source3/smbd/smbXsrv_session.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2011-2012
   5    Copyright (C) Michael Adam 2012
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/filesys.h"
  23 #include <tevent.h>
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "dbwrap/dbwrap.h"
  27 #include "dbwrap/dbwrap_rbt.h"
  28 #include "dbwrap/dbwrap_open.h"
  29 #include "dbwrap/dbwrap_watch.h"
  30 #include "session.h"
  31 #include "auth.h"
  32 #include "auth/gensec/gensec.h"
  33 #include "../lib/tsocket/tsocket.h"
  34 #include "../libcli/security/security.h"
  35 #include "messages.h"
  36 #include "lib/util/util_tdb.h"
  37 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  38 #include "serverid.h"
  39 #include "lib/util/tevent_ntstatus.h"
  40
  41 struct smbXsrv_session_table {
  42         struct {
  43                 struct db_context *db_ctx;
  44                 uint32_t lowest_id;
  45                 uint32_t highest_id;
  46                 uint32_t max_sessions;
  47                 uint32_t num_sessions;
  48         } local;
  49         struct {
  50                 struct db_context *db_ctx;
  51         } global;
  52 };
  53
  54 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
  55
  56 NTSTATUS smbXsrv_session_global_init(void)
  57 {
  58         char *global_path = NULL;
  59         struct db_context *db_ctx = NULL;
  60
  61         if (smbXsrv_session_global_db_ctx != NULL) {
  62                 return NT_STATUS_OK;
  63         }
  64
  65         /*
  66          * This contains secret information like session keys!
  67          */
  68         global_path = lock_path("smbXsrv_session_global.tdb");
  69         if (global_path == NULL) {
  70                 return NT_STATUS_NO_MEMORY;
  71         }
  72
  73         db_ctx = db_open(NULL, global_path,
  74                          0, /* hash_size */
  75                          TDB_DEFAULT |
  76                          TDB_CLEAR_IF_FIRST |
  77                          TDB_INCOMPATIBLE_HASH,
  78                          O_RDWR | O_CREAT, 0600,
  79                          DBWRAP_LOCK_ORDER_1,
  80                          DBWRAP_FLAG_NONE);
  81         TALLOC_FREE(global_path);
  82         if (db_ctx == NULL) {
  83                 NTSTATUS status;
  84
  85                 status = map_nt_error_from_unix_common(errno);
  86
  87                 return status;
  88         }
  89
  90         smbXsrv_session_global_db_ctx = db_ctx;
  91
  92         return NT_STATUS_OK;
  93 }
  94
  95 /*
  96  * NOTE:
  97  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
  98  * has the same result as integer comparison between the uint32_t
  99  * values.
 100  *
 101  * TODO: implement string based key
 102  */
 103
 104 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
 105
 106 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
 107                                                  uint8_t *key_buf)
 108 {
 109         TDB_DATA key;
 110
 111         RSIVAL(key_buf, 0, id);
 112
 113         key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
 114
 115         return key;
 116 }
 117
 118 #if 0
 119 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
 120 {
 121         if (id == NULL) {
 122                 return NT_STATUS_INVALID_PARAMETER;
 123         }
 124
 125         if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
 126                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 127         }
 128
 129         *id = RIVAL(key.dptr, 0);
 130
 131         return NT_STATUS_OK;
 132 }
 133 #endif
 134
 135 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
 136
 137 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
 138                                                 uint8_t *key_buf)
 139 {
 140         TDB_DATA key;
 141
 142         RSIVAL(key_buf, 0, id);
 143
 144         key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
 145
 146         return key;
 147 }
 148
 149 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
 150 {
 151         if (id == NULL) {
 152                 return NT_STATUS_INVALID_PARAMETER;
 153         }
 154
 155         if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
 156                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 157         }
 158
 159         *id = RIVAL(key.dptr, 0);
 160
 161         return NT_STATUS_OK;
 162 }
 163
 164 static struct db_record *smbXsrv_session_global_fetch_locked(
 165                         struct db_context *db,
 166                         uint32_t id,
 167                         TALLOC_CTX *mem_ctx)
 168 {
 169         TDB_DATA key;
 170         uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
 171         struct db_record *rec = NULL;
 172
 173         key = smbXsrv_session_global_id_to_key(id, key_buf);
 174
 175         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 176
 177         if (rec == NULL) {
 178                 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
 179                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 180         }
 181
 182         return rec;
 183 }
 184
 185 static void smbXsrv_session_close_loop(struct tevent_req *subreq);
 186
 187 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
 188                                            uint32_t lowest_id,
 189                                            uint32_t highest_id,
 190                                            uint32_t max_sessions)
 191 {
 192         struct smbXsrv_client *client = conn->client;
 193         struct smbXsrv_session_table *table;
 194         NTSTATUS status;
 195         struct tevent_req *subreq;
 196         uint64_t max_range;
 197
 198         if (lowest_id > highest_id) {
 199                 return NT_STATUS_INTERNAL_ERROR;
 200         }
 201
 202         max_range = highest_id;
 203         max_range -= lowest_id;
 204         max_range += 1;
 205
 206         if (max_sessions > max_range) {
 207                 return NT_STATUS_INTERNAL_ERROR;
 208         }
 209
 210         table = talloc_zero(client, struct smbXsrv_session_table);
 211         if (table == NULL) {
 212                 return NT_STATUS_NO_MEMORY;
 213         }
 214
 215         table->local.db_ctx = db_open_rbt(table);
 216         if (table->local.db_ctx == NULL) {
 217                 TALLOC_FREE(table);
 218                 return NT_STATUS_NO_MEMORY;
 219         }
 220         table->local.lowest_id = lowest_id;
 221         table->local.highest_id = highest_id;
 222         table->local.max_sessions = max_sessions;
 223
 224         status = smbXsrv_session_global_init();
 225         if (!NT_STATUS_IS_OK(status)) {
 226                 TALLOC_FREE(table);
 227                 return status;
 228         }
 229
 230         table->global.db_ctx = smbXsrv_session_global_db_ctx;
 231
 232         dbwrap_watch_db(table->global.db_ctx, client->msg_ctx);
 233
 234         subreq = messaging_read_send(table, client->ev_ctx, client->msg_ctx,
 235                                      MSG_SMBXSRV_SESSION_CLOSE);
 236         if (subreq == NULL) {
 237                 TALLOC_FREE(table);
 238                 return NT_STATUS_NO_MEMORY;
 239         }
 240         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
 241
 242         client->session_table = table;
 243         return NT_STATUS_OK;
 244 }
 245
 246 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
 247
 248 static void smbXsrv_session_close_loop(struct tevent_req *subreq)
 249 {
 250         struct smbXsrv_client *client =
 251                 tevent_req_callback_data(subreq,
 252                 struct smbXsrv_client);
 253         struct smbXsrv_session_table *table = client->session_table;
 254         int ret;
 255         struct messaging_rec *rec = NULL;
 256         struct smbXsrv_session_closeB close_blob;
 257         enum ndr_err_code ndr_err;
 258         struct smbXsrv_session_close0 *close_info0 = NULL;
 259         struct smbXsrv_session *session = NULL;
 260         NTSTATUS status;
 261         struct timeval tv = timeval_current();
 262         NTTIME now = timeval_to_nttime(&tv);
 263
 264         ret = messaging_read_recv(subreq, talloc_tos(), &rec);
 265         TALLOC_FREE(subreq);
 266         if (ret != 0) {
 267                 goto next;
 268         }
 269
 270         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
 271                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
 272         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 273                 status = ndr_map_error2ntstatus(ndr_err);
 274                 DEBUG(1,("smbXsrv_session_close_loop: "
 275                          "ndr_pull_struct_blob - %s\n",
 276                          nt_errstr(status)));
 277                 goto next;
 278         }
 279
 280         DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
 281         if (DEBUGLVL(10)) {
 282                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 283         }
 284
 285         if (close_blob.version != SMBXSRV_VERSION_0) {
 286                 DEBUG(0,("smbXsrv_session_close_loop: "
 287                          "ignore invalid version %u\n", close_blob.version));
 288                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 289                 goto next;
 290         }
 291
 292         close_info0 = close_blob.info.info0;
 293         if (close_info0 == NULL) {
 294                 DEBUG(0,("smbXsrv_session_close_loop: "
 295                          "ignore NULL info %u\n", close_blob.version));
 296                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 297                 goto next;
 298         }
 299
 300         status = smb2srv_session_lookup_client(client,
 301                                                close_info0->old_session_wire_id,
 302                                                now, &session);
 303         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
 304                 DEBUG(4,("smbXsrv_session_close_loop: "
 305                          "old_session_wire_id %llu not found\n",
