source3/smbd/smb2_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) Jeremy Allison 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "system/network.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "lib/param/param.h"
  27 #include "../libcli/smb/smb_common.h"
  28 #include "../lib/tsocket/tsocket.h"
  29 #include "../lib/util/tevent_ntstatus.h"
  30 #include "smbprofile.h"
  31 #include "../lib/util/bitmap.h"
  32 #include "../librpc/gen_ndr/krb5pac.h"
  33 #include "lib/util/iov_buf.h"
  34 #include "auth.h"
  35 #include "libcli/smb/smbXcli_base.h"
  36
  37 #if defined(LINUX)
  38 /* SIOCOUTQ TIOCOUTQ are the same */
  39 #define __IOCTL_SEND_QUEUE_SIZE_OPCODE TIOCOUTQ
  40 #define __HAVE_TCP_INFO_RTO 1
  41 #define __ALLOW_MULTI_CHANNEL_SUPPORT 1
  42 #elif defined(FREEBSD)
  43 #define __IOCTL_SEND_QUEUE_SIZE_OPCODE FIONWRITE
  44 #define __HAVE_TCP_INFO_RTO 1
  45 #define __ALLOW_MULTI_CHANNEL_SUPPORT 1
  46 #endif
  47
  48 #include "lib/crypto/gnutls_helpers.h"
  49 #include <gnutls/gnutls.h>
  50 #include <gnutls/crypto.h>
  51
  52 #undef DBGC_CLASS
  53 #define DBGC_CLASS DBGC_SMB2
  54
  55 static void smbd_smb2_connection_handler(struct tevent_context *ev,
  56                                          struct tevent_fd *fde,
  57                                          uint16_t flags,
  58                                          void *private_data);
  59 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn);
  60
  61 static const struct smbd_smb2_dispatch_table {
  62         uint16_t opcode;
  63         const char *name;
  64         bool need_session;
  65         bool need_tcon;
  66         bool as_root;
  67         uint16_t fileid_ofs;
  68         bool allow_invalid_fileid;
  69         bool modify;
  70 } smbd_smb2_table[] = {
  71 #define _OP(o) .opcode = o, .name = #o
  72         {
  73                 _OP(SMB2_OP_NEGPROT),
  74                 .as_root = true,
  75         },{
  76                 _OP(SMB2_OP_SESSSETUP),
  77                 .as_root = true,
  78         },{
  79                 _OP(SMB2_OP_LOGOFF),
  80                 .need_session = true,
  81                 .as_root = true,
  82         },{
  83                 _OP(SMB2_OP_TCON),
  84                 .need_session = true,
  85                 /*
  86                  * This call needs to be run as root.
  87                  *
  88                  * smbd_smb2_request_process_tcon()
  89                  * calls make_connection_snum(), which will call
  90                  * change_to_user(), when needed.
  91                  */
  92                 .as_root = true,
  93         },{
  94                 _OP(SMB2_OP_TDIS),
  95                 .need_session = true,
  96                 .need_tcon = true,
  97                 .as_root = true,
  98         },{
  99                 _OP(SMB2_OP_CREATE),
 100                 .need_session = true,
 101                 .need_tcon = true,
 102         },{
 103                 _OP(SMB2_OP_CLOSE),
 104                 .need_session = true,
 105                 .need_tcon = true,
 106                 .fileid_ofs = 0x08,
 107         },{
 108                 _OP(SMB2_OP_FLUSH),
 109                 .need_session = true,
 110                 .need_tcon = true,
 111                 .fileid_ofs = 0x08,
 112         },{
 113                 _OP(SMB2_OP_READ),
 114                 .need_session = true,
 115                 .need_tcon = true,
 116                 .fileid_ofs = 0x10,
 117         },{
 118                 _OP(SMB2_OP_WRITE),
 119                 .need_session = true,
 120                 .need_tcon = true,
 121                 .fileid_ofs = 0x10,
 122                 .modify = true,
 123         },{
 124                 _OP(SMB2_OP_LOCK),
 125                 .need_session = true,
 126                 .need_tcon = true,
 127                 .fileid_ofs = 0x08,
 128         },{
 129                 _OP(SMB2_OP_IOCTL),
 130                 .need_session = true,
 131                 .need_tcon = true,
 132                 .fileid_ofs = 0x08,
 133                 .allow_invalid_fileid = true,
 134                 .modify = true,
 135         },{
 136                 _OP(SMB2_OP_CANCEL),
 137                 .as_root = true,
 138         },{
 139                 _OP(SMB2_OP_KEEPALIVE),
 140                 .as_root = true,
 141         },{
 142                 _OP(SMB2_OP_QUERY_DIRECTORY),
 143                 .need_session = true,
 144                 .need_tcon = true,
 145                 .fileid_ofs = 0x08,
 146         },{
 147                 _OP(SMB2_OP_NOTIFY),
 148                 .need_session = true,
 149                 .need_tcon = true,
 150                 .fileid_ofs = 0x08,
 151         },{
 152                 _OP(SMB2_OP_GETINFO),
 153                 .need_session = true,
 154                 .need_tcon = true,
 155                 .fileid_ofs = 0x18,
 156         },{
 157                 _OP(SMB2_OP_SETINFO),
 158                 .need_session = true,
 159                 .need_tcon = true,
 160                 .fileid_ofs = 0x10,
 161                 .modify = true,
 162         },{
 163                 _OP(SMB2_OP_BREAK),
 164                 .need_session = true,
 165                 .need_tcon = true,
 166                 /*
 167                  * we do not set
 168                  * .fileid_ofs here
 169                  * as LEASE breaks does not
 170                  * have a file id
 171                  */
 172         }
 173 };
 174
 175 const char *smb2_opcode_name(uint16_t opcode)
 176 {
 177         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
 178                 return "Bad SMB2 opcode";
 179         }
 180         return smbd_smb2_table[opcode].name;
 181 }
 182
 183 static const struct smbd_smb2_dispatch_table *smbd_smb2_call(uint16_t opcode)
 184 {
 185         const struct smbd_smb2_dispatch_table *ret = NULL;
 186
 187         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
 188                 return NULL;
 189         }
 190
 191         ret = &smbd_smb2_table[opcode];
 192
 193         SMB_ASSERT(ret->opcode == opcode);
 194
 195         return ret;
 196 }
 197
 198 static void print_req_vectors(const struct smbd_smb2_request *req)
 199 {
 200         int i;
 201
 202         for (i = 0; i < req->in.vector_count; i++) {
 203                 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
 204                         (unsigned int)i,
 205                         (unsigned int)req->in.vector[i].iov_len);
 206         }
 207         for (i = 0; i < req->out.vector_count; i++) {
 208                 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
 209                         (unsigned int)i,
 210                         (unsigned int)req->out.vector[i].iov_len);
 211         }
 212 }
 213
 214 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
 215 {
 216         if (size < (4 + SMB2_HDR_BODY)) {
 217                 return false;
 218         }
 219
 220         if (IVAL(inbuf, 4) != SMB2_MAGIC) {
 221                 return false;
 222         }
 223
 224         return true;
 225 }
 226
 227 bool smbd_smb2_is_compound(const struct smbd_smb2_request *req)
 228 {
 229         return req->in.vector_count >= (2*SMBD_SMB2_NUM_IOV_PER_REQ);
 230 }
 231
 232 static NTSTATUS smbd_initialize_smb2(struct smbXsrv_connection *xconn,
 233                                      uint64_t expected_seq_low)
 234 {
 235         int rc;
 236
 237         xconn->smb2.credits.seq_low = expected_seq_low;
 238         xconn->smb2.credits.seq_range = 1;
 239         xconn->smb2.credits.granted = 1;
 240         xconn->smb2.credits.max = lp_smb2_max_credits();
 241         xconn->smb2.credits.bitmap = bitmap_talloc(xconn,
 242                                                    xconn->smb2.credits.max);
 243         if (xconn->smb2.credits.bitmap == NULL) {
 244                 return NT_STATUS_NO_MEMORY;
 245         }
 246
 247         tevent_fd_set_close_fn(xconn->transport.fde, NULL);
 248         TALLOC_FREE(xconn->transport.fde);
 249
 250         xconn->transport.fde = tevent_add_fd(
 251                                         xconn->client->raw_ev_ctx,
 252                                         xconn,
 253                                         xconn->transport.sock,
 254                                         TEVENT_FD_READ,
 255                                         smbd_smb2_connection_handler,
 256                                         xconn);
 257         if (xconn->transport.fde == NULL) {
 258                 close(xconn->transport.sock);
 259                 xconn->transport.sock = -1;
 260                 return NT_STATUS_NO_MEMORY;
 261         }
 262         tevent_fd_set_auto_close(xconn->transport.fde);
 263
 264         /* Ensure child is set to non-blocking mode */
 265         rc = set_blocking(xconn->transport.sock, false);
 266         if (rc < 0) {
 267                 return NT_STATUS_INTERNAL_ERROR;
 268         }
 269
 270         return NT_STATUS_OK;
 271 }
 272
 273 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
 274 #define _smb2_setlen(_buf,len) do { \
 275         uint8_t *buf = (uint8_t *)_buf; \
 276         buf[0] = 0; \
 277         buf[1] = ((len)&0xFF0000)>>16; \
 278         buf[2] = ((len)&0xFF00)>>8; \
 279         buf[3] = (len)&0xFF; \
 280 } while (0)
 281
 282 static bool smb2_setup_nbt_length(struct iovec *vector, int count)
 283 {
 284         ssize_t len;
 285
 286         if (count == 0) {
 287                 return false;
 288         }
 289
 290         len = iov_buflen(vector+1, count-1);
 291
 292         if ((len == -1) || (len > 0xFFFFFF)) {
 293                 return false;
 294         }
 295
 296         _smb2_setlen(vector[0].iov_base, len);
 297         return true;
 298 }
 299
 300 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
 301 {
 302         TALLOC_FREE(req->first_enc_key);
 303         TALLOC_FREE(req->last_sign_key);
 304         return 0;
 305 }
 306
 307 void smb2_request_set_async_internal(struct smbd_smb2_request *req,
 308                                      bool async_internal)
 309 {
 310         req->async_internal = async_internal;
 311 }
 312
 313 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
 314 {
 315         TALLOC_CTX *mem_pool;
 316         struct smbd_smb2_request *req;
 317
 318 #if 0
 319         /* Enable this to find subtle valgrind errors. */
 320         mem_pool = talloc_init("smbd_smb2_request_allocate");
 321 #else
 322         mem_pool = talloc_tos();
 323 #endif
 324         if (mem_pool == NULL) {
 325                 return NULL;
 326         }
 327
 328         req = talloc_zero(mem_pool, struct smbd_smb2_request);
 329         if (req == NULL) {
 330                 talloc_free(mem_pool);
 331                 return NULL;
 332         }
 333         talloc_reparent(mem_pool, mem_ctx, req);
 334 #if 0
 335         TALLOC_FREE(mem_pool);
 336 #endif
 337
 338         req->last_session_id = UINT64_MAX;
 339         req->last_tid = UINT32_MAX;
 340
 341         talloc_set_destructor(req, smbd_smb2_request_destructor);
 342
 343         return req;
 344 }
 345
 346 static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *xconn,
 347                                                NTTIME now,
 348                                                uint8_t *buf,
 349                                                size_t buflen,
 350                                                struct smbd_smb2_request *req,
 351                                                struct iovec **piov,
 352                                                int *pnum_iov)
 353 {
 354         TALLOC_CTX *mem_ctx = req;
 355         struct iovec *iov;
 356         int num_iov = 1;
 357         size_t taken = 0;
 358         uint8_t *first_hdr = buf;
 359         size_t verified_buflen = 0;
 360         uint8_t *tf = NULL;
 361         size_t tf_len = 0;
 362
 363         /*
 364          * Note: index '0' is reserved for the transport protocol
 365          */
 366         iov = req->in._vector;
 367
 368         while (taken < buflen) {
 369                 size_t len = buflen - taken;
 370                 uint8_t *hdr = first_hdr + taken;
 371                 struct iovec *cur;
 372                 size_t full_size;
 373                 size_t next_command_ofs;
 374                 uint16_t body_size;
 375                 uint8_t *body = NULL;
 376                 uint32_t dyn_size;
 377                 uint8_t *dyn = NULL;
 378                 struct iovec *iov_alloc = NULL;
 379
 380                 if (iov != req->in._vector) {
 381                         iov_alloc = iov;
 382                 }
 383
 384                 if (verified_buflen > taken) {
 385                         len = verified_buflen - taken;
 386                 } else {
 387                         tf = NULL;
 388                         tf_len = 0;
 389                 }
 390
 391                 if (len < 4) {
 392                         DEBUG(10, ("%d bytes left, expected at least %d\n",
 393                                    (int)len, 4));
 394                         goto inval;
 395                 }
 396                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
 397                         struct smbXsrv_session *s = NULL;
 398                         uint64_t uid;
 399                         struct iovec tf_iov[2];
 400                         NTSTATUS status;
 401                         size_t enc_len;
 402
 403                         if (xconn->protocol < PROTOCOL_SMB3_00) {
 404                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
 405                                            "but dialect[0x%04X] is used\n",
 406                                            xconn->smb2.server.dialect));
 407                                 goto inval;
 408                         }
 409
 410                         if (xconn->smb2.server.cipher == 0) {
 411                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
 412                                            "but not negotiated "
 413                                            "client[0x%08X] server[0x%08X]\n",
 414                                            xconn->smb2.client.capabilities,
 415                                            xconn->smb2.server.capabilities));
 416                                 goto inval;
 417                         }
 418
 419                         if (len < SMB2_TF_HDR_SIZE) {
 420                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
 421                                            (int)len, SMB2_TF_HDR_SIZE));
 422                                 goto inval;
 423                         }
 424                         tf = hdr;
 425                         tf_len = SMB2_TF_HDR_SIZE;
 426                         taken += tf_len;
 427
 428                         hdr = first_hdr + taken;
 429                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
 430                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
 431
 432                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
 433                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
 434                                            (int)len,
 435                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
 436                                 goto inval;
 437                         }
 438
 439                         status = smb2srv_session_lookup_conn(xconn, uid, now,
 440                                                              &s);
 441                         if (s == NULL) {
 442                                 status = smb2srv_session_lookup_global(xconn->client,
 443                                                                        uid, req, &s);
 444                         }
 445                         if (s == NULL) {
 446                                 DEBUG(1, ("invalid session[%llu] in "
 447                                           "SMB2_TRANSFORM header\n",
 448                                            (unsigned long long)uid));
 449                                 TALLOC_FREE(iov_alloc);
 450                                 return NT_STATUS_USER_SESSION_DELETED;
 451                         }
 452
 453                         tf_iov[0].iov_base = (void *)tf;
 454                         tf_iov[0].iov_len = tf_len;
 455                         tf_iov[1].iov_base = (void *)hdr;
 456                         tf_iov[1].iov_len = enc_len;
 457
 458                         status = smb2_signing_decrypt_pdu(s->global->decryption_key,
 459                                                           tf_iov, 2);
 460                         if (!NT_STATUS_IS_OK(status)) {
 461                                 TALLOC_FREE(iov_alloc);
 462                                 return status;
 463                         }
 464
 465                         verified_buflen = taken + enc_len;
 466                         len = enc_len;
 467                 }
 468
 469                 /*
 470                  * We need the header plus the body length field
 471                  */
 472
 473                 if (len < SMB2_HDR_BODY + 2) {
 474
 475                         if ((len == 5) &&
 476                             (IVAL(hdr, 0) == SMB_SUICIDE_PACKET) &&
 477                             lp_parm_bool(-1, "smbd", "suicide mode", false)) {
 478                                 uint8_t exitcode = CVAL(hdr, 4);
 479                                 DBG_WARNING("SUICIDE: Exiting immediately "
 480                                             "with code %"PRIu8"\n",
 481                                             exitcode);
 482                                 exit(exitcode);
 483                         }
 484
 485                         DEBUG(10, ("%d bytes left, expected at least %d\n",
 486                                    (int)len, SMB2_HDR_BODY));
 487                         goto inval;
 488                 }
 489                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
 490                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
 491                                    IVAL(hdr, 0)));
 492                         goto inval;
 493                 }
 494                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
 495                         DEBUG(10, ("Got HDR len %d, expected %d\n",
 496                                    SVAL(hdr, 4), SMB2_HDR_BODY));
 497                         goto inval;
 498                 }
 499
 500                 full_size = len;
 501                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
 502                 body_size = SVAL(hdr, SMB2_HDR_BODY);
 503
 504                 if (next_command_ofs != 0) {
 505                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
 506                                 goto inval;
 507                         }
 508                         if (next_command_ofs > full_size) {
 509                                 goto inval;
 510                         }
 511                         full_size = next_command_ofs;
 512                 }
 513                 if (body_size < 2) {
 514                         goto inval;
 515                 }
 516                 body_size &= 0xfffe;
 517
 518                 if (body_size > (full_size - SMB2_HDR_BODY)) {
 519                         /*
 520                          * let the caller handle the error
 521                          */
 522                         body_size = full_size - SMB2_HDR_BODY;
 523                 }
 524                 body = hdr + SMB2_HDR_BODY;
 525                 dyn = body + body_size;
 526                 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
 527
 528                 if (num_iov >= ARRAY_SIZE(req->in._vector)) {
 529                         struct iovec *iov_tmp = NULL;
 530
 531                         iov_tmp = talloc_realloc(mem_ctx, iov_alloc,
 532                                                  struct iovec,
 533                                                  num_iov +
 534                                                  SMBD_SMB2_NUM_IOV_PER_REQ);
 535                         if (iov_tmp == NULL) {
 536                                 TALLOC_FREE(iov_alloc);
 537                                 return NT_STATUS_NO_MEMORY;
 538                         }
 539
 540                         if (iov_alloc == NULL) {
 541                                 memcpy(iov_tmp,
 542                                        req->in._vector,
 543                                        sizeof(req->in._vector));
 544                         }
 545
 546                         iov = iov_tmp;
 547                 }
 548                 cur = &iov[num_iov];
 549                 num_iov += SMBD_SMB2_NUM_IOV_PER_REQ;
 550
 551                 cur[SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
 552                 cur[SMBD_SMB2_TF_IOV_OFS].iov_len    = tf_len;
 553                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
 554                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
 555                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
 556                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_len  = body_size;
 557                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
 558                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_len   = dyn_size;
 559
 560                 taken += full_size;
 561         }
 562
 563         *piov = iov;
 564         *pnum_iov = num_iov;
 565         return NT_STATUS_OK;
 566
 567 inval:
 568         if (iov != req->in._vector) {
 569                 TALLOC_FREE(iov);
 570         }
 571         return NT_STATUS_INVALID_PARAMETER;
 572 }
 573
 574 static NTSTATUS smbd_smb2_request_create(struct smbXsrv_connection *xconn,
 575                                          const uint8_t *_inpdu, size_t size,
 576                                          struct smbd_smb2_request **_req)
 577 {
 578         struct smbd_server_connection *sconn = xconn->client->sconn;
 579         struct smbd_smb2_request *req;
 580         uint32_t protocol_version;
 581         uint8_t *inpdu = NULL;
 582         const uint8_t *inhdr = NULL;
 583         uint16_t cmd;
 584         uint32_t next_command_ofs;
 585         NTSTATUS status;
 586         NTTIME now;
 587
 588         if (size < (SMB2_HDR_BODY + 2)) {
 589                 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
 590                 return NT_STATUS_INVALID_PARAMETER;
 591         }
 592
 593         inhdr = _inpdu;
 594
 595         protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
 596         if (protocol_version != SMB2_MAGIC) {
 597                 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
 598                          protocol_version));
 599                 return NT_STATUS_INVALID_PARAMETER;
 600         }
 601
 602         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 603         if (cmd != SMB2_OP_NEGPROT) {
 604                 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
 605                          cmd));
 606                 return NT_STATUS_INVALID_PARAMETER;
 607         }
 608
 609         next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
 610         if (next_command_ofs != 0) {
 611                 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
 612                          next_command_ofs));
 613                 return NT_STATUS_INVALID_PARAMETER;
 614         }
 615
 616         req = smbd_smb2_request_allocate(xconn);
 617         if (req == NULL) {
 618                 return NT_STATUS_NO_MEMORY;
 619         }
 620         req->sconn = sconn;
 621         req->xconn = xconn;
 622
 623         inpdu = talloc_memdup(req, _inpdu, size);
 624         if (inpdu == NULL) {
 625                 return NT_STATUS_NO_MEMORY;
 626         }
 627
 628         req->request_time = timeval_current();
 629         now = timeval_to_nttime(&req->request_time);
 630
 631         status = smbd_smb2_inbuf_parse_compound(xconn,
 632                                                 now,
 633                                                 inpdu,
 634                                                 size,
 635                                                 req, &req->in.vector,
 636                                                 &req->in.vector_count);
 637         if (!NT_STATUS_IS_OK(status)) {
 638                 TALLOC_FREE(req);
 639                 return status;
 640         }
 641
 642         req->current_idx = 1;
 643
 644         *_req = req;
 645         return NT_STATUS_OK;
 646 }
 647
 648 static bool smb2_validate_sequence_number(struct smbXsrv_connection *xconn,
 649                                           uint64_t message_id, uint64_t seq_id)
 650 {
 651         struct bitmap *credits_bm = xconn->smb2.credits.bitmap;
 652         unsigned int offset;
 653         uint64_t seq_tmp;
 654
 655         seq_tmp = xconn->smb2.credits.seq_low;
 656         if (seq_id < seq_tmp) {
 657                 DBGC_ERR(DBGC_SMB2_CREDITS,
 658                         "smb2_validate_sequence_number: bad message_id "
 659                         "%llu (sequence id %llu) "
 660                         "(granted = %u, low = %llu, range = %u)\n",
 661                         (unsigned long long)message_id,
 662                         (unsigned long long)seq_id,
 663                         (unsigned int)xconn->smb2.credits.granted,
 664                         (unsigned long long)xconn->smb2.credits.seq_low,
 665                         (unsigned int)xconn->smb2.credits.seq_range);
 666                 return false;
 667         }
 668
 669         seq_tmp += xconn->smb2.credits.seq_range;
 670         if (seq_id >= seq_tmp) {
 671                 DBGC_ERR(DBGC_SMB2_CREDITS,
 672                         "smb2_validate_sequence_number: bad message_id "
 673                         "%llu (sequence id %llu) "
 674                         "(granted = %u, low = %llu, range = %u)\n",
 675                         (unsigned long long)message_id,
 676                         (unsigned long long)seq_id,
 677                         (unsigned int)xconn->smb2.credits.granted,
 678                         (unsigned long long)xconn->smb2.credits.seq_low,
 679                         (unsigned int)xconn->smb2.credits.seq_range);
 680                 return false;
 681         }
 682
 683         offset = seq_id % xconn->smb2.credits.max;
 684
 685         if (bitmap_query(credits_bm, offset)) {
 686                 DBGC_ERR(DBGC_SMB2_CREDITS,
 687                         "smb2_validate_sequence_number: duplicate message_id "
 688                         "%llu (sequence id %llu) "
 689                         "(granted = %u, low = %llu, range = %u) "
 690                         "(bm offset %u)\n",
 691                         (unsigned long long)message_id,
 692                         (unsigned long long)seq_id,
 693                         (unsigned int)xconn->smb2.credits.granted,
 694                         (unsigned long long)xconn->smb2.credits.seq_low,
 695                         (unsigned int)xconn->smb2.credits.seq_range,
 696                         offset);
 697                 return false;
 698         }
 699
 700         /* Mark the message_ids as seen in the bitmap. */
 701         bitmap_set(credits_bm, offset);
 702
 703         if (seq_id != xconn->smb2.credits.seq_low) {
 704                 return true;
 705         }
 706
 707         /*
 708          * Move the window forward by all the message_id's
 709          * already seen.
