source3/smbd/smb2_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) Jeremy Allison 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "system/network.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "smbd/smbXsrv_open.h"
  27 #include "lib/param/param.h"
  28 #include "../libcli/smb/smb_common.h"
  29 #include "../lib/tsocket/tsocket.h"
  30 #include "../lib/util/tevent_ntstatus.h"
  31 #include "smbprofile.h"
  32 #include "../lib/util/bitmap.h"
  33 #include "../librpc/gen_ndr/krb5pac.h"
  34 #include "lib/util/iov_buf.h"
  35 #include "auth.h"
  36 #include "libcli/smb/smbXcli_base.h"
  37 #include "source3/lib/substitute.h"
  38
  39 #if defined(LINUX)
  40 /* SIOCOUTQ TIOCOUTQ are the same */
  41 #define __IOCTL_SEND_QUEUE_SIZE_OPCODE TIOCOUTQ
  42 #define __HAVE_TCP_INFO_RTO 1
  43 #define __ALLOW_MULTI_CHANNEL_SUPPORT 1
  44 #elif defined(FREEBSD)
  45 #define __IOCTL_SEND_QUEUE_SIZE_OPCODE FIONWRITE
  46 #define __HAVE_TCP_INFO_RTO 1
  47 #define __ALLOW_MULTI_CHANNEL_SUPPORT 1
  48 #endif
  49
  50 #include "lib/crypto/gnutls_helpers.h"
  51 #include <gnutls/gnutls.h>
  52 #include <gnutls/crypto.h>
  53
  54 #undef DBGC_CLASS
  55 #define DBGC_CLASS DBGC_SMB2
  56
  57 static void smbd_smb2_connection_handler(struct tevent_context *ev,
  58                                          struct tevent_fd *fde,
  59                                          uint16_t flags,
  60                                          void *private_data);
  61 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn);
  62
  63 static const struct smbd_smb2_dispatch_table {
  64         uint16_t opcode;
  65         const char *name;
  66         bool need_session;
  67         bool need_tcon;
  68         bool as_root;
  69         uint16_t fileid_ofs;
  70         bool modify;
  71 } smbd_smb2_table[] = {
  72 #define _OP(o) .opcode = o, .name = #o
  73         {
  74                 _OP(SMB2_OP_NEGPROT),
  75                 .as_root = true,
  76         },{
  77                 _OP(SMB2_OP_SESSSETUP),
  78                 .as_root = true,
  79         },{
  80                 _OP(SMB2_OP_LOGOFF),
  81                 .need_session = true,
  82                 .as_root = true,
  83         },{
  84                 _OP(SMB2_OP_TCON),
  85                 .need_session = true,
  86                 /*
  87                  * This call needs to be run as root.
  88                  *
  89                  * smbd_smb2_request_process_tcon()
  90                  * calls make_connection_snum(), which will call
  91                  * change_to_user(), when needed.
  92                  */
  93                 .as_root = true,
  94         },{
  95                 _OP(SMB2_OP_TDIS),
  96                 .need_session = true,
  97                 .need_tcon = true,
  98                 .as_root = true,
  99         },{
 100                 _OP(SMB2_OP_CREATE),
 101                 .need_session = true,
 102                 .need_tcon = true,
 103         },{
 104                 _OP(SMB2_OP_CLOSE),
 105                 .need_session = true,
 106                 .need_tcon = true,
 107                 .fileid_ofs = 0x08,
 108         },{
 109                 _OP(SMB2_OP_FLUSH),
 110                 .need_session = true,
 111                 .need_tcon = true,
 112                 .fileid_ofs = 0x08,
 113         },{
 114                 _OP(SMB2_OP_READ),
 115                 .need_session = true,
 116                 .need_tcon = true,
 117                 .fileid_ofs = 0x10,
 118         },{
 119                 _OP(SMB2_OP_WRITE),
 120                 .need_session = true,
 121                 .need_tcon = true,
 122                 .fileid_ofs = 0x10,
 123                 .modify = true,
 124         },{
 125                 _OP(SMB2_OP_LOCK),
 126                 .need_session = true,
 127                 .need_tcon = true,
 128                 .fileid_ofs = 0x08,
 129         },{
 130                 _OP(SMB2_OP_IOCTL),
 131                 .need_session = true,
 132                 .need_tcon = true,
 133                 .fileid_ofs = 0x08,
 134                 .modify = true,
 135         },{
 136                 _OP(SMB2_OP_CANCEL),
 137                 .as_root = true,
 138         },{
 139                 _OP(SMB2_OP_KEEPALIVE),
 140                 .as_root = true,
 141         },{
 142                 _OP(SMB2_OP_QUERY_DIRECTORY),
 143                 .need_session = true,
 144                 .need_tcon = true,
 145                 .fileid_ofs = 0x08,
 146         },{
 147                 _OP(SMB2_OP_NOTIFY),
 148                 .need_session = true,
 149                 .need_tcon = true,
 150                 .fileid_ofs = 0x08,
 151         },{
 152                 _OP(SMB2_OP_GETINFO),
 153                 .need_session = true,
 154                 .need_tcon = true,
 155                 .fileid_ofs = 0x18,
 156         },{
 157                 _OP(SMB2_OP_SETINFO),
 158                 .need_session = true,
 159                 .need_tcon = true,
 160                 .fileid_ofs = 0x10,
 161                 .modify = true,
 162         },{
 163                 _OP(SMB2_OP_BREAK),
 164                 .need_session = true,
 165                 .need_tcon = true,
 166                 /*
 167                  * we do not set
 168                  * .fileid_ofs here
 169                  * as LEASE breaks does not
 170                  * have a file id
 171                  */
 172         }
 173 };
 174
 175 const char *smb2_opcode_name(uint16_t opcode)
 176 {
 177         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
 178                 return "Bad SMB2 opcode";
 179         }
 180         return smbd_smb2_table[opcode].name;
 181 }
 182
 183 static const struct smbd_smb2_dispatch_table *smbd_smb2_call(uint16_t opcode)
 184 {
 185         const struct smbd_smb2_dispatch_table *ret = NULL;
 186
 187         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
 188                 return NULL;
 189         }
 190
 191         ret = &smbd_smb2_table[opcode];
 192
 193         SMB_ASSERT(ret->opcode == opcode);
 194
 195         return ret;
 196 }
 197
 198 static void print_req_vectors(const struct smbd_smb2_request *req)
 199 {
 200         int i;
 201
 202         for (i = 0; i < req->in.vector_count; i++) {
 203                 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
 204                         (unsigned int)i,
 205                         (unsigned int)req->in.vector[i].iov_len);
 206         }
 207         for (i = 0; i < req->out.vector_count; i++) {
 208                 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
 209                         (unsigned int)i,
 210                         (unsigned int)req->out.vector[i].iov_len);
 211         }
 212 }
 213
 214 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
 215 {
 216         if (size < (4 + SMB2_HDR_BODY)) {
 217                 return false;
 218         }
 219
 220         if (IVAL(inbuf, 4) != SMB2_MAGIC) {
 221                 return false;
 222         }
 223
 224         return true;
 225 }
 226
 227 bool smbd_smb2_is_compound(const struct smbd_smb2_request *req)
 228 {
 229         return req->in.vector_count >= (2*SMBD_SMB2_NUM_IOV_PER_REQ);
 230 }
 231
 232 static NTSTATUS smbd_initialize_smb2(struct smbXsrv_connection *xconn,
 233                                      uint64_t expected_seq_low)
 234 {
 235         int rc;
 236
 237         xconn->smb2.credits.seq_low = expected_seq_low;
 238         xconn->smb2.credits.seq_range = 1;
 239         xconn->smb2.credits.granted = 1;
 240         xconn->smb2.credits.max = lp_smb2_max_credits();
 241         xconn->smb2.credits.bitmap = bitmap_talloc(xconn,
 242                                                    xconn->smb2.credits.max);
 243         if (xconn->smb2.credits.bitmap == NULL) {
 244                 return NT_STATUS_NO_MEMORY;
 245         }
 246
 247         tevent_fd_set_close_fn(xconn->transport.fde, NULL);
 248         TALLOC_FREE(xconn->transport.fde);
 249
 250         xconn->transport.fde = tevent_add_fd(
 251                                         xconn->client->raw_ev_ctx,
 252                                         xconn,
 253                                         xconn->transport.sock,
 254                                         TEVENT_FD_READ,
 255                                         smbd_smb2_connection_handler,
 256                                         xconn);
 257         if (xconn->transport.fde == NULL) {
 258                 close(xconn->transport.sock);
 259                 xconn->transport.sock = -1;
 260                 return NT_STATUS_NO_MEMORY;
 261         }
 262         tevent_fd_set_auto_close(xconn->transport.fde);
 263
 264         /* Ensure child is set to non-blocking mode */
 265         rc = set_blocking(xconn->transport.sock, false);
 266         if (rc < 0) {
 267                 return NT_STATUS_INTERNAL_ERROR;
 268         }
 269
 270         return NT_STATUS_OK;
 271 }
 272
 273 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
 274 #define _smb2_setlen(_buf,len) do { \
 275         uint8_t *buf = (uint8_t *)_buf; \
 276         buf[0] = 0; \
 277         buf[1] = ((len)&0xFF0000)>>16; \
 278         buf[2] = ((len)&0xFF00)>>8; \
 279         buf[3] = (len)&0xFF; \
 280 } while (0)
 281
 282 static bool smb2_setup_nbt_length(struct iovec *vector, int count)
 283 {
 284         ssize_t len;
 285
 286         if (count == 0) {
 287                 return false;
 288         }
 289
 290         len = iov_buflen(vector+1, count-1);
 291
 292         if ((len == -1) || (len > 0xFFFFFF)) {
 293                 return false;
 294         }
 295
 296         _smb2_setlen(vector[0].iov_base, len);
 297         return true;
 298 }
 299
 300 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
 301 {
 302         TALLOC_FREE(req->first_enc_key);
 303         TALLOC_FREE(req->last_sign_key);
 304         return 0;
 305 }
 306
 307 void smb2_request_set_async_internal(struct smbd_smb2_request *req,
 308                                      bool async_internal)
 309 {
 310         req->async_internal = async_internal;
 311 }
 312
 313 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
 314 {
 315         TALLOC_CTX *mem_pool;
 316         struct smbd_smb2_request *req;
 317
 318 #if 0
 319         /* Enable this to find subtle valgrind errors. */
 320         mem_pool = talloc_init("smbd_smb2_request_allocate");
 321 #else
 322         mem_pool = talloc_tos();
 323 #endif
 324         if (mem_pool == NULL) {
 325                 return NULL;
 326         }
 327
 328         req = talloc_zero(mem_pool, struct smbd_smb2_request);
 329         if (req == NULL) {
 330                 talloc_free(mem_pool);
 331                 return NULL;
 332         }
 333         talloc_reparent(mem_pool, mem_ctx, req);
 334 #if 0
 335         TALLOC_FREE(mem_pool);
 336 #endif
 337
 338         req->last_session_id = UINT64_MAX;
 339         req->last_tid = UINT32_MAX;
 340
 341         talloc_set_destructor(req, smbd_smb2_request_destructor);
 342
 343         return req;
 344 }
 345
 346 static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *xconn,
 347                                                NTTIME now,
 348                                                uint8_t *buf,
 349                                                size_t buflen,
 350                                                struct smbd_smb2_request *req,
 351                                                struct iovec **piov,
 352                                                int *pnum_iov)
 353 {
 354         TALLOC_CTX *mem_ctx = req;
 355         struct iovec *iov;
 356         int num_iov = 1;
 357         size_t taken = 0;
 358         uint8_t *first_hdr = buf;
 359         size_t verified_buflen = 0;
 360         uint8_t *tf = NULL;
 361         size_t tf_len = 0;
 362
 363         /*
 364          * Note: index '0' is reserved for the transport protocol
 365          */
 366         iov = req->in._vector;
 367
 368         while (taken < buflen) {
 369                 size_t len = buflen - taken;
 370                 uint8_t *hdr = first_hdr + taken;
 371                 struct iovec *cur;
 372                 size_t full_size;
 373                 size_t next_command_ofs;
 374                 uint16_t body_size;
 375                 uint8_t *body = NULL;
 376                 uint32_t dyn_size;
 377                 uint8_t *dyn = NULL;
 378                 struct iovec *iov_alloc = NULL;
 379
 380                 if (iov != req->in._vector) {
 381                         iov_alloc = iov;
 382                 }
 383
 384                 if (verified_buflen > taken) {
 385                         len = verified_buflen - taken;
 386                 } else {
 387                         tf = NULL;
 388                         tf_len = 0;
 389                 }
 390
 391                 if (len < 4) {
 392                         DEBUG(10, ("%d bytes left, expected at least %d\n",
 393                                    (int)len, 4));
 394                         goto inval;
 395                 }
 396                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
 397                         struct smbXsrv_session *s = NULL;
 398                         uint64_t uid;
 399                         struct iovec tf_iov[2];
 400                         NTSTATUS status;
 401                         size_t enc_len;
 402
 403                         if (xconn->protocol < PROTOCOL_SMB3_00) {
 404                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
 405                                            "but dialect[0x%04X] is used\n",
 406                                            xconn->smb2.server.dialect));
 407                                 goto inval;
 408                         }
 409
 410                         if (xconn->smb2.server.cipher == 0) {
 411                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
 412                                            "but not negotiated "
 413                                            "client[0x%08X] server[0x%08X]\n",
 414                                            xconn->smb2.client.capabilities,
 415                                            xconn->smb2.server.capabilities));
 416                                 goto inval;
 417                         }
 418
 419                         if (len < SMB2_TF_HDR_SIZE) {
 420                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
 421                                            (int)len, SMB2_TF_HDR_SIZE));
 422                                 goto inval;
 423                         }
 424                         tf = hdr;
 425                         tf_len = SMB2_TF_HDR_SIZE;
 426                         taken += tf_len;
 427
 428                         hdr = first_hdr + taken;
 429                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
 430                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
 431
 432                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
 433                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
 434                                            (int)len,
 435                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
 436                                 goto inval;
 437                         }
 438
 439                         status = smb2srv_session_lookup_conn(xconn, uid, now,
 440                                                              &s);
 441                         if (s == NULL) {
 442                                 status = smb2srv_session_lookup_global(xconn->client,
 443                                                                        uid, req, &s);
 444                         }
 445                         if (s == NULL) {
 446                                 DEBUG(1, ("invalid session[%llu] in "
 447                                           "SMB2_TRANSFORM header\n",
 448                                            (unsigned long long)uid));
 449                                 TALLOC_FREE(iov_alloc);
 450                                 return NT_STATUS_USER_SESSION_DELETED;
 451                         }
 452
 453                         tf_iov[0].iov_base = (void *)tf;
 454                         tf_iov[0].iov_len = tf_len;
 455                         tf_iov[1].iov_base = (void *)hdr;
 456                         tf_iov[1].iov_len = enc_len;
 457
 458                         status = smb2_signing_decrypt_pdu(s->global->decryption_key,
 459                                                           tf_iov, 2);
 460                         if (!NT_STATUS_IS_OK(status)) {
 461                                 TALLOC_FREE(iov_alloc);
 462                                 return status;
 463                         }
 464
 465                         verified_buflen = taken + enc_len;
 466                         len = enc_len;
 467                 }
 468
 469                 /*
 470                  * We need the header plus the body length field
 471                  */
 472
 473                 if (len < SMB2_HDR_BODY + 2) {
 474
 475                         if ((len == 5) &&
 476                             (IVAL(hdr, 0) == SMB_SUICIDE_PACKET) &&
 477                             lp_parm_bool(-1, "smbd", "suicide mode", false)) {
 478                                 uint8_t exitcode = CVAL(hdr, 4);
 479                                 DBG_WARNING("SUICIDE: Exiting immediately "
 480                                             "with code %"PRIu8"\n",
 481                                             exitcode);
 482                                 exit(exitcode);
 483                         }
 484
 485                         DEBUG(10, ("%d bytes left, expected at least %d\n",
 486                                    (int)len, SMB2_HDR_BODY));
 487                         goto inval;
 488                 }
 489                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
 490                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
 491                                    IVAL(hdr, 0)));
 492                         goto inval;
 493                 }
 494                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
 495                         DEBUG(10, ("Got HDR len %d, expected %d\n",
 496                                    SVAL(hdr, 4), SMB2_HDR_BODY));
 497                         goto inval;
 498                 }
 499
 500                 full_size = len;
 501                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
 502                 body_size = SVAL(hdr, SMB2_HDR_BODY);
 503
 504                 if (next_command_ofs != 0) {
 505                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
 506                                 goto inval;
 507                         }
 508                         if (next_command_ofs > full_size) {
 509                                 goto inval;
 510                         }
 511                         full_size = next_command_ofs;
 512                 }
 513                 if (body_size < 2) {
 514                         goto inval;
 515                 }
 516                 body_size &= 0xfffe;
 517
 518                 if (body_size > (full_size - SMB2_HDR_BODY)) {
 519                         /*
 520                          * let the caller handle the error
 521                          */
 522                         body_size = full_size - SMB2_HDR_BODY;
 523                 }
 524                 body = hdr + SMB2_HDR_BODY;
 525                 dyn = body + body_size;
 526                 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
 527
 528                 if (num_iov >= ARRAY_SIZE(req->in._vector)) {
 529                         struct iovec *iov_tmp = NULL;
 530
 531                         iov_tmp = talloc_realloc(mem_ctx, iov_alloc,
 532                                                  struct iovec,
 533                                                  num_iov +
 534                                                  SMBD_SMB2_NUM_IOV_PER_REQ);
 535                         if (iov_tmp == NULL) {
 536                                 TALLOC_FREE(iov_alloc);
 537                                 return NT_STATUS_NO_MEMORY;
 538                         }
 539
 540                         if (iov_alloc == NULL) {
 541                                 memcpy(iov_tmp,
 542                                        req->in._vector,
 543                                        sizeof(req->in._vector));
 544                         }
 545
 546                         iov = iov_tmp;
 547                 }
 548                 cur = &iov[num_iov];
 549                 num_iov += SMBD_SMB2_NUM_IOV_PER_REQ;
 550
 551                 cur[SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
 552                 cur[SMBD_SMB2_TF_IOV_OFS].iov_len    = tf_len;
 553                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
 554                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
 555                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
 556                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_len  = body_size;
 557                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
 558                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_len   = dyn_size;
 559
 560                 taken += full_size;
 561         }
 562
 563         *piov = iov;
 564         *pnum_iov = num_iov;
 565         return NT_STATUS_OK;
 566
 567 inval:
 568         if (iov != req->in._vector) {
 569                 TALLOC_FREE(iov);
 570         }
 571         return NT_STATUS_INVALID_PARAMETER;
 572 }
 573
 574 static NTSTATUS smbd_smb2_request_create(struct smbXsrv_connection *xconn,
 575                                          const uint8_t *_inpdu, size_t size,
 576                                          struct smbd_smb2_request **_req)
 577 {
 578         struct smbd_server_connection *sconn = xconn->client->sconn;
 579         struct smbd_smb2_request *req;
 580         uint32_t protocol_version;
 581         uint8_t *inpdu = NULL;
 582         const uint8_t *inhdr = NULL;
 583         uint16_t cmd;
 584         uint32_t next_command_ofs;
 585         NTSTATUS status;
 586         NTTIME now;
 587
 588         if (size < (SMB2_HDR_BODY + 2)) {
 589                 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
 590                 return NT_STATUS_INVALID_PARAMETER;
 591         }
 592
 593         inhdr = _inpdu;
 594
 595         protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
 596         if (protocol_version != SMB2_MAGIC) {
 597                 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
 598                          protocol_version));
 599                 return NT_STATUS_INVALID_PARAMETER;
 600         }
 601
 602         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 603         if (cmd != SMB2_OP_NEGPROT) {
 604                 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
 605                          cmd));
 606                 return NT_STATUS_INVALID_PARAMETER;
 607         }
 608
 609         next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
 610         if (next_command_ofs != 0) {
 611                 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
 612                          next_command_ofs));
 613                 return NT_STATUS_INVALID_PARAMETER;
 614         }
 615
 616         req = smbd_smb2_request_allocate(xconn);
 617         if (req == NULL) {
 618                 return NT_STATUS_NO_MEMORY;
 619         }
 620         req->sconn = sconn;
 621         req->xconn = xconn;
 622
 623         inpdu = talloc_memdup(req, _inpdu, size);
 624         if (inpdu == NULL) {
 625                 return NT_STATUS_NO_MEMORY;
 626         }
 627
 628         req->request_time = timeval_current();
 629         now = timeval_to_nttime(&req->request_time);
 630
 631         status = smbd_smb2_inbuf_parse_compound(xconn,
 632                                                 now,
 633                                                 inpdu,
 634                                                 size,
 635                                                 req, &req->in.vector,
 636                                                 &req->in.vector_count);
 637         if (!NT_STATUS_IS_OK(status)) {
 638                 TALLOC_FREE(req);
 639                 return status;
 640         }
 641
 642         req->current_idx = 1;
 643
 644         *_req = req;
 645         return NT_STATUS_OK;
 646 }
 647
 648 static bool smb2_validate_sequence_number(struct smbXsrv_connection *xconn,
 649                                           uint64_t message_id, uint64_t seq_id)
 650 {
 651         struct bitmap *credits_bm = xconn->smb2.credits.bitmap;
 652         unsigned int offset;
 653         uint64_t seq_tmp;
 654
 655         seq_tmp = xconn->smb2.credits.seq_low;
 656         if (seq_id < seq_tmp) {
 657                 DBGC_ERR(DBGC_SMB2_CREDITS,
 658                         "smb2_validate_sequence_number: bad message_id "
 659                         "%llu (sequence id %llu) "
 660                         "(granted = %u, low = %llu, range = %u)\n",
 661                         (unsigned long long)message_id,
 662                         (unsigned long long)seq_id,
 663                         (unsigned int)xconn->smb2.credits.granted,
 664                         (unsigned long long)xconn->smb2.credits.seq_low,
 665                         (unsigned int)xconn->smb2.credits.seq_range);
 666                 return false;
 667         }
 668
 669         seq_tmp += xconn->smb2.credits.seq_range;
 670         if (seq_id >= seq_tmp) {
 671                 DBGC_ERR(DBGC_SMB2_CREDITS,
 672                         "smb2_validate_sequence_number: bad message_id "
 673                         "%llu (sequence id %llu) "
 674                         "(granted = %u, low = %llu, range = %u)\n",
 675                         (unsigned long long)message_id,
 676                         (unsigned long long)seq_id,
 677                         (unsigned int)xconn->smb2.credits.granted,
 678                         (unsigned long long)xconn->smb2.credits.seq_low,
 679                         (unsigned int)xconn->smb2.credits.seq_range);
 680                 return false;
 681         }
 682
 683         offset = seq_id % xconn->smb2.credits.max;
 684
 685         if (bitmap_query(credits_bm, offset)) {
 686                 DBGC_ERR(DBGC_SMB2_CREDITS,
 687                         "smb2_validate_sequence_number: duplicate message_id "
 688                         "%llu (sequence id %llu) "
 689                         "(granted = %u, low = %llu, range = %u) "
 690                         "(bm offset %u)\n",
 691                         (unsigned long long)message_id,
 692                         (unsigned long long)seq_id,
 693                         (unsigned int)xconn->smb2.credits.granted,
 694                         (unsigned long long)xconn->smb2.credits.seq_low,
 695                         (unsigned int)xconn->smb2.credits.seq_range,
 696                         offset);
 697                 return false;
 698         }
 699
 700         /* Mark the message_ids as seen in the bitmap. */
 701         bitmap_set(credits_bm, offset);
 702
 703         if (seq_id != xconn->smb2.credits.seq_low) {
 704                 return true;
 705         }
 706
 707         /*
 708          * Move the window forward by all the message_id's
 709          * already seen.