 306                          (unsigned long long)close_info0->old_session_wire_id));
 307                 if (DEBUGLVL(4)) {
 308                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 309                 }
 310                 goto next;
 311         }
 312         if (!NT_STATUS_IS_OK(status) &&
 313             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
 314             !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 315                 DEBUG(1,("smbXsrv_session_close_loop: "
 316                          "old_session_wire_id %llu - %s\n",
 317                          (unsigned long long)close_info0->old_session_wire_id,
 318                          nt_errstr(status)));
 319                 if (DEBUGLVL(1)) {
 320                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 321                 }
 322                 goto next;
 323         }
 324
 325         if (session->global->session_global_id != close_info0->old_session_global_id) {
 326                 DEBUG(1,("smbXsrv_session_close_loop: "
 327                          "old_session_wire_id %llu - global %u != %u\n",
 328                          (unsigned long long)close_info0->old_session_wire_id,
 329                          session->global->session_global_id,
 330                          close_info0->old_session_global_id));
 331                 if (DEBUGLVL(1)) {
 332                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 333                 }
 334                 goto next;
 335         }
 336
 337         if (session->global->creation_time != close_info0->old_creation_time) {
 338                 DEBUG(1,("smbXsrv_session_close_loop: "
 339                          "old_session_wire_id %llu - "
 340                          "creation %s (%llu) != %s (%llu)\n",
 341                          (unsigned long long)close_info0->old_session_wire_id,
 342                          nt_time_string(rec, session->global->creation_time),
 343                          (unsigned long long)session->global->creation_time,
 344                          nt_time_string(rec, close_info0->old_creation_time),
 345                          (unsigned long long)close_info0->old_creation_time));
 346                 if (DEBUGLVL(1)) {
 347                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 348                 }
 349                 goto next;
 350         }
 351
 352         subreq = smb2srv_session_shutdown_send(session, client->ev_ctx,
 353                                                session, NULL);
 354         if (subreq == NULL) {
 355                 status = NT_STATUS_NO_MEMORY;
 356                 DEBUG(0, ("smbXsrv_session_close_loop: "
 357                           "smb2srv_session_shutdown_send(%llu) failed: %s\n",
 358                           (unsigned long long)session->global->session_wire_id,
 359                           nt_errstr(status)));
 360                 if (DEBUGLVL(1)) {
 361                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 362                 }
 363                 goto next;
 364         }
 365         tevent_req_set_callback(subreq,
 366                                 smbXsrv_session_close_shutdown_done,
 367                                 session);
 368
 369 next:
 370         TALLOC_FREE(rec);
 371
 372         subreq = messaging_read_send(table, client->ev_ctx, client->msg_ctx,
 373                                      MSG_SMBXSRV_SESSION_CLOSE);
 374         if (subreq == NULL) {
 375                 const char *r;
 376                 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
 377                 exit_server_cleanly(r);
 378                 return;
 379         }
 380         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
 381 }
 382
 383 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
 384 {
 385         struct smbXsrv_session *session =
 386                 tevent_req_callback_data(subreq,
 387                 struct smbXsrv_session);
 388         NTSTATUS status;
 389
 390         status = smb2srv_session_shutdown_recv(subreq);
 391         TALLOC_FREE(subreq);
 392         if (!NT_STATUS_IS_OK(status)) {
 393                 DEBUG(0, ("smbXsrv_session_close_loop: "
 394                           "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
 395                           (unsigned long long)session->global->session_wire_id,
 396                           nt_errstr(status)));
 397         }
 398
 399         status = smbXsrv_session_logoff(session);
 400         if (!NT_STATUS_IS_OK(status)) {
 401                 DEBUG(0, ("smbXsrv_session_close_loop: "
 402                           "smbXsrv_session_logoff(%llu) failed: %s\n",
 403                           (unsigned long long)session->global->session_wire_id,
 404                           nt_errstr(status)));
 405         }
 406
 407         TALLOC_FREE(session);
 408 }
 409
 410 struct smb1srv_session_local_allocate_state {
 411         const uint32_t lowest_id;
 412         const uint32_t highest_id;
 413         uint32_t last_id;
 414         uint32_t useable_id;
 415         NTSTATUS status;
 416 };
 417
 418 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
 419                                                    void *private_data)
 420 {
 421         struct smb1srv_session_local_allocate_state *state =
 422                 (struct smb1srv_session_local_allocate_state *)private_data;
 423         TDB_DATA key = dbwrap_record_get_key(rec);
 424         uint32_t id = 0;
 425         NTSTATUS status;
 426
 427         status = smbXsrv_session_local_key_to_id(key, &id);
 428         if (!NT_STATUS_IS_OK(status)) {
 429                 state->status = status;
 430                 return -1;
 431         }
 432
 433         if (id <= state->last_id) {
 434                 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 435                 return -1;
 436         }
 437         state->last_id = id;
 438
 439         if (id > state->useable_id) {
 440                 state->status = NT_STATUS_OK;
 441                 return -1;
 442         }
 443
 444         if (state->useable_id == state->highest_id) {
 445                 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
 446                 return -1;
 447         }
 448
 449         state->useable_id +=1;
 450         return 0;
 451 }
 452
 453 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
 454                                                   uint32_t lowest_id,
 455                                                   uint32_t highest_id,
 456                                                   TALLOC_CTX *mem_ctx,
 457                                                   struct db_record **_rec,
 458                                                   uint32_t *_id)
 459 {
 460         struct smb1srv_session_local_allocate_state state = {
 461                 .lowest_id = lowest_id,
 462                 .highest_id = highest_id,
 463                 .last_id = 0,
 464                 .useable_id = lowest_id,
 465                 .status = NT_STATUS_INTERNAL_ERROR,
 466         };
 467         uint32_t i;
 468         uint32_t range;
 469         NTSTATUS status;
 470         int count = 0;
 471
 472         *_rec = NULL;
 473         *_id = 0;
 474
 475         if (lowest_id > highest_id) {
 476                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 477         }
 478
 479         /*
 480          * first we try randomly
 481          */
 482         range = (highest_id - lowest_id) + 1;
 483
 484         for (i = 0; i < (range / 2); i++) {
 485                 uint32_t id;
 486                 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 487                 TDB_DATA key;
 488                 TDB_DATA val;
 489                 struct db_record *rec = NULL;
 490
 491                 id = generate_random() % range;
 492                 id += lowest_id;
 493
 494                 if (id < lowest_id) {
 495                         id = lowest_id;
 496                 }
 497                 if (id > highest_id) {
 498                         id = highest_id;
 499                 }
 500
 501                 key = smbXsrv_session_local_id_to_key(id, key_buf);
 502
 503                 rec = dbwrap_fetch_locked(db, mem_ctx, key);
 504                 if (rec == NULL) {
 505                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 506                 }
 507
 508                 val = dbwrap_record_get_value(rec);
 509                 if (val.dsize != 0) {
 510                         TALLOC_FREE(rec);
 511                         continue;
 512                 }
 513
 514                 *_rec = rec;
 515                 *_id = id;
 516                 return NT_STATUS_OK;
 517         }
 518
 519         /*
 520          * if the range is almost full,
 521          * we traverse the whole table
 522          * (this relies on sorted behavior of dbwrap_rbt)
 523          */
 524         status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
 525                                       &state, &count);
 526         if (NT_STATUS_IS_OK(status)) {
 527                 if (NT_STATUS_IS_OK(state.status)) {
 528                         return NT_STATUS_INTERNAL_ERROR;
 529                 }
 530
 531                 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
 532                         return state.status;
 533                 }
 534
 535                 if (state.useable_id <= state.highest_id) {
 536                         state.status = NT_STATUS_OK;
 537                 } else {
 538                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 539                 }
 540         } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
 541                 /*
 542                  * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
 543                  *
 544                  * If we get anything else it is an error, because it
 545                  * means we did not manage to find a free slot in
 546                  * the db.
