#include "smbprofile.h"
#include "../lib/util/bitmap.h"
#include "../librpc/gen_ndr/krb5pac.h"
+#include "lib/util/iov_buf.h"
#include "auth.h"
+#include "libcli/smb/smbXcli_base.h"
+
+#include "lib/crypto/gnutls_helpers.h"
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_SMB2
static void smbd_smb2_connection_handler(struct tevent_context *ev,
struct tevent_fd *fde,
bool as_root;
uint16_t fileid_ofs;
bool allow_invalid_fileid;
+ bool modify;
} smbd_smb2_table[] = {
#define _OP(o) .opcode = o, .name = #o
{
.need_session = true,
.need_tcon = true,
.fileid_ofs = 0x10,
+ .modify = true,
},{
_OP(SMB2_OP_LOCK),
.need_session = true,
.need_tcon = true,
.fileid_ofs = 0x08,
.allow_invalid_fileid = true,
+ .modify = true,
},{
_OP(SMB2_OP_CANCEL),
.as_root = true,
_OP(SMB2_OP_KEEPALIVE),
.as_root = true,
},{
- _OP(SMB2_OP_FIND),
+ _OP(SMB2_OP_QUERY_DIRECTORY),
.need_session = true,
.need_tcon = true,
.fileid_ofs = 0x08,
.need_session = true,
.need_tcon = true,
.fileid_ofs = 0x10,
+ .modify = true,
},{
_OP(SMB2_OP_BREAK),
.need_session = true,
return true;
}
-static NTSTATUS smbd_initialize_smb2(struct smbXsrv_connection *xconn)
+bool smbd_smb2_is_compound(const struct smbd_smb2_request *req)
+{
+ return req->in.vector_count >= (2*SMBD_SMB2_NUM_IOV_PER_REQ);
+}
+
+static NTSTATUS smbd_initialize_smb2(struct smbXsrv_connection *xconn,
+ uint64_t expected_seq_low)
{
TALLOC_FREE(xconn->transport.fde);
- xconn->smb2.credits.seq_low = 0;
+ xconn->smb2.credits.seq_low = expected_seq_low;
xconn->smb2.credits.seq_range = 1;
xconn->smb2.credits.granted = 1;
xconn->smb2.credits.max = lp_smb2_max_credits();
return NT_STATUS_NO_MEMORY;
}
- xconn->transport.fde = tevent_add_fd(xconn->ev_ctx,
+ xconn->transport.fde = tevent_add_fd(
+ xconn->client->raw_ev_ctx,
xconn,
xconn->transport.sock,
TEVENT_FD_READ,
buf[3] = (len)&0xFF; \
} while (0)
-static void smb2_setup_nbt_length(struct iovec *vector, int count)
+static bool smb2_setup_nbt_length(struct iovec *vector, int count)
{
- size_t len = 0;
- int i;
+ ssize_t len;
- for (i=1; i < count; i++) {
- len += vector[i].iov_len;
+ if (count == 0) {
+ return false;
+ }
+
+ len = iov_buflen(vector+1, count-1);
+
+ if ((len == -1) || (len > 0xFFFFFF)) {
+ return false;
}
_smb2_setlen(vector[0].iov_base, len);
+ return true;
}
static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
return 0;
}
+void smb2_request_set_async_internal(struct smbd_smb2_request *req,
+ bool async_internal)
+{
+ req->async_internal = async_internal;
+}
+
static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
{
TALLOC_CTX *mem_pool;
goto inval;
}
- status = smb2srv_session_lookup(xconn, uid, now, &s);
+ status = smb2srv_session_lookup_conn(xconn, uid, now,
+ &s);
if (s == NULL) {
DEBUG(1, ("invalid session[%llu] in "
"SMB2_TRANSFORM header\n",
*/
if (len < SMB2_HDR_BODY + 2) {
+
+ if ((len == 5) &&
+ (IVAL(hdr, 0) == SMB_SUICIDE_PACKET) &&
+ lp_parm_bool(-1, "smbd", "suicide mode", false)) {
+ uint8_t exitcode = CVAL(hdr, 4);
+ DBG_WARNING("SUICIDE: Exiting immediately "
+ "with code %"PRIu8"\n",
+ exitcode);
+ exit(exitcode);
+ }
+
DEBUG(10, ("%d bytes left, expected at least %d\n",
(int)len, SMB2_HDR_BODY));
goto inval;
seq_tmp = xconn->smb2.credits.seq_low;
if (seq_id < seq_tmp) {
- DEBUG(0,("smb2_validate_sequence_number: bad message_id "
+ DBGC_ERR(DBGC_SMB2_CREDITS,
+ "smb2_validate_sequence_number: bad message_id "
"%llu (sequence id %llu) "
"(granted = %u, low = %llu, range = %u)\n",
(unsigned long long)message_id,
(unsigned long long)seq_id,
(unsigned int)xconn->smb2.credits.granted,
(unsigned long long)xconn->smb2.credits.seq_low,
- (unsigned int)xconn->smb2.credits.seq_range));
+ (unsigned int)xconn->smb2.credits.seq_range);
return false;
}
seq_tmp += xconn->smb2.credits.seq_range;
if (seq_id >= seq_tmp) {
- DEBUG(0,("smb2_validate_sequence_number: bad message_id "
+ DBGC_ERR(DBGC_SMB2_CREDITS,
+ "smb2_validate_sequence_number: bad message_id "
"%llu (sequence id %llu) "
"(granted = %u, low = %llu, range = %u)\n",
(unsigned long long)message_id,
(unsigned long long)seq_id,
(unsigned int)xconn->smb2.credits.granted,
(unsigned long long)xconn->smb2.credits.seq_low,
- (unsigned int)xconn->smb2.credits.seq_range));
+ (unsigned int)xconn->smb2.credits.seq_range);
return false;
}
offset = seq_id % xconn->smb2.credits.max;
if (bitmap_query(credits_bm, offset)) {
- DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
+ DBGC_ERR(DBGC_SMB2_CREDITS,
+ "smb2_validate_sequence_number: duplicate message_id "
"%llu (sequence id %llu) "
"(granted = %u, low = %llu, range = %u) "
"(bm offset %u)\n",
(unsigned int)xconn->smb2.credits.granted,
(unsigned long long)xconn->smb2.credits.seq_low,
(unsigned int)xconn->smb2.credits.seq_range,
- offset));
+ offset);
return false;
}
* already seen.
*/
while (bitmap_query(credits_bm, offset)) {
- DEBUG(10,("smb2_validate_sequence_number: clearing "
+ DBGC_DEBUG(DBGC_SMB2_CREDITS,
+ "smb2_validate_sequence_number: clearing "
"id %llu (position %u) from bitmap\n",
(unsigned long long)(xconn->smb2.credits.seq_low),
- offset));
+ offset);
bitmap_clear(credits_bm, offset);
xconn->smb2.credits.seq_low += 1;
credit_charge = MAX(credit_charge, 1);
}
- DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
+ DEBUGC(11,
+ DBGC_SMB2_CREDITS,
+ ("smb2_validate_message_id: mid %llu (charge %llu), "
"credits_granted %llu, "
"seqnum low/range: %llu/%llu\n",
(unsigned long long) message_id,
(unsigned long long) xconn->smb2.credits.seq_range));
if (xconn->smb2.credits.granted < credit_charge) {
- DEBUG(0, ("smb2_validate_message_id: client used more "
+ DBGC_ERR(DBGC_SMB2_CREDITS,
+ "smb2_validate_message_id: client used more "
"credits than granted, mid %llu, charge %llu, "
"credits_granted %llu, "
"seqnum low/range: %llu/%llu\n",
(unsigned long long) credit_charge,
(unsigned long long) xconn->smb2.credits.granted,
(unsigned long long) xconn->smb2.credits.seq_low,
- (unsigned long long) xconn->smb2.credits.seq_range));
+ (unsigned long long) xconn->smb2.credits.seq_range);
return false;
}
uint64_t id = message_id + i;
bool ok;
- DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
+ DEBUGC(11,
+ DBGC_SMB2_CREDITS,
+ ("Iterating mid %llu charge %u (sequence %llu)\n",
(unsigned long long)message_id,
credit_charge,
(unsigned long long)id));
* of requests and the used sequence number.
