source3/smbd/smb2_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) Jeremy Allison 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "smbprofile.h"
  29 #include "../lib/util/bitmap.h"
  30 #include "../librpc/gen_ndr/krb5pac.h"
  31 #include "lib/util/iov_buf.h"
  32 #include "auth.h"
  33 #include "lib/crypto/sha512.h"
  34
  35 static void smbd_smb2_connection_handler(struct tevent_context *ev,
  36                                          struct tevent_fd *fde,
  37                                          uint16_t flags,
  38                                          void *private_data);
  39 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn);
  40
  41 static const struct smbd_smb2_dispatch_table {
  42         uint16_t opcode;
  43         const char *name;
  44         bool need_session;
  45         bool need_tcon;
  46         bool as_root;
  47         uint16_t fileid_ofs;
  48         bool allow_invalid_fileid;
  49         bool modify;
  50 } smbd_smb2_table[] = {
  51 #define _OP(o) .opcode = o, .name = #o
  52         {
  53                 _OP(SMB2_OP_NEGPROT),
  54                 .as_root = true,
  55         },{
  56                 _OP(SMB2_OP_SESSSETUP),
  57                 .as_root = true,
  58         },{
  59                 _OP(SMB2_OP_LOGOFF),
  60                 .need_session = true,
  61                 .as_root = true,
  62         },{
  63                 _OP(SMB2_OP_TCON),
  64                 .need_session = true,
  65                 /*
  66                  * This call needs to be run as root.
  67                  *
  68                  * smbd_smb2_request_process_tcon()
  69                  * calls make_connection_snum(), which will call
  70                  * change_to_user(), when needed.
  71                  */
  72                 .as_root = true,
  73         },{
  74                 _OP(SMB2_OP_TDIS),
  75                 .need_session = true,
  76                 .need_tcon = true,
  77                 .as_root = true,
  78         },{
  79                 _OP(SMB2_OP_CREATE),
  80                 .need_session = true,
  81                 .need_tcon = true,
  82         },{
  83                 _OP(SMB2_OP_CLOSE),
  84                 .need_session = true,
  85                 .need_tcon = true,
  86                 .fileid_ofs = 0x08,
  87         },{
  88                 _OP(SMB2_OP_FLUSH),
  89                 .need_session = true,
  90                 .need_tcon = true,
  91                 .fileid_ofs = 0x08,
  92         },{
  93                 _OP(SMB2_OP_READ),
  94                 .need_session = true,
  95                 .need_tcon = true,
  96                 .fileid_ofs = 0x10,
  97         },{
  98                 _OP(SMB2_OP_WRITE),
  99                 .need_session = true,
 100                 .need_tcon = true,
 101                 .fileid_ofs = 0x10,
 102                 .modify = true,
 103         },{
 104                 _OP(SMB2_OP_LOCK),
 105                 .need_session = true,
 106                 .need_tcon = true,
 107                 .fileid_ofs = 0x08,
 108         },{
 109                 _OP(SMB2_OP_IOCTL),
 110                 .need_session = true,
 111                 .need_tcon = true,
 112                 .fileid_ofs = 0x08,
 113                 .allow_invalid_fileid = true,
 114                 .modify = true,
 115         },{
 116                 _OP(SMB2_OP_CANCEL),
 117                 .as_root = true,
 118         },{
 119                 _OP(SMB2_OP_KEEPALIVE),
 120                 .as_root = true,
 121         },{
 122                 _OP(SMB2_OP_QUERY_DIRECTORY),
 123                 .need_session = true,
 124                 .need_tcon = true,
 125                 .fileid_ofs = 0x08,
 126         },{
 127                 _OP(SMB2_OP_NOTIFY),
 128                 .need_session = true,
 129                 .need_tcon = true,
 130                 .fileid_ofs = 0x08,
 131         },{
 132                 _OP(SMB2_OP_GETINFO),
 133                 .need_session = true,
 134                 .need_tcon = true,
 135                 .fileid_ofs = 0x18,
 136         },{
 137                 _OP(SMB2_OP_SETINFO),
 138                 .need_session = true,
 139                 .need_tcon = true,
 140                 .fileid_ofs = 0x10,
 141                 .modify = true,
 142         },{
 143                 _OP(SMB2_OP_BREAK),
 144                 .need_session = true,
 145                 .need_tcon = true,
 146                 /*
 147                  * we do not set
 148                  * .fileid_ofs here
 149                  * as LEASE breaks does not
 150                  * have a file id
 151                  */
 152         }
 153 };
 154
 155 const char *smb2_opcode_name(uint16_t opcode)
 156 {
 157         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
 158                 return "Bad SMB2 opcode";
 159         }
 160         return smbd_smb2_table[opcode].name;
 161 }
 162
 163 static const struct smbd_smb2_dispatch_table *smbd_smb2_call(uint16_t opcode)
 164 {
 165         const struct smbd_smb2_dispatch_table *ret = NULL;
 166
 167         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
 168                 return NULL;
 169         }
 170
 171         ret = &smbd_smb2_table[opcode];
 172
 173         SMB_ASSERT(ret->opcode == opcode);
 174
 175         return ret;
 176 }
 177
 178 static void print_req_vectors(const struct smbd_smb2_request *req)
 179 {
 180         int i;
 181
 182         for (i = 0; i < req->in.vector_count; i++) {
 183                 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
 184                         (unsigned int)i,
 185                         (unsigned int)req->in.vector[i].iov_len);
 186         }
 187         for (i = 0; i < req->out.vector_count; i++) {
 188                 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
 189                         (unsigned int)i,
 190                         (unsigned int)req->out.vector[i].iov_len);
 191         }
 192 }
 193
 194 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
 195 {
 196         if (size < (4 + SMB2_HDR_BODY)) {
 197                 return false;
 198         }
 199
 200         if (IVAL(inbuf, 4) != SMB2_MAGIC) {
 201                 return false;
 202         }
 203
 204         return true;
 205 }
 206
 207 static NTSTATUS smbd_initialize_smb2(struct smbXsrv_connection *xconn,
 208                                      uint64_t expected_seq_low)
 209 {
 210         TALLOC_FREE(xconn->transport.fde);
 211
 212         xconn->smb2.credits.seq_low = expected_seq_low;
 213         xconn->smb2.credits.seq_range = 1;
 214         xconn->smb2.credits.granted = 1;
 215         xconn->smb2.credits.max = lp_smb2_max_credits();
 216         xconn->smb2.credits.bitmap = bitmap_talloc(xconn,
 217                                                    xconn->smb2.credits.max);
 218         if (xconn->smb2.credits.bitmap == NULL) {
 219                 return NT_STATUS_NO_MEMORY;
 220         }
 221
 222         xconn->transport.fde = tevent_add_fd(xconn->ev_ctx,
 223                                         xconn,
 224                                         xconn->transport.sock,
 225                                         TEVENT_FD_READ,
 226                                         smbd_smb2_connection_handler,
 227                                         xconn);
 228         if (xconn->transport.fde == NULL) {
 229                 return NT_STATUS_NO_MEMORY;
 230         }
 231
 232         /* Ensure child is set to non-blocking mode */
 233         set_blocking(xconn->transport.sock, false);
 234         return NT_STATUS_OK;
 235 }
 236
 237 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
 238 #define _smb2_setlen(_buf,len) do { \
 239         uint8_t *buf = (uint8_t *)_buf; \
 240         buf[0] = 0; \
 241         buf[1] = ((len)&0xFF0000)>>16; \
 242         buf[2] = ((len)&0xFF00)>>8; \
 243         buf[3] = (len)&0xFF; \
 244 } while (0)
 245
 246 static bool smb2_setup_nbt_length(struct iovec *vector, int count)
 247 {
 248         ssize_t len;
 249
 250         if (count == 0) {
 251                 return false;
 252         }
 253
 254         len = iov_buflen(vector+1, count-1);
 255
 256         if ((len == -1) || (len > 0xFFFFFF)) {
 257                 return false;
 258         }
 259
 260         _smb2_setlen(vector[0].iov_base, len);
 261         return true;
 262 }
 263
 264 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
 265 {
 266         if (req->first_key.length > 0) {
 267                 data_blob_clear_free(&req->first_key);
 268         }
 269         if (req->last_key.length > 0) {
 270                 data_blob_clear_free(&req->last_key);
 271         }
 272         return 0;
 273 }
 274
 275 void smb2_request_set_async_internal(struct smbd_smb2_request *req,
 276                                      bool async_internal)
 277 {
 278         req->async_internal = async_internal;
 279 }
 280
 281 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
 282 {
 283         TALLOC_CTX *mem_pool;
 284         struct smbd_smb2_request *req;
 285
 286 #if 0
 287         /* Enable this to find subtle valgrind errors. */
 288         mem_pool = talloc_init("smbd_smb2_request_allocate");
 289 #else
 290         mem_pool = talloc_tos();
 291 #endif
 292         if (mem_pool == NULL) {
 293                 return NULL;
 294         }
 295
 296         req = talloc_zero(mem_pool, struct smbd_smb2_request);
 297         if (req == NULL) {
 298                 talloc_free(mem_pool);
 299                 return NULL;
 300         }
 301         talloc_reparent(mem_pool, mem_ctx, req);
 302 #if 0
 303         TALLOC_FREE(mem_pool);
 304 #endif
 305
 306         req->last_session_id = UINT64_MAX;
 307         req->last_tid = UINT32_MAX;
 308
 309         talloc_set_destructor(req, smbd_smb2_request_destructor);
 310
 311         return req;
 312 }
 313
 314 static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *xconn,
 315                                                NTTIME now,
 316                                                uint8_t *buf,
 317                                                size_t buflen,
 318                                                struct smbd_smb2_request *req,
 319                                                struct iovec **piov,
 320                                                int *pnum_iov)
 321 {
 322         TALLOC_CTX *mem_ctx = req;
 323         struct iovec *iov;
 324         int num_iov = 1;
 325         size_t taken = 0;
 326         uint8_t *first_hdr = buf;
 327         size_t verified_buflen = 0;
 328         uint8_t *tf = NULL;
 329         size_t tf_len = 0;
 330
 331         /*
 332          * Note: index '0' is reserved for the transport protocol
 333          */
 334         iov = req->in._vector;
 335
 336         while (taken < buflen) {
 337                 size_t len = buflen - taken;
 338                 uint8_t *hdr = first_hdr + taken;
 339                 struct iovec *cur;
 340                 size_t full_size;
 341                 size_t next_command_ofs;
 342                 uint16_t body_size;
 343                 uint8_t *body = NULL;
 344                 uint32_t dyn_size;
 345                 uint8_t *dyn = NULL;
 346                 struct iovec *iov_alloc = NULL;
 347
 348                 if (iov != req->in._vector) {
 349                         iov_alloc = iov;
 350                 }
 351
 352                 if (verified_buflen > taken) {
 353                         len = verified_buflen - taken;
 354                 } else {
 355                         tf = NULL;
 356                         tf_len = 0;
 357                 }
 358
 359                 if (len < 4) {
 360                         DEBUG(10, ("%d bytes left, expected at least %d\n",
 361                                    (int)len, 4));
 362                         goto inval;
 363                 }
 364                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
 365                         struct smbXsrv_session *s = NULL;
 366                         uint64_t uid;
 367                         struct iovec tf_iov[2];
 368                         NTSTATUS status;
 369                         size_t enc_len;
 370
 371                         if (xconn->protocol < PROTOCOL_SMB2_24) {
 372                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
 373                                            "but dialect[0x%04X] is used\n",
 374                                            xconn->smb2.server.dialect));
 375                                 goto inval;
 376                         }
 377
 378                         if (xconn->smb2.server.cipher == 0) {
 379                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
 380                                            "but not negotiated "
 381                                            "client[0x%08X] server[0x%08X]\n",
 382                                            xconn->smb2.client.capabilities,
 383                                            xconn->smb2.server.capabilities));
 384                                 goto inval;
 385                         }
 386
 387                         if (len < SMB2_TF_HDR_SIZE) {
 388                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
 389                                            (int)len, SMB2_TF_HDR_SIZE));
 390                                 goto inval;
 391                         }
 392                         tf = hdr;
 393                         tf_len = SMB2_TF_HDR_SIZE;
 394                         taken += tf_len;
 395
 396                         hdr = first_hdr + taken;
 397                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
 398                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
 399
 400                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
 401                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
 402                                            (int)len,
 403                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
 404                                 goto inval;
 405                         }
 406
 407                         status = smb2srv_session_lookup_conn(xconn, uid, now,
 408                                                              &s);
 409                         if (s == NULL) {
 410                                 DEBUG(1, ("invalid session[%llu] in "
 411                                           "SMB2_TRANSFORM header\n",
 412                                            (unsigned long long)uid));
 413                                 TALLOC_FREE(iov_alloc);
 414                                 return NT_STATUS_USER_SESSION_DELETED;
 415                         }
 416
 417                         tf_iov[0].iov_base = (void *)tf;
 418                         tf_iov[0].iov_len = tf_len;
 419                         tf_iov[1].iov_base = (void *)hdr;
 420                         tf_iov[1].iov_len = enc_len;
 421
 422                         status = smb2_signing_decrypt_pdu(s->global->decryption_key,
 423                                                           xconn->smb2.server.cipher,
 424                                                           tf_iov, 2);
 425                         if (!NT_STATUS_IS_OK(status)) {
 426                                 TALLOC_FREE(iov_alloc);
 427                                 return status;
 428                         }
 429
 430                         verified_buflen = taken + enc_len;
 431                         len = enc_len;
 432                 }
 433
 434                 /*
 435                  * We need the header plus the body length field
 436                  */
 437
 438                 if (len < SMB2_HDR_BODY + 2) {
 439                         DEBUG(10, ("%d bytes left, expected at least %d\n",
 440                                    (int)len, SMB2_HDR_BODY));
 441                         goto inval;
 442                 }
 443                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
 444                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
 445                                    IVAL(hdr, 0)));
 446                         goto inval;
 447                 }
 448                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
 449                         DEBUG(10, ("Got HDR len %d, expected %d\n",
 450                                    SVAL(hdr, 4), SMB2_HDR_BODY));
 451                         goto inval;
 452                 }
 453
 454                 full_size = len;
 455                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
 456                 body_size = SVAL(hdr, SMB2_HDR_BODY);
 457
 458                 if (next_command_ofs != 0) {
 459                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
 460                                 goto inval;
 461                         }
 462                         if (next_command_ofs > full_size) {
 463                                 goto inval;
 464                         }
 465                         full_size = next_command_ofs;
 466                 }
 467                 if (body_size < 2) {
 468                         goto inval;
 469                 }
 470                 body_size &= 0xfffe;
 471
 472                 if (body_size > (full_size - SMB2_HDR_BODY)) {
 473                         /*
 474                          * let the caller handle the error
 475                          */
 476                         body_size = full_size - SMB2_HDR_BODY;
 477                 }
 478                 body = hdr + SMB2_HDR_BODY;
 479                 dyn = body + body_size;
 480                 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
 481
 482                 if (num_iov >= ARRAY_SIZE(req->in._vector)) {
 483                         struct iovec *iov_tmp = NULL;
 484
 485                         iov_tmp = talloc_realloc(mem_ctx, iov_alloc,
 486                                                  struct iovec,
 487                                                  num_iov +
 488                                                  SMBD_SMB2_NUM_IOV_PER_REQ);
 489                         if (iov_tmp == NULL) {
 490                                 TALLOC_FREE(iov_alloc);
 491                                 return NT_STATUS_NO_MEMORY;
 492                         }
 493
 494                         if (iov_alloc == NULL) {
 495                                 memcpy(iov_tmp,
 496                                        req->in._vector,
 497                                        sizeof(req->in._vector));
 498                         }
 499
 500                         iov = iov_tmp;
 501                 }
 502                 cur = &iov[num_iov];
 503                 num_iov += SMBD_SMB2_NUM_IOV_PER_REQ;
 504
 505                 cur[SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
 506                 cur[SMBD_SMB2_TF_IOV_OFS].iov_len    = tf_len;
 507                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
 508                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
 509                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
 510                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_len  = body_size;
 511                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
 512                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_len   = dyn_size;
 513
 514                 taken += full_size;
 515         }
 516
 517         *piov = iov;
 518         *pnum_iov = num_iov;
 519         return NT_STATUS_OK;
 520
 521 inval:
 522         if (iov != req->in._vector) {
 523                 TALLOC_FREE(iov);
 524         }
 525         return NT_STATUS_INVALID_PARAMETER;
 526 }
 527
 528 static NTSTATUS smbd_smb2_request_create(struct smbXsrv_connection *xconn,
 529                                          const uint8_t *_inpdu, size_t size,
 530                                          struct smbd_smb2_request **_req)
 531 {
 532         struct smbd_server_connection *sconn = xconn->client->sconn;
 533         struct smbd_smb2_request *req;
 534         uint32_t protocol_version;
 535         uint8_t *inpdu = NULL;
 536         const uint8_t *inhdr = NULL;
 537         uint16_t cmd;
 538         uint32_t next_command_ofs;
 539         NTSTATUS status;
 540         NTTIME now;
 541
 542         if (size < (SMB2_HDR_BODY + 2)) {
 543                 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
 544                 return NT_STATUS_INVALID_PARAMETER;
 545         }
 546
 547         inhdr = _inpdu;
 548
 549         protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
 550         if (protocol_version != SMB2_MAGIC) {
 551                 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
 552                          protocol_version));
 553                 return NT_STATUS_INVALID_PARAMETER;
 554         }
 555
 556         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 557         if (cmd != SMB2_OP_NEGPROT) {
 558                 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
 559                          cmd));
 560                 return NT_STATUS_INVALID_PARAMETER;
 561         }
 562
 563         next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
 564         if (next_command_ofs != 0) {
 565                 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
 566                          next_command_ofs));
 567                 return NT_STATUS_INVALID_PARAMETER;
 568         }
 569
 570         req = smbd_smb2_request_allocate(xconn);
 571         if (req == NULL) {
 572                 return NT_STATUS_NO_MEMORY;
 573         }
 574         req->sconn = sconn;
 575         req->xconn = xconn;
 576
 577         inpdu = talloc_memdup(req, _inpdu, size);
 578         if (inpdu == NULL) {
 579                 return NT_STATUS_NO_MEMORY;
 580         }
 581
 582         req->request_time = timeval_current();
 583         now = timeval_to_nttime(&req->request_time);
 584
 585         status = smbd_smb2_inbuf_parse_compound(xconn,
 586                                                 now,
 587                                                 inpdu,
 588                                                 size,
 589                                                 req, &req->in.vector,
 590                                                 &req->in.vector_count);
 591         if (!NT_STATUS_IS_OK(status)) {
 592                 TALLOC_FREE(req);
 593                 return status;
 594         }
 595
 596         req->current_idx = 1;
 597
 598         *_req = req;
 599         return NT_STATUS_OK;
 600 }
 601
 602 static bool smb2_validate_sequence_number(struct smbXsrv_connection *xconn,
 603                                           uint64_t message_id, uint64_t seq_id)
 604 {
 605         struct bitmap *credits_bm = xconn->smb2.credits.bitmap;
 606         unsigned int offset;
 607         uint64_t seq_tmp;
 608
 609         seq_tmp = xconn->smb2.credits.seq_low;
 610         if (seq_id < seq_tmp) {
 611                 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
 612                         "%llu (sequence id %llu) "
 613                         "(granted = %u, low = %llu, range = %u)\n",
 614                         (unsigned long long)message_id,
 615                         (unsigned long long)seq_id,
 616                         (unsigned int)xconn->smb2.credits.granted,
 617                         (unsigned long long)xconn->smb2.credits.seq_low,
 618                         (unsigned int)xconn->smb2.credits.seq_range));
 619                 return false;
 620         }
 621
 622         seq_tmp += xconn->smb2.credits.seq_range;
 623         if (seq_id >= seq_tmp) {
 624                 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
 625                         "%llu (sequence id %llu) "
 626                         "(granted = %u, low = %llu, range = %u)\n",
 627                         (unsigned long long)message_id,
 628                         (unsigned long long)seq_id,
 629                         (unsigned int)xconn->smb2.credits.granted,
 630                         (unsigned long long)xconn->smb2.credits.seq_low,
 631                         (unsigned int)xconn->smb2.credits.seq_range));
 632                 return false;
 633         }
 634
 635         offset = seq_id % xconn->smb2.credits.max;
 636
 637         if (bitmap_query(credits_bm, offset)) {
 638                 DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
 639                         "%llu (sequence id %llu) "
 640                         "(granted = %u, low = %llu, range = %u) "
 641                         "(bm offset %u)\n",
 642                         (unsigned long long)message_id,
 643                         (unsigned long long)seq_id,
 644                         (unsigned int)xconn->smb2.credits.granted,
 645                         (unsigned long long)xconn->smb2.credits.seq_low,
 646                         (unsigned int)xconn->smb2.credits.seq_range,
 647                         offset));
 648                 return false;
 649         }
 650
 651         /* Mark the message_ids as seen in the bitmap. */
 652         bitmap_set(credits_bm, offset);
 653
 654         if (seq_id != xconn->smb2.credits.seq_low) {
 655                 return true;
 656         }
 657
 658         /*
 659          * Move the window forward by all the message_id's
 660          * already seen.
