_STATUS_NO_MEMORY;
260 }
261 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
262
263 client->session_table = table;
264 return NT_STATUS_OK;
265}
266
267static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
268
269static void smbXsrv_session_close_loop(struct tevent_req *subreq)
270{
271 struct smbXsrv_client *client =
272 tevent_req_callback_data(subreq,
273 struct smbXsrv_client);
274 struct smbXsrv_session_table *table = client->session_table;
275 int ret;
276 struct messaging_rec *rec = NULL;
277 struct smbXsrv_session_closeB close_blob;
278 enum ndr_err_code ndr_err;
279 struct smbXsrv_session_close0 *close_info0 = NULL;
280 struct smbXsrv_session *session = NULL;
281 NTSTATUS status;
282 struct timeval tv = timeval_current();
283 NTTIME now = timeval_to_nttime(&tv);
284
285 ret = messaging_read_recv(subreq, talloc_tos(), &rec);
286 TALLOC_FREE(subreq);
287 if (ret != 0) {
288 goto next;
289 }
290
291 ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
292 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
293 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
294 status = ndr_map_error2ntstatus(ndr_err);
295 DEBUG(1,("smbXsrv_session_close_loop: "
296 "ndr_pull_struct_blob - %s\n",
297 nt_errstr(status)));
298 goto next;
299 }
300
301 DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
302 if (DEBUGLVL(10)) {
303 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
304 }
305
306 if (close_blob.version != SMBXSRV_VERSION_0) {
307 DEBUG(0,("smbXsrv_session_close_loop: "
308 "ignore invalid version %u\n", close_blob.version));
309 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
310 goto next;
311 }
312
313 close_info0 = close_blob.info.info0;
314 if (close_info0 == NULL) {
315 DEBUG(0,("smbXsrv_session_close_loop: "
316 "ignore NULL info %u\n", close_blob.version));
317 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
318 goto next;
319 }
320
321 status = smb2srv_session_lookup_client(client,
322 close_info0->old_session_wire_id,
323 now, &session);
324 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
325 DEBUG(4,("smbXsrv_session_close_loop: "
326 "old_session_wire_id %llu not found\n",
327 (unsigned long long)close_info0->old_session_wire_id));
328 if (DEBUGLVL(4)) {
329 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
330 }
331 goto next;
332 }
333 if (!NT_STATUS_IS_OK(status) &&
334 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
335 !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
336 DEBUG(1,("smbXsrv_session_close_loop: "
337 "old_session_wire_id %llu - %s\n",
338 (unsigned long long)close_info0->old_session_wire_id,
339 nt_errstr(status)));
340 if (DEBUGLVL(1)) {
341 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
342 }
343 goto next;
344 }
345
346 if (session->global->session_global_id != close_info0->old_session_global_id) {
347 DEBUG(1,("smbXsrv_session_close_loop: "
348 "old_session_wire_id %llu - global %u != %u\n",
349 (unsigned long long)close_info0->old_session_wire_id,
350 session->global->session_global_id,
351 close_info0->old_session_global_id));
352 if (DEBUGLVL(1)) {
353 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
354 }
355 goto next;
356 }
357
358 if (session->global->creation_time != close_info0->old_creation_time) {
359 DEBUG(1,("smbXsrv_session_close_loop: "
360 "old_session_wire_id %llu - "
361 "creation %s (%llu) != %s (%llu)\n",
362 (unsigned long long)close_info0->old_session_wire_id,
363 nt_time_string(rec, session->global->creation_time),
364 (unsigned long long)session->global->creation_time,
365 nt_time_string(rec, close_info0->old_creation_time),
366 (unsigned long long)close_info0->old_creation_time));
367 if (DEBUGLVL(1)) {
368 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
369 }
370 goto next;
371 }
372
373 subreq = smb2srv_session_shutdown_send(session, client->ev_ctx,
374 session, NULL);
375 if (subreq == NULL) {
376 status = NT_STATUS_NO_MEMORY;
377 DEBUG(0, ("smbXsrv_session_close_loop: "
378 "smb2srv_session_shutdown_send(%llu) failed: %s\n",
379 (unsigned long long)session->global->session_wire_id,
380 nt_errstr(status)));
381 if (DEBUGLVL(1)) {
382 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
383 }
384 goto next;
385 }
386 tevent_req_set_callback(subreq,
387 smbXsrv_session_close_shutdown_done,
388 session);
389
390next:
391 TALLOC_FREE(rec);
392
393 subreq = messaging_read_send(table, client->ev_ctx, client->msg_ctx,
394 MSG_SMBXSRV_SESSION_CLOSE);
395 if (subreq == NULL) {
396 const char *r;
397 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
398 exit_server_cleanly(r);
399 return;
400 }
401 tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
402}
403
404static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
405{
406 struct smbXsrv_session *session =
407 tevent_req_callback_data(subreq,
408 struct smbXsrv_session);
409 NTSTATUS status;
410
411 status = smb2srv_session_shutdown_recv(subreq);
412 TALLOC_FREE(subreq);
413 if (!NT_STATUS_IS_OK(status)) {
414 DEBUG(0, ("smbXsrv_session_close_loop: "
415 "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
416 (unsigned long long)session->global->session_wire_id,
417 nt_errstr(status)));
418 }
419
420 status = smbXsrv_session_logoff(session);
421 if (!NT_STATUS_IS_OK(status)) {
422 DEBUG(0, ("smbXsrv_session_close_loop: "
423 "smbXsrv_session_logoff(%llu) failed: %s\n",
424 (unsigned long long)session->global->session_wire_id,
425 nt_errstr(status)));
426 }
427
428 TALLOC_FREE(session);
429}
430
431struct smb1srv_session_local_allocate_state {
432 const uint32_t lowest_id;
433 const uint32_t highest_id;
434 uint32_t last_id;