* Which means we would grant more credits
* for client which use multi credit requests.
+ *
+ * The above is what Windows Server < 2016 is doing,
+ * but new servers use all credits (8192 by default).
*/
- current_max_credits = xconn->smb2.credits.max / 16;
+ current_max_credits = xconn->smb2.credits.max;
current_max_credits = MAX(current_max_credits, 1);
if (xconn->smb2.credits.multicredit) {
cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
+ credits_requested = MAX(credits_requested, 1);
out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
* credits on the final response.
*/
credits_granted = 0;
- } else if (credits_requested > 0) {
+ } else {
+ uint16_t additional_possible =
+ xconn->smb2.credits.max - credit_charge;
uint16_t additional_max = 0;
uint16_t additional_credits = credits_requested - 1;
* with a successful session setup
*/
if (NT_STATUS_IS_OK(out_status)) {
- additional_max = 32;
+ additional_max = xconn->smb2.credits.max;
}
break;
default:
/*
- * We match windows and only grant additional credits
- * in chunks of 32.
+ * Windows Server < 2016 and older Samba versions
+ * used to only grant additional credits in
+ * chunks of 32 credits.
+ *
+ * But we match Windows Server 2016 and grant
+ * all credits as requested.
*/
- additional_max = 32;
+ additional_max = xconn->smb2.credits.max;
break;
}
+ additional_max = MIN(additional_max, additional_possible);
additional_credits = MIN(additional_credits, additional_max);
credits_granted = credit_charge + additional_credits;
- } else if (xconn->smb2.credits.granted == 0) {
- /*
- * Make sure the client has always at least one credit
- */
- credits_granted = 1;
}
/*
xconn->smb2.credits.granted += credits_granted;
xconn->smb2.credits.seq_range += credits_granted;
- DEBUG(10,("smb2_set_operation_credit: requested %u, charge %u, "
+ DBGC_DEBUG(DBGC_SMB2_CREDITS,
+ "smb2_set_operation_credit: requested %u, charge %u, "
"granted %u, current possible/max %u/%u, "
"total granted/max/low/range %u/%u/%llu/%u\n",
(unsigned int)credits_requested,
(unsigned int)xconn->smb2.credits.granted,
(unsigned int)xconn->smb2.credits.max,
(unsigned long long)xconn->smb2.credits.seq_low,
- (unsigned int)xconn->smb2.credits.seq_range));
+ (unsigned int)xconn->smb2.credits.seq_range);
}
static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
struct iovec *vector;
int count;
int idx;
+ bool ok;
count = req->in.vector_count;
if (count <= ARRAY_SIZE(req->out._vector)) {
req->out.vector_count = count;
/* setup the length of the NBT packet */
- smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
+ ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
+ if (!ok) {
+ return NT_STATUS_INVALID_PARAMETER_MIX;
+ }
- DLIST_ADD_END(xconn->smb2.requests, req, struct smbd_smb2_request *);
+ DLIST_ADD_END(xconn->smb2.requests, req);
return NT_STATUS_OK;
}
+void smbXsrv_connection_disconnect_transport(struct smbXsrv_connection *xconn,
+ NTSTATUS status)
+{
+ if (!NT_STATUS_IS_OK(xconn->transport.status)) {
+ return;
+ }
+
+ xconn->transport.status = status;
+ TALLOC_FREE(xconn->transport.fde);
+ if (xconn->transport.sock != -1) {
+ xconn->transport.sock = -1;
+ }
+ DO_PROFILE_INC(disconnect);
+}
+
+static size_t smbXsrv_client_valid_connections(struct smbXsrv_client *client)
+{
+ struct smbXsrv_connection *xconn = NULL;
+ size_t num_ok = 0;
+
+ for (xconn = client->connections; xconn != NULL; xconn = xconn->next) {
+ if (NT_STATUS_IS_OK(xconn->transport.status)) {
+ num_ok++;
+ }
+ }
+
+ return num_ok;
+}
+
+struct smbXsrv_connection_shutdown_state {
+ struct tevent_queue *wait_queue;
+};
+
+static void smbXsrv_connection_shutdown_wait_done(struct tevent_req *subreq);
+
+static struct tevent_req *smbXsrv_connection_shutdown_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct smbXsrv_connection *xconn)
+{
+ struct tevent_req *req = NULL;
+ struct smbXsrv_connection_shutdown_state *state = NULL;
+ struct tevent_req *subreq = NULL;
+ size_t len = 0;
+ struct smbd_smb2_request *preq = NULL;
+ NTSTATUS status;
+
+ /*
+ * The caller should have called
+ * smbXsrv_connection_disconnect_transport() before.
+ */
+ SMB_ASSERT(!NT_STATUS_IS_OK(xconn->transport.status));
+
+ req = tevent_req_create(mem_ctx, &state,
+ struct smbXsrv_connection_shutdown_state);
+ if (req == NULL) {
+ return NULL;
+ }
+
+ status = smbXsrv_session_disconnect_xconn(xconn);
+ if (tevent_req_nterror(req, status)) {
+ return tevent_req_post(req, ev);
+ }
+
+ state->wait_queue = tevent_queue_create(state, "smbXsrv_connection_shutdown_queue");
+ if (tevent_req_nomem(state->wait_queue, req)) {
+ return tevent_req_post(req, ev);
+ }
+
+ for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
+ /*
+ * The connection is gone so we
+ * don't need to take care of
+ * any crypto
+ */
+ preq->session = NULL;
+ preq->do_signing = false;
+ preq->do_encryption = false;
+ preq->preauth = NULL;
+
+ if (preq->subreq != NULL) {
+ tevent_req_cancel(preq->subreq);
+ }
+
+ /*
+ * Now wait until the request is finished.
+ *
+ * We don't set a callback, as we just want to block the
+ * wait queue and the talloc_free() of the request will
+ * remove the item from the wait queue.
+ */
+ subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
+ if (tevent_req_nomem(subreq, req)) {
+ return tevent_req_post(req, ev);
+ }
+ }
+
+ len = tevent_queue_length(state->wait_queue);
+ if (len == 0) {
+ tevent_req_done(req);
+ return tevent_req_post(req, ev);
+ }
+
+ /*
+ * Now we add our own waiter to the end of the queue,
+ * this way we get notified when all pending requests are finished
+ * and send to the socket.
+ */
+ subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
+ if (tevent_req_nomem(subreq, req)) {
+ return tevent_req_post(req, ev);
+ }
+ tevent_req_set_callback(subreq, smbXsrv_connection_shutdown_wait_done, req);
+
+ return req;
+}
+
+static void smbXsrv_connection_shutdown_wait_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req =
+ tevent_req_callback_data(subreq,
+ struct tevent_req);
+
+ tevent_queue_wait_recv(subreq);
+ TALLOC_FREE(subreq);
+
+ tevent_req_done(req);
+}
+
+static NTSTATUS smbXsrv_connection_shutdown_recv(struct tevent_req *req)
+{
+ return tevent_req_simple_recv_ntstatus(req);
+}
+
+static void smbd_server_connection_terminate_done(struct tevent_req *subreq)
+{
+ struct smbXsrv_connection *xconn =
+ tevent_req_callback_data(subreq,
+ struct smbXsrv_connection);
+ struct smbXsrv_client *client = xconn->client;
+ NTSTATUS status;
+
+ status = smbXsrv_connection_shutdown_recv(subreq);
+ if (!NT_STATUS_IS_OK(status)) {
+ exit_server("smbXsrv_connection_shutdown_recv failed");
+ }
+
+ DLIST_REMOVE(client->connections, xconn);
+ TALLOC_FREE(xconn);
+}
+
void smbd_server_connection_terminate_ex(struct smbXsrv_connection *xconn,
const char *reason,
const char *location)
{
- DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
- reason, location));
+ struct smbXsrv_client *client = xconn->client;
+ size_t num_ok = 0;
+
+ /*
+ * Make sure that no new request will be able to use this session.