 710          */
 711         while (bitmap_query(credits_bm, offset)) {
 712                 DBGC_DEBUG(DBGC_SMB2_CREDITS,
 713                           "smb2_validate_sequence_number: clearing "
 714                           "id %llu (position %u) from bitmap\n",
 715                           (unsigned long long)(xconn->smb2.credits.seq_low),
 716                           offset);
 717                 bitmap_clear(credits_bm, offset);
 718
 719                 xconn->smb2.credits.seq_low += 1;
 720                 xconn->smb2.credits.seq_range -= 1;
 721                 offset = xconn->smb2.credits.seq_low % xconn->smb2.credits.max;
 722         }
 723
 724         return true;
 725 }
 726
 727 static bool smb2_validate_message_id(struct smbXsrv_connection *xconn,
 728                                      const uint8_t *inhdr)
 729 {
 730         uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
 731         uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
 732         uint16_t credit_charge = 1;
 733         uint64_t i;
 734
 735         if (opcode == SMB2_OP_CANCEL) {
 736                 /* SMB2_CANCEL requests by definition resend messageids. */
 737                 return true;
 738         }
 739
 740         if (xconn->smb2.credits.multicredit) {
 741                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
 742                 credit_charge = MAX(credit_charge, 1);
 743         }
 744
 745         DEBUGC(11,
 746                    DBGC_SMB2_CREDITS,
 747                    ("smb2_validate_message_id: mid %llu (charge %llu), "
 748                    "credits_granted %llu, "
 749                    "seqnum low/range: %llu/%llu\n",
 750                    (unsigned long long) message_id,
 751                    (unsigned long long) credit_charge,
 752                    (unsigned long long) xconn->smb2.credits.granted,
 753                    (unsigned long long) xconn->smb2.credits.seq_low,
 754                    (unsigned long long) xconn->smb2.credits.seq_range));
 755
 756         if (xconn->smb2.credits.granted < credit_charge) {
 757                 DBGC_ERR(DBGC_SMB2_CREDITS,
 758                           "smb2_validate_message_id: client used more "
 759                           "credits than granted, mid %llu, charge %llu, "
 760                           "credits_granted %llu, "
 761                           "seqnum low/range: %llu/%llu\n",
 762                           (unsigned long long) message_id,
 763                           (unsigned long long) credit_charge,
 764                           (unsigned long long) xconn->smb2.credits.granted,
 765                           (unsigned long long) xconn->smb2.credits.seq_low,
 766                           (unsigned long long) xconn->smb2.credits.seq_range);
 767                 return false;
 768         }
 769
 770         /*
 771          * now check the message ids
 772          *
 773          * for multi-credit requests we need to check all current mid plus
 774          * the implicit mids caused by the credit charge
 775          * e.g. current mid = 15, charge 5 => mark 15-19 as used
 776          */
 777
 778         for (i = 0; i <= (credit_charge-1); i++) {
 779                 uint64_t id = message_id + i;
 780                 bool ok;
 781
 782                 DEBUGC(11,
 783                            DBGC_SMB2_CREDITS,
 784                            ("Iterating mid %llu charge %u (sequence %llu)\n",
 785                            (unsigned long long)message_id,
 786                            credit_charge,
 787                            (unsigned long long)id));
 788
 789                 ok = smb2_validate_sequence_number(xconn, message_id, id);
 790                 if (!ok) {
 791                         return false;
 792                 }
 793         }
 794
 795         /* substract used credits */
 796         xconn->smb2.credits.granted -= credit_charge;
 797
 798         return true;
 799 }
 800
 801 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
 802 {
 803         int count;
 804         int idx;
 805
 806         count = req->in.vector_count;
 807
 808         if (count < 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
 809                 /* It's not a SMB2 request */
 810                 return NT_STATUS_INVALID_PARAMETER;
 811         }
 812
 813         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 814                 struct iovec *hdr = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
 815                 struct iovec *body = SMBD_SMB2_IDX_BODY_IOV(req,in,idx);
 816                 const uint8_t *inhdr = NULL;
 817
 818                 if (hdr->iov_len != SMB2_HDR_BODY) {
 819                         return NT_STATUS_INVALID_PARAMETER;
 820                 }
 821
 822                 if (body->iov_len < 2) {
 823                         return NT_STATUS_INVALID_PARAMETER;
 824                 }
 825
 826                 inhdr = (const uint8_t *)hdr->iov_base;
 827
 828                 /* Check the SMB2 header */
 829                 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
 830                         return NT_STATUS_INVALID_PARAMETER;
 831                 }
 832
 833                 if (!smb2_validate_message_id(req->xconn, inhdr)) {
 834                         return NT_STATUS_INVALID_PARAMETER;
 835                 }
 836         }
 837
 838         return NT_STATUS_OK;
 839 }
 840
 841 static void smb2_set_operation_credit(struct smbXsrv_connection *xconn,
 842                                       const struct iovec *in_vector,
 843                                       struct iovec *out_vector)
 844 {
 845         const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
 846         uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
 847         uint16_t credit_charge = 1;
 848         uint16_t credits_requested;
 849         uint32_t out_flags;
 850         uint16_t cmd;
 851         NTSTATUS out_status;
 852         uint16_t credits_granted = 0;
 853         uint64_t credits_possible;
 854         uint16_t current_max_credits;
 855
 856         /*
 857          * first we grant only 1/16th of the max range.
 858          *
 859          * Windows also starts with the 1/16th and then grants
 860          * more later. I was only able to trigger higher
 861          * values, when using a very high credit charge.
 862          *
 863          * TODO: scale up depending on load, free memory
 864          *       or other stuff.
 865          *       Maybe also on the relationship between number
 866          *       of requests and the used sequence number.
 867          *       Which means we would grant more credits
 868          *       for client which use multi credit requests.
 869          *
 870          * The above is what Windows Server < 2016 is doing,
 871          * but new servers use all credits (8192 by default).
 872          */
 873         current_max_credits = xconn->smb2.credits.max;
 874         current_max_credits = MAX(current_max_credits, 1);
 875
 876         if (xconn->smb2.credits.multicredit) {
 877                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
 878                 credit_charge = MAX(credit_charge, 1);
 879         }
 880
 881         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 882         credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
 883         credits_requested = MAX(credits_requested, 1);
 884         out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
 885         out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
 886
 887         SMB_ASSERT(xconn->smb2.credits.max >= xconn->smb2.credits.granted);
 888
 889         if (xconn->smb2.credits.max < credit_charge) {
 890                 smbd_server_connection_terminate(xconn,
 891                         "client error: credit charge > max credits\n");
 892                 return;
 893         }
 894
 895         if (out_flags & SMB2_HDR_FLAG_ASYNC) {
 896                 /*
 897                  * In case we already send an async interim
 898                  * response, we should not grant
 899                  * credits on the final response.
 900                  */
 901                 credits_granted = 0;
 902         } else {
 903                 uint16_t additional_possible =
 904                         xconn->smb2.credits.max - credit_charge;
 905                 uint16_t additional_max = 0;
 906                 uint16_t additional_credits = credits_requested - 1;
 907
 908                 switch (cmd) {
 909                 case SMB2_OP_NEGPROT:
 910                         break;
 911                 case SMB2_OP_SESSSETUP:
 912                         /*
 913                          * Windows 2012 RC1 starts to grant
 914                          * additional credits
 915                          * with a successful session setup
 916                          */
 917                         if (NT_STATUS_IS_OK(out_status)) {
 918                                 additional_max = xconn->smb2.credits.max;
 919                         }
 920                         break;
 921                 default:
 922                         /*
 923                          * Windows Server < 2016 and older Samba versions
 924                          * used to only grant additional credits in
 925                          * chunks of 32 credits.
 926                          *
 927                          * But we match Windows Server 2016 and grant
 928                          * all credits as requested.
 929                          */
 930                         additional_max = xconn->smb2.credits.max;
 931                         break;
 932                 }
 933
 934                 additional_max = MIN(additional_max, additional_possible);
 935                 additional_credits = MIN(additional_credits, additional_max);
 936
 937                 credits_granted = credit_charge + additional_credits;
 938         }
 939
 940         /*
 941          * sequence numbers should not wrap
 942          *
 943          * 1. calculate the possible credits until
 944          *    the sequence numbers start to wrap on 64-bit.
 945          *
 946          * 2. UINT64_MAX is used for Break Notifications.
 947          *
 948          * 2. truncate the possible credits to the maximum
 949          *    credits we want to grant to the client in total.
 950          *
 951          * 3. remove the range we'll already granted to the client
 952          *    this makes sure the client consumes the lowest sequence
 953          *    number, before we can grant additional credits.
 954          */
 955         credits_possible = UINT64_MAX - xconn->smb2.credits.seq_low;
 956         if (credits_possible > 0) {
 957                 /* remove UINT64_MAX */
 958                 credits_possible -= 1;
 959         }
 960         credits_possible = MIN(credits_possible, current_max_credits);
 961         credits_possible -= xconn->smb2.credits.seq_range;
 962
 963         credits_granted = MIN(credits_granted, credits_possible);
 964
 965         SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
 966         xconn->smb2.credits.granted += credits_granted;
 967         xconn->smb2.credits.seq_range += credits_granted;
 968
 969         DBGC_DEBUG(DBGC_SMB2_CREDITS,
 970                 "smb2_set_operation_credit: requested %u, charge %u, "
 971                 "granted %u, current possible/max %u/%u, "
 972                 "total granted/max/low/range %u/%u/%llu/%u\n",
 973                 (unsigned int)credits_requested,
 974                 (unsigned int)credit_charge,
 975                 (unsigned int)credits_granted,
 976                 (unsigned int)credits_possible,
 977                 (unsigned int)current_max_credits,
 978                 (unsigned int)xconn->smb2.credits.granted,
 979                 (unsigned int)xconn->smb2.credits.max,
 980                 (unsigned long long)xconn->smb2.credits.seq_low,
 981                 (unsigned int)xconn->smb2.credits.seq_range);
 982 }
 983
 984 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
 985                                 struct smbd_smb2_request *outreq)
 986 {
 987         int count, idx;
 988         uint16_t total_credits = 0;
 989
 990         count = outreq->out.vector_count;
 991
 992         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 993                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(inreq,in,idx);
 994                 struct iovec *outhdr_v = SMBD_SMB2_IDX_HDR_IOV(outreq,out,idx);
 995                 uint8_t *outhdr = (uint8_t *)outhdr_v->iov_base;
 996
 997                 smb2_set_operation_credit(outreq->xconn, inhdr_v, outhdr_v);
 998
 999                 /* To match Windows, count up what we
1000                    just granted. */
1001                 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
1002                 /* Set to zero in all but the last reply. */
1003                 if (idx + SMBD_SMB2_NUM_IOV_PER_REQ < count) {
1004                         SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
1005                 } else {
1006                         SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
1007                 }
1008         }
1009 }
1010
1011 DATA_BLOB smbd_smb2_generate_outbody(struct smbd_smb2_request *req, size_t size)
1012 {
1013         if (req->current_idx <= 1) {
1014                 if (size <= sizeof(req->out._body)) {
1015                         return data_blob_const(req->out._body, size);
1016                 }
1017         }
1018
1019         return data_blob_talloc(req, NULL, size);
1020 }
1021
1022 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
1023 {
1024         struct smbXsrv_connection *xconn = req->xconn;
1025         TALLOC_CTX *mem_ctx;
1026         struct iovec *vector;
1027         int count;
1028         int idx;
1029         bool ok;
1030
1031         count = req->in.vector_count;
1032         if (count <= ARRAY_SIZE(req->out._vector)) {
1033                 mem_ctx = req;
1034                 vector = req->out._vector;
1035         } else {
1036                 vector = talloc_zero_array(req, struct iovec, count);
1037                 if (vector == NULL) {
1038                         return NT_STATUS_NO_MEMORY;
1039                 }
1040                 mem_ctx = vector;
1041         }
1042
1043         vector[0].iov_base      = req->out.nbt_hdr;
1044         vector[0].iov_len       = 4;
1045         SIVAL(req->out.nbt_hdr, 0, 0);
1046
1047         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
1048                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
1049                 const uint8_t *inhdr = (const uint8_t *)inhdr_v->iov_base;
1050                 uint8_t *outhdr = NULL;
1051                 uint8_t *outbody = NULL;
1052                 uint32_t next_command_ofs = 0;
1053                 struct iovec *current = &vector[idx];
1054
1055                 if ((idx + SMBD_SMB2_NUM_IOV_PER_REQ) < count) {
1056                         /* we have a next command -
1057                          * setup for the error case. */
1058                         next_command_ofs = SMB2_HDR_BODY + 9;
1059                 }
1060
1061                 if (idx == 1) {
1062                         outhdr = req->out._hdr;
1063                 } else {
1064                         outhdr = talloc_zero_array(mem_ctx, uint8_t,
1065                                                    OUTVEC_ALLOC_SIZE);
1066                         if (outhdr == NULL) {
1067                                 return NT_STATUS_NO_MEMORY;
1068                         }
1069                 }
1070
1071                 outbody = outhdr + SMB2_HDR_BODY;
1072
1073                 /*
1074                  * SMBD_SMB2_TF_IOV_OFS might be used later
1075                  */
1076                 current[SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
1077                 current[SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
1078
1079                 current[SMBD_SMB2_HDR_IOV_OFS].iov_base  = (void *)outhdr;
1080                 current[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
1081
1082                 current[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)outbody;
1083                 current[SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
1084
1085                 current[SMBD_SMB2_DYN_IOV_OFS].iov_base  = NULL;
1086                 current[SMBD_SMB2_DYN_IOV_OFS].iov_len   = 0;
1087
1088                 /* setup the SMB2 header */
1089                 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID,     SMB2_MAGIC);
1090                 SSVAL(outhdr, SMB2_HDR_LENGTH,          SMB2_HDR_BODY);
1091                 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
1092                       SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
1093                 SIVAL(outhdr, SMB2_HDR_STATUS,
1094                       NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
1095                 SSVAL(outhdr, SMB2_HDR_OPCODE,
1096                       SVAL(inhdr, SMB2_HDR_OPCODE));
1097                 SIVAL(outhdr, SMB2_HDR_FLAGS,
1098                       IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
1099                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND,    next_command_ofs);
1100                 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
1101                       BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
1102                 SIVAL(outhdr, SMB2_HDR_PID,
1103                       IVAL(inhdr, SMB2_HDR_PID));
1104                 SIVAL(outhdr, SMB2_HDR_TID,
1105                       IVAL(inhdr, SMB2_HDR_TID));
1106                 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
1107                       BVAL(inhdr, SMB2_HDR_SESSION_ID));
1108                 memcpy(outhdr + SMB2_HDR_SIGNATURE,
1109                        inhdr + SMB2_HDR_SIGNATURE, 16);
1110
1111                 /* setup error body header */
1112                 SSVAL(outbody, 0x00, 0x08 + 1);
1113                 SSVAL(outbody, 0x02, 0);
1114                 SIVAL(outbody, 0x04, 0);
1115         }
1116
1117         req->out.vector = vector;
1118         req->out.vector_count = count;
1119
1120         /* setup the length of the NBT packet */
1121         ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
1122         if (!ok) {
1123                 return NT_STATUS_INVALID_PARAMETER_MIX;
1124         }
1125
1126         DLIST_ADD_END(xconn->smb2.requests, req);
1127
1128         return NT_STATUS_OK;
1129 }
1130
1131 bool smbXsrv_server_multi_channel_enabled(void)
1132 {
1133         bool enabled = lp_server_multi_channel_support();
1134 #ifndef __ALLOW_MULTI_CHANNEL_SUPPORT
1135         bool forced = false;
1136         struct loadparm_context *lp_ctx = loadparm_init_s3(NULL, loadparm_s3_helpers());
1137         bool unspecified = lpcfg_parm_is_unspecified(lp_ctx, "server multi channel support");
1138         if (unspecified) {
1139                 enabled = false;
1140         }
1141         /*
1142          * If we don't have support from the kernel
1143          * to ask for the un-acked number of bytes
1144          * in the socket send queue, we better
1145          * don't support multi-channel.
1146          */
1147         forced = lp_parm_bool(-1, "force", "server multi channel support", false);
1148         if (enabled && !forced) {
1149                 D_NOTICE("'server multi channel support' enabled "
1150                          "but not supported on %s (%s)\n",
1151                          SYSTEM_UNAME_SYSNAME, SYSTEM_UNAME_RELEASE);
1152                 DEBUGADD(DBGLVL_NOTICE, ("Please report this on "
1153                         "https://bugzilla.samba.org/show_bug.cgi?id=11897\n"));
1154                 enabled = false;
1155         }
1156         TALLOC_FREE(lp_ctx);
1157 #endif /* ! __ALLOW_MULTI_CHANNEL_SUPPORT */
1158         return enabled;
1159 }
1160
1161 static NTSTATUS smbXsrv_connection_get_rto_usecs(struct smbXsrv_connection *xconn,
1162                                                  uint32_t *_rto_usecs)
1163 {
1164         /*
1165          * Define an Retransmission Timeout
1166          * of 1 second, if there's no way for the
1167          * kernel to tell us the current value.
1168          */
1169         uint32_t rto_usecs = 1000000;
1170
1171 #ifdef __HAVE_TCP_INFO_RTO
1172         {
1173                 struct tcp_info info;
1174                 socklen_t ilen = sizeof(info);
1175                 int ret;
1176
1177                 ZERO_STRUCT(info);
1178                 ret = getsockopt(xconn->transport.sock,
1179                                  IPPROTO_TCP, TCP_INFO,
1180                                  (void *)&info, &ilen);
1181                 if (ret != 0) {
1182                         int saved_errno = errno;
1183                         NTSTATUS status = map_nt_error_from_unix(errno);
1184                         DBG_ERR("getsockopt(TCP_INFO) errno[%d/%s] -s %s\n",
1185                                 saved_errno, strerror(saved_errno),
1186                                 nt_errstr(status));
1187                         return status;
1188                 }
1189
1190                 DBG_DEBUG("tcpi_rto[%u] tcpi_rtt[%u] tcpi_rttvar[%u]\n",
1191                           (unsigned)info.tcpi_rto,
1192                           (unsigned)info.tcpi_rtt,
1193                           (unsigned)info.tcpi_rttvar);
1194                 rto_usecs = info.tcpi_rto;
1195         }
1196 #endif /* __HAVE_TCP_INFO_RTO */
1197
1198         rto_usecs = MAX(rto_usecs,  200000); /* at least 0.2s */
1199         rto_usecs = MIN(rto_usecs, 1000000); /* at max   1.0s */
1200         *_rto_usecs = rto_usecs;
1201         return NT_STATUS_OK;
1202 }
1203
1204 static NTSTATUS smbXsrv_connection_get_acked_bytes(struct smbXsrv_connection *xconn,
1205                                                    uint64_t *_acked_bytes)
1206 {
1207         /*
1208          * Unless the kernel has an interface
1209          * to reveal the number of un-acked bytes
1210          * in the socket send queue, we'll assume
1211          * everything is already acked.
1212          *
1213          * But that would mean that we better don't
1214          * pretent to support multi-channel.
1215          */
1216         uint64_t unacked_bytes = 0;
1217
1218         *_acked_bytes = 0;
1219
1220         if (xconn->ack.force_unacked_timeout) {
1221                 /*
1222                  * Smbtorture tries to test channel failures...
1223                  * Just pretend nothing was acked...
1224                  */
1225                 DBG_INFO("Simulating channel failure: "
1226                          "xconn->ack.unacked_bytes[%llu]\n",
1227                          (unsigned long long)xconn->ack.unacked_bytes);
1228                 return NT_STATUS_OK;
1229         }
1230
1231 #ifdef __IOCTL_SEND_QUEUE_SIZE_OPCODE
1232         {
1233                 int value = 0;
1234                 int ret;
1235
1236                 /*
1237                  * If we have kernel support to get
1238                  * the number of bytes waiting in
1239                  * the socket's send queue, we
1240                  * use that in order to find out
1241                  * the number of unacked bytes.