435 uint32_t useable_id;
436 NTSTATUS status;
437};
438
439static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
440 void *private_data)
441{
442 struct smb1srv_session_local_allocate_state *state =
443 (struct smb1srv_session_local_allocate_state *)private_data;
444 TDB_DATA key = dbwrap_record_get_key(rec);
445 uint32_t id = 0;
446 NTSTATUS status;
447
448 status = smbXsrv_session_local_key_to_id(key, &id);
449 if (!NT_STATUS_IS_OK(status)) {
450 state->status = status;
451 return -1;
452 }
453
454 if (id <= state->last_id) {
455 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
456 return -1;
457 }
458 state->last_id = id;
459
460 if (id > state->useable_id) {
461 state->status = NT_STATUS_OK;
462 return -1;
463 }
464
465 if (state->useable_id == state->highest_id) {
466 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
467 return -1;
468 }
469
470 state->useable_id +=1;
471 return 0;
472}
473
474static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
475 uint32_t lowest_id,
476 uint32_t highest_id,
477 TALLOC_CTX *mem_ctx,
478 struct db_record **_rec,
479 uint32_t *_id)
480{
481 struct smb1srv_session_local_allocate_state state = {
482 .lowest_id = lowest_id,
483 .highest_id = highest_id,
484 .last_id = 0,
485 .useable_id = lowest_id,
486 .status = NT_STATUS_INTERNAL_ERROR,
487 };
488 uint32_t i;
489 uint32_t range;
490 NTSTATUS status;
491 int count = 0;
492
493 *_rec = NULL;
494 *_id = 0;
495
496 if (lowest_id > highest_id) {
497 return NT_STATUS_INSUFFICIENT_RESOURCES;
498 }
499
500 /*
501 * first we try randomly
502 */
503 range = (highest_id - lowest_id) + 1;
504
505 for (i = 0; i < (range / 2); i++) {
506 uint32_t id;
507 TDB_DATA val;
508 struct db_record *rec = NULL;
509
510 id = generate_random() % range;
511 id += lowest_id;
512
513 if (id < lowest_id) {
514 id = lowest_id;
515 }
516 if (id > highest_id) {
517 id = highest_id;
518 }
519
520 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
521 if (rec == NULL) {
522 return NT_STATUS_INSUFFICIENT_RESOURCES;
523 }
524
525 val = dbwrap_record_get_value(rec);
526 if (val.dsize != 0) {
527 TALLOC_FREE(rec);
528 continue;
529 }
530
531 *_rec = rec;
532 *_id = id;
533 return NT_STATUS_OK;
534 }
535
536 /*
537 * if the range is almost full,
538 * we traverse the whole table
539 * (this relies on sorted behavior of dbwrap_rbt)
540 */
541 status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
542 &state, &count);
543 if (NT_STATUS_IS_OK(status)) {
544 if (NT_STATUS_IS_OK(state.status)) {
545 return NT_STATUS_INTERNAL_ERROR;
546 }
547
548 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
549 return state.status;
550 }
551
552 if (state.useable_id <= state.highest_id) {
553 state.status = NT_STATUS_OK;
554 } else {
555 return NT_STATUS_INSUFFICIENT_RESOURCES;
556 }
557 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
558 /*
559 * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
560 *
561 * If we get anything else it is an error, because it
562 * means we did not manage to find a free slot in
563 * the db.
564 */
565 return NT_STATUS_INSUFFICIENT_RESOURCES;
566 }
567
568 if (NT_STATUS_IS_OK(state.status)) {
569 uint32_t id;
570 TDB_DATA val;
571 struct db_record *rec = NULL;
572
573 id = state.useable_id;
574
575 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
576 if (rec == NULL) {
577 return NT_STATUS_INSUFFICIENT_RESOURCES;
578 }
579
580 val = dbwrap_record_get_value(rec);
581 if (val.dsize != 0) {
582 TALLOC_FREE(rec);
583 return NT_STATUS_INTERNAL_DB_CORRUPTION;
584 }
585
586 *_rec = rec;
587 *_id = id;
588 return NT_STATUS_OK;
589 }
590
591 return state.status;
592}
593
594struct smbXsrv_session_local_fetch_state {
595 struct smbXsrv_session *session;
596 NTSTATUS status;
597};
598
599static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
600 void *private_data)
601{
602 struct smbXsrv_session_local_fetch_state *state =
603 (struct smbXsrv_session_local_fetch_state *)private_data;
604 void *ptr;
605
606 if (data.dsize != sizeof(ptr)) {
607 state->status = NT_STATUS_INTERNAL_DB_ERROR;
608 return;
609 }
610
611 memcpy(&ptr, data.dptr, data.dsize);
612 state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
613 state->status = NT_STATUS_OK;
614}
615
616static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
617 /* conn: optional */
618 struct smbXsrv_connection *conn,
619 uint32_t session_local_id,
620 NTTIME now,
621 struct smbXsrv_session **_session)
622{
623 struct smbXsrv_session_local_fetch_state state = {
624 .session = NULL,
625 .status = NT_STATUS_INTERNAL_ERROR,
626 };
627 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
628 TDB_DATA key;
629 NTSTATUS status;
630
631 *_session = NULL;
632
633 if (session_local_id == 0) {
634 return NT_STATUS_USER_SESSION_DELETED;
635 }
636
637 if (table == NULL) {
638 /* this might happen before the end of negprot */
639 return NT_STATUS_USER_SESSION_DELETED;
640 }
641
642 if (table->local.db_ctx == NULL) {
643 return NT_STATUS_INTERNAL_ERROR;
644 }
645
646 key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
647
648 status = dbwrap_parse_record(table->local.db_ctx, key,
649 smbXsrv_session_local_fetch_parser,
650 &state);
651 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
652 return NT_STATUS_USER_SESSION_DELETED;
653 } else if (!NT_STATUS_IS_OK(status)) {
654 return status;
655 }
656 if (!NT_STATUS_IS_OK(state.status)) {
657 return state.status;
658 }
659
660 if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
661 return NT_STATUS_USER_SESSION_DELETED;
662 }
663
664 /*
665 * If a connection is specified check if the session is
666 * valid on the channel.