+ *
+ * smbXsrv_connection_disconnect_transport() might be called already,
+ * but calling it again is a no-op.
+ */
+ smbXsrv_connection_disconnect_transport(xconn,
+ NT_STATUS_CONNECTION_DISCONNECTED);
+
+ num_ok = smbXsrv_client_valid_connections(client);
+
+ DBG_DEBUG("conn[%s] num_ok[%zu] reason[%s] at %s\n",
+ smbXsrv_connection_dbg(xconn), num_ok,
+ reason, location);
+
+ if (num_ok != 0) {
+ struct tevent_req *subreq = NULL;
+
+ subreq = smbXsrv_connection_shutdown_send(client,
+ client->raw_ev_ctx,
+ xconn);
+ if (subreq == NULL) {
+ exit_server("smbXsrv_connection_shutdown_send failed");
+ }
+ tevent_req_set_callback(subreq,
+ smbd_server_connection_terminate_done,
+ xconn);
+ return;
+ }
+
+ /*
+ * The last connection was disconnected
+ */
exit_server_cleanly(reason);
}
struct iovec *outvec = NULL;
int count = req->out.vector_count;
int i;
+ bool ok;
newreq = smbd_smb2_request_allocate(req->xconn);
if (!newreq) {
return NULL;
}
- smb2_setup_nbt_length(newreq->out.vector,
- newreq->out.vector_count);
+ ok = smb2_setup_nbt_length(newreq->out.vector,
+ newreq->out.vector_count);
+ if (!ok) {
+ TALLOC_FREE(newreq);
+ return NULL;
+ }
return newreq;
}
uint8_t *outhdr = NULL;
struct smbd_smb2_request *nreq = NULL;
NTSTATUS status;
+ bool ok;
/* Create a new smb2 request we'll use
for the interim return. */
ones we'll be using for the async reply. */
nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
- smb2_setup_nbt_length(nreq->out.vector,
- nreq->out.vector_count);
+ ok = smb2_setup_nbt_length(nreq->out.vector,
+ nreq->out.vector_count);
+ if (!ok) {
+ return NT_STATUS_INVALID_PARAMETER_MIX;
+ }
/* Step back to the previous reply. */
nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
* we need to sign/encrypt here with the last/first key we remembered
*/
if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
- status = smb2_signing_encrypt_pdu(req->first_key,
+ struct smb2_signing_key key = {
+ .blob = req->first_key,
+ };
+ status = smb2_signing_encrypt_pdu(&key,
xconn->smb2.server.cipher,
firsttf,
nreq->out.vector_count - first_idx);
+ smb2_signing_key_destructor(&key);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
} else if (req->last_key.length > 0) {
- status = smb2_signing_sign_pdu(req->last_key,
+ struct smb2_signing_key key = {
+ .blob = req->last_key,
+ };
+
+ status = smb2_signing_sign_pdu(&key,
xconn->protocol,
outhdr_v,
SMBD_SMB2_NUM_IOV_PER_REQ - 1);
+ smb2_signing_key_destructor(&key);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
nreq->queue_entry.mem_ctx = nreq;
nreq->queue_entry.vector = nreq->out.vector;
nreq->queue_entry.count = nreq->out.vector_count;
- DLIST_ADD_END(xconn->smb2.send_queue, &nreq->queue_entry, NULL);
+ DLIST_ADD_END(xconn->smb2.send_queue, &nreq->queue_entry);
xconn->smb2.send_queue_len++;
status = smbd_smb2_flush_send_queue(xconn);
return NT_STATUS_OK;
}
+ if (req->async_internal || defer_time == 0) {
+ /*
+ * An SMB2 request implementation wants to handle the request
+ * asynchronously "internally" while keeping synchronous
+ * behaviour for the SMB2 request. This means we don't send an
+ * interim response and we can allow processing of compound SMB2
+ * requests (cf the subsequent check) for all cases.
+ */
+ return NT_STATUS_OK;
+ }
+
if (req->in.vector_count > req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
/*
- * We're trying to go async in a compound
- * request chain.
- * This is only allowed for opens that
- * cause an oplock break, otherwise it
- * is not allowed. See [MS-SMB2].pdf
- * note <194> on Section 3.3.5.2.7.
+ * We're trying to go async in a compound request
+ * chain. This is only allowed for opens that cause an
+ * oplock break or for the last operation in the
+ * chain, otherwise it is not allowed. See
+ * [MS-SMB2].pdf note <206> on Section 3.3.5.2.7.
*/
const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
data_blob_clear_free(&req->last_key);
}
+ /*
+ * smbd_smb2_request_pending_timer() just send a packet
+ * to the client and doesn't need any impersonation.
+ * So we use req->xconn->client->raw_ev_ctx instead
+ * of req->ev_ctx here.
+ */
defer_endtime = timeval_current_ofs_usec(defer_time);
- req->async_te = tevent_add_timer(req->sconn->ev_ctx,
+ req->async_te = tevent_add_timer(req->xconn->client->raw_ev_ctx,
req, defer_endtime,
smbd_smb2_request_pending_timer,
req);
return NT_STATUS_OK;
}
-static DATA_BLOB smbd_smb2_signing_key(struct smbXsrv_session *session,
- struct smbXsrv_connection *xconn)
+static
+struct smb2_signing_key *smbd_smb2_signing_key(struct smbXsrv_session *session,
+ struct smbXsrv_connection *xconn)
{
struct smbXsrv_channel_global0 *c = NULL;
NTSTATUS status;
- DATA_BLOB key = data_blob_null;
+ struct smb2_signing_key *key = NULL;
status = smbXsrv_session_find_channel(session, xconn, &c);
if (NT_STATUS_IS_OK(status)) {
key = c->signing_key;
}
- if (key.length == 0) {
+ if (!smb2_signing_key_valid(key)) {
key = session->global->signing_key;
}
return key;
}
+static NTSTATUS smb2_get_new_nonce(struct smbXsrv_session *session,
+ uint64_t *new_nonce_high,
+ uint64_t *new_nonce_low)
+{
+ uint64_t nonce_high;
+ uint64_t nonce_low;
+
+ session->nonce_low += 1;
+ if (session->nonce_low == 0) {
+ session->nonce_low += 1;
+ session->nonce_high += 1;
+ }
+
+ /*
+ * CCM and GCM algorithms must never have their
+ * nonce wrap, or the security of the whole
+ * communication and the keys is destroyed.
+ * We must drop the connection once we have
+ * transfered too much data.
+ *
+ * NOTE: We assume nonces greater than 8 bytes.