 710          */
 711         while (bitmap_query(credits_bm, offset)) {
 712                 DBGC_DEBUG(DBGC_SMB2_CREDITS,
 713                           "smb2_validate_sequence_number: clearing "
 714                           "id %llu (position %u) from bitmap\n",
 715                           (unsigned long long)(xconn->smb2.credits.seq_low),
 716                           offset);
 717                 bitmap_clear(credits_bm, offset);
 718
 719                 xconn->smb2.credits.seq_low += 1;
 720                 xconn->smb2.credits.seq_range -= 1;
 721                 offset = xconn->smb2.credits.seq_low % xconn->smb2.credits.max;
 722         }
 723
 724         return true;
 725 }
 726
 727 static bool smb2_validate_message_id(struct smbXsrv_connection *xconn,
 728                                      const uint8_t *inhdr)
 729 {
 730         uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
 731         uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
 732         uint16_t credit_charge = 1;
 733         uint64_t i;
 734
 735         if (opcode == SMB2_OP_CANCEL) {
 736                 /* SMB2_CANCEL requests by definition resend messageids. */
 737                 return true;
 738         }
 739
 740         if (xconn->smb2.credits.multicredit) {
 741                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
 742                 credit_charge = MAX(credit_charge, 1);
 743         }
 744
 745         DEBUGC(11,
 746                    DBGC_SMB2_CREDITS,
 747                    ("smb2_validate_message_id: mid %llu (charge %llu), "
 748                    "credits_granted %llu, "
 749                    "seqnum low/range: %llu/%llu\n",
 750                    (unsigned long long) message_id,
 751                    (unsigned long long) credit_charge,
 752                    (unsigned long long) xconn->smb2.credits.granted,
 753                    (unsigned long long) xconn->smb2.credits.seq_low,
 754                    (unsigned long long) xconn->smb2.credits.seq_range));
 755
 756         if (xconn->smb2.credits.granted < credit_charge) {
 757                 DBGC_ERR(DBGC_SMB2_CREDITS,
 758                           "smb2_validate_message_id: client used more "
 759                           "credits than granted, mid %llu, charge %llu, "
 760                           "credits_granted %llu, "
 761                           "seqnum low/range: %llu/%llu\n",
 762                           (unsigned long long) message_id,
 763                           (unsigned long long) credit_charge,
 764                           (unsigned long long) xconn->smb2.credits.granted,
 765                           (unsigned long long) xconn->smb2.credits.seq_low,
 766                           (unsigned long long) xconn->smb2.credits.seq_range);
 767                 return false;
 768         }
 769
 770         /*
 771          * now check the message ids
 772          *
 773          * for multi-credit requests we need to check all current mid plus
 774          * the implicit mids caused by the credit charge
 775          * e.g. current mid = 15, charge 5 => mark 15-19 as used
 776          */
 777
 778         for (i = 0; i <= (credit_charge-1); i++) {
 779                 uint64_t id = message_id + i;
 780                 bool ok;
 781
 782                 DEBUGC(11,
 783                            DBGC_SMB2_CREDITS,
 784                            ("Iterating mid %llu charge %u (sequence %llu)\n",
 785                            (unsigned long long)message_id,
 786                            credit_charge,
 787                            (unsigned long long)id));
 788
 789                 ok = smb2_validate_sequence_number(xconn, message_id, id);
 790                 if (!ok) {
 791                         return false;
 792                 }
 793         }
 794
 795         /* substract used credits */
 796         xconn->smb2.credits.granted -= credit_charge;
 797
 798         return true;
 799 }
 800
 801 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
 802 {
 803         int count;
 804         int idx;
 805
 806         count = req->in.vector_count;
 807
 808         if (count < 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
 809                 /* It's not a SMB2 request */
 810                 return NT_STATUS_INVALID_PARAMETER;
 811         }
 812
 813         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 814                 struct iovec *hdr = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
 815                 struct iovec *body = SMBD_SMB2_IDX_BODY_IOV(req,in,idx);
 816                 const uint8_t *inhdr = NULL;
 817
 818                 if (hdr->iov_len != SMB2_HDR_BODY) {
 819                         return NT_STATUS_INVALID_PARAMETER;
 820                 }
 821
 822                 if (body->iov_len < 2) {
 823                         return NT_STATUS_INVALID_PARAMETER;
 824                 }
 825
 826                 inhdr = (const uint8_t *)hdr->iov_base;
 827
 828                 /* Check the SMB2 header */
 829                 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
 830                         return NT_STATUS_INVALID_PARAMETER;
 831                 }
 832
 833                 if (!smb2_validate_message_id(req->xconn, inhdr)) {
 834                         return NT_STATUS_INVALID_PARAMETER;
 835                 }
 836         }
 837
 838         return NT_STATUS_OK;
 839 }
 840
 841 static void smb2_set_operation_credit(struct smbXsrv_connection *xconn,
 842                                       const struct iovec *in_vector,
 843                                       struct iovec *out_vector)
 844 {
 845         const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
 846         uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
 847         uint16_t credit_charge = 1;
 848         uint16_t credits_requested;
 849         uint32_t out_flags;
 850         uint16_t cmd;
 851         NTSTATUS out_status;
 852         uint16_t credits_granted = 0;
 853         uint64_t credits_possible;
 854         uint16_t current_max_credits;
 855
 856         /*
 857          * first we grant only 1/16th of the max range.
 858          *
 859          * Windows also starts with the 1/16th and then grants
 860          * more later. I was only able to trigger higher
 861          * values, when using a very high credit charge.
 862          *
 863          * TODO: scale up depending on load, free memory
 864          *       or other stuff.
 865          *       Maybe also on the relationship between number
 866          *       of requests and the used sequence number.
 867          *       Which means we would grant more credits
 868          *       for client which use multi credit requests.
 869          *
 870          * The above is what Windows Server < 2016 is doing,
 871          * but new servers use all credits (8192 by default).
 872          */
 873         current_max_credits = xconn->smb2.credits.max;
 874         current_max_credits = MAX(current_max_credits, 1);
 875
 876         if (xconn->smb2.credits.multicredit) {
 877                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
 878                 credit_charge = MAX(credit_charge, 1);
 879         }
 880
 881         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 882         credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
 883         credits_requested = MAX(credits_requested, 1);
 884         out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
 885         out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
 886
 887         SMB_ASSERT(xconn->smb2.credits.max >= xconn->smb2.credits.granted);
 888
 889         if (xconn->smb2.credits.max < credit_charge) {
 890                 smbd_server_connection_terminate(xconn,
 891                         "client error: credit charge > max credits\n");
 892                 return;
 893         }
 894
 895         if (out_flags & SMB2_HDR_FLAG_ASYNC) {
 896                 /*
 897                  * In case we already send an async interim
 898                  * response, we should not grant
 899                  * credits on the final response.
 900                  */
 901                 credits_granted = 0;
 902         } else {
 903                 uint16_t additional_possible =
 904                         xconn->smb2.credits.max - credit_charge;
 905                 uint16_t additional_max = 0;
 906                 uint16_t additional_credits = credits_requested - 1;
 907
 908                 switch (cmd) {
 909                 case SMB2_OP_NEGPROT:
 910                         break;
 911                 case SMB2_OP_SESSSETUP:
 912                         /*
 913                          * Windows 2012 RC1 starts to grant
 914                          * additional credits
 915                          * with a successful session setup
 916                          */
 917                         if (NT_STATUS_IS_OK(out_status)) {
 918                                 additional_max = xconn->smb2.credits.max;
 919                         }
 920                         break;
 921                 default:
 922                         /*
 923                          * Windows Server < 2016 and older Samba versions
 924                          * used to only grant additional credits in
 925                          * chunks of 32 credits.
 926                          *
 927                          * But we match Windows Server 2016 and grant
 928                          * all credits as requested.
 929                          */
 930                         additional_max = xconn->smb2.credits.max;
 931                         break;
 932                 }
 933
 934                 additional_max = MIN(additional_max, additional_possible);
 935                 additional_credits = MIN(additional_credits, additional_max);
 936
 937                 credits_granted = credit_charge + additional_credits;
 938         }
 939
 940         /*
 941          * sequence numbers should not wrap
 942          *
 943          * 1. calculate the possible credits until
 944          *    the sequence numbers start to wrap on 64-bit.
 945          *
 946          * 2. UINT64_MAX is used for Break Notifications.
 947          *
 948          * 2. truncate the possible credits to the maximum
 949          *    credits we want to grant to the client in total.
 950          *
 951          * 3. remove the range we'll already granted to the client
 952          *    this makes sure the client consumes the lowest sequence
 953          *    number, before we can grant additional credits.
 954          */
 955         credits_possible = UINT64_MAX - xconn->smb2.credits.seq_low;
 956         if (credits_possible > 0) {
 957                 /* remove UINT64_MAX */
 958                 credits_possible -= 1;
 959         }
 960         credits_possible = MIN(credits_possible, current_max_credits);
 961         credits_possible -= xconn->smb2.credits.seq_range;
 962
 963         credits_granted = MIN(credits_granted, credits_possible);
 964
 965         SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
 966         xconn->smb2.credits.granted += credits_granted;
 967         xconn->smb2.credits.seq_range += credits_granted;
 968
 969         DBGC_DEBUG(DBGC_SMB2_CREDITS,
 970                 "smb2_set_operation_credit: requested %u, charge %u, "
 971                 "granted %u, current possible/max %u/%u, "
 972                 "total granted/max/low/range %u/%u/%llu/%u\n",
 973                 (unsigned int)credits_requested,
 974                 (unsigned int)credit_charge,
 975                 (unsigned int)credits_granted,
 976                 (unsigned int)credits_possible,
 977                 (unsigned int)current_max_credits,
 978                 (unsigned int)xconn->smb2.credits.granted,
 979                 (unsigned int)xconn->smb2.credits.max,
 980                 (unsigned long long)xconn->smb2.credits.seq_low,
 981                 (unsigned int)xconn->smb2.credits.seq_range);
 982 }
 983
 984 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
 985                                 struct smbd_smb2_request *outreq)
 986 {
 987         int count, idx;
 988         uint16_t total_credits = 0;
 989
 990         count = outreq->out.vector_count;
 991
 992         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 993                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(inreq,in,idx);
 994                 struct iovec *outhdr_v = SMBD_SMB2_IDX_HDR_IOV(outreq,out,idx);
 995                 uint8_t *outhdr = (uint8_t *)outhdr_v->iov_base;
 996
 997                 smb2_set_operation_credit(outreq->xconn, inhdr_v, outhdr_v);
 998
 999                 /* To match Windows, count up what we
1000                    just granted. */
1001                 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
1002                 /* Set to zero in all but the last reply. */
1003                 if (idx + SMBD_SMB2_NUM_IOV_PER_REQ < count) {
1004                         SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
1005                 } else {
1006                         SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
1007                 }
1008         }
1009 }
1010
1011 DATA_BLOB smbd_smb2_generate_outbody(struct smbd_smb2_request *req, size_t size)
1012 {
1013         if (req->current_idx <= 1) {
1014                 if (size <= sizeof(req->out._body)) {
1015                         return data_blob_const(req->out._body, size);
1016                 }
1017         }
1018
1019         return data_blob_talloc(req, NULL, size);
1020 }
1021
1022 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
1023 {
1024         struct smbXsrv_connection *xconn = req->xconn;
1025         TALLOC_CTX *mem_ctx;
1026         struct iovec *vector;
1027         int count;
1028         int idx;
1029         bool ok;
1030
1031         count = req->in.vector_count;
1032         if (count <= ARRAY_SIZE(req->out._vector)) {
1033                 mem_ctx = req;
1034                 vector = req->out._vector;
1035         } else {
1036                 vector = talloc_zero_array(req, struct iovec, count);
1037                 if (vector == NULL) {
1038                         return NT_STATUS_NO_MEMORY;
1039                 }
1040                 mem_ctx = vector;
1041         }
1042
1043         vector[0].iov_base      = req->out.nbt_hdr;
1044         vector[0].iov_len       = 4;
1045         SIVAL(req->out.nbt_hdr, 0, 0);
1046
1047         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
1048                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
1049                 const uint8_t *inhdr = (const uint8_t *)inhdr_v->iov_base;
1050                 uint8_t *outhdr = NULL;
1051                 uint8_t *outbody = NULL;
1052                 uint32_t next_command_ofs = 0;
1053                 struct iovec *current = &vector[idx];
1054
1055                 if ((idx + SMBD_SMB2_NUM_IOV_PER_REQ) < count) {
1056                         /* we have a next command -
1057                          * setup for the error case. */
1058                         next_command_ofs = SMB2_HDR_BODY + 9;
1059                 }
1060
1061                 if (idx == 1) {
1062                         outhdr = req->out._hdr;
1063                 } else {
1064                         outhdr = talloc_zero_array(mem_ctx, uint8_t,
1065                                                    OUTVEC_ALLOC_SIZE);
1066                         if (outhdr == NULL) {
1067                                 return NT_STATUS_NO_MEMORY;
1068                         }
1069                 }
1070
1071                 outbody = outhdr + SMB2_HDR_BODY;
1072
1073                 /*
1074                  * SMBD_SMB2_TF_IOV_OFS might be used later
1075                  */
1076                 current[SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
1077                 current[SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
1078
1079                 current[SMBD_SMB2_HDR_IOV_OFS].iov_base  = (void *)outhdr;
1080                 current[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
1081
1082                 current[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)outbody;
1083                 current[SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
1084
1085                 current[SMBD_SMB2_DYN_IOV_OFS].iov_base  = NULL;
1086                 current[SMBD_SMB2_DYN_IOV_OFS].iov_len   = 0;
1087
1088                 /* setup the SMB2 header */
1089                 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID,     SMB2_MAGIC);
1090                 SSVAL(outhdr, SMB2_HDR_LENGTH,          SMB2_HDR_BODY);
1091                 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
1092                       SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
1093                 SIVAL(outhdr, SMB2_HDR_STATUS,
1094                       NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
1095                 SSVAL(outhdr, SMB2_HDR_OPCODE,
1096                       SVAL(inhdr, SMB2_HDR_OPCODE));
1097                 SIVAL(outhdr, SMB2_HDR_FLAGS,
1098                       IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
1099                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND,    next_command_ofs);
1100                 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
1101                       BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
1102                 SIVAL(outhdr, SMB2_HDR_PID,
1103                       IVAL(inhdr, SMB2_HDR_PID));
1104                 SIVAL(outhdr, SMB2_HDR_TID,
1105                       IVAL(inhdr, SMB2_HDR_TID));
1106                 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
1107                       BVAL(inhdr, SMB2_HDR_SESSION_ID));
1108                 memcpy(outhdr + SMB2_HDR_SIGNATURE,
1109                        inhdr + SMB2_HDR_SIGNATURE, 16);
1110
1111                 /* setup error body header */
1112                 SSVAL(outbody, 0x00, 0x08 + 1);
1113                 SSVAL(outbody, 0x02, 0);
1114                 SIVAL(outbody, 0x04, 0);
1115         }
1116
1117         req->out.vector = vector;
1118         req->out.vector_count = count;
1119
1120         /* setup the length of the NBT packet */
1121         ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
1122         if (!ok) {
1123                 return NT_STATUS_INVALID_PARAMETER_MIX;
1124         }
1125
1126         DLIST_ADD_END(xconn->smb2.requests, req);
1127
1128         return NT_STATUS_OK;
1129 }
1130
1131 bool smbXsrv_server_multi_channel_enabled(void)
1132 {
1133         bool enabled = lp_server_multi_channel_support();
1134 #ifndef __ALLOW_MULTI_CHANNEL_SUPPORT
1135         bool forced = false;
1136         struct loadparm_context *lp_ctx = loadparm_init_s3(NULL, loadparm_s3_helpers());
1137         bool unspecified = lpcfg_parm_is_unspecified(lp_ctx, "server multi channel support");
1138         if (unspecified) {
1139                 enabled = false;
1140         }
1141         /*
1142          * If we don't have support from the kernel
1143          * to ask for the un-acked number of bytes
1144          * in the socket send queue, we better
1145          * don't support multi-channel.
1146          */
1147         forced = lp_parm_bool(-1, "force", "server multi channel support", false);
1148         if (enabled && !forced) {
1149                 D_NOTICE("'server multi channel support' enabled "
1150                          "but not supported on %s (%s)\n",
1151                          SYSTEM_UNAME_SYSNAME, SYSTEM_UNAME_RELEASE);
1152                 DEBUGADD(DBGLVL_NOTICE, ("Please report this on "
1153                         "https://bugzilla.samba.org/show_bug.cgi?id=11897\n"));
1154                 enabled = false;
1155         }
1156         TALLOC_FREE(lp_ctx);
1157 #endif /* ! __ALLOW_MULTI_CHANNEL_SUPPORT */
1158         return enabled;
1159 }
1160
1161 static NTSTATUS smbXsrv_connection_get_rto_usecs(struct smbXsrv_connection *xconn,
1162                                                  uint32_t *_rto_usecs)
1163 {
1164         /*
1165          * Define an Retransmission Timeout
1166          * of 1 second, if there's no way for the
1167          * kernel to tell us the current value.
1168          */
1169         uint32_t rto_usecs = 1000000;
1170
1171 #ifdef __HAVE_TCP_INFO_RTO
1172         {
1173                 struct tcp_info info;
1174                 socklen_t ilen = sizeof(info);
1175                 int ret;
1176
1177                 ZERO_STRUCT(info);
1178                 ret = getsockopt(xconn->transport.sock,
1179                                  IPPROTO_TCP, TCP_INFO,
1180                                  (void *)&info, &ilen);
1181                 if (ret != 0) {
1182                         int saved_errno = errno;
1183                         NTSTATUS status = map_nt_error_from_unix(errno);
1184                         DBG_ERR("getsockopt(TCP_INFO) errno[%d/%s] -s %s\n",
1185                                 saved_errno, strerror(saved_errno),
1186                                 nt_errstr(status));
1187                         return status;
1188                 }
1189
1190                 DBG_DEBUG("tcpi_rto[%u] tcpi_rtt[%u] tcpi_rttvar[%u]\n",
1191                           (unsigned)info.tcpi_rto,
1192                           (unsigned)info.tcpi_rtt,
1193                           (unsigned)info.tcpi_rttvar);
1194                 rto_usecs = info.tcpi_rto;
1195         }
1196 #endif /* __HAVE_TCP_INFO_RTO */
1197
1198         rto_usecs = MAX(rto_usecs,  200000); /* at least 0.2s */
1199         rto_usecs = MIN(rto_usecs, 1000000); /* at max   1.0s */
1200         *_rto_usecs = rto_usecs;
1201         return NT_STATUS_OK;
1202 }
1203
1204 static NTSTATUS smbXsrv_connection_get_acked_bytes(struct smbXsrv_connection *xconn,
1205                                                    uint64_t *_acked_bytes)
1206 {
1207         /*
1208          * Unless the kernel has an interface
1209          * to reveal the number of un-acked bytes
1210          * in the socket send queue, we'll assume
1211          * everything is already acked.
1212          *
1213          * But that would mean that we better don't
1214          * pretent to support multi-channel.
1215          */
1216         uint64_t unacked_bytes = 0;
1217
1218         *_acked_bytes = 0;
1219
1220         if (xconn->ack.force_unacked_timeout) {
1221                 /*
1222                  * Smbtorture tries to test channel failures...
1223                  * Just pretend nothing was acked...
1224                  */
1225                 DBG_INFO("Simulating channel failure: "
1226                          "xconn->ack.unacked_bytes[%llu]\n",
1227                          (unsigned long long)xconn->ack.unacked_bytes);
1228                 return NT_STATUS_OK;
1229         }
1230
1231 #ifdef __IOCTL_SEND_QUEUE_SIZE_OPCODE
1232         {
1233                 int value = 0;
1234                 int ret;
1235
1236                 /*
1237                  * If we have kernel support to get
1238                  * the number of bytes waiting in
1239                  * the socket's send queue, we
1240                  * use that in order to find out
1241                  * the number of unacked bytes.
