source3/smbd/smbXsrv_open.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2012
   5    Copyright (C) Michael Adam 2012
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "smbXsrv_open.h"
  22 #include "includes.h"
  23 #include "system/filesys.h"
  24 #include "lib/util/server_id.h"
  25 #include "smbd/smbd.h"
  26 #include "smbd/globals.h"
  27 #include "dbwrap/dbwrap.h"
  28 #include "dbwrap/dbwrap_rbt.h"
  29 #include "dbwrap/dbwrap_open.h"
  30 #include "../libcli/security/security.h"
  31 #include "messages.h"
  32 #include "lib/util/util_tdb.h"
  33 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  34 #include "serverid.h"
  35 #include "source3/include/util_tdb.h"
  36
  37 struct smbXsrv_open_table {
  38         struct {
  39                 struct db_context *db_ctx;
  40                 struct db_context *replay_cache_db_ctx;
  41                 uint32_t lowest_id;
  42                 uint32_t highest_id;
  43                 uint32_t max_opens;
  44                 uint32_t num_opens;
  45         } local;
  46         struct {
  47                 struct db_context *db_ctx;
  48         } global;
  49 };
  50
  51 static struct db_context *smbXsrv_open_global_db_ctx = NULL;
  52
  53 NTSTATUS smbXsrv_open_global_init(void)
  54 {
  55         char *global_path = NULL;
  56         struct db_context *db_ctx = NULL;
  57
  58         if (smbXsrv_open_global_db_ctx != NULL) {
  59                 return NT_STATUS_OK;
  60         }
  61
  62         global_path = lock_path(talloc_tos(), "smbXsrv_open_global.tdb");
  63         if (global_path == NULL) {
  64                 return NT_STATUS_NO_MEMORY;
  65         }
  66
  67         db_ctx = db_open(NULL, global_path,
  68                          SMBD_VOLATILE_TDB_HASH_SIZE,
  69                          SMBD_VOLATILE_TDB_FLAGS,
  70                          O_RDWR | O_CREAT, 0600,
  71                          DBWRAP_LOCK_ORDER_1,
  72                          DBWRAP_FLAG_NONE);
  73         TALLOC_FREE(global_path);
  74         if (db_ctx == NULL) {
  75                 NTSTATUS status;
  76
  77                 status = map_nt_error_from_unix_common(errno);
  78
  79                 return status;
  80         }
  81
  82         smbXsrv_open_global_db_ctx = db_ctx;
  83
  84         return NT_STATUS_OK;
  85 }
  86
  87 /*
  88  * NOTE:
  89  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
  90  * has the same result as integer comparison between the uint32_t
  91  * values.
  92  *
  93  * TODO: implement string based key
  94  */
  95
  96 #define SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
  97
  98 static TDB_DATA smbXsrv_open_global_id_to_key(uint32_t id,
  99                                               uint8_t *key_buf)
 100 {
 101         TDB_DATA key;
 102
 103         RSIVAL(key_buf, 0, id);
 104
 105         key = make_tdb_data(key_buf, SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE);
 106
 107         return key;
 108 }
 109
 110 #if 0
 111 static NTSTATUS smbXsrv_open_global_key_to_id(TDB_DATA key, uint32_t *id)
 112 {
 113         if (id == NULL) {
 114                 return NT_STATUS_INVALID_PARAMETER;
 115         }
 116
 117         if (key.dsize != SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE) {
 118                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 119         }
 120
 121         *id = RIVAL(key.dptr, 0);
 122
 123         return NT_STATUS_OK;
 124 }
 125 #endif
 126
 127 #define SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
 128
 129 static TDB_DATA smbXsrv_open_local_id_to_key(uint32_t id,
 130                                              uint8_t *key_buf)
 131 {
 132         TDB_DATA key;
 133
 134         RSIVAL(key_buf, 0, id);
 135
 136         key = make_tdb_data(key_buf, SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE);
 137
 138         return key;
 139 }
 140
 141 static NTSTATUS smbXsrv_open_local_key_to_id(TDB_DATA key, uint32_t *id)
 142 {
 143         if (id == NULL) {
 144                 return NT_STATUS_INVALID_PARAMETER;
 145         }
 146
 147         if (key.dsize != SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE) {
 148                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 149         }
 150
 151         *id = RIVAL(key.dptr, 0);
 152
 153         return NT_STATUS_OK;
 154 }
 155
 156 static struct db_record *smbXsrv_open_global_fetch_locked(
 157                         struct db_context *db,
 158                         uint32_t id,
 159                         TALLOC_CTX *mem_ctx)
 160 {
 161         TDB_DATA key;
 162         uint8_t key_buf[SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE];
 163         struct db_record *rec = NULL;
 164
 165         key = smbXsrv_open_global_id_to_key(id, key_buf);
 166
 167         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 168
 169         if (rec == NULL) {
 170                 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
 171                           tdb_data_dbg(key));