667 */
668 if (conn != NULL) {
669 struct smbXsrv_channel_global0 *c = NULL;
670
671 status = smbXsrv_session_find_channel(state.session, conn, &c);
672 if (!NT_STATUS_IS_OK(status)) {
673 return status;
674 }
675 }
676
677 state.session->idle_time = now;
678
679 if (!NT_STATUS_IS_OK(state.session->status)) {
680 *_session = state.session;
681 return state.session->status;
682 }
683
684 if (now > state.session->global->expiration_time) {
685 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
686 }
687
688 *_session = state.session;
689 return state.session->status;
690}
691
692static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
693{
694 return 0;
695}
696
697static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
698 bool *is_free,
699 bool *was_free,
700 TALLOC_CTX *mem_ctx,
701 struct smbXsrv_session_global0 **_g);
702
703static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
704 TALLOC_CTX *mem_ctx,
705 struct smbXsrv_session_global0 **_global)
706{
707 uint32_t i;
708 struct smbXsrv_session_global0 *global = NULL;
709 uint32_t last_free = 0;
710 const uint32_t min_tries = 3;
711
712 *_global = NULL;
713
714 global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
715 if (global == NULL) {
716 return NT_STATUS_NO_MEMORY;
717 }
718 talloc_set_destructor(global, smbXsrv_session_global_destructor);
719
720 /*
721 * Here we just randomly try the whole 32-bit space
722 *
723 * We use just 32-bit, because we want to reuse the
724 * ID for SRVSVC.
725 */
726 for (i = 0; i < UINT32_MAX; i++) {
727 bool is_free = false;
728 bool was_free = false;
729 uint32_t id;
730
731 if (i >= min_tries && last_free != 0) {
732 id = last_free;
733 } else {
734 id = generate_random();
735 }
736 if (id == 0) {
737 id++;
738 }
739 if (id == UINT32_MAX) {
740 id--;
741 }
742
743 global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
744 mem_ctx);
745 if (global->db_rec == NULL) {
746 talloc_free(global);
747 return NT_STATUS_INSUFFICIENT_RESOURCES;
748 }
749
750 smbXsrv_session_global_verify_record(global->db_rec,
751 &is_free,
752 &was_free,
753 NULL, NULL);
754
755 if (!is_free) {
756 TALLOC_FREE(global->db_rec);
757 continue;
758 }
759
760 if (!was_free && i < min_tries) {
761 /*
762 * The session_id is free now,
763 * but was not free before.
764 *
765 * This happens if a smbd crashed
766 * and did not cleanup the record.
767 *
768 * If this is one of our first tries,
769 * then we try to find a real free one.
770 */
771 if (last_free == 0) {
772 last_free = id;
773 }
774 TALLOC_FREE(global->db_rec);
775 continue;
776 }
777
778 global->session_global_id = id;
779
780 *_global = global;
781 return NT_STATUS_OK;
782 }
783
784 /* should not be reached */
785 talloc_free(global);
786 return NT_STATUS_INTERNAL_ERROR;
787}
788
789static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
790 bool *is_free,
791 bool *was_free,
792 TALLOC_CTX *mem_ctx,
793 struct smbXsrv_session_global0 **_g)
794{
795 TDB_DATA key;
796 TDB_DATA val;
797 DATA_BLOB blob;
798 struct smbXsrv_session_globalB global_blob;
799 enum ndr_err_code ndr_err;
800 struct smbXsrv_session_global0 *global = NULL;
801 bool exists;
802 TALLOC_CTX *frame = talloc_stackframe();
803
804 *is_free = false;
805
806 if (was_free) {
807 *was_free = false;
808 }
809 if (_g) {
810 *_g = NULL;
811 }
812
813 key = dbwrap_record_get_key(db_rec);
814
815 val = dbwrap_record_get_value(db_rec);
816 if (val.dsize == 0) {
817 TALLOC_FREE(frame);
818 *is_free = true;
819 if (was_free) {
820 *was_free = true;
821 }
822 return;
823 }
824
825 blob = data_blob_const(val.dptr, val.dsize);
826
827 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
828 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
829 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
830 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
831 DEBUG(1,("smbXsrv_session_global_verify_record: "
832 "key '%s' ndr_pull_struct_blob - %s\n",
833 hex_encode_talloc(frame, key.dptr, key.dsize),
834 nt_errstr(status)));
835 TALLOC_FREE(frame);
836 return;
837 }
838
839 DEBUG(10,("smbXsrv_session_global_verify_record\n"));
840 if (DEBUGLVL(10)) {
841 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
842 }
843
844 if (global_blob.version != SMBXSRV_VERSION_0) {
845 DEBUG(0,("smbXsrv_session_global_verify_record: "
846 "key '%s' use unsupported version %u\n",
847 hex_encode_talloc(frame, key.dptr, key.dsize),
848 global_blob.version));
849 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
850 TALLOC_FREE(frame);
851 return;
852 }
853
854 global = global_blob.info.info0;
855
856 exists = serverid_exists(&global->channels[0].server_id);
857 if (!exists) {
858 struct server_id_buf idbuf;
859 DEBUG(2,("smbXsrv_session_global_verify_record: "
860 "key '%s' server_id %s does not exist.\n",
861 hex_encode_talloc(frame, key.dptr, key.dsize),
862 server_id_str_buf(global->channels[0].server_id,
863 &idbuf)));
864 if (DEBUGLVL(2)) {
865 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
866 }
867 TALLOC_FREE(frame);
868 dbwrap_record_delete(db_rec);
869 *is_free = true;
870 return;
871 }
872
873 if (_g) {
874 *_g = talloc_move(mem_ctx, &global);
875 }
876 TALLOC_FREE(frame);
877}
878
879static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
880{
881 struct smbXsrv_session_globalB global_blob;
882 DATA_BLOB blob = data_blob_null;
883 TDB_DATA key;
884 TDB_DATA val;
885 NTSTATUS status;
886 enum ndr_err_code ndr_err;
887
888 /*
889 * TODO: if we use other versions than '0'
890 * we would add glue code here, that would be able to
891 * store the information in the old format.