+ */
+ if (session->nonce_high >= session->nonce_high_max) {
+ return NT_STATUS_ENCRYPTION_FAILED;
+ }
+
+ nonce_high = session->nonce_high_random;
+ nonce_high += session->nonce_high;
+ nonce_low = session->nonce_low;
+
+ *new_nonce_high = nonce_high;
+ *new_nonce_low = nonce_low;
+ return NT_STATUS_OK;
+}
+
static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
struct tevent_timer *te,
struct timeval current_time,
uint8_t *outhdr = NULL;
const uint8_t *inhdr = NULL;
uint8_t *tf = NULL;
- size_t tf_len = 0;
uint8_t *hdr = NULL;
uint8_t *body = NULL;
uint8_t *dyn = NULL;
uint32_t flags = 0;
- uint64_t session_id = 0;
uint64_t message_id = 0;
- uint64_t nonce_high = 0;
- uint64_t nonce_low = 0;
uint64_t async_id = 0;
NTSTATUS status;
+ bool ok;
TALLOC_FREE(req->async_te);
outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
flags = IVAL(outhdr, SMB2_HDR_FLAGS);
message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
- session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
async_id = message_id; /* keep it simple for now... */
}
tf = state->buf + NBT_HDR_SIZE;
- tf_len = SMB2_TF_HDR_SIZE;
hdr = tf + SMB2_TF_HDR_SIZE;
body = hdr + SMB2_HDR_BODY;
dyn = body + 8;
if (req->do_encryption) {
- struct smbXsrv_session *x = req->session;
-
- nonce_high = x->nonce_high;
- nonce_low = x->nonce_low;
+ uint64_t nonce_high = 0;
+ uint64_t nonce_low = 0;
+ uint64_t session_id = req->session->global->session_wire_id;
- x->nonce_low += 1;
- if (x->nonce_low == 0) {
- x->nonce_low += 1;
- x->nonce_high += 1;
+ status = smb2_get_new_nonce(req->session,
+ &nonce_high,
+ &nonce_low);
+ if (!NT_STATUS_IS_OK(status)) {
+ smbd_server_connection_terminate(xconn,
+ nt_errstr(status));
+ return;
}
- }
- SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
- SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
- SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
- SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
+ SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
+ SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
+ SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
+ SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
+ }
SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
if (req->do_encryption) {
state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = tf;
- state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = tf_len;
+ state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len =
+ SMB2_TF_HDR_SIZE;
} else {
state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base = NULL;
state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len = 0;
state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base = dyn;
state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len = 1;
- smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
+ ok = smb2_setup_nbt_length(state->vector,
+ 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
+ if (!ok) {
+ smbd_server_connection_terminate(
+ xconn, nt_errstr(NT_STATUS_INTERNAL_ERROR));
+ return;
+ }
/* Ensure we correctly go through crediting. Grant
the credits now, and zero credits on the final
if (req->do_encryption) {
struct smbXsrv_session *x = req->session;
- DATA_BLOB encryption_key = x->global->encryption_key;
+ struct smb2_signing_key *encryption_key = x->global->encryption_key;
status = smb2_signing_encrypt_pdu(encryption_key,
xconn->smb2.server.cipher,
}
} else if (req->do_signing) {
struct smbXsrv_session *x = req->session;
- DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
+ struct smb2_signing_key *signing_key =
+ smbd_smb2_signing_key(x, xconn);
status = smb2_signing_sign_pdu(signing_key,
xconn->protocol,
state->queue_entry.mem_ctx = state;
state->queue_entry.vector = state->vector;
state->queue_entry.count = ARRAY_SIZE(state->vector);
- DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry, NULL);
+ DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
xconn->smb2.send_queue_len++;
status = smbd_smb2_flush_send_queue(xconn);
search_async_id = BVAL(inhdr, SMB2_HDR_PID);
/*
- * we don't need the request anymore
- * cancel requests never have a response
+ * We don't need the request anymore cancel requests never
+ * have a response.
+ *
+ * We defer the TALLOC_FREE(req) to the caller.
*/
DLIST_REMOVE(xconn->smb2.requests, req);
- TALLOC_FREE(req);
for (cur = xconn->smb2.requests; cur; cur = cur->next) {
const uint8_t *outhdr;
return status;
}
- if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* should we pass FLAG_CASELESS_PATHNAMES here? */
- if (!set_current_service(tcon->compat, 0, true)) {
+ if (!change_to_user_and_service(
+ tcon->compat,
+ req->session->global->session_wire_id))
+ {
return NT_STATUS_ACCESS_DENIED;
}
req->last_session_id = 0;
- /* lookup an existing session */
- status = smb2srv_session_lookup(req->xconn,
- in_session_id, now,
- &session);
+ /* look an existing session up */
+ switch (in_opcode) {
+ case SMB2_OP_SESSSETUP:
+ /*
+ * For a session bind request, we don't have the
+ * channel set up at this point yet, so we defer
+ * the verification that the connection belongs
+ * to the session to the session setup code, which
+ * can look at the session binding flags.
+ */
+ status = smb2srv_session_lookup_client(req->xconn->client,
+ in_session_id, now,
+ &session);
+ break;
+ default:
+ status = smb2srv_session_lookup_conn(req->xconn,
+ in_session_id, now,
+ &session);
+ break;
+ }
if (session) {
req->session = session;
req->last_session_id = in_session_id;
case SMB2_OP_SESSSETUP:
status = NT_STATUS_OK;
break;
+ case SMB2_OP_LOGOFF:
+ case SMB2_OP_CLOSE:
+ case SMB2_OP_LOCK:
+ case SMB2_OP_CANCEL:
+ case SMB2_OP_KEEPALIVE:
+ /*
+ * [MS-SMB2] 3.3.5.2.9 Verifying the Session
+ * specifies that LOGOFF, CLOSE and (UN)LOCK
+ * should always be processed even on expired sessions.
+ *
+ * Also see the logic in
+ * smbd_smb2_request_process_lock().
+ *
+ * The smb2.session.expire2 test shows that
+ * CANCEL and KEEPALIVE/ECHO should also
+ * be processed.
+ */
+ status = NT_STATUS_OK;
+ break;
default:
break;
}
return NT_STATUS_INVALID_HANDLE;
}
- if (in_session_id != req->xconn->client->last_session_id) {
- req->xconn->client->last_session_id = in_session_id;
- set_current_user_info(session_info->unix_info->sanitized_username,
- session_info->unix_info->unix_name,
- session_info->info->domain_name);
- }
-
return NT_STATUS_OK;
}
needed_charge = (data_length - 1)/ 65536 + 1;
- DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
+ DBGC_DEBUG(DBGC_SMB2_CREDITS,
+ "mid %llu, CreditCharge: %d, NeededCharge: %d\n",
(unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
- credit_charge, needed_charge));
+ credit_charge, needed_charge);
if (needed_charge > credit_charge) {
- DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
- credit_charge, needed_charge));
+ DBGC_WARNING(DBGC_SMB2_CREDITS,
+ "CreditCharge too low, given %d, needed %d\n",
+ credit_charge, needed_charge);
return NT_STATUS_INVALID_PARAMETER;
}
switch (opcode) {
case SMB2_OP_IOCTL:
case SMB2_OP_GETINFO:
- min_dyn_size = 0;
- break;
case SMB2_OP_WRITE:
- if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) {
- if (req->smb1req->unread_bytes < min_dyn_size) {
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- min_dyn_size = 0;
- }
+ min_dyn_size = 0;
break;
}
return NT_STATUS_OK;
}
+bool smbXsrv_is_encrypted(uint8_t encryption_flags)
+{
+ return (!(encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET)
+ &&
+ (encryption_flags & (SMBXSRV_PROCESSED_ENCRYPTED_PACKET |
+ SMBXSRV_ENCRYPTION_DESIRED |
+ SMBXSRV_ENCRYPTION_REQUIRED)));
+}
+
+bool smbXsrv_is_partially_encrypted(uint8_t encryption_flags)
+{
+ return ((encryption_flags & SMBXSRV_PROCESSED_ENCRYPTED_PACKET) &&
+ (encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET));
+}
+
+/* Set a flag if not already set, return true if set */
+bool smbXsrv_set_crypto_flag(uint8_t *flags, uint8_t flag)
+{
+ if ((flag == 0) || (*flags & flag)) {
+ return false;
+ }
+
+ *flags |= flag;
+ return true;
+}
+
+/*
+ * Update encryption state tracking flags, this can be used to
+ * determine whether whether the session or tcon is "encrypted".