 172         }
 173
 174         return rec;
 175 }
 176
 177 static struct db_record *smbXsrv_open_local_fetch_locked(
 178                         struct db_context *db,
 179                         uint32_t id,
 180                         TALLOC_CTX *mem_ctx)
 181 {
 182         TDB_DATA key;
 183         uint8_t key_buf[SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE];
 184         struct db_record *rec = NULL;
 185
 186         key = smbXsrv_open_local_id_to_key(id, key_buf);
 187
 188         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 189
 190         if (rec == NULL) {
 191                 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
 192                           tdb_data_dbg(key));
 193         }
 194
 195         return rec;
 196 }
 197
 198 static NTSTATUS smbXsrv_open_table_init(struct smbXsrv_connection *conn,
 199                                         uint32_t lowest_id,
 200                                         uint32_t highest_id,
 201                                         uint32_t max_opens)
 202 {
 203         struct smbXsrv_client *client = conn->client;
 204         struct smbXsrv_open_table *table;
 205         NTSTATUS status;
 206         uint64_t max_range;
 207
 208         if (lowest_id > highest_id) {
 209                 return NT_STATUS_INTERNAL_ERROR;
 210         }
 211
 212         max_range = highest_id;
 213         max_range -= lowest_id;
 214         max_range += 1;
 215
 216         if (max_opens > max_range) {
 217                 return NT_STATUS_INTERNAL_ERROR;
 218         }
 219
 220         table = talloc_zero(client, struct smbXsrv_open_table);
 221         if (table == NULL) {
 222                 return NT_STATUS_NO_MEMORY;
 223         }
 224
 225         table->local.db_ctx = db_open_rbt(table);
 226         if (table->local.db_ctx == NULL) {
 227                 TALLOC_FREE(table);
 228                 return NT_STATUS_NO_MEMORY;
 229         }
 230         table->local.replay_cache_db_ctx = db_open_rbt(table);
 231         if (table->local.replay_cache_db_ctx == NULL) {
 232                 TALLOC_FREE(table);
 233                 return NT_STATUS_NO_MEMORY;
 234         }
 235         table->local.lowest_id = lowest_id;
 236         table->local.highest_id = highest_id;
 237         table->local.max_opens = max_opens;
 238
 239         status = smbXsrv_open_global_init();
 240         if (!NT_STATUS_IS_OK(status)) {
 241                 TALLOC_FREE(table);
 242                 return status;
 243         }
 244
 245         table->global.db_ctx = smbXsrv_open_global_db_ctx;
 246
 247         client->open_table = table;
 248         return NT_STATUS_OK;
 249 }
 250
 251 struct smbXsrv_open_local_allocate_state {
 252         const uint32_t lowest_id;
 253         const uint32_t highest_id;
 254         uint32_t last_id;
 255         uint32_t useable_id;
 256         NTSTATUS status;
 257 };
 258
 259 static int smbXsrv_open_local_allocate_traverse(struct db_record *rec,
 260                                                    void *private_data)
 261 {
 262         struct smbXsrv_open_local_allocate_state *state =
 263                 (struct smbXsrv_open_local_allocate_state *)private_data;
 264         TDB_DATA key = dbwrap_record_get_key(rec);
 265         uint32_t id = 0;
 266         NTSTATUS status;
 267
 268         status = smbXsrv_open_local_key_to_id(key, &id);
 269         if (!NT_STATUS_IS_OK(status)) {
 270                 state->status = status;
 271                 return -1;
 272         }
 273
 274         if (id <= state->last_id) {
 275                 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 276                 return -1;
 277         }
 278         state->last_id = id;
 279
 280         if (id > state->useable_id) {
 281                 state->status = NT_STATUS_OK;
 282                 return -1;
 283         }
 284
 285         if (state->useable_id == state->highest_id) {
 286                 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
 287                 return -1;
 288         }
 289
 290         state->useable_id +=1;
 291         return 0;
 292 }
 293
 294 static NTSTATUS smbXsrv_open_local_allocate_id(struct db_context *db,
 295                                                uint32_t lowest_id,
 296                                                uint32_t highest_id,
 297                                                TALLOC_CTX *mem_ctx,
 298                                                struct db_record **_rec,
 299                                                uint32_t *_id)
 300 {
 301         struct smbXsrv_open_local_allocate_state state = {
 302                 .lowest_id = lowest_id,
 303                 .highest_id = highest_id,
 304                 .last_id = 0,
 305                 .useable_id = lowest_id,
 306                 .status = NT_STATUS_INTERNAL_ERROR,
 307         };
 308         uint32_t i;
 309         uint32_t range;
 310         NTSTATUS status;
 311         int count = 0;
 312
 313         *_rec = NULL;