 661          */
 662         while (bitmap_query(credits_bm, offset)) {
 663                 DEBUG(10,("smb2_validate_sequence_number: clearing "
 664                           "id %llu (position %u) from bitmap\n",
 665                           (unsigned long long)(xconn->smb2.credits.seq_low),
 666                           offset));
 667                 bitmap_clear(credits_bm, offset);
 668
 669                 xconn->smb2.credits.seq_low += 1;
 670                 xconn->smb2.credits.seq_range -= 1;
 671                 offset = xconn->smb2.credits.seq_low % xconn->smb2.credits.max;
 672         }
 673
 674         return true;
 675 }
 676
 677 static bool smb2_validate_message_id(struct smbXsrv_connection *xconn,
 678                                      const uint8_t *inhdr)
 679 {
 680         uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
 681         uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
 682         uint16_t credit_charge = 1;
 683         uint64_t i;
 684
 685         if (opcode == SMB2_OP_CANCEL) {
 686                 /* SMB2_CANCEL requests by definition resend messageids. */
 687                 return true;
 688         }
 689
 690         if (xconn->smb2.credits.multicredit) {
 691                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
 692                 credit_charge = MAX(credit_charge, 1);
 693         }
 694
 695         DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
 696                    "credits_granted %llu, "
 697                    "seqnum low/range: %llu/%llu\n",
 698                    (unsigned long long) message_id,
 699                    (unsigned long long) credit_charge,
 700                    (unsigned long long) xconn->smb2.credits.granted,
 701                    (unsigned long long) xconn->smb2.credits.seq_low,
 702                    (unsigned long long) xconn->smb2.credits.seq_range));
 703
 704         if (xconn->smb2.credits.granted < credit_charge) {
 705                 DEBUG(0, ("smb2_validate_message_id: client used more "
 706                           "credits than granted, mid %llu, charge %llu, "
 707                           "credits_granted %llu, "
 708                           "seqnum low/range: %llu/%llu\n",
 709                           (unsigned long long) message_id,
 710                           (unsigned long long) credit_charge,
 711                           (unsigned long long) xconn->smb2.credits.granted,
 712                           (unsigned long long) xconn->smb2.credits.seq_low,
 713                           (unsigned long long) xconn->smb2.credits.seq_range));
 714                 return false;
 715         }
 716
 717         /*
 718          * now check the message ids
 719          *
 720          * for multi-credit requests we need to check all current mid plus
 721          * the implicit mids caused by the credit charge
 722          * e.g. current mid = 15, charge 5 => mark 15-19 as used
 723          */
 724
 725         for (i = 0; i <= (credit_charge-1); i++) {
 726                 uint64_t id = message_id + i;
 727                 bool ok;
 728
 729                 DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
 730                            (unsigned long long)message_id,
 731                            credit_charge,
 732                            (unsigned long long)id));
 733
 734                 ok = smb2_validate_sequence_number(xconn, message_id, id);
 735                 if (!ok) {
 736                         return false;
 737                 }
 738         }
 739
 740         /* substract used credits */
 741         xconn->smb2.credits.granted -= credit_charge;
 742
 743         return true;
 744 }
 745
 746 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
 747 {
 748         int count;
 749         int idx;
 750
 751         count = req->in.vector_count;
 752
 753         if (count < 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
 754                 /* It's not a SMB2 request */
 755                 return NT_STATUS_INVALID_PARAMETER;
 756         }
 757
 758         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 759                 struct iovec *hdr = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
 760                 struct iovec *body = SMBD_SMB2_IDX_BODY_IOV(req,in,idx);
 761                 const uint8_t *inhdr = NULL;
 762
 763                 if (hdr->iov_len != SMB2_HDR_BODY) {
 764                         return NT_STATUS_INVALID_PARAMETER;
 765                 }
 766
 767                 if (body->iov_len < 2) {
 768                         return NT_STATUS_INVALID_PARAMETER;
 769                 }
 770
 771                 inhdr = (const uint8_t *)hdr->iov_base;
 772
 773                 /* Check the SMB2 header */
 774                 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
 775                         return NT_STATUS_INVALID_PARAMETER;
 776                 }
 777
 778                 if (!smb2_validate_message_id(req->xconn, inhdr)) {
 779                         return NT_STATUS_INVALID_PARAMETER;
 780                 }
 781         }
 782
 783         return NT_STATUS_OK;
 784 }
 785
 786 static void smb2_set_operation_credit(struct smbXsrv_connection *xconn,
 787                                       const struct iovec *in_vector,
 788                                       struct iovec *out_vector)
 789 {
 790         const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
 791         uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
 792         uint16_t credit_charge = 1;
 793         uint16_t credits_requested;
 794         uint32_t out_flags;
 795         uint16_t cmd;
 796         NTSTATUS out_status;
 797         uint16_t credits_granted = 0;
 798         uint64_t credits_possible;
 799         uint16_t current_max_credits;
 800
 801         /*
 802          * first we grant only 1/16th of the max range.
 803          *
 804          * Windows also starts with the 1/16th and then grants
 805          * more later. I was only able to trigger higher
 806          * values, when using a very high credit charge.
 807          *
 808          * TODO: scale up depending on load, free memory
 809          *       or other stuff.
 810          *       Maybe also on the relationship between number
 811          *       of requests and the used sequence number.
 812          *       Which means we would grant more credits
 813          *       for client which use multi credit requests.
 814          */
 815         current_max_credits = xconn->smb2.credits.max / 16;
 816         current_max_credits = MAX(current_max_credits, 1);
 817
 818         if (xconn->smb2.credits.multicredit) {
 819                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
 820                 credit_charge = MAX(credit_charge, 1);
 821         }
 822
 823         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 824         credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
 825         credits_requested = MAX(credits_requested, 1);
 826         out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
 827         out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
 828
 829         SMB_ASSERT(xconn->smb2.credits.max >= xconn->smb2.credits.granted);
 830
 831         if (xconn->smb2.credits.max < credit_charge) {
 832                 smbd_server_connection_terminate(xconn,
 833                         "client error: credit charge > max credits\n");
 834                 return;
 835         }
 836
 837         if (out_flags & SMB2_HDR_FLAG_ASYNC) {
 838                 /*
 839                  * In case we already send an async interim
 840                  * response, we should not grant
 841                  * credits on the final response.
 842                  */
 843                 credits_granted = 0;
 844         } else {
 845                 uint16_t additional_possible =
 846                         xconn->smb2.credits.max - credit_charge;
 847                 uint16_t additional_max = 0;
 848                 uint16_t additional_credits = credits_requested - 1;
 849
 850                 switch (cmd) {
 851                 case SMB2_OP_NEGPROT:
 852                         break;
 853                 case SMB2_OP_SESSSETUP:
 854                         /*
 855                          * Windows 2012 RC1 starts to grant
 856                          * additional credits
 857                          * with a successful session setup
 858                          */
 859                         if (NT_STATUS_IS_OK(out_status)) {
 860                                 additional_max = 32;
 861                         }
 862                         break;
 863                 default:
 864                         /*
 865                          * We match windows and only grant additional credits
 866                          * in chunks of 32.
 867                          */
 868                         additional_max = 32;
 869                         break;
 870                 }
 871
 872                 additional_max = MIN(additional_max, additional_possible);
 873                 additional_credits = MIN(additional_credits, additional_max);
 874
 875                 credits_granted = credit_charge + additional_credits;
 876         }
 877
 878         /*
 879          * sequence numbers should not wrap
 880          *
 881          * 1. calculate the possible credits until
 882          *    the sequence numbers start to wrap on 64-bit.
 883          *
 884          * 2. UINT64_MAX is used for Break Notifications.
 885          *
 886          * 2. truncate the possible credits to the maximum
 887          *    credits we want to grant to the client in total.
 888          *
 889          * 3. remove the range we'll already granted to the client
 890          *    this makes sure the client consumes the lowest sequence
 891          *    number, before we can grant additional credits.