1242                  */
1243                 ret = ioctl(xconn->transport.sock,
1244                             __IOCTL_SEND_QUEUE_SIZE_OPCODE,
1245                             &value);
1246                 if (ret != 0) {
1247                         int saved_errno = errno;
1248                         NTSTATUS status = map_nt_error_from_unix(saved_errno);
1249                         DBG_ERR("Failed to get the SEND_QUEUE_SIZE - "
1250                                 "errno %d (%s) - %s\n",
1251                                 saved_errno, strerror(saved_errno),
1252                                 nt_errstr(status));
1253                         return status;
1254                 }
1255
1256                 if (value < 0) {
1257                         DBG_ERR("xconn->ack.unacked_bytes[%llu] value[%d]\n",
1258                                 (unsigned long long)xconn->ack.unacked_bytes,
1259                                 value);
1260                         return NT_STATUS_INTERNAL_ERROR;
1261                 }
1262                 unacked_bytes = value;
1263         }
1264 #endif
1265         if (xconn->ack.unacked_bytes == 0) {
1266                 xconn->ack.unacked_bytes = unacked_bytes;
1267                 return NT_STATUS_OK;
1268         }
1269
1270         if (xconn->ack.unacked_bytes < unacked_bytes) {
1271                 DBG_ERR("xconn->ack.unacked_bytes[%llu] unacked_bytes[%llu]\n",
1272                         (unsigned long long)xconn->ack.unacked_bytes,
1273                         (unsigned long long)unacked_bytes);
1274                 return NT_STATUS_INTERNAL_ERROR;
1275         }
1276
1277         *_acked_bytes = xconn->ack.unacked_bytes - unacked_bytes;
1278         xconn->ack.unacked_bytes = unacked_bytes;
1279         return NT_STATUS_OK;
1280 }
1281
1282 static void smbd_smb2_send_queue_ack_fail(struct smbd_smb2_send_queue **queue,
1283                                           NTSTATUS status)
1284 {
1285         struct smbd_smb2_send_queue *e = NULL;
1286         struct smbd_smb2_send_queue *n = NULL;
1287
1288         for (e = *queue; e != NULL; e = n) {
1289                 n = e->next;
1290
1291                 DLIST_REMOVE(*queue, e);
1292                 if (e->ack.req != NULL) {
1293                         tevent_req_nterror(e->ack.req, status);
1294                 }
1295         }
1296 }
1297
1298 static NTSTATUS smbd_smb2_send_queue_ack_bytes(struct smbd_smb2_send_queue **queue,
1299                                                uint64_t acked_bytes)
1300 {
1301         struct smbd_smb2_send_queue *e = NULL;
1302         struct smbd_smb2_send_queue *n = NULL;
1303
1304         for (e = *queue; e != NULL; e = n) {
1305                 bool expired;
1306
1307                 n = e->next;
1308
1309                 if (e->ack.req == NULL) {
1310                         continue;
1311                 }
1312
1313                 if (e->ack.required_acked_bytes <= acked_bytes) {
1314                         e->ack.required_acked_bytes = 0;
1315                         DLIST_REMOVE(*queue, e);
1316                         tevent_req_done(e->ack.req);
1317                         continue;
1318                 }
1319                 e->ack.required_acked_bytes -= acked_bytes;
1320
1321                 expired = timeval_expired(&e->ack.timeout);
1322                 if (expired) {
1323                         return NT_STATUS_IO_TIMEOUT;
1324                 }
1325         }
1326
1327         return NT_STATUS_OK;
1328 }
1329
1330 static NTSTATUS smbd_smb2_check_ack_queue(struct smbXsrv_connection *xconn)
1331 {
1332         uint64_t acked_bytes = 0;
1333         NTSTATUS status;
1334
1335         status = smbXsrv_connection_get_acked_bytes(xconn, &acked_bytes);
1336         if (!NT_STATUS_IS_OK(status)) {
1337                 return status;
1338         }
1339
1340         status = smbd_smb2_send_queue_ack_bytes(&xconn->ack.queue, acked_bytes);
1341         if (!NT_STATUS_IS_OK(status)) {
1342                 return status;
1343         }
1344
1345         status = smbd_smb2_send_queue_ack_bytes(&xconn->smb2.send_queue, 0);
1346         if (!NT_STATUS_IS_OK(status)) {
1347                 return status;
1348         }
1349
1350         return NT_STATUS_OK;
1351 }
1352
1353 static void smbXsrv_connection_ack_checker(struct tevent_req *subreq)
1354 {
1355         struct smbXsrv_connection *xconn =
1356                 tevent_req_callback_data(subreq,
1357                 struct smbXsrv_connection);
1358         struct smbXsrv_client *client = xconn->client;
1359         struct timeval next_check;
1360         NTSTATUS status;
1361         bool ok;
1362
1363         xconn->ack.checker_subreq = NULL;
1364
1365         ok = tevent_wakeup_recv(subreq);
1366         TALLOC_FREE(subreq);
1367         if (!ok) {
1368                 smbd_server_connection_terminate(xconn,
1369                                                  "tevent_wakeup_recv() failed");
1370                 return;
1371         }
1372
1373         status = smbd_smb2_check_ack_queue(xconn);
1374         if (!NT_STATUS_IS_OK(status)) {
1375                 smbd_server_connection_terminate(xconn, nt_errstr(status));
1376                 return;
1377         }
1378
1379         next_check = timeval_current_ofs_usec(xconn->ack.rto_usecs);
1380         xconn->ack.checker_subreq = tevent_wakeup_send(xconn,
1381                                                        client->raw_ev_ctx,
1382                                                        next_check);
1383         if (xconn->ack.checker_subreq == NULL) {
1384                 smbd_server_connection_terminate(xconn,
1385                                                  "tevent_wakeup_send() failed");
1386                 return;
1387         }
1388         tevent_req_set_callback(xconn->ack.checker_subreq,
1389                                 smbXsrv_connection_ack_checker,
1390                                 xconn);
1391 }
1392
1393 static NTSTATUS smbXsrv_client_pending_breaks_updated(struct smbXsrv_client *client)
1394 {
1395         struct smbXsrv_connection *xconn = NULL;
1396
1397         for (xconn = client->connections; xconn != NULL; xconn = xconn->next) {
1398                 struct timeval next_check;
1399                 uint64_t acked_bytes = 0;
1400                 NTSTATUS status;
1401
1402                 /*
1403                  * A new 'pending break cycle' starts
1404                  * with a first pending break and lasts until
1405                  * all pending breaks are finished.
1406                  *
1407                  * This is typically a very short time,
1408                  * the value of one retransmission timeout.
1409                  */
1410
1411                 if (client->pending_breaks == NULL) {
1412                         /*
1413                          * No more pending breaks, remove a pending
1414                          * checker timer
1415                          */
1416                         TALLOC_FREE(xconn->ack.checker_subreq);
1417                         continue;
1418                 }
1419
1420                 if (xconn->ack.checker_subreq != NULL) {
1421                         /*
1422                          * The cycle already started =>
1423                          * nothing todo
1424                          */
1425                         continue;
1426                 }
1427
1428                 /*
1429                  * Get the current retransmission timeout value.
1430                  *
1431                  * It may change over time, but fetching it once
1432                  * per 'pending break' cycled should be enough.
1433                  */
1434                 status = smbXsrv_connection_get_rto_usecs(xconn,
1435                                                           &xconn->ack.rto_usecs);
1436                 if (!NT_STATUS_IS_OK(status)) {
1437                         return status;
1438                 }
1439
1440                 /*
1441                  * At the start of the cycle we reset the
1442                  * unacked_bytes counter (first to 0 and
1443                  * within smbXsrv_connection_get_acked_bytes()
1444                  * to the current value in the kernel
1445                  * send queue.
1446                  */
1447                 xconn->ack.unacked_bytes = 0;
1448                 status = smbXsrv_connection_get_acked_bytes(xconn, &acked_bytes);
1449                 if (!NT_STATUS_IS_OK(status)) {
1450                         return status;
1451                 }
1452
1453                 /*
1454                  * We setup a timer in order to check for
1455                  * acked bytes after one retransmission timeout.
1456                  *
1457                  * The code that sets up the send_queue.ack.timeout
1458                  * uses a multiple of the retransmission timeout.
1459                  */
1460                 next_check = timeval_current_ofs_usec(xconn->ack.rto_usecs);
1461                 xconn->ack.checker_subreq = tevent_wakeup_send(xconn,
1462                                                         client->raw_ev_ctx,
1463                                                         next_check);
1464                 if (xconn->ack.checker_subreq == NULL) {
1465                         return NT_STATUS_NO_MEMORY;
1466                 }
1467                 tevent_req_set_callback(xconn->ack.checker_subreq,
1468                                         smbXsrv_connection_ack_checker,
1469                                         xconn);
1470         }
1471
1472         return NT_STATUS_OK;
1473 }
1474
1475 void smbXsrv_connection_disconnect_transport(struct smbXsrv_connection *xconn,
1476                                              NTSTATUS status)
1477 {
1478         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1479                 return;
1480         }
1481
1482         xconn->transport.status = status;
1483         TALLOC_FREE(xconn->transport.fde);
1484         if (xconn->transport.sock != -1) {
1485                 xconn->transport.sock = -1;
1486         }
1487         smbd_smb2_send_queue_ack_fail(&xconn->ack.queue, status);
1488         smbd_smb2_send_queue_ack_fail(&xconn->smb2.send_queue, status);
1489         xconn->smb2.send_queue_len = 0;
1490         DO_PROFILE_INC(disconnect);
1491 }
1492
1493 size_t smbXsrv_client_valid_connections(struct smbXsrv_client *client)
1494 {
1495         struct smbXsrv_connection *xconn = NULL;
1496         size_t num_ok = 0;
1497
1498         for (xconn = client->connections; xconn != NULL; xconn = xconn->next) {
1499                 if (NT_STATUS_IS_OK(xconn->transport.status)) {
1500                         num_ok++;
1501                 }
1502         }
1503
1504         return num_ok;
1505 }
1506
1507 struct smbXsrv_connection_shutdown_state {
1508         struct smbXsrv_connection *xconn;
1509 };
1510
1511 static void smbXsrv_connection_shutdown_wait_done(struct tevent_req *subreq);
1512
1513 static struct tevent_req *smbXsrv_connection_shutdown_send(TALLOC_CTX *mem_ctx,
1514                                         struct tevent_context *ev,
1515                                         struct smbXsrv_connection *xconn)
1516 {
1517         struct tevent_req *req = NULL;
1518         struct smbXsrv_connection_shutdown_state *state = NULL;
1519         struct tevent_req *subreq = NULL;
1520         size_t len = 0;
1521         struct smbd_smb2_request *preq = NULL;
1522         NTSTATUS status;
1523
1524         /*
1525          * The caller should have called
1526          * smbXsrv_connection_disconnect_transport() before.
1527          */
1528         SMB_ASSERT(!NT_STATUS_IS_OK(xconn->transport.status));
1529         SMB_ASSERT(xconn->transport.terminating);
1530         SMB_ASSERT(xconn->transport.shutdown_wait_queue == NULL);
1531
1532         req = tevent_req_create(mem_ctx, &state,
1533                                 struct smbXsrv_connection_shutdown_state);
1534         if (req == NULL) {
1535                 return NULL;
1536         }
1537
1538         state->xconn = xconn;
1539         tevent_req_defer_callback(req, ev);
1540
1541         xconn->transport.shutdown_wait_queue =
1542                 tevent_queue_create(state, "smbXsrv_connection_shutdown_queue");
1543         if (tevent_req_nomem(xconn->transport.shutdown_wait_queue, req)) {
1544                 return tevent_req_post(req, ev);
1545         }
1546
1547         for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1548                 /*
1549                  * Now wait until the request is finished.
1550                  *
1551                  * We don't set a callback, as we just want to block the
1552                  * wait queue and the talloc_free() of the request will
1553                  * remove the item from the wait queue.
1554                  *
1555                  * Note that we don't cancel the requests here
1556                  * in order to keep the replay detection logic correct.
1557                  *
1558                  * However if we teardown the last channel of
1559                  * a connection, we'll call some logic via
1560                  * smbXsrv_session_disconnect_xconn()
1561                  * -> smbXsrv_session_disconnect_xconn_callback()
1562                  *   -> smbXsrv_session_remove_channel()
1563                  *     -> smb2srv_session_shutdown_send()
1564                  * will indeed cancel the request.
1565                  */
1566                 subreq = tevent_queue_wait_send(preq, ev,
1567                                         xconn->transport.shutdown_wait_queue);
1568                 if (tevent_req_nomem(subreq, req)) {
1569                         return tevent_req_post(req, ev);
1570                 }
1571         }
1572
1573         /*
1574          * This may attach sessions with num_channels == 0
1575          * to xconn->transport.shutdown_wait_queue.
1576          */
1577         status = smbXsrv_session_disconnect_xconn(xconn);
1578         if (tevent_req_nterror(req, status)) {
1579                 return tevent_req_post(req, ev);
1580         }
1581
1582         len = tevent_queue_length(xconn->transport.shutdown_wait_queue);
1583         if (len == 0) {
1584                 tevent_req_done(req);
1585                 return tevent_req_post(req, ev);
1586         }
1587
1588         /*
1589          * Now we add our own waiter to the end of the queue,
1590          * this way we get notified when all pending requests are finished
1591          * and send to the socket.
1592          */
1593         subreq = tevent_queue_wait_send(state, ev, xconn->transport.shutdown_wait_queue);
1594         if (tevent_req_nomem(subreq, req)) {
1595                 return tevent_req_post(req, ev);
1596         }
1597         tevent_req_set_callback(subreq, smbXsrv_connection_shutdown_wait_done, req);
1598
1599         return req;
1600 }
1601
1602 static void smbXsrv_connection_shutdown_wait_done(struct tevent_req *subreq)
1603 {
1604         struct tevent_req *req =
1605                 tevent_req_callback_data(subreq,
1606                 struct tevent_req);
1607         struct smbXsrv_connection_shutdown_state *state =
1608                 tevent_req_data(req,
1609                 struct smbXsrv_connection_shutdown_state);
1610         struct smbXsrv_connection *xconn = state->xconn;
1611
1612         tevent_queue_wait_recv(subreq);
1613         TALLOC_FREE(subreq);
1614
1615         tevent_req_done(req);
1616         /*
1617          * make sure the xconn pointer is still valid,
1618          * it should as we used tevent_req_defer_callback()
1619          */
1620         SMB_ASSERT(xconn->transport.terminating);
1621 }
1622
1623 static NTSTATUS smbXsrv_connection_shutdown_recv(struct tevent_req *req)
1624 {
1625         struct smbXsrv_connection_shutdown_state *state =
1626                 tevent_req_data(req,
1627                 struct smbXsrv_connection_shutdown_state);
1628         struct smbXsrv_connection *xconn = state->xconn;
1629         /*
1630          * make sure the xconn pointer is still valid,
1631          * it should as we used tevent_req_defer_callback()
1632          */
1633         SMB_ASSERT(xconn->transport.terminating);
1634         return tevent_req_simple_recv_ntstatus(req);
1635 }
1636
1637 static void smbd_server_connection_terminate_done(struct tevent_req *subreq)
1638 {
1639         struct smbXsrv_connection *xconn =
1640                 tevent_req_callback_data(subreq,
1641                 struct smbXsrv_connection);
1642         struct smbXsrv_client *client = xconn->client;
1643         NTSTATUS status;
1644
1645         status = smbXsrv_connection_shutdown_recv(subreq);
1646         if (!NT_STATUS_IS_OK(status)) {
1647                 exit_server("smbXsrv_connection_shutdown_recv failed");
1648         }
1649
1650         DLIST_REMOVE(client->connections, xconn);
1651         TALLOC_FREE(xconn);
1652 }
1653
1654 void smbd_server_connection_terminate_ex(struct smbXsrv_connection *xconn,
1655                                          const char *reason,
1656                                          const char *location)
1657 {
1658         struct smbXsrv_client *client = xconn->client;
1659         size_t num_ok = 0;
1660
1661         /*
1662          * Make sure that no new request will be able to use this session.
1663          *
1664          * smbXsrv_connection_disconnect_transport() might be called already,
1665          * but calling it again is a no-op.
1666          */
1667         smbXsrv_connection_disconnect_transport(xconn,
1668                                         NT_STATUS_CONNECTION_DISCONNECTED);
1669
1670         num_ok = smbXsrv_client_valid_connections(client);
1671
1672         if (xconn->transport.terminating) {
1673                 DBG_DEBUG("skip recursion conn[%s] num_ok[%zu] reason[%s] at %s\n",
1674                           smbXsrv_connection_dbg(xconn), num_ok,
1675                           reason, location);
1676                 return;
1677         }
1678         xconn->transport.terminating = true;
1679
1680         DBG_DEBUG("conn[%s] num_ok[%zu] reason[%s] at %s\n",
1681                   smbXsrv_connection_dbg(xconn), num_ok,
1682                   reason, location);
1683
1684         if (xconn->has_cluster_movable_ip) {
1685                 /*
1686                  * If the connection has a movable cluster public address
1687                  * we disconnect all client connections,
1688                  * as the public address might be moved to
1689                  * a different node.
1690                  *
1691                  * In future we may recheck which node currently
1692                  * holds this address, but for now we keep it simple.
1693                  */
1694                 smbd_server_disconnect_client_ex(xconn->client,
1695                                                  reason,
1696                                                  location);
1697                 return;
1698         }
1699
1700         if (num_ok != 0) {
1701                 struct tevent_req *subreq = NULL;
1702
1703                 subreq = smbXsrv_connection_shutdown_send(client,
1704                                                           client->raw_ev_ctx,
1705                                                           xconn);
1706                 if (subreq == NULL) {
1707                         exit_server("smbXsrv_connection_shutdown_send failed");
1708                 }
1709                 tevent_req_set_callback(subreq,
1710                                         smbd_server_connection_terminate_done,
1711                                         xconn);
1712                 return;
1713         }
1714
1715         /*
1716          * The last connection was disconnected
1717          */
1718         exit_server_cleanly(reason);
1719 }
1720
1721 void smbd_server_disconnect_client_ex(struct smbXsrv_client *client,
1722                                       const char *reason,
1723                                       const char *location)
1724 {
1725         size_t num_ok = 0;
1726
1727         num_ok = smbXsrv_client_valid_connections(client);
1728
1729         DBG_WARNING("client[%s] num_ok[%zu] reason[%s] at %s\n",
1730                     client->global->remote_address, num_ok,
1731                     reason, location);
1732
1733         /*
1734          * Something bad happened we need to disconnect all connections.
1735          */
1736         exit_server_cleanly(reason);
1737 }
1738
1739 static bool dup_smb2_vec4(TALLOC_CTX *ctx,
1740                         struct iovec *outvec,
1741                         const struct iovec *srcvec)
1742 {
1743         const uint8_t *srctf;
1744         size_t srctf_len;
1745         const uint8_t *srchdr;
1746         size_t srchdr_len;
1747         const uint8_t *srcbody;
1748         size_t srcbody_len;
1749         const uint8_t *expected_srcbody;
1750         const uint8_t *srcdyn;
1751         size_t srcdyn_len;
1752         const uint8_t *expected_srcdyn;
1753         uint8_t *dsttf;
1754         uint8_t *dsthdr;
1755         uint8_t *dstbody;
1756         uint8_t *dstdyn;
1757
1758         srctf  = (const uint8_t *)srcvec[SMBD_SMB2_TF_IOV_OFS].iov_base;
1759         srctf_len = srcvec[SMBD_SMB2_TF_IOV_OFS].iov_len;
1760         srchdr  = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
1761         srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
1762         srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
1763         srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
1764         expected_srcbody = srchdr + SMB2_HDR_BODY;
1765         srcdyn  = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
1766         srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
1767         expected_srcdyn = srcbody + 8;
1768
1769         if ((srctf_len != SMB2_TF_HDR_SIZE) && (srctf_len != 0)) {
1770                 return false;
1771         }
1772
1773         if (srchdr_len != SMB2_HDR_BODY) {
1774                 return false;
1775         }
1776
1777         if (srctf_len == SMB2_TF_HDR_SIZE) {
1778                 dsttf = talloc_memdup(ctx, srctf, SMB2_TF_HDR_SIZE);
1779                 if (dsttf == NULL) {
1780                         return false;
1781                 }
1782         } else {
1783                 dsttf = NULL;
1784         }
1785         outvec[SMBD_SMB2_TF_IOV_OFS].iov_base = (void *)dsttf;
1786         outvec[SMBD_SMB2_TF_IOV_OFS].iov_len = srctf_len;
1787
1788         /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
1789          * be allocated with size OUTVEC_ALLOC_SIZE. */
1790
1791         dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
1792         if (dsthdr == NULL) {
1793                 return false;
1794         }
1795         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
1796         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1797
1798         /*
1799          * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
1800          * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
1801          * then duplicate this. Else use talloc_memdup().
1802          */
1803
1804         if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
1805                 dstbody = dsthdr + SMB2_HDR_BODY;
1806         } else {
1807                 dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
1808                 if (dstbody == NULL) {
1809                         return false;
1810                 }
1811         }
1812         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
1813         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
1814
1815         /*
1816          * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
1817          * pointing to
1818          * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
1819          * then duplicate this. Else use talloc_memdup().