 314         *_id = 0;
 315
 316         if (lowest_id > highest_id) {
 317                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 318         }
 319
 320         /*
 321          * first we try randomly
 322          */
 323         range = (highest_id - lowest_id) + 1;
 324
 325         for (i = 0; i < (range / 2); i++) {
 326                 uint32_t id;
 327                 TDB_DATA val;
 328                 struct db_record *rec = NULL;
 329
 330                 id = generate_random() % range;
 331                 id += lowest_id;
 332
 333                 if (id < lowest_id) {
 334                         id = lowest_id;
 335                 }
 336                 if (id > highest_id) {
 337                         id = highest_id;
 338                 }
 339
 340                 rec = smbXsrv_open_local_fetch_locked(db, id, mem_ctx);
 341                 if (rec == NULL) {
 342                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 343                 }
 344
 345                 val = dbwrap_record_get_value(rec);
 346                 if (val.dsize != 0) {
 347                         TALLOC_FREE(rec);
 348                         continue;
 349                 }
 350
 351                 *_rec = rec;
 352                 *_id = id;
 353                 return NT_STATUS_OK;
 354         }
 355
 356         /*
 357          * if the range is almost full,
 358          * we traverse the whole table
 359          * (this relies on sorted behavior of dbwrap_rbt)
 360          */
 361         status = dbwrap_traverse_read(db, smbXsrv_open_local_allocate_traverse,
 362                                       &state, &count);
 363         if (NT_STATUS_IS_OK(status)) {
 364                 if (NT_STATUS_IS_OK(state.status)) {
 365                         return NT_STATUS_INTERNAL_ERROR;
 366                 }
 367
 368                 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
 369                         return state.status;
 370                 }
 371
 372                 if (state.useable_id <= state.highest_id) {
 373                         state.status = NT_STATUS_OK;
 374                 } else {
 375                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 376                 }
 377         } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
 378                 /*
 379                  * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
 380                  *
 381                  * If we get anything else it is an error, because it
 382                  * means we did not manage to find a free slot in
 383                  * the db.
 384                  */
 385                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 386         }
 387
 388         if (NT_STATUS_IS_OK(state.status)) {
 389                 uint32_t id;
 390                 TDB_DATA val;
 391                 struct db_record *rec = NULL;
 392
 393                 id = state.useable_id;
 394
 395                 rec = smbXsrv_open_local_fetch_locked(db, id, mem_ctx);
 396                 if (rec == NULL) {
 397                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 398                 }
 399
 400                 val = dbwrap_record_get_value(rec);
 401                 if (val.dsize != 0) {
 402                         TALLOC_FREE(rec);
 403                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 404                 }
 405
 406                 *_rec = rec;
 407                 *_id = id;
 408                 return NT_STATUS_OK;
 409         }
 410
 411         return state.status;
 412 }
 413
 414 struct smbXsrv_open_local_fetch_state {
 415         struct smbXsrv_open *op;
 416         NTSTATUS status;
 417 };
 418
 419 static void smbXsrv_open_local_fetch_parser(TDB_DATA key, TDB_DATA data,
 420                                             void *private_data)
 421 {
 422         struct smbXsrv_open_local_fetch_state *state =
 423                 (struct smbXsrv_open_local_fetch_state *)private_data;
 424         void *ptr;
 425
 426         if (data.dsize != sizeof(ptr)) {
 427                 state->status = NT_STATUS_INTERNAL_DB_ERROR;
 428                 return;
 429         }
 430
 431         memcpy(&ptr, data.dptr, data.dsize);
 432         state->op = talloc_get_type_abort(ptr, struct smbXsrv_open);
 433         state->status = NT_STATUS_OK;
 434 }
 435
 436 static NTSTATUS smbXsrv_open_local_lookup(struct smbXsrv_open_table *table,
 437                                           uint32_t open_local_id,
 438                                           uint32_t open_global_id,
 439                                           NTTIME now,
 440                                           struct smbXsrv_open **_open)
 441 {
 442         struct smbXsrv_open_local_fetch_state state = {
 443                 .op = NULL,
 444                 .status = NT_STATUS_INTERNAL_ERROR,
 445         };
 446         uint8_t key_buf[SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE];
 447         TDB_DATA key;