1242                  */
1243                 ret = ioctl(xconn->transport.sock,
1244                             __IOCTL_SEND_QUEUE_SIZE_OPCODE,
1245                             &value);
1246                 if (ret != 0) {
1247                         int saved_errno = errno;
1248                         NTSTATUS status = map_nt_error_from_unix(saved_errno);
1249                         DBG_ERR("Failed to get the SEND_QUEUE_SIZE - "
1250                                 "errno %d (%s) - %s\n",
1251                                 saved_errno, strerror(saved_errno),
1252                                 nt_errstr(status));
1253                         return status;
1254                 }
1255
1256                 if (value < 0) {
1257                         DBG_ERR("xconn->ack.unacked_bytes[%llu] value[%d]\n",
1258                                 (unsigned long long)xconn->ack.unacked_bytes,
1259                                 value);
1260                         return NT_STATUS_INTERNAL_ERROR;
1261                 }
1262                 unacked_bytes = value;
1263         }
1264 #endif
1265         if (xconn->ack.unacked_bytes == 0) {
1266                 xconn->ack.unacked_bytes = unacked_bytes;
1267                 return NT_STATUS_OK;
1268         }
1269
1270         if (xconn->ack.unacked_bytes < unacked_bytes) {
1271                 DBG_ERR("xconn->ack.unacked_bytes[%llu] unacked_bytes[%llu]\n",
1272                         (unsigned long long)xconn->ack.unacked_bytes,
1273                         (unsigned long long)unacked_bytes);
1274                 return NT_STATUS_INTERNAL_ERROR;
1275         }
1276
1277         *_acked_bytes = xconn->ack.unacked_bytes - unacked_bytes;
1278         xconn->ack.unacked_bytes = unacked_bytes;
1279         return NT_STATUS_OK;
1280 }
1281
1282 static void smbd_smb2_send_queue_ack_fail(struct smbd_smb2_send_queue **queue,
1283                                           NTSTATUS status)
1284 {
1285         struct smbd_smb2_send_queue *e = NULL;
1286         struct smbd_smb2_send_queue *n = NULL;
1287
1288         for (e = *queue; e != NULL; e = n) {
1289                 n = e->next;
1290
1291                 DLIST_REMOVE(*queue, e);
1292                 if (e->ack.req != NULL) {
1293                         tevent_req_nterror(e->ack.req, status);
1294                 }
1295         }
1296 }
1297
1298 static NTSTATUS smbd_smb2_send_queue_ack_bytes(struct smbd_smb2_send_queue **queue,
1299                                                uint64_t acked_bytes)
1300 {
1301         struct smbd_smb2_send_queue *e = NULL;
1302         struct smbd_smb2_send_queue *n = NULL;
1303
1304         for (e = *queue; e != NULL; e = n) {
1305                 bool expired;
1306
1307                 n = e->next;
1308
1309                 if (e->ack.req == NULL) {
1310                         continue;
1311                 }
1312
1313                 if (e->ack.required_acked_bytes <= acked_bytes) {
1314                         e->ack.required_acked_bytes = 0;
1315                         DLIST_REMOVE(*queue, e);
1316                         tevent_req_done(e->ack.req);
1317                         continue;
1318                 }
1319                 e->ack.required_acked_bytes -= acked_bytes;
1320
1321                 expired = timeval_expired(&e->ack.timeout);
1322                 if (expired) {
1323                         return NT_STATUS_IO_TIMEOUT;
1324                 }
1325         }
1326
1327         return NT_STATUS_OK;
1328 }
1329
1330 static NTSTATUS smbd_smb2_check_ack_queue(struct smbXsrv_connection *xconn)
1331 {
1332         uint64_t acked_bytes = 0;
1333         NTSTATUS status;
1334
1335         status = smbXsrv_connection_get_acked_bytes(xconn, &acked_bytes);
1336         if (!NT_STATUS_IS_OK(status)) {
1337                 return status;
1338         }
1339
1340         status = smbd_smb2_send_queue_ack_bytes(&xconn->ack.queue, acked_bytes);
1341         if (!NT_STATUS_IS_OK(status)) {
1342                 return status;
1343         }
1344
1345         status = smbd_smb2_send_queue_ack_bytes(&xconn->smb2.send_queue, 0);
1346         if (!NT_STATUS_IS_OK(status)) {
1347                 return status;
1348         }
1349
1350         return NT_STATUS_OK;
1351 }
1352
1353 static void smbXsrv_connection_ack_checker(struct tevent_req *subreq)
1354 {
1355         struct smbXsrv_connection *xconn =
1356                 tevent_req_callback_data(subreq,
1357                 struct smbXsrv_connection);
1358         struct smbXsrv_client *client = xconn->client;
1359         struct timeval next_check;
1360         NTSTATUS status;
1361         bool ok;
1362
1363         xconn->ack.checker_subreq = NULL;
1364
1365         ok = tevent_wakeup_recv(subreq);
1366         TALLOC_FREE(subreq);
1367         if (!ok) {
1368                 smbd_server_connection_terminate(xconn,
1369                                                  "tevent_wakeup_recv() failed");
1370                 return;
1371         }
1372
1373         status = smbd_smb2_check_ack_queue(xconn);
1374         if (!NT_STATUS_IS_OK(status)) {
1375                 smbd_server_connection_terminate(xconn, nt_errstr(status));
1376                 return;
1377         }
1378
1379         next_check = timeval_current_ofs_usec(xconn->ack.rto_usecs);
1380         xconn->ack.checker_subreq = tevent_wakeup_send(xconn,
1381                                                        client->raw_ev_ctx,
1382                                                        next_check);
1383         if (xconn->ack.checker_subreq == NULL) {
1384                 smbd_server_connection_terminate(xconn,
1385                                                  "tevent_wakeup_send() failed");
1386                 return;
1387         }
1388         tevent_req_set_callback(xconn->ack.checker_subreq,
1389                                 smbXsrv_connection_ack_checker,
1390                                 xconn);
1391 }
1392
1393 static NTSTATUS smbXsrv_client_pending_breaks_updated(struct smbXsrv_client *client)
1394 {
1395         struct smbXsrv_connection *xconn = NULL;
1396
1397         for (xconn = client->connections; xconn != NULL; xconn = xconn->next) {
1398                 struct timeval next_check;
1399                 uint64_t acked_bytes = 0;
1400                 NTSTATUS status;
1401
1402                 /*
1403                  * A new 'pending break cycle' starts
1404                  * with a first pending break and lasts until
1405                  * all pending breaks are finished.
1406                  *
1407                  * This is typically a very short time,
1408                  * the value of one retransmission timeout.
1409                  */
1410
1411                 if (client->pending_breaks == NULL) {
1412                         /*
1413                          * No more pending breaks, remove a pending
1414                          * checker timer
1415                          */
1416                         TALLOC_FREE(xconn->ack.checker_subreq);
1417                         continue;
1418                 }
1419
1420                 if (xconn->ack.checker_subreq != NULL) {
1421                         /*
1422                          * The cycle already started =>
1423                          * nothing todo
1424                          */
1425                         continue;
1426                 }
1427
1428                 /*
1429                  * Get the current retransmission timeout value.
1430                  *
1431                  * It may change over time, but fetching it once
1432                  * per 'pending break' cycled should be enough.
1433                  */
1434                 status = smbXsrv_connection_get_rto_usecs(xconn,
1435                                                           &xconn->ack.rto_usecs);
1436                 if (!NT_STATUS_IS_OK(status)) {
1437                         return status;
1438                 }
1439
1440                 /*
1441                  * At the start of the cycle we reset the
1442                  * unacked_bytes counter (first to 0 and
1443                  * within smbXsrv_connection_get_acked_bytes()
1444                  * to the current value in the kernel
1445                  * send queue.
1446                  */
1447                 xconn->ack.unacked_bytes = 0;
1448                 status = smbXsrv_connection_get_acked_bytes(xconn, &acked_bytes);
1449                 if (!NT_STATUS_IS_OK(status)) {
1450                         return status;
1451                 }
1452
1453                 /*
1454                  * We setup a timer in order to check for
1455                  * acked bytes after one retransmission timeout.
1456                  *
1457                  * The code that sets up the send_queue.ack.timeout
1458                  * uses a multiple of the retransmission timeout.
1459                  */
1460                 next_check = timeval_current_ofs_usec(xconn->ack.rto_usecs);
1461                 xconn->ack.checker_subreq = tevent_wakeup_send(xconn,
1462                                                         client->raw_ev_ctx,
1463                                                         next_check);
1464                 if (xconn->ack.checker_subreq == NULL) {
1465                         return NT_STATUS_NO_MEMORY;
1466                 }
1467                 tevent_req_set_callback(xconn->ack.checker_subreq,
1468                                         smbXsrv_connection_ack_checker,
1469                                         xconn);
1470         }
1471
1472         return NT_STATUS_OK;
1473 }
1474
1475 void smbXsrv_connection_disconnect_transport(struct smbXsrv_connection *xconn,
1476                                              NTSTATUS status)
1477 {
1478         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1479                 return;
1480         }
1481
1482         xconn->transport.status = status;
1483         TALLOC_FREE(xconn->transport.fde);
1484         if (xconn->transport.sock != -1) {
1485                 xconn->transport.sock = -1;
1486         }
1487         smbd_smb2_send_queue_ack_fail(&xconn->ack.queue, status);
1488         smbd_smb2_send_queue_ack_fail(&xconn->smb2.send_queue, status);
1489         xconn->smb2.send_queue_len = 0;
1490         DO_PROFILE_INC(disconnect);
1491 }
1492
1493 size_t smbXsrv_client_valid_connections(struct smbXsrv_client *client)
1494 {
1495         struct smbXsrv_connection *xconn = NULL;
1496         size_t num_ok = 0;
1497
1498         for (xconn = client->connections; xconn != NULL; xconn = xconn->next) {
1499                 if (NT_STATUS_IS_OK(xconn->transport.status)) {
1500                         num_ok++;
1501                 }
1502         }
1503
1504         return num_ok;
1505 }
1506
1507 struct smbXsrv_connection_shutdown_state {
1508         struct smbXsrv_connection *xconn;
1509 };
1510
1511 static void smbXsrv_connection_shutdown_wait_done(struct tevent_req *subreq);
1512
1513 static struct tevent_req *smbXsrv_connection_shutdown_send(TALLOC_CTX *mem_ctx,
1514                                         struct tevent_context *ev,
1515                                         struct smbXsrv_connection *xconn)
1516 {
1517         struct tevent_req *req = NULL;
1518         struct smbXsrv_connection_shutdown_state *state = NULL;
1519         struct tevent_req *subreq = NULL;
1520         size_t len = 0;
1521         struct smbd_smb2_request *preq = NULL;
1522         NTSTATUS status;
1523
1524         /*
1525          * The caller should have called
1526          * smbXsrv_connection_disconnect_transport() before.
1527          */
1528         SMB_ASSERT(!NT_STATUS_IS_OK(xconn->transport.status));
1529         SMB_ASSERT(xconn->transport.terminating);
1530         SMB_ASSERT(xconn->transport.shutdown_wait_queue == NULL);
1531
1532         req = tevent_req_create(mem_ctx, &state,
1533                                 struct smbXsrv_connection_shutdown_state);
1534         if (req == NULL) {
1535                 return NULL;
1536         }
1537
1538         state->xconn = xconn;
1539         tevent_req_defer_callback(req, ev);
1540
1541         xconn->transport.shutdown_wait_queue =
1542                 tevent_queue_create(state, "smbXsrv_connection_shutdown_queue");
1543         if (tevent_req_nomem(xconn->transport.shutdown_wait_queue, req)) {
1544                 return tevent_req_post(req, ev);
1545         }
1546
1547         for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1548                 /*
1549                  * Now wait until the request is finished.
1550                  *
1551                  * We don't set a callback, as we just want to block the
1552                  * wait queue and the talloc_free() of the request will
1553                  * remove the item from the wait queue.
1554                  *
1555                  * Note that we don't cancel the requests here
1556                  * in order to keep the replay detection logic correct.
1557                  *
1558                  * However if we teardown the last channel of
1559                  * a connection, we'll call some logic via
1560                  * smbXsrv_session_disconnect_xconn()
1561                  * -> smbXsrv_session_disconnect_xconn_callback()
1562                  *   -> smbXsrv_session_remove_channel()
1563                  *     -> smb2srv_session_shutdown_send()
1564                  * will indeed cancel the request.
1565                  */
1566                 subreq = tevent_queue_wait_send(preq, ev,
1567                                         xconn->transport.shutdown_wait_queue);
1568                 if (tevent_req_nomem(subreq, req)) {
1569                         return tevent_req_post(req, ev);
1570                 }
1571         }
1572
1573         /*
1574          * This may attach sessions with num_channels == 0
1575          * to xconn->transport.shutdown_wait_queue.
1576          */
1577         status = smbXsrv_session_disconnect_xconn(xconn);
1578         if (tevent_req_nterror(req, status)) {
1579                 return tevent_req_post(req, ev);
1580         }
1581
1582         len = tevent_queue_length(xconn->transport.shutdown_wait_queue);
1583         if (len == 0) {
1584                 tevent_req_done(req);
1585                 return tevent_req_post(req, ev);
1586         }
1587
1588         /*
1589          * Now we add our own waiter to the end of the queue,
1590          * this way we get notified when all pending requests are finished
1591          * and send to the socket.
1592          */
1593         subreq = tevent_queue_wait_send(state, ev, xconn->transport.shutdown_wait_queue);
1594         if (tevent_req_nomem(subreq, req)) {
1595                 return tevent_req_post(req, ev);
1596         }
1597         tevent_req_set_callback(subreq, smbXsrv_connection_shutdown_wait_done, req);
1598
1599         return req;
1600 }
1601
1602 static void smbXsrv_connection_shutdown_wait_done(struct tevent_req *subreq)
1603 {
1604         struct tevent_req *req =
1605                 tevent_req_callback_data(subreq,
1606                 struct tevent_req);
1607         struct smbXsrv_connection_shutdown_state *state =
1608                 tevent_req_data(req,
1609                 struct smbXsrv_connection_shutdown_state);
1610         struct smbXsrv_connection *xconn = state->xconn;
1611
1612         tevent_queue_wait_recv(subreq);
1613         TALLOC_FREE(subreq);
1614
1615         tevent_req_done(req);
1616         /*
1617          * make sure the xconn pointer is still valid,
1618          * it should as we used tevent_req_defer_callback()
1619          */
1620         SMB_ASSERT(xconn->transport.terminating);
1621 }
1622
1623 static NTSTATUS smbXsrv_connection_shutdown_recv(struct tevent_req *req)
1624 {
1625         struct smbXsrv_connection_shutdown_state *state =
1626                 tevent_req_data(req,
1627                 struct smbXsrv_connection_shutdown_state);
1628         struct smbXsrv_connection *xconn = state->xconn;
1629         /*
1630          * make sure the xconn pointer is still valid,
1631          * it should as we used tevent_req_defer_callback()
1632          */
1633         SMB_ASSERT(xconn->transport.terminating);
1634         return tevent_req_simple_recv_ntstatus(req);
1635 }
1636
1637 static void smbd_server_connection_terminate_done(struct tevent_req *subreq)
1638 {
1639         struct smbXsrv_connection *xconn =
1640                 tevent_req_callback_data(subreq,
1641                 struct smbXsrv_connection);
1642         struct smbXsrv_client *client = xconn->client;
1643         NTSTATUS status;
1644
1645         status = smbXsrv_connection_shutdown_recv(subreq);
1646         if (!NT_STATUS_IS_OK(status)) {
1647                 exit_server("smbXsrv_connection_shutdown_recv failed");
1648         }
1649
1650         DLIST_REMOVE(client->connections, xconn);
1651         TALLOC_FREE(xconn);
1652 }
1653
1654 void smbd_server_connection_terminate_ex(struct smbXsrv_connection *xconn,
1655                                          const char *reason,
1656                                          const char *location)
1657 {
1658         struct smbXsrv_client *client = xconn->client;
1659         size_t num_ok = 0;
1660
1661         /*
1662          * Make sure that no new request will be able to use this session.
1663          *
1664          * smbXsrv_connection_disconnect_transport() might be called already,
1665          * but calling it again is a no-op.
1666          */
1667         smbXsrv_connection_disconnect_transport(xconn,
1668                                         NT_STATUS_CONNECTION_DISCONNECTED);
1669
1670         num_ok = smbXsrv_client_valid_connections(client);
1671
1672         if (xconn->transport.terminating) {
1673                 DBG_DEBUG("skip recursion conn[%s] num_ok[%zu] reason[%s] at %s\n",
1674                           smbXsrv_connection_dbg(xconn), num_ok,
1675                           reason, location);
1676                 return;
1677         }
1678         xconn->transport.terminating = true;
1679
1680         DBG_DEBUG("conn[%s] num_ok[%zu] reason[%s] at %s\n",
1681                   smbXsrv_connection_dbg(xconn), num_ok,
1682                   reason, location);
1683
1684         if (xconn->has_cluster_movable_ip) {
1685                 /*
1686                  * If the connection has a movable cluster public address
1687                  * we disconnect all client connections,
1688                  * as the public address might be moved to
1689                  * a different node.
1690                  *
1691                  * In future we may recheck which node currently
1692                  * holds this address, but for now we keep it simple.
1693                  */
1694                 smbd_server_disconnect_client_ex(xconn->client,
1695                                                  reason,
1696                                                  location);
1697                 return;
1698         }
1699
1700         if (num_ok != 0) {
1701                 struct tevent_req *subreq = NULL;
1702
1703                 subreq = smbXsrv_connection_shutdown_send(client,
1704                                                           client->raw_ev_ctx,
1705                                                           xconn);
1706                 if (subreq == NULL) {
1707                         exit_server("smbXsrv_connection_shutdown_send failed");
1708                 }
1709                 tevent_req_set_callback(subreq,
1710                                         smbd_server_connection_terminate_done,
1711                                         xconn);
1712                 return;
1713         }
1714
1715         /*
1716          * The last connection was disconnected
1717          */
1718         exit_server_cleanly(reason);
1719 }
1720
1721 void smbd_server_disconnect_client_ex(struct smbXsrv_client *client,
1722                                       const char *reason,
1723                                       const char *location)
1724 {
1725         size_t num_ok = 0;
1726
1727         num_ok = smbXsrv_client_valid_connections(client);
1728
1729         DBG_WARNING("client[%s] num_ok[%zu] reason[%s] at %s\n",
1730                     client->global->remote_address, num_ok,
1731                     reason, location);
1732
1733         /*
1734          * Something bad happened we need to disconnect all connections.
1735          */
1736         exit_server_cleanly(reason);
1737 }
1738
1739 static bool dup_smb2_vec4(TALLOC_CTX *ctx,
1740                         struct iovec *outvec,
1741                         const struct iovec *srcvec)
1742 {
1743         const uint8_t *srctf;
1744         size_t srctf_len;
1745         const uint8_t *srchdr;
1746         size_t srchdr_len;
1747         const uint8_t *srcbody;
1748         size_t srcbody_len;
1749         const uint8_t *expected_srcbody;
1750         const uint8_t *srcdyn;
1751         size_t srcdyn_len;
1752         const uint8_t *expected_srcdyn;
1753         uint8_t *dsttf;
1754         uint8_t *dsthdr;
1755         uint8_t *dstbody;
1756         uint8_t *dstdyn;
1757
1758         srctf  = (const uint8_t *)srcvec[SMBD_SMB2_TF_IOV_OFS].iov_base;
1759         srctf_len = srcvec[SMBD_SMB2_TF_IOV_OFS].iov_len;
1760         srchdr  = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
1761         srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
1762         srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
1763         srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
1764         expected_srcbody = srchdr + SMB2_HDR_BODY;
1765         srcdyn  = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
1766         srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
1767         expected_srcdyn = srcbody + 8;
1768
1769         if ((srctf_len != SMB2_TF_HDR_SIZE) && (srctf_len != 0)) {
1770                 return false;
1771         }
1772
1773         if (srchdr_len != SMB2_HDR_BODY) {
1774                 return false;
1775         }
1776
1777         if (srctf_len == SMB2_TF_HDR_SIZE) {
1778                 dsttf = talloc_memdup(ctx, srctf, SMB2_TF_HDR_SIZE);
1779                 if (dsttf == NULL) {
1780                         return false;
1781                 }
1782         } else {
1783                 dsttf = NULL;
1784         }
1785         outvec[SMBD_SMB2_TF_IOV_OFS].iov_base = (void *)dsttf;
1786         outvec[SMBD_SMB2_TF_IOV_OFS].iov_len = srctf_len;
1787
1788         /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
1789          * be allocated with size OUTVEC_ALLOC_SIZE. */
1790
1791         dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
1792         if (dsthdr == NULL) {
1793                 return false;
1794         }
1795         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
1796         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1797
1798         /*
1799          * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
1800          * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
1801          * then duplicate this. Else use talloc_memdup().
1802          */
1803
1804         if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
1805                 dstbody = dsthdr + SMB2_HDR_BODY;
1806         } else {
1807                 dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
1808                 if (dstbody == NULL) {
1809                         return false;
1810                 }
1811         }
1812         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
1813         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
1814
1815         /*
1816          * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
1817          * pointing to
1818          * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
1819          * then duplicate this. Else use talloc_memdup().