1820          */
1821
1822         if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
1823                 dstdyn = dsthdr + SMB2_HDR_BODY + 8;
1824         } else if (srcdyn == NULL) {
1825                 dstdyn = NULL;
1826         } else {
1827                 dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
1828                 if (dstdyn == NULL) {
1829                         return false;
1830                 }
1831         }
1832         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
1833         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
1834
1835         return true;
1836 }
1837
1838 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
1839 {
1840         struct smbd_smb2_request *newreq = NULL;
1841         struct iovec *outvec = NULL;
1842         int count = req->out.vector_count;
1843         int i;
1844         bool ok;
1845
1846         newreq = smbd_smb2_request_allocate(req->xconn);
1847         if (!newreq) {
1848                 return NULL;
1849         }
1850
1851         newreq->sconn = req->sconn;
1852         newreq->xconn = req->xconn;
1853         newreq->session = req->session;
1854         newreq->do_encryption = req->do_encryption;
1855         newreq->do_signing = req->do_signing;
1856         newreq->current_idx = req->current_idx;
1857
1858         outvec = talloc_zero_array(newreq, struct iovec, count);
1859         if (!outvec) {
1860                 TALLOC_FREE(newreq);
1861                 return NULL;
1862         }
1863         newreq->out.vector = outvec;
1864         newreq->out.vector_count = count;
1865
1866         /* Setup the outvec's identically to req. */
1867         outvec[0].iov_base = newreq->out.nbt_hdr;
1868         outvec[0].iov_len = 4;
1869         memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
1870
1871         /* Setup the vectors identically to the ones in req. */
1872         for (i = 1; i < count; i += SMBD_SMB2_NUM_IOV_PER_REQ) {
1873                 if (!dup_smb2_vec4(outvec, &outvec[i], &req->out.vector[i])) {
1874                         break;
1875                 }
1876         }
1877
1878         if (i < count) {
1879                 /* Alloc failed. */
1880                 TALLOC_FREE(newreq);
1881                 return NULL;
1882         }
1883
1884         ok = smb2_setup_nbt_length(newreq->out.vector,
1885                                    newreq->out.vector_count);
1886         if (!ok) {
1887                 TALLOC_FREE(newreq);
1888                 return NULL;
1889         }
1890
1891         return newreq;
1892 }
1893
1894 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
1895 {
1896         struct smbXsrv_connection *xconn = req->xconn;
1897         int first_idx = 1;
1898         struct iovec *firsttf = NULL;
1899         struct iovec *outhdr_v = NULL;
1900         uint8_t *outhdr = NULL;
1901         struct smbd_smb2_request *nreq = NULL;
1902         NTSTATUS status;
1903         bool ok;
1904
1905         /* Create a new smb2 request we'll use
1906            for the interim return. */
1907         nreq = dup_smb2_req(req);
1908         if (!nreq) {
1909                 return NT_STATUS_NO_MEMORY;
1910         }
1911
1912         /* Lose the last X out vectors. They're the
1913            ones we'll be using for the async reply. */
1914         nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
1915
1916         ok = smb2_setup_nbt_length(nreq->out.vector,
1917                                    nreq->out.vector_count);
1918         if (!ok) {
1919                 return NT_STATUS_INVALID_PARAMETER_MIX;
1920         }
1921
1922         /* Step back to the previous reply. */
1923         nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
1924         firsttf = SMBD_SMB2_IDX_TF_IOV(nreq,out,first_idx);
1925         outhdr_v = SMBD_SMB2_OUT_HDR_IOV(nreq);
1926         outhdr = SMBD_SMB2_OUT_HDR_PTR(nreq);
1927         /* And end the chain. */
1928         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
1929
1930         /* Calculate outgoing credits */
1931         smb2_calculate_credits(req, nreq);
1932
1933         if (DEBUGLEVEL >= 10) {
1934                 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
1935                         (unsigned int)nreq->current_idx );
1936                 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
1937                         (unsigned int)nreq->out.vector_count );
1938                 print_req_vectors(nreq);
1939         }
1940
1941         /*
1942          * As we have changed the header (SMB2_HDR_NEXT_COMMAND),
1943          * we need to sign/encrypt here with the last/first key we remembered
1944          */
1945         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
1946                 status = smb2_signing_encrypt_pdu(req->first_enc_key,
1947                                         firsttf,
1948                                         nreq->out.vector_count - first_idx);
1949                 if (!NT_STATUS_IS_OK(status)) {
1950                         return status;
1951                 }
1952         } else if (smb2_signing_key_valid(req->last_sign_key)) {
1953                 status = smb2_signing_sign_pdu(req->last_sign_key,
1954                                                outhdr_v,
1955                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1956                 if (!NT_STATUS_IS_OK(status)) {
1957                         return status;
1958                 }
1959         }
1960
1961         nreq->queue_entry.mem_ctx = nreq;
1962         nreq->queue_entry.vector = nreq->out.vector;
1963         nreq->queue_entry.count = nreq->out.vector_count;
1964         DLIST_ADD_END(xconn->smb2.send_queue, &nreq->queue_entry);
1965         xconn->smb2.send_queue_len++;
1966
1967         status = smbd_smb2_flush_send_queue(xconn);
1968         if (!NT_STATUS_IS_OK(status)) {
1969                 return status;
1970         }
1971
1972         return NT_STATUS_OK;
1973 }
1974
1975 struct smbd_smb2_request_pending_state {
1976         struct smbd_smb2_send_queue queue_entry;
1977         uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
1978         struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
1979 };
1980
1981 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1982                                             struct tevent_timer *te,
1983                                             struct timeval current_time,
1984                                             void *private_data);
1985
1986 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
1987                                          struct tevent_req *subreq,
1988                                          uint32_t defer_time)
1989 {
1990         NTSTATUS status;
1991         struct timeval defer_endtime;
1992         uint8_t *outhdr = NULL;
1993         uint32_t flags;
1994
1995         if (!tevent_req_is_in_progress(subreq)) {
1996                 /*
1997                  * This is a performance optimization,
1998                  * it avoids one tevent_loop iteration,
1999                  * which means we avoid one
2000                  * talloc_stackframe_pool/talloc_free pair.
2001                  */
2002                 tevent_req_notify_callback(subreq);
2003                 return NT_STATUS_OK;
2004         }
2005
2006         req->subreq = subreq;
2007         subreq = NULL;
2008
2009         if (req->async_te) {
2010                 /* We're already async. */
2011                 return NT_STATUS_OK;
2012         }
2013
2014         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2015         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
2016         if (flags & SMB2_HDR_FLAG_ASYNC) {
2017                 /* We're already async. */
2018                 return NT_STATUS_OK;
2019         }
2020
2021         if (req->async_internal || defer_time == 0) {
2022                 /*
2023                  * An SMB2 request implementation wants to handle the request
2024                  * asynchronously "internally" while keeping synchronous
2025                  * behaviour for the SMB2 request. This means we don't send an
2026                  * interim response and we can allow processing of compound SMB2
2027                  * requests (cf the subsequent check) for all cases.
2028                  */
2029                 return NT_STATUS_OK;
2030         }
2031
2032         if (req->in.vector_count > req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
2033                 /*
2034                  * We're trying to go async in a compound request
2035                  * chain. This is only allowed for opens that cause an
2036                  * oplock break or for the last operation in the
2037                  * chain, otherwise it is not allowed. See
2038                  * [MS-SMB2].pdf note <206> on Section 3.3.5.2.7.
2039                  */
2040                 const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2041
2042                 if (SVAL(inhdr, SMB2_HDR_OPCODE) != SMB2_OP_CREATE) {
2043                         /*
2044                          * Cancel the outstanding request.
2045                          */
2046                         bool ok = tevent_req_cancel(req->subreq);
2047                         if (ok) {
2048                                 return NT_STATUS_OK;
2049                         }
2050                         TALLOC_FREE(req->subreq);
2051                         return smbd_smb2_request_error(req,
2052                                 NT_STATUS_INTERNAL_ERROR);
2053                 }
2054         }
2055
2056         if (DEBUGLEVEL >= 10) {
2057                 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
2058                         (unsigned int)req->current_idx );
2059                 print_req_vectors(req);
2060         }
2061
2062         if (req->current_idx > 1) {
2063                 /*
2064                  * We're going async in a compound
2065                  * chain after the first request has
2066                  * already been processed. Send an
2067                  * interim response containing the
2068                  * set of replies already generated.
2069                  */
2070                 int idx = req->current_idx;
2071
2072                 status = smb2_send_async_interim_response(req);
2073                 if (!NT_STATUS_IS_OK(status)) {
2074                         return status;
2075                 }
2076                 TALLOC_FREE(req->first_enc_key);
2077
2078                 req->current_idx = 1;
2079
2080                 /*
2081                  * Re-arrange the in.vectors to remove what
2082                  * we just sent.
2083                  */
2084                 memmove(&req->in.vector[1],
2085                         &req->in.vector[idx],
2086                         sizeof(req->in.vector[0])*(req->in.vector_count - idx));
2087                 req->in.vector_count = 1 + (req->in.vector_count - idx);
2088
2089                 /* Re-arrange the out.vectors to match. */
2090                 memmove(&req->out.vector[1],
2091                         &req->out.vector[idx],
2092                         sizeof(req->out.vector[0])*(req->out.vector_count - idx));
2093                 req->out.vector_count = 1 + (req->out.vector_count - idx);
2094
2095                 if (req->in.vector_count == 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
2096                         /*
2097                          * We only have one remaining request as
2098                          * we've processed everything else.
2099                          * This is no longer a compound request.
2100                          */
2101                         req->compound_related = false;
2102                         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2103                         flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
2104                         SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
2105                 }
2106         }
2107         TALLOC_FREE(req->last_sign_key);
2108
2109         /*
2110          * smbd_smb2_request_pending_timer() just send a packet
2111          * to the client and doesn't need any impersonation.
2112          * So we use req->xconn->client->raw_ev_ctx instead
2113          * of req->ev_ctx here.
2114          */
2115         defer_endtime = timeval_current_ofs_usec(defer_time);
2116         req->async_te = tevent_add_timer(req->xconn->client->raw_ev_ctx,
2117                                          req, defer_endtime,
2118                                          smbd_smb2_request_pending_timer,
2119                                          req);
2120         if (req->async_te == NULL) {
2121                 return NT_STATUS_NO_MEMORY;
2122         }
2123
2124         return NT_STATUS_OK;
2125 }
2126
2127 static
2128 struct smb2_signing_key *smbd_smb2_signing_key(struct smbXsrv_session *session,
2129                                                struct smbXsrv_connection *xconn,
2130                                                bool *_has_channel)
2131 {
2132         struct smbXsrv_channel_global0 *c = NULL;
2133         NTSTATUS status;
2134         struct smb2_signing_key *key = NULL;
2135         bool has_channel = false;
2136
2137         status = smbXsrv_session_find_channel(session, xconn, &c);
2138         if (NT_STATUS_IS_OK(status)) {
2139                 key = c->signing_key;
2140                 has_channel = true;
2141         }
2142
2143         if (!smb2_signing_key_valid(key)) {
2144                 key = session->global->signing_key;
2145                 has_channel = false;
2146         }
2147
2148         if (_has_channel != NULL) {
2149                 *_has_channel = has_channel;
2150         }
2151
2152         return key;
2153 }
2154
2155 static NTSTATUS smb2_get_new_nonce(struct smbXsrv_session *session,
2156                                    uint64_t *new_nonce_high,
2157                                    uint64_t *new_nonce_low)
2158 {
2159         uint64_t nonce_high;
2160         uint64_t nonce_low;
2161
2162         session->nonce_low += 1;
2163         if (session->nonce_low == 0) {
2164                 session->nonce_low += 1;
2165                 session->nonce_high += 1;
2166         }
2167
2168         /*
2169          * CCM and GCM algorithms must never have their
2170          * nonce wrap, or the security of the whole
2171          * communication and the keys is destroyed.
2172          * We must drop the connection once we have
2173          * transfered too much data.
2174          *
2175          * NOTE: We assume nonces greater than 8 bytes.
2176          */
2177         if (session->nonce_high >= session->nonce_high_max) {
2178                 return NT_STATUS_ENCRYPTION_FAILED;
2179         }
2180
2181         nonce_high = session->nonce_high_random;
2182         nonce_high += session->nonce_high;
2183         nonce_low = session->nonce_low;
2184
2185         *new_nonce_high = nonce_high;
2186         *new_nonce_low = nonce_low;
2187         return NT_STATUS_OK;
2188 }
2189
2190 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
2191                                             struct tevent_timer *te,
2192                                             struct timeval current_time,
2193                                             void *private_data)
2194 {
2195         struct smbd_smb2_request *req =
2196                 talloc_get_type_abort(private_data,
2197                 struct smbd_smb2_request);
2198         struct smbXsrv_connection *xconn = req->xconn;
2199         struct smbd_smb2_request_pending_state *state = NULL;
2200         uint8_t *outhdr = NULL;
2201         const uint8_t *inhdr = NULL;
2202         uint8_t *tf = NULL;
2203         uint8_t *hdr = NULL;
2204         uint8_t *body = NULL;
2205         uint8_t *dyn = NULL;
2206         uint32_t flags = 0;
2207         uint64_t message_id = 0;
2208         uint64_t async_id = 0;
2209         NTSTATUS status;
2210         bool ok;
2211
2212         TALLOC_FREE(req->async_te);
2213
2214         /* Ensure our final reply matches the interim one. */
2215         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2216         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2217         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
2218         message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
2219
2220         async_id = message_id; /* keep it simple for now... */
2221
2222         SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
2223         SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
2224
2225         DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
2226                 "going async\n",
2227                 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
2228                 (unsigned long long)async_id ));
2229
2230         /*
2231          * What we send is identical to a smbd_smb2_request_error
2232          * packet with an error status of STATUS_PENDING. Make use
2233          * of this fact sometime when refactoring. JRA.
2234          */
2235
2236         state = talloc_zero(req->xconn, struct smbd_smb2_request_pending_state);
2237         if (state == NULL) {
2238                 smbd_server_connection_terminate(xconn,
2239                                                  nt_errstr(NT_STATUS_NO_MEMORY));
2240                 return;
2241         }
2242
2243         tf = state->buf + NBT_HDR_SIZE;
2244
2245         hdr = tf + SMB2_TF_HDR_SIZE;
2246         body = hdr + SMB2_HDR_BODY;
2247         dyn = body + 8;
2248
2249         if (req->do_encryption) {
2250                 uint64_t nonce_high = 0;
2251                 uint64_t nonce_low = 0;
2252                 uint64_t session_id = req->session->global->session_wire_id;
2253
2254                 status = smb2_get_new_nonce(req->session,
2255                                             &nonce_high,
2256                                             &nonce_low);
2257                 if (!NT_STATUS_IS_OK(status)) {
2258                         smbd_server_connection_terminate(xconn,
2259                                                          nt_errstr(status));
2260                         return;
2261                 }
2262
2263                 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2264                 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2265                 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2266                 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
2267         }
2268
2269         SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
2270         SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
2271         SSVAL(hdr, SMB2_HDR_EPOCH, 0);
2272         SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(NT_STATUS_PENDING));
2273         SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
2274
2275         SIVAL(hdr, SMB2_HDR_FLAGS, flags);
2276         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
2277         SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
2278         SBVAL(hdr, SMB2_HDR_PID, async_id);
2279         SBVAL(hdr, SMB2_HDR_SESSION_ID,
2280                 BVAL(outhdr, SMB2_HDR_SESSION_ID));
2281         memcpy(hdr+SMB2_HDR_SIGNATURE,
2282                outhdr+SMB2_HDR_SIGNATURE, 16);
2283
2284         SSVAL(body, 0x00, 0x08 + 1);
2285
2286         SCVAL(body, 0x02, 0);
2287         SCVAL(body, 0x03, 0);
2288         SIVAL(body, 0x04, 0);
2289         /* Match W2K8R2... */
2290         SCVAL(dyn,  0x00, 0x21);
2291
2292         state->vector[0].iov_base = (void *)state->buf;
2293         state->vector[0].iov_len = NBT_HDR_SIZE;
2294
2295         if (req->do_encryption) {
2296                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
2297                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    =
2298                                                         SMB2_TF_HDR_SIZE;
2299         } else {
2300                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
2301                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
2302         }
2303
2304         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
2305         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
2306
2307         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
2308         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
2309
2310         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
2311         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len   = 1;
2312
2313         ok = smb2_setup_nbt_length(state->vector,
2314                                    1 + SMBD_SMB2_NUM_IOV_PER_REQ);
2315         if (!ok) {
2316                 smbd_server_connection_terminate(
2317                         xconn, nt_errstr(NT_STATUS_INTERNAL_ERROR));
2318                 return;
2319         }
2320
2321         /* Ensure we correctly go through crediting. Grant
2322            the credits now, and zero credits on the final
2323            response. */
2324         smb2_set_operation_credit(req->xconn,
2325                         SMBD_SMB2_IN_HDR_IOV(req),
2326                         &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
2327
2328         SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
2329
2330         if (DEBUGLVL(10)) {
2331                 int i;
2332
2333                 for (i = 0; i < ARRAY_SIZE(state->vector); i++) {
2334                         dbgtext("\tstate->vector[%u/%u].iov_len = %u\n",
2335                                 (unsigned int)i,
2336                                 (unsigned int)ARRAY_SIZE(state->vector),
2337                                 (unsigned int)state->vector[i].iov_len);
2338                 }
2339         }
2340
2341         if (req->do_encryption) {
2342                 struct smbXsrv_session *x = req->session;
2343                 struct smb2_signing_key *encryption_key = x->global->encryption_key;
2344
2345                 status = smb2_signing_encrypt_pdu(encryption_key,
2346                                         &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
2347                                         SMBD_SMB2_NUM_IOV_PER_REQ);
2348                 if (!NT_STATUS_IS_OK(status)) {
2349                         smbd_server_connection_terminate(xconn,
2350                                                 nt_errstr(status));
2351                         return;
2352                 }
2353         } else if (req->do_signing) {
2354                 struct smbXsrv_session *x = req->session;
2355                 struct smb2_signing_key *signing_key =
2356                         smbd_smb2_signing_key(x, xconn, NULL);
2357
2358                 status = smb2_signing_sign_pdu(signing_key,
2359                                         &state->vector[1+SMBD_SMB2_HDR_IOV_OFS],
2360                                         SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2361                 if (!NT_STATUS_IS_OK(status)) {
2362                         smbd_server_connection_terminate(xconn,
2363                                                 nt_errstr(status));
2364                         return;
2365                 }
2366         }
2367
2368         state->queue_entry.mem_ctx = state;
2369         state->queue_entry.vector = state->vector;
2370         state->queue_entry.count = ARRAY_SIZE(state->vector);
2371         DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
2372         xconn->smb2.send_queue_len++;
2373
2374         status = smbd_smb2_flush_send_queue(xconn);
2375         if (!NT_STATUS_IS_OK(status)) {
2376                 smbd_server_connection_terminate(xconn,
2377                                                  nt_errstr(status));
2378                 return;
2379         }
2380 }
2381
2382 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
2383 {
2384         struct smbXsrv_connection *xconn = req->xconn;
2385         struct smbd_smb2_request *cur;
2386         const uint8_t *inhdr;
2387         uint32_t flags;
2388         uint64_t search_message_id;
2389         uint64_t search_async_id;
2390         uint64_t found_id;
2391
2392         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2393
2394         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2395         search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
2396         search_async_id = BVAL(inhdr, SMB2_HDR_PID);
2397
2398         /*
2399          * We don't need the request anymore cancel requests never
2400          * have a response.
2401          *
2402          * We defer the TALLOC_FREE(req) to the caller.
2403          */
2404         DLIST_REMOVE(xconn->smb2.requests, req);
2405
2406         for (cur = xconn->smb2.requests; cur; cur = cur->next) {
2407                 const uint8_t *outhdr;
2408                 uint64_t message_id;
2409                 uint64_t async_id;
2410
2411                 if (cur->session != req->session) {
2412                         continue;
2413                 }
2414
2415                 if (cur->compound_related) {
2416                         /*
2417                          * Never cancel anything in a compound request.
2418                          * Way too hard to deal with the result.
2419                          */
2420                         continue;
2421                 }
2422
2423                 outhdr = SMBD_SMB2_OUT_HDR_PTR(cur);
2424
2425                 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
2426                 async_id = BVAL(outhdr, SMB2_HDR_PID);
2427
2428                 if (flags & SMB2_HDR_FLAG_ASYNC) {
2429                         if (search_async_id == async_id) {
2430                                 found_id = async_id;
2431                                 break;
2432                         }
2433                 } else {
2434                         if (search_message_id == message_id) {
2435                                 found_id = message_id;
2436                                 break;
2437                         }
2438                 }
2439         }
2440
2441         if (cur && cur->subreq) {
2442                 inhdr = SMBD_SMB2_IN_HDR_PTR(cur);
2443                 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
2444                         "cancel opcode[%s] mid %llu\n",
2445                         smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
2446                         (unsigned long long)found_id ));
2447                 tevent_req_cancel(cur->subreq);
2448         }
2449
2450         return NT_STATUS_OK;
2451 }
2452
2453 /*************************************************************
2454  Ensure an incoming tid is a valid one for us to access.
2455  Change to the associated uid credentials and chdir to the
2456  valid tid directory.
2457 *************************************************************/
2458
2459 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
2460 {
2461         const uint8_t *inhdr;
2462         uint32_t in_flags;
2463         uint32_t in_tid;
2464         struct smbXsrv_tcon *tcon;
2465         NTSTATUS status;
2466         NTTIME now = timeval_to_nttime(&req->request_time);
2467
2468         req->tcon = NULL;
2469
2470         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2471
2472         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2473         in_tid = IVAL(inhdr, SMB2_HDR_TID);
2474
2475         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
2476                 in_tid = req->last_tid;
2477         }
2478
2479         req->last_tid = 0;
2480
2481         status = smb2srv_tcon_lookup(req->session,
2482                                      in_tid, now, &tcon);
2483         if (!NT_STATUS_IS_OK(status)) {
2484                 return status;
2485         }
2486
2487         if (!change_to_user_and_service(
2488                     tcon->compat,
2489                     req->session->global->session_wire_id))
2490         {
2491                 return NT_STATUS_ACCESS_DENIED;
2492         }
2493
2494         req->tcon = tcon;
2495         req->last_tid = in_tid;
2496
2497         return NT_STATUS_OK;
2498 }
2499
2500 /*************************************************************
2501  Ensure an incoming session_id is a valid one for us to access.
2502 *************************************************************/
2503
2504 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
2505 {
2506         const uint8_t *inhdr;
2507         uint32_t in_flags;
2508         uint16_t in_opcode;
2509         uint64_t in_session_id;
2510         struct smbXsrv_session *session = NULL;
2511         struct auth_session_info *session_info;
2512         NTSTATUS status;
2513         NTTIME now = timeval_to_nttime(&req->request_time);
2514
2515         req->session = NULL;
2516         req->tcon = NULL;
2517
2518         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2519
2520         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2521         in_opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2522         in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
2523
2524         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
2525                 in_session_id = req->last_session_id;
2526         }
2527
2528         req->last_session_id = 0;
2529
2530         /* look an existing session up */
2531         switch (in_opcode) {
2532         case SMB2_OP_SESSSETUP:
2533                 /*
2534                  * For a session bind request, we don't have the
2535                  * channel set up at this point yet, so we defer
2536                  * the verification that the connection belongs
2537                  * to the session to the session setup code, which
2538                  * can look at the session binding flags.