 448         NTSTATUS status;
 449
 450         *_open = NULL;
 451
 452         if (open_local_id == 0) {
 453                 return NT_STATUS_FILE_CLOSED;
 454         }
 455
 456         if (table == NULL) {
 457                 /* this might happen before the end of negprot */
 458                 return NT_STATUS_FILE_CLOSED;
 459         }
 460
 461         if (table->local.db_ctx == NULL) {
 462                 return NT_STATUS_INTERNAL_ERROR;
 463         }
 464
 465         key = smbXsrv_open_local_id_to_key(open_local_id, key_buf);
 466
 467         status = dbwrap_parse_record(table->local.db_ctx, key,
 468                                      smbXsrv_open_local_fetch_parser,
 469                                      &state);
 470         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
 471                 return NT_STATUS_FILE_CLOSED;
 472         }
 473         if (!NT_STATUS_IS_OK(status)) {
 474                 return status;
 475         }
 476         if (!NT_STATUS_IS_OK(state.status)) {
 477                 return state.status;
 478         }
 479
 480         if (NT_STATUS_EQUAL(state.op->status, NT_STATUS_FILE_CLOSED)) {
 481                 return NT_STATUS_FILE_CLOSED;
 482         }
 483
 484         if (open_global_id == 0) {
 485                 /* make the global check a no-op for SMB1 */
 486                 open_global_id = state.op->global->open_global_id;
 487         }
 488
 489         if (state.op->global->open_global_id != open_global_id) {
 490                 return NT_STATUS_FILE_CLOSED;
 491         }
 492
 493         if (now != 0) {
 494                 state.op->idle_time = now;
 495         }
 496
 497         *_open = state.op;
 498         return state.op->status;
 499 }
 500
 501 static int smbXsrv_open_global_destructor(struct smbXsrv_open_global0 *global)
 502 {
 503         return 0;
 504 }
 505
 506 static void smbXsrv_open_global_verify_record(struct db_record *db_rec,
 507                                         bool *is_free,
 508                                         bool *was_free,
 509                                         TALLOC_CTX *mem_ctx,
 510                                         struct smbXsrv_open_global0 **_g);
 511
 512 static NTSTATUS smbXsrv_open_global_allocate(struct db_context *db,
 513                                         TALLOC_CTX *mem_ctx,
 514                                         struct smbXsrv_open_global0 **_global)
 515 {
 516         uint32_t i;
 517         struct smbXsrv_open_global0 *global = NULL;
 518         uint32_t last_free = 0;
 519         const uint32_t min_tries = 3;
 520
 521         *_global = NULL;
 522
 523         global = talloc_zero(mem_ctx, struct smbXsrv_open_global0);
 524         if (global == NULL) {
 525                 return NT_STATUS_NO_MEMORY;
 526         }
 527         talloc_set_destructor(global, smbXsrv_open_global_destructor);
 528
 529         /*
 530          * We mark every slot as invalid using 0xFF.
 531          * Valid values are masked with 0xF.
 532          */
 533         memset(global->lock_sequence_array, 0xFF,
 534                sizeof(global->lock_sequence_array));
 535
 536         /*
 537          * Here we just randomly try the whole 32-bit space
 538          *
 539          * We use just 32-bit, because we want to reuse the
 540          * ID for SRVSVC.
 541          */
 542         for (i = 0; i < UINT32_MAX; i++) {
 543                 bool is_free = false;
 544                 bool was_free = false;
 545                 uint32_t id;
 546
 547                 if (i >= min_tries && last_free != 0) {
 548                         id = last_free;
 549                 } else {
 550                         id = generate_random();
 551                 }
 552                 if (id == 0) {
 553                         id++;
 554                 }
 555                 if (id == UINT32_MAX) {
 556                         id--;
 557                 }
 558
 559                 global->db_rec = smbXsrv_open_global_fetch_locked(db, id, mem_ctx);
 560                 if (global->db_rec == NULL) {
 561                         talloc_free(global);
 562                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 563                 }
 564
 565                 smbXsrv_open_global_verify_record(global->db_rec,
 566                                                   &is_free,
 567                                                   &was_free,
 568                                                   NULL, NULL);
 569
 570                 if (!is_free) {
 571                         TALLOC_FREE(global->db_rec);
 572                         continue;
 573                 }
 574
 575                 if (!was_free && i < min_tries) {
 576                         /*
 577                          * The session_id is free now,
 578                          * but was not free before.
 579                          *
 580                          * This happens if a smbd crashed
 581                          * and did not cleanup the record.