1820          */
1821
1822         if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
1823                 dstdyn = dsthdr + SMB2_HDR_BODY + 8;
1824         } else if (srcdyn == NULL) {
1825                 dstdyn = NULL;
1826         } else {
1827                 dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
1828                 if (dstdyn == NULL) {
1829                         return false;
1830                 }
1831         }
1832         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
1833         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
1834
1835         return true;
1836 }
1837
1838 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
1839 {
1840         struct smbd_smb2_request *newreq = NULL;
1841         struct iovec *outvec = NULL;
1842         int count = req->out.vector_count;
1843         int i;
1844         bool ok;
1845
1846         newreq = smbd_smb2_request_allocate(req->xconn);
1847         if (!newreq) {
1848                 return NULL;
1849         }
1850
1851         newreq->sconn = req->sconn;
1852         newreq->xconn = req->xconn;
1853         newreq->session = req->session;
1854         newreq->do_encryption = req->do_encryption;
1855         newreq->do_signing = req->do_signing;
1856         newreq->current_idx = req->current_idx;
1857
1858         outvec = talloc_zero_array(newreq, struct iovec, count);
1859         if (!outvec) {
1860                 TALLOC_FREE(newreq);
1861                 return NULL;
1862         }
1863         newreq->out.vector = outvec;
1864         newreq->out.vector_count = count;
1865
1866         /* Setup the outvec's identically to req. */
1867         outvec[0].iov_base = newreq->out.nbt_hdr;
1868         outvec[0].iov_len = 4;
1869         memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
1870
1871         /* Setup the vectors identically to the ones in req. */
1872         for (i = 1; i < count; i += SMBD_SMB2_NUM_IOV_PER_REQ) {
1873                 if (!dup_smb2_vec4(outvec, &outvec[i], &req->out.vector[i])) {
1874                         break;
1875                 }
1876         }
1877
1878         if (i < count) {
1879                 /* Alloc failed. */
1880                 TALLOC_FREE(newreq);
1881                 return NULL;
1882         }
1883
1884         ok = smb2_setup_nbt_length(newreq->out.vector,
1885                                    newreq->out.vector_count);
1886         if (!ok) {
1887                 TALLOC_FREE(newreq);
1888                 return NULL;
1889         }
1890
1891         return newreq;
1892 }
1893
1894 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
1895 {
1896         struct smbXsrv_connection *xconn = req->xconn;
1897         int first_idx = 1;
1898         struct iovec *firsttf = NULL;
1899         struct iovec *outhdr_v = NULL;
1900         uint8_t *outhdr = NULL;
1901         struct smbd_smb2_request *nreq = NULL;
1902         NTSTATUS status;
1903         bool ok;
1904
1905         /* Create a new smb2 request we'll use
1906            for the interim return. */
1907         nreq = dup_smb2_req(req);
1908         if (!nreq) {
1909                 return NT_STATUS_NO_MEMORY;
1910         }
1911
1912         /* Lose the last X out vectors. They're the
1913            ones we'll be using for the async reply. */
1914         nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
1915
1916         ok = smb2_setup_nbt_length(nreq->out.vector,
1917                                    nreq->out.vector_count);
1918         if (!ok) {
1919                 return NT_STATUS_INVALID_PARAMETER_MIX;
1920         }
1921
1922         /* Step back to the previous reply. */
1923         nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
1924         firsttf = SMBD_SMB2_IDX_TF_IOV(nreq,out,first_idx);
1925         outhdr_v = SMBD_SMB2_OUT_HDR_IOV(nreq);
1926         outhdr = SMBD_SMB2_OUT_HDR_PTR(nreq);
1927         /* And end the chain. */
1928         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
1929
1930         /* Calculate outgoing credits */
1931         smb2_calculate_credits(req, nreq);
1932
1933         if (DEBUGLEVEL >= 10) {
1934                 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
1935                         (unsigned int)nreq->current_idx );
1936                 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
1937                         (unsigned int)nreq->out.vector_count );
1938                 print_req_vectors(nreq);
1939         }
1940
1941         /*
1942          * As we have changed the header (SMB2_HDR_NEXT_COMMAND),
1943          * we need to sign/encrypt here with the last/first key we remembered
1944          */
1945         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
1946                 status = smb2_signing_encrypt_pdu(req->first_enc_key,
1947                                         firsttf,
1948                                         nreq->out.vector_count - first_idx);
1949                 if (!NT_STATUS_IS_OK(status)) {
1950                         return status;
1951                 }
1952         } else if (smb2_signing_key_valid(req->last_sign_key)) {
1953                 status = smb2_signing_sign_pdu(req->last_sign_key,
1954                                                outhdr_v,
1955                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1956                 if (!NT_STATUS_IS_OK(status)) {
1957                         return status;
1958                 }
1959         }
1960
1961         nreq->queue_entry.mem_ctx = nreq;
1962         nreq->queue_entry.vector = nreq->out.vector;
1963         nreq->queue_entry.count = nreq->out.vector_count;
1964         DLIST_ADD_END(xconn->smb2.send_queue, &nreq->queue_entry);
1965         xconn->smb2.send_queue_len++;
1966
1967         status = smbd_smb2_flush_send_queue(xconn);
1968         if (!NT_STATUS_IS_OK(status)) {
1969                 return status;
1970         }
1971
1972         return NT_STATUS_OK;
1973 }
1974
1975 struct smbd_smb2_request_pending_state {
1976         struct smbd_smb2_send_queue queue_entry;
1977         uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
1978         struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
1979 };
1980
1981 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1982                                             struct tevent_timer *te,
1983                                             struct timeval current_time,
1984                                             void *private_data);
1985
1986 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
1987                                          struct tevent_req *subreq,
1988                                          uint32_t defer_time)
1989 {
1990         NTSTATUS status;
1991         struct timeval defer_endtime;
1992         uint8_t *outhdr = NULL;
1993         uint32_t flags;
1994
1995         if (!tevent_req_is_in_progress(subreq)) {
1996                 /*
1997                  * This is a performance optimization,
1998                  * it avoids one tevent_loop iteration,
1999                  * which means we avoid one
2000                  * talloc_stackframe_pool/talloc_free pair.
2001                  */
2002                 tevent_req_notify_callback(subreq);
2003                 return NT_STATUS_OK;
2004         }
2005
2006         req->subreq = subreq;
2007         subreq = NULL;
2008
2009         if (req->async_te) {
2010                 /* We're already async. */
2011                 return NT_STATUS_OK;
2012         }
2013
2014         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2015         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
2016         if (flags & SMB2_HDR_FLAG_ASYNC) {
2017                 /* We're already async. */
2018                 return NT_STATUS_OK;
2019         }
2020
2021         if (req->async_internal || defer_time == 0) {
2022                 /*
2023                  * An SMB2 request implementation wants to handle the request
2024                  * asynchronously "internally" while keeping synchronous
2025                  * behaviour for the SMB2 request. This means we don't send an
2026                  * interim response and we can allow processing of compound SMB2
2027                  * requests (cf the subsequent check) for all cases.
2028                  */
2029                 return NT_STATUS_OK;
2030         }
2031
2032         if (req->in.vector_count > req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
2033                 /*
2034                  * We're trying to go async in a compound request
2035                  * chain. This is only allowed for opens that cause an
2036                  * oplock break or for the last operation in the
2037                  * chain, otherwise it is not allowed. See
2038                  * [MS-SMB2].pdf note <206> on Section 3.3.5.2.7.
2039                  */
2040                 const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2041
2042                 if (SVAL(inhdr, SMB2_HDR_OPCODE) != SMB2_OP_CREATE) {
2043                         /*
2044                          * Cancel the outstanding request.
2045                          */
2046                         bool ok = tevent_req_cancel(req->subreq);
2047                         if (ok) {
2048                                 return NT_STATUS_OK;
2049                         }
2050                         TALLOC_FREE(req->subreq);
2051                         return smbd_smb2_request_error(req,
2052                                 NT_STATUS_INTERNAL_ERROR);
2053                 }
2054         }
2055
2056         if (DEBUGLEVEL >= 10) {
2057                 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
2058                         (unsigned int)req->current_idx );
2059                 print_req_vectors(req);
2060         }
2061
2062         if (req->current_idx > 1) {
2063                 /*
2064                  * We're going async in a compound
2065                  * chain after the first request has
2066                  * already been processed. Send an
2067                  * interim response containing the
2068                  * set of replies already generated.
2069                  */
2070                 int idx = req->current_idx;
2071
2072                 status = smb2_send_async_interim_response(req);
2073                 if (!NT_STATUS_IS_OK(status)) {
2074                         return status;
2075                 }
2076                 TALLOC_FREE(req->first_enc_key);
2077
2078                 req->current_idx = 1;
2079
2080                 /*
2081                  * Re-arrange the in.vectors to remove what
2082                  * we just sent.
2083                  */
2084                 memmove(&req->in.vector[1],
2085                         &req->in.vector[idx],
2086                         sizeof(req->in.vector[0])*(req->in.vector_count - idx));
2087                 req->in.vector_count = 1 + (req->in.vector_count - idx);
2088
2089                 /* Re-arrange the out.vectors to match. */
2090                 memmove(&req->out.vector[1],
2091                         &req->out.vector[idx],
2092                         sizeof(req->out.vector[0])*(req->out.vector_count - idx));
2093                 req->out.vector_count = 1 + (req->out.vector_count - idx);
2094
2095                 if (req->in.vector_count == 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
2096                         /*
2097                          * We only have one remaining request as
2098                          * we've processed everything else.
2099                          * This is no longer a compound request.
2100                          */
2101                         req->compound_related = false;
2102                         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2103                         flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
2104                         SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
2105                 }
2106         }
2107         TALLOC_FREE(req->last_sign_key);
2108
2109         /*
2110          * smbd_smb2_request_pending_timer() just send a packet
2111          * to the client and doesn't need any impersonation.
2112          * So we use req->xconn->client->raw_ev_ctx instead
2113          * of req->ev_ctx here.
2114          */
2115         defer_endtime = timeval_current_ofs_usec(defer_time);
2116         req->async_te = tevent_add_timer(req->xconn->client->raw_ev_ctx,
2117                                          req, defer_endtime,
2118                                          smbd_smb2_request_pending_timer,
2119                                          req);
2120         if (req->async_te == NULL) {
2121                 return NT_STATUS_NO_MEMORY;
2122         }
2123
2124         return NT_STATUS_OK;
2125 }
2126
2127 static
2128 struct smb2_signing_key *smbd_smb2_signing_key(struct smbXsrv_session *session,
2129                                                struct smbXsrv_connection *xconn,
2130                                                bool *_has_channel)
2131 {
2132         struct smbXsrv_channel_global0 *c = NULL;
2133         NTSTATUS status;
2134         struct smb2_signing_key *key = NULL;
2135         bool has_channel = false;
2136
2137         status = smbXsrv_session_find_channel(session, xconn, &c);
2138         if (NT_STATUS_IS_OK(status)) {
2139                 key = c->signing_key;
2140                 has_channel = true;
2141         }
2142
2143         if (!smb2_signing_key_valid(key)) {
2144                 key = session->global->signing_key;
2145                 has_channel = false;
2146         }
2147
2148         if (_has_channel != NULL) {
2149                 *_has_channel = has_channel;
2150         }
2151
2152         return key;
2153 }
2154
2155 static NTSTATUS smb2_get_new_nonce(struct smbXsrv_session *session,
2156                                    uint64_t *new_nonce_high,
2157                                    uint64_t *new_nonce_low)
2158 {
2159         uint64_t nonce_high;
2160         uint64_t nonce_low;
2161
2162         session->nonce_low += 1;
2163         if (session->nonce_low == 0) {
2164                 session->nonce_low += 1;
2165                 session->nonce_high += 1;
2166         }
2167
2168         /*
2169          * CCM and GCM algorithms must never have their
2170          * nonce wrap, or the security of the whole
2171          * communication and the keys is destroyed.
2172          * We must drop the connection once we have
2173          * transfered too much data.
2174          *
2175          * NOTE: We assume nonces greater than 8 bytes.
2176          */
2177         if (session->nonce_high >= session->nonce_high_max) {
2178                 return NT_STATUS_ENCRYPTION_FAILED;
2179         }
2180
2181         nonce_high = session->nonce_high_random;
2182         nonce_high += session->nonce_high;
2183         nonce_low = session->nonce_low;
2184
2185         *new_nonce_high = nonce_high;
2186         *new_nonce_low = nonce_low;
2187         return NT_STATUS_OK;
2188 }
2189
2190 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
2191                                             struct tevent_timer *te,
2192                                             struct timeval current_time,
2193                                             void *private_data)
2194 {
2195         struct smbd_smb2_request *req =
2196                 talloc_get_type_abort(private_data,
2197                 struct smbd_smb2_request);
2198         struct smbXsrv_connection *xconn = req->xconn;
2199         struct smbd_smb2_request_pending_state *state = NULL;
2200         uint8_t *outhdr = NULL;
2201         const uint8_t *inhdr = NULL;
2202         uint8_t *tf = NULL;
2203         uint8_t *hdr = NULL;
2204         uint8_t *body = NULL;
2205         uint8_t *dyn = NULL;
2206         uint32_t flags = 0;
2207         uint64_t message_id = 0;
2208         uint64_t async_id = 0;
2209         NTSTATUS status;
2210         bool ok;
2211
2212         TALLOC_FREE(req->async_te);
2213
2214         /* Ensure our final reply matches the interim one. */
2215         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2216         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2217         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
2218         message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
2219
2220         async_id = message_id; /* keep it simple for now... */
2221
2222         SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
2223         SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
2224
2225         DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
2226                 "going async\n",
2227                 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
2228                 (unsigned long long)async_id ));
2229
2230         /*
2231          * What we send is identical to a smbd_smb2_request_error
2232          * packet with an error status of STATUS_PENDING. Make use
2233          * of this fact sometime when refactoring. JRA.
2234          */
2235
2236         state = talloc_zero(req->xconn, struct smbd_smb2_request_pending_state);
2237         if (state == NULL) {
2238                 smbd_server_connection_terminate(xconn,
2239                                                  nt_errstr(NT_STATUS_NO_MEMORY));
2240                 return;
2241         }
2242
2243         tf = state->buf + NBT_HDR_SIZE;
2244
2245         hdr = tf + SMB2_TF_HDR_SIZE;
2246         body = hdr + SMB2_HDR_BODY;
2247         dyn = body + 8;
2248
2249         if (req->do_encryption) {
2250                 uint64_t nonce_high = 0;
2251                 uint64_t nonce_low = 0;
2252                 uint64_t session_id = req->session->global->session_wire_id;
2253
2254                 status = smb2_get_new_nonce(req->session,
2255                                             &nonce_high,
2256                                             &nonce_low);
2257                 if (!NT_STATUS_IS_OK(status)) {
2258                         smbd_server_connection_terminate(xconn,
2259                                                          nt_errstr(status));
2260                         return;
2261                 }
2262
2263                 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2264                 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2265                 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2266                 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
2267         }
2268
2269         SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
2270         SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
2271         SSVAL(hdr, SMB2_HDR_EPOCH, 0);
2272         SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(NT_STATUS_PENDING));
2273         SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
2274
2275         /*
2276          * The STATUS_PENDING response has SMB2_HDR_FLAG_SIGNED
2277          * clearedm, but echoes the signature field.
2278          */
2279         flags &= ~SMB2_HDR_FLAG_SIGNED;
2280         SIVAL(hdr, SMB2_HDR_FLAGS, flags);
2281         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
2282         SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
2283         SBVAL(hdr, SMB2_HDR_PID, async_id);
2284         SBVAL(hdr, SMB2_HDR_SESSION_ID,
2285                 BVAL(outhdr, SMB2_HDR_SESSION_ID));
2286         memcpy(hdr+SMB2_HDR_SIGNATURE,
2287                outhdr+SMB2_HDR_SIGNATURE, 16);
2288
2289         SSVAL(body, 0x00, 0x08 + 1);
2290
2291         SCVAL(body, 0x02, 0);
2292         SCVAL(body, 0x03, 0);
2293         SIVAL(body, 0x04, 0);
2294         /* Match W2K8R2... */
2295         SCVAL(dyn,  0x00, 0x21);
2296
2297         state->vector[0].iov_base = (void *)state->buf;
2298         state->vector[0].iov_len = NBT_HDR_SIZE;
2299
2300         if (req->do_encryption) {
2301                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
2302                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    =
2303                                                         SMB2_TF_HDR_SIZE;
2304         } else {
2305                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
2306                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
2307         }
2308
2309         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
2310         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
2311
2312         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
2313         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
2314
2315         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
2316         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len   = 1;
2317
2318         ok = smb2_setup_nbt_length(state->vector,
2319                                    1 + SMBD_SMB2_NUM_IOV_PER_REQ);
2320         if (!ok) {
2321                 smbd_server_connection_terminate(
2322                         xconn, nt_errstr(NT_STATUS_INTERNAL_ERROR));
2323                 return;
2324         }
2325
2326         /* Ensure we correctly go through crediting. Grant
2327            the credits now, and zero credits on the final
2328            response. */
2329         smb2_set_operation_credit(req->xconn,
2330                         SMBD_SMB2_IN_HDR_IOV(req),
2331                         &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
2332
2333         /*
2334          * We add SMB2_HDR_FLAG_ASYNC after smb2_set_operation_credit()
2335          * as it reacts on it
2336          */
2337         SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
2338
2339         if (DEBUGLVL(10)) {
2340                 int i;
2341
2342                 for (i = 0; i < ARRAY_SIZE(state->vector); i++) {
2343                         dbgtext("\tstate->vector[%u/%u].iov_len = %u\n",
2344                                 (unsigned int)i,
2345                                 (unsigned int)ARRAY_SIZE(state->vector),
2346                                 (unsigned int)state->vector[i].iov_len);
2347                 }
2348         }
2349
2350         if (req->do_encryption) {
2351                 struct smbXsrv_session *x = req->session;
2352                 struct smb2_signing_key *encryption_key = x->global->encryption_key;
2353
2354                 status = smb2_signing_encrypt_pdu(encryption_key,
2355                                         &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
2356                                         SMBD_SMB2_NUM_IOV_PER_REQ);
2357                 if (!NT_STATUS_IS_OK(status)) {
2358                         smbd_server_connection_terminate(xconn,
2359                                                 nt_errstr(status));
2360                         return;
2361                 }
2362         }
2363
2364         state->queue_entry.mem_ctx = state;
2365         state->queue_entry.vector = state->vector;
2366         state->queue_entry.count = ARRAY_SIZE(state->vector);
2367         DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
2368         xconn->smb2.send_queue_len++;
2369
2370         status = smbd_smb2_flush_send_queue(xconn);
2371         if (!NT_STATUS_IS_OK(status)) {
2372                 smbd_server_connection_terminate(xconn,
2373                                                  nt_errstr(status));
2374                 return;
2375         }
2376 }
2377
2378 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
2379 {
2380         struct smbXsrv_connection *xconn = req->xconn;
2381         struct smbd_smb2_request *cur;
2382         const uint8_t *inhdr;
2383         uint32_t flags;
2384         uint64_t search_message_id;
2385         uint64_t search_async_id;
2386         uint64_t found_id;
2387
2388         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2389
2390         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2391         search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
2392         search_async_id = BVAL(inhdr, SMB2_HDR_PID);
2393
2394         /*
2395          * We don't need the request anymore cancel requests never
2396          * have a response.
2397          *
2398          * We defer the TALLOC_FREE(req) to the caller.
2399          */
2400         DLIST_REMOVE(xconn->smb2.requests, req);
2401
2402         for (cur = xconn->smb2.requests; cur; cur = cur->next) {
2403                 const uint8_t *outhdr;
2404                 uint64_t message_id;
2405                 uint64_t async_id;
2406
2407                 if (cur->session != req->session) {
2408                         continue;
2409                 }
2410
2411                 if (cur->compound_related) {
2412                         /*
2413                          * Never cancel anything in a compound request.
2414                          * Way too hard to deal with the result.
2415                          */
2416                         continue;
2417                 }
2418
2419                 outhdr = SMBD_SMB2_OUT_HDR_PTR(cur);
2420
2421                 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
2422                 async_id = BVAL(outhdr, SMB2_HDR_PID);
2423
2424                 if (flags & SMB2_HDR_FLAG_ASYNC) {
2425                         if (search_async_id == async_id) {
2426                                 found_id = async_id;
2427                                 break;
2428                         }
2429                 } else {
2430                         if (search_message_id == message_id) {
2431                                 found_id = message_id;
2432                                 break;
2433                         }
2434                 }
2435         }
2436
2437         if (cur && cur->subreq) {
2438                 inhdr = SMBD_SMB2_IN_HDR_PTR(cur);
2439                 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
2440                         "cancel opcode[%s] mid %llu\n",
2441                         smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
2442                         (unsigned long long)found_id ));
2443                 tevent_req_cancel(cur->subreq);
2444         }
2445
2446         return NT_STATUS_OK;
2447 }
2448
2449 /*************************************************************
2450  Ensure an incoming tid is a valid one for us to access.
2451  Change to the associated uid credentials and chdir to the
2452  valid tid directory.
2453 *************************************************************/
2454
2455 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
2456 {
2457         const uint8_t *inhdr;
2458         uint32_t in_flags;
2459         uint32_t in_tid;
2460         struct smbXsrv_tcon *tcon;
2461         NTSTATUS status;
2462         NTTIME now = timeval_to_nttime(&req->request_time);
2463
2464         req->tcon = NULL;
2465
2466         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2467
2468         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2469         in_tid = IVAL(inhdr, SMB2_HDR_TID);
2470
2471         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
2472                 in_tid = req->last_tid;
2473         }
2474
2475         req->last_tid = 0;
2476
2477         status = smb2srv_tcon_lookup(req->session,
2478                                      in_tid, now, &tcon);
2479         if (!NT_STATUS_IS_OK(status)) {
2480                 return status;
2481         }
2482
2483         if (!change_to_user_and_service(
2484                     tcon->compat,
2485                     req->session->global->session_wire_id))
2486         {
2487                 return NT_STATUS_ACCESS_DENIED;
2488         }
2489
2490         req->tcon = tcon;
2491         req->last_tid = in_tid;
2492
2493         return NT_STATUS_OK;
2494 }
2495
2496 /*************************************************************
2497  Ensure an incoming session_id is a valid one for us to access.
2498 *************************************************************/
2499
2500 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
2501 {
2502         const uint8_t *inhdr;
2503         uint32_t in_flags;
2504         uint16_t in_opcode;
2505         uint64_t in_session_id;
2506         struct smbXsrv_session *session = NULL;
2507         struct auth_session_info *session_info;
2508         NTSTATUS status;
2509         NTTIME now = timeval_to_nttime(&req->request_time);
2510
2511         req->session = NULL;
2512         req->tcon = NULL;
2513
2514         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2515
2516         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2517         in_opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2518         in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
2519
2520         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
2521                 in_session_id = req->last_session_id;
2522         }
2523
2524         req->last_session_id = 0;
2525
2526         /* look an existing session up */
2527         switch (in_opcode) {
2528         case SMB2_OP_SESSSETUP:
2529                 /*
2530                  * For a session bind request, we don't have the
2531                  * channel set up at this point yet, so we defer
2532                  * the verification that the connection belongs
2533                  * to the session to the session setup code, which
2534                  * can look at the session binding flags.