 892          */
 893         credits_possible = UINT64_MAX - xconn->smb2.credits.seq_low;
 894         if (credits_possible > 0) {
 895                 /* remove UINT64_MAX */
 896                 credits_possible -= 1;
 897         }
 898         credits_possible = MIN(credits_possible, current_max_credits);
 899         credits_possible -= xconn->smb2.credits.seq_range;
 900
 901         credits_granted = MIN(credits_granted, credits_possible);
 902
 903         SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
 904         xconn->smb2.credits.granted += credits_granted;
 905         xconn->smb2.credits.seq_range += credits_granted;
 906
 907         DEBUG(10,("smb2_set_operation_credit: requested %u, charge %u, "
 908                 "granted %u, current possible/max %u/%u, "
 909                 "total granted/max/low/range %u/%u/%llu/%u\n",
 910                 (unsigned int)credits_requested,
 911                 (unsigned int)credit_charge,
 912                 (unsigned int)credits_granted,
 913                 (unsigned int)credits_possible,
 914                 (unsigned int)current_max_credits,
 915                 (unsigned int)xconn->smb2.credits.granted,
 916                 (unsigned int)xconn->smb2.credits.max,
 917                 (unsigned long long)xconn->smb2.credits.seq_low,
 918                 (unsigned int)xconn->smb2.credits.seq_range));
 919 }
 920
 921 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
 922                                 struct smbd_smb2_request *outreq)
 923 {
 924         int count, idx;
 925         uint16_t total_credits = 0;
 926
 927         count = outreq->out.vector_count;
 928
 929         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 930                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(inreq,in,idx);
 931                 struct iovec *outhdr_v = SMBD_SMB2_IDX_HDR_IOV(outreq,out,idx);
 932                 uint8_t *outhdr = (uint8_t *)outhdr_v->iov_base;
 933
 934                 smb2_set_operation_credit(outreq->xconn, inhdr_v, outhdr_v);
 935
 936                 /* To match Windows, count up what we
 937                    just granted. */
 938                 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
 939                 /* Set to zero in all but the last reply. */
 940                 if (idx + SMBD_SMB2_NUM_IOV_PER_REQ < count) {
 941                         SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
 942                 } else {
 943                         SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
 944                 }
 945         }
 946 }
 947
 948 DATA_BLOB smbd_smb2_generate_outbody(struct smbd_smb2_request *req, size_t size)
 949 {
 950         if (req->current_idx <= 1) {
 951                 if (size <= sizeof(req->out._body)) {
 952                         return data_blob_const(req->out._body, size);
 953                 }
 954         }
 955
 956         return data_blob_talloc(req, NULL, size);
 957 }
 958
 959 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
 960 {
 961         struct smbXsrv_connection *xconn = req->xconn;
 962         TALLOC_CTX *mem_ctx;
 963         struct iovec *vector;
 964         int count;
 965         int idx;
 966         bool ok;
 967
 968         count = req->in.vector_count;
 969         if (count <= ARRAY_SIZE(req->out._vector)) {
 970                 mem_ctx = req;
 971                 vector = req->out._vector;
 972         } else {
 973                 vector = talloc_zero_array(req, struct iovec, count);
 974                 if (vector == NULL) {
 975                         return NT_STATUS_NO_MEMORY;
 976                 }
 977                 mem_ctx = vector;
 978         }
 979
 980         vector[0].iov_base      = req->out.nbt_hdr;
 981         vector[0].iov_len       = 4;
 982         SIVAL(req->out.nbt_hdr, 0, 0);
 983
 984         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 985                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
 986                 const uint8_t *inhdr = (const uint8_t *)inhdr_v->iov_base;
 987                 uint8_t *outhdr = NULL;
 988                 uint8_t *outbody = NULL;
 989                 uint32_t next_command_ofs = 0;
 990                 struct iovec *current = &vector[idx];
 991
 992                 if ((idx + SMBD_SMB2_NUM_IOV_PER_REQ) < count) {
 993                         /* we have a next command -
 994                          * setup for the error case. */
 995                         next_command_ofs = SMB2_HDR_BODY + 9;
 996                 }
 997
 998                 if (idx == 1) {
 999                         outhdr = req->out._hdr;
1000                 } else {
1001                         outhdr = talloc_zero_array(mem_ctx, uint8_t,
1002                                                    OUTVEC_ALLOC_SIZE);
1003                         if (outhdr == NULL) {
1004                                 return NT_STATUS_NO_MEMORY;
1005                         }
1006                 }
1007
1008                 outbody = outhdr + SMB2_HDR_BODY;
1009
1010                 /*
1011                  * SMBD_SMB2_TF_IOV_OFS might be used later
1012                  */
1013                 current[SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
1014                 current[SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
1015
1016                 current[SMBD_SMB2_HDR_IOV_OFS].iov_base  = (void *)outhdr;
1017                 current[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
1018
1019                 current[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)outbody;
1020                 current[SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
1021
1022                 current[SMBD_SMB2_DYN_IOV_OFS].iov_base  = NULL;
1023                 current[SMBD_SMB2_DYN_IOV_OFS].iov_len   = 0;
1024
1025                 /* setup the SMB2 header */
1026                 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID,     SMB2_MAGIC);
1027                 SSVAL(outhdr, SMB2_HDR_LENGTH,          SMB2_HDR_BODY);
1028                 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
1029                       SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
1030                 SIVAL(outhdr, SMB2_HDR_STATUS,
1031                       NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
1032                 SSVAL(outhdr, SMB2_HDR_OPCODE,
1033                       SVAL(inhdr, SMB2_HDR_OPCODE));
1034                 SIVAL(outhdr, SMB2_HDR_FLAGS,
1035                       IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
1036                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND,    next_command_ofs);
1037                 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
1038                       BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
1039                 SIVAL(outhdr, SMB2_HDR_PID,
1040                       IVAL(inhdr, SMB2_HDR_PID));
1041                 SIVAL(outhdr, SMB2_HDR_TID,
1042                       IVAL(inhdr, SMB2_HDR_TID));
1043                 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
1044                       BVAL(inhdr, SMB2_HDR_SESSION_ID));
1045                 memcpy(outhdr + SMB2_HDR_SIGNATURE,
1046                        inhdr + SMB2_HDR_SIGNATURE, 16);
1047
1048                 /* setup error body header */
1049                 SSVAL(outbody, 0x00, 0x08 + 1);
1050                 SSVAL(outbody, 0x02, 0);
1051                 SIVAL(outbody, 0x04, 0);
1052         }
1053
1054         req->out.vector = vector;
1055         req->out.vector_count = count;
1056
1057         /* setup the length of the NBT packet */
1058         ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
1059         if (!ok) {
1060                 return NT_STATUS_INVALID_PARAMETER_MIX;
1061         }
1062
1063         DLIST_ADD_END(xconn->smb2.requests, req);
1064
1065         return NT_STATUS_OK;
1066 }
1067
1068 void smbd_server_connection_terminate_ex(struct smbXsrv_connection *xconn,
1069                                          const char *reason,
1070                                          const char *location)
1071 {
1072         struct smbXsrv_client *client = xconn->client;
1073
1074         DEBUG(10,("smbd_server_connection_terminate_ex: conn[%s] reason[%s] at %s\n",
1075                   smbXsrv_connection_dbg(xconn), reason, location));
1076
1077         if (client->connections->next != NULL) {
1078                 /* TODO: cancel pending requests */
1079                 DLIST_REMOVE(client->connections, xconn);
1080                 TALLOC_FREE(xconn);
1081                 return;
1082         }
1083
1084         /*
1085          * The last connection was disconnected
1086          */
1087         exit_server_cleanly(reason);
1088 }
1089
1090 static bool dup_smb2_vec4(TALLOC_CTX *ctx,
1091                         struct iovec *outvec,
1092                         const struct iovec *srcvec)
1093 {
1094         const uint8_t *srctf;
1095         size_t srctf_len;
1096         const uint8_t *srchdr;
1097         size_t srchdr_len;
1098         const uint8_t *srcbody;
1099         size_t srcbody_len;
1100         const uint8_t *expected_srcbody;
1101         const uint8_t *srcdyn;
1102         size_t srcdyn_len;
1103         const uint8_t *expected_srcdyn;
1104         uint8_t *dsttf;
1105         uint8_t *dsthdr;
1106         uint8_t *dstbody;
1107         uint8_t *dstdyn;
1108
1109         srctf  = (const uint8_t *)srcvec[SMBD_SMB2_TF_IOV_OFS].iov_base;
1110         srctf_len = srcvec[SMBD_SMB2_TF_IOV_OFS].iov_len;
1111         srchdr  = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
1112         srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
1113         srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
1114         srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
1115         expected_srcbody = srchdr + SMB2_HDR_BODY;
1116         srcdyn  = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
1117         srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
1118         expected_srcdyn = srcbody + 8;
1119
1120         if ((srctf_len != SMB2_TF_HDR_SIZE) && (srctf_len != 0)) {
1121                 return false;
1122         }
1123
1124         if (srchdr_len != SMB2_HDR_BODY) {
1125                 return false;
1126         }
1127
1128         if (srctf_len == SMB2_TF_HDR_SIZE) {
1129                 dsttf = talloc_memdup(ctx, srctf, SMB2_TF_HDR_SIZE);
1130                 if (dsttf == NULL) {
1131                         return false;
1132                 }
1133         } else {
1134                 dsttf = NULL;
1135         }
1136         outvec[SMBD_SMB2_TF_IOV_OFS].iov_base = (void *)dsttf;
1137         outvec[SMBD_SMB2_TF_IOV_OFS].iov_len = srctf_len;
1138
1139         /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
1140          * be allocated with size OUTVEC_ALLOC_SIZE. */
1141
1142         dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
1143         if (dsthdr == NULL) {
1144                 return false;
1145         }
1146         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
1147         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1148
1149         /*
1150          * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
1151          * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
1152          * then duplicate this. Else use talloc_memdup().
1153          */
1154
1155         if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
1156                 dstbody = dsthdr + SMB2_HDR_BODY;
1157         } else {
1158                 dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
1159                 if (dstbody == NULL) {
1160                         return false;
1161                 }
1162         }
1163         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
1164         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
1165
1166         /*
1167          * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
1168          * pointing to
1169          * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
1170          * then duplicate this. Else use talloc_memdup().
1171          */
1172
1173         if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
1174                 dstdyn = dsthdr + SMB2_HDR_BODY + 8;
1175         } else if (srcdyn == NULL) {
1176                 dstdyn = NULL;
1177         } else {
1178                 dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
1179                 if (dstdyn == NULL) {
1180                         return false;
1181                 }
1182         }
1183         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
1184         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
1185
1186         return true;
1187 }
1188
1189 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
1190 {
1191         struct smbd_smb2_request *newreq = NULL;
1192         struct iovec *outvec = NULL;
1193         int count = req->out.vector_count;
1194         int i;
1195         bool ok;
1196
1197         newreq = smbd_smb2_request_allocate(req->xconn);
1198         if (!newreq) {
1199                 return NULL;
1200         }
1201
1202         newreq->sconn = req->sconn;
1203         newreq->xconn = req->xconn;
1204         newreq->session = req->session;
1205         newreq->do_encryption = req->do_encryption;
1206         newreq->do_signing = req->do_signing;
1207         newreq->current_idx = req->current_idx;
1208
1209         outvec = talloc_zero_array(newreq, struct iovec, count);
1210         if (!outvec) {
1211                 TALLOC_FREE(newreq);
1212                 return NULL;
1213         }
1214         newreq->out.vector = outvec;
1215         newreq->out.vector_count = count;
1216
1217         /* Setup the outvec's identically to req. */
1218         outvec[0].iov_base = newreq->out.nbt_hdr;
1219         outvec[0].iov_len = 4;
1220         memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
1221
1222         /* Setup the vectors identically to the ones in req. */
1223         for (i = 1; i < count; i += SMBD_SMB2_NUM_IOV_PER_REQ) {
1224                 if (!dup_smb2_vec4(outvec, &outvec[i], &req->out.vector[i])) {
1225                         break;
1226                 }
1227         }
1228
1229         if (i < count) {
1230                 /* Alloc failed. */
1231                 TALLOC_FREE(newreq);
1232                 return NULL;
1233         }
1234
1235         ok = smb2_setup_nbt_length(newreq->out.vector,
1236                                    newreq->out.vector_count);
1237         if (!ok) {
1238                 TALLOC_FREE(newreq);
1239                 return NULL;
1240         }
1241
1242         return newreq;
1243 }
1244
1245 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
1246 {
1247         struct smbXsrv_connection *xconn = req->xconn;
1248         int first_idx = 1;
1249         struct iovec *firsttf = NULL;
1250         struct iovec *outhdr_v = NULL;
1251         uint8_t *outhdr = NULL;
1252         struct smbd_smb2_request *nreq = NULL;
1253         NTSTATUS status;
1254         bool ok;
1255
1256         /* Create a new smb2 request we'll use
1257            for the interim return. */
1258         nreq = dup_smb2_req(req);
1259         if (!nreq) {
1260                 return NT_STATUS_NO_MEMORY;
1261         }
1262
1263         /* Lose the last X out vectors. They're the
1264            ones we'll be using for the async reply. */
1265         nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
1266
1267         ok = smb2_setup_nbt_length(nreq->out.vector,
1268                                    nreq->out.vector_count);
1269         if (!ok) {
1270                 return NT_STATUS_INVALID_PARAMETER_MIX;
1271         }
1272
1273         /* Step back to the previous reply. */
1274         nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
1275         firsttf = SMBD_SMB2_IDX_TF_IOV(nreq,out,first_idx);
1276         outhdr_v = SMBD_SMB2_OUT_HDR_IOV(nreq);
1277         outhdr = SMBD_SMB2_OUT_HDR_PTR(nreq);
1278         /* And end the chain. */
1279         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
1280
1281         /* Calculate outgoing credits */
1282         smb2_calculate_credits(req, nreq);
1283
1284         if (DEBUGLEVEL >= 10) {
1285                 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
1286                         (unsigned int)nreq->current_idx );
1287                 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
1288                         (unsigned int)nreq->out.vector_count );
1289                 print_req_vectors(nreq);
1290         }
1291
1292         /*
1293          * As we have changed the header (SMB2_HDR_NEXT_COMMAND),
1294          * we need to sign/encrypt here with the last/first key we remembered
1295          */
1296         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
1297                 status = smb2_signing_encrypt_pdu(req->first_key,
1298                                         xconn->smb2.server.cipher,
1299                                         firsttf,
1300                                         nreq->out.vector_count - first_idx);
1301                 if (!NT_STATUS_IS_OK(status)) {
1302                         return status;
1303                 }
1304         } else if (req->last_key.length > 0) {
1305                 status = smb2_signing_sign_pdu(req->last_key,
1306                                                xconn->protocol,
1307                                                outhdr_v,
1308                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1309                 if (!NT_STATUS_IS_OK(status)) {
1310                         return status;
1311                 }
1312         }
1313
1314         nreq->queue_entry.mem_ctx = nreq;
1315         nreq->queue_entry.vector = nreq->out.vector;
1316         nreq->queue_entry.count = nreq->out.vector_count;
1317         DLIST_ADD_END(xconn->smb2.send_queue, &nreq->queue_entry);
1318         xconn->smb2.send_queue_len++;
1319
1320         status = smbd_smb2_flush_send_queue(xconn);
1321         if (!NT_STATUS_IS_OK(status)) {
1322                 return status;
1323         }
1324
1325         return NT_STATUS_OK;
1326 }
1327
1328 struct smbd_smb2_request_pending_state {
1329         struct smbd_smb2_send_queue queue_entry;
1330         uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
1331         struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
1332 };
1333
1334 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1335                                             struct tevent_timer *te,
1336                                             struct timeval current_time,
1337                                             void *private_data);
1338
1339 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
1340                                          struct tevent_req *subreq,
1341                                          uint32_t defer_time)
1342 {
1343         NTSTATUS status;
1344         struct timeval defer_endtime;
1345         uint8_t *outhdr = NULL;
1346         uint32_t flags;
1347
1348         if (!tevent_req_is_in_progress(subreq)) {
1349                 /*
1350                  * This is a performance optimization,
1351                  * it avoids one tevent_loop iteration,
1352                  * which means we avoid one
1353                  * talloc_stackframe_pool/talloc_free pair.
1354                  */
1355                 tevent_req_notify_callback(subreq);
1356                 return NT_STATUS_OK;
1357         }
1358
1359         req->subreq = subreq;
1360         subreq = NULL;
1361
1362         if (req->async_te) {
1363                 /* We're already async. */
1364                 return NT_STATUS_OK;
1365         }
1366
1367         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1368         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1369         if (flags & SMB2_HDR_FLAG_ASYNC) {
1370                 /* We're already async. */
1371                 return NT_STATUS_OK;
1372         }
1373
1374         if (req->async_internal) {
1375                 /*
1376                  * An SMB2 request implementation wants to handle the request
1377                  * asynchronously "internally" while keeping synchronous
1378                  * behaviour for the SMB2 request. This means we don't send an
1379                  * interim response and we can allow processing of compound SMB2
1380                  * requests (cf the subsequent check) for all cases.
1381                  */
1382                 return NT_STATUS_OK;
1383         }
1384
1385         if (req->in.vector_count > req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
1386                 /*
1387                  * We're trying to go async in a compound request
1388                  * chain. This is only allowed for opens that cause an
1389                  * oplock break or for the last operation in the
1390                  * chain, otherwise it is not allowed. See
1391                  * [MS-SMB2].pdf note <206> on Section 3.3.5.2.7.
1392                  */
1393                 const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1394
1395                 if (SVAL(inhdr, SMB2_HDR_OPCODE) != SMB2_OP_CREATE) {
1396                         /*
1397                          * Cancel the outstanding request.
1398                          */
1399                         bool ok = tevent_req_cancel(req->subreq);
1400                         if (ok) {
1401                                 return NT_STATUS_OK;
1402                         }
1403                         TALLOC_FREE(req->subreq);
1404                         return smbd_smb2_request_error(req,
1405                                 NT_STATUS_INTERNAL_ERROR);
1406                 }
1407         }
1408
1409         if (DEBUGLEVEL >= 10) {
1410                 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
1411                         (unsigned int)req->current_idx );
1412                 print_req_vectors(req);
1413         }
1414
1415         if (req->current_idx > 1) {
1416                 /*
1417                  * We're going async in a compound
1418                  * chain after the first request has
1419                  * already been processed. Send an
1420                  * interim response containing the
1421                  * set of replies already generated.
1422                  */
1423                 int idx = req->current_idx;
1424
1425                 status = smb2_send_async_interim_response(req);
1426                 if (!NT_STATUS_IS_OK(status)) {
1427                         return status;
1428                 }
1429                 if (req->first_key.length > 0) {
1430                         data_blob_clear_free(&req->first_key);
1431                 }
1432
1433                 req->current_idx = 1;
1434
1435                 /*
1436                  * Re-arrange the in.vectors to remove what
1437                  * we just sent.
1438                  */
1439                 memmove(&req->in.vector[1],
1440                         &req->in.vector[idx],
1441                         sizeof(req->in.vector[0])*(req->in.vector_count - idx));
1442                 req->in.vector_count = 1 + (req->in.vector_count - idx);
1443
1444                 /* Re-arrange the out.vectors to match. */
1445                 memmove(&req->out.vector[1],
1446                         &req->out.vector[idx],
1447                         sizeof(req->out.vector[0])*(req->out.vector_count - idx));
1448                 req->out.vector_count = 1 + (req->out.vector_count - idx);
1449
1450                 if (req->in.vector_count == 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
1451                         /*
1452                          * We only have one remaining request as
1453                          * we've processed everything else.
1454                          * This is no longer a compound request.
1455                          */
1456                         req->compound_related = false;
1457                         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1458                         flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
1459                         SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
1460                 }
1461         }
1462         if (req->last_key.length > 0) {
1463                 data_blob_clear_free(&req->last_key);
1464         }
1465
1466         defer_endtime = timeval_current_ofs_usec(defer_time);
1467         req->async_te = tevent_add_timer(req->sconn->ev_ctx,
1468                                          req, defer_endtime,
1469                                          smbd_smb2_request_pending_timer,
1470                                          req);
1471         if (req->async_te == NULL) {
1472                 return NT_STATUS_NO_MEMORY;
1473         }
1474
1475         return NT_STATUS_OK;
1476 }
1477
1478 static DATA_BLOB smbd_smb2_signing_key(struct smbXsrv_session *session,
1479                                        struct smbXsrv_connection *xconn)
1480 {
1481         struct smbXsrv_channel_global0 *c = NULL;
1482         NTSTATUS status;
1483         DATA_BLOB key = data_blob_null;
1484
1485         status = smbXsrv_session_find_channel(session, xconn, &c);
1486         if (NT_STATUS_IS_OK(status)) {
1487                 key = c->signing_key;
1488         }
1489
1490         if (key.length == 0) {
1491                 key = session->global->signing_key;
1492         }
1493
1494         return key;
1495 }
1496
1497 static NTSTATUS smb2_get_new_nonce(struct smbXsrv_session *session,
1498                                    uint64_t *new_nonce_high,
1499                                    uint64_t *new_nonce_low)
1500 {
1501         uint64_t nonce_high;
1502         uint64_t nonce_low;
1503
1504         session->nonce_low += 1;
1505         if (session->nonce_low == 0) {
1506                 session->nonce_low += 1;
1507                 session->nonce_high += 1;
1508         }
1509
1510         /*
1511          * CCM and GCM algorithms must never have their
1512          * nonce wrap, or the security of the whole
1513          * communication and the keys is destroyed.