2539                  */
2540                 status = smb2srv_session_lookup_client(req->xconn->client,
2541                                                        in_session_id, now,
2542                                                        &session);
2543                 break;
2544         default:
2545                 status = smb2srv_session_lookup_conn(req->xconn,
2546                                                      in_session_id, now,
2547                                                      &session);
2548                 break;
2549         }
2550         if (session) {
2551                 req->session = session;
2552                 req->last_session_id = in_session_id;
2553         }
2554         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
2555                 switch (in_opcode) {
2556                 case SMB2_OP_SESSSETUP:
2557                         status = smb2srv_session_lookup_global(req->xconn->client,
2558                                                                in_session_id,
2559                                                                req,
2560                                                                &session);
2561                         if (NT_STATUS_IS_OK(status)) {
2562                                 /*
2563                                  * We fallback to a session of
2564                                  * another process in order to
2565                                  * get the signing correct.
2566                                  *
2567                                  * We don't set req->last_session_id here.
2568                                  */
2569                                 req->session = session;
2570                         }
2571                         break;
2572                 default:
2573                         break;
2574                 }
2575         }
2576         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
2577                 switch (in_opcode) {
2578                 case SMB2_OP_SESSSETUP:
2579                         status = NT_STATUS_OK;
2580                         break;
2581                 case SMB2_OP_LOGOFF:
2582                 case SMB2_OP_CLOSE:
2583                 case SMB2_OP_LOCK:
2584                 case SMB2_OP_CANCEL:
2585                 case SMB2_OP_KEEPALIVE:
2586                         /*
2587                          * [MS-SMB2] 3.3.5.2.9 Verifying the Session
2588                          * specifies that LOGOFF, CLOSE and (UN)LOCK
2589                          * should always be processed even on expired sessions.
2590                          *
2591                          * Also see the logic in
2592                          * smbd_smb2_request_process_lock().
2593                          *
2594                          * The smb2.session.expire2 test shows that
2595                          * CANCEL and KEEPALIVE/ECHO should also
2596                          * be processed.
2597                          */
2598                         status = NT_STATUS_OK;
2599                         break;
2600                 default:
2601                         break;
2602                 }
2603         }
2604         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
2605                 switch (in_opcode) {
2606                 case SMB2_OP_TCON:
2607                 case SMB2_OP_CREATE:
2608                 case SMB2_OP_GETINFO:
2609                 case SMB2_OP_SETINFO:
2610                         return NT_STATUS_INVALID_HANDLE;
2611                 default:
2612                         /*
2613                          * Notice the check for
2614                          * (session_info == NULL)
2615                          * below.
2616                          */
2617                         status = NT_STATUS_OK;
2618                         break;
2619                 }
2620         }
2621         if (!NT_STATUS_IS_OK(status)) {
2622                 return status;
2623         }
2624
2625         session_info = session->global->auth_session_info;
2626         if (session_info == NULL) {
2627                 return NT_STATUS_INVALID_HANDLE;
2628         }
2629
2630         return NT_STATUS_OK;
2631 }
2632
2633 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
2634                                                 uint32_t data_length)
2635 {
2636         struct smbXsrv_connection *xconn = req->xconn;
2637         uint16_t needed_charge;
2638         uint16_t credit_charge = 1;
2639         const uint8_t *inhdr;
2640
2641         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2642
2643         if (xconn->smb2.credits.multicredit) {
2644                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
2645                 credit_charge = MAX(credit_charge, 1);
2646         }
2647
2648         needed_charge = (data_length - 1)/ 65536 + 1;
2649
2650         DBGC_DEBUG(DBGC_SMB2_CREDITS,
2651                    "mid %llu, CreditCharge: %d, NeededCharge: %d\n",
2652                    (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
2653                    credit_charge, needed_charge);
2654
2655         if (needed_charge > credit_charge) {
2656                 DBGC_WARNING(DBGC_SMB2_CREDITS,
2657                           "CreditCharge too low, given %d, needed %d\n",
2658                           credit_charge, needed_charge);
2659                 return NT_STATUS_INVALID_PARAMETER;
2660         }
2661
2662         return NT_STATUS_OK;
2663 }
2664
2665 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
2666                                         size_t expected_body_size)
2667 {
2668         struct iovec *inhdr_v;
2669         const uint8_t *inhdr;
2670         uint16_t opcode;
2671         const uint8_t *inbody;
2672         size_t body_size;
2673         size_t min_dyn_size = expected_body_size & 0x00000001;
2674         int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
2675
2676         /*
2677          * The following should be checked already.
2678          */
2679         if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
2680                 return NT_STATUS_INTERNAL_ERROR;
2681         }
2682         if (req->current_idx > max_idx) {
2683                 return NT_STATUS_INTERNAL_ERROR;
2684         }
2685
2686         inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
2687         if (inhdr_v->iov_len != SMB2_HDR_BODY) {
2688                 return NT_STATUS_INTERNAL_ERROR;
2689         }
2690         if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
2691                 return NT_STATUS_INTERNAL_ERROR;
2692         }
2693
2694         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2695         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2696
2697         switch (opcode) {
2698         case SMB2_OP_IOCTL:
2699         case SMB2_OP_GETINFO:
2700         case SMB2_OP_WRITE:
2701                 min_dyn_size = 0;
2702                 break;
2703         }
2704
2705         /*
2706          * Now check the expected body size,
2707          * where the last byte might be in the
2708          * dynamic section..
2709          */
2710         if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
2711                 return NT_STATUS_INVALID_PARAMETER;
2712         }
2713         if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
2714                 return NT_STATUS_INVALID_PARAMETER;
2715         }
2716
2717         inbody = SMBD_SMB2_IN_BODY_PTR(req);
2718
2719         body_size = SVAL(inbody, 0x00);
2720         if (body_size != expected_body_size) {
2721                 return NT_STATUS_INVALID_PARAMETER;
2722         }
2723
2724         return NT_STATUS_OK;
2725 }
2726
2727 bool smbXsrv_is_encrypted(uint8_t encryption_flags)
2728 {
2729         return (!(encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET)
2730                 &&
2731                 (encryption_flags & (SMBXSRV_PROCESSED_ENCRYPTED_PACKET |
2732                                      SMBXSRV_ENCRYPTION_DESIRED |
2733                                      SMBXSRV_ENCRYPTION_REQUIRED)));
2734 }
2735
2736 bool smbXsrv_is_partially_encrypted(uint8_t encryption_flags)
2737 {
2738         return ((encryption_flags & SMBXSRV_PROCESSED_ENCRYPTED_PACKET) &&
2739                 (encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET));
2740 }
2741
2742 /* Set a flag if not already set, return true if set */
2743 bool smbXsrv_set_crypto_flag(uint8_t *flags, uint8_t flag)
2744 {
2745         if ((flag == 0) || (*flags & flag)) {
2746                 return false;
2747         }
2748
2749         *flags |= flag;
2750         return true;
2751 }
2752
2753 /*
2754  * Update encryption state tracking flags, this can be used to
2755  * determine whether whether the session or tcon is "encrypted".
2756  */
2757 static void smb2srv_update_crypto_flags(struct smbd_smb2_request *req,
2758                                         uint16_t opcode,
2759                                         bool *update_session_globalp,
2760                                         bool *update_tcon_globalp)
2761 {
2762         /* Default: assume unecrypted and unsigned */
2763         struct smbXsrv_session *session = req->session;
2764         struct smbXsrv_tcon *tcon = req->tcon;
2765         uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
2766         uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
2767         bool update_session = false;
2768         bool update_tcon = false;
2769
2770         if (session->table == NULL) {
2771                 /*
2772                  * sessions from smb2srv_session_lookup_global()
2773                  * have NT_STATUS_BAD_LOGON_SESSION_STATE
2774                  * and session->table == NULL.
2775                  *
2776                  * They only used to give the correct error
2777                  * status, we should not update any state.
2778                  */
2779                 goto out;
2780         }
2781
2782         if (req->was_encrypted && req->do_encryption) {
2783                 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
2784                 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
2785         } else {
2786                 /* Unencrypted packet, can be signed */
2787                 if (req->do_signing) {
2788                         sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
2789                 }
2790         }
2791
2792         update_session |= smbXsrv_set_crypto_flag(
2793                 &session->global->encryption_flags, encrypt_flag);
2794         update_session |= smbXsrv_set_crypto_flag(
2795                 &session->global->signing_flags, sign_flag);
2796
2797         if (tcon) {
2798                 update_tcon |= smbXsrv_set_crypto_flag(
2799                         &tcon->global->encryption_flags, encrypt_flag);
2800                 update_tcon |= smbXsrv_set_crypto_flag(
2801                         &tcon->global->signing_flags, sign_flag);
2802         }
2803
2804 out:
2805         *update_session_globalp = update_session;
2806         *update_tcon_globalp = update_tcon;
2807         return;
2808 }
2809
2810 bool smbXsrv_is_signed(uint8_t signing_flags)
2811 {
2812         /*
2813          * Signing is always enabled, so unless we got an unsigned
2814          * packet and at least one signed packet that was not
2815          * encrypted, the session or tcon is "signed".
2816          */
2817         return (!(signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
2818                 (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
2819 }
2820
2821 bool smbXsrv_is_partially_signed(uint8_t signing_flags)
2822 {
2823         return ((signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
2824                 (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
2825 }
2826
2827 static NTSTATUS smbd_smb2_request_dispatch_update_counts(
2828                                 struct smbd_smb2_request *req,
2829                                 bool modify_call)
2830 {
2831         struct smbXsrv_connection *xconn = req->xconn;
2832         const uint8_t *inhdr;
2833         uint16_t channel_sequence;
2834         uint8_t generation_wrap = 0;
2835         uint32_t flags;
2836         int cmp;
2837         struct smbXsrv_open *op;
2838         bool update_open = false;
2839         NTSTATUS status = NT_STATUS_OK;
2840
2841         SMB_ASSERT(!req->request_counters_updated);
2842
2843         if (xconn->protocol < PROTOCOL_SMB3_00) {
2844                 return NT_STATUS_OK;
2845         }
2846
2847         if (req->compat_chain_fsp == NULL) {
2848                 return NT_STATUS_OK;
2849         }
2850
2851         op = req->compat_chain_fsp->op;
2852         if (op == NULL) {
2853                 return NT_STATUS_OK;
2854         }
2855
2856         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2857         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2858         channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
2859
2860         cmp = channel_sequence - op->global->channel_sequence;
2861         if (cmp < 0) {
2862                 /*
2863                  * csn wrap. We need to watch out for long-running
2864                  * requests that are still sitting on a previously
2865                  * used csn. SMB2_OP_NOTIFY can take VERY long.
2866                  */
2867                 generation_wrap += 1;
2868         }
2869
2870         if (abs(cmp) > INT16_MAX) {
2871                 /*
2872                  * [MS-SMB2] 3.3.5.2.10 - Verifying the Channel Sequence Number:
2873                  *
2874                  * If the channel sequence number of the request and the one
2875                  * known to the server are not equal, the channel sequence
2876                  * number and outstanding request counts are only updated
2877                  * "... if the unsigned difference using 16-bit arithmetic
2878                  * between ChannelSequence and Open.ChannelSequence is less than
2879                  * or equal to 0x7FFF ...".
2880                  * Otherwise, an error is returned for the modifying
2881                  * calls write, set_info, and ioctl.
2882                  *
2883                  * There are currently two issues with the description:
2884                  *
2885                  * * For the other calls, the document seems to imply
2886                  *   that processing continues without adapting the
2887                  *   counters (if the sequence numbers are not equal).
2888                  *
2889                  *   TODO: This needs clarification!
2890                  *
2891                  * * Also, the behaviour if the difference is larger
2892                  *   than 0x7FFF is not clear. The document seems to
2893                  *   imply that if such a difference is reached,
2894                  *   the server starts to ignore the counters or
2895                  *   in the case of the modifying calls, return errors.
2896                  *
2897                  *   TODO: This needs clarification!
2898                  *
2899                  * At this point Samba tries to be a little more
2900                  * clever than the description in the MS-SMB2 document
2901                  * by heuristically detecting and properly treating
2902                  * a 16 bit overflow of the client-submitted sequence
2903                  * number:
2904                  *
2905                  * If the stored channel sequence number is more than
2906                  * 0x7FFF larger than the one from the request, then
2907                  * the client-provided sequence number has likely
2908                  * overflown. We treat this case as valid instead
2909                  * of as failure.
2910                  *
2911                  * The MS-SMB2 behaviour would be setting cmp = -1.
2912                  */
2913                 cmp *= -1;
2914         }
2915
2916         if (flags & SMB2_HDR_FLAG_REPLAY_OPERATION) {
2917                 if (cmp == 0 && op->pre_request_count == 0) {
2918                         op->request_count += 1;
2919                         req->request_counters_updated = true;
2920                 } else if (cmp > 0 && op->pre_request_count == 0) {
2921                         op->pre_request_count += op->request_count;
2922                         op->request_count = 1;
2923                         op->global->channel_sequence = channel_sequence;
2924                         op->global->channel_generation += generation_wrap;
2925                         update_open = true;
2926                         req->request_counters_updated = true;
2927                 } else if (modify_call) {
2928                         return NT_STATUS_FILE_NOT_AVAILABLE;
2929                 }
2930         } else {
2931                 if (cmp == 0) {
2932                         op->request_count += 1;
2933                         req->request_counters_updated = true;
2934                 } else if (cmp > 0) {
2935                         op->pre_request_count += op->request_count;
2936                         op->request_count = 1;
2937                         op->global->channel_sequence = channel_sequence;
2938                         op->global->channel_generation += generation_wrap;
2939                         update_open = true;
2940                         req->request_counters_updated = true;
2941                 } else if (modify_call) {
2942                         return NT_STATUS_FILE_NOT_AVAILABLE;
2943                 }
2944         }
2945         req->channel_generation = op->global->channel_generation;
2946
2947         if (update_open) {
2948                 status = smbXsrv_open_update(op);
2949         }
2950
2951         return status;
2952 }
2953
2954 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
2955 {
2956         struct smbXsrv_connection *xconn = req->xconn;
2957         const struct smbd_smb2_dispatch_table *call = NULL;
2958         const struct iovec *intf_v = SMBD_SMB2_IN_TF_IOV(req);
2959         const uint8_t *inhdr;
2960         uint16_t opcode;
2961         uint32_t flags;
2962         uint64_t mid;
2963         NTSTATUS status;
2964         NTSTATUS session_status;
2965         uint32_t allowed_flags;
2966         NTSTATUS return_value;
2967         struct smbXsrv_session *x = NULL;
2968         bool signing_required = false;
2969         bool encryption_desired = false;
2970         bool encryption_required = false;
2971
2972         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2973
2974         DO_PROFILE_INC(request);
2975
2976         SMB_ASSERT(!req->request_counters_updated);
2977
2978         /* TODO: verify more things */
2979
2980         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2981         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2982         mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
2983         DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
2984                 smb2_opcode_name(opcode),
2985                 (unsigned long long)mid));
2986
2987         if (xconn->protocol >= PROTOCOL_SMB2_02) {
2988                 /*
2989                  * once the protocol is negotiated
2990                  * SMB2_OP_NEGPROT is not allowed anymore
2991                  */
2992                 if (opcode == SMB2_OP_NEGPROT) {
2993                         /* drop the connection */
2994                         return NT_STATUS_INVALID_PARAMETER;
2995                 }
2996         } else {
2997                 /*
2998                  * if the protocol is not negotiated yet
2999                  * only SMB2_OP_NEGPROT is allowed.
3000                  */
3001                 if (opcode != SMB2_OP_NEGPROT) {
3002                         /* drop the connection */
3003                         return NT_STATUS_INVALID_PARAMETER;
3004                 }
3005         }
3006
3007         /*
3008          * Check if the client provided a valid session id.
3009          *
3010          * As some command don't require a valid session id
3011          * we defer the check of the session_status
3012          */
3013         session_status = smbd_smb2_request_check_session(req);
3014         x = req->session;
3015         if (x != NULL) {
3016                 signing_required = x->global->signing_flags & SMBXSRV_SIGNING_REQUIRED;
3017                 encryption_desired = x->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED;
3018                 encryption_required = x->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED;
3019         }
3020
3021         req->async_internal = false;
3022         req->do_signing = false;
3023         if (opcode != SMB2_OP_SESSSETUP) {
3024                 req->do_encryption = encryption_desired;
3025         } else {
3026                 req->do_encryption = false;
3027         }
3028         req->was_encrypted = false;
3029         if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
3030                 const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
3031                 uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
3032
3033                 if (x != NULL && x->global->session_wire_id != tf_session_id) {
3034                         DEBUG(0,("smbd_smb2_request_dispatch: invalid session_id"
3035                                  "in SMB2_HDR[%llu], SMB2_TF[%llu]\n",
3036                                  (unsigned long long)x->global->session_wire_id,
3037                                  (unsigned long long)tf_session_id));
3038                         /*
3039                          * TODO: windows allows this...
3040                          * should we drop the connection?
3041                          *
3042                          * For now we just return ACCESS_DENIED
3043                          * (Windows clients never trigger this)
3044                          * and wait for an update of [MS-SMB2].
3045                          */
3046                         return smbd_smb2_request_error(req,
3047                                         NT_STATUS_ACCESS_DENIED);
3048                 }
3049
3050                 req->was_encrypted = true;
3051                 req->do_encryption = true;
3052         }
3053
3054         if (encryption_required && !req->was_encrypted) {
3055                 req->do_encryption = true;
3056                 return smbd_smb2_request_error(req,
3057                                 NT_STATUS_ACCESS_DENIED);
3058         }
3059
3060         call = smbd_smb2_call(opcode);
3061         if (call == NULL) {
3062                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
3063         }
3064
3065         allowed_flags = SMB2_HDR_FLAG_CHAINED |
3066                         SMB2_HDR_FLAG_SIGNED |
3067                         SMB2_HDR_FLAG_DFS;
3068         if (xconn->protocol >= PROTOCOL_SMB3_11) {
3069                 allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
3070         }
3071         if (opcode == SMB2_OP_NEGPROT) {
3072                 if (lp_server_max_protocol() >= PROTOCOL_SMB3_11) {
3073                         allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
3074                 }
3075         }
3076         if (opcode == SMB2_OP_CANCEL) {
3077                 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
3078         }
3079         if (xconn->protocol >= PROTOCOL_SMB3_00) {
3080                 allowed_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
3081         }
3082         if ((flags & ~allowed_flags) != 0) {
3083                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
3084         }
3085
3086         if (flags & SMB2_HDR_FLAG_CHAINED) {
3087                 /*
3088                  * This check is mostly for giving the correct error code
3089                  * for compounded requests.
3090                  */
3091                 if (!NT_STATUS_IS_OK(session_status)) {
3092                         return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
3093                 }
3094         } else {
3095                 req->compat_chain_fsp = NULL;
3096         }
3097
3098         if (req->was_encrypted) {
3099                 signing_required = false;
3100         } else if (signing_required || (flags & SMB2_HDR_FLAG_SIGNED)) {
3101                 struct smb2_signing_key *signing_key = NULL;
3102                 bool has_channel = false;
3103
3104                 if (x == NULL) {
3105                         /*
3106                          * MS-SMB2: 3.3.5.2.4 Verifying the Signature.
3107                          * If the SMB2 header of the SMB2 NEGOTIATE
3108                          * request has the SMB2_FLAGS_SIGNED bit set in the
3109                          * Flags field, the server MUST fail the request
3110                          * with STATUS_INVALID_PARAMETER.
3111                          *
3112                          * Microsoft test tool checks this.
3113                          */
3114
3115                         if ((opcode == SMB2_OP_NEGPROT) &&
3116                                         (flags & SMB2_HDR_FLAG_SIGNED)) {
3117                                 status = NT_STATUS_INVALID_PARAMETER;
3118                         } else {
3119                                 status = NT_STATUS_USER_SESSION_DELETED;
3120                         }
3121                         return smbd_smb2_request_error(req, status);
3122                 }
3123
3124                 signing_key = smbd_smb2_signing_key(x, xconn, &has_channel);
3125
3126                 /*
3127                  * If we have a signing key, we should
3128                  * sign the response
3129                  */
3130                 if (smb2_signing_key_valid(signing_key)) {
3131                         req->do_signing = true;
3132                 }
3133
3134                 status = smb2_signing_check_pdu(signing_key,
3135                                                 SMBD_SMB2_IN_HDR_IOV(req),
3136                                                 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
3137                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) &&
3138                     opcode == SMB2_OP_SESSSETUP && !has_channel &&
3139                     NT_STATUS_IS_OK(session_status))
3140                 {
3141                         if (!NT_STATUS_EQUAL(x->status, NT_STATUS_BAD_LOGON_SESSION_STATE)) {
3142                                 struct smbXsrv_session *session = NULL;
3143                                 NTSTATUS error;
3144
3145                                 error = smb2srv_session_lookup_global(req->xconn->client,
3146                                                                       x->global->session_wire_id,
3147                                                                       req,
3148                                                                       &session);
3149                                 if (!NT_STATUS_IS_OK(error)) {
3150                                         return smbd_smb2_request_error(req, error);
3151                                 }
3152
3153                                 /*
3154                                  * We fallback to a session of
3155                                  * another process in order to
3156                                  * get the signing correct.