892 */
893
894 if (global->db_rec == NULL) {
895 return NT_STATUS_INTERNAL_ERROR;
896 }
897
898 key = dbwrap_record_get_key(global->db_rec);
899 val = dbwrap_record_get_value(global->db_rec);
900
901 ZERO_STRUCT(global_blob);
902 global_blob.version = smbXsrv_version_global_current();
903 if (val.dsize >= 8) {
904 global_blob.seqnum = IVAL(val.dptr, 4);
905 }
906 global_blob.seqnum += 1;
907 global_blob.info.info0 = global;
908
909 ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
910 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
911 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
912 status = ndr_map_error2ntstatus(ndr_err);
913 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
914 hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
915 nt_errstr(status)));
916 TALLOC_FREE(global->db_rec);
917 return status;
918 }
919
920 val = make_tdb_data(blob.data, blob.length);
921 status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
922 if (!NT_STATUS_IS_OK(status)) {
923 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
924 hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
925 nt_errstr(status)));
926 TALLOC_FREE(global->db_rec);
927 return status;
928 }
929
930 if (DEBUGLVL(10)) {
931 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
932 hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
933 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
934 }
935
936 TALLOC_FREE(global->db_rec);
937
938 return NT_STATUS_OK;
939}
940
941struct smb2srv_session_close_previous_state {
942 struct tevent_context *ev;
943 struct smbXsrv_connection *connection;
944 struct dom_sid *current_sid;
945 uint64_t current_session_id;
946 struct db_record *db_rec;
947};
948
949static void smb2srv_session_close_previous_check(struct tevent_req *req);
950static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
951
952struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
953 struct tevent_context *ev,
954 struct smbXsrv_connection *conn,
955 struct auth_session_info *session_info,
956 uint64_t previous_session_id,
957 uint64_t current_session_id)
958{
959 struct tevent_req *req;
960 struct smb2srv_session_close_previous_state *state;
961 uint32_t global_id = previous_session_id & UINT32_MAX;
962 uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
963 struct smbXsrv_session_table *table = conn->client->session_table;
964 struct security_token *current_token = NULL;
965
966 req = tevent_req_create(mem_ctx, &state,
967 struct smb2srv_session_close_previous_state);
968 if (req == NULL) {
969 return NULL;
970 }
971 state->ev = ev;
972 state->connection = conn;
973 state->current_session_id = current_session_id;
974
975 if (global_zeros != 0) {
976 tevent_req_done(req);
977 return tevent_req_post(req, ev);
978 }
979
980 if (session_info == NULL) {
981 tevent_req_done(req);
982 return tevent_req_post(req, ev);
983 }
984 current_token = session_info->security_token;
985
986 if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
987 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
988 }
989
990 if (state->current_sid == NULL) {
991 tevent_req_done(req);
992 return tevent_req_post(req, ev);
993 }
994
995 if (!security_token_has_nt_authenticated_users(current_token)) {
996 /* TODO */
997 tevent_req_done(req);
998 return tevent_req_post(req, ev);
999 }
1000
1001 state->db_rec = smbXsrv_session_global_fetch_locked(
1002 table->global.db_ctx,
1003 global_id,
1004 state /* TALLOC_CTX */);
1005 if (state->db_rec == NULL) {
1006 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1007 return tevent_req_post(req, ev);
1008 }
1009
1010 smb2srv_session_close_previous_check(req);
1011 if (!tevent_req_is_in_progress(req)) {
1012 return tevent_req_post(req, ev);
1013 }
1014
1015 return req;
1016}
1017
1018static void smb2srv_session_close_previous_check(struct tevent_req *req)
1019{
1020 struct smb2srv_session_close_previous_state *state =
1021 tevent_req_data(req,
1022 struct smb2srv_session_close_previous_state);
1023 struct smbXsrv_connection *conn = state->connection;
1024 DATA_BLOB blob;
1025 struct security_token *previous_token = NULL;
1026 struct smbXsrv_session_global0 *global = NULL;
1027 enum ndr_err_code ndr_err;
1028 struct smbXsrv_session_close0 close_info0;
1029 struct smbXsrv_session_closeB close_blob;
1030 struct tevent_req *subreq = NULL;
1031 NTSTATUS status;
1032 bool is_free = false;
1033
1034 smbXsrv_session_global_verify_record(state->db_rec,
1035 &is_free,
1036 NULL,
1037 state,
1038 &global);
1039
1040 if (is_free) {
1041 TALLOC_FREE(state->db_rec);
1042 tevent_req_done(req);
1043 return;
1044 }
1045
1046 if (global->auth_session_info == NULL) {
1047 TALLOC_FREE(state->db_rec);
1048 tevent_req_done(req);
1049 return;
1050 }
1051
1052 previous_token = global->auth_session_info->security_token;
1053
1054 if (!security_token_is_sid(previous_token, state->current_sid)) {
1055 TALLOC_FREE(state->db_rec);
1056 tevent_req_done(req);
1057 return;
1058 }
1059
1060 subreq = dbwrap_record_watch_send(state, state->ev,
1061 state->db_rec, conn->msg_ctx);
1062 if (tevent_req_nomem(subreq, req)) {
1063 TALLOC_FREE(state->db_rec);
1064 return;
1065 }
1066 tevent_req_set_callback(subreq,
1067 smb2srv_session_close_previous_modified,
1068 req);
1069
1070 close_info0.old_session_global_id = global->session_global_id;
1071 close_info0.old_session_wire_id = global->session_wire_id;
1072 close_info0.old_creation_time = global->creation_time;
1073 close_info0.new_session_wire_id = state->current_session_id;
1074
1075 ZERO_STRUCT(close_blob);
1076 close_blob.version = smbXsrv_version_global_current();
1077 close_blob.info.info0 = &close_info0;
1078
1079 ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1080 (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1081 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1082 TALLOC_FREE(state->db_rec);
1083 status = ndr_map_error2ntstatus(ndr_err);
1084 DEBUG(1,("smb2srv_session_close_previous_check: "
1085 "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1086 (unsigned long long)close_info0.old_session_wire_id,
1087 (unsigned long long)close_info0.new_session_wire_id,
1088 nt_errstr(status)));
1089 tevent_req_nterror(req, status);
1090 return;
1091 }
1092
1093 status = messaging_send(conn->msg_ctx,
1094 global->channels[0].server_id,
1095 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1096 TALLOC_FREE(state->db_rec);
1097 if (tevent_req_nterror(req, status)) {
1098 return;
1099 }
1100
1101 TALLOC_FREE(global);
1102 return;
1103}
1104
1105static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1106{
1107 struct tevent_req *req =
1108 tevent_req_callback_data(subreq,
1109 struct tevent_req);
1110 struct smb2srv_session_close_previous_state *state =
1111 tevent_req_data(req,
1112 struct smb2srv_session_close_previous_state);
1113 NTSTATUS status;
1114
1115 status = dbwrap_record_watch_recv(subreq, state, &state->db_rec);
1116 TALLOC_FREE(subreq);
1117 if (tevent_req_nterror(req, status)) {
1118 return;
1119 }
1120
1121 smb2srv_session_close_previous_check(req);
1122}
1123
1124NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1125{
1126 NTSTATUS status;
1127
1128 if (tevent_req_is_nterror(req, &status)) {
1129 tevent_req_received(req);
1130 return status;
1131 }
1132
1133 tevent_req_received(req);
1134 return NT_STATUS_OK;
1135}
1136
1137static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1138{
1139 NTSTATUS status;
1140 struct smbXsrv_connection *xconn = NULL;
1141
1142 if (session->client != NULL) {
1143 xconn = session->client->connections;
1144 }
1145
1146 for (; xconn != NULL; xconn = xconn->next) {
1147 struct smbd_smb2_request *preq;
1148
1149 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1150 if (preq->session != session) {
1151 continue;
1152 }
1153
1154 preq->session = NULL;
1155 /*
1156 * If we no longer have a session we can't
1157 * sign or encrypt replies.