1514          * We must drop the connection once we have
1515          * transfered too much data.
1516          *
1517          * NOTE: We assume nonces greater than 8 bytes.
1518          */
1519         if (session->nonce_high >= session->nonce_high_max) {
1520                 return NT_STATUS_ENCRYPTION_FAILED;
1521         }
1522
1523         nonce_high = session->nonce_high_random;
1524         nonce_high += session->nonce_high;
1525         nonce_low = session->nonce_low;
1526
1527         *new_nonce_high = nonce_high;
1528         *new_nonce_low = nonce_low;
1529         return NT_STATUS_OK;
1530 }
1531
1532 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1533                                             struct tevent_timer *te,
1534                                             struct timeval current_time,
1535                                             void *private_data)
1536 {
1537         struct smbd_smb2_request *req =
1538                 talloc_get_type_abort(private_data,
1539                 struct smbd_smb2_request);
1540         struct smbXsrv_connection *xconn = req->xconn;
1541         struct smbd_smb2_request_pending_state *state = NULL;
1542         uint8_t *outhdr = NULL;
1543         const uint8_t *inhdr = NULL;
1544         uint8_t *tf = NULL;
1545         size_t tf_len = 0;
1546         uint8_t *hdr = NULL;
1547         uint8_t *body = NULL;
1548         uint8_t *dyn = NULL;
1549         uint32_t flags = 0;
1550         uint64_t session_id = 0;
1551         uint64_t message_id = 0;
1552         uint64_t nonce_high = 0;
1553         uint64_t nonce_low = 0;
1554         uint64_t async_id = 0;
1555         NTSTATUS status;
1556         bool ok;
1557
1558         TALLOC_FREE(req->async_te);
1559
1560         /* Ensure our final reply matches the interim one. */
1561         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1562         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1563         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1564         message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1565         session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
1566
1567         async_id = message_id; /* keep it simple for now... */
1568
1569         SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1570         SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
1571
1572         DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1573                 "going async\n",
1574                 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1575                 (unsigned long long)async_id ));
1576
1577         /*
1578          * What we send is identical to a smbd_smb2_request_error
1579          * packet with an error status of STATUS_PENDING. Make use
1580          * of this fact sometime when refactoring. JRA.
1581          */
1582
1583         state = talloc_zero(req->xconn, struct smbd_smb2_request_pending_state);
1584         if (state == NULL) {
1585                 smbd_server_connection_terminate(xconn,
1586                                                  nt_errstr(NT_STATUS_NO_MEMORY));
1587                 return;
1588         }
1589
1590         tf = state->buf + NBT_HDR_SIZE;
1591         tf_len = SMB2_TF_HDR_SIZE;
1592
1593         hdr = tf + SMB2_TF_HDR_SIZE;
1594         body = hdr + SMB2_HDR_BODY;
1595         dyn = body + 8;
1596
1597         if (req->do_encryption) {
1598                 status = smb2_get_new_nonce(req->session,
1599                                             &nonce_high,
1600                                             &nonce_low);
1601                 if (!NT_STATUS_IS_OK(status)) {
1602                         smbd_server_connection_terminate(xconn,
1603                                                          nt_errstr(status));
1604                         return;
1605                 }
1606         }
1607
1608         SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
1609         SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
1610         SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
1611         SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
1612
1613         SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1614         SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1615         SSVAL(hdr, SMB2_HDR_EPOCH, 0);
1616         SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
1617         SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
1618
1619         SIVAL(hdr, SMB2_HDR_FLAGS, flags);
1620         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
1621         SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
1622         SBVAL(hdr, SMB2_HDR_PID, async_id);
1623         SBVAL(hdr, SMB2_HDR_SESSION_ID,
1624                 BVAL(outhdr, SMB2_HDR_SESSION_ID));
1625         memcpy(hdr+SMB2_HDR_SIGNATURE,
1626                outhdr+SMB2_HDR_SIGNATURE, 16);
1627
1628         SSVAL(body, 0x00, 0x08 + 1);
1629
1630         SCVAL(body, 0x02, 0);
1631         SCVAL(body, 0x03, 0);
1632         SIVAL(body, 0x04, 0);
1633         /* Match W2K8R2... */
1634         SCVAL(dyn,  0x00, 0x21);
1635
1636         state->vector[0].iov_base = (void *)state->buf;
1637         state->vector[0].iov_len = NBT_HDR_SIZE;
1638
1639         if (req->do_encryption) {
1640                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
1641                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    = tf_len;
1642         } else {
1643                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
1644                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
1645         }
1646
1647         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
1648         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
1649
1650         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
1651         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
1652
1653         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
1654         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len   = 1;
1655
1656         ok = smb2_setup_nbt_length(state->vector,
1657                                    1 + SMBD_SMB2_NUM_IOV_PER_REQ);
1658         if (!ok) {
1659                 smbd_server_connection_terminate(
1660                         xconn, nt_errstr(NT_STATUS_INTERNAL_ERROR));
1661                 return;
1662         }
1663
1664         /* Ensure we correctly go through crediting. Grant
1665            the credits now, and zero credits on the final
1666            response. */
1667         smb2_set_operation_credit(req->xconn,
1668                         SMBD_SMB2_IN_HDR_IOV(req),
1669                         &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
1670
1671         SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1672
1673         if (DEBUGLVL(10)) {
1674                 int i;
1675
1676                 for (i = 0; i < ARRAY_SIZE(state->vector); i++) {
1677                         dbgtext("\tstate->vector[%u/%u].iov_len = %u\n",
1678                                 (unsigned int)i,
1679                                 (unsigned int)ARRAY_SIZE(state->vector),
1680                                 (unsigned int)state->vector[i].iov_len);
1681                 }
1682         }
1683
1684         if (req->do_encryption) {
1685                 struct smbXsrv_session *x = req->session;
1686                 DATA_BLOB encryption_key = x->global->encryption_key;
1687
1688                 status = smb2_signing_encrypt_pdu(encryption_key,
1689                                         xconn->smb2.server.cipher,
1690                                         &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
1691                                         SMBD_SMB2_NUM_IOV_PER_REQ);
1692                 if (!NT_STATUS_IS_OK(status)) {
1693                         smbd_server_connection_terminate(xconn,
1694                                                 nt_errstr(status));
1695                         return;
1696                 }
1697         } else if (req->do_signing) {
1698                 struct smbXsrv_session *x = req->session;
1699                 DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
1700
1701                 status = smb2_signing_sign_pdu(signing_key,
1702                                         xconn->protocol,
1703                                         &state->vector[1+SMBD_SMB2_HDR_IOV_OFS],
1704                                         SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1705                 if (!NT_STATUS_IS_OK(status)) {
1706                         smbd_server_connection_terminate(xconn,
1707                                                 nt_errstr(status));
1708                         return;
1709                 }
1710         }
1711
1712         state->queue_entry.mem_ctx = state;
1713         state->queue_entry.vector = state->vector;
1714         state->queue_entry.count = ARRAY_SIZE(state->vector);
1715         DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
1716         xconn->smb2.send_queue_len++;
1717
1718         status = smbd_smb2_flush_send_queue(xconn);
1719         if (!NT_STATUS_IS_OK(status)) {
1720                 smbd_server_connection_terminate(xconn,
1721                                                  nt_errstr(status));
1722                 return;
1723         }
1724 }
1725
1726 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
1727 {
1728         struct smbXsrv_connection *xconn = req->xconn;
1729         struct smbd_smb2_request *cur;
1730         const uint8_t *inhdr;
1731         uint32_t flags;
1732         uint64_t search_message_id;
1733         uint64_t search_async_id;
1734         uint64_t found_id;
1735
1736         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1737
1738         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1739         search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1740         search_async_id = BVAL(inhdr, SMB2_HDR_PID);
1741
1742         /*
1743          * We don't need the request anymore cancel requests never
1744          * have a response.
1745          *
1746          * We defer the TALLOC_FREE(req) to the caller.
1747          */
1748         DLIST_REMOVE(xconn->smb2.requests, req);
1749
1750         for (cur = xconn->smb2.requests; cur; cur = cur->next) {
1751                 const uint8_t *outhdr;
1752                 uint64_t message_id;
1753                 uint64_t async_id;
1754
1755                 if (cur->compound_related) {
1756                         /*
1757                          * Never cancel anything in a compound request.
1758                          * Way too hard to deal with the result.
1759                          */
1760                         continue;
1761                 }
1762
1763                 outhdr = SMBD_SMB2_OUT_HDR_PTR(cur);
1764
1765                 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1766                 async_id = BVAL(outhdr, SMB2_HDR_PID);
1767
1768                 if (flags & SMB2_HDR_FLAG_ASYNC) {
1769                         if (search_async_id == async_id) {
1770                                 found_id = async_id;
1771                                 break;
1772                         }
1773                 } else {
1774                         if (search_message_id == message_id) {
1775                                 found_id = message_id;
1776                                 break;
1777                         }
1778                 }
1779         }
1780
1781         if (cur && cur->subreq) {
1782                 inhdr = SMBD_SMB2_IN_HDR_PTR(cur);
1783                 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1784                         "cancel opcode[%s] mid %llu\n",
1785                         smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1786                         (unsigned long long)found_id ));
1787                 tevent_req_cancel(cur->subreq);
1788         }
1789
1790         return NT_STATUS_OK;
1791 }
1792
1793 /*************************************************************
1794  Ensure an incoming tid is a valid one for us to access.
1795  Change to the associated uid credentials and chdir to the
1796  valid tid directory.
1797 *************************************************************/
1798
1799 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
1800 {
1801         const uint8_t *inhdr;
1802         uint32_t in_flags;
1803         uint32_t in_tid;
1804         struct smbXsrv_tcon *tcon;
1805         NTSTATUS status;
1806         NTTIME now = timeval_to_nttime(&req->request_time);
1807
1808         req->tcon = NULL;
1809
1810         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1811
1812         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1813         in_tid = IVAL(inhdr, SMB2_HDR_TID);
1814
1815         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1816                 in_tid = req->last_tid;
1817         }
1818
1819         req->last_tid = 0;
1820
1821         status = smb2srv_tcon_lookup(req->session,
1822                                      in_tid, now, &tcon);
1823         if (!NT_STATUS_IS_OK(status)) {
1824                 return status;
1825         }
1826
1827         if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
1828                 return NT_STATUS_ACCESS_DENIED;
1829         }
1830
1831         if (!set_current_service(tcon->compat, 0, true)) {
1832                 return NT_STATUS_ACCESS_DENIED;
1833         }
1834
1835         req->tcon = tcon;
1836         req->last_tid = in_tid;
1837
1838         return NT_STATUS_OK;
1839 }
1840
1841 /*************************************************************
1842  Ensure an incoming session_id is a valid one for us to access.
1843 *************************************************************/
1844
1845 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
1846 {
1847         const uint8_t *inhdr;
1848         uint32_t in_flags;
1849         uint16_t in_opcode;
1850         uint64_t in_session_id;
1851         struct smbXsrv_session *session = NULL;
1852         struct auth_session_info *session_info;
1853         NTSTATUS status;
1854         NTTIME now = timeval_to_nttime(&req->request_time);
1855
1856         req->session = NULL;
1857         req->tcon = NULL;
1858
1859         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1860
1861         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1862         in_opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1863         in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
1864
1865         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1866                 in_session_id = req->last_session_id;
1867         }
1868
1869         req->last_session_id = 0;
1870
1871         /* look an existing session up */
1872         switch (in_opcode) {
1873         case SMB2_OP_SESSSETUP:
1874                 /*
1875                  * For a session bind request, we don't have the
1876                  * channel set up at this point yet, so we defer
1877                  * the verification that the connection belongs
1878                  * to the session to the session setup code, which
1879                  * can look at the session binding flags.
1880                  */
1881                 status = smb2srv_session_lookup_client(req->xconn->client,
1882                                                        in_session_id, now,
1883                                                        &session);
1884                 break;
1885         default:
1886                 status = smb2srv_session_lookup_conn(req->xconn,
1887                                                      in_session_id, now,
1888                                                      &session);
1889                 break;
1890         }
1891         if (session) {
1892                 req->session = session;
1893                 req->last_session_id = in_session_id;
1894         }
1895         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1896                 switch (in_opcode) {
1897                 case SMB2_OP_SESSSETUP:
1898                         status = NT_STATUS_OK;
1899                         break;
1900                 default:
1901                         break;
1902                 }
1903         }
1904         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1905                 switch (in_opcode) {
1906                 case SMB2_OP_TCON:
1907                 case SMB2_OP_CREATE:
1908                 case SMB2_OP_GETINFO:
1909                 case SMB2_OP_SETINFO:
1910                         return NT_STATUS_INVALID_HANDLE;
1911                 default:
1912                         /*
1913                          * Notice the check for
1914                          * (session_info == NULL)
1915                          * below.
1916                          */
1917                         status = NT_STATUS_OK;
1918                         break;
1919                 }
1920         }
1921         if (!NT_STATUS_IS_OK(status)) {
1922                 return status;
1923         }
1924
1925         session_info = session->global->auth_session_info;
1926         if (session_info == NULL) {
1927                 return NT_STATUS_INVALID_HANDLE;
1928         }
1929
1930         if (in_session_id != req->xconn->client->last_session_id) {
1931                 req->xconn->client->last_session_id = in_session_id;
1932                 set_current_user_info(session_info->unix_info->sanitized_username,
1933                                       session_info->unix_info->unix_name,
1934                                       session_info->info->domain_name);
1935         }
1936
1937         return NT_STATUS_OK;
1938 }
1939
1940 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
1941                                                 uint32_t data_length)
1942 {
1943         struct smbXsrv_connection *xconn = req->xconn;
1944         uint16_t needed_charge;
1945         uint16_t credit_charge = 1;
1946         const uint8_t *inhdr;
1947
1948         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1949
1950         if (xconn->smb2.credits.multicredit) {
1951                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
1952                 credit_charge = MAX(credit_charge, 1);
1953         }
1954
1955         needed_charge = (data_length - 1)/ 65536 + 1;
1956
1957         DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
1958                    (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
1959                    credit_charge, needed_charge));
1960
1961         if (needed_charge > credit_charge) {
1962                 DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
1963                           credit_charge, needed_charge));
1964                 return NT_STATUS_INVALID_PARAMETER;
1965         }
1966
1967         return NT_STATUS_OK;
1968 }
1969
1970 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
1971                                         size_t expected_body_size)
1972 {
1973         struct iovec *inhdr_v;
1974         const uint8_t *inhdr;
1975         uint16_t opcode;
1976         const uint8_t *inbody;
1977         size_t body_size;
1978         size_t min_dyn_size = expected_body_size & 0x00000001;
1979         int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
1980
1981         /*
1982          * The following should be checked already.
1983          */
1984         if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
1985                 return NT_STATUS_INTERNAL_ERROR;
1986         }
1987         if (req->current_idx > max_idx) {
1988                 return NT_STATUS_INTERNAL_ERROR;
1989         }
1990
1991         inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
1992         if (inhdr_v->iov_len != SMB2_HDR_BODY) {
1993                 return NT_STATUS_INTERNAL_ERROR;
1994         }
1995         if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
1996                 return NT_STATUS_INTERNAL_ERROR;
1997         }
1998
1999         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2000         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2001
2002         switch (opcode) {
2003         case SMB2_OP_IOCTL:
2004         case SMB2_OP_GETINFO:
2005                 min_dyn_size = 0;
2006                 break;
2007         case SMB2_OP_WRITE:
2008                 if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) {
2009                         if (req->smb1req->unread_bytes < min_dyn_size) {
2010                                 return NT_STATUS_INVALID_PARAMETER;
2011                         }
2012
2013                         min_dyn_size = 0;
2014                 }
2015                 break;
2016         }
2017
2018         /*
2019          * Now check the expected body size,
2020          * where the last byte might be in the
2021          * dynamic section..