2535                  */
2536                 status = smb2srv_session_lookup_client(req->xconn->client,
2537                                                        in_session_id, now,
2538                                                        &session);
2539                 break;
2540         default:
2541                 status = smb2srv_session_lookup_conn(req->xconn,
2542                                                      in_session_id, now,
2543                                                      &session);
2544                 break;
2545         }
2546         if (session) {
2547                 req->session = session;
2548                 req->last_session_id = in_session_id;
2549         }
2550         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
2551                 switch (in_opcode) {
2552                 case SMB2_OP_SESSSETUP:
2553                         status = smb2srv_session_lookup_global(req->xconn->client,
2554                                                                in_session_id,
2555                                                                req,
2556                                                                &session);
2557                         if (NT_STATUS_IS_OK(status)) {
2558                                 /*
2559                                  * We fallback to a session of
2560                                  * another process in order to
2561                                  * get the signing correct.
2562                                  *
2563                                  * We don't set req->last_session_id here.
2564                                  */
2565                                 req->session = session;
2566                         }
2567                         break;
2568                 default:
2569                         break;
2570                 }
2571         }
2572         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
2573                 switch (in_opcode) {
2574                 case SMB2_OP_SESSSETUP:
2575                         status = NT_STATUS_OK;
2576                         break;
2577                 case SMB2_OP_LOGOFF:
2578                 case SMB2_OP_CLOSE:
2579                 case SMB2_OP_LOCK:
2580                 case SMB2_OP_CANCEL:
2581                 case SMB2_OP_KEEPALIVE:
2582                         /*
2583                          * [MS-SMB2] 3.3.5.2.9 Verifying the Session
2584                          * specifies that LOGOFF, CLOSE and (UN)LOCK
2585                          * should always be processed even on expired sessions.
2586                          *
2587                          * Also see the logic in
2588                          * smbd_smb2_request_process_lock().
2589                          *
2590                          * The smb2.session.expire2 test shows that
2591                          * CANCEL and KEEPALIVE/ECHO should also
2592                          * be processed.
2593                          */
2594                         status = NT_STATUS_OK;
2595                         break;
2596                 default:
2597                         break;
2598                 }
2599         }
2600         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
2601                 switch (in_opcode) {
2602                 case SMB2_OP_TCON:
2603                 case SMB2_OP_CREATE:
2604                 case SMB2_OP_GETINFO:
2605                 case SMB2_OP_SETINFO:
2606                         return NT_STATUS_INVALID_HANDLE;
2607                 default:
2608                         /*
2609                          * Notice the check for
2610                          * (session_info == NULL)
2611                          * below.
2612                          */
2613                         status = NT_STATUS_OK;
2614                         break;
2615                 }
2616         }
2617         if (!NT_STATUS_IS_OK(status)) {
2618                 return status;
2619         }
2620
2621         session_info = session->global->auth_session_info;
2622         if (session_info == NULL) {
2623                 return NT_STATUS_INVALID_HANDLE;
2624         }
2625
2626         return NT_STATUS_OK;
2627 }
2628
2629 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
2630                                                 uint32_t data_length)
2631 {
2632         struct smbXsrv_connection *xconn = req->xconn;
2633         uint16_t needed_charge;
2634         uint16_t credit_charge = 1;
2635         const uint8_t *inhdr;
2636
2637         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2638
2639         if (xconn->smb2.credits.multicredit) {
2640                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
2641                 credit_charge = MAX(credit_charge, 1);
2642         }
2643
2644         needed_charge = (data_length - 1)/ 65536 + 1;
2645
2646         DBGC_DEBUG(DBGC_SMB2_CREDITS,
2647                    "mid %llu, CreditCharge: %d, NeededCharge: %d\n",
2648                    (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
2649                    credit_charge, needed_charge);
2650
2651         if (needed_charge > credit_charge) {
2652                 DBGC_WARNING(DBGC_SMB2_CREDITS,
2653                           "CreditCharge too low, given %d, needed %d\n",
2654                           credit_charge, needed_charge);
2655                 return NT_STATUS_INVALID_PARAMETER;
2656         }
2657
2658         return NT_STATUS_OK;
2659 }
2660
2661 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
2662                                         size_t expected_body_size)
2663 {
2664         struct iovec *inhdr_v;
2665         const uint8_t *inhdr;
2666         uint16_t opcode;
2667         const uint8_t *inbody;
2668         size_t body_size;
2669         size_t min_dyn_size = expected_body_size & 0x00000001;
2670         int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
2671
2672         /*
2673          * The following should be checked already.
2674          */
2675         if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
2676                 return NT_STATUS_INTERNAL_ERROR;
2677         }
2678         if (req->current_idx > max_idx) {
2679                 return NT_STATUS_INTERNAL_ERROR;
2680         }
2681
2682         inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
2683         if (inhdr_v->iov_len != SMB2_HDR_BODY) {
2684                 return NT_STATUS_INTERNAL_ERROR;
2685         }
2686         if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
2687                 return NT_STATUS_INTERNAL_ERROR;
2688         }
2689
2690         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2691         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2692
2693         switch (opcode) {
2694         case SMB2_OP_IOCTL:
2695         case SMB2_OP_GETINFO:
2696         case SMB2_OP_WRITE:
2697                 min_dyn_size = 0;
2698                 break;
2699         }
2700
2701         /*
2702          * Now check the expected body size,
2703          * where the last byte might be in the
2704          * dynamic section..
2705          */
2706         if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
2707                 return NT_STATUS_INVALID_PARAMETER;
2708         }
2709         if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
2710                 return NT_STATUS_INVALID_PARAMETER;
2711         }
2712
2713         inbody = SMBD_SMB2_IN_BODY_PTR(req);
2714
2715         body_size = SVAL(inbody, 0x00);
2716         if (body_size != expected_body_size) {
2717                 return NT_STATUS_INVALID_PARAMETER;
2718         }
2719
2720         return NT_STATUS_OK;
2721 }
2722
2723 bool smbXsrv_is_encrypted(uint8_t encryption_flags)
2724 {
2725         return (!(encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET)
2726                 &&
2727                 (encryption_flags & (SMBXSRV_PROCESSED_ENCRYPTED_PACKET |
2728                                      SMBXSRV_ENCRYPTION_DESIRED |
2729                                      SMBXSRV_ENCRYPTION_REQUIRED)));
2730 }
2731
2732 bool smbXsrv_is_partially_encrypted(uint8_t encryption_flags)
2733 {
2734         return ((encryption_flags & SMBXSRV_PROCESSED_ENCRYPTED_PACKET) &&
2735                 (encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET));
2736 }
2737
2738 /* Set a flag if not already set, return true if set */
2739 bool smbXsrv_set_crypto_flag(uint8_t *flags, uint8_t flag)
2740 {
2741         if ((flag == 0) || (*flags & flag)) {
2742                 return false;
2743         }
2744
2745         *flags |= flag;
2746         return true;
2747 }
2748
2749 /*
2750  * Update encryption state tracking flags, this can be used to
2751  * determine whether whether the session or tcon is "encrypted".
2752  */
2753 static void smb2srv_update_crypto_flags(struct smbd_smb2_request *req,
2754                                         uint16_t opcode,
2755                                         bool *update_session_globalp,
2756                                         bool *update_tcon_globalp)
2757 {
2758         /* Default: assume unecrypted and unsigned */
2759         struct smbXsrv_session *session = req->session;
2760         struct smbXsrv_tcon *tcon = req->tcon;
2761         uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
2762         uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
2763         bool update_session = false;
2764         bool update_tcon = false;
2765
2766         if (session->table == NULL) {
2767                 /*
2768                  * sessions from smb2srv_session_lookup_global()
2769                  * have NT_STATUS_BAD_LOGON_SESSION_STATE
2770                  * and session->table == NULL.
2771                  *
2772                  * They only used to give the correct error
2773                  * status, we should not update any state.
2774                  */
2775                 goto out;
2776         }
2777
2778         if (req->was_encrypted && req->do_encryption) {
2779                 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
2780                 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
2781         } else {
2782                 /* Unencrypted packet, can be signed */
2783                 if (req->do_signing) {
2784                         sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
2785                 }
2786         }
2787
2788         update_session |= smbXsrv_set_crypto_flag(
2789                 &session->global->encryption_flags, encrypt_flag);
2790         update_session |= smbXsrv_set_crypto_flag(
2791                 &session->global->signing_flags, sign_flag);
2792
2793         if (tcon) {
2794                 update_tcon |= smbXsrv_set_crypto_flag(
2795                         &tcon->global->encryption_flags, encrypt_flag);
2796                 update_tcon |= smbXsrv_set_crypto_flag(
2797                         &tcon->global->signing_flags, sign_flag);
2798         }
2799
2800 out:
2801         *update_session_globalp = update_session;
2802         *update_tcon_globalp = update_tcon;
2803         return;
2804 }
2805
2806 bool smbXsrv_is_signed(uint8_t signing_flags)
2807 {
2808         /*
2809          * Signing is always enabled, so unless we got an unsigned
2810          * packet and at least one signed packet that was not
2811          * encrypted, the session or tcon is "signed".
2812          */
2813         return (!(signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
2814                 (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
2815 }
2816
2817 bool smbXsrv_is_partially_signed(uint8_t signing_flags)
2818 {
2819         return ((signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
2820                 (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
2821 }
2822
2823 static NTSTATUS smbd_smb2_request_dispatch_update_counts(
2824                                 struct smbd_smb2_request *req,
2825                                 bool modify_call)
2826 {
2827         struct smbXsrv_connection *xconn = req->xconn;
2828         const uint8_t *inhdr;
2829         uint16_t channel_sequence;
2830         uint8_t generation_wrap = 0;
2831         uint32_t flags;
2832         int cmp;
2833         struct smbXsrv_open *op;
2834         bool update_open = false;
2835         NTSTATUS status = NT_STATUS_OK;
2836
2837         SMB_ASSERT(!req->request_counters_updated);
2838
2839         if (xconn->protocol < PROTOCOL_SMB3_00) {
2840                 return NT_STATUS_OK;
2841         }
2842
2843         if (req->compat_chain_fsp == NULL) {
2844                 return NT_STATUS_OK;
2845         }
2846
2847         op = req->compat_chain_fsp->op;
2848         if (op == NULL) {
2849                 return NT_STATUS_OK;
2850         }
2851
2852         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2853         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2854         channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
2855
2856         cmp = channel_sequence - op->global->channel_sequence;
2857         if (cmp < 0) {
2858                 /*
2859                  * csn wrap. We need to watch out for long-running
2860                  * requests that are still sitting on a previously
2861                  * used csn. SMB2_OP_NOTIFY can take VERY long.
2862                  */
2863                 generation_wrap += 1;
2864         }
2865
2866         if (abs(cmp) > INT16_MAX) {
2867                 /*
2868                  * [MS-SMB2] 3.3.5.2.10 - Verifying the Channel Sequence Number:
2869                  *
2870                  * If the channel sequence number of the request and the one
2871                  * known to the server are not equal, the channel sequence
2872                  * number and outstanding request counts are only updated
2873                  * "... if the unsigned difference using 16-bit arithmetic
2874                  * between ChannelSequence and Open.ChannelSequence is less than
2875                  * or equal to 0x7FFF ...".
2876                  * Otherwise, an error is returned for the modifying
2877                  * calls write, set_info, and ioctl.
2878                  *
2879                  * There are currently two issues with the description:
2880                  *
2881                  * * For the other calls, the document seems to imply
2882                  *   that processing continues without adapting the
2883                  *   counters (if the sequence numbers are not equal).
2884                  *
2885                  *   TODO: This needs clarification!
2886                  *
2887                  * * Also, the behaviour if the difference is larger
2888                  *   than 0x7FFF is not clear. The document seems to
2889                  *   imply that if such a difference is reached,
2890                  *   the server starts to ignore the counters or
2891                  *   in the case of the modifying calls, return errors.
2892                  *
2893                  *   TODO: This needs clarification!
2894                  *
2895                  * At this point Samba tries to be a little more
2896                  * clever than the description in the MS-SMB2 document
2897                  * by heuristically detecting and properly treating
2898                  * a 16 bit overflow of the client-submitted sequence
2899                  * number:
2900                  *
2901                  * If the stored channel sequence number is more than
2902                  * 0x7FFF larger than the one from the request, then
2903                  * the client-provided sequence number has likely
2904                  * overflown. We treat this case as valid instead
2905                  * of as failure.
2906                  *
2907                  * The MS-SMB2 behaviour would be setting cmp = -1.
2908                  */
2909                 cmp *= -1;
2910         }
2911
2912         if (flags & SMB2_HDR_FLAG_REPLAY_OPERATION) {
2913                 if (cmp == 0 && op->pre_request_count == 0) {
2914                         op->request_count += 1;
2915                         req->request_counters_updated = true;
2916                 } else if (cmp > 0 && op->pre_request_count == 0) {
2917                         op->pre_request_count += op->request_count;
2918                         op->request_count = 1;
2919                         op->global->channel_sequence = channel_sequence;
2920                         op->global->channel_generation += generation_wrap;
2921                         update_open = true;
2922                         req->request_counters_updated = true;
2923                 } else if (modify_call) {
2924                         return NT_STATUS_FILE_NOT_AVAILABLE;
2925                 }
2926         } else {
2927                 if (cmp == 0) {
2928                         op->request_count += 1;
2929                         req->request_counters_updated = true;
2930                 } else if (cmp > 0) {
2931                         op->pre_request_count += op->request_count;
2932                         op->request_count = 1;
2933                         op->global->channel_sequence = channel_sequence;
2934                         op->global->channel_generation += generation_wrap;
2935                         update_open = true;
2936                         req->request_counters_updated = true;
2937                 } else if (modify_call) {
2938                         return NT_STATUS_FILE_NOT_AVAILABLE;
2939                 }
2940         }
2941         req->channel_generation = op->global->channel_generation;
2942
2943         if (update_open) {
2944                 status = smbXsrv_open_update(op);
2945         }
2946
2947         return status;
2948 }
2949
2950 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
2951 {
2952         struct smbXsrv_connection *xconn = req->xconn;
2953         const struct smbd_smb2_dispatch_table *call = NULL;
2954         const struct iovec *intf_v = SMBD_SMB2_IN_TF_IOV(req);
2955         const uint8_t *inhdr;
2956         uint16_t opcode;
2957         uint32_t flags;
2958         uint64_t mid;
2959         NTSTATUS status;
2960         NTSTATUS session_status;
2961         uint32_t allowed_flags;
2962         NTSTATUS return_value;
2963         struct smbXsrv_session *x = NULL;
2964         bool signing_required = false;
2965         bool encryption_desired = false;
2966         bool encryption_required = false;
2967
2968         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2969
2970         DO_PROFILE_INC(request);
2971
2972         SMB_ASSERT(!req->request_counters_updated);
2973
2974         /* TODO: verify more things */
2975
2976         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2977         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2978         mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
2979         DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
2980                 smb2_opcode_name(opcode),
2981                 (unsigned long long)mid));
2982
2983         if (xconn->protocol >= PROTOCOL_SMB2_02) {
2984                 /*
2985                  * once the protocol is negotiated
2986                  * SMB2_OP_NEGPROT is not allowed anymore
2987                  */
2988                 if (opcode == SMB2_OP_NEGPROT) {
2989                         /* drop the connection */
2990                         return NT_STATUS_INVALID_PARAMETER;
2991                 }
2992         } else {
2993                 /*
2994                  * if the protocol is not negotiated yet
2995                  * only SMB2_OP_NEGPROT is allowed.
2996                  */
2997                 if (opcode != SMB2_OP_NEGPROT) {
2998                         /* drop the connection */
2999                         return NT_STATUS_INVALID_PARAMETER;
3000                 }
3001         }
3002
3003         /*
3004          * Check if the client provided a valid session id.
3005          *
3006          * As some command don't require a valid session id
3007          * we defer the check of the session_status
3008          */
3009         session_status = smbd_smb2_request_check_session(req);
3010         x = req->session;
3011         if (x != NULL) {
3012                 signing_required = x->global->signing_flags & SMBXSRV_SIGNING_REQUIRED;
3013                 encryption_desired = x->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED;
3014                 encryption_required = x->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED;
3015         }
3016
3017         req->async_internal = false;
3018         req->do_signing = false;
3019         if (opcode != SMB2_OP_SESSSETUP) {
3020                 req->do_encryption = encryption_desired;
3021         } else {
3022                 req->do_encryption = false;
3023         }
3024         req->was_encrypted = false;
3025         if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
3026                 const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
3027                 uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
3028
3029                 if (x != NULL && x->global->session_wire_id != tf_session_id) {
3030                         DEBUG(0,("smbd_smb2_request_dispatch: invalid session_id"
3031                                  "in SMB2_HDR[%llu], SMB2_TF[%llu]\n",
3032                                  (unsigned long long)x->global->session_wire_id,
3033                                  (unsigned long long)tf_session_id));
3034                         /*
3035                          * TODO: windows allows this...
3036                          * should we drop the connection?
3037                          *
3038                          * For now we just return ACCESS_DENIED
3039                          * (Windows clients never trigger this)
3040                          * and wait for an update of [MS-SMB2].
3041                          */
3042                         return smbd_smb2_request_error(req,
3043                                         NT_STATUS_ACCESS_DENIED);
3044                 }
3045
3046                 req->was_encrypted = true;
3047                 req->do_encryption = true;
3048         }
3049
3050         if (encryption_required && !req->was_encrypted) {
3051                 req->do_encryption = true;
3052                 return smbd_smb2_request_error(req,
3053                                 NT_STATUS_ACCESS_DENIED);
3054         }
3055
3056         call = smbd_smb2_call(opcode);
3057         if (call == NULL) {
3058                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
3059         }
3060
3061         allowed_flags = SMB2_HDR_FLAG_CHAINED |
3062                         SMB2_HDR_FLAG_SIGNED |
3063                         SMB2_HDR_FLAG_DFS;
3064         if (xconn->protocol >= PROTOCOL_SMB3_11) {
3065                 allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
3066         }
3067         if (opcode == SMB2_OP_NEGPROT) {
3068                 if (lp_server_max_protocol() >= PROTOCOL_SMB3_11) {
3069                         allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
3070                 }
3071         }
3072         if (opcode == SMB2_OP_CANCEL) {
3073                 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
3074         }
3075         if (xconn->protocol >= PROTOCOL_SMB3_00) {
3076                 allowed_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
3077         }
3078         if ((flags & ~allowed_flags) != 0) {
3079                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
3080         }
3081
3082         if (flags & SMB2_HDR_FLAG_CHAINED) {
3083                 /*
3084                  * This check is mostly for giving the correct error code
3085                  * for compounded requests.
3086                  */
3087                 if (!NT_STATUS_IS_OK(session_status)) {
3088                         return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
3089                 }
3090         } else {
3091                 req->compat_chain_fsp = NULL;
3092         }
3093
3094         if (req->was_encrypted) {
3095                 signing_required = false;
3096         } else if (signing_required || (flags & SMB2_HDR_FLAG_SIGNED)) {
3097                 struct smb2_signing_key *signing_key = NULL;
3098                 bool has_channel = false;
3099
3100                 if (x == NULL) {
3101                         /*
3102                          * MS-SMB2: 3.3.5.2.4 Verifying the Signature.
3103                          * If the SMB2 header of the SMB2 NEGOTIATE
3104                          * request has the SMB2_FLAGS_SIGNED bit set in the
3105                          * Flags field, the server MUST fail the request
3106                          * with STATUS_INVALID_PARAMETER.
3107                          *
3108                          * Microsoft test tool checks this.
3109                          */
3110
3111                         if ((opcode == SMB2_OP_NEGPROT) &&
3112                                         (flags & SMB2_HDR_FLAG_SIGNED)) {
3113                                 status = NT_STATUS_INVALID_PARAMETER;
3114                         } else {
3115                                 status = NT_STATUS_USER_SESSION_DELETED;
3116                         }
3117                         return smbd_smb2_request_error(req, status);
3118                 }
3119
3120                 signing_key = smbd_smb2_signing_key(x, xconn, &has_channel);
3121
3122                 /*
3123                  * If we have a signing key, we should
3124                  * sign the response
3125                  */
3126                 if (smb2_signing_key_valid(signing_key) && opcode != SMB2_OP_CANCEL) {
3127                         req->do_signing = true;
3128                 }
3129
3130                 status = smb2_signing_check_pdu(signing_key,
3131                                                 SMBD_SMB2_IN_HDR_IOV(req),
3132                                                 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
3133                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) &&
3134                     opcode == SMB2_OP_SESSSETUP && !has_channel &&
3135                     NT_STATUS_IS_OK(session_status))
3136                 {
3137                         if (!NT_STATUS_EQUAL(x->status, NT_STATUS_BAD_LOGON_SESSION_STATE)) {
3138                                 struct smbXsrv_session *session = NULL;
3139                                 NTSTATUS error;
3140
3141                                 error = smb2srv_session_lookup_global(req->xconn->client,
3142                                                                       x->global->session_wire_id,
3143                                                                       req,
3144                                                                       &session);
3145                                 if (!NT_STATUS_IS_OK(error)) {
3146                                         return smbd_smb2_request_error(req, error);
3147                                 }
3148
3149                                 /*
3150                                  * We fallback to a session of
3151                                  * another process in order to
3152                                  * get the signing correct.