 582                          *
 583                          * If this is one of our first tries,
 584                          * then we try to find a real free one.
 585                          */
 586                         if (last_free == 0) {
 587                                 last_free = id;
 588                         }
 589                         TALLOC_FREE(global->db_rec);
 590                         continue;
 591                 }
 592
 593                 global->open_global_id = id;
 594
 595                 *_global = global;
 596                 return NT_STATUS_OK;
 597         }
 598
 599         /* should not be reached */
 600         talloc_free(global);
 601         return NT_STATUS_INTERNAL_ERROR;
 602 }
 603
 604 static void smbXsrv_open_global_verify_record(struct db_record *db_rec,
 605                                         bool *is_free,
 606                                         bool *was_free,
 607                                         TALLOC_CTX *mem_ctx,
 608                                         struct smbXsrv_open_global0 **_g)
 609 {
 610         TDB_DATA key;
 611         TDB_DATA val;
 612         DATA_BLOB blob;
 613         struct smbXsrv_open_globalB global_blob;
 614         enum ndr_err_code ndr_err;
 615         struct smbXsrv_open_global0 *global = NULL;
 616         bool exists;
 617         TALLOC_CTX *frame = talloc_stackframe();
 618
 619         *is_free = false;
 620
 621         if (was_free) {
 622                 *was_free = false;
 623         }
 624         if (_g) {
 625                 *_g = NULL;
 626         }
 627
 628         key = dbwrap_record_get_key(db_rec);
 629
 630         val = dbwrap_record_get_value(db_rec);
 631         if (val.dsize == 0) {
 632                 DEBUG(10, ("%s: empty value\n", __func__));
 633                 TALLOC_FREE(frame);
 634                 *is_free = true;
 635                 if (was_free) {
 636                         *was_free = true;
 637                 }
 638                 return;
 639         }
 640
 641         blob = data_blob_const(val.dptr, val.dsize);
 642
 643         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 644                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_open_globalB);
 645         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 646                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 647                 DEBUG(1,("smbXsrv_open_global_verify_record: "
 648                          "key '%s' ndr_pull_struct_blob - %s\n",
 649                          tdb_data_dbg(key),
 650                          nt_errstr(status)));
 651                 TALLOC_FREE(frame);
 652                 return;
 653         }
 654
 655         DEBUG(10,("smbXsrv_open_global_verify_record\n"));
 656         if (CHECK_DEBUGLVL(10)) {
 657                 NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
 658         }
 659
 660         if (global_blob.version != SMBXSRV_VERSION_0) {
 661                 DEBUG(0,("smbXsrv_open_global_verify_record: "
 662                          "key '%s' use unsupported version %u\n",
 663                          tdb_data_dbg(key),
 664                          global_blob.version));
 665                 NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
 666                 TALLOC_FREE(frame);
 667                 return;
 668         }
 669
 670         global = global_blob.info.info0;
 671
 672         if (server_id_is_disconnected(&global->server_id)) {
 673                 exists = true;
 674         } else {
 675                 exists = serverid_exists(&global->server_id);
 676         }
 677         if (!exists) {
 678                 struct server_id_buf idbuf;
 679                 DEBUG(2,("smbXsrv_open_global_verify_record: "
 680                          "key '%s' server_id %s does not exist.\n",
 681                          tdb_data_dbg(key),
 682                          server_id_str_buf(global->server_id, &idbuf)));
 683                 if (CHECK_DEBUGLVL(2)) {
 684                         NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
 685                 }
 686                 TALLOC_FREE(frame);
 687                 dbwrap_record_delete(db_rec);
 688                 *is_free = true;
 689                 return;
 690         }
 691
 692         if (_g) {
 693                 *_g = talloc_move(mem_ctx, &global);
 694         }
 695         TALLOC_FREE(frame);
 696 }
 697
 698 static NTSTATUS smbXsrv_open_global_store(struct smbXsrv_open_global0 *global)
 699 {
 700         struct smbXsrv_open_globalB global_blob;
 701         DATA_BLOB blob = data_blob_null;
 702         TDB_DATA key;
 703         TDB_DATA val;
 704         NTSTATUS status;
 705         enum ndr_err_code ndr_err;
 706
 707         /*
 708          * TODO: if we use other versions than '0'
 709          * we would add glue code here, that would be able to
 710          * store the information in the old format.