1158 */
1159 preq->do_signing = false;
1160 preq->do_encryption = false;
1161 preq->preauth = NULL;
1162 }
1163 }
1164
1165 status = smbXsrv_session_logoff(session);
1166 return status;
1167}
1168
1169static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1170{
1171 NTSTATUS status;
1172
1173 status = smbXsrv_session_clear_and_logoff(session);
1174 if (!NT_STATUS_IS_OK(status)) {
1175 DEBUG(0, ("smbXsrv_session_destructor: "
1176 "smbXsrv_session_logoff() failed: %s\n",
1177 nt_errstr(status)));
1178 }
1179
1180 TALLOC_FREE(session->global);
1181
1182 return 0;
1183}
1184
1185NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1186 NTTIME now,
1187 struct smbXsrv_session **_session)
1188{
1189 struct smbXsrv_session_table *table = conn->client->session_table;
1190 struct db_record *local_rec = NULL;
1191 struct smbXsrv_session *session = NULL;
1192 void *ptr = NULL;
1193 TDB_DATA val;
1194 struct smbXsrv_session_global0 *global = NULL;
1195 struct smbXsrv_channel_global0 *channel = NULL;
1196 NTSTATUS status;
1197
1198 if (table->local.num_sessions >= table->local.max_sessions) {
1199 return NT_STATUS_INSUFFICIENT_RESOURCES;
1200 }
1201
1202 session = talloc_zero(table, struct smbXsrv_session);
1203 if (session == NULL) {
1204 return NT_STATUS_NO_MEMORY;
1205 }
1206 session->table = table;
1207 session->idle_time = now;
1208 session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1209 session->client = conn->client;
1210
1211 status = smbXsrv_session_global_allocate(table->global.db_ctx,
1212 session,
1213 &global);
1214 if (!NT_STATUS_IS_OK(status)) {
1215 TALLOC_FREE(session);
1216 return status;
1217 }
1218 session->global = global;
1219
1220 if (conn->protocol >= PROTOCOL_SMB2_02) {
1221 uint64_t id = global->session_global_id;
1222
1223 global->connection_dialect = conn->smb2.server.dialect;
1224
1225 global->session_wire_id = id;
1226
1227 status = smb2srv_tcon_table_init(session);
1228 if (!NT_STATUS_IS_OK(status)) {
1229 TALLOC_FREE(session);
1230 return status;
1231 }
1232
1233 session->local_id = global->session_global_id;
1234
1235 local_rec = smbXsrv_session_local_fetch_locked(
1236 table->local.db_ctx,
1237 session->local_id,
1238 session /* TALLOC_CTX */);
1239 if (local_rec == NULL) {
1240 TALLOC_FREE(session);
1241 return NT_STATUS_NO_MEMORY;
1242 }
1243
1244 val = dbwrap_record_get_value(local_rec);
1245 if (val.dsize != 0) {
1246 TALLOC_FREE(session);
1247 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1248 }
1249 } else {
1250
1251 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1252 table->local.lowest_id,
1253 table->local.highest_id,
1254 session,
1255 &local_rec,
1256 &session->local_id);
1257 if (!NT_STATUS_IS_OK(status)) {
1258 TALLOC_FREE(session);
1259 return status;
1260 }
1261
1262 global->session_wire_id = session->local_id;
1263 }
1264
1265 global->creation_time = now;
1266 global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1267
1268 status = smbXsrv_session_add_channel(session, conn, &channel);
1269 if (!NT_STATUS_IS_OK(status)) {
1270 TALLOC_FREE(session);
1271 return status;
1272 }
1273
1274 ptr = session;
1275 val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1276 status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1277 TALLOC_FREE(local_rec);
1278 if (!NT_STATUS_IS_OK(status)) {
1279 TALLOC_FREE(session);
1280 return status;
1281 }
1282 table->local.num_sessions += 1;
1283
1284 talloc_set_destructor(session, smbXsrv_session_destructor);
1285
1286 status = smbXsrv_session_global_store(global);
1287 if (!NT_STATUS_IS_OK(status)) {
1288 DEBUG(0,("smbXsrv_session_create: "
1289 "global_id (0x%08x) store failed - %s\n",
1290 session->global->session_global_id,
1291 nt_errstr(status)));
1292 TALLOC_FREE(session);
1293 return status;
1294 }
1295
1296 if (DEBUGLVL(10)) {
1297 struct smbXsrv_sessionB session_blob;
1298
1299 ZERO_STRUCT(session_blob);
1300 session_blob.version = SMBXSRV_VERSION_0;
1301 session_blob.info.info0 = session;
1302
1303 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1304 session->global->session_global_id));
1305 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1306 }
1307
1308 *_session = session;
1309 return NT_STATUS_OK;
1310}
1311
1312NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1313 struct smbXsrv_connection *conn,
1314 struct smbXsrv_channel_global0 **_c)
1315{
1316 struct smbXsrv_session_global0 *global = session->global;
1317 struct smbXsrv_channel_global0 *c = NULL;
1318
1319 if (global->num_channels > 31) {
1320 /*
1321 * Windows 2012 and 2012R2 allow up to 32 channels
1322 */
1323 return NT_STATUS_INSUFFICIENT_RESOURCES;
1324 }
1325
1326 c = talloc_realloc(global,
1327 global->channels,
1328 struct smbXsrv_channel_global0,
1329 global->num_channels + 1);
1330 if (c == NULL) {
1331 return NT_STATUS_NO_MEMORY;
1332 }
1333 global->channels = c;
1334
1335 c = &global->channels[global->num_channels];
1336 ZERO_STRUCTP(c);