+ */
+static void smb2srv_update_crypto_flags(struct smbd_smb2_request *req,
+ uint16_t opcode,
+ bool *update_session_globalp,
+ bool *update_tcon_globalp)
+{
+ /* Default: assume unecrypted and unsigned */
+ struct smbXsrv_session *session = req->session;
+ struct smbXsrv_tcon *tcon = req->tcon;
+ uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
+ uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
+ bool update_session = false;
+ bool update_tcon = false;
+
+ if (req->was_encrypted && req->do_encryption) {
+ encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
+ sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
+ } else {
+ /* Unencrypted packet, can be signed */
+ if (req->do_signing) {
+ sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
+ } else if (opcode == SMB2_OP_CANCEL) {
+ /* Cancel requests are allowed to skip signing */
+ sign_flag &= ~SMBXSRV_PROCESSED_UNSIGNED_PACKET;
+ }
+ }
+
+ update_session |= smbXsrv_set_crypto_flag(
+ &session->global->encryption_flags, encrypt_flag);
+ update_session |= smbXsrv_set_crypto_flag(
+ &session->global->signing_flags, sign_flag);
+
+ if (tcon) {
+ update_tcon |= smbXsrv_set_crypto_flag(
+ &tcon->global->encryption_flags, encrypt_flag);
+ update_tcon |= smbXsrv_set_crypto_flag(
+ &tcon->global->signing_flags, sign_flag);
+ }
+
+ *update_session_globalp = update_session;
+ *update_tcon_globalp = update_tcon;
+ return;
+}
+
+bool smbXsrv_is_signed(uint8_t signing_flags)
+{
+ /*
+ * Signing is always enabled, so unless we got an unsigned
+ * packet and at least one signed packet that was not
+ * encrypted, the session or tcon is "signed".
+ */
+ return (!(signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
+ (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
+}
+
+bool smbXsrv_is_partially_signed(uint8_t signing_flags)
+{
+ return ((signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
+ (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
+}
+
+static NTSTATUS smbd_smb2_request_dispatch_update_counts(
+ struct smbd_smb2_request *req,
+ bool modify_call)
+{
+ struct smbXsrv_connection *xconn = req->xconn;
+ const uint8_t *inhdr;
+ uint16_t channel_sequence;
+ uint8_t generation_wrap = 0;
+ uint32_t flags;
+ int cmp;
+ struct smbXsrv_open *op;
+ bool update_open = false;
+ NTSTATUS status = NT_STATUS_OK;
+
+ SMB_ASSERT(!req->request_counters_updated);
+
+ if (xconn->protocol < PROTOCOL_SMB2_22) {
+ return NT_STATUS_OK;
+ }
+
+ if (req->compat_chain_fsp == NULL) {
+ return NT_STATUS_OK;
+ }
+
+ op = req->compat_chain_fsp->op;
+ if (op == NULL) {
+ return NT_STATUS_OK;
+ }
+
+ inhdr = SMBD_SMB2_IN_HDR_PTR(req);
+ flags = IVAL(inhdr, SMB2_HDR_FLAGS);
+ channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
+
+ cmp = channel_sequence - op->global->channel_sequence;
+ if (cmp < 0) {
+ /*
+ * csn wrap. We need to watch out for long-running
+ * requests that are still sitting on a previously
+ * used csn. SMB2_OP_NOTIFY can take VERY long.
+ */
+ generation_wrap += 1;
+ }
+
+ if (abs(cmp) > INT16_MAX) {
+ /*
+ * [MS-SMB2] 3.3.5.2.10 - Verifying the Channel Sequence Number:
+ *
+ * If the channel sequence number of the request and the one
+ * known to the server are not equal, the channel sequence
+ * number and outstanding request counts are only updated
+ * "... if the unsigned difference using 16-bit arithmetic
+ * between ChannelSequence and Open.ChannelSequence is less than
+ * or equal to 0x7FFF ...".
+ * Otherwise, an error is returned for the modifying
+ * calls write, set_info, and ioctl.
+ *
+ * There are currently two issues with the description:
+ *
+ * * For the other calls, the document seems to imply
+ * that processing continues without adapting the
+ * counters (if the sequence numbers are not equal).
+ *
+ * TODO: This needs clarification!
+ *
+ * * Also, the behaviour if the difference is larger
+ * than 0x7FFF is not clear. The document seems to
+ * imply that if such a difference is reached,
+ * the server starts to ignore the counters or
+ * in the case of the modifying calls, return errors.
+ *
+ * TODO: This needs clarification!
+ *
+ * At this point Samba tries to be a little more
+ * clever than the description in the MS-SMB2 document
+ * by heuristically detecting and properly treating
+ * a 16 bit overflow of the client-submitted sequence
+ * number:
+ *
+ * If the stored channel sequence number is more than
+ * 0x7FFF larger than the one from the request, then
+ * the client-provided sequence number has likely
+ * overflown. We treat this case as valid instead
+ * of as failure.
+ *
+ * The MS-SMB2 behaviour would be setting cmp = -1.
+ */
+ cmp *= -1;
+ }
+
+ if (flags & SMB2_HDR_FLAG_REPLAY_OPERATION) {
+ if (cmp == 0 && op->pre_request_count == 0) {
+ op->request_count += 1;
+ req->request_counters_updated = true;
+ } else if (cmp > 0 && op->pre_request_count == 0) {
+ op->pre_request_count += op->request_count;
+ op->request_count = 1;
+ op->global->channel_sequence = channel_sequence;
+ op->global->channel_generation += generation_wrap;
+ update_open = true;
+ req->request_counters_updated = true;
+ } else if (modify_call) {
+ return NT_STATUS_FILE_NOT_AVAILABLE;
+ }
+ } else {
+ if (cmp == 0) {
+ op->request_count += 1;
+ req->request_counters_updated = true;
+ } else if (cmp > 0) {
+ op->pre_request_count += op->request_count;
+ op->request_count = 1;
+ op->global->channel_sequence = channel_sequence;
+ op->global->channel_generation += generation_wrap;
+ update_open = true;
+ req->request_counters_updated = true;
+ } else if (modify_call) {
+ return NT_STATUS_FILE_NOT_AVAILABLE;
+ }
+ }
+ req->channel_generation = op->global->channel_generation;
+
+ if (update_open) {
+ status = smbXsrv_open_update(op);
+ }
+
+ return status;
+}
+
NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
{
struct smbXsrv_connection *xconn = req->xconn;
NTSTATUS return_value;
struct smbXsrv_session *x = NULL;
bool signing_required = false;
+ bool encryption_desired = false;
bool encryption_required = false;
inhdr = SMBD_SMB2_IN_HDR_PTR(req);
DO_PROFILE_INC(request);
+ SMB_ASSERT(!req->request_counters_updated);
+
/* TODO: verify more things */
flags = IVAL(inhdr, SMB2_HDR_FLAGS);
}
/*
- * Check if the client provided a valid session id,
- * if so smbd_smb2_request_check_session() calls
- * set_current_user_info().
+ * Check if the client provided a valid session id.