 547                  */
 548                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 549         }
 550
 551         if (NT_STATUS_IS_OK(state.status)) {
 552                 uint32_t id;
 553                 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 554                 TDB_DATA key;
 555                 TDB_DATA val;
 556                 struct db_record *rec = NULL;
 557
 558                 id = state.useable_id;
 559
 560                 key = smbXsrv_session_local_id_to_key(id, key_buf);
 561
 562                 rec = dbwrap_fetch_locked(db, mem_ctx, key);
 563                 if (rec == NULL) {
 564                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 565                 }
 566
 567                 val = dbwrap_record_get_value(rec);
 568                 if (val.dsize != 0) {
 569                         TALLOC_FREE(rec);
 570                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 571                 }
 572
 573                 *_rec = rec;
 574                 *_id = id;
 575                 return NT_STATUS_OK;
 576         }
 577
 578         return state.status;
 579 }
 580
 581 struct smbXsrv_session_local_fetch_state {
 582         struct smbXsrv_session *session;
 583         NTSTATUS status;
 584 };
 585
 586 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
 587                                                void *private_data)
 588 {
 589         struct smbXsrv_session_local_fetch_state *state =
 590                 (struct smbXsrv_session_local_fetch_state *)private_data;
 591         void *ptr;
 592
 593         if (data.dsize != sizeof(ptr)) {
 594                 state->status = NT_STATUS_INTERNAL_DB_ERROR;
 595                 return;
 596         }
 597
 598         memcpy(&ptr, data.dptr, data.dsize);
 599         state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
 600         state->status = NT_STATUS_OK;
 601 }
 602
 603 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
 604                                              /* conn: optional */
 605                                              struct smbXsrv_connection *conn,
 606                                              uint32_t session_local_id,
 607                                              NTTIME now,
 608                                              struct smbXsrv_session **_session)
 609 {
 610         struct smbXsrv_session_local_fetch_state state = {
 611                 .session = NULL,
 612                 .status = NT_STATUS_INTERNAL_ERROR,
 613         };
 614         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 615         TDB_DATA key;
 616         NTSTATUS status;
 617
 618         *_session = NULL;
 619
 620         if (session_local_id == 0) {
 621                 return NT_STATUS_USER_SESSION_DELETED;
 622         }
 623
 624         if (table == NULL) {
 625                 /* this might happen before the end of negprot */
 626                 return NT_STATUS_USER_SESSION_DELETED;
 627         }
 628
 629         if (table->local.db_ctx == NULL) {
 630                 return NT_STATUS_INTERNAL_ERROR;
 631         }
 632
 633         key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
 634
 635         status = dbwrap_parse_record(table->local.db_ctx, key,
 636                                      smbXsrv_session_local_fetch_parser,
 637                                      &state);
 638         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
 639                 return NT_STATUS_USER_SESSION_DELETED;
 640         } else if (!NT_STATUS_IS_OK(status)) {
 641                 return status;
 642         }
 643         if (!NT_STATUS_IS_OK(state.status)) {
 644                 return state.status;
 645         }
 646
 647         if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
 648                 return NT_STATUS_USER_SESSION_DELETED;
 649         }
 650
 651         /*
 652          * If a connection is specified check if the session is
 653          * valid on the channel.
 654          */
 655         if (conn != NULL) {
 656                 struct smbXsrv_channel_global0 *c = NULL;
 657
 658                 status = smbXsrv_session_find_channel(state.session, conn, &c);
 659                 if (!NT_STATUS_IS_OK(status)) {
 660                         return status;
 661                 }
 662         }
 663
 664         state.session->idle_time = now;
 665
 666         if (!NT_STATUS_IS_OK(state.session->status)) {
 667                 *_session = state.session;
 668                 return state.session->status;
 669         }
 670
 671         if (now > state.session->global->expiration_time) {
 672                 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
 673         }
 674
 675         *_session = state.session;
 676         return state.session->status;
 677 }
 678
 679 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
 680 {
 681         return 0;
 682 }
 683
 684 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 685                                         bool *is_free,
 686                                         bool *was_free,
 687                                         TALLOC_CTX *mem_ctx,
 688                                         struct smbXsrv_session_global0 **_g);
 689
 690 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
 691                                         TALLOC_CTX *mem_ctx,
 692                                         struct smbXsrv_session_global0 **_global)
 693 {
 694         uint32_t i;
 695         struct smbXsrv_session_global0 *global = NULL;
 696         uint32_t last_free = 0;
 697         const uint32_t min_tries = 3;
 698
 699         *_global = NULL;
 700
 701         global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
 702         if (global == NULL) {
 703                 return NT_STATUS_NO_MEMORY;
 704         }
 705         talloc_set_destructor(global, smbXsrv_session_global_destructor);
 706
 707         /*
 708          * Here we just randomly try the whole 32-bit space
 709          *
 710          * We use just 32-bit, because we want to reuse the
 711          * ID for SRVSVC.
 712          */
 713         for (i = 0; i < UINT32_MAX; i++) {
 714                 bool is_free = false;
 715                 bool was_free = false;
 716                 uint32_t id;
 717
 718                 if (i >= min_tries && last_free != 0) {
 719                         id = last_free;
 720                 } else {
 721                         id = generate_random();
 722                 }
 723                 if (id == 0) {
 724                         id++;
 725                 }
 726                 if (id == UINT32_MAX) {
 727                         id--;
 728                 }
 729
 730                 global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
 731                                                                      mem_ctx);
 732                 if (global->db_rec == NULL) {
 733                         talloc_free(global);
 734                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 735                 }
 736
 737                 smbXsrv_session_global_verify_record(global->db_rec,
 738                                                      &is_free,
 739                                                      &was_free,
 740                                                      NULL, NULL);
 741
 742                 if (!is_free) {
 743                         TALLOC_FREE(global->db_rec);
 744                         continue;
 745                 }
 746
 747                 if (!was_free && i < min_tries) {
 748                         /*
 749                          * The session_id is free now,
 750                          * but was not free before.
 751                          *
 752                          * This happens if a smbd crashed
 753                          * and did not cleanup the record.