1337
1338 c->server_id = messaging_server_id(conn->msg_ctx);
1339 c->local_address = tsocket_address_string(conn->local_address,
1340 global->channels);
1341 if (c->local_address == NULL) {
1342 return NT_STATUS_NO_MEMORY;
1343 }
1344 c->remote_address = tsocket_address_string(conn->remote_address,
1345 global->channels);
1346 if (c->remote_address == NULL) {
1347 return NT_STATUS_NO_MEMORY;
1348 }
1349 c->remote_name = talloc_strdup(global->channels,
1350 conn->remote_hostname);
1351 if (c->remote_name == NULL) {
1352 return NT_STATUS_NO_MEMORY;
1353 }
1354 c->connection = conn;
1355
1356 global->num_channels += 1;
1357
1358 *_c = c;
1359 return NT_STATUS_OK;
1360}
1361
1362NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1363{
1364 struct smbXsrv_session_table *table = session->table;
1365 NTSTATUS status;
1366
1367 if (session->global->db_rec != NULL) {
1368 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1369 "Called with db_rec != NULL'\n",
1370 session->global->session_global_id));
1371 return NT_STATUS_INTERNAL_ERROR;
1372 }
1373
1374 session->global->db_rec = smbXsrv_session_global_fetch_locked(
1375 table->global.db_ctx,
1376 session->global->session_global_id,
1377 session->global /* TALLOC_CTX */);
1378 if (session->global->db_rec == NULL) {
1379 return NT_STATUS_INTERNAL_DB_ERROR;
1380 }
1381
1382 status = smbXsrv_session_global_store(session->global);
1383 if (!NT_STATUS_IS_OK(status)) {
1384 DEBUG(0,("smbXsrv_session_update: "
1385 "global_id (0x%08x) store failed - %s\n",
1386 session->global->session_global_id,
1387 nt_errstr(status)));
1388 return status;
1389 }
1390
1391 if (DEBUGLVL(10)) {
1392 struct smbXsrv_sessionB session_blob;
1393
1394 ZERO_STRUCT(session_blob);
1395 session_blob.version = SMBXSRV_VERSION_0;
1396 session_blob.info.info0 = session;
1397
1398 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1399 session->global->session_global_id));
1400 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1401 }
1402
1403 return NT_STATUS_OK;
1404}
1405
1406NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1407 const struct smbXsrv_connection *conn,
1408 struct smbXsrv_channel_global0 **_c)
1409{
1410 uint32_t i;
1411
1412 for (i=0; i < session->global->num_channels; i++) {
1413 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1414
1415 if (c->connection == conn) {
1416 *_c = c;
1417 return NT_STATUS_OK;
1418 }
1419 }
1420
1421 return NT_STATUS_USER_SESSION_DELETED;
1422}
1423
1424NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1425 const struct smbXsrv_connection *conn,
1426 NTTIME now,
1427 struct smbXsrv_session_auth0 **_a)
1428{
1429 struct smbXsrv_session_auth0 *a;
1430
1431 for (a = session->pending_auth; a != NULL; a = a->next) {
1432 if (a->connection == conn) {
1433 if (now != 0) {
1434 a->idle_time = now;
1435 }
1436 *_a = a;
1437 return NT_STATUS_OK;
1438 }
1439 }
1440
1441 return NT_STATUS_USER_SESSION_DELETED;
1442}
1443
1444static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1445{
1446 if (a->session == NULL) {
1447 return 0;
1448 }
1449
1450 DLIST_REMOVE(a->session->pending_auth, a);
1451 a->session = NULL;
1452 return 0;
1453}
1454
1455NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1456 struct smbXsrv_connection *conn,
1457 NTTIME now,
1458 uint8_t in_flags,
1459 uint8_t in_security_mode,
1460 struct smbXsrv_session_auth0 **_a)
1461{
1462 struct smbXsrv_session_auth0 *a;
1463 NTSTATUS status;
1464
1465 status = smbXsrv_session_find_auth(session, conn, 0, &a);
1466 if (NT_STATUS_IS_OK(status)) {
1467 return NT_STATUS_INTERNAL_ERROR;
1468 }
1469
1470 a = talloc_zero(session, struct smbXsrv_session_auth0);
1471 if (a == NULL) {
1472 return NT_STATUS_NO_MEMORY;
1473 }
1474 a->session = session;
1475 a->connection = conn;
1476 a->in_flags = in_flags;
1477 a->in_security_mode = in_security_mode;
1478 a->creation_time = now;
1479 a->idle_time = now;
1480
1481 if (conn->protocol >= PROTOCOL_SMB3_10) {
1482 a->preauth = talloc(a, struct smbXsrv_preauth);
1483 if (a->preauth == NULL) {
1484 TALLOC_FREE(session);
1485 return NT_STATUS_NO_MEMORY;
1486 }
1487 *a->preauth = conn->smb2.preauth;
1488 }
1489
1490 talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1491 DLIST_ADD_END(session->pending_auth, a);
1492
1493 *_a = a;
1494 return NT_STATUS_OK;
1495}
1496
1497struct smb2srv_session_shutdown_state {
1498 struct tevent_queue *wait_queue;
1499};
1500
1501static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1502
1503struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1504 struct tevent_context *ev,
1505 struct smbXsrv_session *session,
1506 struct smbd_smb2_request *current_req)
1507{
1508 struct tevent_req *req;
1509 struct smb2srv_session_shutdown_state *state;
1510 struct tevent_req *subreq;
1511 struct smbXsrv_connection *xconn = NULL;
1512 size_t len = 0;
1513
1514 /*
1515 * Make sure that no new request will be able to use this session.