 711          */
 712
 713         if (global->db_rec == NULL) {
 714                 return NT_STATUS_INTERNAL_ERROR;
 715         }
 716
 717         key = dbwrap_record_get_key(global->db_rec);
 718         val = dbwrap_record_get_value(global->db_rec);
 719
 720         global_blob = (struct smbXsrv_open_globalB) {
 721                 .version = smbXsrv_version_global_current(),
 722         };
 723
 724         if (val.dsize >= 8) {
 725                 global_blob.seqnum = IVAL(val.dptr, 4);
 726         }
 727         global_blob.seqnum += 1;
 728         global_blob.info.info0 = global;
 729
 730         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 731                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_open_globalB);
 732         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 733                 status = ndr_map_error2ntstatus(ndr_err);
 734                 DEBUG(1,("smbXsrv_open_global_store: key '%s' ndr_push - %s\n",
 735                          tdb_data_dbg(key),
 736                          nt_errstr(status)));
 737                 TALLOC_FREE(global->db_rec);
 738                 return status;
 739         }
 740
 741         val = make_tdb_data(blob.data, blob.length);
 742         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 743         if (!NT_STATUS_IS_OK(status)) {
 744                 DEBUG(1,("smbXsrv_open_global_store: key '%s' store - %s\n",
 745                          tdb_data_dbg(key),
 746                          nt_errstr(status)));
 747                 TALLOC_FREE(global->db_rec);
 748                 return status;
 749         }
 750
 751         if (CHECK_DEBUGLVL(10)) {
 752                 DEBUG(10,("smbXsrv_open_global_store: key '%s' stored\n",
 753                           tdb_data_dbg(key)));
 754                 NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
 755         }
 756
 757         TALLOC_FREE(global->db_rec);
 758
 759         return NT_STATUS_OK;
 760 }
 761
 762 static NTSTATUS smbXsrv_open_global_lookup(struct smbXsrv_open_table *table,
 763                                            uint32_t open_global_id,
 764                                            TALLOC_CTX *mem_ctx,
 765                                            struct smbXsrv_open_global0 **_global)
 766 {
 767         struct db_record *global_rec = NULL;
 768         bool is_free = false;
 769
 770         *_global = NULL;
 771
 772         if (table->global.db_ctx == NULL) {
 773                 return NT_STATUS_INTERNAL_ERROR;
 774         }
 775
 776         global_rec = smbXsrv_open_global_fetch_locked(table->global.db_ctx,
 777                                                       open_global_id,
 778                                                       mem_ctx);
 779         if (global_rec == NULL) {
 780                 return NT_STATUS_INTERNAL_DB_ERROR;
 781         }
 782
 783         smbXsrv_open_global_verify_record(global_rec,
 784                                           &is_free,
 785                                           NULL,
 786                                           mem_ctx,
 787                                           _global);
 788         if (is_free) {
 789                 DEBUG(10, ("%s: is_free=true\n", __func__));
 790                 talloc_free(global_rec);
 791                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 792         }
 793
 794         (*_global)->db_rec = talloc_move(*_global, &global_rec);
 795
 796         talloc_set_destructor(*_global, smbXsrv_open_global_destructor);
 797
 798         return NT_STATUS_OK;
 799 }
 800
 801 static int smbXsrv_open_destructor(struct smbXsrv_open *op)
 802 {
 803         NTSTATUS status;
 804
 805         status = smbXsrv_open_close(op, 0);
 806         if (!NT_STATUS_IS_OK(status)) {
 807                 DEBUG(0, ("smbXsrv_open_destructor: "
 808                           "smbXsrv_open_close() failed - %s\n",
 809                           nt_errstr(status)));
 810         }
 811
 812         TALLOC_FREE(op->global);
 813
 814         return 0;
 815 }
 816
 817 NTSTATUS smbXsrv_open_create(struct smbXsrv_connection *conn,
 818                              struct auth_session_info *session_info,
 819                              NTTIME now,
 820                              struct smbXsrv_open **_open)
 821 {
 822         struct smbXsrv_open_table *table = conn->client->open_table;
 823         struct db_record *local_rec = NULL;
 824         struct smbXsrv_open *op = NULL;
 825         void *ptr = NULL;
 826         TDB_DATA val;
 827         struct smbXsrv_open_global0 *global = NULL;
 828         NTSTATUS status;
 829         struct dom_sid *current_sid = NULL;
 830         struct security_token *current_token = NULL;
 831
 832         if (session_info == NULL) {
 833                 return NT_STATUS_INVALID_HANDLE;