2022          */
2023         if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
2024                 return NT_STATUS_INVALID_PARAMETER;
2025         }
2026         if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
2027                 return NT_STATUS_INVALID_PARAMETER;
2028         }
2029
2030         inbody = SMBD_SMB2_IN_BODY_PTR(req);
2031
2032         body_size = SVAL(inbody, 0x00);
2033         if (body_size != expected_body_size) {
2034                 return NT_STATUS_INVALID_PARAMETER;
2035         }
2036
2037         return NT_STATUS_OK;
2038 }
2039
2040 bool smbXsrv_is_encrypted(uint8_t encryption_flags)
2041 {
2042         return (!(encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET)
2043                 &&
2044                 (encryption_flags & (SMBXSRV_PROCESSED_ENCRYPTED_PACKET |
2045                                      SMBXSRV_ENCRYPTION_DESIRED |
2046                                      SMBXSRV_ENCRYPTION_REQUIRED)));
2047 }
2048
2049 bool smbXsrv_is_partially_encrypted(uint8_t encryption_flags)
2050 {
2051         return ((encryption_flags & SMBXSRV_PROCESSED_ENCRYPTED_PACKET) &&
2052                 (encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET));
2053 }
2054
2055 /* Set a flag if not already set, return true if set */
2056 bool smbXsrv_set_crypto_flag(uint8_t *flags, uint8_t flag)
2057 {
2058         if ((flag == 0) || (*flags & flag)) {
2059                 return false;
2060         }
2061
2062         *flags |= flag;
2063         return true;
2064 }
2065
2066 /*
2067  * Update encryption state tracking flags, this can be used to
2068  * determine whether whether the session or tcon is "encrypted".
2069  */
2070 static void smb2srv_update_crypto_flags(struct smbd_smb2_request *req,
2071                                         uint16_t opcode,
2072                                         bool *update_session_globalp,
2073                                         bool *update_tcon_globalp)
2074 {
2075         /* Default: assume unecrypted and unsigned */
2076         struct smbXsrv_session *session = req->session;
2077         struct smbXsrv_tcon *tcon = req->tcon;
2078         uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
2079         uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
2080         bool update_session = false;
2081         bool update_tcon = false;
2082
2083         if (req->was_encrypted && req->do_encryption) {
2084                 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
2085                 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
2086         } else {
2087                 /* Unencrypted packet, can be signed */
2088                 if (req->do_signing) {
2089                         sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
2090                 } else if (opcode == SMB2_OP_CANCEL) {
2091                         /* Cancel requests are allowed to skip signing */
2092                         sign_flag &= ~SMBXSRV_PROCESSED_UNSIGNED_PACKET;
2093                 }
2094         }
2095
2096         update_session |= smbXsrv_set_crypto_flag(
2097                 &session->global->encryption_flags, encrypt_flag);
2098         update_session |= smbXsrv_set_crypto_flag(
2099                 &session->global->signing_flags, sign_flag);
2100
2101         if (tcon) {
2102                 update_tcon |= smbXsrv_set_crypto_flag(
2103                         &tcon->global->encryption_flags, encrypt_flag);
2104                 update_tcon |= smbXsrv_set_crypto_flag(
2105                         &tcon->global->signing_flags, sign_flag);
2106         }
2107
2108         *update_session_globalp = update_session;
2109         *update_tcon_globalp = update_tcon;
2110         return;
2111 }
2112
2113 bool smbXsrv_is_signed(uint8_t signing_flags)
2114 {
2115         /*
2116          * Signing is always enabled, so unless we got an unsigned
2117          * packet and at least one signed packet that was not
2118          * encrypted, the session or tcon is "signed".
2119          */
2120         return (!(signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
2121                 (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
2122 }
2123
2124 bool smbXsrv_is_partially_signed(uint8_t signing_flags)
2125 {
2126         return ((signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
2127                 (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
2128 }
2129
2130 static NTSTATUS smbd_smb2_request_dispatch_update_counts(
2131                                 struct smbd_smb2_request *req,
2132                                 bool modify_call)
2133 {
2134         struct smbXsrv_connection *xconn = req->xconn;
2135         const uint8_t *inhdr;
2136         uint16_t channel_sequence;
2137         uint32_t flags;
2138         int cmp;
2139         struct smbXsrv_open *op;
2140         bool update_open = false;
2141         NTSTATUS status = NT_STATUS_OK;
2142
2143         req->request_counters_updated = false;
2144
2145         if (xconn->protocol < PROTOCOL_SMB2_22) {
2146                 return NT_STATUS_OK;
2147         }
2148
2149         if (req->compat_chain_fsp == NULL) {
2150                 return NT_STATUS_OK;
2151         }
2152
2153         op = req->compat_chain_fsp->op;
2154         if (op == NULL) {
2155                 return NT_STATUS_OK;
2156         }
2157
2158         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2159         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2160         channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
2161
2162         cmp = channel_sequence - op->global->channel_sequence;
2163
2164         if (abs(cmp) > INT16_MAX) {
2165                 /*
2166                  * [MS-SMB2] 3.3.5.2.10 - Verifying the Channel Sequence Number:
2167                  *
2168                  * If the channel sequence number of the request and the one
2169                  * known to the server are not equal, the channel sequence
2170                  * number and outstanding request counts are only updated
2171                  * "... if the unsigned difference using 16-bit arithmetic
2172                  * between ChannelSequence and Open.ChannelSequence is less than
2173                  * or equal to 0x7FFF ...".
2174                  * Otherwise, an error is returned for the modifying
2175                  * calls write, set_info, and ioctl.
2176                  *
2177                  * There are currently two issues with the description:
2178                  *
2179                  * * For the other calls, the document seems to imply
2180                  *   that processing continues without adapting the
2181                  *   counters (if the sequence numbers are not equal).
2182                  *
2183                  *   TODO: This needs clarification!
2184                  *
2185                  * * Also, the behaviour if the difference is larger
2186                  *   than 0x7FFF is not clear. The document seems to
2187                  *   imply that if such a difference is reached,
2188                  *   the server starts to ignore the counters or
2189                  *   in the case of the modifying calls, return errors.
2190                  *
2191                  *   TODO: This needs clarification!
2192                  *
2193                  * At this point Samba tries to be a little more
2194                  * clever than the description in the MS-SMB2 document
2195                  * by heuristically detecting and properly treating
2196                  * a 16 bit overflow of the client-submitted sequence
2197                  * number:
2198                  *
2199                  * If the stored channel squence number is more than
2200                  * 0x7FFF larger than the one from the request, then
2201                  * the client-provided sequence number has likely
2202                  * overflown. We treat this case as valid instead
2203                  * of as failure.
2204                  *
2205                  * The MS-SMB2 behaviour would be setting cmp = -1.
2206                  */
2207                 cmp *= -1;
2208         }
2209
2210         if (!(flags & SMB2_HDR_FLAG_REPLAY_OPERATION)) {
2211                 if (cmp == 0) {
2212                         op->request_count += 1;
2213                         req->request_counters_updated = true;
2214                 } else if (cmp > 0) {
2215                         op->pre_request_count += op->request_count;
2216                         op->request_count = 1;
2217                         op->global->channel_sequence = channel_sequence;
2218                         update_open = true;
2219                         req->request_counters_updated = true;
2220                 } else if (modify_call) {
2221                         return NT_STATUS_FILE_NOT_AVAILABLE;
2222                 }
2223         } else {
2224                 if (cmp == 0 && op->pre_request_count == 0) {
2225                         op->request_count += 1;
2226                         req->request_counters_updated = true;
2227                 } else if (cmp > 0 && op->pre_request_count == 0) {
2228                         op->pre_request_count += op->request_count;
2229                         op->request_count = 1;
2230                         op->global->channel_sequence = channel_sequence;
2231                         update_open = true;
2232                         req->request_counters_updated = true;
2233                 } else if (modify_call) {
2234                         return NT_STATUS_FILE_NOT_AVAILABLE;
2235                 }
2236         }
2237
2238         if (update_open) {
2239                 status = smbXsrv_open_update(op);
2240         }
2241
2242         return status;
2243 }
2244
2245 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
2246 {
2247         struct smbXsrv_connection *xconn = req->xconn;
2248         const struct smbd_smb2_dispatch_table *call = NULL;
2249         const struct iovec *intf_v = SMBD_SMB2_IN_TF_IOV(req);
2250         const uint8_t *inhdr;
2251         uint16_t opcode;
2252         uint32_t flags;
2253         uint64_t mid;
2254         NTSTATUS status;
2255         NTSTATUS session_status;
2256         uint32_t allowed_flags;
2257         NTSTATUS return_value;
2258         struct smbXsrv_session *x = NULL;
2259         bool signing_required = false;
2260         bool encryption_desired = false;
2261         bool encryption_required = false;
2262
2263         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2264
2265         DO_PROFILE_INC(request);
2266
2267         /* TODO: verify more things */
2268
2269         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2270         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2271         mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
2272         DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
2273                 smb2_opcode_name(opcode),
2274                 (unsigned long long)mid));
2275
2276         if (xconn->protocol >= PROTOCOL_SMB2_02) {
2277                 /*
2278                  * once the protocol is negotiated
2279                  * SMB2_OP_NEGPROT is not allowed anymore
2280                  */
2281                 if (opcode == SMB2_OP_NEGPROT) {
2282                         /* drop the connection */
2283                         return NT_STATUS_INVALID_PARAMETER;
2284                 }
2285         } else {
2286                 /*
2287                  * if the protocol is not negotiated yet
2288                  * only SMB2_OP_NEGPROT is allowed.
2289                  */
2290                 if (opcode != SMB2_OP_NEGPROT) {
2291                         /* drop the connection */
2292                         return NT_STATUS_INVALID_PARAMETER;
2293                 }
2294         }
2295
2296         /*
2297          * Check if the client provided a valid session id,
2298          * if so smbd_smb2_request_check_session() calls
2299          * set_current_user_info().
2300          *
2301          * As some command don't require a valid session id
2302          * we defer the check of the session_status
2303          */
2304         session_status = smbd_smb2_request_check_session(req);
2305         x = req->session;
2306         if (x != NULL) {
2307                 signing_required = x->global->signing_flags & SMBXSRV_SIGNING_REQUIRED;
2308                 encryption_desired = x->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED;
2309                 encryption_required = x->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED;
2310         }
2311
2312         req->async_internal = false;
2313         req->do_signing = false;
2314         req->do_encryption = false;
2315         req->was_encrypted = false;
2316         if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
2317                 const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
2318                 uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
2319
2320                 if (x != NULL && x->global->session_wire_id != tf_session_id) {
2321                         DEBUG(0,("smbd_smb2_request_dispatch: invalid session_id"
2322                                  "in SMB2_HDR[%llu], SMB2_TF[%llu]\n",
2323                                  (unsigned long long)x->global->session_wire_id,
2324                                  (unsigned long long)tf_session_id));
2325                         /*
2326                          * TODO: windows allows this...
2327                          * should we drop the connection?
2328                          *
2329                          * For now we just return ACCESS_DENIED
2330                          * (Windows clients never trigger this)
2331                          * and wait for an update of [MS-SMB2].
2332                          */
2333                         return smbd_smb2_request_error(req,
2334                                         NT_STATUS_ACCESS_DENIED);
2335                 }
2336
2337                 req->was_encrypted = true;
2338         }
2339
2340         if (encryption_required && !req->was_encrypted) {
2341                 return smbd_smb2_request_error(req,
2342                                 NT_STATUS_ACCESS_DENIED);
2343         }
2344
2345         call = smbd_smb2_call(opcode);
2346         if (call == NULL) {
2347                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2348         }
2349
2350         allowed_flags = SMB2_HDR_FLAG_CHAINED |
2351                         SMB2_HDR_FLAG_SIGNED |
2352                         SMB2_HDR_FLAG_DFS;
2353         if (xconn->protocol >= PROTOCOL_SMB3_11) {
2354                 allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
2355         }
2356         if (opcode == SMB2_OP_NEGPROT) {
2357                 if (lp_server_max_protocol() >= PROTOCOL_SMB3_11) {
2358                         allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
2359                 }
2360         }
2361         if (opcode == SMB2_OP_CANCEL) {
2362                 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
2363         }
2364         if (xconn->protocol >= PROTOCOL_SMB2_22) {
2365                 allowed_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
2366         }
2367         if ((flags & ~allowed_flags) != 0) {
2368                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2369         }
2370
2371         if (flags & SMB2_HDR_FLAG_CHAINED) {
2372                 /*
2373                  * This check is mostly for giving the correct error code
2374                  * for compounded requests.
2375                  */
2376                 if (!NT_STATUS_IS_OK(session_status)) {
2377                         return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2378                 }
2379         } else {
2380                 req->compat_chain_fsp = NULL;
2381         }
2382
2383         if (req->was_encrypted) {
2384                 signing_required = false;
2385         } else if (signing_required || (flags & SMB2_HDR_FLAG_SIGNED)) {
2386                 DATA_BLOB signing_key = data_blob_null;
2387
2388                 if (x == NULL) {
2389                         /*
2390                          * MS-SMB2: 3.3.5.2.4 Verifying the Signature.
2391                          * If the SMB2 header of the SMB2 NEGOTIATE
2392                          * request has the SMB2_FLAGS_SIGNED bit set in the
2393                          * Flags field, the server MUST fail the request
2394                          * with STATUS_INVALID_PARAMETER.
2395                          *
2396                          * Microsoft test tool checks this.
2397                          */
2398
2399                         if ((opcode == SMB2_OP_NEGPROT) &&
2400                                         (flags & SMB2_HDR_FLAG_SIGNED)) {
2401                                 status = NT_STATUS_INVALID_PARAMETER;
2402                         } else {
2403                                 status = NT_STATUS_USER_SESSION_DELETED;
2404                         }
2405                         return smbd_smb2_request_error(req, status);
2406                 }
2407
2408                 signing_key = smbd_smb2_signing_key(x, xconn);
2409
2410                 /*
2411                  * If we have a signing key, we should
2412                  * sign the response
2413                  */
2414                 if (signing_key.length > 0) {
2415                         req->do_signing = true;
2416                 }
2417
2418                 status = smb2_signing_check_pdu(signing_key,
2419                                                 xconn->protocol,
2420                                                 SMBD_SMB2_IN_HDR_IOV(req),
2421                                                 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2422                 if (!NT_STATUS_IS_OK(status)) {
2423                         return smbd_smb2_request_error(req, status);
2424                 }
2425
2426                 /*
2427                  * Now that we know the request was correctly signed
2428                  * we have to sign the response too.
2429                  */
2430                 req->do_signing = true;
2431
2432                 if (!NT_STATUS_IS_OK(session_status)) {
2433                         return smbd_smb2_request_error(req, session_status);
2434                 }
2435         } else if (opcode == SMB2_OP_CANCEL) {
2436                 /* Cancel requests are allowed to skip the signing */
2437         } else if (signing_required) {
2438                 /*
2439                  * If signing is required we try to sign
2440                  * a possible error response
2441                  */
2442                 req->do_signing = true;
2443                 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
2444         }
2445
2446         if (flags & SMB2_HDR_FLAG_CHAINED) {
2447                 req->compound_related = true;
2448         }
2449
2450         if (call->need_session) {
2451                 if (!NT_STATUS_IS_OK(session_status)) {
2452                         return smbd_smb2_request_error(req, session_status);
2453                 }
2454         }
2455
2456         if (call->need_tcon) {
2457                 SMB_ASSERT(call->need_session);
2458
2459                 /*
2460                  * This call needs to be run as user.
2461                  *
2462                  * smbd_smb2_request_check_tcon()
2463                  * calls change_to_user() on success.