*
* As some command don't require a valid session id
* we defer the check of the session_status
session_status = smbd_smb2_request_check_session(req);
x = req->session;
if (x != NULL) {
- signing_required = x->global->signing_required;
- encryption_required = x->global->encryption_required;
-
- if (opcode == SMB2_OP_SESSSETUP &&
- x->global->signing_key.length > 0) {
- signing_required = true;
- }
+ signing_required = x->global->signing_flags & SMBXSRV_SIGNING_REQUIRED;
+ encryption_desired = x->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED;
+ encryption_required = x->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED;
}
+ req->async_internal = false;
req->do_signing = false;
- req->do_encryption = false;
+ if (opcode != SMB2_OP_SESSSETUP) {
+ req->do_encryption = encryption_desired;
+ } else {
+ req->do_encryption = false;
+ }
+ req->was_encrypted = false;
if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
NT_STATUS_ACCESS_DENIED);
}
+ req->was_encrypted = true;
req->do_encryption = true;
}
- if (encryption_required && !req->do_encryption) {
+ if (encryption_required && !req->was_encrypted) {
+ req->do_encryption = true;
return smbd_smb2_request_error(req,
NT_STATUS_ACCESS_DENIED);
}
allowed_flags = SMB2_HDR_FLAG_CHAINED |
SMB2_HDR_FLAG_SIGNED |
SMB2_HDR_FLAG_DFS;
+ if (xconn->protocol >= PROTOCOL_SMB3_11) {
+ allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
+ }
+ if (opcode == SMB2_OP_NEGPROT) {
+ if (lp_server_max_protocol() >= PROTOCOL_SMB3_11) {
+ allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
+ }
+ }
if (opcode == SMB2_OP_CANCEL) {
allowed_flags |= SMB2_HDR_FLAG_ASYNC;
}
+ if (xconn->protocol >= PROTOCOL_SMB2_22) {
+ allowed_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
+ }
if ((flags & ~allowed_flags) != 0) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
req->compat_chain_fsp = NULL;
}
- if (req->do_encryption) {
+ if (req->was_encrypted) {
signing_required = false;
} else if (signing_required || (flags & SMB2_HDR_FLAG_SIGNED)) {
- DATA_BLOB signing_key = data_blob_null;
+ struct smb2_signing_key *signing_key = NULL;
if (x == NULL) {
/*
* If we have a signing key, we should
* sign the response
*/
- if (signing_key.length > 0) {
+ if (smb2_signing_key_valid(signing_key)) {
req->do_signing = true;
}
*
* smbd_smb2_request_check_tcon()
* calls change_to_user() on success.
+ * Which implies set_current_user_info()
+ * and chdir_current_service().
*/
status = smbd_smb2_request_check_tcon(req);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
- if (req->tcon->global->encryption_required) {
+ if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) {
+ encryption_desired = true;
+ }
+ if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED) {
encryption_required = true;
}
- if (encryption_required && !req->do_encryption) {
+ if (encryption_required && !req->was_encrypted) {
+ req->do_encryption = true;
return smbd_smb2_request_error(req,
NT_STATUS_ACCESS_DENIED);
+ } else if (encryption_desired) {
+ req->do_encryption = true;
+ }
+ } else if (call->need_session) {
+ struct auth_session_info *session_info = NULL;
+
+ /*
+ * Unless we also have need_tcon (see above),
+ * we still need to call set_current_user_info().
+ */
+
+ session_info = req->session->global->auth_session_info;
+ if (session_info == NULL) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ set_current_user_info(session_info->unix_info->sanitized_username,
+ session_info->unix_info->unix_name,
+ session_info->info->domain_name);
+ }
+
+ if (req->session) {
+ bool update_session_global = false;
+ bool update_tcon_global = false;
+
+ smb2srv_update_crypto_flags(req, opcode,
+ &update_session_global,
+ &update_tcon_global);
+
+ if (update_session_global) {
+ status = smbXsrv_session_update(x);
+ if (!NT_STATUS_IS_OK(status)) {
+ return smbd_smb2_request_error(req, status);
+ }
+ }
+ if (update_tcon_global) {
+ status = smbXsrv_tcon_update(req->tcon);
+ if (!NT_STATUS_IS_OK(status)) {
+ return smbd_smb2_request_error(req, status);
+ }
}
}
}
}
+ status = smbd_smb2_request_dispatch_update_counts(req, call->modify);
+ if (!NT_STATUS_IS_OK(status)) {
+ return smbd_smb2_request_error(req, status);
+ }
+
if (call->as_root) {
SMB_ASSERT(call->fileid_ofs == 0);
/* This call needs to be run as root */
req->profile, _INBYTES(req));
return_value = smbd_smb2_request_process_cancel(req);
SMBPROFILE_IOBYTES_ASYNC_END(req->profile, 0);
+
+ /*
+ * We don't need the request anymore cancel requests never
+ * have a response.
+ *
+ * smbd_smb2_request_process_cancel() already called
+ * DLIST_REMOVE(xconn->smb2.requests, req);
+ */
+ TALLOC_FREE(req);
+
break;
case SMB2_OP_KEEPALIVE:
return_value = smbd_smb2_request_process_keepalive(req);
break;
- case SMB2_OP_FIND:
+ case SMB2_OP_QUERY_DIRECTORY:
SMBPROFILE_IOBYTES_ASYNC_START(smb2_find, profile_p,
req->profile, _INBYTES(req));
- return_value = smbd_smb2_request_process_find(req);
+ return_value = smbd_smb2_request_process_query_directory(req);
break;
case SMB2_OP_NOTIFY:
return return_value;
}
+static void smbd_smb2_request_reply_update_counts(struct smbd_smb2_request *req)
+{
+ struct smbXsrv_connection *xconn = req->xconn;
+ const uint8_t *inhdr;
+ uint16_t channel_sequence;
+ struct smbXsrv_open *op;
+
+ if (!req->request_counters_updated) {
+ return;
+ }
+
+ req->request_counters_updated = false;
+
+ if (xconn->protocol < PROTOCOL_SMB2_22) {
+ return;
+ }
+
+ if (req->compat_chain_fsp == NULL) {
+ return;
+ }
+
+ op = req->compat_chain_fsp->op;
+ if (op == NULL) {
+ return;
+ }
+
+ inhdr = SMBD_SMB2_IN_HDR_PTR(req);
+ channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
+
+ if ((op->global->channel_sequence == channel_sequence) &&
+ (op->global->channel_generation == req->channel_generation)) {
+ SMB_ASSERT(op->request_count > 0);
+ op->request_count -= 1;
+ } else {
+ SMB_ASSERT(op->pre_request_count > 0);
+ op->pre_request_count -= 1;
+ }
+}
+
static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
{
struct smbXsrv_connection *xconn = req->xconn;
struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
NTSTATUS status;
+ bool ok;
req->subreq = NULL;
TALLOC_FREE(req->async_te);
+ /* MS-SMB2: 3.3.4.1 Sending Any Outgoing Message */
+ smbd_smb2_request_reply_update_counts(req);
+
if (req->do_encryption &&
(firsttf->iov_len == 0) &&
(req->first_key.length == 0) &&
(req->session != NULL) &&
- (req->session->global->encryption_key.length != 0))
+ smb2_signing_key_valid(req->session->global->encryption_key))
{
- DATA_BLOB encryption_key = req->session->global->encryption_key;
+ struct smb2_signing_key *encryption_key =
+ req->session->global->encryption_key;
uint8_t *tf;
uint64_t session_id = req->session->global->session_wire_id;
- struct smbXsrv_session *x = req->session;
uint64_t nonce_high;
uint64_t nonce_low;
- nonce_high = x->nonce_high;
- nonce_low = x->nonce_low;
-
- x->nonce_low += 1;
- if (x->nonce_low == 0) {
- x->nonce_low += 1;
- x->nonce_high += 1;
+ status = smb2_get_new_nonce(req->session,
+ &nonce_high,
+ &nonce_low);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
}
/*
* we are sure that we do not change
* the header again.
*/
- req->first_key = data_blob_dup_talloc(req, encryption_key);
+ req->first_key = data_blob_dup_talloc(req,
+ encryption_key->blob);
if (req->first_key.data == NULL) {
return NT_STATUS_NO_MEMORY;
}
{
int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
+ struct smb2_signing_key key = {
+ .blob = req->last_key,
+ };
/*
* As we are sure the header of the last request in the
* compound chain will not change, we can to sign here
* with the last signing key we remembered.
*/
- status = smb2_signing_sign_pdu(req->last_key,
+ status = smb2_signing_sign_pdu(&key,
xconn->protocol,
lasthdr,
SMBD_SMB2_NUM_IOV_PER_REQ - 1);
+ smb2_signing_key_destructor(&key);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
if (req->do_signing && firsttf->iov_len == 0) {
struct smbXsrv_session *x = req->session;
- DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
+ struct smb2_signing_key *signing_key =
+ smbd_smb2_signing_key(x, xconn);
/*
* we need to remember the signing key
* we are sure that we do not change
* the header again.