 754                          *
 755                          * If this is one of our first tries,
 756                          * then we try to find a real free one.
 757                          */
 758                         if (last_free == 0) {
 759                                 last_free = id;
 760                         }
 761                         TALLOC_FREE(global->db_rec);
 762                         continue;
 763                 }
 764
 765                 global->session_global_id = id;
 766
 767                 *_global = global;
 768                 return NT_STATUS_OK;
 769         }
 770
 771         /* should not be reached */
 772         talloc_free(global);
 773         return NT_STATUS_INTERNAL_ERROR;
 774 }
 775
 776 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 777                                         bool *is_free,
 778                                         bool *was_free,
 779                                         TALLOC_CTX *mem_ctx,
 780                                         struct smbXsrv_session_global0 **_g)
 781 {
 782         TDB_DATA key;
 783         TDB_DATA val;
 784         DATA_BLOB blob;
 785         struct smbXsrv_session_globalB global_blob;
 786         enum ndr_err_code ndr_err;
 787         struct smbXsrv_session_global0 *global = NULL;
 788         bool exists;
 789         TALLOC_CTX *frame = talloc_stackframe();
 790
 791         *is_free = false;
 792
 793         if (was_free) {
 794                 *was_free = false;
 795         }
 796         if (_g) {
 797                 *_g = NULL;
 798         }
 799
 800         key = dbwrap_record_get_key(db_rec);
 801
 802         val = dbwrap_record_get_value(db_rec);
 803         if (val.dsize == 0) {
 804                 TALLOC_FREE(frame);
 805                 *is_free = true;
 806                 if (was_free) {
 807                         *was_free = true;
 808                 }
 809                 return;
 810         }
 811
 812         blob = data_blob_const(val.dptr, val.dsize);
 813
 814         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 815                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
 816         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 817                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 818                 DEBUG(1,("smbXsrv_session_global_verify_record: "
 819                          "key '%s' ndr_pull_struct_blob - %s\n",
 820                          hex_encode_talloc(frame, key.dptr, key.dsize),
 821                          nt_errstr(status)));
 822                 TALLOC_FREE(frame);
 823                 return;
 824         }
 825
 826         DEBUG(10,("smbXsrv_session_global_verify_record\n"));
 827         if (DEBUGLVL(10)) {
 828                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 829         }
 830
 831         if (global_blob.version != SMBXSRV_VERSION_0) {
 832                 DEBUG(0,("smbXsrv_session_global_verify_record: "
 833                          "key '%s' use unsupported version %u\n",
 834                          hex_encode_talloc(frame, key.dptr, key.dsize),
 835                          global_blob.version));
 836                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 837                 TALLOC_FREE(frame);
 838                 return;
 839         }
 840
 841         global = global_blob.info.info0;
 842
 843         exists = serverid_exists(&global->channels[0].server_id);
 844         if (!exists) {
 845                 struct server_id_buf idbuf;
 846                 DEBUG(2,("smbXsrv_session_global_verify_record: "
 847                          "key '%s' server_id %s does not exist.\n",
 848                          hex_encode_talloc(frame, key.dptr, key.dsize),
 849                          server_id_str_buf(global->channels[0].server_id,
 850                                            &idbuf)));
 851                 if (DEBUGLVL(2)) {
 852                         NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 853                 }
 854                 TALLOC_FREE(frame);
 855                 dbwrap_record_delete(db_rec);
 856                 *is_free = true;
 857                 return;
 858         }
 859
 860         if (_g) {
 861                 *_g = talloc_move(mem_ctx, &global);
 862         }
 863         TALLOC_FREE(frame);
 864 }
 865
 866 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
 867 {
 868         struct smbXsrv_session_globalB global_blob;
 869         DATA_BLOB blob = data_blob_null;
 870         TDB_DATA key;
 871         TDB_DATA val;
 872         NTSTATUS status;
 873         enum ndr_err_code ndr_err;
 874
 875         /*
 876          * TODO: if we use other versions than '0'
 877          * we would add glue code here, that would be able to
 878          * store the information in the old format.
 879          */
 880
 881         if (global->db_rec == NULL) {
 882                 return NT_STATUS_INTERNAL_ERROR;
 883         }
 884
 885         key = dbwrap_record_get_key(global->db_rec);
 886         val = dbwrap_record_get_value(global->db_rec);
 887
 888         ZERO_STRUCT(global_blob);
 889         global_blob.version = smbXsrv_version_global_current();
 890         if (val.dsize >= 8) {
 891                 global_blob.seqnum = IVAL(val.dptr, 4);
 892         }
 893         global_blob.seqnum += 1;
 894         global_blob.info.info0 = global;
 895
 896         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 897                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
 898         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 899                 status = ndr_map_error2ntstatus(ndr_err);
 900                 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
 901                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 902                          nt_errstr(status)));
 903                 TALLOC_FREE(global->db_rec);
 904                 return status;
 905         }
 906
 907         val = make_tdb_data(blob.data, blob.length);
 908         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 909         if (!NT_STATUS_IS_OK(status)) {
 910                 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
 911                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 912                          nt_errstr(status)));
 913                 TALLOC_FREE(global->db_rec);
 914                 return status;
 915         }
 916
 917         if (DEBUGLVL(10)) {
 918                 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
 919                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
 920                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 921         }
 922
 923         TALLOC_FREE(global->db_rec);
 924
 925         return NT_STATUS_OK;
 926 }
 927
 928 struct smb2srv_session_close_previous_state {
 929         struct tevent_context *ev;
 930         struct smbXsrv_connection *connection;
 931         struct dom_sid *current_sid;
 932         uint64_t current_session_id;
 933         struct db_record *db_rec;
 934 };
 935
 936 static void smb2srv_session_close_previous_check(struct tevent_req *req);
 937 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
 938
 939 struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
 940                                         struct tevent_context *ev,
 941                                         struct smbXsrv_connection *conn,
 942                                         struct auth_session_info *session_info,
 943                                         uint64_t previous_session_id,
 944                                         uint64_t current_session_id)
 945 {
 946         struct tevent_req *req;
 947         struct smb2srv_session_close_previous_state *state;
 948         uint32_t global_id = previous_session_id & UINT32_MAX;
 949         uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
 950         struct smbXsrv_session_table *table = conn->client->session_table;
 951         struct security_token *current_token = NULL;
 952
 953         req = tevent_req_create(mem_ctx, &state,
 954                                 struct smb2srv_session_close_previous_state);
 955         if (req == NULL) {
 956                 return NULL;
 957         }
 958         state->ev = ev;
 959         state->connection = conn;
 960         state->current_session_id = current_session_id;
 961
 962         if (global_zeros != 0) {
 963                 tevent_req_done(req);
 964                 return tevent_req_post(req, ev);
 965         }
 966
 967         if (session_info == NULL) {
 968                 tevent_req_done(req);
 969                 return tevent_req_post(req, ev);
 970         }
 971         current_token = session_info->security_token;
 972
 973         if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
 974                 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
 975         }
 976
 977         if (state->current_sid == NULL) {
 978                 tevent_req_done(req);
 979                 return tevent_req_post(req, ev);
 980         }
 981
 982         if (!security_token_has_nt_authenticated_users(current_token)) {
 983                 /* TODO */
 984                 tevent_req_done(req);
 985                 return tevent_req_post(req, ev);
 986         }
 987
 988         state->db_rec = smbXsrv_session_global_fetch_locked(
 989                                                         table->global.db_ctx,
 990                                                         global_id,
 991                                                         state /* TALLOC_CTX */);
 992         if (state->db_rec == NULL) {
 993                 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
 994                 return tevent_req_post(req, ev);
 995         }
 996
 997         smb2srv_session_close_previous_check(req);
 998         if (!tevent_req_is_in_progress(req)) {
 999                 return tevent_req_post(req, ev);