1516 */
1517 session->status = NT_STATUS_USER_SESSION_DELETED;
1518
1519 req = tevent_req_create(mem_ctx, &state,
1520 struct smb2srv_session_shutdown_state);
1521 if (req == NULL) {
1522 return NULL;
1523 }
1524
1525 state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1526 if (tevent_req_nomem(state->wait_queue, req)) {
1527 return tevent_req_post(req, ev);
1528 }
1529
1530 for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1531 struct smbd_smb2_request *preq;
1532
1533 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1534 if (preq == current_req) {
1535 /* Can't cancel current request. */
1536 continue;
1537 }
1538 if (preq->session != session) {
1539 /* Request on different session. */
1540 continue;
1541 }
1542
1543 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1544 preq->session = NULL;
1545 /*
1546 * If we no longer have a session we can't
1547 * sign or encrypt replies.
1548 */
1549 preq->do_signing = false;
1550 preq->do_encryption = false;
1551 preq->preauth = NULL;
1552
1553 if (preq->subreq != NULL) {
1554 tevent_req_cancel(preq->subreq);
1555 }
1556 continue;
1557 }
1558
1559 /*
1560 * Never cancel anything in a compound
1561 * request. Way too hard to deal with
1562 * the result.
1563 */
1564 if (!preq->compound_related && preq->subreq != NULL) {
1565 tevent_req_cancel(preq->subreq);
1566 }
1567
1568 /*
1569 * Now wait until the request is finished.
1570 *
1571 * We don't set a callback, as we just want to block the
1572 * wait queue and the talloc_free() of the request will
1573 * remove the item from the wait queue.
1574 */
1575 subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1576 if (tevent_req_nomem(subreq, req)) {
1577 return tevent_req_post(req, ev);
1578 }
1579 }
1580 }
1581
1582 len = tevent_queue_length(state->wait_queue);
1583 if (len == 0) {
1584 tevent_req_done(req);
1585 return tevent_req_post(req, ev);
1586 }
1587
1588 /*
1589 * Now we add our own waiter to the end of the queue,
1590 * this way we get notified when all pending requests are finished
1591 * and send to the socket.
1592 */
1593 subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1594 if (tevent_req_nomem(subreq, req)) {
1595 return tevent_req_post(req, ev);
1596 }
1597 tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1598
1599 return req;
1600}
1601
1602static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1603{
1604 struct tevent_req *req =
1605 tevent_req_callback_data(subreq,
1606 struct tevent_req);
1607
1608 tevent_queue_wait_recv(subreq);
1609 TALLOC_FREE(subreq);
1610
1611 tevent_req_done(req);
1612}
1613
1614NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1615{
1616 return tevent_req_simple_recv_ntstatus(req);
1617}
1618
1619NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1620{
1621 struct smbXsrv_session_table *table;
1622 struct db_record *local_rec = NULL;
1623 struct db_record *global_rec = NULL;
1624 struct smbd_server_connection *sconn = NULL;
1625 NTSTATUS status;
1626 NTSTATUS error = NT_STATUS_OK;
1627
1628 if (session->table == NULL) {
1629 return NT_STATUS_OK;
1630 }
1631
1632 table = session->table;
1633 session->table = NULL;
1634
1635 sconn = session->client->sconn;
1636 session->client = NULL;
1637 session->status = NT_STATUS_USER_SESSION_DELETED;
1638
1639 global_rec = session->global->db_rec;
1640 session->global->db_rec = NULL;
1641 if (global_rec == NULL) {
1642 global_rec = smbXsrv_session_global_fetch_locked(
1643 table->global.db_ctx,
1644 session->global->session_global_id,
1645 session->global /* TALLOC_CTX */);
1646 if (global_rec == NULL) {
1647 error = NT_STATUS_INTERNAL_ERROR;
1648 }
1649 }
1650
1651 if (global_rec != NULL) {
1652 status = dbwrap_record_delete(global_rec);
1653 if (!NT_STATUS_IS_OK(status)) {
1654 TDB_DATA key = dbwrap_record_get_key(global_rec);
1655
1656 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1657 "failed to delete global key '%s': %s\n",
1658 session->global->session_global_id,
1659 hex_encode_talloc(global_rec, key.dptr,
1660 key.dsize),
1661 nt_errstr(status)));
1662 error = status;
1663 }
1664 }
1665 TALLOC_FREE(global_rec);
1666
1667 local_rec = session->db_rec;
1668 if (local_rec == NULL) {
1669 local_rec = smbXsrv_session_local_fetch_locked(
1670 table->local.db_ctx,
1671 session->local_id,
1672 session /* TALLOC_CTX */);
1673 if (local_rec == NULL) {
1674 error = NT_STATUS_INTERNAL_ERROR;
1675 }
1676 }
1677
1678 if (local_rec != NULL) {
1679 status = dbwrap_record_delete(local_rec);
1680 if (!NT_STATUS_IS_OK(status)) {
1681 TDB_DATA key = dbwrap_record_get_key(local_rec);
1682
1683 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1684 "failed to delete local key '%s': %s\n",
1685 session->global->session_global_id,
1686 hex_encode_talloc(local_rec, key.dptr,
1687 key.dsize),
1688 nt_errstr(status)));
1689 error = status;
1690 }
1691 table->local.num_sessions -= 1;
1692 }
1693 if (session->db_rec == NULL) {
1694 TALLOC_FREE(local_rec);
1695 }
1696 session->db_rec = NULL;
1697
1698 if (session->compat) {
1699 file_close_user(sconn, session->compat->vuid);
1700 }
1701
1702 if (session->tcon_table != NULL) {
1703 /*
1704 * Note: We only have a tcon_table for SMB2.