*/
- req->last_key = data_blob_dup_talloc(req, signing_key);
+ req->last_key = data_blob_dup_talloc(req,
+ signing_key->blob);
if (req->last_key.data == NULL) {
return NT_STATUS_NO_MEMORY;
}
}
+ /*
+ * smbd_smb2_request_dispatch() will redo the impersonation.
+ * So we use req->xconn->client->raw_ev_ctx instead
+ * of req->ev_ctx here.
+ */
tevent_schedule_immediate(im,
- req->sconn->ev_ctx,
+ req->xconn->client->raw_ev_ctx,
smbd_smb2_request_dispatch_immediate,
req);
return NT_STATUS_OK;
req->compound_related = false;
}
- smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
+ ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
+ if (!ok) {
+ return NT_STATUS_INVALID_PARAMETER_MIX;
+ }
/* Set credit for these operations (zero credits if this
is a final reply for an async operation). */
* now check if we need to sign the current response
*/
if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
- status = smb2_signing_encrypt_pdu(req->first_key,
+ struct smb2_signing_key key = {
+ .blob = req->first_key,
+ };
+ status = smb2_signing_encrypt_pdu(&key,
xconn->smb2.server.cipher,
firsttf,
req->out.vector_count - first_idx);
+ smb2_signing_key_destructor(&key);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
} else if (req->do_signing) {
struct smbXsrv_session *x = req->session;
- DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
+ struct smb2_signing_key *signing_key =
+ smbd_smb2_signing_key(x, xconn);
status = smb2_signing_sign_pdu(signing_key,
xconn->protocol,
data_blob_clear_free(&req->first_key);
}
+ if (req->preauth != NULL) {
+ gnutls_hash_hd_t hash_hnd = NULL;
+ size_t i;
+ int rc;
+
+ rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_SHA512);
+ if (rc < 0) {
+ return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
+ }
+ rc = gnutls_hash(hash_hnd,
+ req->preauth->sha512_value,
+ sizeof(req->preauth->sha512_value));
+ if (rc < 0) {
+ gnutls_hash_deinit(hash_hnd, NULL);
+ return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
+ }
+ for (i = 1; i < req->in.vector_count; i++) {
+ rc = gnutls_hash(hash_hnd,
+ req->in.vector[i].iov_base,
+ req->in.vector[i].iov_len);
+ if (rc < 0) {
+ gnutls_hash_deinit(hash_hnd, NULL);
+ return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
+ }
+ }
+ if (rc < 0) {
+ gnutls_hash_deinit(hash_hnd, NULL);
+ return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
+ }
+ gnutls_hash_output(hash_hnd, req->preauth->sha512_value);
+
+ rc = gnutls_hash(hash_hnd,
+ req->preauth->sha512_value,
+ sizeof(req->preauth->sha512_value));
+ if (rc < 0) {
+ gnutls_hash_deinit(hash_hnd, NULL);
+ return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
+ }
+ for (i = 1; i < req->out.vector_count; i++) {
+ rc = gnutls_hash(hash_hnd,
+ req->out.vector[i].iov_base,
+ req->out.vector[i].iov_len);
+ if (rc < 0) {
+ gnutls_hash_deinit(hash_hnd, NULL);
+ return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
+ }
+ }
+
+ gnutls_hash_deinit(hash_hnd, req->preauth->sha512_value);
+
+ req->preauth = NULL;
+ }
+
/* I am a sick, sick man... :-). Sendfile hack ... JRA. */
if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
outdyn->iov_base == NULL && outdyn->iov_len != 0) {
req->queue_entry.mem_ctx = req;
req->queue_entry.vector = req->out.vector;
req->queue_entry.count = req->out.vector_count;
- DLIST_ADD_END(xconn->smb2.send_queue, &req->queue_entry, NULL);
+ DLIST_ADD_END(xconn->smb2.send_queue, &req->queue_entry);
xconn->smb2.send_queue_len++;
status = smbd_smb2_flush_send_queue(xconn);
struct iovec *outbody_v;
struct iovec *outdyn_v;
uint32_t next_command_ofs;
+ uint64_t mid;
- DEBUG(10,("smbd_smb2_request_done_ex: "
- "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
- req->current_idx, nt_errstr(status), (unsigned int)body.length,
- dyn ? "yes": "no",
+ outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
+ mid = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
+
+ DBG_DEBUG("mid [%"PRIu64"] idx[%d] status[%s] "
+ "body[%u] dyn[%s:%u] at %s\n",
+ mid,
+ req->current_idx,
+ nt_errstr(status),
+ (unsigned int)body.length,
+ dyn ? "yes" : "no",
(unsigned int)(dyn ? dyn->length : 0),
- location));
+ location);
if (body.length < 2) {
return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
}
- outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
outdyn_v->iov_len = 0;
}
- /* see if we need to recalculate the offset to the next response */
- if (next_command_ofs > 0) {
+ /*
+ * See if we need to recalculate the offset to the next response
+ *
+ * Note that all responses may require padding (including the very last
+ * one).
+ */
+ if (req->out.vector_count >= (2 * SMBD_SMB2_NUM_IOV_PER_REQ)) {
next_command_ofs = SMB2_HDR_BODY;
next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
next_command_ofs += pad_size;
}
- SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
-
+ if ((req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) >= req->out.vector_count) {
+ SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
+ } else {
+ SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
+ }
return smbd_smb2_request_reply(req);
}
uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
size_t unread_bytes = smbd_smb2_unread_bytes(req);
- DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
- req->current_idx, nt_errstr(status), info ? " +info" : "",
- location));
+ DBG_NOTICE("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| "
+ "at %s\n", req->current_idx, nt_errstr(status),
+ info ? " +info" : "", location);
if (unread_bytes) {
/* Recvfile error. Drain incoming socket. */
size_t body_len)
{
struct smbd_smb2_send_break_state *state;
- bool do_encryption = session->global->encryption_required;
+ bool do_encryption = false;
+ uint64_t session_wire_id = 0;
uint64_t nonce_high = 0;
uint64_t nonce_low = 0;
NTSTATUS status;
size_t statelen;
+ bool ok;
- if (tcon->global->encryption_required) {
- do_encryption = true;
+ if (session != NULL) {
+ session_wire_id = session->global->session_wire_id;
+ do_encryption = session->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED;
+ if (tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) {
+ do_encryption = true;
+ }
}
statelen = offsetof(struct smbd_smb2_send_break_state, body) +
talloc_set_name_const(state, "struct smbd_smb2_send_break_state");
if (do_encryption) {
- nonce_high = session->nonce_high;
- nonce_low = session->nonce_low;
-
- session->nonce_low += 1;
- if (session->nonce_low == 0) {
- session->nonce_low += 1;
- session->nonce_high += 1;
+ status = smb2_get_new_nonce(session,
+ &nonce_high,
+ &nonce_low);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
}
}
SIVAL(state->tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
SBVAL(state->tf, SMB2_TF_NONCE+0, nonce_low);
SBVAL(state->tf, SMB2_TF_NONCE+8, nonce_high);
- SBVAL(state->tf, SMB2_TF_SESSION_ID, session->global->session_wire_id);
+ SBVAL(state->tf, SMB2_TF_SESSION_ID, session_wire_id);
SIVAL(state->hdr, 0, SMB2_MAGIC);