1000         }
1001
1002         return req;
1003 }
1004
1005 static void smb2srv_session_close_previous_check(struct tevent_req *req)
1006 {
1007         struct smb2srv_session_close_previous_state *state =
1008                 tevent_req_data(req,
1009                 struct smb2srv_session_close_previous_state);
1010         struct smbXsrv_connection *conn = state->connection;
1011         DATA_BLOB blob;
1012         struct security_token *previous_token = NULL;
1013         struct smbXsrv_session_global0 *global = NULL;
1014         enum ndr_err_code ndr_err;
1015         struct smbXsrv_session_close0 close_info0;
1016         struct smbXsrv_session_closeB close_blob;
1017         struct tevent_req *subreq = NULL;
1018         NTSTATUS status;
1019         bool is_free = false;
1020
1021         smbXsrv_session_global_verify_record(state->db_rec,
1022                                              &is_free,
1023                                              NULL,
1024                                              state,
1025                                              &global);
1026
1027         if (is_free) {
1028                 TALLOC_FREE(state->db_rec);
1029                 tevent_req_done(req);
1030                 return;
1031         }
1032
1033         if (global->auth_session_info == NULL) {
1034                 TALLOC_FREE(state->db_rec);
1035                 tevent_req_done(req);
1036                 return;
1037         }
1038
1039         previous_token = global->auth_session_info->security_token;
1040
1041         if (!security_token_is_sid(previous_token, state->current_sid)) {
1042                 TALLOC_FREE(state->db_rec);
1043                 tevent_req_done(req);
1044                 return;
1045         }
1046
1047         subreq = dbwrap_record_watch_send(state, state->ev,
1048                                           state->db_rec, conn->msg_ctx);
1049         if (tevent_req_nomem(subreq, req)) {
1050                 TALLOC_FREE(state->db_rec);
1051                 return;
1052         }
1053         tevent_req_set_callback(subreq,
1054                                 smb2srv_session_close_previous_modified,
1055                                 req);
1056
1057         close_info0.old_session_global_id = global->session_global_id;
1058         close_info0.old_session_wire_id = global->session_wire_id;
1059         close_info0.old_creation_time = global->creation_time;
1060         close_info0.new_session_wire_id = state->current_session_id;
1061
1062         ZERO_STRUCT(close_blob);
1063         close_blob.version = smbXsrv_version_global_current();
1064         close_blob.info.info0 = &close_info0;
1065
1066         ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1067                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1068         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1069                 TALLOC_FREE(state->db_rec);
1070                 status = ndr_map_error2ntstatus(ndr_err);
1071                 DEBUG(1,("smb2srv_session_close_previous_check: "
1072                          "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1073                          (unsigned long long)close_info0.old_session_wire_id,
1074                          (unsigned long long)close_info0.new_session_wire_id,
1075                          nt_errstr(status)));
1076                 tevent_req_nterror(req, status);
1077                 return;
1078         }
1079
1080         status = messaging_send(conn->msg_ctx,
1081                                 global->channels[0].server_id,
1082                                 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1083         TALLOC_FREE(state->db_rec);
1084         if (tevent_req_nterror(req, status)) {
1085                 return;
1086         }
1087
1088         TALLOC_FREE(global);
1089         return;
1090 }
1091
1092 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1093 {
1094         struct tevent_req *req =
1095                 tevent_req_callback_data(subreq,
1096                 struct tevent_req);
1097         struct smb2srv_session_close_previous_state *state =
1098                 tevent_req_data(req,
1099                 struct smb2srv_session_close_previous_state);
1100         NTSTATUS status;
1101
1102         status = dbwrap_record_watch_recv(subreq, state, &state->db_rec);
1103         TALLOC_FREE(subreq);
1104         if (tevent_req_nterror(req, status)) {
1105                 return;
1106         }
1107
1108         smb2srv_session_close_previous_check(req);
1109 }
1110
1111 NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1112 {
1113         NTSTATUS status;
1114
1115         if (tevent_req_is_nterror(req, &status)) {
1116                 tevent_req_received(req);
1117                 return status;
1118         }
1119
1120         tevent_req_received(req);
1121         return NT_STATUS_OK;
1122 }
1123
1124 static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1125 {
1126         NTSTATUS status;
1127         struct smbXsrv_connection *xconn = NULL;
1128
1129         if (session->client != NULL) {
1130                 xconn = session->client->connections;
1131         }
1132
1133         for (; xconn != NULL; xconn = xconn->next) {
1134                 struct smbd_smb2_request *preq;
1135
1136                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1137                         if (preq->session != session) {
1138                                 continue;
1139                         }
1140
1141                         preq->session = NULL;
1142                         /*
1143                          * If we no longer have a session we can't
1144                          * sign or encrypt replies.
1145                          */
1146                         preq->do_signing = false;
1147                         preq->do_encryption = false;
1148                         preq->preauth = NULL;
1149                 }
1150         }
1151
1152         status = smbXsrv_session_logoff(session);
1153         return status;
1154 }
1155
1156 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1157 {
1158         NTSTATUS status;
1159
1160         status = smbXsrv_session_clear_and_logoff(session);
1161         if (!NT_STATUS_IS_OK(status)) {
1162                 DEBUG(0, ("smbXsrv_session_destructor: "
1163                           "smbXsrv_session_logoff() failed: %s\n",
1164                           nt_errstr(status)));
1165         }
1166
1167         TALLOC_FREE(session->global);
1168
1169         return 0;
1170 }
1171
1172 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1173                                 NTTIME now,
1174                                 struct smbXsrv_session **_session)
1175 {
1176         struct smbXsrv_session_table *table = conn->client->session_table;
1177         struct db_record *local_rec = NULL;
1178         struct smbXsrv_session *session = NULL;
1179         void *ptr = NULL;
1180         TDB_DATA val;
1181         struct smbXsrv_session_global0 *global = NULL;
1182         struct smbXsrv_channel_global0 *channel = NULL;
1183         NTSTATUS status;
1184
1185         if (table->local.num_sessions >= table->local.max_sessions) {
1186                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1187         }
1188
1189         session = talloc_zero(table, struct smbXsrv_session);
1190         if (session == NULL) {
1191                 return NT_STATUS_NO_MEMORY;
1192         }
1193         session->table = table;
1194         session->idle_time = now;
1195         session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1196         session->client = conn->client;
1197
1198         status = smbXsrv_session_global_allocate(table->global.db_ctx,
1199                                                  session,
1200                                                  &global);
1201         if (!NT_STATUS_IS_OK(status)) {
1202                 TALLOC_FREE(session);
1203                 return status;
1204         }
1205         session->global = global;
1206
1207         if (conn->protocol >= PROTOCOL_SMB2_02) {
1208                 uint64_t id = global->session_global_id;
1209                 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
1210                 TDB_DATA key;
1211
1212                 global->connection_dialect = conn->smb2.server.dialect;
1213
1214                 global->session_wire_id = id;
1215
1216                 status = smb2srv_tcon_table_init(session);
1217                 if (!NT_STATUS_IS_OK(status)) {
1218                         TALLOC_FREE(session);
1219                         return status;
1220                 }
1221
1222                 session->local_id = global->session_global_id;
1223
1224                 key = smbXsrv_session_local_id_to_key(session->local_id, key_buf);
1225
1226                 local_rec = dbwrap_fetch_locked(table->local.db_ctx,
1227                                                 session, key);
1228                 if (local_rec == NULL) {
1229                         TALLOC_FREE(session);
1230                         return NT_STATUS_NO_MEMORY;
1231                 }
1232
1233                 val = dbwrap_record_get_value(local_rec);
1234                 if (val.dsize != 0) {
1235                         TALLOC_FREE(session);
1236                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1237                 }
1238         } else {
1239
1240                 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1241                                                         table->local.lowest_id,
1242                                                         table->local.highest_id,
1243                                                         session,
1244                                                         &local_rec,
1245                                                         &session->local_id);
1246                 if (!NT_STATUS_IS_OK(status)) {
1247                         TALLOC_FREE(session);