 834         }
 835         current_token = session_info->security_token;
 836
 837         if (current_token == NULL) {
 838                 return NT_STATUS_INVALID_HANDLE;
 839         }
 840
 841         if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
 842                 current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
 843         }
 844
 845         if (current_sid == NULL) {
 846                 return NT_STATUS_INVALID_HANDLE;
 847         }
 848
 849         if (table->local.num_opens >= table->local.max_opens) {
 850                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 851         }
 852
 853         op = talloc_zero(table, struct smbXsrv_open);
 854         if (op == NULL) {
 855                 return NT_STATUS_NO_MEMORY;
 856         }
 857         op->table = table;
 858         op->status = NT_STATUS_OK; /* TODO: start with INTERNAL_ERROR */
 859         op->idle_time = now;
 860
 861         status = smbXsrv_open_global_allocate(table->global.db_ctx,
 862                                               op, &global);
 863         if (!NT_STATUS_IS_OK(status)) {
 864                 TALLOC_FREE(op);
 865                 return status;
 866         }
 867         op->global = global;
 868
 869         status = smbXsrv_open_local_allocate_id(table->local.db_ctx,
 870                                                 table->local.lowest_id,
 871                                                 table->local.highest_id,
 872                                                 op,
 873                                                 &local_rec,
 874                                                 &op->local_id);
 875         if (!NT_STATUS_IS_OK(status)) {
 876                 TALLOC_FREE(op);
 877                 return status;
 878         }
 879
 880         global->open_persistent_id = global->open_global_id;
 881         global->open_volatile_id = op->local_id;
 882
 883         global->server_id = messaging_server_id(conn->client->msg_ctx);
 884         global->open_time = now;
 885         global->open_owner = *current_sid;
 886         if (conn->protocol >= PROTOCOL_SMB2_10) {
 887                 global->client_guid = conn->smb2.client.guid;
 888         }
 889
 890         ptr = op;
 891         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
 892         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
 893         TALLOC_FREE(local_rec);
 894         if (!NT_STATUS_IS_OK(status)) {
 895                 TALLOC_FREE(op);
 896                 return status;
 897         }
 898         table->local.num_opens += 1;
 899
 900         talloc_set_destructor(op, smbXsrv_open_destructor);
 901
 902         status = smbXsrv_open_global_store(global);
 903         if (!NT_STATUS_IS_OK(status)) {
 904                 DEBUG(0,("smbXsrv_open_create: "
 905                          "global_id (0x%08x) store failed - %s\n",
 906                          op->global->open_global_id,
 907                          nt_errstr(status)));
 908                 TALLOC_FREE(op);
 909                 return status;
 910         }
 911
 912         if (CHECK_DEBUGLVL(10)) {
 913                 struct smbXsrv_openB open_blob = {
 914                         .version = SMBXSRV_VERSION_0,
 915                         .info.info0 = op,
 916                 };
 917
 918                 DEBUG(10,("smbXsrv_open_create: global_id (0x%08x) stored\n",
 919                          op->global->open_global_id));
 920                 NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
 921         }
 922
 923         *_open = op;
 924         return NT_STATUS_OK;
 925 }
 926
 927 static NTSTATUS smbXsrv_open_set_replay_cache(struct smbXsrv_open *op)
 928 {
 929         struct GUID *create_guid;
 930         struct GUID_txt_buf buf;
 931         char *guid_string;
 932         struct db_context *db = op->table->local.replay_cache_db_ctx;
 933         struct smbXsrv_open_replay_cache rc = {
 934                 .idle_time = op->idle_time,
 935                 .local_id = op->local_id,
 936         };
 937         uint8_t data[SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE] = { 0 };
 938         DATA_BLOB blob = data_blob_const(data, ARRAY_SIZE(data));
 939         enum ndr_err_code ndr_err;
 940         NTSTATUS status;
 941         TDB_DATA key;
 942         TDB_DATA val;
 943
 944         if (!(op->flags & SMBXSRV_OPEN_NEED_REPLAY_CACHE)) {
 945                 return NT_STATUS_OK;
 946         }
 947
 948         if (op->flags & SMBXSRV_OPEN_HAVE_REPLAY_CACHE) {
 949                 return NT_STATUS_OK;
 950         }
 951
 952         create_guid = &op->global->create_guid;
 953         guid_string = GUID_buf_string(create_guid, &buf);
 954         key = string_term_tdb_data(guid_string);
 955
 956         ndr_err = ndr_push_struct_into_fixed_blob(&blob, &rc,