SSVAL(state->hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
* state->vector[1+SMBD_SMB2_DYN_IOV_OFS] is NULL by talloc_zero above
*/
- smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
+ ok = smb2_setup_nbt_length(state->vector,
+ 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
+ if (!ok) {
+ return NT_STATUS_INVALID_PARAMETER_MIX;
+ }
if (do_encryption) {
- DATA_BLOB encryption_key = session->global->encryption_key;
+ struct smb2_signing_key *encryption_key =
+ session->global->encryption_key;
status = smb2_signing_encrypt_pdu(encryption_key,
xconn->smb2.server.cipher,
state->queue_entry.mem_ctx = state;
state->queue_entry.vector = state->vector;
state->queue_entry.count = ARRAY_SIZE(state->vector);
- DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry, NULL);
+ DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
xconn->smb2.send_queue_len++;
status = smbd_smb2_flush_send_queue(xconn);
SBVAL(body, 0x08, op->global->open_persistent_id);
SBVAL(body, 0x10, op->global->open_volatile_id);
- return smbd_smb2_send_break(xconn, session, tcon, body, sizeof(body));
+ return smbd_smb2_send_break(xconn, NULL, NULL, body, sizeof(body));
+}
+
+NTSTATUS smbd_smb2_send_lease_break(struct smbXsrv_connection *xconn,
+ uint16_t new_epoch,
+ uint32_t lease_flags,
+ struct smb2_lease_key *lease_key,
+ uint32_t current_lease_state,
+ uint32_t new_lease_state)
+{
+ uint8_t body[0x2c];
+
+ SSVAL(body, 0x00, sizeof(body));
+ SSVAL(body, 0x02, new_epoch);
+ SIVAL(body, 0x04, lease_flags);
+ SBVAL(body, 0x08, lease_key->data[0]);
+ SBVAL(body, 0x10, lease_key->data[1]);
+ SIVAL(body, 0x18, current_lease_state);
+ SIVAL(body, 0x1c, new_lease_state);
+ SIVAL(body, 0x20, 0); /* BreakReason, MUST be 0 */
+ SIVAL(body, 0x24, 0); /* AccessMaskHint, MUST be 0 */
+ SIVAL(body, 0x28, 0); /* ShareMaskHint, MUST be 0 */
+
+ return smbd_smb2_send_break(xconn, NULL, NULL, body, sizeof(body));
}
static bool is_smb2_recvfile_write(struct smbd_smb2_request_read_state *state)
if (IS_PRINT(fsp->conn)) {
return false;
}
+ if (fsp->base_fsp != NULL) {
+ return false;
+ }
DEBUG(10,("Doing recvfile write len = %u\n",
(unsigned int)(state->pktfull - state->pktlen)));
return NT_STATUS_OK;
}
-void smbd_smb2_first_negprot(struct smbXsrv_connection *xconn,
- const uint8_t *inpdu, size_t size)
+NTSTATUS smbd_smb2_process_negprot(struct smbXsrv_connection *xconn,
+ uint64_t expected_seq_low,
+ const uint8_t *inpdu, size_t size)
{
struct smbd_server_connection *sconn = xconn->client->sconn;
NTSTATUS status;
DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
(unsigned int)size));
- status = smbd_initialize_smb2(xconn);
+ status = smbd_initialize_smb2(xconn, expected_seq_low);
if (!NT_STATUS_IS_OK(status)) {
smbd_server_connection_terminate(xconn, nt_errstr(status));
- return;
+ return status;
}
status = smbd_smb2_request_create(xconn, inpdu, size, &req);
if (!NT_STATUS_IS_OK(status)) {
smbd_server_connection_terminate(xconn, nt_errstr(status));
- return;
+ return status;
}
status = smbd_smb2_request_validate(req);
if (!NT_STATUS_IS_OK(status)) {
smbd_server_connection_terminate(xconn, nt_errstr(status));
- return;
+ return status;
}
status = smbd_smb2_request_setup_out(req);
if (!NT_STATUS_IS_OK(status)) {
smbd_server_connection_terminate(xconn, nt_errstr(status));
- return;
+ return status;
}
#ifdef WITH_PROFILE
* this was already counted at the SMB1 layer =>
* smbd_smb2_request_dispatch() should not count it twice.
*/
- if (profile_p->request_stats.count > 0) {
- profile_p->request_stats.count--;
+ if (profile_p->values.request_stats.count > 0) {
+ profile_p->values.request_stats.count--;
}
#endif
status = smbd_smb2_request_dispatch(req);
if (!NT_STATUS_IS_OK(status)) {
smbd_server_connection_terminate(xconn, nt_errstr(status));
- return;
+ return status;
}
status = smbd_smb2_request_next_incoming(xconn);
if (!NT_STATUS_IS_OK(status)) {
smbd_server_connection_terminate(xconn, nt_errstr(status));
- return;
+ return status;
}
sconn->num_requests++;
+ return NT_STATUS_OK;
}
static int socket_error_from_errno(int ret,
int ret;
int err;
bool retry;
+ NTSTATUS status;
if (xconn->smb2.send_queue == NULL) {
TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
while (xconn->smb2.send_queue != NULL) {
struct smbd_smb2_send_queue *e = xconn->smb2.send_queue;
+ bool ok;
+ struct msghdr msg;
if (e->sendfile_header != NULL) {
- NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
size_t size = 0;
size_t i = 0;
uint8_t *buf;
+ status = NT_STATUS_INTERNAL_ERROR;
+
for (i=0; i < e->count; i++) {
size += e->vector[i].iov_len;
}
talloc_free(e->mem_ctx);
if (!NT_STATUS_IS_OK(status)) {
+ smbXsrv_connection_disconnect_transport(xconn,
+ status);
return status;
}
continue;
}
- ret = writev(xconn->transport.sock, e->vector, e->count);
+ msg = (struct msghdr) {
+ .msg_iov = e->vector,
+ .msg_iovlen = e->count,
+ };
+
+ ret = sendmsg(xconn->transport.sock, &msg, 0);
if (ret == 0) {
/* propagate end of file */
return NT_STATUS_INTERNAL_ERROR;
return NT_STATUS_OK;
}
if (err != 0) {
- return map_nt_error_from_unix_common(err);
- }
- while (ret > 0) {
- if (ret < e->vector[0].iov_len) {
- uint8_t *base;
- base = (uint8_t *)e->vector[0].iov_base;
- base += ret;
- e->vector[0].iov_base = (void *)base;
- e->vector[0].iov_len -= ret;
- break;
- }
- ret -= e->vector[0].iov_len;
- e->vector += 1;
- e->count -= 1;
+ status = map_nt_error_from_unix_common(err);
+ smbXsrv_connection_disconnect_transport(xconn,
+ status);
+ return status;
}
- /*
- * there're maybe some empty vectors at the end
- * which we need to skip, otherwise we would get
- * ret == 0 from the readv() call and return EPIPE
- */
- while (e->count > 0) {
- if (e->vector[0].iov_len > 0) {
- break;
- }
- e->vector += 1;
- e->count -= 1;
+ ok = iov_advance(&e->vector, &e->count, ret);
+ if (!ok) {
+ return NT_STATUS_INTERNAL_ERROR;
}
if (e->count > 0) {
talloc_free(e->mem_ctx);
}
+ /*
+ * Restart reads if we were blocked on
+ * draining the send queue.
+ */
+
+ status = smbd_smb2_request_next_incoming(xconn);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
return NT_STATUS_OK;
}
bool retry;
NTSTATUS status;
NTTIME now;
+ struct msghdr msg;
if (!NT_STATUS_IS_OK(xconn->transport.status)) {
/*
state->vector.iov_len = NBT_HDR_SIZE;
}
- ret = readv(xconn->transport.sock, &state->vector, 1);
+ msg = (struct msghdr) {
+ .msg_iov = &state->vector,
+ .msg_iovlen = 1,
+ };
+
+ ret = recvmsg(xconn->transport.sock, &msg, 0);
if (ret == 0) {
/* propagate end of file */
- return NT_STATUS_END_OF_FILE;
+ status = NT_STATUS_END_OF_FILE;
+ smbXsrv_connection_disconnect_transport(xconn,
+ status);
+ return status;
}
err = socket_error_from_errno(ret, errno, &retry);
if (retry) {
return NT_STATUS_OK;
}
if (err != 0) {
- return map_nt_error_from_unix_common(err);
+ status = map_nt_error_from_unix_common(err);
+ smbXsrv_connection_disconnect_transport(xconn,
+ status);
+ return status;
}
if (ret < state->vector.iov_len) {
git.samba.org / samba.git / blobdiff