1248                         return status;
1249                 }
1250
1251                 global->session_wire_id = session->local_id;
1252         }
1253
1254         global->creation_time = now;
1255         global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1256
1257         status = smbXsrv_session_add_channel(session, conn, &channel);
1258         if (!NT_STATUS_IS_OK(status)) {
1259                 TALLOC_FREE(session);
1260                 return status;
1261         }
1262
1263         ptr = session;
1264         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1265         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1266         TALLOC_FREE(local_rec);
1267         if (!NT_STATUS_IS_OK(status)) {
1268                 TALLOC_FREE(session);
1269                 return status;
1270         }
1271         table->local.num_sessions += 1;
1272
1273         talloc_set_destructor(session, smbXsrv_session_destructor);
1274
1275         status = smbXsrv_session_global_store(global);
1276         if (!NT_STATUS_IS_OK(status)) {
1277                 DEBUG(0,("smbXsrv_session_create: "
1278                          "global_id (0x%08x) store failed - %s\n",
1279                          session->global->session_global_id,
1280                          nt_errstr(status)));
1281                 TALLOC_FREE(session);
1282                 return status;
1283         }
1284
1285         if (DEBUGLVL(10)) {
1286                 struct smbXsrv_sessionB session_blob;
1287
1288                 ZERO_STRUCT(session_blob);
1289                 session_blob.version = SMBXSRV_VERSION_0;
1290                 session_blob.info.info0 = session;
1291
1292                 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1293                          session->global->session_global_id));
1294                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1295         }
1296
1297         *_session = session;
1298         return NT_STATUS_OK;
1299 }
1300
1301 NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1302                                      struct smbXsrv_connection *conn,
1303                                      struct smbXsrv_channel_global0 **_c)
1304 {
1305         struct smbXsrv_session_global0 *global = session->global;
1306         struct smbXsrv_channel_global0 *c = NULL;
1307
1308         if (global->num_channels > 31) {
1309                 /*
1310                  * Windows 2012 and 2012R2 allow up to 32 channels
1311                  */
1312                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1313         }
1314
1315         c = talloc_realloc(global,
1316                            global->channels,
1317                            struct smbXsrv_channel_global0,
1318                            global->num_channels + 1);
1319         if (c == NULL) {
1320                 return NT_STATUS_NO_MEMORY;
1321         }
1322         global->channels = c;
1323
1324         c = &global->channels[global->num_channels];
1325         ZERO_STRUCTP(c);
1326
1327         c->server_id = messaging_server_id(conn->msg_ctx);
1328         c->local_address = tsocket_address_string(conn->local_address,
1329                                                   global->channels);
1330         if (c->local_address == NULL) {
1331                 return NT_STATUS_NO_MEMORY;
1332         }
1333         c->remote_address = tsocket_address_string(conn->remote_address,
1334                                                    global->channels);
1335         if (c->remote_address == NULL) {
1336                 return NT_STATUS_NO_MEMORY;
1337         }
1338         c->remote_name = talloc_strdup(global->channels,
1339                                        conn->remote_hostname);
1340         if (c->remote_name == NULL) {
1341                 return NT_STATUS_NO_MEMORY;
1342         }
1343         c->connection = conn;
1344
1345         global->num_channels += 1;
1346
1347         *_c = c;
1348         return NT_STATUS_OK;
1349 }
1350
1351 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1352 {
1353         struct smbXsrv_session_table *table = session->table;
1354         NTSTATUS status;
1355
1356         if (session->global->db_rec != NULL) {
1357                 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1358                           "Called with db_rec != NULL'\n",
1359                           session->global->session_global_id));
1360                 return NT_STATUS_INTERNAL_ERROR;
1361         }
1362
1363         session->global->db_rec = smbXsrv_session_global_fetch_locked(
1364                                         table->global.db_ctx,
1365                                         session->global->session_global_id,
1366                                         session->global /* TALLOC_CTX */);
1367         if (session->global->db_rec == NULL) {
1368                 return NT_STATUS_INTERNAL_DB_ERROR;
1369         }
1370
1371         status = smbXsrv_session_global_store(session->global);
1372         if (!NT_STATUS_IS_OK(status)) {
1373                 DEBUG(0,("smbXsrv_session_update: "
1374                          "global_id (0x%08x) store failed - %s\n",
1375                          session->global->session_global_id,
1376                          nt_errstr(status)));
1377                 return status;
1378         }
1379
1380         if (DEBUGLVL(10)) {
1381                 struct smbXsrv_sessionB session_blob;
1382
1383                 ZERO_STRUCT(session_blob);
1384                 session_blob.version = SMBXSRV_VERSION_0;
1385                 session_blob.info.info0 = session;
1386
1387                 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1388                           session->global->session_global_id));
1389                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1390         }
1391
1392         return NT_STATUS_OK;
1393 }
1394
1395 NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1396                                       const struct smbXsrv_connection *conn,
1397                                       struct smbXsrv_channel_global0 **_c)
1398 {
1399         uint32_t i;
1400
1401         for (i=0; i < session->global->num_channels; i++) {
1402                 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1403
1404                 if (c->connection == conn) {
1405                         *_c = c;
1406                         return NT_STATUS_OK;
1407                 }
1408         }
1409
1410         return NT_STATUS_USER_SESSION_DELETED;
1411 }
1412
1413 NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1414                                    const struct smbXsrv_connection *conn,
1415                                    NTTIME now,
1416                                    struct smbXsrv_session_auth0 **_a)
1417 {
1418         struct smbXsrv_session_auth0 *a;
1419
1420         for (a = session->pending_auth; a != NULL; a = a->next) {
1421                 if (a->connection == conn) {
1422                         if (now != 0) {
1423                                 a->idle_time = now;
1424                         }
1425                         *_a = a;
1426                         return NT_STATUS_OK;
1427                 }
1428         }
1429
1430         return NT_STATUS_USER_SESSION_DELETED;
1431 }
1432
1433 static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1434 {
1435         if (a->session == NULL) {
1436                 return 0;
1437         }
1438
1439         DLIST_REMOVE(a->session->pending_auth, a);
1440         a->session = NULL;
1441         return 0;
1442 }
1443
1444 NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1445                                      struct smbXsrv_connection *conn,
1446                                      NTTIME now,
1447                                      uint8_t in_flags,
1448                                      uint8_t in_security_mode,
1449                                      struct smbXsrv_session_auth0 **_a)
1450 {
1451         struct smbXsrv_session_auth0 *a;
1452         NTSTATUS status;
1453
1454         status = smbXsrv_session_find_auth(session, conn, 0, &a);
1455         if (NT_STATUS_IS_OK(status)) {
1456                 return NT_STATUS_INTERNAL_ERROR;
1457         }
1458
1459         a = talloc_zero(session, struct smbXsrv_session_auth0);
1460         if (a == NULL) {
1461                 return NT_STATUS_NO_MEMORY;
1462         }
1463         a->session = session;
1464         a->connection = conn;
1465         a->in_flags = in_flags;
1466         a->in_security_mode = in_security_mode;
1467         a->creation_time = now;
1468         a->idle_time = now;
1469
1470         if (conn->protocol >= PROTOCOL_SMB3_10) {
1471                 a->preauth = talloc(a, struct smbXsrv_preauth);
1472                 if (a->preauth == NULL) {
1473                         TALLOC_FREE(session);
1474                         return NT_STATUS_NO_MEMORY;
1475                 }
1476                 *a->preauth = conn->smb2.preauth;
1477         }
1478
1479         talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1480         DLIST_ADD_END(session->pending_auth, a);
1481
1482         *_a = a;
1483         return NT_STATUS_OK;
1484 }
1485
1486 struct smb2srv_session_shutdown_state {
1487         struct tevent_queue *wait_queue;
1488 };
1489
1490 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1491
1492 struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1493                                         struct tevent_context *ev,
1494                                         struct smbXsrv_session *session,
1495                                         struct smbd_smb2_request *current_req)
1496 {
1497         struct tevent_req *req;
1498         struct smb2srv_session_shutdown_state *state;
1499         struct tevent_req *subreq;
1500         struct smbXsrv_connection *xconn = NULL;
1501         size_t len = 0;
1502
1503         /*
1504          * Make sure that no new request will be able to use this session.