2464                  */
2465                 status = smbd_smb2_request_check_tcon(req);
2466                 if (!NT_STATUS_IS_OK(status)) {
2467                         return smbd_smb2_request_error(req, status);
2468                 }
2469                 if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) {
2470                         encryption_desired = true;
2471                 }
2472                 if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED) {
2473                         encryption_required = true;
2474                 }
2475                 if (encryption_required && !req->was_encrypted) {
2476                         return smbd_smb2_request_error(req,
2477                                 NT_STATUS_ACCESS_DENIED);
2478                 }
2479         }
2480
2481         if (req->was_encrypted || encryption_desired) {
2482                 req->do_encryption = true;
2483         }
2484
2485         if (req->session) {
2486                 bool update_session_global = false;
2487                 bool update_tcon_global = false;
2488
2489                 smb2srv_update_crypto_flags(req, opcode,
2490                                             &update_session_global,
2491                                             &update_tcon_global);
2492
2493                 if (update_session_global) {
2494                         status = smbXsrv_session_update(x);
2495                         if (!NT_STATUS_IS_OK(status)) {
2496                                 return smbd_smb2_request_error(req, status);
2497                         }
2498                 }
2499                 if (update_tcon_global) {
2500                         status = smbXsrv_tcon_update(req->tcon);
2501                         if (!NT_STATUS_IS_OK(status)) {
2502                                 return smbd_smb2_request_error(req, status);
2503                         }
2504                 }
2505         }
2506
2507         if (call->fileid_ofs != 0) {
2508                 size_t needed = call->fileid_ofs + 16;
2509                 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
2510                 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
2511                 uint64_t file_id_persistent;
2512                 uint64_t file_id_volatile;
2513                 struct files_struct *fsp;
2514
2515                 SMB_ASSERT(call->need_tcon);
2516
2517                 if (needed > body_size) {
2518                         return smbd_smb2_request_error(req,
2519                                         NT_STATUS_INVALID_PARAMETER);
2520                 }
2521
2522                 file_id_persistent      = BVAL(body, call->fileid_ofs + 0);
2523                 file_id_volatile        = BVAL(body, call->fileid_ofs + 8);
2524
2525                 fsp = file_fsp_smb2(req, file_id_persistent, file_id_volatile);
2526                 if (fsp == NULL) {
2527                         if (!call->allow_invalid_fileid) {
2528                                 return smbd_smb2_request_error(req,
2529                                                 NT_STATUS_FILE_CLOSED);
2530                         }
2531
2532                         if (file_id_persistent != UINT64_MAX) {
2533                                 return smbd_smb2_request_error(req,
2534                                                 NT_STATUS_FILE_CLOSED);
2535                         }
2536                         if (file_id_volatile != UINT64_MAX) {
2537                                 return smbd_smb2_request_error(req,
2538                                                 NT_STATUS_FILE_CLOSED);
2539                         }
2540                 }
2541         }
2542
2543         status = smbd_smb2_request_dispatch_update_counts(req, call->modify);
2544         if (!NT_STATUS_IS_OK(status)) {
2545                 return smbd_smb2_request_error(req, status);
2546         }
2547
2548         if (call->as_root) {
2549                 SMB_ASSERT(call->fileid_ofs == 0);
2550                 /* This call needs to be run as root */
2551                 change_to_root_user();
2552         } else {
2553                 SMB_ASSERT(call->need_tcon);
2554         }
2555
2556 #define _INBYTES(_r) \
2557         iov_buflen(SMBD_SMB2_IN_HDR_IOV(_r), SMBD_SMB2_NUM_IOV_PER_REQ-1)
2558
2559         switch (opcode) {
2560         case SMB2_OP_NEGPROT:
2561                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_negprot, profile_p,
2562                                                req->profile, _INBYTES(req));
2563                 return_value = smbd_smb2_request_process_negprot(req);
2564                 break;
2565
2566         case SMB2_OP_SESSSETUP:
2567                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_sesssetup, profile_p,
2568                                                req->profile, _INBYTES(req));
2569                 return_value = smbd_smb2_request_process_sesssetup(req);
2570                 break;
2571
2572         case SMB2_OP_LOGOFF:
2573                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_logoff, profile_p,
2574                                                req->profile, _INBYTES(req));
2575                 return_value = smbd_smb2_request_process_logoff(req);
2576                 break;
2577
2578         case SMB2_OP_TCON:
2579                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tcon, profile_p,
2580                                                req->profile, _INBYTES(req));
2581                 return_value = smbd_smb2_request_process_tcon(req);
2582                 break;
2583
2584         case SMB2_OP_TDIS:
2585                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tdis, profile_p,
2586                                                req->profile, _INBYTES(req));
2587                 return_value = smbd_smb2_request_process_tdis(req);
2588                 break;
2589
2590         case SMB2_OP_CREATE:
2591                 if (req->subreq == NULL) {
2592                         SMBPROFILE_IOBYTES_ASYNC_START(smb2_create, profile_p,
2593                                                        req->profile, _INBYTES(req));
2594                 } else {
2595                         SMBPROFILE_IOBYTES_ASYNC_SET_BUSY(req->profile);
2596                 }
2597                 return_value = smbd_smb2_request_process_create(req);
2598                 break;
2599
2600         case SMB2_OP_CLOSE:
2601                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_close, profile_p,
2602                                                req->profile, _INBYTES(req));
2603                 return_value = smbd_smb2_request_process_close(req);
2604                 break;
2605
2606         case SMB2_OP_FLUSH:
2607                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_flush, profile_p,
2608                                                req->profile, _INBYTES(req));
2609                 return_value = smbd_smb2_request_process_flush(req);
2610                 break;
2611
2612         case SMB2_OP_READ:
2613                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_read, profile_p,
2614                                                req->profile, _INBYTES(req));
2615                 return_value = smbd_smb2_request_process_read(req);
2616                 break;
2617
2618         case SMB2_OP_WRITE:
2619                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_write, profile_p,
2620                                                req->profile, _INBYTES(req));
2621                 return_value = smbd_smb2_request_process_write(req);
2622                 break;
2623
2624         case SMB2_OP_LOCK:
2625                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_lock, profile_p,
2626                                                req->profile, _INBYTES(req));
2627                 return_value = smbd_smb2_request_process_lock(req);
2628                 break;
2629
2630         case SMB2_OP_IOCTL:
2631                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_ioctl, profile_p,
2632                                                req->profile, _INBYTES(req));
2633                 return_value = smbd_smb2_request_process_ioctl(req);
2634                 break;
2635
2636         case SMB2_OP_CANCEL:
2637                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_cancel, profile_p,
2638                                                req->profile, _INBYTES(req));
2639                 return_value = smbd_smb2_request_process_cancel(req);
2640                 SMBPROFILE_IOBYTES_ASYNC_END(req->profile, 0);
2641
2642                 /*
2643                  * We don't need the request anymore cancel requests never
2644                  * have a response.
2645                  *
2646                  * smbd_smb2_request_process_cancel() already called
2647                  * DLIST_REMOVE(xconn->smb2.requests, req);
2648                  */
2649                 TALLOC_FREE(req);
2650
2651                 break;
2652
2653         case SMB2_OP_KEEPALIVE:
2654                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_keepalive, profile_p,
2655                                                req->profile, _INBYTES(req));
2656                 return_value = smbd_smb2_request_process_keepalive(req);
2657                 break;
2658
2659         case SMB2_OP_QUERY_DIRECTORY:
2660                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_find, profile_p,
2661                                                req->profile, _INBYTES(req));
2662                 return_value = smbd_smb2_request_process_query_directory(req);
2663                 break;
2664
2665         case SMB2_OP_NOTIFY:
2666                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_notify, profile_p,
2667                                                req->profile, _INBYTES(req));
2668                 return_value = smbd_smb2_request_process_notify(req);
2669                 break;
2670
2671         case SMB2_OP_GETINFO:
2672                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_getinfo, profile_p,
2673                                                req->profile, _INBYTES(req));
2674                 return_value = smbd_smb2_request_process_getinfo(req);
2675                 break;
2676
2677         case SMB2_OP_SETINFO:
2678                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_setinfo, profile_p,
2679                                                req->profile, _INBYTES(req));
2680                 return_value = smbd_smb2_request_process_setinfo(req);
2681                 break;
2682
2683         case SMB2_OP_BREAK:
2684                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_break, profile_p,
2685                                                req->profile, _INBYTES(req));
2686                 return_value = smbd_smb2_request_process_break(req);
2687                 break;
2688
2689         default:
2690                 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2691                 break;
2692         }
2693         return return_value;
2694 }
2695
2696 static void smbd_smb2_request_reply_update_counts(struct smbd_smb2_request *req)
2697 {
2698         struct smbXsrv_connection *xconn = req->xconn;
2699         const uint8_t *inhdr;
2700         uint16_t channel_sequence;
2701         struct smbXsrv_open *op;
2702
2703         if (!req->request_counters_updated) {
2704                 return;
2705         }
2706
2707         if (xconn->protocol < PROTOCOL_SMB2_22) {
2708                 return;
2709         }
2710
2711         if (req->compat_chain_fsp == NULL) {
2712                 return;
2713         }
2714
2715         op = req->compat_chain_fsp->op;
2716         if (op == NULL) {
2717                 return;
2718         }
2719
2720         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2721         channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
2722
2723         if (op->global->channel_sequence == channel_sequence) {
2724                 SMB_ASSERT(op->request_count > 0);
2725                 op->request_count -= 1;
2726         } else {
2727                 SMB_ASSERT(op->pre_request_count > 0);
2728                 op->pre_request_count -= 1;
2729         }
2730 }
2731
2732 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
2733 {
2734         struct smbXsrv_connection *xconn = req->xconn;
2735         int first_idx = 1;
2736         struct iovec *firsttf = SMBD_SMB2_IDX_TF_IOV(req,out,first_idx);
2737         struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
2738         struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
2739         NTSTATUS status;
2740         bool ok;
2741
2742         req->subreq = NULL;
2743         TALLOC_FREE(req->async_te);
2744
2745         /* MS-SMB2: 3.3.4.1 Sending Any Outgoing Message */
2746         smbd_smb2_request_reply_update_counts(req);
2747
2748         if (req->do_encryption &&
2749             (firsttf->iov_len == 0) &&
2750             (req->first_key.length == 0) &&
2751             (req->session != NULL) &&
2752             (req->session->global->encryption_key.length != 0))
2753         {
2754                 DATA_BLOB encryption_key = req->session->global->encryption_key;
2755                 uint8_t *tf;
2756                 uint64_t session_id = req->session->global->session_wire_id;
2757                 uint64_t nonce_high;
2758                 uint64_t nonce_low;
2759
2760                 status = smb2_get_new_nonce(req->session,
2761                                             &nonce_high,
2762                                             &nonce_low);
2763                 if (!NT_STATUS_IS_OK(status)) {
2764                         return status;
2765                 }
2766
2767                 /*
2768                  * We need to place the SMB2_TRANSFORM header before the
2769                  * first SMB2 header
2770                  */
2771
2772                 /*
2773                  * we need to remember the encryption key
2774                  * and defer the signing/encryption until
2775                  * we are sure that we do not change
2776                  * the header again.
2777                  */
2778                 req->first_key = data_blob_dup_talloc(req, encryption_key);
2779                 if (req->first_key.data == NULL) {
2780                         return NT_STATUS_NO_MEMORY;
2781                 }
2782
2783                 tf = talloc_zero_array(req, uint8_t,
2784                                        SMB2_TF_HDR_SIZE);
2785                 if (tf == NULL) {
2786                         return NT_STATUS_NO_MEMORY;
2787                 }
2788
2789                 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2790                 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2791                 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2792                 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
2793
2794                 firsttf->iov_base = (void *)tf;
2795                 firsttf->iov_len = SMB2_TF_HDR_SIZE;
2796         }
2797
2798         if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
2799             (req->last_key.length > 0) &&
2800             (firsttf->iov_len == 0))
2801         {
2802                 int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
2803                 struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
2804
2805                 /*
2806                  * As we are sure the header of the last request in the
2807                  * compound chain will not change, we can to sign here
2808                  * with the last signing key we remembered.
2809                  */
2810                 status = smb2_signing_sign_pdu(req->last_key,
2811                                                xconn->protocol,
2812                                                lasthdr,
2813                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2814                 if (!NT_STATUS_IS_OK(status)) {
2815                         return status;
2816                 }
2817         }
2818         if (req->last_key.length > 0) {
2819                 data_blob_clear_free(&req->last_key);
2820         }
2821
2822         SMBPROFILE_IOBYTES_ASYNC_END(req->profile,
2823                 iov_buflen(outhdr, SMBD_SMB2_NUM_IOV_PER_REQ-1));
2824
2825         req->current_idx += SMBD_SMB2_NUM_IOV_PER_REQ;
2826
2827         if (req->current_idx < req->out.vector_count) {
2828                 /*
2829                  * We must process the remaining compound
2830                  * SMB2 requests before any new incoming SMB2
2831                  * requests. This is because incoming SMB2
2832                  * requests may include a cancel for a
2833                  * compound request we haven't processed
2834                  * yet.
2835                  */
2836                 struct tevent_immediate *im = tevent_create_immediate(req);
2837                 if (!im) {
2838                         return NT_STATUS_NO_MEMORY;
2839                 }
2840
2841                 if (req->do_signing && firsttf->iov_len == 0) {
2842                         struct smbXsrv_session *x = req->session;
2843                         DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
2844
2845                         /*
2846                          * we need to remember the signing key
2847                          * and defer the signing until
2848                          * we are sure that we do not change
2849                          * the header again.
2850                          */
2851                         req->last_key = data_blob_dup_talloc(req, signing_key);
2852                         if (req->last_key.data == NULL) {
2853                                 return NT_STATUS_NO_MEMORY;
2854                         }
2855                 }
2856
2857                 tevent_schedule_immediate(im,
2858                                         req->sconn->ev_ctx,
2859                                         smbd_smb2_request_dispatch_immediate,
2860                                         req);
2861                 return NT_STATUS_OK;
2862         }
2863
2864         if (req->compound_related) {
2865                 req->compound_related = false;
2866         }
2867
2868         ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
2869         if (!ok) {
2870                 return NT_STATUS_INVALID_PARAMETER_MIX;
2871         }
2872
2873         /* Set credit for these operations (zero credits if this
2874            is a final reply for an async operation). */
2875         smb2_calculate_credits(req, req);
2876
2877         /*
2878          * now check if we need to sign the current response
2879          */
2880         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
2881                 status = smb2_signing_encrypt_pdu(req->first_key,
2882                                         xconn->smb2.server.cipher,
2883                                         firsttf,
2884                                         req->out.vector_count - first_idx);
2885                 if (!NT_STATUS_IS_OK(status)) {
2886                         return status;
2887                 }
2888         } else if (req->do_signing) {
2889                 struct smbXsrv_session *x = req->session;
2890                 DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
2891
2892                 status = smb2_signing_sign_pdu(signing_key,
2893                                                xconn->protocol,
2894                                                outhdr,
2895                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2896                 if (!NT_STATUS_IS_OK(status)) {
2897                         return status;
2898                 }
2899         }
2900         if (req->first_key.length > 0) {
2901                 data_blob_clear_free(&req->first_key);
2902         }
2903
2904         if (req->preauth != NULL) {
2905                 struct hc_sha512state sctx;
2906                 int i;
2907
2908                 samba_SHA512_Init(&sctx);
2909                 samba_SHA512_Update(&sctx, req->preauth->sha512_value,
2910                                     sizeof(req->preauth->sha512_value));
2911                 for (i = 1; i < req->in.vector_count; i++) {
2912                         samba_SHA512_Update(&sctx,
2913                                             req->in.vector[i].iov_base,
2914                                             req->in.vector[i].iov_len);
2915                 }
2916                 samba_SHA512_Final(req->preauth->sha512_value, &sctx);
2917
2918                 samba_SHA512_Init(&sctx);
2919                 samba_SHA512_Update(&sctx, req->preauth->sha512_value,
2920                                     sizeof(req->preauth->sha512_value));
2921                 for (i = 1; i < req->out.vector_count; i++) {
2922                         samba_SHA512_Update(&sctx,
2923                                             req->out.vector[i].iov_base,
2924                                             req->out.vector[i].iov_len);
2925                 }
2926                 samba_SHA512_Final(req->preauth->sha512_value, &sctx);
2927
2928                 req->preauth = NULL;
2929         }
2930
2931         /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
2932         if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
2933             outdyn->iov_base == NULL && outdyn->iov_len != 0) {
2934                 /* Dynamic part is NULL. Chop it off,
2935                    We're going to send it via sendfile. */
2936                 req->out.vector_count -= 1;
2937         }
2938
2939         /*
2940          * We're done with this request -
2941          * move it off the "being processed" queue.