3153                                  *
3154                                  * We don't set req->last_session_id here.
3155                                  */
3156                                 req->session = x = session;
3157                         }
3158                         goto skipped_signing;
3159                 }
3160                 if (!NT_STATUS_IS_OK(status)) {
3161                         return smbd_smb2_request_error(req, status);
3162                 }
3163
3164                 /*
3165                  * Now that we know the request was correctly signed
3166                  * we have to sign the response too.
3167                  */
3168                 if (opcode != SMB2_OP_CANCEL) {
3169                         req->do_signing = true;
3170                 }
3171
3172                 if (!NT_STATUS_IS_OK(session_status)) {
3173                         return smbd_smb2_request_error(req, session_status);
3174                 }
3175         }
3176
3177         if (opcode == SMB2_OP_IOCTL) {
3178                 /*
3179                  * Some special IOCTL calls don't require
3180                  * file, tcon nor session.
3181                  *
3182                  * They typically don't do any real action
3183                  * on behalf of the client.
3184                  *
3185                  * They are mainly used to alter the behavior
3186                  * of the connection for testing. So we can
3187                  * run as root and skip all file, tcon and session
3188                  * checks below.
3189                  */
3190                 static const struct smbd_smb2_dispatch_table _root_ioctl_call = {
3191                         _OP(SMB2_OP_IOCTL),
3192                         .as_root = true,
3193                 };
3194                 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
3195                 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
3196                 uint32_t in_ctl_code;
3197                 size_t needed = 8;
3198
3199                 if (needed > body_size) {
3200                         return smbd_smb2_request_error(req,
3201                                         NT_STATUS_INVALID_PARAMETER);
3202                 }
3203
3204                 in_ctl_code = IVAL(body, 0x04);
3205                 /*
3206                  * Only add trusted IOCTL codes here!
3207                  */
3208                 switch (in_ctl_code) {
3209                 case FSCTL_SMBTORTURE_FORCE_UNACKED_TIMEOUT:
3210                         call = &_root_ioctl_call;
3211                         break;
3212                 case FSCTL_VALIDATE_NEGOTIATE_INFO:
3213                         call = &_root_ioctl_call;
3214                         break;
3215                 }
3216         }
3217
3218 skipped_signing:
3219
3220         if (flags & SMB2_HDR_FLAG_CHAINED) {
3221                 req->compound_related = true;
3222         }
3223
3224         if (call->need_session) {
3225                 if (!NT_STATUS_IS_OK(session_status)) {
3226                         return smbd_smb2_request_error(req, session_status);
3227                 }
3228         }
3229
3230         if (call->need_tcon) {
3231                 SMB_ASSERT(call->need_session);
3232
3233                 /*
3234                  * This call needs to be run as user.
3235                  *
3236                  * smbd_smb2_request_check_tcon()
3237                  * calls change_to_user() on success.
3238                  * Which implies set_current_user_info()
3239                  * and chdir_current_service().
3240                  */
3241                 status = smbd_smb2_request_check_tcon(req);
3242                 if (!NT_STATUS_IS_OK(status)) {
3243                         return smbd_smb2_request_error(req, status);
3244                 }
3245                 if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) {
3246                         encryption_desired = true;
3247                 }
3248                 if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED) {
3249                         encryption_required = true;
3250                 }
3251                 if (encryption_required && !req->was_encrypted) {
3252                         req->do_encryption = true;
3253                         return smbd_smb2_request_error(req,
3254                                 NT_STATUS_ACCESS_DENIED);
3255                 } else if (encryption_desired) {
3256                         req->do_encryption = true;
3257                 }
3258         } else if (call->need_session) {
3259                 struct auth_session_info *session_info = NULL;
3260
3261                 /*
3262                  * Unless we also have need_tcon (see above),
3263                  * we still need to call set_current_user_info().
3264                  */
3265
3266                 session_info = req->session->global->auth_session_info;
3267                 if (session_info == NULL) {
3268                         return NT_STATUS_INVALID_HANDLE;
3269                 }
3270
3271                 set_current_user_info(session_info->unix_info->sanitized_username,
3272                                       session_info->unix_info->unix_name,
3273                                       session_info->info->domain_name);
3274         }
3275
3276         if (req->session) {
3277                 bool update_session_global = false;
3278                 bool update_tcon_global = false;
3279
3280                 smb2srv_update_crypto_flags(req, opcode,
3281                                             &update_session_global,
3282                                             &update_tcon_global);
3283
3284                 if (update_session_global) {
3285                         status = smbXsrv_session_update(x);
3286                         if (!NT_STATUS_IS_OK(status)) {
3287                                 return smbd_smb2_request_error(req, status);
3288                         }
3289                 }
3290                 if (update_tcon_global) {
3291                         status = smbXsrv_tcon_update(req->tcon);
3292                         if (!NT_STATUS_IS_OK(status)) {
3293                                 return smbd_smb2_request_error(req, status);
3294                         }
3295                 }
3296         }
3297
3298         if (call->fileid_ofs != 0) {
3299                 size_t needed = call->fileid_ofs + 16;
3300                 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
3301                 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
3302                 uint64_t file_id_persistent;
3303                 uint64_t file_id_volatile;
3304                 struct files_struct *fsp;
3305
3306                 SMB_ASSERT(call->need_tcon);
3307
3308                 if (needed > body_size) {
3309                         return smbd_smb2_request_error(req,
3310                                         NT_STATUS_INVALID_PARAMETER);
3311                 }
3312
3313                 file_id_persistent      = BVAL(body, call->fileid_ofs + 0);
3314                 file_id_volatile        = BVAL(body, call->fileid_ofs + 8);
3315
3316                 fsp = file_fsp_smb2(req, file_id_persistent, file_id_volatile);
3317                 if (fsp == NULL) {
3318                         if (req->compound_related &&
3319                             !NT_STATUS_IS_OK(req->compound_create_err))
3320                         {
3321                                 return smbd_smb2_request_error(req,
3322                                                 req->compound_create_err);
3323                         }
3324                         /*
3325                          * smbd_smb2_request_process_ioctl()
3326                          * has more checks in order to return more
3327                          * detailed error codes...
3328                          */
3329                         if (opcode != SMB2_OP_IOCTL) {
3330                                 return smbd_smb2_request_error(req,
3331                                                 NT_STATUS_FILE_CLOSED);
3332                         }
3333                 } else {
3334                         if (fsp->fsp_flags.encryption_required && !req->was_encrypted) {
3335                                 return smbd_smb2_request_error(req,
3336                                                 NT_STATUS_ACCESS_DENIED);
3337                         }
3338                 }
3339         }
3340
3341         status = smbd_smb2_request_dispatch_update_counts(req, call->modify);
3342         if (!NT_STATUS_IS_OK(status)) {
3343                 return smbd_smb2_request_error(req, status);
3344         }
3345
3346         if (call->as_root) {
3347                 SMB_ASSERT(call->fileid_ofs == 0);
3348                 /* This call needs to be run as root */
3349                 change_to_root_user();
3350         } else {
3351                 SMB_ASSERT(call->need_tcon);
3352         }
3353
3354 #define _INBYTES(_r) \
3355         iov_buflen(SMBD_SMB2_IN_HDR_IOV(_r), SMBD_SMB2_NUM_IOV_PER_REQ-1)
3356
3357         switch (opcode) {
3358         case SMB2_OP_NEGPROT:
3359                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_negprot, profile_p,
3360                                                req->profile, _INBYTES(req));
3361                 return_value = smbd_smb2_request_process_negprot(req);
3362                 break;
3363
3364         case SMB2_OP_SESSSETUP:
3365                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_sesssetup, profile_p,
3366                                                req->profile, _INBYTES(req));
3367                 return_value = smbd_smb2_request_process_sesssetup(req);
3368                 break;
3369
3370         case SMB2_OP_LOGOFF:
3371                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_logoff, profile_p,
3372                                                req->profile, _INBYTES(req));
3373                 return_value = smbd_smb2_request_process_logoff(req);
3374                 break;
3375
3376         case SMB2_OP_TCON:
3377                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tcon, profile_p,
3378                                                req->profile, _INBYTES(req));
3379                 return_value = smbd_smb2_request_process_tcon(req);
3380                 break;
3381
3382         case SMB2_OP_TDIS:
3383                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tdis, profile_p,
3384                                                req->profile, _INBYTES(req));
3385                 return_value = smbd_smb2_request_process_tdis(req);
3386                 break;
3387
3388         case SMB2_OP_CREATE:
3389                 if (req->subreq == NULL) {
3390                         SMBPROFILE_IOBYTES_ASYNC_START(smb2_create, profile_p,
3391                                                        req->profile, _INBYTES(req));
3392                 } else {
3393                         SMBPROFILE_IOBYTES_ASYNC_SET_BUSY(req->profile);
3394                 }
3395                 return_value = smbd_smb2_request_process_create(req);
3396                 break;
3397
3398         case SMB2_OP_CLOSE:
3399                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_close, profile_p,
3400                                                req->profile, _INBYTES(req));
3401                 return_value = smbd_smb2_request_process_close(req);
3402                 break;
3403
3404         case SMB2_OP_FLUSH:
3405                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_flush, profile_p,
3406                                                req->profile, _INBYTES(req));
3407                 return_value = smbd_smb2_request_process_flush(req);
3408                 break;
3409
3410         case SMB2_OP_READ:
3411                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_read, profile_p,
3412                                                req->profile, _INBYTES(req));
3413                 return_value = smbd_smb2_request_process_read(req);
3414                 break;
3415
3416         case SMB2_OP_WRITE:
3417                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_write, profile_p,
3418                                                req->profile, _INBYTES(req));
3419                 return_value = smbd_smb2_request_process_write(req);
3420                 break;
3421
3422         case SMB2_OP_LOCK:
3423                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_lock, profile_p,
3424                                                req->profile, _INBYTES(req));
3425                 return_value = smbd_smb2_request_process_lock(req);
3426                 break;
3427
3428         case SMB2_OP_IOCTL:
3429                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_ioctl, profile_p,
3430                                                req->profile, _INBYTES(req));
3431                 return_value = smbd_smb2_request_process_ioctl(req);
3432                 break;
3433
3434         case SMB2_OP_CANCEL:
3435                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_cancel, profile_p,
3436                                                req->profile, _INBYTES(req));
3437                 return_value = smbd_smb2_request_process_cancel(req);
3438                 SMBPROFILE_IOBYTES_ASYNC_END(req->profile, 0);
3439
3440                 /*
3441                  * We don't need the request anymore cancel requests never
3442                  * have a response.
3443                  *
3444                  * smbd_smb2_request_process_cancel() already called
3445                  * DLIST_REMOVE(xconn->smb2.requests, req);
3446                  */
3447                 TALLOC_FREE(req);
3448
3449                 break;
3450
3451         case SMB2_OP_KEEPALIVE:
3452                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_keepalive, profile_p,
3453                                                req->profile, _INBYTES(req));
3454                 return_value = smbd_smb2_request_process_keepalive(req);
3455                 break;
3456
3457         case SMB2_OP_QUERY_DIRECTORY:
3458                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_find, profile_p,
3459                                                req->profile, _INBYTES(req));
3460                 return_value = smbd_smb2_request_process_query_directory(req);
3461                 break;
3462
3463         case SMB2_OP_NOTIFY:
3464                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_notify, profile_p,
3465                                                req->profile, _INBYTES(req));
3466                 return_value = smbd_smb2_request_process_notify(req);
3467                 break;
3468
3469         case SMB2_OP_GETINFO:
3470                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_getinfo, profile_p,
3471                                                req->profile, _INBYTES(req));
3472                 return_value = smbd_smb2_request_process_getinfo(req);
3473                 break;
3474
3475         case SMB2_OP_SETINFO:
3476                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_setinfo, profile_p,
3477                                                req->profile, _INBYTES(req));
3478                 return_value = smbd_smb2_request_process_setinfo(req);
3479                 break;
3480
3481         case SMB2_OP_BREAK:
3482                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_break, profile_p,
3483                                                req->profile, _INBYTES(req));
3484                 return_value = smbd_smb2_request_process_break(req);
3485                 break;
3486
3487         default:
3488                 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
3489                 break;
3490         }
3491         return return_value;
3492 }
3493
3494 static void smbd_smb2_request_reply_update_counts(struct smbd_smb2_request *req)
3495 {
3496         struct smbXsrv_connection *xconn = req->xconn;
3497         const uint8_t *inhdr;
3498         uint16_t channel_sequence;
3499         struct smbXsrv_open *op;
3500
3501         if (!req->request_counters_updated) {
3502                 return;
3503         }
3504
3505         req->request_counters_updated = false;
3506
3507         if (xconn->protocol < PROTOCOL_SMB3_00) {
3508                 return;
3509         }
3510
3511         if (req->compat_chain_fsp == NULL) {
3512                 return;
3513         }
3514
3515         op = req->compat_chain_fsp->op;
3516         if (op == NULL) {
3517                 return;
3518         }
3519
3520         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
3521         channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
3522
3523         if ((op->global->channel_sequence == channel_sequence) &&
3524             (op->global->channel_generation == req->channel_generation)) {
3525                 SMB_ASSERT(op->request_count > 0);
3526                 op->request_count -= 1;
3527         } else {
3528                 SMB_ASSERT(op->pre_request_count > 0);
3529                 op->pre_request_count -= 1;
3530         }
3531 }
3532
3533 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
3534 {
3535         struct smbXsrv_connection *xconn = req->xconn;
3536         int first_idx = 1;
3537         struct iovec *firsttf = SMBD_SMB2_IDX_TF_IOV(req,out,first_idx);
3538         struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
3539         struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
3540         NTSTATUS status;
3541         bool ok;
3542
3543         req->subreq = NULL;
3544         TALLOC_FREE(req->async_te);
3545
3546         /* MS-SMB2: 3.3.4.1 Sending Any Outgoing Message */
3547         smbd_smb2_request_reply_update_counts(req);
3548
3549         if (req->do_encryption &&
3550             (firsttf->iov_len == 0) &&
3551             (!smb2_signing_key_valid(req->first_enc_key)) &&
3552             (req->session != NULL) &&
3553             smb2_signing_key_valid(req->session->global->encryption_key))
3554         {
3555                 struct smb2_signing_key *encryption_key =
3556                         req->session->global->encryption_key;
3557                 uint8_t *tf;
3558                 uint64_t session_id = req->session->global->session_wire_id;
3559                 uint64_t nonce_high;
3560                 uint64_t nonce_low;
3561
3562                 status = smb2_get_new_nonce(req->session,
3563                                             &nonce_high,
3564                                             &nonce_low);
3565                 if (!NT_STATUS_IS_OK(status)) {
3566                         return status;
3567                 }
3568
3569                 /*
3570                  * We need to place the SMB2_TRANSFORM header before the
3571                  * first SMB2 header
3572                  */
3573
3574                 /*
3575                  * we need to remember the encryption key
3576                  * and defer the signing/encryption until
3577                  * we are sure that we do not change
3578                  * the header again.
3579                  */
3580                 status = smb2_signing_key_copy(req,
3581                                                encryption_key,
3582                                                &req->first_enc_key);
3583                 if (!NT_STATUS_IS_OK(status)) {
3584                         return status;
3585                 }
3586
3587                 tf = talloc_zero_array(req, uint8_t,
3588                                        SMB2_TF_HDR_SIZE);
3589                 if (tf == NULL) {
3590                         return NT_STATUS_NO_MEMORY;
3591                 }
3592
3593                 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3594                 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
3595                 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
3596                 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
3597
3598                 firsttf->iov_base = (void *)tf;
3599                 firsttf->iov_len = SMB2_TF_HDR_SIZE;
3600         }
3601
3602         if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
3603             (smb2_signing_key_valid(req->last_sign_key)) &&
3604             (firsttf->iov_len == 0))
3605         {
3606                 int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
3607                 struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
3608
3609                 /*
3610                  * As we are sure the header of the last request in the
3611                  * compound chain will not change, we can to sign here
3612                  * with the last signing key we remembered.
3613                  */
3614                 status = smb2_signing_sign_pdu(req->last_sign_key,
3615                                                lasthdr,
3616                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
3617                 if (!NT_STATUS_IS_OK(status)) {
3618                         return status;
3619                 }
3620         }
3621         TALLOC_FREE(req->last_sign_key);
3622
3623         SMBPROFILE_IOBYTES_ASYNC_END(req->profile,
3624                 iov_buflen(outhdr, SMBD_SMB2_NUM_IOV_PER_REQ-1));
3625
3626         req->current_idx += SMBD_SMB2_NUM_IOV_PER_REQ;
3627
3628         if (req->current_idx < req->out.vector_count) {
3629                 /*
3630                  * We must process the remaining compound
3631                  * SMB2 requests before any new incoming SMB2
3632                  * requests. This is because incoming SMB2
3633                  * requests may include a cancel for a
3634                  * compound request we haven't processed
3635                  * yet.
3636                  */
3637                 struct tevent_immediate *im = tevent_create_immediate(req);
3638                 if (!im) {
3639                         return NT_STATUS_NO_MEMORY;
3640                 }
3641
3642                 if (req->do_signing && firsttf->iov_len == 0) {
3643                         struct smbXsrv_session *x = req->session;
3644                         struct smb2_signing_key *signing_key =
3645                                 smbd_smb2_signing_key(x, xconn, NULL);
3646
3647                         /*
3648                          * we need to remember the signing key
3649                          * and defer the signing until
3650                          * we are sure that we do not change
3651                          * the header again.
3652                          */
3653                         status = smb2_signing_key_copy(req,
3654                                                        signing_key,
3655                                                        &req->last_sign_key);
3656                         if (!NT_STATUS_IS_OK(status)) {
3657                                 return status;
3658                         }
3659                 }
3660
3661                 /*
3662                  * smbd_smb2_request_dispatch() will redo the impersonation.
3663                  * So we use req->xconn->client->raw_ev_ctx instead
3664                  * of req->ev_ctx here.
3665                  */
3666                 tevent_schedule_immediate(im,
3667                                         req->xconn->client->raw_ev_ctx,
3668                                         smbd_smb2_request_dispatch_immediate,
3669                                         req);
3670                 return NT_STATUS_OK;
3671         }
3672
3673         if (req->compound_related) {
3674                 req->compound_related = false;
3675         }
3676
3677         ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
3678         if (!ok) {
3679                 return NT_STATUS_INVALID_PARAMETER_MIX;
3680         }
3681
3682         /* Set credit for these operations (zero credits if this
3683            is a final reply for an async operation). */
3684         smb2_calculate_credits(req, req);
3685
3686         /*
3687          * now check if we need to sign the current response
3688          */
3689         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
3690                 status = smb2_signing_encrypt_pdu(req->first_enc_key,
3691                                         firsttf,
3692                                         req->out.vector_count - first_idx);
3693                 if (!NT_STATUS_IS_OK(status)) {
3694                         return status;
3695                 }
3696         } else if (req->do_signing) {
3697                 struct smbXsrv_session *x = req->session;
3698                 struct smb2_signing_key *signing_key =
3699                         smbd_smb2_signing_key(x, xconn, NULL);
3700
3701                 status = smb2_signing_sign_pdu(signing_key,
3702                                                outhdr,
3703                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
3704                 if (!NT_STATUS_IS_OK(status)) {
3705                         return status;
3706                 }
3707         }
3708         TALLOC_FREE(req->first_enc_key);
3709
3710         if (req->preauth != NULL) {
3711                 gnutls_hash_hd_t hash_hnd = NULL;
3712                 size_t i;
3713                 int rc;
3714
3715                 rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_SHA512);
3716                 if (rc < 0) {
3717                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3718                 }
3719                 rc = gnutls_hash(hash_hnd,
3720                             req->preauth->sha512_value,
3721                             sizeof(req->preauth->sha512_value));
3722                 if (rc < 0) {
3723                         gnutls_hash_deinit(hash_hnd, NULL);
3724                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3725                 }
3726                 for (i = 1; i < req->in.vector_count; i++) {
3727                         rc = gnutls_hash(hash_hnd,
3728                                          req->in.vector[i].iov_base,
3729                                          req->in.vector[i].iov_len);
3730                         if (rc < 0) {
3731                                 gnutls_hash_deinit(hash_hnd, NULL);
3732                                 return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3733                         }
3734                 }
3735                 if (rc < 0) {
3736                         gnutls_hash_deinit(hash_hnd, NULL);
3737                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3738                 }
3739                 gnutls_hash_output(hash_hnd, req->preauth->sha512_value);
3740
3741                 rc = gnutls_hash(hash_hnd,
3742                                  req->preauth->sha512_value,
3743                                  sizeof(req->preauth->sha512_value));
3744                 if (rc < 0) {
3745                         gnutls_hash_deinit(hash_hnd, NULL);
3746                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3747                 }
3748                 for (i = 1; i < req->out.vector_count; i++) {
3749                         rc = gnutls_hash(hash_hnd,
3750                                          req->out.vector[i].iov_base,
3751                                          req->out.vector[i].iov_len);
3752                         if (rc < 0) {
3753                                 gnutls_hash_deinit(hash_hnd, NULL);
3754                                 return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3755                         }
3756                 }
3757
3758                 gnutls_hash_deinit(hash_hnd, req->preauth->sha512_value);
3759
3760                 req->preauth = NULL;
3761         }
3762
3763         /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
3764         if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
3765             outdyn->iov_base == NULL && outdyn->iov_len != 0) {
3766                 /* Dynamic part is NULL. Chop it off,
3767                    We're going to send it via sendfile. */
3768                 req->out.vector_count -= 1;
3769         }
3770
3771         /*
3772          * We're done with this request -
3773          * move it off the "being processed" queue.