1505          */
1506         session->status = NT_STATUS_USER_SESSION_DELETED;
1507
1508         req = tevent_req_create(mem_ctx, &state,
1509                                 struct smb2srv_session_shutdown_state);
1510         if (req == NULL) {
1511                 return NULL;
1512         }
1513
1514         state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1515         if (tevent_req_nomem(state->wait_queue, req)) {
1516                 return tevent_req_post(req, ev);
1517         }
1518
1519         for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1520                 struct smbd_smb2_request *preq;
1521
1522                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1523                         if (preq == current_req) {
1524                                 /* Can't cancel current request. */
1525                                 continue;
1526                         }
1527                         if (preq->session != session) {
1528                                 /* Request on different session. */
1529                                 continue;
1530                         }
1531
1532                         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1533                                 preq->session = NULL;
1534                                 /*
1535                                  * If we no longer have a session we can't
1536                                  * sign or encrypt replies.
1537                                  */
1538                                 preq->do_signing = false;
1539                                 preq->do_encryption = false;
1540                                 preq->preauth = NULL;
1541
1542                                 if (preq->subreq != NULL) {
1543                                         tevent_req_cancel(preq->subreq);
1544                                 }
1545                                 continue;
1546                         }
1547
1548                         /*
1549                          * Never cancel anything in a compound
1550                          * request. Way too hard to deal with
1551                          * the result.
1552                          */
1553                         if (!preq->compound_related && preq->subreq != NULL) {
1554                                 tevent_req_cancel(preq->subreq);
1555                         }
1556
1557                         /*
1558                          * Now wait until the request is finished.
1559                          *
1560                          * We don't set a callback, as we just want to block the
1561                          * wait queue and the talloc_free() of the request will
1562                          * remove the item from the wait queue.
1563                          */
1564                         subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1565                         if (tevent_req_nomem(subreq, req)) {
1566                                 return tevent_req_post(req, ev);
1567                         }
1568                 }
1569         }
1570
1571         len = tevent_queue_length(state->wait_queue);
1572         if (len == 0) {
1573                 tevent_req_done(req);
1574                 return tevent_req_post(req, ev);
1575         }
1576
1577         /*
1578          * Now we add our own waiter to the end of the queue,
1579          * this way we get notified when all pending requests are finished
1580          * and send to the socket.
1581          */
1582         subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1583         if (tevent_req_nomem(subreq, req)) {
1584                 return tevent_req_post(req, ev);
1585         }
1586         tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1587
1588         return req;
1589 }
1590
1591 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1592 {
1593         struct tevent_req *req =
1594                 tevent_req_callback_data(subreq,
1595                 struct tevent_req);
1596
1597         tevent_queue_wait_recv(subreq);
1598         TALLOC_FREE(subreq);
1599
1600         tevent_req_done(req);
1601 }
1602
1603 NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1604 {
1605         return tevent_req_simple_recv_ntstatus(req);
1606 }
1607
1608 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1609 {
1610         struct smbXsrv_session_table *table;
1611         struct db_record *local_rec = NULL;
1612         struct db_record *global_rec = NULL;
1613         struct smbd_server_connection *sconn = NULL;
1614         NTSTATUS status;
1615         NTSTATUS error = NT_STATUS_OK;
1616
1617         if (session->table == NULL) {
1618                 return NT_STATUS_OK;
1619         }
1620
1621         table = session->table;
1622         session->table = NULL;
1623
1624         sconn = session->client->sconn;
1625         session->client = NULL;
1626         session->status = NT_STATUS_USER_SESSION_DELETED;
1627
1628         global_rec = session->global->db_rec;
1629         session->global->db_rec = NULL;
1630         if (global_rec == NULL) {
1631                 global_rec = smbXsrv_session_global_fetch_locked(
1632                                         table->global.db_ctx,
1633                                         session->global->session_global_id,
1634                                         session->global /* TALLOC_CTX */);
1635                 if (global_rec == NULL) {
1636                         error = NT_STATUS_INTERNAL_ERROR;
1637                 }
1638         }
1639
1640         if (global_rec != NULL) {
1641                 status = dbwrap_record_delete(global_rec);
1642                 if (!NT_STATUS_IS_OK(status)) {
1643                         TDB_DATA key = dbwrap_record_get_key(global_rec);
1644
1645                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1646                                   "failed to delete global key '%s': %s\n",
1647                                   session->global->session_global_id,
1648                                   hex_encode_talloc(global_rec, key.dptr,
1649                                                     key.dsize),
1650                                   nt_errstr(status)));
1651                         error = status;
1652                 }
1653         }
1654         TALLOC_FREE(global_rec);
1655
1656         local_rec = session->db_rec;
1657         if (local_rec == NULL) {
1658                 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
1659                 TDB_DATA key;
1660
1661                 key = smbXsrv_session_local_id_to_key(session->local_id,
1662                                                       key_buf);
1663
1664                 local_rec = dbwrap_fetch_locked(table->local.db_ctx,
1665                                                 session, key);
1666                 if (local_rec == NULL) {
1667                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1668                                   "Failed to lock local key '%s'\n",
1669                                   session->global->session_global_id,
1670                                   hex_encode_talloc(local_rec, key.dptr,
1671                                                     key.dsize)));
1672                         error = NT_STATUS_INTERNAL_ERROR;
1673                 }
1674         }
1675
1676         if (local_rec != NULL) {
1677                 status = dbwrap_record_delete(local_rec);
1678                 if (!NT_STATUS_IS_OK(status)) {
1679                         TDB_DATA key = dbwrap_record_get_key(local_rec);
1680
1681                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1682                                   "failed to delete local key '%s': %s\n",
1683                                   session->global->session_global_id,
1684                                   hex_encode_talloc(local_rec, key.dptr,
1685                                                     key.dsize),
1686                                   nt_errstr(status)));
1687                         error = status;
1688                 }
1689                 table->local.num_sessions -= 1;
1690         }
1691         if (session->db_rec == NULL) {
1692                 TALLOC_FREE(local_rec);
1693         }
1694         session->db_rec = NULL;
1695
1696         if (session->compat) {
1697                 file_close_user(sconn, session->compat->vuid);
1698         }
1699
1700         if (session->tcon_table != NULL) {
1701                 /*
1702                  * Note: We only have a tcon_table for SMB2.