2942          */
2943         DLIST_REMOVE(xconn->smb2.requests, req);
2944
2945         req->queue_entry.mem_ctx = req;
2946         req->queue_entry.vector = req->out.vector;
2947         req->queue_entry.count = req->out.vector_count;
2948         DLIST_ADD_END(xconn->smb2.send_queue, &req->queue_entry);
2949         xconn->smb2.send_queue_len++;
2950
2951         status = smbd_smb2_flush_send_queue(xconn);
2952         if (!NT_STATUS_IS_OK(status)) {
2953                 return status;
2954         }
2955
2956         return NT_STATUS_OK;
2957 }
2958
2959 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn);
2960
2961 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
2962                                         struct tevent_immediate *im,
2963                                         void *private_data)
2964 {
2965         struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
2966                                         struct smbd_smb2_request);
2967         struct smbXsrv_connection *xconn = req->xconn;
2968         NTSTATUS status;
2969
2970         TALLOC_FREE(im);
2971
2972         if (DEBUGLEVEL >= 10) {
2973                 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
2974                         req->current_idx, req->in.vector_count));
2975                 print_req_vectors(req);
2976         }
2977
2978         status = smbd_smb2_request_dispatch(req);
2979         if (!NT_STATUS_IS_OK(status)) {
2980                 smbd_server_connection_terminate(xconn, nt_errstr(status));
2981                 return;
2982         }
2983
2984         status = smbd_smb2_request_next_incoming(xconn);
2985         if (!NT_STATUS_IS_OK(status)) {
2986                 smbd_server_connection_terminate(xconn, nt_errstr(status));
2987                 return;
2988         }
2989 }
2990
2991 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
2992                                    NTSTATUS status,
2993                                    DATA_BLOB body, DATA_BLOB *dyn,
2994                                    const char *location)
2995 {
2996         uint8_t *outhdr;
2997         struct iovec *outbody_v;
2998         struct iovec *outdyn_v;
2999         uint32_t next_command_ofs;
3000
3001         DEBUG(10,("smbd_smb2_request_done_ex: "
3002                   "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
3003                   req->current_idx, nt_errstr(status), (unsigned int)body.length,
3004                   dyn ? "yes": "no",
3005                   (unsigned int)(dyn ? dyn->length : 0),
3006                   location));
3007
3008         if (body.length < 2) {
3009                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
3010         }
3011
3012         if ((body.length % 2) != 0) {
3013                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
3014         }
3015
3016         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
3017         outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
3018         outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
3019
3020         next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
3021         SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
3022
3023         outbody_v->iov_base = (void *)body.data;
3024         outbody_v->iov_len = body.length;
3025
3026         if (dyn) {
3027                 outdyn_v->iov_base = (void *)dyn->data;
3028                 outdyn_v->iov_len = dyn->length;
3029         } else {
3030                 outdyn_v->iov_base = NULL;
3031                 outdyn_v->iov_len = 0;
3032         }
3033
3034         /*
3035          * See if we need to recalculate the offset to the next response
3036          *
3037          * Note that all responses may require padding (including the very last
3038          * one).
3039          */
3040         if (req->out.vector_count >= (2 * SMBD_SMB2_NUM_IOV_PER_REQ)) {
3041                 next_command_ofs  = SMB2_HDR_BODY;
3042                 next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
3043                 next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
3044         }
3045
3046         if ((next_command_ofs % 8) != 0) {
3047                 size_t pad_size = 8 - (next_command_ofs % 8);
3048                 if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
3049                         /*
3050                          * if the dyn buffer is empty
3051                          * we can use it to add padding
3052                          */
3053                         uint8_t *pad;
3054
3055                         pad = talloc_zero_array(req,
3056                                                 uint8_t, pad_size);
3057                         if (pad == NULL) {
3058                                 return smbd_smb2_request_error(req,
3059                                                 NT_STATUS_NO_MEMORY);
3060                         }
3061
3062                         outdyn_v->iov_base = (void *)pad;
3063                         outdyn_v->iov_len = pad_size;
3064                 } else {
3065                         /*
3066                          * For now we copy the dynamic buffer
3067                          * and add the padding to the new buffer
3068                          */
3069                         size_t old_size;
3070                         uint8_t *old_dyn;
3071                         size_t new_size;
3072                         uint8_t *new_dyn;
3073
3074                         old_size = SMBD_SMB2_OUT_DYN_LEN(req);
3075                         old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
3076
3077                         new_size = old_size + pad_size;
3078                         new_dyn = talloc_zero_array(req,
3079                                                uint8_t, new_size);
3080                         if (new_dyn == NULL) {
3081                                 return smbd_smb2_request_error(req,
3082                                                 NT_STATUS_NO_MEMORY);
3083                         }
3084
3085                         memcpy(new_dyn, old_dyn, old_size);
3086                         memset(new_dyn + old_size, 0, pad_size);
3087
3088                         outdyn_v->iov_base = (void *)new_dyn;
3089                         outdyn_v->iov_len = new_size;
3090                 }
3091                 next_command_ofs += pad_size;
3092         }
3093
3094         if ((req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) >= req->out.vector_count) {
3095                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
3096         } else {
3097                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
3098         }
3099         return smbd_smb2_request_reply(req);
3100 }
3101
3102 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
3103                                     NTSTATUS status,
3104                                     DATA_BLOB *info,
3105                                     const char *location)
3106 {
3107         struct smbXsrv_connection *xconn = req->xconn;
3108         DATA_BLOB body;
3109         DATA_BLOB _dyn;
3110         uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
3111         size_t unread_bytes = smbd_smb2_unread_bytes(req);
3112
3113         DBG_NOTICE("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| "
3114                    "at %s\n", req->current_idx, nt_errstr(status),
3115                    info ? " +info" : "", location);
3116
3117         if (unread_bytes) {
3118                 /* Recvfile error. Drain incoming socket. */
3119                 size_t ret;
3120
3121                 errno = 0;
3122                 ret = drain_socket(xconn->transport.sock, unread_bytes);
3123                 if (ret != unread_bytes) {
3124                         NTSTATUS error;
3125
3126                         if (errno == 0) {
3127                                 error = NT_STATUS_IO_DEVICE_ERROR;
3128                         } else {
3129                                 error = map_nt_error_from_unix_common(errno);
3130                         }
3131
3132                         DEBUG(2, ("Failed to drain %u bytes from SMB2 socket: "
3133                                   "ret[%u] errno[%d] => %s\n",
3134                                   (unsigned)unread_bytes,
3135                                   (unsigned)ret, errno, nt_errstr(error)));
3136                         return error;
3137                 }
3138         }
3139
3140         body.data = outhdr + SMB2_HDR_BODY;
3141         body.length = 8;
3142         SSVAL(body.data, 0, 9);
3143
3144         if (info) {
3145                 SIVAL(body.data, 0x04, info->length);
3146         } else {
3147                 /* Allocated size of req->out.vector[i].iov_base
3148                  * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
3149                  * 1 byte without having to do an alloc.
3150                  */
3151                 info = &_dyn;
3152                 info->data = ((uint8_t *)outhdr) +
3153                         OUTVEC_ALLOC_SIZE - 1;
3154                 info->length = 1;
3155                 SCVAL(info->data, 0, 0);
3156         }
3157
3158         /*
3159          * Note: Even if there is an error, continue to process the request.
3160          * per MS-SMB2.
3161          */
3162
3163         return smbd_smb2_request_done_ex(req, status, body, info, __location__);
3164 }
3165
3166
3167 struct smbd_smb2_send_break_state {
3168         struct smbd_smb2_send_queue queue_entry;
3169         uint8_t nbt_hdr[NBT_HDR_SIZE];
3170         uint8_t tf[SMB2_TF_HDR_SIZE];
3171         uint8_t hdr[SMB2_HDR_BODY];
3172         struct iovec vector[1+SMBD_SMB2_NUM_IOV_PER_REQ];
3173         uint8_t body[1];
3174 };
3175
3176 static NTSTATUS smbd_smb2_send_break(struct smbXsrv_connection *xconn,
3177                                      struct smbXsrv_session *session,
3178                                      struct smbXsrv_tcon *tcon,
3179                                      const uint8_t *body,
3180                                      size_t body_len)
3181 {
3182         struct smbd_smb2_send_break_state *state;
3183         bool do_encryption = false;
3184         uint64_t session_wire_id = 0;
3185         uint64_t nonce_high = 0;
3186         uint64_t nonce_low = 0;
3187         NTSTATUS status;
3188         size_t statelen;
3189         bool ok;
3190
3191         if (session != NULL) {
3192                 session_wire_id = session->global->session_wire_id;
3193                 do_encryption = session->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED;
3194                 if (tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) {
3195                         do_encryption = true;
3196                 }
3197         }
3198
3199         statelen = offsetof(struct smbd_smb2_send_break_state, body) +
3200                 body_len;
3201
3202         state = talloc_zero_size(xconn, statelen);
3203         if (state == NULL) {
3204                 return NT_STATUS_NO_MEMORY;
3205         }
3206         talloc_set_name_const(state, "struct smbd_smb2_send_break_state");
3207
3208         if (do_encryption) {
3209                 status = smb2_get_new_nonce(session,
3210                                             &nonce_high,
3211                                             &nonce_low);
3212                 if (!NT_STATUS_IS_OK(status)) {
3213                         return status;
3214                 }
3215         }
3216
3217         SIVAL(state->tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3218         SBVAL(state->tf, SMB2_TF_NONCE+0, nonce_low);
3219         SBVAL(state->tf, SMB2_TF_NONCE+8, nonce_high);
3220         SBVAL(state->tf, SMB2_TF_SESSION_ID, session_wire_id);
3221
3222         SIVAL(state->hdr, 0,                            SMB2_MAGIC);
3223         SSVAL(state->hdr, SMB2_HDR_LENGTH,              SMB2_HDR_BODY);
3224         SSVAL(state->hdr, SMB2_HDR_EPOCH,               0);
3225         SIVAL(state->hdr, SMB2_HDR_STATUS,              0);
3226         SSVAL(state->hdr, SMB2_HDR_OPCODE,              SMB2_OP_BREAK);
3227         SSVAL(state->hdr, SMB2_HDR_CREDIT,              0);
3228         SIVAL(state->hdr, SMB2_HDR_FLAGS,               SMB2_HDR_FLAG_REDIRECT);
3229         SIVAL(state->hdr, SMB2_HDR_NEXT_COMMAND,        0);
3230         SBVAL(state->hdr, SMB2_HDR_MESSAGE_ID,          UINT64_MAX);
3231         SIVAL(state->hdr, SMB2_HDR_PID,         0);
3232         SIVAL(state->hdr, SMB2_HDR_TID,         0);
3233         SBVAL(state->hdr, SMB2_HDR_SESSION_ID,          0);
3234         memset(state->hdr+SMB2_HDR_SIGNATURE, 0, 16);
3235
3236         state->vector[0] = (struct iovec) {
3237                 .iov_base = state->nbt_hdr,
3238                 .iov_len  = sizeof(state->nbt_hdr)
3239         };
3240
3241         if (do_encryption) {
3242                 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
3243                         .iov_base = state->tf,
3244                         .iov_len  = sizeof(state->tf)
3245                 };
3246         } else {
3247                 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
3248                         .iov_base = NULL,
3249                         .iov_len  = 0
3250                 };
3251         }
3252
3253         state->vector[1+SMBD_SMB2_HDR_IOV_OFS] = (struct iovec) {
3254                 .iov_base = state->hdr,
3255                 .iov_len  = sizeof(state->hdr)
3256         };
3257
3258         memcpy(state->body, body, body_len);
3259
3260         state->vector[1+SMBD_SMB2_BODY_IOV_OFS] = (struct iovec) {
3261                 .iov_base = state->body,
3262                 .iov_len  = body_len /* no sizeof(state->body) .. :-) */
3263         };
3264
3265         /*
3266          * state->vector[1+SMBD_SMB2_DYN_IOV_OFS] is NULL by talloc_zero above
3267          */
3268
3269         ok = smb2_setup_nbt_length(state->vector,
3270                                    1 + SMBD_SMB2_NUM_IOV_PER_REQ);
3271         if (!ok) {
3272                 return NT_STATUS_INVALID_PARAMETER_MIX;
3273         }
3274
3275         if (do_encryption) {
3276                 DATA_BLOB encryption_key = session->global->encryption_key;
3277
3278                 status = smb2_signing_encrypt_pdu(encryption_key,
3279                                         xconn->smb2.server.cipher,
3280                                         &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
3281                                         SMBD_SMB2_NUM_IOV_PER_REQ);
3282                 if (!NT_STATUS_IS_OK(status)) {
3283                         return status;
3284                 }
3285         }
3286
3287         state->queue_entry.mem_ctx = state;
3288         state->queue_entry.vector = state->vector;
3289         state->queue_entry.count = ARRAY_SIZE(state->vector);
3290         DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
3291         xconn->smb2.send_queue_len++;
3292
3293         status = smbd_smb2_flush_send_queue(xconn);
3294         if (!NT_STATUS_IS_OK(status)) {
3295                 return status;
3296         }
3297
3298         return NT_STATUS_OK;
3299 }
3300
3301 NTSTATUS smbd_smb2_send_oplock_break(struct smbXsrv_connection *xconn,
3302                                      struct smbXsrv_session *session,
3303                                      struct smbXsrv_tcon *tcon,
3304                                      struct smbXsrv_open *op,
3305                                      uint8_t oplock_level)
3306 {
3307         uint8_t body[0x18];
3308
3309         SSVAL(body, 0x00, sizeof(body));
3310         SCVAL(body, 0x02, oplock_level);
3311         SCVAL(body, 0x03, 0);           /* reserved */
3312         SIVAL(body, 0x04, 0);           /* reserved */
3313         SBVAL(body, 0x08, op->global->open_persistent_id);
3314         SBVAL(body, 0x10, op->global->open_volatile_id);
3315
3316         return smbd_smb2_send_break(xconn, NULL, NULL, body, sizeof(body));
3317 }
3318
3319 NTSTATUS smbd_smb2_send_lease_break(struct smbXsrv_connection *xconn,
3320                                     uint16_t new_epoch,
3321                                     uint32_t lease_flags,
3322                                     struct smb2_lease_key *lease_key,
3323                                     uint32_t current_lease_state,
3324                                     uint32_t new_lease_state)
3325 {
3326         uint8_t body[0x2c];
3327
3328         SSVAL(body, 0x00, sizeof(body));
3329         SSVAL(body, 0x02, new_epoch);
3330         SIVAL(body, 0x04, lease_flags);
3331         SBVAL(body, 0x08, lease_key->data[0]);
3332         SBVAL(body, 0x10, lease_key->data[1]);
3333         SIVAL(body, 0x18, current_lease_state);
3334         SIVAL(body, 0x1c, new_lease_state);
3335         SIVAL(body, 0x20, 0);           /* BreakReason, MUST be 0 */
3336         SIVAL(body, 0x24, 0);           /* AccessMaskHint, MUST be 0 */
3337         SIVAL(body, 0x28, 0);           /* ShareMaskHint, MUST be 0 */
3338
3339         return smbd_smb2_send_break(xconn, NULL, NULL, body, sizeof(body));
3340 }
3341
3342 static bool is_smb2_recvfile_write(struct smbd_smb2_request_read_state *state)
3343 {
3344         NTSTATUS status;
3345         uint32_t flags;
3346         uint64_t file_id_persistent;
3347         uint64_t file_id_volatile;
3348         struct smbXsrv_open *op = NULL;
3349         struct files_struct *fsp = NULL;
3350         const uint8_t *body = NULL;
3351
3352         /*
3353          * This is only called with a pktbuf
3354          * of at least SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN
3355          * bytes
3356          */
3357
3358         if (IVAL(state->pktbuf, 0) == SMB2_TF_MAGIC) {
3359                 /* Transform header. Cannot recvfile. */
3360                 return false;
3361         }
3362         if (IVAL(state->pktbuf, 0) != SMB2_MAGIC) {
3363                 /* Not SMB2. Normal error path will cope. */
3364                 return false;
3365         }
3366         if (SVAL(state->pktbuf, 4) != SMB2_HDR_BODY) {
3367                 /* Not SMB2. Normal error path will cope. */
3368                 return false;
3369         }
3370         if (SVAL(state->pktbuf, SMB2_HDR_OPCODE) != SMB2_OP_WRITE) {
3371                 /* Needs to be a WRITE. */
3372                 return false;
3373         }
3374         if (IVAL(state->pktbuf, SMB2_HDR_NEXT_COMMAND) != 0) {
3375                 /* Chained. Cannot recvfile. */
3376                 return false;
3377         }
3378         flags = IVAL(state->pktbuf, SMB2_HDR_FLAGS);
3379         if (flags & SMB2_HDR_FLAG_CHAINED) {
3380                 /* Chained. Cannot recvfile. */
3381                 return false;
3382         }
3383         if (flags & SMB2_HDR_FLAG_SIGNED) {
3384                 /* Signed. Cannot recvfile. */
3385                 return false;
3386         }
3387
3388         body = &state->pktbuf[SMB2_HDR_BODY];
3389
3390         file_id_persistent      = BVAL(body, 0x10);
3391         file_id_volatile        = BVAL(body, 0x18);
3392
3393         status = smb2srv_open_lookup(state->req->xconn,
3394                                      file_id_persistent,
3395                                      file_id_volatile,
3396                                      0, /* now */
3397                                      &op);
3398         if (!NT_STATUS_IS_OK(status)) {
3399                 return false;
3400         }
3401
3402         fsp = op->compat;
3403         if (fsp == NULL) {
3404                 return false;
3405         }
3406         if (fsp->conn == NULL) {
3407                 return false;
3408         }
3409
3410         if (IS_IPC(fsp->conn)) {
3411                 return false;
3412         }
3413         if (IS_PRINT(fsp->conn)) {
3414                 return false;
3415         }
3416
3417         DEBUG(10,("Doing recvfile write len = %u\n",
3418                 (unsigned int)(state->pktfull - state->pktlen)));
3419
3420         return true;
3421 }
3422
3423 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn)
3424 {
3425         struct smbd_server_connection *sconn = xconn->client->sconn;
3426         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
3427         size_t max_send_queue_len;
3428         size_t cur_send_queue_len;
3429
3430         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
3431                 /*
3432                  * we're not supposed to do any io
3433                  */
3434                 return NT_STATUS_OK;
3435         }
3436
3437         if (state->req != NULL) {
3438                 /*
3439                  * if there is already a tstream_readv_pdu
3440                  * pending, we are done.