3157                                  *
3158                                  * We don't set req->last_session_id here.
3159                                  */
3160                                 req->session = x = session;
3161                         }
3162                         goto skipped_signing;
3163                 }
3164                 if (!NT_STATUS_IS_OK(status)) {
3165                         return smbd_smb2_request_error(req, status);
3166                 }
3167
3168                 /*
3169                  * Now that we know the request was correctly signed
3170                  * we have to sign the response too.
3171                  */
3172                 req->do_signing = true;
3173
3174                 if (!NT_STATUS_IS_OK(session_status)) {
3175                         return smbd_smb2_request_error(req, session_status);
3176                 }
3177         } else if (opcode == SMB2_OP_IOCTL) {
3178                 /*
3179                  * Some special IOCTL calls don't require
3180                  * file, tcon nor session.
3181                  *
3182                  * They typically don't do any real action
3183                  * on behalf of the client.
3184                  *
3185                  * They are mainly used to alter the behavior
3186                  * of the connection for testing. So we can
3187                  * run as root and skip all file, tcon and session
3188                  * checks below.
3189                  */
3190                 static const struct smbd_smb2_dispatch_table _root_ioctl_call = {
3191                         _OP(SMB2_OP_IOCTL),
3192                         .as_root = true,
3193                 };
3194                 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
3195                 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
3196                 uint32_t in_ctl_code;
3197                 size_t needed = 4;
3198
3199                 if (needed > body_size) {
3200                         return smbd_smb2_request_error(req,
3201                                         NT_STATUS_INVALID_PARAMETER);
3202                 }
3203
3204                 in_ctl_code = IVAL(body, 0x04);
3205                 /*
3206                  * Only add trusted IOCTL codes here!
3207                  */
3208                 switch (in_ctl_code) {
3209                 case FSCTL_SMBTORTURE_FORCE_UNACKED_TIMEOUT:
3210                         call = &_root_ioctl_call;
3211                         break;
3212                 }
3213         }
3214
3215 skipped_signing:
3216
3217         if (flags & SMB2_HDR_FLAG_CHAINED) {
3218                 req->compound_related = true;
3219         }
3220
3221         if (call->need_session) {
3222                 if (!NT_STATUS_IS_OK(session_status)) {
3223                         return smbd_smb2_request_error(req, session_status);
3224                 }
3225         }
3226
3227         if (call->need_tcon) {
3228                 SMB_ASSERT(call->need_session);
3229
3230                 /*
3231                  * This call needs to be run as user.
3232                  *
3233                  * smbd_smb2_request_check_tcon()
3234                  * calls change_to_user() on success.
3235                  * Which implies set_current_user_info()
3236                  * and chdir_current_service().
3237                  */
3238                 status = smbd_smb2_request_check_tcon(req);
3239                 if (!NT_STATUS_IS_OK(status)) {
3240                         return smbd_smb2_request_error(req, status);
3241                 }
3242                 if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) {
3243                         encryption_desired = true;
3244                 }
3245                 if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED) {
3246                         encryption_required = true;
3247                 }
3248                 if (encryption_required && !req->was_encrypted) {
3249                         req->do_encryption = true;
3250                         return smbd_smb2_request_error(req,
3251                                 NT_STATUS_ACCESS_DENIED);
3252                 } else if (encryption_desired) {
3253                         req->do_encryption = true;
3254                 }
3255         } else if (call->need_session) {
3256                 struct auth_session_info *session_info = NULL;
3257
3258                 /*
3259                  * Unless we also have need_tcon (see above),
3260                  * we still need to call set_current_user_info().
3261                  */
3262
3263                 session_info = req->session->global->auth_session_info;
3264                 if (session_info == NULL) {
3265                         return NT_STATUS_INVALID_HANDLE;
3266                 }
3267
3268                 set_current_user_info(session_info->unix_info->sanitized_username,
3269                                       session_info->unix_info->unix_name,
3270                                       session_info->info->domain_name);
3271         }
3272
3273         if (req->session) {
3274                 bool update_session_global = false;
3275                 bool update_tcon_global = false;
3276
3277                 smb2srv_update_crypto_flags(req, opcode,
3278                                             &update_session_global,
3279                                             &update_tcon_global);
3280
3281                 if (update_session_global) {
3282                         status = smbXsrv_session_update(x);
3283                         if (!NT_STATUS_IS_OK(status)) {
3284                                 return smbd_smb2_request_error(req, status);
3285                         }
3286                 }
3287                 if (update_tcon_global) {
3288                         status = smbXsrv_tcon_update(req->tcon);
3289                         if (!NT_STATUS_IS_OK(status)) {
3290                                 return smbd_smb2_request_error(req, status);
3291                         }
3292                 }
3293         }
3294
3295         if (call->fileid_ofs != 0) {
3296                 size_t needed = call->fileid_ofs + 16;
3297                 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
3298                 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
3299                 uint64_t file_id_persistent;
3300                 uint64_t file_id_volatile;
3301                 struct files_struct *fsp;
3302
3303                 SMB_ASSERT(call->need_tcon);
3304
3305                 if (needed > body_size) {
3306                         return smbd_smb2_request_error(req,
3307                                         NT_STATUS_INVALID_PARAMETER);
3308                 }
3309
3310                 file_id_persistent      = BVAL(body, call->fileid_ofs + 0);
3311                 file_id_volatile        = BVAL(body, call->fileid_ofs + 8);
3312
3313                 fsp = file_fsp_smb2(req, file_id_persistent, file_id_volatile);
3314                 if (fsp == NULL) {
3315                         if (req->compound_related &&
3316                             !NT_STATUS_IS_OK(req->compound_create_err))
3317                         {
3318                                 return smbd_smb2_request_error(req,
3319                                                 req->compound_create_err);
3320                         }
3321                         if (!call->allow_invalid_fileid) {
3322                                 return smbd_smb2_request_error(req,
3323                                                 NT_STATUS_FILE_CLOSED);
3324                         }
3325
3326                         if (file_id_persistent != UINT64_MAX) {
3327                                 return smbd_smb2_request_error(req,
3328                                                 NT_STATUS_FILE_CLOSED);
3329                         }
3330                         if (file_id_volatile != UINT64_MAX) {
3331                                 return smbd_smb2_request_error(req,
3332                                                 NT_STATUS_FILE_CLOSED);
3333                         }
3334                 } else {
3335                         if (fsp->fsp_flags.encryption_required && !req->was_encrypted) {
3336                                 return smbd_smb2_request_error(req,
3337                                                 NT_STATUS_ACCESS_DENIED);
3338                         }
3339                 }
3340         }
3341
3342         status = smbd_smb2_request_dispatch_update_counts(req, call->modify);
3343         if (!NT_STATUS_IS_OK(status)) {
3344                 return smbd_smb2_request_error(req, status);
3345         }
3346
3347         if (call->as_root) {
3348                 SMB_ASSERT(call->fileid_ofs == 0);
3349                 /* This call needs to be run as root */
3350                 change_to_root_user();
3351         } else {
3352                 SMB_ASSERT(call->need_tcon);
3353         }
3354
3355 #define _INBYTES(_r) \
3356         iov_buflen(SMBD_SMB2_IN_HDR_IOV(_r), SMBD_SMB2_NUM_IOV_PER_REQ-1)
3357
3358         switch (opcode) {
3359         case SMB2_OP_NEGPROT:
3360                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_negprot, profile_p,
3361                                                req->profile, _INBYTES(req));
3362                 return_value = smbd_smb2_request_process_negprot(req);
3363                 break;
3364
3365         case SMB2_OP_SESSSETUP:
3366                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_sesssetup, profile_p,
3367                                                req->profile, _INBYTES(req));
3368                 return_value = smbd_smb2_request_process_sesssetup(req);
3369                 break;
3370
3371         case SMB2_OP_LOGOFF:
3372                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_logoff, profile_p,
3373                                                req->profile, _INBYTES(req));
3374                 return_value = smbd_smb2_request_process_logoff(req);
3375                 break;
3376
3377         case SMB2_OP_TCON:
3378                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tcon, profile_p,
3379                                                req->profile, _INBYTES(req));
3380                 return_value = smbd_smb2_request_process_tcon(req);
3381                 break;
3382
3383         case SMB2_OP_TDIS:
3384                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tdis, profile_p,
3385                                                req->profile, _INBYTES(req));
3386                 return_value = smbd_smb2_request_process_tdis(req);
3387                 break;
3388
3389         case SMB2_OP_CREATE:
3390                 if (req->subreq == NULL) {
3391                         SMBPROFILE_IOBYTES_ASYNC_START(smb2_create, profile_p,
3392                                                        req->profile, _INBYTES(req));
3393                 } else {
3394                         SMBPROFILE_IOBYTES_ASYNC_SET_BUSY(req->profile);
3395                 }
3396                 return_value = smbd_smb2_request_process_create(req);
3397                 break;
3398
3399         case SMB2_OP_CLOSE:
3400                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_close, profile_p,
3401                                                req->profile, _INBYTES(req));
3402                 return_value = smbd_smb2_request_process_close(req);
3403                 break;
3404
3405         case SMB2_OP_FLUSH:
3406                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_flush, profile_p,
3407                                                req->profile, _INBYTES(req));
3408                 return_value = smbd_smb2_request_process_flush(req);
3409                 break;
3410
3411         case SMB2_OP_READ:
3412                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_read, profile_p,
3413                                                req->profile, _INBYTES(req));
3414                 return_value = smbd_smb2_request_process_read(req);
3415                 break;
3416
3417         case SMB2_OP_WRITE:
3418                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_write, profile_p,
3419                                                req->profile, _INBYTES(req));
3420                 return_value = smbd_smb2_request_process_write(req);
3421                 break;
3422
3423         case SMB2_OP_LOCK:
3424                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_lock, profile_p,
3425                                                req->profile, _INBYTES(req));
3426                 return_value = smbd_smb2_request_process_lock(req);
3427                 break;
3428
3429         case SMB2_OP_IOCTL:
3430                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_ioctl, profile_p,
3431                                                req->profile, _INBYTES(req));
3432                 return_value = smbd_smb2_request_process_ioctl(req);
3433                 break;
3434
3435         case SMB2_OP_CANCEL:
3436                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_cancel, profile_p,
3437                                                req->profile, _INBYTES(req));
3438                 return_value = smbd_smb2_request_process_cancel(req);
3439                 SMBPROFILE_IOBYTES_ASYNC_END(req->profile, 0);
3440
3441                 /*
3442                  * We don't need the request anymore cancel requests never
3443                  * have a response.
3444                  *
3445                  * smbd_smb2_request_process_cancel() already called
3446                  * DLIST_REMOVE(xconn->smb2.requests, req);
3447                  */
3448                 TALLOC_FREE(req);
3449
3450                 break;
3451
3452         case SMB2_OP_KEEPALIVE:
3453                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_keepalive, profile_p,
3454                                                req->profile, _INBYTES(req));
3455                 return_value = smbd_smb2_request_process_keepalive(req);
3456                 break;
3457
3458         case SMB2_OP_QUERY_DIRECTORY:
3459                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_find, profile_p,
3460                                                req->profile, _INBYTES(req));
3461                 return_value = smbd_smb2_request_process_query_directory(req);
3462                 break;
3463
3464         case SMB2_OP_NOTIFY:
3465                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_notify, profile_p,
3466                                                req->profile, _INBYTES(req));
3467                 return_value = smbd_smb2_request_process_notify(req);
3468                 break;
3469
3470         case SMB2_OP_GETINFO:
3471                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_getinfo, profile_p,
3472                                                req->profile, _INBYTES(req));
3473                 return_value = smbd_smb2_request_process_getinfo(req);
3474                 break;
3475
3476         case SMB2_OP_SETINFO:
3477                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_setinfo, profile_p,
3478                                                req->profile, _INBYTES(req));
3479                 return_value = smbd_smb2_request_process_setinfo(req);
3480                 break;
3481
3482         case SMB2_OP_BREAK:
3483                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_break, profile_p,
3484                                                req->profile, _INBYTES(req));
3485                 return_value = smbd_smb2_request_process_break(req);
3486                 break;
3487
3488         default:
3489                 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
3490                 break;
3491         }
3492         return return_value;
3493 }
3494
3495 static void smbd_smb2_request_reply_update_counts(struct smbd_smb2_request *req)
3496 {
3497         struct smbXsrv_connection *xconn = req->xconn;
3498         const uint8_t *inhdr;
3499         uint16_t channel_sequence;
3500         struct smbXsrv_open *op;
3501
3502         if (!req->request_counters_updated) {
3503                 return;
3504         }
3505
3506         req->request_counters_updated = false;
3507
3508         if (xconn->protocol < PROTOCOL_SMB3_00) {
3509                 return;
3510         }
3511
3512         if (req->compat_chain_fsp == NULL) {
3513                 return;
3514         }
3515
3516         op = req->compat_chain_fsp->op;
3517         if (op == NULL) {
3518                 return;
3519         }
3520
3521         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
3522         channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
3523
3524         if ((op->global->channel_sequence == channel_sequence) &&
3525             (op->global->channel_generation == req->channel_generation)) {
3526                 SMB_ASSERT(op->request_count > 0);
3527                 op->request_count -= 1;
3528         } else {
3529                 SMB_ASSERT(op->pre_request_count > 0);
3530                 op->pre_request_count -= 1;
3531         }
3532 }
3533
3534 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
3535 {
3536         struct smbXsrv_connection *xconn = req->xconn;
3537         int first_idx = 1;
3538         struct iovec *firsttf = SMBD_SMB2_IDX_TF_IOV(req,out,first_idx);
3539         struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
3540         struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
3541         NTSTATUS status;
3542         bool ok;
3543
3544         req->subreq = NULL;
3545         TALLOC_FREE(req->async_te);
3546
3547         /* MS-SMB2: 3.3.4.1 Sending Any Outgoing Message */
3548         smbd_smb2_request_reply_update_counts(req);
3549
3550         if (req->do_encryption &&
3551             (firsttf->iov_len == 0) &&
3552             (!smb2_signing_key_valid(req->first_enc_key)) &&
3553             (req->session != NULL) &&
3554             smb2_signing_key_valid(req->session->global->encryption_key))
3555         {
3556                 struct smb2_signing_key *encryption_key =
3557                         req->session->global->encryption_key;
3558                 uint8_t *tf;
3559                 uint64_t session_id = req->session->global->session_wire_id;
3560                 uint64_t nonce_high;
3561                 uint64_t nonce_low;
3562
3563                 status = smb2_get_new_nonce(req->session,
3564                                             &nonce_high,
3565                                             &nonce_low);
3566                 if (!NT_STATUS_IS_OK(status)) {
3567                         return status;
3568                 }
3569
3570                 /*
3571                  * We need to place the SMB2_TRANSFORM header before the
3572                  * first SMB2 header
3573                  */
3574
3575                 /*
3576                  * we need to remember the encryption key
3577                  * and defer the signing/encryption until
3578                  * we are sure that we do not change
3579                  * the header again.
3580                  */
3581                 status = smb2_signing_key_copy(req,
3582                                                encryption_key,
3583                                                &req->first_enc_key);
3584                 if (!NT_STATUS_IS_OK(status)) {
3585                         return status;
3586                 }
3587
3588                 tf = talloc_zero_array(req, uint8_t,
3589                                        SMB2_TF_HDR_SIZE);
3590                 if (tf == NULL) {
3591                         return NT_STATUS_NO_MEMORY;
3592                 }
3593
3594                 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3595                 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
3596                 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
3597                 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
3598
3599                 firsttf->iov_base = (void *)tf;
3600                 firsttf->iov_len = SMB2_TF_HDR_SIZE;
3601         }
3602
3603         if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
3604             (smb2_signing_key_valid(req->last_sign_key)) &&
3605             (firsttf->iov_len == 0))
3606         {
3607                 int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
3608                 struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
3609
3610                 /*
3611                  * As we are sure the header of the last request in the
3612                  * compound chain will not change, we can to sign here
3613                  * with the last signing key we remembered.
3614                  */
3615                 status = smb2_signing_sign_pdu(req->last_sign_key,
3616                                                lasthdr,
3617                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
3618                 if (!NT_STATUS_IS_OK(status)) {
3619                         return status;
3620                 }
3621         }
3622         TALLOC_FREE(req->last_sign_key);
3623
3624         SMBPROFILE_IOBYTES_ASYNC_END(req->profile,
3625                 iov_buflen(outhdr, SMBD_SMB2_NUM_IOV_PER_REQ-1));
3626
3627         req->current_idx += SMBD_SMB2_NUM_IOV_PER_REQ;
3628
3629         if (req->current_idx < req->out.vector_count) {
3630                 /*
3631                  * We must process the remaining compound
3632                  * SMB2 requests before any new incoming SMB2
3633                  * requests. This is because incoming SMB2
3634                  * requests may include a cancel for a
3635                  * compound request we haven't processed
3636                  * yet.
3637                  */
3638                 struct tevent_immediate *im = tevent_create_immediate(req);
3639                 if (!im) {
3640                         return NT_STATUS_NO_MEMORY;
3641                 }
3642
3643                 if (req->do_signing && firsttf->iov_len == 0) {
3644                         struct smbXsrv_session *x = req->session;
3645                         struct smb2_signing_key *signing_key =
3646                                 smbd_smb2_signing_key(x, xconn, NULL);
3647
3648                         /*
3649                          * we need to remember the signing key
3650                          * and defer the signing until
3651                          * we are sure that we do not change
3652                          * the header again.
3653                          */
3654                         status = smb2_signing_key_copy(req,
3655                                                        signing_key,
3656                                                        &req->last_sign_key);
3657                         if (!NT_STATUS_IS_OK(status)) {
3658                                 return status;
3659                         }
3660                 }
3661
3662                 /*
3663                  * smbd_smb2_request_dispatch() will redo the impersonation.
3664                  * So we use req->xconn->client->raw_ev_ctx instead
3665                  * of req->ev_ctx here.
3666                  */
3667                 tevent_schedule_immediate(im,
3668                                         req->xconn->client->raw_ev_ctx,
3669                                         smbd_smb2_request_dispatch_immediate,
3670                                         req);
3671                 return NT_STATUS_OK;
3672         }
3673
3674         if (req->compound_related) {
3675                 req->compound_related = false;
3676         }
3677
3678         ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
3679         if (!ok) {
3680                 return NT_STATUS_INVALID_PARAMETER_MIX;
3681         }
3682
3683         /* Set credit for these operations (zero credits if this
3684            is a final reply for an async operation). */
3685         smb2_calculate_credits(req, req);
3686
3687         /*
3688          * now check if we need to sign the current response
3689          */
3690         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
3691                 status = smb2_signing_encrypt_pdu(req->first_enc_key,
3692                                         firsttf,
3693                                         req->out.vector_count - first_idx);
3694                 if (!NT_STATUS_IS_OK(status)) {
3695                         return status;
3696                 }
3697         } else if (req->do_signing) {
3698                 struct smbXsrv_session *x = req->session;
3699                 struct smb2_signing_key *signing_key =
3700                         smbd_smb2_signing_key(x, xconn, NULL);
3701
3702                 status = smb2_signing_sign_pdu(signing_key,
3703                                                outhdr,
3704                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
3705                 if (!NT_STATUS_IS_OK(status)) {
3706                         return status;
3707                 }
3708         }
3709         TALLOC_FREE(req->first_enc_key);
3710
3711         if (req->preauth != NULL) {
3712                 gnutls_hash_hd_t hash_hnd = NULL;
3713                 size_t i;
3714                 int rc;
3715
3716                 rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_SHA512);
3717                 if (rc < 0) {
3718                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3719                 }
3720                 rc = gnutls_hash(hash_hnd,
3721                             req->preauth->sha512_value,
3722                             sizeof(req->preauth->sha512_value));
3723                 if (rc < 0) {
3724                         gnutls_hash_deinit(hash_hnd, NULL);
3725                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3726                 }
3727                 for (i = 1; i < req->in.vector_count; i++) {
3728                         rc = gnutls_hash(hash_hnd,
3729                                          req->in.vector[i].iov_base,
3730                                          req->in.vector[i].iov_len);
3731                         if (rc < 0) {
3732                                 gnutls_hash_deinit(hash_hnd, NULL);
3733                                 return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3734                         }
3735                 }
3736                 if (rc < 0) {
3737                         gnutls_hash_deinit(hash_hnd, NULL);
3738                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3739                 }
3740                 gnutls_hash_output(hash_hnd, req->preauth->sha512_value);
3741
3742                 rc = gnutls_hash(hash_hnd,
3743                                  req->preauth->sha512_value,
3744                                  sizeof(req->preauth->sha512_value));
3745                 if (rc < 0) {
3746                         gnutls_hash_deinit(hash_hnd, NULL);
3747                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3748                 }
3749                 for (i = 1; i < req->out.vector_count; i++) {
3750                         rc = gnutls_hash(hash_hnd,
3751                                          req->out.vector[i].iov_base,
3752                                          req->out.vector[i].iov_len);
3753                         if (rc < 0) {
3754                                 gnutls_hash_deinit(hash_hnd, NULL);
3755                                 return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
3756                         }
3757                 }
3758
3759                 gnutls_hash_deinit(hash_hnd, req->preauth->sha512_value);
3760
3761                 req->preauth = NULL;
3762         }
3763
3764         /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
3765         if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
3766             outdyn->iov_base == NULL && outdyn->iov_len != 0) {
3767                 /* Dynamic part is NULL. Chop it off,
3768                    We're going to send it via sendfile. */
3769                 req->out.vector_count -= 1;
3770         }
3771
3772         /*
3773          * We're done with this request -
3774          * move it off the "being processed" queue.