1705 */
1706 status = smb2srv_tcon_disconnect_all(session);
1707 if (!NT_STATUS_IS_OK(status)) {
1708 DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1709 "smb2srv_tcon_disconnect_all() failed: %s\n",
1710 session->global->session_global_id,
1711 nt_errstr(status)));
1712 error = status;
1713 }
1714 }
1715
1716 if (session->compat) {
1717 invalidate_vuid(sconn, session->compat->vuid);
1718 session->compat = NULL;
1719 }
1720
1721 return error;
1722}
1723
1724struct smbXsrv_session_logoff_all_state {
1725 NTSTATUS first_status;
1726 int errors;
1727};
1728
1729static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1730 void *private_data);
1731
1732NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_connection *conn)
1733{
1734 struct smbXsrv_session_table *table = conn->client->session_table;
1735 struct smbXsrv_session_logoff_all_state state;
1736 NTSTATUS status;
1737 int count = 0;
1738
1739 if (table == NULL) {
1740 DEBUG(10, ("smbXsrv_session_logoff_all: "
1741 "empty session_table, nothing to do.\n"));
1742 return NT_STATUS_OK;
1743 }
1744
1745 ZERO_STRUCT(state);
1746
1747 status = dbwrap_traverse(table->local.db_ctx,
1748 smbXsrv_session_logoff_all_callback,
1749 &state, &count);
1750 if (!NT_STATUS_IS_OK(status)) {
1751 DEBUG(0, ("smbXsrv_session_logoff_all: "
1752 "dbwrap_traverse() failed: %s\n",
1753 nt_errstr(status)));
1754 return status;
1755 }
1756
1757 if (!NT_STATUS_IS_OK(state.first_status)) {
1758 DEBUG(0, ("smbXsrv_session_logoff_all: "
1759 "count[%d] errors[%d] first[%s]\n",
1760 count, state.errors,
1761 nt_errstr(state.first_status)));
1762 return state.first_status;
1763 }
1764
1765 return NT_STATUS_OK;
1766}
1767
1768static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1769 void *private_data)
1770{
1771 struct smbXsrv_session_logoff_all_state *state =
1772 (struct smbXsrv_session_logoff_all_state *)private_data;
1773 TDB_DATA val;
1774 void *ptr = NULL;
1775 struct smbXsrv_session *session = NULL;
1776 NTSTATUS status;
1777
1778 val = dbwrap_record_get_value(local_rec);
1779 if (val.dsize != sizeof(ptr)) {
1780 status = NT_STATUS_INTERNAL_ERROR;
1781 if (NT_STATUS_IS_OK(state->first_status)) {
1782 state->first_status = status;
1783 }
1784 state->errors++;
1785 return 0;
1786 }
1787
1788 memcpy(&ptr, val.dptr, val.dsize);
1789 session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1790
1791 session->db_rec = local_rec;
1792
1793 status = smbXsrv_session_clear_and_logoff(session);
1794 if (!NT_STATUS_IS_OK(status)) {
1795 if (NT_STATUS_IS_OK(state->first_status)) {
1796 state->first_status = status;
1797 }
1798 state->errors++;
1799 return 0;
1800 }
1801
1802 return 0;
1803}
1804
1805NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
1806{
1807 /*
1808 * Allow a range from 1..65534 with 65534 values.
1809 */
1810 return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
1811 UINT16_MAX - 1);
1812}
1813
1814NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
1815 uint16_t vuid, NTTIME now,
1816 struct smbXsrv_session **session)
1817{
1818 struct smbXsrv_session_table *table = conn->client->session_table;
1819 uint32_t local_id = vuid;
1820
1821 return smbXsrv_session_local_lookup(table, conn, local_id, now,
1822 session);
1823}
1824
1825NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
1826{
1827 /*
1828 * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
1829 */
1830 return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
1831 UINT16_MAX - 1);
1832}
1833
1834static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
1835 /* conn: optional */
1836 struct smbXsrv_connection *conn,
1837 uint64_t session_id, NTTIME now,
1838 struct smbXsrv_session **session)
1839{
1840 uint32_t local_id = session_id & UINT32_MAX;
1841 uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
1842
1843 if (local_zeros != 0) {
1844 return NT_STATUS_USER_SESSION_DELETED;
1845 }
1846
1847 return smbXsrv_session_local_lookup(table, conn, local_id, now,
1848 session);
1849}
1850
1851NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
1852 uint64_t session_id, NTTIME now,
1853 struct smbXsrv_session **session)
1854{
1855 struct smbXsrv_session_table *table = conn->client->session_table;
1856 return smb2srv_session_lookup_raw(table, conn, session_id, now,
1857 session);
1858}
1859
1860NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
1861 uint64_t session_id, NTTIME now,
1862 struct smbXsrv_session **session)
1863{
1864 struct smbXsrv_session_table *table = client->session_table;
1865 return smb2srv_session_lookup_raw(table, NULL, session_id, now,
1866 session);
1867}
1868
1869struct smbXsrv_session_global_traverse_state {
1870 int (*fn)(struct smbXsrv_session_global0 *, void *);
1871 void *private_data;
1872};
1873
1874static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
1875{
1876 int ret = -1;
1877 struct smbXsrv_session_global_traverse_state *state =
1878 (struct smbXsrv_session_global_traverse_state*)data;
1879 TDB_DATA key = dbwrap_record_get_key(rec);
1880 TDB_DATA val = dbwrap_record_get_value(rec);
1881 DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
1882 struct smbXsrv_session_globalB global_blob;
1883 enum ndr_err_code ndr_err;
1884 TALLOC_CTX *frame = talloc_stackframe();
1885
1886 ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
1887 (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
1888 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1889 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1890 "key '%s' ndr_pull_struct_blob - %s\n",
1891 hex_encode_talloc(frame, key.dptr, key.dsize),
1892 ndr_errstr(ndr_err)));
1893 goto done;
1894 }
1895
1896 if (global_blob.version != SMBXSRV_VERSION_0) {
1897 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1898 "key '%s' unsuported version - %d\n",
1899 hex_encode_talloc(frame, key.dptr, key.dsize),
1900 (int)global_blob.version));
1901 goto done;
1902 }
1903
1904 global_blob.info.info0->db_rec = rec;
1905 ret = state->fn(global_blob.info.info0, state->private_data);
1906done:
1907 TALLOC_FREE(frame);
1908 return ret;
1909}
1910
1911NTSTATUS smbXsrv_session_global_traverse(
1912 int (*fn)(struct smbXsrv_session_global0 *, void *),
1913 void *private_data)
1914{
1915
1916 NTSTATUS status;
1917 int count = 0;
1918 struct smbXsrv_session_global_traverse_state state = {
1919 .fn = fn,
1920 .private_data = private_data,
1921 };
1922
1923 become_root();
1924 status = smbXsrv_session_global_init();
1925 if (!NT_STATUS_IS_OK(status)) {
1926 unbecome_root();
1927 DEBUG(0, ("Failed to initialize session_global: %s\n",
1928 nt_errstr(status)));
1929 return status;
1930 }
1931
1932 status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
1933 smbXsrv_session_global_traverse_fn,
1934 &state,
1935 &count);
1936 unbecome_root();
1937
1938 return status;
1939}
Note: See TracBrowser for help on using the repository browser.