3441                  */
3442                 return NT_STATUS_OK;
3443         }
3444
3445         max_send_queue_len = MAX(1, xconn->smb2.credits.max/16);
3446         cur_send_queue_len = xconn->smb2.send_queue_len;
3447
3448         if (cur_send_queue_len > max_send_queue_len) {
3449                 /*
3450                  * if we have a lot of requests to send,
3451                  * we wait until they are on the wire until we
3452                  * ask for the next request.
3453                  */
3454                 return NT_STATUS_OK;
3455         }
3456
3457         /* ask for the next request */
3458         ZERO_STRUCTP(state);
3459         state->req = smbd_smb2_request_allocate(xconn);
3460         if (state->req == NULL) {
3461                 return NT_STATUS_NO_MEMORY;
3462         }
3463         state->req->sconn = sconn;
3464         state->req->xconn = xconn;
3465         state->min_recv_size = lp_min_receive_file_size();
3466
3467         TEVENT_FD_READABLE(xconn->transport.fde);
3468
3469         return NT_STATUS_OK;
3470 }
3471
3472 void smbd_smb2_process_negprot(struct smbXsrv_connection *xconn,
3473                                uint64_t expected_seq_low,
3474                                const uint8_t *inpdu, size_t size)
3475 {
3476         struct smbd_server_connection *sconn = xconn->client->sconn;
3477         NTSTATUS status;
3478         struct smbd_smb2_request *req = NULL;
3479
3480         DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
3481                  (unsigned int)size));
3482
3483         status = smbd_initialize_smb2(xconn, expected_seq_low);
3484         if (!NT_STATUS_IS_OK(status)) {
3485                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3486                 return;
3487         }
3488
3489         status = smbd_smb2_request_create(xconn, inpdu, size, &req);
3490         if (!NT_STATUS_IS_OK(status)) {
3491                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3492                 return;
3493         }
3494
3495         status = smbd_smb2_request_validate(req);
3496         if (!NT_STATUS_IS_OK(status)) {
3497                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3498                 return;
3499         }
3500
3501         status = smbd_smb2_request_setup_out(req);
3502         if (!NT_STATUS_IS_OK(status)) {
3503                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3504                 return;
3505         }
3506
3507 #ifdef WITH_PROFILE
3508         /*
3509          * this was already counted at the SMB1 layer =>
3510          * smbd_smb2_request_dispatch() should not count it twice.
3511          */
3512         if (profile_p->values.request_stats.count > 0) {
3513                 profile_p->values.request_stats.count--;
3514         }
3515 #endif
3516         status = smbd_smb2_request_dispatch(req);
3517         if (!NT_STATUS_IS_OK(status)) {
3518                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3519                 return;
3520         }
3521
3522         status = smbd_smb2_request_next_incoming(xconn);
3523         if (!NT_STATUS_IS_OK(status)) {
3524                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3525                 return;
3526         }
3527
3528         sconn->num_requests++;
3529 }
3530
3531 static int socket_error_from_errno(int ret,
3532                                    int sys_errno,
3533                                    bool *retry)
3534 {
3535         *retry = false;
3536
3537         if (ret >= 0) {
3538                 return 0;
3539         }
3540
3541         if (ret != -1) {
3542                 return EIO;
3543         }
3544
3545         if (sys_errno == 0) {
3546                 return EIO;
3547         }
3548
3549         if (sys_errno == EINTR) {
3550                 *retry = true;
3551                 return sys_errno;
3552         }
3553
3554         if (sys_errno == EINPROGRESS) {
3555                 *retry = true;
3556                 return sys_errno;
3557         }
3558
3559         if (sys_errno == EAGAIN) {
3560                 *retry = true;
3561                 return sys_errno;
3562         }
3563
3564         /* ENOMEM is retryable on Solaris/illumos, and possibly other systems. */
3565         if (sys_errno == ENOMEM) {
3566                 *retry = true;
3567                 return sys_errno;
3568         }
3569
3570 #ifdef EWOULDBLOCK
3571 #if EWOULDBLOCK != EAGAIN
3572         if (sys_errno == EWOULDBLOCK) {
3573                 *retry = true;
3574                 return sys_errno;
3575         }
3576 #endif
3577 #endif
3578
3579         return sys_errno;
3580 }
3581
3582 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn)
3583 {
3584         int ret;
3585         int err;
3586         bool retry;
3587         NTSTATUS status;
3588
3589         if (xconn->smb2.send_queue == NULL) {
3590                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3591                 return NT_STATUS_OK;
3592         }
3593
3594         while (xconn->smb2.send_queue != NULL) {
3595                 struct smbd_smb2_send_queue *e = xconn->smb2.send_queue;
3596                 bool ok;
3597
3598                 if (e->sendfile_header != NULL) {
3599                         size_t size = 0;
3600                         size_t i = 0;
3601                         uint8_t *buf;
3602
3603                         status = NT_STATUS_INTERNAL_ERROR;
3604
3605                         for (i=0; i < e->count; i++) {
3606                                 size += e->vector[i].iov_len;
3607                         }
3608
3609                         if (size <= e->sendfile_header->length) {
3610                                 buf = e->sendfile_header->data;
3611                         } else {
3612                                 buf = talloc_array(e->mem_ctx, uint8_t, size);
3613                                 if (buf == NULL) {
3614                                         return NT_STATUS_NO_MEMORY;
3615                                 }
3616                         }
3617
3618                         size = 0;
3619                         for (i=0; i < e->count; i++) {
3620                                 memcpy(buf+size,
3621                                        e->vector[i].iov_base,
3622                                        e->vector[i].iov_len);
3623                                 size += e->vector[i].iov_len;
3624                         }
3625
3626                         e->sendfile_header->data = buf;
3627                         e->sendfile_header->length = size;
3628                         e->sendfile_status = &status;
3629                         e->count = 0;
3630
3631                         xconn->smb2.send_queue_len--;
3632                         DLIST_REMOVE(xconn->smb2.send_queue, e);
3633                         /*
3634                          * This triggers the sendfile path via
3635                          * the destructor.
3636                          */
3637                         talloc_free(e->mem_ctx);
3638
3639                         if (!NT_STATUS_IS_OK(status)) {
3640                                 return status;
3641                         }
3642                         continue;
3643                 }
3644
3645                 ret = writev(xconn->transport.sock, e->vector, e->count);
3646                 if (ret == 0) {
3647                         /* propagate end of file */
3648                         return NT_STATUS_INTERNAL_ERROR;
3649                 }
3650                 err = socket_error_from_errno(ret, errno, &retry);
3651                 if (retry) {
3652                         /* retry later */
3653                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
3654                         return NT_STATUS_OK;
3655                 }
3656                 if (err != 0) {
3657                         return map_nt_error_from_unix_common(err);
3658                 }
3659
3660                 ok = iov_advance(&e->vector, &e->count, ret);
3661                 if (!ok) {
3662                         return NT_STATUS_INTERNAL_ERROR;
3663                 }
3664
3665                 if (e->count > 0) {
3666                         /* we have more to write */
3667                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
3668                         return NT_STATUS_OK;
3669                 }
3670
3671                 xconn->smb2.send_queue_len--;
3672                 DLIST_REMOVE(xconn->smb2.send_queue, e);
3673                 talloc_free(e->mem_ctx);
3674         }
3675
3676         /*
3677          * Restart reads if we were blocked on
3678          * draining the send queue.
3679          */
3680
3681         status = smbd_smb2_request_next_incoming(xconn);
3682         if (!NT_STATUS_IS_OK(status)) {
3683                 return status;
3684         }
3685
3686         return NT_STATUS_OK;
3687 }
3688
3689 static NTSTATUS smbd_smb2_io_handler(struct smbXsrv_connection *xconn,
3690                                      uint16_t fde_flags)
3691 {
3692         struct smbd_server_connection *sconn = xconn->client->sconn;
3693         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
3694         struct smbd_smb2_request *req = NULL;
3695         size_t min_recvfile_size = UINT32_MAX;
3696         int ret;
3697         int err;
3698         bool retry;
3699         NTSTATUS status;
3700         NTTIME now;
3701
3702         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
3703                 /*
3704                  * we're not supposed to do any io
3705                  */
3706                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3707                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3708                 return NT_STATUS_OK;
3709         }
3710
3711         if (fde_flags & TEVENT_FD_WRITE) {
3712                 status = smbd_smb2_flush_send_queue(xconn);
3713                 if (!NT_STATUS_IS_OK(status)) {
3714                         return status;
3715                 }
3716         }
3717
3718         if (!(fde_flags & TEVENT_FD_READ)) {
3719                 return NT_STATUS_OK;
3720         }
3721
3722         if (state->req == NULL) {
3723                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3724                 return NT_STATUS_OK;
3725         }
3726
3727 again:
3728         if (!state->hdr.done) {
3729                 state->hdr.done = true;
3730
3731                 state->vector.iov_base = (void *)state->hdr.nbt;
3732                 state->vector.iov_len = NBT_HDR_SIZE;
3733         }
3734
3735         ret = readv(xconn->transport.sock, &state->vector, 1);
3736         if (ret == 0) {
3737                 /* propagate end of file */
3738                 return NT_STATUS_END_OF_FILE;
3739         }
3740         err = socket_error_from_errno(ret, errno, &retry);
3741         if (retry) {
3742                 /* retry later */
3743                 TEVENT_FD_READABLE(xconn->transport.fde);
3744                 return NT_STATUS_OK;
3745         }
3746         if (err != 0) {
3747                 return map_nt_error_from_unix_common(err);
3748         }
3749
3750         if (ret < state->vector.iov_len) {
3751                 uint8_t *base;
3752                 base = (uint8_t *)state->vector.iov_base;
3753                 base += ret;
3754                 state->vector.iov_base = (void *)base;
3755                 state->vector.iov_len -= ret;
3756                 /* we have more to read */
3757                 TEVENT_FD_READABLE(xconn->transport.fde);
3758                 return NT_STATUS_OK;
3759         }
3760
3761         if (state->pktlen > 0) {
3762                 if (state->doing_receivefile && !is_smb2_recvfile_write(state)) {
3763                         /*
3764                          * Not a possible receivefile write.
3765                          * Read the rest of the data.
3766                          */
3767                         state->doing_receivefile = false;
3768
3769                         state->pktbuf = talloc_realloc(state->req,
3770                                                        state->pktbuf,
3771                                                        uint8_t,
3772                                                        state->pktfull);
3773                         if (state->pktbuf == NULL) {
3774                                 return NT_STATUS_NO_MEMORY;
3775                         }
3776
3777                         state->vector.iov_base = (void *)(state->pktbuf +
3778                                 state->pktlen);
3779                         state->vector.iov_len = (state->pktfull -
3780                                 state->pktlen);
3781
3782                         state->pktlen = state->pktfull;
3783                         goto again;
3784                 }
3785
3786                 /*
3787                  * Either this is a receivefile write so we've
3788                  * done a short read, or if not we have all the data.
3789                  */
3790                 goto got_full;
3791         }
3792
3793         /*
3794          * Now we analyze the NBT header
3795          */
3796         if (state->hdr.nbt[0] != 0x00) {
3797                 state->min_recv_size = 0;
3798         }
3799         state->pktfull = smb2_len(state->hdr.nbt);
3800         if (state->pktfull == 0) {
3801                 goto got_full;
3802         }
3803
3804         if (state->min_recv_size != 0) {
3805                 min_recvfile_size = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3806                 min_recvfile_size += state->min_recv_size;
3807         }
3808
3809         if (state->pktfull > min_recvfile_size) {
3810                 /*
3811                  * Might be a receivefile write. Read the SMB2 HEADER +
3812                  * SMB2_WRITE header first. Set 'doing_receivefile'
3813                  * as we're *attempting* receivefile write. If this
3814                  * turns out not to be a SMB2_WRITE request or otherwise
3815                  * not suitable then we'll just read the rest of the data
3816                  * the next time this function is called.
3817                  */
3818                 state->pktlen = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3819                 state->doing_receivefile = true;
3820         } else {
3821                 state->pktlen = state->pktfull;
3822         }
3823
3824         state->pktbuf = talloc_array(state->req, uint8_t, state->pktlen);
3825         if (state->pktbuf == NULL) {
3826                 return NT_STATUS_NO_MEMORY;
3827         }
3828
3829         state->vector.iov_base = (void *)state->pktbuf;
3830         state->vector.iov_len = state->pktlen;
3831
3832         goto again;
3833
3834 got_full:
3835
3836         if (state->hdr.nbt[0] != 0x00) {
3837                 DEBUG(1,("ignore NBT[0x%02X] msg\n",
3838                          state->hdr.nbt[0]));
3839
3840                 req = state->req;
3841                 ZERO_STRUCTP(state);
3842                 state->req = req;
3843                 state->min_recv_size = lp_min_receive_file_size();
3844                 req = NULL;
3845                 goto again;
3846         }
3847
3848         req = state->req;
3849         state->req = NULL;
3850
3851         req->request_time = timeval_current();
3852         now = timeval_to_nttime(&req->request_time);
3853
3854         status = smbd_smb2_inbuf_parse_compound(xconn,
3855                                                 now,
3856                                                 state->pktbuf,
3857                                                 state->pktlen,
3858                                                 req,
3859                                                 &req->in.vector,
3860                                                 &req->in.vector_count);
3861         if (!NT_STATUS_IS_OK(status)) {
3862                 return status;
3863         }
3864
3865         if (state->doing_receivefile) {
3866                 req->smb1req = talloc_zero(req, struct smb_request);
3867                 if (req->smb1req == NULL) {
3868                         return NT_STATUS_NO_MEMORY;
3869                 }
3870                 req->smb1req->unread_bytes = state->pktfull - state->pktlen;
3871         }
3872
3873         ZERO_STRUCTP(state);
3874
3875         req->current_idx = 1;
3876
3877         DEBUG(10,("smbd_smb2_request idx[%d] of %d vectors\n",
3878                  req->current_idx, req->in.vector_count));
3879
3880         status = smbd_smb2_request_validate(req);
3881         if (!NT_STATUS_IS_OK(status)) {
3882                 return status;
3883         }
3884
3885         status = smbd_smb2_request_setup_out(req);
3886         if (!NT_STATUS_IS_OK(status)) {
3887                 return status;
3888         }
3889
3890         status = smbd_smb2_request_dispatch(req);
3891         if (!NT_STATUS_IS_OK(status)) {
3892                 return status;
3893         }
3894
3895         sconn->num_requests++;
3896
3897         /* The timeout_processing function isn't run nearly
3898            often enough to implement 'max log size' without
3899            overrunning the size of the file by many megabytes.
3900            This is especially true if we are running at debug
3901            level 10.  Checking every 50 SMB2s is a nice
3902            tradeoff of performance vs log file size overrun. */
3903
3904         if ((sconn->num_requests % 50) == 0 &&
3905             need_to_check_log_size()) {
3906                 change_to_root_user();
3907                 check_log_size();
3908         }
3909
3910         status = smbd_smb2_request_next_incoming(xconn);
3911         if (!NT_STATUS_IS_OK(status)) {
3912                 return status;
3913         }
3914
3915         return NT_STATUS_OK;
3916 }
3917
3918 static void smbd_smb2_connection_handler(struct tevent_context *ev,
3919                                          struct tevent_fd *fde,
3920                                          uint16_t flags,
3921                                          void *private_data)
3922 {
3923         struct smbXsrv_connection *xconn =
3924                 talloc_get_type_abort(private_data,
3925                 struct smbXsrv_connection);
3926         NTSTATUS status;
3927
3928         status = smbd_smb2_io_handler(xconn, flags);
3929         if (!NT_STATUS_IS_OK(status)) {
3930                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3931                 return;
3932         }
3933 }