1703                  */
1704                 status = smb2srv_tcon_disconnect_all(session);
1705                 if (!NT_STATUS_IS_OK(status)) {
1706                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1707                                   "smb2srv_tcon_disconnect_all() failed: %s\n",
1708                                   session->global->session_global_id,
1709                                   nt_errstr(status)));
1710                         error = status;
1711                 }
1712         }
1713
1714         if (session->compat) {
1715                 invalidate_vuid(sconn, session->compat->vuid);
1716                 session->compat = NULL;
1717         }
1718
1719         return error;
1720 }
1721
1722 struct smbXsrv_session_logoff_all_state {
1723         NTSTATUS first_status;
1724         int errors;
1725 };
1726
1727 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1728                                                void *private_data);
1729
1730 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_connection *conn)
1731 {
1732         struct smbXsrv_session_table *table = conn->client->session_table;
1733         struct smbXsrv_session_logoff_all_state state;
1734         NTSTATUS status;
1735         int count = 0;
1736
1737         if (table == NULL) {
1738                 DEBUG(10, ("smbXsrv_session_logoff_all: "
1739                            "empty session_table, nothing to do.\n"));
1740                 return NT_STATUS_OK;
1741         }
1742
1743         ZERO_STRUCT(state);
1744
1745         status = dbwrap_traverse(table->local.db_ctx,
1746                                  smbXsrv_session_logoff_all_callback,
1747                                  &state, &count);
1748         if (!NT_STATUS_IS_OK(status)) {
1749                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1750                           "dbwrap_traverse() failed: %s\n",
1751                           nt_errstr(status)));
1752                 return status;
1753         }
1754
1755         if (!NT_STATUS_IS_OK(state.first_status)) {
1756                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1757                           "count[%d] errors[%d] first[%s]\n",
1758                           count, state.errors,
1759                           nt_errstr(state.first_status)));
1760                 return state.first_status;
1761         }
1762
1763         return NT_STATUS_OK;
1764 }
1765
1766 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1767                                                void *private_data)
1768 {
1769         struct smbXsrv_session_logoff_all_state *state =
1770                 (struct smbXsrv_session_logoff_all_state *)private_data;
1771         TDB_DATA val;
1772         void *ptr = NULL;
1773         struct smbXsrv_session *session = NULL;
1774         NTSTATUS status;
1775
1776         val = dbwrap_record_get_value(local_rec);
1777         if (val.dsize != sizeof(ptr)) {
1778                 status = NT_STATUS_INTERNAL_ERROR;
1779                 if (NT_STATUS_IS_OK(state->first_status)) {
1780                         state->first_status = status;
1781                 }
1782                 state->errors++;
1783                 return 0;
1784         }
1785
1786         memcpy(&ptr, val.dptr, val.dsize);
1787         session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1788
1789         session->db_rec = local_rec;
1790
1791         status = smbXsrv_session_clear_and_logoff(session);
1792         if (!NT_STATUS_IS_OK(status)) {
1793                 if (NT_STATUS_IS_OK(state->first_status)) {
1794                         state->first_status = status;
1795                 }
1796                 state->errors++;
1797                 return 0;
1798         }
1799
1800         return 0;
1801 }
1802
1803 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
1804 {
1805         /*
1806          * Allow a range from 1..65534 with 65534 values.
1807          */
1808         return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
1809                                           UINT16_MAX - 1);
1810 }
1811
1812 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
1813                                 uint16_t vuid, NTTIME now,
1814                                 struct smbXsrv_session **session)
1815 {
1816         struct smbXsrv_session_table *table = conn->client->session_table;
1817         uint32_t local_id = vuid;
1818
1819         return smbXsrv_session_local_lookup(table, conn, local_id, now,
1820                                             session);
1821 }
1822
1823 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
1824 {
1825         /*
1826          * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
1827          */
1828         return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
1829                                           UINT16_MAX - 1);
1830 }
1831
1832 static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
1833                                            /* conn: optional */
1834                                            struct smbXsrv_connection *conn,
1835                                            uint64_t session_id, NTTIME now,
1836                                            struct smbXsrv_session **session)
1837 {
1838         uint32_t local_id = session_id & UINT32_MAX;
1839         uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
1840
1841         if (local_zeros != 0) {
1842                 return NT_STATUS_USER_SESSION_DELETED;
1843         }
1844
1845         return smbXsrv_session_local_lookup(table, conn, local_id, now,
1846                                             session);
1847 }
1848
1849 NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
1850                                      uint64_t session_id, NTTIME now,
1851                                      struct smbXsrv_session **session)
1852 {
1853         struct smbXsrv_session_table *table = conn->client->session_table;
1854         return smb2srv_session_lookup_raw(table, conn, session_id, now,
1855                                           session);
1856 }
1857
1858 NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
1859                                        uint64_t session_id, NTTIME now,
1860                                        struct smbXsrv_session **session)
1861 {
1862         struct smbXsrv_session_table *table = client->session_table;
1863         return smb2srv_session_lookup_raw(table, NULL, session_id, now,
1864                                           session);
1865 }
1866
1867 struct smbXsrv_session_global_traverse_state {
1868         int (*fn)(struct smbXsrv_session_global0 *, void *);
1869         void *private_data;
1870 };
1871
1872 static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
1873 {
1874         int ret = -1;
1875         struct smbXsrv_session_global_traverse_state *state =
1876                 (struct smbXsrv_session_global_traverse_state*)data;
1877         TDB_DATA key = dbwrap_record_get_key(rec);
1878         TDB_DATA val = dbwrap_record_get_value(rec);
1879         DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
1880         struct smbXsrv_session_globalB global_blob;
1881         enum ndr_err_code ndr_err;
1882         TALLOC_CTX *frame = talloc_stackframe();
1883
1884         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
1885                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
1886         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1887                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1888                          "key '%s' ndr_pull_struct_blob - %s\n",
1889                          hex_encode_talloc(frame, key.dptr, key.dsize),
1890                          ndr_errstr(ndr_err)));
1891                 goto done;
1892         }
1893
1894         if (global_blob.version != SMBXSRV_VERSION_0) {
1895                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1896                          "key '%s' unsuported version - %d\n",
1897                          hex_encode_talloc(frame, key.dptr, key.dsize),
1898                          (int)global_blob.version));
1899                 goto done;
1900         }
1901
1902         global_blob.info.info0->db_rec = rec;
1903         ret = state->fn(global_blob.info.info0, state->private_data);
1904 done:
1905         TALLOC_FREE(frame);
1906         return ret;
1907 }
1908
1909 NTSTATUS smbXsrv_session_global_traverse(
1910                         int (*fn)(struct smbXsrv_session_global0 *, void *),
1911                         void *private_data)
1912 {
1913
1914         NTSTATUS status;
1915         int count = 0;
1916         struct smbXsrv_session_global_traverse_state state = {
1917                 .fn = fn,
1918                 .private_data = private_data,
1919         };
1920
1921         become_root();
1922         status = smbXsrv_session_global_init();
1923         if (!NT_STATUS_IS_OK(status)) {
1924                 unbecome_root();
1925                 DEBUG(0, ("Failed to initialize session_global: %s\n",
1926                           nt_errstr(status)));
1927                 return status;
1928         }
1929
1930         status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
1931                                       smbXsrv_session_global_traverse_fn,
1932                                       &state,
1933                                       &count);
1934         unbecome_root();
1935
1936         return status;
1937 }