3774          */
3775         DLIST_REMOVE(xconn->smb2.requests, req);
3776
3777         req->queue_entry.mem_ctx = req;
3778         req->queue_entry.vector = req->out.vector;
3779         req->queue_entry.count = req->out.vector_count;
3780         DLIST_ADD_END(xconn->smb2.send_queue, &req->queue_entry);
3781         xconn->smb2.send_queue_len++;
3782
3783         status = smbd_smb2_flush_send_queue(xconn);
3784         if (!NT_STATUS_IS_OK(status)) {
3785                 return status;
3786         }
3787
3788         return NT_STATUS_OK;
3789 }
3790
3791 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn);
3792
3793 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
3794                                         struct tevent_immediate *im,
3795                                         void *private_data)
3796 {
3797         struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
3798                                         struct smbd_smb2_request);
3799         struct smbXsrv_connection *xconn = req->xconn;
3800         NTSTATUS status;
3801
3802         TALLOC_FREE(im);
3803
3804         if (DEBUGLEVEL >= 10) {
3805                 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
3806                         req->current_idx, req->in.vector_count));
3807                 print_req_vectors(req);
3808         }
3809
3810         status = smbd_smb2_request_dispatch(req);
3811         if (!NT_STATUS_IS_OK(status)) {
3812                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3813                 return;
3814         }
3815
3816         status = smbd_smb2_request_next_incoming(xconn);
3817         if (!NT_STATUS_IS_OK(status)) {
3818                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3819                 return;
3820         }
3821 }
3822
3823 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
3824                                    NTSTATUS status,
3825                                    DATA_BLOB body, DATA_BLOB *dyn,
3826                                    const char *location)
3827 {
3828         uint8_t *outhdr;
3829         struct iovec *outbody_v;
3830         struct iovec *outdyn_v;
3831         uint32_t next_command_ofs;
3832         uint64_t mid;
3833
3834         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
3835         mid = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
3836
3837         DBG_DEBUG("mid [%"PRIu64"] idx[%d] status[%s] "
3838                   "body[%u] dyn[%s:%u] at %s\n",
3839                   mid,
3840                   req->current_idx,
3841                   nt_errstr(status),
3842                   (unsigned int)body.length,
3843                   dyn ? "yes" : "no",
3844                   (unsigned int)(dyn ? dyn->length : 0),
3845                   location);
3846
3847         if (body.length < 2) {
3848                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
3849         }
3850
3851         if ((body.length % 2) != 0) {
3852                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
3853         }
3854
3855         outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
3856         outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
3857
3858         next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
3859         SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
3860
3861         outbody_v->iov_base = (void *)body.data;
3862         outbody_v->iov_len = body.length;
3863
3864         if (dyn) {
3865                 outdyn_v->iov_base = (void *)dyn->data;
3866                 outdyn_v->iov_len = dyn->length;
3867         } else {
3868                 outdyn_v->iov_base = NULL;
3869                 outdyn_v->iov_len = 0;
3870         }
3871
3872         /*
3873          * See if we need to recalculate the offset to the next response
3874          *
3875          * Note that all responses may require padding (including the very last
3876          * one).
3877          */
3878         if (req->out.vector_count >= (2 * SMBD_SMB2_NUM_IOV_PER_REQ)) {
3879                 next_command_ofs  = SMB2_HDR_BODY;
3880                 next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
3881                 next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
3882         }
3883
3884         if ((next_command_ofs % 8) != 0) {
3885                 size_t pad_size = 8 - (next_command_ofs % 8);
3886                 if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
3887                         /*
3888                          * if the dyn buffer is empty
3889                          * we can use it to add padding
3890                          */
3891                         uint8_t *pad;
3892
3893                         pad = talloc_zero_array(req,
3894                                                 uint8_t, pad_size);
3895                         if (pad == NULL) {
3896                                 return smbd_smb2_request_error(req,
3897                                                 NT_STATUS_NO_MEMORY);
3898                         }
3899
3900                         outdyn_v->iov_base = (void *)pad;
3901                         outdyn_v->iov_len = pad_size;
3902                 } else {
3903                         /*
3904                          * For now we copy the dynamic buffer
3905                          * and add the padding to the new buffer
3906                          */
3907                         size_t old_size;
3908                         uint8_t *old_dyn;
3909                         size_t new_size;
3910                         uint8_t *new_dyn;
3911
3912                         old_size = SMBD_SMB2_OUT_DYN_LEN(req);
3913                         old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
3914
3915                         new_size = old_size + pad_size;
3916                         new_dyn = talloc_zero_array(req,
3917                                                uint8_t, new_size);
3918                         if (new_dyn == NULL) {
3919                                 return smbd_smb2_request_error(req,
3920                                                 NT_STATUS_NO_MEMORY);
3921                         }
3922
3923                         memcpy(new_dyn, old_dyn, old_size);
3924                         memset(new_dyn + old_size, 0, pad_size);
3925
3926                         outdyn_v->iov_base = (void *)new_dyn;
3927                         outdyn_v->iov_len = new_size;
3928                 }
3929                 next_command_ofs += pad_size;
3930         }
3931
3932         if ((req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) >= req->out.vector_count) {
3933                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
3934         } else {
3935                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
3936         }
3937         return smbd_smb2_request_reply(req);
3938 }
3939
3940 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
3941                                     NTSTATUS status,
3942                                     DATA_BLOB *info,
3943                                     const char *location)
3944 {
3945         struct smbXsrv_connection *xconn = req->xconn;
3946         DATA_BLOB body;
3947         DATA_BLOB _dyn;
3948         uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
3949         size_t unread_bytes = smbd_smb2_unread_bytes(req);
3950
3951         DBG_NOTICE("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| "
3952                    "at %s\n", req->current_idx, nt_errstr(status),
3953                    info ? " +info" : "", location);
3954
3955         if (unread_bytes) {
3956                 /* Recvfile error. Drain incoming socket. */
3957                 size_t ret;
3958
3959                 errno = 0;
3960                 ret = drain_socket(xconn->transport.sock, unread_bytes);
3961                 if (ret != unread_bytes) {
3962                         NTSTATUS error;
3963
3964                         if (errno == 0) {
3965                                 error = NT_STATUS_IO_DEVICE_ERROR;
3966                         } else {
3967                                 error = map_nt_error_from_unix_common(errno);
3968                         }
3969
3970                         DEBUG(2, ("Failed to drain %u bytes from SMB2 socket: "
3971                                   "ret[%u] errno[%d] => %s\n",
3972                                   (unsigned)unread_bytes,
3973                                   (unsigned)ret, errno, nt_errstr(error)));
3974                         return error;
3975                 }
3976         }
3977
3978         body.data = outhdr + SMB2_HDR_BODY;
3979         body.length = 8;
3980         SSVAL(body.data, 0, 9);
3981
3982         if (info) {
3983                 SIVAL(body.data, 0x04, info->length);
3984         } else {
3985                 /* Allocated size of req->out.vector[i].iov_base
3986                  * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
3987                  * 1 byte without having to do an alloc.
3988                  */
3989                 info = &_dyn;
3990                 info->data = ((uint8_t *)outhdr) +
3991                         OUTVEC_ALLOC_SIZE - 1;
3992                 info->length = 1;
3993                 SCVAL(info->data, 0, 0);
3994         }
3995
3996         /*
3997          * Note: Even if there is an error, continue to process the request.
3998          * per MS-SMB2.
3999          */
4000
4001         return smbd_smb2_request_done_ex(req, status, body, info, __location__);
4002 }
4003
4004 struct smbd_smb2_break_state {
4005         struct tevent_req *req;
4006         struct smbd_smb2_send_queue queue_entry;
4007         uint8_t nbt_hdr[NBT_HDR_SIZE];
4008         uint8_t hdr[SMB2_HDR_BODY];
4009         struct iovec vector[1+SMBD_SMB2_NUM_IOV_PER_REQ];
4010 };
4011
4012 static struct tevent_req *smbd_smb2_break_send(TALLOC_CTX *mem_ctx,
4013                                                struct tevent_context *ev,
4014                                                struct smbXsrv_connection *xconn,
4015                                                uint64_t session_id,
4016                                                const uint8_t *body,
4017                                                size_t body_len)
4018 {
4019         struct tevent_req *req = NULL;
4020         struct smbd_smb2_break_state *state = NULL;
4021         NTSTATUS status;
4022         bool ok;
4023
4024         req = tevent_req_create(mem_ctx, &state,
4025                                 struct smbd_smb2_break_state);
4026         if (req == NULL) {
4027                 return NULL;
4028         }
4029
4030         state->req = req;
4031         tevent_req_defer_callback(req, ev);
4032
4033         SIVAL(state->hdr, 0,                            SMB2_MAGIC);
4034         SSVAL(state->hdr, SMB2_HDR_LENGTH,              SMB2_HDR_BODY);
4035         SSVAL(state->hdr, SMB2_HDR_EPOCH,               0);
4036         SIVAL(state->hdr, SMB2_HDR_STATUS,              0);
4037         SSVAL(state->hdr, SMB2_HDR_OPCODE,              SMB2_OP_BREAK);
4038         SSVAL(state->hdr, SMB2_HDR_CREDIT,              0);
4039         SIVAL(state->hdr, SMB2_HDR_FLAGS,               SMB2_HDR_FLAG_REDIRECT);
4040         SIVAL(state->hdr, SMB2_HDR_NEXT_COMMAND,        0);
4041         SBVAL(state->hdr, SMB2_HDR_MESSAGE_ID,          UINT64_MAX);
4042         SIVAL(state->hdr, SMB2_HDR_PID,                 0);
4043         SIVAL(state->hdr, SMB2_HDR_TID,                 0);
4044         SBVAL(state->hdr, SMB2_HDR_SESSION_ID,          session_id);
4045         memset(state->hdr+SMB2_HDR_SIGNATURE, 0, 16);
4046
4047         state->vector[0] = (struct iovec) {
4048                 .iov_base = state->nbt_hdr,
4049                 .iov_len  = sizeof(state->nbt_hdr)
4050         };
4051
4052         state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
4053                 .iov_base = NULL,
4054                 .iov_len  = 0
4055         };
4056
4057         state->vector[1+SMBD_SMB2_HDR_IOV_OFS] = (struct iovec) {
4058                 .iov_base = state->hdr,
4059                 .iov_len  = sizeof(state->hdr)
4060         };
4061
4062         state->vector[1+SMBD_SMB2_BODY_IOV_OFS] = (struct iovec) {
4063                 .iov_base = discard_const_p(uint8_t, body),
4064                 .iov_len  = body_len,
4065         };
4066
4067         /*
4068          * state->vector[1+SMBD_SMB2_DYN_IOV_OFS] is NULL by talloc_zero above
4069          */
4070
4071         ok = smb2_setup_nbt_length(state->vector,
4072                                    1 + SMBD_SMB2_NUM_IOV_PER_REQ);
4073         if (!ok) {
4074                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4075                 return tevent_req_post(req, ev);
4076         }
4077
4078         /*
4079          * We require TCP acks for this PDU to the client!
4080          * We want 5 retransmissions and timeout when the
4081          * retransmission timeout (rto) passed 6 times.
4082          *
4083          * required_acked_bytes gets a dummy value of
4084          * UINT64_MAX, as long it's in xconn->smb2.send_queue,
4085          * it'll get the real value when it's moved to
4086          * xconn->ack.queue.
4087          *
4088          * state->queue_entry.ack.req gets completed with
4089          * 1.  tevent_req_done(), when all bytes are acked.
4090          * 2a. tevent_req_nterror(NT_STATUS_IO_TIMEOUT), when
4091          *     the timeout expired before all bytes were acked.
4092          * 2b. tevent_req_nterror(transport_error), when the
4093          *     connection got a disconnect from the kernel.
4094          */
4095         state->queue_entry.ack.timeout =
4096                 timeval_current_ofs_usec(xconn->ack.rto_usecs * 6);
4097         state->queue_entry.ack.required_acked_bytes = UINT64_MAX;
4098         state->queue_entry.ack.req = req;
4099         state->queue_entry.mem_ctx = state;
4100         state->queue_entry.vector = state->vector;
4101         state->queue_entry.count = ARRAY_SIZE(state->vector);
4102         DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
4103         xconn->smb2.send_queue_len++;
4104
4105         status = smbd_smb2_flush_send_queue(xconn);
4106         if (tevent_req_nterror(req, status)) {
4107                 return tevent_req_post(req, ev);
4108         }
4109
4110         return req;
4111 }
4112
4113 static NTSTATUS smbd_smb2_break_recv(struct tevent_req *req)
4114 {
4115         return tevent_req_simple_recv_ntstatus(req);
4116 }
4117
4118 struct smbXsrv_pending_break {
4119         struct smbXsrv_pending_break *prev, *next;
4120         struct smbXsrv_client *client;
4121         bool disable_oplock_break_retries;
4122         uint64_t session_id;
4123         uint64_t last_channel_id;
4124         union {
4125                 uint8_t generic[1];
4126                 uint8_t oplock[0x18];
4127                 uint8_t lease[0x2c];
4128         } body;
4129         size_t body_len;
4130 };
4131
4132 static void smbXsrv_pending_break_done(struct tevent_req *subreq);
4133
4134 static struct smbXsrv_pending_break *smbXsrv_pending_break_create(
4135                 struct smbXsrv_client *client,
4136                 uint64_t session_id)
4137 {
4138         struct smbXsrv_pending_break *pb = NULL;
4139
4140         pb = talloc_zero(client, struct smbXsrv_pending_break);
4141         if (pb == NULL) {
4142                 return NULL;
4143         }
4144         pb->client = client;
4145         pb->session_id = session_id;
4146         pb->disable_oplock_break_retries = lp_smb2_disable_oplock_break_retry();
4147
4148         return pb;
4149 }
4150
4151 static NTSTATUS smbXsrv_pending_break_submit(struct smbXsrv_pending_break *pb);
4152
4153 static NTSTATUS smbXsrv_pending_break_schedule(struct smbXsrv_pending_break *pb)
4154 {
4155         struct smbXsrv_client *client = pb->client;
4156         NTSTATUS status;
4157
4158         DLIST_ADD_END(client->pending_breaks, pb);
4159         status = smbXsrv_client_pending_breaks_updated(client);
4160         if (!NT_STATUS_IS_OK(status)) {
4161                 return status;
4162         }
4163
4164         status = smbXsrv_pending_break_submit(pb);
4165         if (!NT_STATUS_IS_OK(status)) {
4166                 return status;
4167         }
4168
4169         return NT_STATUS_OK;
4170 }
4171
4172 static NTSTATUS smbXsrv_pending_break_submit(struct smbXsrv_pending_break *pb)
4173 {
4174         struct smbXsrv_client *client = pb->client;
4175         struct smbXsrv_session *session = NULL;
4176         struct smbXsrv_connection *xconn = NULL;
4177         struct smbXsrv_connection *oplock_xconn = NULL;
4178         struct tevent_req *subreq = NULL;
4179         NTSTATUS status;
4180
4181         if (pb->session_id != 0) {
4182                 status = get_valid_smbXsrv_session(client,
4183                                                    pb->session_id,
4184                                                    &session);
4185                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
4186                         return NT_STATUS_ABANDONED;
4187                 }
4188                 if (!NT_STATUS_IS_OK(status)) {
4189                         return status;
4190                 }
4191
4192                 if (pb->last_channel_id != 0) {
4193                         /*
4194                          * This is what current Windows servers
4195                          * do, they don't retry on all available
4196                          * channels. They only use the last channel.
4197                          *
4198                          * But it doesn't match the specification in
4199                          * [MS-SMB2] "3.3.4.6 Object Store Indicates an
4200                          * Oplock Break"
4201                          *
4202                          * Per default disable_oplock_break_retries is false
4203                          * and we behave like the specification.
4204                          */
4205                         if (pb->disable_oplock_break_retries) {
4206                                 return NT_STATUS_ABANDONED;
4207                         }
4208                 }
4209         }
4210
4211         for (xconn = client->connections; xconn != NULL; xconn = xconn->next) {
4212                 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
4213                         continue;
4214                 }
4215
4216                 if (xconn->channel_id == 0) {
4217                         /*
4218                          * non-multichannel case
4219                          */
4220                         break;
4221                 }
4222
4223                 if (session != NULL) {
4224                         struct smbXsrv_channel_global0 *c = NULL;
4225
4226                         /*
4227                          * Having a session means we're handling
4228                          * an oplock break and we only need to
4229                          * use channels available on the
4230                          * session.
4231                          */
4232                         status = smbXsrv_session_find_channel(session, xconn, &c);
4233                         if (!NT_STATUS_IS_OK(status)) {
4234                                 continue;
4235                         }
4236
4237                         /*
4238                          * This is what current Windows servers
4239                          * do, they don't retry on all available
4240                          * channels. They only use the last channel.
4241                          *
4242                          * But it doesn't match the specification
4243                          * in [MS-SMB2] "3.3.4.6 Object Store Indicates an
4244                          * Oplock Break"
4245                          *
4246                          * Per default disable_oplock_break_retries is false
4247                          * and we behave like the specification.
4248                          */
4249                         if (pb->disable_oplock_break_retries) {
4250                                 oplock_xconn = xconn;
4251                                 continue;
4252                         }
4253                 }
4254
4255                 if (xconn->channel_id > pb->last_channel_id) {
4256                         /*
4257                          * multichannel case
4258                          */
4259                         break;
4260                 }
4261         }
4262
4263         if (xconn == NULL) {
4264                 xconn = oplock_xconn;
4265         }
4266
4267         if (xconn == NULL) {
4268                 /*
4269                  * If there's no remaining connection available
4270                  * tell the caller to stop...
4271                  */
4272                 return NT_STATUS_ABANDONED;
4273         }
4274
4275         pb->last_channel_id = xconn->channel_id;
4276
4277         subreq = smbd_smb2_break_send(pb,
4278                                       client->raw_ev_ctx,
4279                                       xconn,
4280                                       pb->session_id,
4281                                       pb->body.generic,
4282                                       pb->body_len);
4283         if (subreq == NULL) {
4284                 return NT_STATUS_NO_MEMORY;
4285         }
4286         tevent_req_set_callback(subreq,
4287                                 smbXsrv_pending_break_done,
4288                                 pb);
4289
4290         return NT_STATUS_OK;
4291 }
4292
4293 static void smbXsrv_pending_break_done(struct tevent_req *subreq)
4294 {
4295         struct smbXsrv_pending_break *pb =
4296                 tevent_req_callback_data(subreq,
4297                 struct smbXsrv_pending_break);
4298         struct smbXsrv_client *client = pb->client;
4299         NTSTATUS status;
4300
4301         status = smbd_smb2_break_recv(subreq);
4302         TALLOC_FREE(subreq);
4303         if (!NT_STATUS_IS_OK(status)) {
4304                 status = smbXsrv_pending_break_submit(pb);
4305                 if (NT_STATUS_EQUAL(status, NT_STATUS_ABANDONED)) {
4306                         /*
4307                          * If there's no remaing connection
4308                          * there's no need to send a break again.