3775          */
3776         DLIST_REMOVE(xconn->smb2.requests, req);
3777
3778         req->queue_entry.mem_ctx = req;
3779         req->queue_entry.vector = req->out.vector;
3780         req->queue_entry.count = req->out.vector_count;
3781         DLIST_ADD_END(xconn->smb2.send_queue, &req->queue_entry);
3782         xconn->smb2.send_queue_len++;
3783
3784         status = smbd_smb2_flush_send_queue(xconn);
3785         if (!NT_STATUS_IS_OK(status)) {
3786                 return status;
3787         }
3788
3789         return NT_STATUS_OK;
3790 }
3791
3792 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn);
3793
3794 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
3795                                         struct tevent_immediate *im,
3796                                         void *private_data)
3797 {
3798         struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
3799                                         struct smbd_smb2_request);
3800         struct smbXsrv_connection *xconn = req->xconn;
3801         NTSTATUS status;
3802
3803         TALLOC_FREE(im);
3804
3805         if (DEBUGLEVEL >= 10) {
3806                 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
3807                         req->current_idx, req->in.vector_count));
3808                 print_req_vectors(req);
3809         }
3810
3811         status = smbd_smb2_request_dispatch(req);
3812         if (!NT_STATUS_IS_OK(status)) {
3813                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3814                 return;
3815         }
3816
3817         status = smbd_smb2_request_next_incoming(xconn);
3818         if (!NT_STATUS_IS_OK(status)) {
3819                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3820                 return;
3821         }
3822 }
3823
3824 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
3825                                    NTSTATUS status,
3826                                    DATA_BLOB body, DATA_BLOB *dyn,
3827                                    const char *location)
3828 {
3829         uint8_t *outhdr;
3830         struct iovec *outbody_v;
3831         struct iovec *outdyn_v;
3832         uint32_t next_command_ofs;
3833         uint64_t mid;
3834
3835         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
3836         mid = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
3837
3838         DBG_DEBUG("mid [%"PRIu64"] idx[%d] status[%s] "
3839                   "body[%u] dyn[%s:%u] at %s\n",
3840                   mid,
3841                   req->current_idx,
3842                   nt_errstr(status),
3843                   (unsigned int)body.length,
3844                   dyn ? "yes" : "no",
3845                   (unsigned int)(dyn ? dyn->length : 0),
3846                   location);
3847
3848         if (body.length < 2) {
3849                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
3850         }
3851
3852         if ((body.length % 2) != 0) {
3853                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
3854         }
3855
3856         outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
3857         outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
3858
3859         next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
3860         SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
3861
3862         outbody_v->iov_base = (void *)body.data;
3863         outbody_v->iov_len = body.length;
3864
3865         if (dyn) {
3866                 outdyn_v->iov_base = (void *)dyn->data;
3867                 outdyn_v->iov_len = dyn->length;
3868         } else {
3869                 outdyn_v->iov_base = NULL;
3870                 outdyn_v->iov_len = 0;
3871         }
3872
3873         /*
3874          * See if we need to recalculate the offset to the next response
3875          *
3876          * Note that all responses may require padding (including the very last
3877          * one).
3878          */
3879         if (req->out.vector_count >= (2 * SMBD_SMB2_NUM_IOV_PER_REQ)) {
3880                 next_command_ofs  = SMB2_HDR_BODY;
3881                 next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
3882                 next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
3883         }
3884
3885         if ((next_command_ofs % 8) != 0) {
3886                 size_t pad_size = 8 - (next_command_ofs % 8);
3887                 if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
3888                         /*
3889                          * if the dyn buffer is empty
3890                          * we can use it to add padding
3891                          */
3892                         uint8_t *pad;
3893
3894                         pad = talloc_zero_array(req,
3895                                                 uint8_t, pad_size);
3896                         if (pad == NULL) {
3897                                 return smbd_smb2_request_error(req,
3898                                                 NT_STATUS_NO_MEMORY);
3899                         }
3900
3901                         outdyn_v->iov_base = (void *)pad;
3902                         outdyn_v->iov_len = pad_size;
3903                 } else {
3904                         /*
3905                          * For now we copy the dynamic buffer
3906                          * and add the padding to the new buffer
3907                          */
3908                         size_t old_size;
3909                         uint8_t *old_dyn;
3910                         size_t new_size;
3911                         uint8_t *new_dyn;
3912
3913                         old_size = SMBD_SMB2_OUT_DYN_LEN(req);
3914                         old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
3915
3916                         new_size = old_size + pad_size;
3917                         new_dyn = talloc_zero_array(req,
3918                                                uint8_t, new_size);
3919                         if (new_dyn == NULL) {
3920                                 return smbd_smb2_request_error(req,
3921                                                 NT_STATUS_NO_MEMORY);
3922                         }
3923
3924                         memcpy(new_dyn, old_dyn, old_size);
3925                         memset(new_dyn + old_size, 0, pad_size);
3926
3927                         outdyn_v->iov_base = (void *)new_dyn;
3928                         outdyn_v->iov_len = new_size;
3929                 }
3930                 next_command_ofs += pad_size;
3931         }
3932
3933         if ((req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) >= req->out.vector_count) {
3934                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
3935         } else {
3936                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
3937         }
3938         return smbd_smb2_request_reply(req);
3939 }
3940
3941 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
3942                                     NTSTATUS status,
3943                                     DATA_BLOB *info,
3944                                     const char *location)
3945 {
3946         struct smbXsrv_connection *xconn = req->xconn;
3947         DATA_BLOB body;
3948         DATA_BLOB _dyn;
3949         uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
3950         size_t unread_bytes = smbd_smb2_unread_bytes(req);
3951
3952         DBG_NOTICE("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| "
3953                    "at %s\n", req->current_idx, nt_errstr(status),
3954                    info ? " +info" : "", location);
3955
3956         if (unread_bytes) {
3957                 /* Recvfile error. Drain incoming socket. */
3958                 size_t ret;
3959
3960                 errno = 0;
3961                 ret = drain_socket(xconn->transport.sock, unread_bytes);
3962                 if (ret != unread_bytes) {
3963                         NTSTATUS error;
3964
3965                         if (errno == 0) {
3966                                 error = NT_STATUS_IO_DEVICE_ERROR;
3967                         } else {
3968                                 error = map_nt_error_from_unix_common(errno);
3969                         }
3970
3971                         DEBUG(2, ("Failed to drain %u bytes from SMB2 socket: "
3972                                   "ret[%u] errno[%d] => %s\n",
3973                                   (unsigned)unread_bytes,
3974                                   (unsigned)ret, errno, nt_errstr(error)));
3975                         return error;
3976                 }
3977         }
3978
3979         body.data = outhdr + SMB2_HDR_BODY;
3980         body.length = 8;
3981         SSVAL(body.data, 0, 9);
3982
3983         if (info) {
3984                 SIVAL(body.data, 0x04, info->length);
3985         } else {
3986                 /* Allocated size of req->out.vector[i].iov_base
3987                  * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
3988                  * 1 byte without having to do an alloc.
3989                  */
3990                 info = &_dyn;
3991                 info->data = ((uint8_t *)outhdr) +
3992                         OUTVEC_ALLOC_SIZE - 1;
3993                 info->length = 1;
3994                 SCVAL(info->data, 0, 0);
3995         }
3996
3997         /*
3998          * Note: Even if there is an error, continue to process the request.
3999          * per MS-SMB2.
4000          */
4001
4002         return smbd_smb2_request_done_ex(req, status, body, info, __location__);
4003 }
4004
4005 struct smbd_smb2_break_state {
4006         struct tevent_req *req;
4007         struct smbd_smb2_send_queue queue_entry;
4008         uint8_t nbt_hdr[NBT_HDR_SIZE];
4009         uint8_t hdr[SMB2_HDR_BODY];
4010         struct iovec vector[1+SMBD_SMB2_NUM_IOV_PER_REQ];
4011 };
4012
4013 static struct tevent_req *smbd_smb2_break_send(TALLOC_CTX *mem_ctx,
4014                                                struct tevent_context *ev,
4015                                                struct smbXsrv_connection *xconn,
4016                                                uint64_t session_id,
4017                                                const uint8_t *body,
4018                                                size_t body_len)
4019 {
4020         struct tevent_req *req = NULL;
4021         struct smbd_smb2_break_state *state = NULL;
4022         NTSTATUS status;
4023         bool ok;
4024
4025         req = tevent_req_create(mem_ctx, &state,
4026                                 struct smbd_smb2_break_state);
4027         if (req == NULL) {
4028                 return NULL;
4029         }
4030
4031         state->req = req;
4032         tevent_req_defer_callback(req, ev);
4033
4034         SIVAL(state->hdr, 0,                            SMB2_MAGIC);
4035         SSVAL(state->hdr, SMB2_HDR_LENGTH,              SMB2_HDR_BODY);
4036         SSVAL(state->hdr, SMB2_HDR_EPOCH,               0);
4037         SIVAL(state->hdr, SMB2_HDR_STATUS,              0);
4038         SSVAL(state->hdr, SMB2_HDR_OPCODE,              SMB2_OP_BREAK);
4039         SSVAL(state->hdr, SMB2_HDR_CREDIT,              0);
4040         SIVAL(state->hdr, SMB2_HDR_FLAGS,               SMB2_HDR_FLAG_REDIRECT);
4041         SIVAL(state->hdr, SMB2_HDR_NEXT_COMMAND,        0);
4042         SBVAL(state->hdr, SMB2_HDR_MESSAGE_ID,          UINT64_MAX);
4043         SIVAL(state->hdr, SMB2_HDR_PID,                 0);
4044         SIVAL(state->hdr, SMB2_HDR_TID,                 0);
4045         SBVAL(state->hdr, SMB2_HDR_SESSION_ID,          session_id);
4046         memset(state->hdr+SMB2_HDR_SIGNATURE, 0, 16);
4047
4048         state->vector[0] = (struct iovec) {
4049                 .iov_base = state->nbt_hdr,
4050                 .iov_len  = sizeof(state->nbt_hdr)
4051         };
4052
4053         state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
4054                 .iov_base = NULL,
4055                 .iov_len  = 0
4056         };
4057
4058         state->vector[1+SMBD_SMB2_HDR_IOV_OFS] = (struct iovec) {
4059                 .iov_base = state->hdr,
4060                 .iov_len  = sizeof(state->hdr)
4061         };
4062
4063         state->vector[1+SMBD_SMB2_BODY_IOV_OFS] = (struct iovec) {
4064                 .iov_base = discard_const_p(uint8_t, body),
4065                 .iov_len  = body_len,
4066         };
4067
4068         /*
4069          * state->vector[1+SMBD_SMB2_DYN_IOV_OFS] is NULL by talloc_zero above
4070          */
4071
4072         ok = smb2_setup_nbt_length(state->vector,
4073                                    1 + SMBD_SMB2_NUM_IOV_PER_REQ);
4074         if (!ok) {
4075                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4076                 return tevent_req_post(req, ev);
4077         }
4078
4079         /*
4080          * We require TCP acks for this PDU to the client!
4081          * We want 5 retransmissions and timeout when the
4082          * retransmission timeout (rto) passed 6 times.
4083          *
4084          * required_acked_bytes gets a dummy value of
4085          * UINT64_MAX, as long it's in xconn->smb2.send_queue,
4086          * it'll get the real value when it's moved to
4087          * xconn->ack.queue.
4088          *
4089          * state->queue_entry.ack.req gets completed with
4090          * 1.  tevent_req_done(), when all bytes are acked.
4091          * 2a. tevent_req_nterror(NT_STATUS_IO_TIMEOUT), when
4092          *     the timeout expired before all bytes were acked.
4093          * 2b. tevent_req_nterror(transport_error), when the
4094          *     connection got a disconnect from the kernel.
4095          */
4096         state->queue_entry.ack.timeout =
4097                 timeval_current_ofs_usec(xconn->ack.rto_usecs * 6);
4098         state->queue_entry.ack.required_acked_bytes = UINT64_MAX;
4099         state->queue_entry.ack.req = req;
4100         state->queue_entry.mem_ctx = state;
4101         state->queue_entry.vector = state->vector;
4102         state->queue_entry.count = ARRAY_SIZE(state->vector);
4103         DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
4104         xconn->smb2.send_queue_len++;
4105
4106         status = smbd_smb2_flush_send_queue(xconn);
4107         if (tevent_req_nterror(req, status)) {
4108                 return tevent_req_post(req, ev);
4109         }
4110
4111         return req;
4112 }
4113
4114 static NTSTATUS smbd_smb2_break_recv(struct tevent_req *req)
4115 {
4116         return tevent_req_simple_recv_ntstatus(req);
4117 }
4118
4119 struct smbXsrv_pending_break {
4120         struct smbXsrv_pending_break *prev, *next;
4121         struct smbXsrv_client *client;
4122         bool disable_oplock_break_retries;
4123         uint64_t session_id;
4124         uint64_t last_channel_id;
4125         union {
4126                 uint8_t generic[1];
4127                 uint8_t oplock[0x18];
4128                 uint8_t lease[0x2c];
4129         } body;
4130         size_t body_len;
4131 };
4132
4133 static void smbXsrv_pending_break_done(struct tevent_req *subreq);
4134
4135 static struct smbXsrv_pending_break *smbXsrv_pending_break_create(
4136                 struct smbXsrv_client *client,
4137                 uint64_t session_id)
4138 {
4139         struct smbXsrv_pending_break *pb = NULL;
4140
4141         pb = talloc_zero(client, struct smbXsrv_pending_break);
4142         if (pb == NULL) {
4143                 return NULL;
4144         }
4145         pb->client = client;
4146         pb->session_id = session_id;
4147         pb->disable_oplock_break_retries = lp_smb2_disable_oplock_break_retry();
4148
4149         return pb;
4150 }
4151
4152 static NTSTATUS smbXsrv_pending_break_submit(struct smbXsrv_pending_break *pb);
4153
4154 static NTSTATUS smbXsrv_pending_break_schedule(struct smbXsrv_pending_break *pb)
4155 {
4156         struct smbXsrv_client *client = pb->client;
4157         NTSTATUS status;
4158
4159         DLIST_ADD_END(client->pending_breaks, pb);
4160         status = smbXsrv_client_pending_breaks_updated(client);
4161         if (!NT_STATUS_IS_OK(status)) {
4162                 return status;
4163         }
4164
4165         status = smbXsrv_pending_break_submit(pb);
4166         if (!NT_STATUS_IS_OK(status)) {
4167                 return status;
4168         }
4169
4170         return NT_STATUS_OK;
4171 }
4172
4173 static NTSTATUS smbXsrv_pending_break_submit(struct smbXsrv_pending_break *pb)
4174 {
4175         struct smbXsrv_client *client = pb->client;
4176         struct smbXsrv_session *session = NULL;
4177         struct smbXsrv_connection *xconn = NULL;
4178         struct smbXsrv_connection *oplock_xconn = NULL;
4179         struct tevent_req *subreq = NULL;
4180         NTSTATUS status;
4181
4182         if (pb->session_id != 0) {
4183                 status = get_valid_smbXsrv_session(client,
4184                                                    pb->session_id,
4185                                                    &session);
4186                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
4187                         return NT_STATUS_ABANDONED;
4188                 }
4189                 if (!NT_STATUS_IS_OK(status)) {
4190                         return status;
4191                 }
4192
4193                 if (pb->last_channel_id != 0) {
4194                         /*
4195                          * This is what current Windows servers
4196                          * do, they don't retry on all available
4197                          * channels. They only use the last channel.
4198                          *
4199                          * But it doesn't match the specification in
4200                          * [MS-SMB2] "3.3.4.6 Object Store Indicates an
4201                          * Oplock Break"
4202                          *
4203                          * Per default disable_oplock_break_retries is false
4204                          * and we behave like the specification.
4205                          */
4206                         if (pb->disable_oplock_break_retries) {
4207                                 return NT_STATUS_ABANDONED;
4208                         }
4209                 }
4210         }
4211
4212         for (xconn = client->connections; xconn != NULL; xconn = xconn->next) {
4213                 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
4214                         continue;
4215                 }
4216
4217                 if (xconn->channel_id == 0) {
4218                         /*
4219                          * non-multichannel case
4220                          */
4221                         break;
4222                 }
4223
4224                 if (session != NULL) {
4225                         struct smbXsrv_channel_global0 *c = NULL;
4226
4227                         /*
4228                          * Having a session means we're handling
4229                          * an oplock break and we only need to
4230                          * use channels available on the
4231                          * session.
4232                          */
4233                         status = smbXsrv_session_find_channel(session, xconn, &c);
4234                         if (!NT_STATUS_IS_OK(status)) {
4235                                 continue;
4236                         }
4237
4238                         /*
4239                          * This is what current Windows servers
4240                          * do, they don't retry on all available
4241                          * channels. They only use the last channel.
4242                          *
4243                          * But it doesn't match the specification
4244                          * in [MS-SMB2] "3.3.4.6 Object Store Indicates an
4245                          * Oplock Break"
4246                          *
4247                          * Per default disable_oplock_break_retries is false
4248                          * and we behave like the specification.
4249                          */
4250                         if (pb->disable_oplock_break_retries) {
4251                                 oplock_xconn = xconn;
4252                                 continue;
4253                         }
4254                 }
4255
4256                 if (xconn->channel_id > pb->last_channel_id) {
4257                         /*
4258                          * multichannel case
4259                          */
4260                         break;
4261                 }
4262         }
4263
4264         if (xconn == NULL) {
4265                 xconn = oplock_xconn;
4266         }
4267
4268         if (xconn == NULL) {
4269                 /*
4270                  * If there's no remaining connection available
4271                  * tell the caller to stop...
4272                  */
4273                 return NT_STATUS_ABANDONED;
4274         }
4275
4276         pb->last_channel_id = xconn->channel_id;
4277
4278         subreq = smbd_smb2_break_send(pb,
4279                                       client->raw_ev_ctx,
4280                                       xconn,
4281                                       pb->session_id,
4282                                       pb->body.generic,
4283                                       pb->body_len);
4284         if (subreq == NULL) {
4285                 return NT_STATUS_NO_MEMORY;
4286         }
4287         tevent_req_set_callback(subreq,
4288                                 smbXsrv_pending_break_done,
4289                                 pb);
4290
4291         return NT_STATUS_OK;
4292 }
4293
4294 static void smbXsrv_pending_break_done(struct tevent_req *subreq)
4295 {
4296         struct smbXsrv_pending_break *pb =
4297                 tevent_req_callback_data(subreq,
4298                 struct smbXsrv_pending_break);
4299         struct smbXsrv_client *client = pb->client;
4300         NTSTATUS status;
4301
4302         status = smbd_smb2_break_recv(subreq);
4303         TALLOC_FREE(subreq);
4304         if (!NT_STATUS_IS_OK(status)) {
4305                 status = smbXsrv_pending_break_submit(pb);
4306                 if (NT_STATUS_EQUAL(status, NT_STATUS_ABANDONED)) {
4307                         /*
4308                          * If there's no remaing connection
4309                          * there's no need to send a break again.