4309                          */
4310                         goto remove;
4311                 }
4312                 if (!NT_STATUS_IS_OK(status)) {
4313                         smbd_server_disconnect_client(client, nt_errstr(status));
4314                         return;
4315                 }
4316                 return;
4317         }
4318
4319 remove:
4320         DLIST_REMOVE(client->pending_breaks, pb);
4321         TALLOC_FREE(pb);
4322
4323         status = smbXsrv_client_pending_breaks_updated(client);
4324         if (!NT_STATUS_IS_OK(status)) {
4325                 smbd_server_disconnect_client(client, nt_errstr(status));
4326                 return;
4327         }
4328 }
4329
4330 NTSTATUS smbd_smb2_send_oplock_break(struct smbXsrv_client *client,
4331                                      struct smbXsrv_open *op,
4332                                      uint8_t oplock_level)
4333 {
4334         struct smbXsrv_pending_break *pb = NULL;
4335         uint8_t *body = NULL;
4336
4337         pb = smbXsrv_pending_break_create(client,
4338                                           op->compat->vuid);
4339         if (pb == NULL) {
4340                 return NT_STATUS_NO_MEMORY;
4341         }
4342         pb->body_len = sizeof(pb->body.oplock);
4343         body = pb->body.oplock;
4344
4345         SSVAL(body, 0x00, pb->body_len);
4346         SCVAL(body, 0x02, oplock_level);
4347         SCVAL(body, 0x03, 0);           /* reserved */
4348         SIVAL(body, 0x04, 0);           /* reserved */
4349         SBVAL(body, 0x08, op->global->open_persistent_id);
4350         SBVAL(body, 0x10, op->global->open_volatile_id);
4351
4352         return smbXsrv_pending_break_schedule(pb);
4353 }
4354
4355 NTSTATUS smbd_smb2_send_lease_break(struct smbXsrv_client *client,
4356                                     uint16_t new_epoch,
4357                                     uint32_t lease_flags,
4358                                     struct smb2_lease_key *lease_key,
4359                                     uint32_t current_lease_state,
4360                                     uint32_t new_lease_state)
4361 {
4362         struct smbXsrv_pending_break *pb = NULL;
4363         uint8_t *body = NULL;
4364
4365         pb = smbXsrv_pending_break_create(client,
4366                                           0); /* no session_id */
4367         if (pb == NULL) {
4368                 return NT_STATUS_NO_MEMORY;
4369         }
4370         pb->body_len = sizeof(pb->body.lease);
4371         body = pb->body.lease;
4372
4373         SSVAL(body, 0x00, pb->body_len);
4374         SSVAL(body, 0x02, new_epoch);
4375         SIVAL(body, 0x04, lease_flags);
4376         SBVAL(body, 0x08, lease_key->data[0]);
4377         SBVAL(body, 0x10, lease_key->data[1]);
4378         SIVAL(body, 0x18, current_lease_state);
4379         SIVAL(body, 0x1c, new_lease_state);
4380         SIVAL(body, 0x20, 0);           /* BreakReason, MUST be 0 */
4381         SIVAL(body, 0x24, 0);           /* AccessMaskHint, MUST be 0 */
4382         SIVAL(body, 0x28, 0);           /* ShareMaskHint, MUST be 0 */
4383
4384         return smbXsrv_pending_break_schedule(pb);
4385 }
4386
4387 static bool is_smb2_recvfile_write(struct smbd_smb2_request_read_state *state)
4388 {
4389         NTSTATUS status;
4390         uint32_t flags;
4391         uint64_t file_id_persistent;
4392         uint64_t file_id_volatile;
4393         struct smbXsrv_open *op = NULL;
4394         struct files_struct *fsp = NULL;
4395         const uint8_t *body = NULL;
4396
4397         /*
4398          * This is only called with a pktbuf
4399          * of at least SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN
4400          * bytes
4401          */
4402
4403         if (IVAL(state->pktbuf, 0) == SMB2_TF_MAGIC) {
4404                 /* Transform header. Cannot recvfile. */
4405                 return false;
4406         }
4407         if (IVAL(state->pktbuf, 0) != SMB2_MAGIC) {
4408                 /* Not SMB2. Normal error path will cope. */
4409                 return false;
4410         }
4411         if (SVAL(state->pktbuf, 4) != SMB2_HDR_BODY) {
4412                 /* Not SMB2. Normal error path will cope. */
4413                 return false;
4414         }
4415         if (SVAL(state->pktbuf, SMB2_HDR_OPCODE) != SMB2_OP_WRITE) {
4416                 /* Needs to be a WRITE. */
4417                 return false;
4418         }
4419         if (IVAL(state->pktbuf, SMB2_HDR_NEXT_COMMAND) != 0) {
4420                 /* Chained. Cannot recvfile. */
4421                 return false;
4422         }
4423         flags = IVAL(state->pktbuf, SMB2_HDR_FLAGS);
4424         if (flags & SMB2_HDR_FLAG_CHAINED) {
4425                 /* Chained. Cannot recvfile. */
4426                 return false;
4427         }
4428         if (flags & SMB2_HDR_FLAG_SIGNED) {
4429                 /* Signed. Cannot recvfile. */
4430                 return false;
4431         }
4432
4433         body = &state->pktbuf[SMB2_HDR_BODY];
4434
4435         file_id_persistent      = BVAL(body, 0x10);
4436         file_id_volatile        = BVAL(body, 0x18);
4437
4438         status = smb2srv_open_lookup(state->req->xconn,
4439                                      file_id_persistent,
4440                                      file_id_volatile,
4441                                      0, /* now */
4442                                      &op);
4443         if (!NT_STATUS_IS_OK(status)) {
4444                 return false;
4445         }
4446
4447         fsp = op->compat;
4448         if (fsp == NULL) {
4449                 return false;
4450         }
4451         if (fsp->conn == NULL) {
4452                 return false;
4453         }
4454
4455         if (IS_IPC(fsp->conn)) {
4456                 return false;
4457         }
4458         if (IS_PRINT(fsp->conn)) {
4459                 return false;
4460         }
4461         if (fsp->base_fsp != NULL) {
4462                 return false;
4463         }
4464
4465         DEBUG(10,("Doing recvfile write len = %u\n",
4466                 (unsigned int)(state->pktfull - state->pktlen)));
4467
4468         return true;
4469 }
4470
4471 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn)
4472 {
4473         struct smbd_server_connection *sconn = xconn->client->sconn;
4474         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
4475         size_t max_send_queue_len;
4476         size_t cur_send_queue_len;
4477
4478         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
4479                 /*
4480                  * we're not supposed to do any io
4481                  */
4482                 return NT_STATUS_OK;
4483         }
4484
4485         if (state->req != NULL) {
4486                 /*
4487                  * if there is already a tstream_readv_pdu
4488                  * pending, we are done.
4489                  */
4490                 return NT_STATUS_OK;
4491         }
4492
4493         max_send_queue_len = MAX(1, xconn->smb2.credits.max/16);
4494         cur_send_queue_len = xconn->smb2.send_queue_len;
4495
4496         if (cur_send_queue_len > max_send_queue_len) {
4497                 /*
4498                  * if we have a lot of requests to send,
4499                  * we wait until they are on the wire until we
4500                  * ask for the next request.
4501                  */
4502                 return NT_STATUS_OK;
4503         }
4504
4505         /* ask for the next request */
4506         ZERO_STRUCTP(state);
4507         state->req = smbd_smb2_request_allocate(xconn);
4508         if (state->req == NULL) {
4509                 return NT_STATUS_NO_MEMORY;
4510         }
4511         state->req->sconn = sconn;
4512         state->req->xconn = xconn;
4513         state->min_recv_size = lp_min_receive_file_size();
4514
4515         TEVENT_FD_READABLE(xconn->transport.fde);
4516
4517         return NT_STATUS_OK;
4518 }
4519
4520 NTSTATUS smbd_smb2_process_negprot(struct smbXsrv_connection *xconn,
4521                                uint64_t expected_seq_low,
4522                                const uint8_t *inpdu, size_t size)
4523 {
4524         struct smbd_server_connection *sconn = xconn->client->sconn;
4525         NTSTATUS status;
4526         struct smbd_smb2_request *req = NULL;
4527
4528         DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
4529                  (unsigned int)size));
4530
4531         status = smbd_initialize_smb2(xconn, expected_seq_low);
4532         if (!NT_STATUS_IS_OK(status)) {
4533                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4534                 return status;
4535         }
4536
4537         /*
4538          * If a new connection joins the process, when we're
4539          * already in a "pending break cycle", we need to
4540          * turn on the ack checker on the new connection.
4541          */
4542         status = smbXsrv_client_pending_breaks_updated(xconn->client);
4543         if (!NT_STATUS_IS_OK(status)) {
4544                 /*
4545                  * If there's a problem, we disconnect the whole
4546                  * client with all connections here!
4547                  *
4548                  * Instead of just the new connection.
4549                  */
4550                 smbd_server_disconnect_client(xconn->client, nt_errstr(status));
4551                 return status;
4552         }
4553
4554         status = smbd_smb2_request_create(xconn, inpdu, size, &req);
4555         if (!NT_STATUS_IS_OK(status)) {
4556                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4557                 return status;
4558         }
4559
4560         status = smbd_smb2_request_validate(req);
4561         if (!NT_STATUS_IS_OK(status)) {
4562                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4563                 return status;
4564         }
4565
4566         status = smbd_smb2_request_setup_out(req);
4567         if (!NT_STATUS_IS_OK(status)) {
4568                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4569                 return status;
4570         }
4571
4572 #ifdef WITH_PROFILE
4573         /*
4574          * this was already counted at the SMB1 layer =>
4575          * smbd_smb2_request_dispatch() should not count it twice.
4576          */
4577         if (profile_p->values.request_stats.count > 0) {
4578                 profile_p->values.request_stats.count--;
4579         }
4580 #endif
4581         status = smbd_smb2_request_dispatch(req);
4582         if (!NT_STATUS_IS_OK(status)) {
4583                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4584                 return status;
4585         }
4586
4587         status = smbd_smb2_request_next_incoming(xconn);
4588         if (!NT_STATUS_IS_OK(status)) {
4589                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4590                 return status;
4591         }
4592
4593         sconn->num_requests++;
4594         return NT_STATUS_OK;
4595 }
4596
4597 static int socket_error_from_errno(int ret,
4598                                    int sys_errno,
4599                                    bool *retry)
4600 {
4601         *retry = false;
4602
4603         if (ret >= 0) {
4604                 return 0;
4605         }
4606
4607         if (ret != -1) {
4608                 return EIO;
4609         }
4610
4611         if (sys_errno == 0) {
4612                 return EIO;
4613         }
4614
4615         if (sys_errno == EINTR) {
4616                 *retry = true;
4617                 return sys_errno;
4618         }
4619
4620         if (sys_errno == EINPROGRESS) {
4621                 *retry = true;
4622                 return sys_errno;
4623         }
4624
4625         if (sys_errno == EAGAIN) {
4626                 *retry = true;
4627                 return sys_errno;
4628         }
4629
4630         /* ENOMEM is retryable on Solaris/illumos, and possibly other systems. */
4631         if (sys_errno == ENOMEM) {
4632                 *retry = true;
4633                 return sys_errno;
4634         }
4635
4636 #ifdef EWOULDBLOCK
4637 #if EWOULDBLOCK != EAGAIN
4638         if (sys_errno == EWOULDBLOCK) {
4639                 *retry = true;
4640                 return sys_errno;
4641         }
4642 #endif
4643 #endif
4644
4645         return sys_errno;
4646 }
4647
4648 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn)
4649 {
4650         int ret;
4651         int err;
4652         bool retry;
4653         NTSTATUS status;
4654
4655         if (xconn->smb2.send_queue == NULL) {
4656                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
4657                 return NT_STATUS_OK;
4658         }
4659
4660         while (xconn->smb2.send_queue != NULL) {
4661                 struct smbd_smb2_send_queue *e = xconn->smb2.send_queue;
4662                 bool ok;
4663                 struct msghdr msg;
4664
4665                 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
4666                         /*
4667                          * we're not supposed to do any io
4668                          * just flush all pending stuff.
4669                          */
4670                         xconn->smb2.send_queue_len--;
4671                         DLIST_REMOVE(xconn->smb2.send_queue, e);
4672
4673                         talloc_free(e->mem_ctx);
4674                         continue;
4675                 }
4676
4677                 if (e->sendfile_header != NULL) {
4678                         size_t size = 0;
4679                         size_t i = 0;
4680                         uint8_t *buf;
4681
4682                         status = NT_STATUS_INTERNAL_ERROR;
4683
4684                         for (i=0; i < e->count; i++) {
4685                                 size += e->vector[i].iov_len;
4686                         }
4687
4688                         if (size <= e->sendfile_header->length) {
4689                                 buf = e->sendfile_header->data;
4690                         } else {
4691                                 buf = talloc_array(e->mem_ctx, uint8_t, size);
4692                                 if (buf == NULL) {
4693                                         return NT_STATUS_NO_MEMORY;
4694                                 }
4695                         }
4696
4697                         size = 0;
4698                         for (i=0; i < e->count; i++) {
4699                                 memcpy(buf+size,
4700                                        e->vector[i].iov_base,
4701                                        e->vector[i].iov_len);
4702                                 size += e->vector[i].iov_len;
4703                         }
4704
4705                         e->sendfile_header->data = buf;
4706                         e->sendfile_header->length = size;
4707                         e->sendfile_status = &status;
4708                         e->count = 0;
4709
4710                         xconn->smb2.send_queue_len--;
4711                         DLIST_REMOVE(xconn->smb2.send_queue, e);
4712
4713                         size += e->sendfile_body_size;
4714
4715                         /*
4716                          * This triggers the sendfile path via
4717                          * the destructor.
4718                          */
4719                         talloc_free(e->mem_ctx);
4720
4721                         if (!NT_STATUS_IS_OK(status)) {
4722                                 smbXsrv_connection_disconnect_transport(xconn,
4723                                                                         status);
4724                                 return status;
4725                         }
4726                         xconn->ack.unacked_bytes += size;
4727                         continue;
4728                 }
4729
4730                 msg = (struct msghdr) {
4731                         .msg_iov = e->vector,
4732                         .msg_iovlen = e->count,
4733                 };
4734
4735                 ret = sendmsg(xconn->transport.sock, &msg, 0);
4736                 if (ret == 0) {
4737                         /* propagate end of file */
4738                         return NT_STATUS_INTERNAL_ERROR;
4739                 }
4740                 err = socket_error_from_errno(ret, errno, &retry);
4741                 if (retry) {
4742                         /* retry later */
4743                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
4744                         return NT_STATUS_OK;
4745                 }
4746                 if (err != 0) {
4747                         status = map_nt_error_from_unix_common(err);
4748                         smbXsrv_connection_disconnect_transport(xconn,
4749                                                                 status);
4750                         return status;
4751                 }
4752
4753                 xconn->ack.unacked_bytes += ret;
4754
4755                 ok = iov_advance(&e->vector, &e->count, ret);
4756                 if (!ok) {
4757                         return NT_STATUS_INTERNAL_ERROR;
4758                 }
4759
4760                 if (e->count > 0) {
4761                         /* we have more to write */
4762                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
4763                         return NT_STATUS_OK;
4764                 }
4765
4766                 xconn->smb2.send_queue_len--;
4767                 DLIST_REMOVE(xconn->smb2.send_queue, e);
4768
4769                 if (e->ack.req == NULL) {
4770                         talloc_free(e->mem_ctx);
4771                         continue;
4772                 }
4773
4774                 e->ack.required_acked_bytes = xconn->ack.unacked_bytes;
4775                 DLIST_ADD_END(xconn->ack.queue, e);
4776         }
4777
4778         /*
4779          * Restart reads if we were blocked on
4780          * draining the send queue.
4781          */
4782
4783         status = smbd_smb2_request_next_incoming(xconn);
4784         if (!NT_STATUS_IS_OK(status)) {
4785                 return status;
4786         }
4787
4788         return NT_STATUS_OK;
4789 }
4790
4791 static NTSTATUS smbd_smb2_io_handler(struct smbXsrv_connection *xconn,
4792                                      uint16_t fde_flags)
4793 {
4794         struct smbd_server_connection *sconn = xconn->client->sconn;
4795         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
4796         struct smbd_smb2_request *req = NULL;
4797         size_t min_recvfile_size = UINT32_MAX;
4798         int ret;
4799         int err;
4800         bool retry;
4801         NTSTATUS status;
4802         NTTIME now;
4803         struct msghdr msg;
4804
4805         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
4806                 /*
4807                  * we're not supposed to do any io
4808                  */
4809                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
4810                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
4811                 return NT_STATUS_OK;
4812         }
4813
4814         if (fde_flags & TEVENT_FD_WRITE) {
4815                 status = smbd_smb2_flush_send_queue(xconn);
4816                 if (!NT_STATUS_IS_OK(status)) {
4817                         return status;
4818                 }
4819         }
4820
4821         if (!(fde_flags & TEVENT_FD_READ)) {
4822                 return NT_STATUS_OK;
4823         }
4824
4825         if (state->req == NULL) {
4826                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
4827                 return NT_STATUS_OK;
4828         }
4829
4830 again:
4831         if (!state->hdr.done) {
4832                 state->hdr.done = true;
4833
4834                 state->vector.iov_base = (void *)state->hdr.nbt;
4835                 state->vector.iov_len = NBT_HDR_SIZE;
4836         }
4837
4838         msg = (struct msghdr) {
4839                 .msg_iov = &state->vector,
4840                 .msg_iovlen = 1,
4841         };
4842
4843         ret = recvmsg(xconn->transport.sock, &msg, 0);
4844         if (ret == 0) {
4845                 /* propagate end of file */
4846                 status = NT_STATUS_END_OF_FILE;
4847                 smbXsrv_connection_disconnect_transport(xconn,
4848                                                         status);
4849                 return status;
4850         }
4851         err = socket_error_from_errno(ret, errno, &retry);
4852         if (retry) {
4853                 /* retry later */
4854                 TEVENT_FD_READABLE(xconn->transport.fde);
4855                 return NT_STATUS_OK;
4856         }
4857         if (err != 0) {
4858                 status = map_nt_error_from_unix_common(err);
4859                 smbXsrv_connection_disconnect_transport(xconn,
4860                                                         status);
4861                 return status;
4862         }
4863
4864         if (ret < state->vector.iov_len) {
4865                 uint8_t *base;
4866                 base = (uint8_t *)state->vector.iov_base;
4867                 base += ret;
4868                 state->vector.iov_base = (void *)base;
4869                 state->vector.iov_len -= ret;
4870                 /* we have more to read */
4871                 TEVENT_FD_READABLE(xconn->transport.fde);
4872                 return NT_STATUS_OK;
4873         }
4874
4875         if (state->pktlen > 0) {
4876                 if (state->doing_receivefile && !is_smb2_recvfile_write(state)) {
4877                         /*
4878                          * Not a possible receivefile write.
4879                          * Read the rest of the data.
4880                          */
4881                         state->doing_receivefile = false;
4882
4883                         state->pktbuf = talloc_realloc(state->req,
4884                                                        state->pktbuf,
4885                                                        uint8_t,
4886                                                        state->pktfull);
4887                         if (state->pktbuf == NULL) {
4888                                 return NT_STATUS_NO_MEMORY;
4889                         }
4890
4891                         state->vector.iov_base = (void *)(state->pktbuf +
4892                                 state->pktlen);
4893                         state->vector.iov_len = (state->pktfull -
4894                                 state->pktlen);
4895
4896                         state->pktlen = state->pktfull;
4897                         goto again;
4898                 }
4899
4900                 /*
4901                  * Either this is a receivefile write so we've
4902                  * done a short read, or if not we have all the data.
4903                  */
4904                 goto got_full;
4905         }
4906
4907         /*
4908          * Now we analyze the NBT header
4909          */
4910         if (state->hdr.nbt[0] != 0x00) {
4911                 state->min_recv_size = 0;
4912         }
4913         state->pktfull = smb2_len(state->hdr.nbt);
4914         if (state->pktfull == 0) {
4915                 goto got_full;
4916         }
4917
4918         if (state->min_recv_size != 0) {
4919                 min_recvfile_size = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
4920                 min_recvfile_size += state->min_recv_size;
4921         }
4922
4923         if (state->pktfull > min_recvfile_size) {
4924                 /*
4925                  * Might be a receivefile write. Read the SMB2 HEADER +
4926                  * SMB2_WRITE header first. Set 'doing_receivefile'
4927                  * as we're *attempting* receivefile write. If this
4928                  * turns out not to be a SMB2_WRITE request or otherwise
4929                  * not suitable then we'll just read the rest of the data
4930                  * the next time this function is called.
4931                  */
4932                 state->pktlen = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
4933                 state->doing_receivefile = true;
4934         } else {
4935                 state->pktlen = state->pktfull;
4936         }
4937
4938         state->pktbuf = talloc_array(state->req, uint8_t, state->pktlen);
4939         if (state->pktbuf == NULL) {
4940                 return NT_STATUS_NO_MEMORY;
4941         }
4942
4943         state->vector.iov_base = (void *)state->pktbuf;
4944         state->vector.iov_len = state->pktlen;
4945
4946         goto again;
4947
4948 got_full:
4949
4950         if (state->hdr.nbt[0] != 0x00) {
4951                 DEBUG(1,("ignore NBT[0x%02X] msg\n",
4952                          state->hdr.nbt[0]));
4953
4954                 req = state->req;
4955                 ZERO_STRUCTP(state);
4956                 state->req = req;
4957                 state->min_recv_size = lp_min_receive_file_size();
4958                 req = NULL;
4959                 goto again;
4960         }
4961
4962         req = state->req;
4963         state->req = NULL;
4964
4965         req->request_time = timeval_current();
4966         now = timeval_to_nttime(&req->request_time);
4967
4968         status = smbd_smb2_inbuf_parse_compound(xconn,
4969                                                 now,
4970                                                 state->pktbuf,
4971                                                 state->pktlen,
4972                                                 req,
4973                                                 &req->in.vector,
4974                                                 &req->in.vector_count);
4975         if (!NT_STATUS_IS_OK(status)) {
4976                 return status;
4977         }
4978
4979         if (state->doing_receivefile) {
4980                 req->smb1req = talloc_zero(req, struct smb_request);
4981                 if (req->smb1req == NULL) {
4982                         return NT_STATUS_NO_MEMORY;
4983                 }
4984                 req->smb1req->unread_bytes = state->pktfull - state->pktlen;
4985         }
4986
4987         ZERO_STRUCTP(state);
4988
4989         req->current_idx = 1;
4990
4991         DEBUG(10,("smbd_smb2_request idx[%d] of %d vectors\n",
4992                  req->current_idx, req->in.vector_count));
4993
4994         status = smbd_smb2_request_validate(req);
4995         if (!NT_STATUS_IS_OK(status)) {
4996                 return status;
4997         }
4998
4999         status = smbd_smb2_request_setup_out(req);
5000         if (!NT_STATUS_IS_OK(status)) {
5001                 return status;
5002         }
5003
5004         status = smbd_smb2_request_dispatch(req);
5005         if (!NT_STATUS_IS_OK(status)) {
5006                 return status;
5007         }
5008
5009         sconn->num_requests++;
5010
5011         /* The timeout_processing function isn't run nearly
5012            often enough to implement 'max log size' without
5013            overrunning the size of the file by many megabytes.
5014            This is especially true if we are running at debug
5015            level 10.  Checking every 50 SMB2s is a nice
5016            tradeoff of performance vs log file size overrun. */
5017
5018         if ((sconn->num_requests % 50) == 0 &&
5019             need_to_check_log_size()) {
5020                 change_to_root_user();
5021                 check_log_size();
5022         }
5023
5024         status = smbd_smb2_request_next_incoming(xconn);
5025         if (!NT_STATUS_IS_OK(status)) {
5026                 return status;
5027         }
5028
5029         return NT_STATUS_OK;
5030 }
5031
5032 static void smbd_smb2_connection_handler(struct tevent_context *ev,
5033                                          struct tevent_fd *fde,
5034                                          uint16_t flags,
5035                                          void *private_data)
5036 {
5037         struct smbXsrv_connection *xconn =
5038                 talloc_get_type_abort(private_data,
5039                 struct smbXsrv_connection);
5040         NTSTATUS status;
5041
5042         status = smbd_smb2_io_handler(xconn, flags);
5043         if (!NT_STATUS_IS_OK(status)) {
5044                 smbd_server_connection_terminate(xconn, nt_errstr(status));
5045                 return;
5046         }
5047 }