4310                          */
4311                         goto remove;
4312                 }
4313                 if (!NT_STATUS_IS_OK(status)) {
4314                         smbd_server_disconnect_client(client, nt_errstr(status));
4315                         return;
4316                 }
4317                 return;
4318         }
4319
4320 remove:
4321         DLIST_REMOVE(client->pending_breaks, pb);
4322         TALLOC_FREE(pb);
4323
4324         status = smbXsrv_client_pending_breaks_updated(client);
4325         if (!NT_STATUS_IS_OK(status)) {
4326                 smbd_server_disconnect_client(client, nt_errstr(status));
4327                 return;
4328         }
4329 }
4330
4331 NTSTATUS smbd_smb2_send_oplock_break(struct smbXsrv_client *client,
4332                                      struct smbXsrv_open *op,
4333                                      uint8_t oplock_level)
4334 {
4335         struct smbXsrv_pending_break *pb = NULL;
4336         uint8_t *body = NULL;
4337
4338         pb = smbXsrv_pending_break_create(client,
4339                                           op->compat->vuid);
4340         if (pb == NULL) {
4341                 return NT_STATUS_NO_MEMORY;
4342         }
4343         pb->body_len = sizeof(pb->body.oplock);
4344         body = pb->body.oplock;
4345
4346         SSVAL(body, 0x00, pb->body_len);
4347         SCVAL(body, 0x02, oplock_level);
4348         SCVAL(body, 0x03, 0);           /* reserved */
4349         SIVAL(body, 0x04, 0);           /* reserved */
4350         SBVAL(body, 0x08, op->global->open_persistent_id);
4351         SBVAL(body, 0x10, op->global->open_volatile_id);
4352
4353         return smbXsrv_pending_break_schedule(pb);
4354 }
4355
4356 NTSTATUS smbd_smb2_send_lease_break(struct smbXsrv_client *client,
4357                                     uint16_t new_epoch,
4358                                     uint32_t lease_flags,
4359                                     struct smb2_lease_key *lease_key,
4360                                     uint32_t current_lease_state,
4361                                     uint32_t new_lease_state)
4362 {
4363         struct smbXsrv_pending_break *pb = NULL;
4364         uint8_t *body = NULL;
4365
4366         pb = smbXsrv_pending_break_create(client,
4367                                           0); /* no session_id */
4368         if (pb == NULL) {
4369                 return NT_STATUS_NO_MEMORY;
4370         }
4371         pb->body_len = sizeof(pb->body.lease);
4372         body = pb->body.lease;
4373
4374         SSVAL(body, 0x00, pb->body_len);
4375         SSVAL(body, 0x02, new_epoch);
4376         SIVAL(body, 0x04, lease_flags);
4377         SBVAL(body, 0x08, lease_key->data[0]);
4378         SBVAL(body, 0x10, lease_key->data[1]);
4379         SIVAL(body, 0x18, current_lease_state);
4380         SIVAL(body, 0x1c, new_lease_state);
4381         SIVAL(body, 0x20, 0);           /* BreakReason, MUST be 0 */
4382         SIVAL(body, 0x24, 0);           /* AccessMaskHint, MUST be 0 */
4383         SIVAL(body, 0x28, 0);           /* ShareMaskHint, MUST be 0 */
4384
4385         return smbXsrv_pending_break_schedule(pb);
4386 }
4387
4388 static bool is_smb2_recvfile_write(struct smbd_smb2_request_read_state *state)
4389 {
4390         NTSTATUS status;
4391         uint32_t flags;
4392         uint64_t file_id_persistent;
4393         uint64_t file_id_volatile;
4394         struct smbXsrv_open *op = NULL;
4395         struct files_struct *fsp = NULL;
4396         const uint8_t *body = NULL;
4397
4398         /*
4399          * This is only called with a pktbuf
4400          * of at least SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN
4401          * bytes
4402          */
4403
4404         if (IVAL(state->pktbuf, 0) == SMB2_TF_MAGIC) {
4405                 /* Transform header. Cannot recvfile. */
4406                 return false;
4407         }
4408         if (IVAL(state->pktbuf, 0) != SMB2_MAGIC) {
4409                 /* Not SMB2. Normal error path will cope. */
4410                 return false;
4411         }
4412         if (SVAL(state->pktbuf, 4) != SMB2_HDR_BODY) {
4413                 /* Not SMB2. Normal error path will cope. */
4414                 return false;
4415         }
4416         if (SVAL(state->pktbuf, SMB2_HDR_OPCODE) != SMB2_OP_WRITE) {
4417                 /* Needs to be a WRITE. */
4418                 return false;
4419         }
4420         if (IVAL(state->pktbuf, SMB2_HDR_NEXT_COMMAND) != 0) {
4421                 /* Chained. Cannot recvfile. */
4422                 return false;
4423         }
4424         flags = IVAL(state->pktbuf, SMB2_HDR_FLAGS);
4425         if (flags & SMB2_HDR_FLAG_CHAINED) {
4426                 /* Chained. Cannot recvfile. */
4427                 return false;
4428         }
4429         if (flags & SMB2_HDR_FLAG_SIGNED) {
4430                 /* Signed. Cannot recvfile. */
4431                 return false;
4432         }
4433
4434         body = &state->pktbuf[SMB2_HDR_BODY];
4435
4436         file_id_persistent      = BVAL(body, 0x10);
4437         file_id_volatile        = BVAL(body, 0x18);
4438
4439         status = smb2srv_open_lookup(state->req->xconn,
4440                                      file_id_persistent,
4441                                      file_id_volatile,
4442                                      0, /* now */
4443                                      &op);
4444         if (!NT_STATUS_IS_OK(status)) {
4445                 return false;
4446         }
4447
4448         fsp = op->compat;
4449         if (fsp == NULL) {
4450                 return false;
4451         }
4452         if (fsp->conn == NULL) {
4453                 return false;
4454         }
4455
4456         if (IS_IPC(fsp->conn)) {
4457                 return false;
4458         }
4459         if (IS_PRINT(fsp->conn)) {
4460                 return false;
4461         }
4462         if (fsp->base_fsp != NULL) {
4463                 return false;
4464         }
4465
4466         DEBUG(10,("Doing recvfile write len = %u\n",
4467                 (unsigned int)(state->pktfull - state->pktlen)));
4468
4469         return true;
4470 }
4471
4472 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn)
4473 {
4474         struct smbd_server_connection *sconn = xconn->client->sconn;
4475         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
4476         size_t max_send_queue_len;
4477         size_t cur_send_queue_len;
4478
4479         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
4480                 /*
4481                  * we're not supposed to do any io
4482                  */
4483                 return NT_STATUS_OK;
4484         }
4485
4486         if (state->req != NULL) {
4487                 /*
4488                  * if there is already a tstream_readv_pdu
4489                  * pending, we are done.
4490                  */
4491                 return NT_STATUS_OK;
4492         }
4493
4494         max_send_queue_len = MAX(1, xconn->smb2.credits.max/16);
4495         cur_send_queue_len = xconn->smb2.send_queue_len;
4496
4497         if (cur_send_queue_len > max_send_queue_len) {
4498                 /*
4499                  * if we have a lot of requests to send,
4500                  * we wait until they are on the wire until we
4501                  * ask for the next request.
4502                  */
4503                 return NT_STATUS_OK;
4504         }
4505
4506         /* ask for the next request */
4507         ZERO_STRUCTP(state);
4508         state->req = smbd_smb2_request_allocate(xconn);
4509         if (state->req == NULL) {
4510                 return NT_STATUS_NO_MEMORY;
4511         }
4512         state->req->sconn = sconn;
4513         state->req->xconn = xconn;
4514         state->min_recv_size = lp_min_receive_file_size();
4515
4516         TEVENT_FD_READABLE(xconn->transport.fde);
4517
4518         return NT_STATUS_OK;
4519 }
4520
4521 NTSTATUS smbd_smb2_process_negprot(struct smbXsrv_connection *xconn,
4522                                uint64_t expected_seq_low,
4523                                const uint8_t *inpdu, size_t size)
4524 {
4525         struct smbd_server_connection *sconn = xconn->client->sconn;
4526         NTSTATUS status;
4527         struct smbd_smb2_request *req = NULL;
4528
4529         DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
4530                  (unsigned int)size));
4531
4532         status = smbd_initialize_smb2(xconn, expected_seq_low);
4533         if (!NT_STATUS_IS_OK(status)) {
4534                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4535                 return status;
4536         }
4537
4538         /*
4539          * If a new connection joins the process, when we're
4540          * already in a "pending break cycle", we need to
4541          * turn on the ack checker on the new connection.
4542          */
4543         status = smbXsrv_client_pending_breaks_updated(xconn->client);
4544         if (!NT_STATUS_IS_OK(status)) {
4545                 /*
4546                  * If there's a problem, we disconnect the whole
4547                  * client with all connections here!
4548                  *
4549                  * Instead of just the new connection.
4550                  */
4551                 smbd_server_disconnect_client(xconn->client, nt_errstr(status));
4552                 return status;
4553         }
4554
4555         status = smbd_smb2_request_create(xconn, inpdu, size, &req);
4556         if (!NT_STATUS_IS_OK(status)) {
4557                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4558                 return status;
4559         }
4560
4561         status = smbd_smb2_request_validate(req);
4562         if (!NT_STATUS_IS_OK(status)) {
4563                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4564                 return status;
4565         }
4566
4567         status = smbd_smb2_request_setup_out(req);
4568         if (!NT_STATUS_IS_OK(status)) {
4569                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4570                 return status;
4571         }
4572
4573 #ifdef WITH_PROFILE
4574         /*
4575          * this was already counted at the SMB1 layer =>
4576          * smbd_smb2_request_dispatch() should not count it twice.
4577          */
4578         if (profile_p->values.request_stats.count > 0) {
4579                 profile_p->values.request_stats.count--;
4580         }
4581 #endif
4582         status = smbd_smb2_request_dispatch(req);
4583         if (!NT_STATUS_IS_OK(status)) {
4584                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4585                 return status;
4586         }
4587
4588         status = smbd_smb2_request_next_incoming(xconn);
4589         if (!NT_STATUS_IS_OK(status)) {
4590                 smbd_server_connection_terminate(xconn, nt_errstr(status));
4591                 return status;
4592         }
4593
4594         sconn->num_requests++;
4595         return NT_STATUS_OK;
4596 }
4597
4598 static int socket_error_from_errno(int ret,
4599                                    int sys_errno,
4600                                    bool *retry)
4601 {
4602         *retry = false;
4603
4604         if (ret >= 0) {
4605                 return 0;
4606         }
4607
4608         if (ret != -1) {
4609                 return EIO;
4610         }
4611
4612         if (sys_errno == 0) {
4613                 return EIO;
4614         }
4615
4616         if (sys_errno == EINTR) {
4617                 *retry = true;
4618                 return sys_errno;
4619         }
4620
4621         if (sys_errno == EINPROGRESS) {
4622                 *retry = true;
4623                 return sys_errno;
4624         }
4625
4626         if (sys_errno == EAGAIN) {
4627                 *retry = true;
4628                 return sys_errno;
4629         }
4630
4631         /* ENOMEM is retryable on Solaris/illumos, and possibly other systems. */
4632         if (sys_errno == ENOMEM) {
4633                 *retry = true;
4634                 return sys_errno;
4635         }
4636
4637 #ifdef EWOULDBLOCK
4638 #if EWOULDBLOCK != EAGAIN
4639         if (sys_errno == EWOULDBLOCK) {
4640                 *retry = true;
4641                 return sys_errno;
4642         }
4643 #endif
4644 #endif
4645
4646         return sys_errno;
4647 }
4648
4649 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn)
4650 {
4651         int ret;
4652         int err;
4653         bool retry;
4654         NTSTATUS status;
4655
4656         if (xconn->smb2.send_queue == NULL) {
4657                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
4658                 return NT_STATUS_OK;
4659         }
4660
4661         while (xconn->smb2.send_queue != NULL) {
4662                 struct smbd_smb2_send_queue *e = xconn->smb2.send_queue;
4663                 bool ok;
4664                 struct msghdr msg;
4665
4666                 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
4667                         /*
4668                          * we're not supposed to do any io
4669                          * just flush all pending stuff.
4670                          */
4671                         xconn->smb2.send_queue_len--;
4672                         DLIST_REMOVE(xconn->smb2.send_queue, e);
4673
4674                         talloc_free(e->mem_ctx);
4675                         continue;
4676                 }
4677
4678                 if (e->sendfile_header != NULL) {
4679                         size_t size = 0;
4680                         size_t i = 0;
4681                         uint8_t *buf;
4682
4683                         status = NT_STATUS_INTERNAL_ERROR;
4684
4685                         for (i=0; i < e->count; i++) {
4686                                 size += e->vector[i].iov_len;
4687                         }
4688
4689                         if (size <= e->sendfile_header->length) {
4690                                 buf = e->sendfile_header->data;
4691                         } else {
4692                                 buf = talloc_array(e->mem_ctx, uint8_t, size);
4693                                 if (buf == NULL) {
4694                                         return NT_STATUS_NO_MEMORY;
4695                                 }
4696                         }
4697
4698                         size = 0;
4699                         for (i=0; i < e->count; i++) {
4700                                 memcpy(buf+size,
4701                                        e->vector[i].iov_base,
4702                                        e->vector[i].iov_len);
4703                                 size += e->vector[i].iov_len;
4704                         }
4705
4706                         e->sendfile_header->data = buf;
4707                         e->sendfile_header->length = size;
4708                         e->sendfile_status = &status;
4709                         e->count = 0;
4710
4711                         xconn->smb2.send_queue_len--;
4712                         DLIST_REMOVE(xconn->smb2.send_queue, e);
4713
4714                         size += e->sendfile_body_size;
4715
4716                         /*
4717                          * This triggers the sendfile path via
4718                          * the destructor.
4719                          */
4720                         talloc_free(e->mem_ctx);
4721
4722                         if (!NT_STATUS_IS_OK(status)) {
4723                                 smbXsrv_connection_disconnect_transport(xconn,
4724                                                                         status);
4725                                 return status;
4726                         }
4727                         xconn->ack.unacked_bytes += size;
4728                         continue;
4729                 }
4730
4731                 msg = (struct msghdr) {
4732                         .msg_iov = e->vector,
4733                         .msg_iovlen = e->count,
4734                 };
4735
4736                 ret = sendmsg(xconn->transport.sock, &msg, 0);
4737                 if (ret == 0) {
4738                         /* propagate end of file */
4739                         return NT_STATUS_INTERNAL_ERROR;
4740                 }
4741                 err = socket_error_from_errno(ret, errno, &retry);
4742                 if (retry) {
4743                         /* retry later */
4744                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
4745                         return NT_STATUS_OK;
4746                 }
4747                 if (err != 0) {
4748                         status = map_nt_error_from_unix_common(err);
4749                         smbXsrv_connection_disconnect_transport(xconn,
4750                                                                 status);
4751                         return status;
4752                 }
4753
4754                 xconn->ack.unacked_bytes += ret;
4755
4756                 ok = iov_advance(&e->vector, &e->count, ret);
4757                 if (!ok) {
4758                         return NT_STATUS_INTERNAL_ERROR;
4759                 }
4760
4761                 if (e->count > 0) {
4762                         /* we have more to write */
4763                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
4764                         return NT_STATUS_OK;
4765                 }
4766
4767                 xconn->smb2.send_queue_len--;
4768                 DLIST_REMOVE(xconn->smb2.send_queue, e);
4769
4770                 if (e->ack.req == NULL) {
4771                         talloc_free(e->mem_ctx);
4772                         continue;
4773                 }
4774
4775                 e->ack.required_acked_bytes = xconn->ack.unacked_bytes;
4776                 DLIST_ADD_END(xconn->ack.queue, e);
4777         }
4778
4779         /*
4780          * Restart reads if we were blocked on
4781          * draining the send queue.
4782          */
4783
4784         status = smbd_smb2_request_next_incoming(xconn);
4785         if (!NT_STATUS_IS_OK(status)) {
4786                 return status;
4787         }
4788
4789         return NT_STATUS_OK;
4790 }
4791
4792 static NTSTATUS smbd_smb2_io_handler(struct smbXsrv_connection *xconn,
4793                                      uint16_t fde_flags)
4794 {
4795         struct smbd_server_connection *sconn = xconn->client->sconn;
4796         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
4797         struct smbd_smb2_request *req = NULL;
4798         size_t min_recvfile_size = UINT32_MAX;
4799         int ret;
4800         int err;
4801         bool retry;
4802         NTSTATUS status;
4803         NTTIME now;
4804         struct msghdr msg;
4805
4806         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
4807                 /*
4808                  * we're not supposed to do any io
4809                  */
4810                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
4811                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
4812                 return NT_STATUS_OK;
4813         }
4814
4815         if (fde_flags & TEVENT_FD_WRITE) {
4816                 status = smbd_smb2_flush_send_queue(xconn);
4817                 if (!NT_STATUS_IS_OK(status)) {
4818                         return status;
4819                 }
4820         }
4821
4822         if (!(fde_flags & TEVENT_FD_READ)) {
4823                 return NT_STATUS_OK;
4824         }
4825
4826         if (state->req == NULL) {
4827                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
4828                 return NT_STATUS_OK;
4829         }
4830
4831 again:
4832         if (!state->hdr.done) {
4833                 state->hdr.done = true;
4834
4835                 state->vector.iov_base = (void *)state->hdr.nbt;
4836                 state->vector.iov_len = NBT_HDR_SIZE;
4837         }
4838
4839         msg = (struct msghdr) {
4840                 .msg_iov = &state->vector,
4841                 .msg_iovlen = 1,
4842         };
4843
4844         ret = recvmsg(xconn->transport.sock, &msg, 0);
4845         if (ret == 0) {
4846                 /* propagate end of file */
4847                 status = NT_STATUS_END_OF_FILE;
4848                 smbXsrv_connection_disconnect_transport(xconn,
4849                                                         status);
4850                 return status;
4851         }
4852         err = socket_error_from_errno(ret, errno, &retry);
4853         if (retry) {
4854                 /* retry later */
4855                 TEVENT_FD_READABLE(xconn->transport.fde);
4856                 return NT_STATUS_OK;
4857         }
4858         if (err != 0) {
4859                 status = map_nt_error_from_unix_common(err);
4860                 smbXsrv_connection_disconnect_transport(xconn,
4861                                                         status);
4862                 return status;
4863         }
4864
4865         if (ret < state->vector.iov_len) {
4866                 uint8_t *base;
4867                 base = (uint8_t *)state->vector.iov_base;
4868                 base += ret;
4869                 state->vector.iov_base = (void *)base;
4870                 state->vector.iov_len -= ret;
4871                 /* we have more to read */
4872                 TEVENT_FD_READABLE(xconn->transport.fde);
4873                 return NT_STATUS_OK;
4874         }
4875
4876         if (state->pktlen > 0) {
4877                 if (state->doing_receivefile && !is_smb2_recvfile_write(state)) {
4878                         /*
4879                          * Not a possible receivefile write.
4880                          * Read the rest of the data.
4881                          */
4882                         state->doing_receivefile = false;
4883
4884                         state->pktbuf = talloc_realloc(state->req,
4885                                                        state->pktbuf,
4886                                                        uint8_t,
4887                                                        state->pktfull);
4888                         if (state->pktbuf == NULL) {
4889                                 return NT_STATUS_NO_MEMORY;
4890                         }
4891
4892                         state->vector.iov_base = (void *)(state->pktbuf +
4893                                 state->pktlen);
4894                         state->vector.iov_len = (state->pktfull -
4895                                 state->pktlen);
4896
4897                         state->pktlen = state->pktfull;
4898                         goto again;
4899                 }
4900
4901                 /*
4902                  * Either this is a receivefile write so we've
4903                  * done a short read, or if not we have all the data.
4904                  */
4905                 goto got_full;
4906         }
4907
4908         /*
4909          * Now we analyze the NBT header
4910          */
4911         if (state->hdr.nbt[0] != 0x00) {
4912                 state->min_recv_size = 0;
4913         }
4914         state->pktfull = smb2_len(state->hdr.nbt);
4915         if (state->pktfull == 0) {
4916                 goto got_full;
4917         }
4918
4919         if (state->min_recv_size != 0) {
4920                 min_recvfile_size = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
4921                 min_recvfile_size += state->min_recv_size;
4922         }
4923
4924         if (state->pktfull > min_recvfile_size) {
4925                 /*
4926                  * Might be a receivefile write. Read the SMB2 HEADER +
4927                  * SMB2_WRITE header first. Set 'doing_receivefile'
4928                  * as we're *attempting* receivefile write. If this
4929                  * turns out not to be a SMB2_WRITE request or otherwise
4930                  * not suitable then we'll just read the rest of the data
4931                  * the next time this function is called.
4932                  */
4933                 state->pktlen = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
4934                 state->doing_receivefile = true;
4935         } else {
4936                 state->pktlen = state->pktfull;
4937         }
4938
4939         state->pktbuf = talloc_array(state->req, uint8_t, state->pktlen);
4940         if (state->pktbuf == NULL) {
4941                 return NT_STATUS_NO_MEMORY;
4942         }
4943
4944         state->vector.iov_base = (void *)state->pktbuf;
4945         state->vector.iov_len = state->pktlen;
4946
4947         goto again;
4948
4949 got_full:
4950
4951         if (state->hdr.nbt[0] != 0x00) {
4952                 DEBUG(1,("ignore NBT[0x%02X] msg\n",
4953                          state->hdr.nbt[0]));
4954
4955                 req = state->req;
4956                 ZERO_STRUCTP(state);
4957                 state->req = req;
4958                 state->min_recv_size = lp_min_receive_file_size();
4959                 req = NULL;
4960                 goto again;
4961         }
4962
4963         req = state->req;
4964         state->req = NULL;
4965
4966         req->request_time = timeval_current();
4967         now = timeval_to_nttime(&req->request_time);
4968
4969         status = smbd_smb2_inbuf_parse_compound(xconn,
4970                                                 now,
4971                                                 state->pktbuf,
4972                                                 state->pktlen,
4973                                                 req,
4974                                                 &req->in.vector,
4975                                                 &req->in.vector_count);
4976         if (!NT_STATUS_IS_OK(status)) {
4977                 return status;
4978         }
4979
4980         if (state->doing_receivefile) {
4981                 req->smb1req = talloc_zero(req, struct smb_request);
4982                 if (req->smb1req == NULL) {
4983                         return NT_STATUS_NO_MEMORY;
4984                 }
4985                 req->smb1req->unread_bytes = state->pktfull - state->pktlen;
4986         }
4987
4988         ZERO_STRUCTP(state);
4989
4990         req->current_idx = 1;
4991
4992         DEBUG(10,("smbd_smb2_request idx[%d] of %d vectors\n",
4993                  req->current_idx, req->in.vector_count));
4994
4995         status = smbd_smb2_request_validate(req);
4996         if (!NT_STATUS_IS_OK(status)) {
4997                 return status;
4998         }
4999
5000         status = smbd_smb2_request_setup_out(req);
5001         if (!NT_STATUS_IS_OK(status)) {
5002                 return status;
5003         }
5004
5005         status = smbd_smb2_request_dispatch(req);
5006         if (!NT_STATUS_IS_OK(status)) {
5007                 return status;
5008         }
5009
5010         sconn->num_requests++;
5011
5012         /* The timeout_processing function isn't run nearly
5013            often enough to implement 'max log size' without
5014            overrunning the size of the file by many megabytes.
5015            This is especially true if we are running at debug
5016            level 10.  Checking every 50 SMB2s is a nice
5017            tradeoff of performance vs log file size overrun. */
5018
5019         if ((sconn->num_requests % 50) == 0 &&
5020             need_to_check_log_size()) {
5021                 change_to_root_user();
5022                 check_log_size();
5023         }
5024
5025         status = smbd_smb2_request_next_incoming(xconn);
5026         if (!NT_STATUS_IS_OK(status)) {
5027                 return status;
5028         }
5029
5030         return NT_STATUS_OK;
5031 }
5032
5033 static void smbd_smb2_connection_handler(struct tevent_context *ev,
5034                                          struct tevent_fd *fde,
5035                                          uint16_t flags,
5036                                          void *private_data)
5037 {
5038         struct smbXsrv_connection *xconn =
5039                 talloc_get_type_abort(private_data,
5040                 struct smbXsrv_connection);
5041         NTSTATUS status;
5042
5043         status = smbd_smb2_io_handler(xconn, flags);
5044         if (!NT_STATUS_IS_OK(status)) {
5045                 smbd_server_connection_terminate(xconn, nt_errstr(status));
5046                 return;
5047         }
5048 }