 957                 (ndr_push_flags_fn_t)ndr_push_smbXsrv_open_replay_cache);
 958         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 959                 status = ndr_map_error2ntstatus(ndr_err);
 960                 return status;
 961         }
 962         val = make_tdb_data(blob.data, blob.length);
 963
 964         status = dbwrap_store(db, key, val, TDB_REPLACE);
 965
 966         if (NT_STATUS_IS_OK(status)) {
 967                 op->flags |= SMBXSRV_OPEN_HAVE_REPLAY_CACHE;
 968                 op->flags &= ~SMBXSRV_OPEN_NEED_REPLAY_CACHE;
 969         }
 970
 971         return status;
 972 }
 973
 974 NTSTATUS smbXsrv_open_purge_replay_cache(struct smbXsrv_client *client,
 975                                          const struct GUID *create_guid)
 976 {
 977         struct GUID_txt_buf buf;
 978         char *guid_string;
 979         struct db_context *db;
 980
 981         if (client->open_table == NULL) {
 982                 return NT_STATUS_OK;
 983         }
 984
 985         db = client->open_table->local.replay_cache_db_ctx;
 986
 987         guid_string = GUID_buf_string(create_guid, &buf);
 988         if (guid_string == NULL) {
 989                 return NT_STATUS_INVALID_PARAMETER;
 990         }
 991
 992         return dbwrap_purge_bystring(db, guid_string);
 993 }
 994
 995 static NTSTATUS smbXsrv_open_clear_replay_cache(struct smbXsrv_open *op)
 996 {
 997         struct GUID *create_guid;
 998         struct GUID_txt_buf buf;
 999         char *guid_string;
1000         struct db_context *db;
1001         NTSTATUS status;
1002
1003         if (op->table == NULL) {
1004                 return NT_STATUS_OK;
1005         }
1006
1007         db = op->table->local.replay_cache_db_ctx;
1008
1009         if (!(op->flags & SMBXSRV_OPEN_HAVE_REPLAY_CACHE)) {
1010                 return NT_STATUS_OK;
1011         }
1012
1013         create_guid = &op->global->create_guid;
1014         if (GUID_all_zero(create_guid)) {
1015                 return NT_STATUS_OK;
1016         }
1017
1018         guid_string = GUID_buf_string(create_guid, &buf);
1019         if (guid_string == NULL) {
1020                 return NT_STATUS_INVALID_PARAMETER;
1021         }
1022
1023         status = dbwrap_purge_bystring(db, guid_string);
1024
1025         if (NT_STATUS_IS_OK(status)) {
1026                 op->flags &= ~SMBXSRV_OPEN_HAVE_REPLAY_CACHE;
1027         }
1028
1029         return status;
1030 }
1031
1032 NTSTATUS smbXsrv_open_update(struct smbXsrv_open *op)
1033 {
1034         struct smbXsrv_open_table *table = op->table;
1035         NTSTATUS status;
1036
1037         if (op->global->db_rec != NULL) {
1038                 DEBUG(0, ("smbXsrv_open_update(0x%08x): "
1039                           "Called with db_rec != NULL'\n",
1040                           op->global->open_global_id));
1041                 return NT_STATUS_INTERNAL_ERROR;
1042         }
1043
1044         op->global->db_rec = smbXsrv_open_global_fetch_locked(
1045                                                 table->global.db_ctx,
1046                                                 op->global->open_global_id,
1047                                                 op->global /* TALLOC_CTX */);
1048         if (op->global->db_rec == NULL) {
1049                 return NT_STATUS_INTERNAL_DB_ERROR;
1050         }
1051
1052         status = smbXsrv_open_global_store(op->global);
1053         if (!NT_STATUS_IS_OK(status)) {
1054                 DEBUG(0,("smbXsrv_open_update: "
1055                          "global_id (0x%08x) store failed - %s\n",
1056                          op->global->open_global_id,
1057                          nt_errstr(status)));
1058                 return status;
1059         }
1060
1061         status = smbXsrv_open_set_replay_cache(op);
1062         if (!NT_STATUS_IS_OK(status)) {
1063                 DBG_ERR("smbXsrv_open_set_replay_cache failed: %s\n",
1064                         nt_errstr(status));
1065                 return status;
1066         }
1067
1068         if (CHECK_DEBUGLVL(10)) {
1069                 struct smbXsrv_openB open_blob = {
1070                         .version = SMBXSRV_VERSION_0,
1071                         .info.info0 = op,
1072                 };
1073
1074                 DEBUG(10,("smbXsrv_open_update: global_id (0x%08x) stored\n",
1075                           op->global->open_global_id));
1076                 NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
1077         }
1078
1079         return NT_STATUS_OK;
1080 }
1081
1082 NTSTATUS smbXsrv_open_close(struct smbXsrv_open *op, NTTIME now)
1083 {
1084         struct smbXsrv_open_table *table;
1085         struct db_record *local_rec = NULL;
1086         struct db_record *global_rec = NULL;
1087         NTSTATUS status;
1088         NTSTATUS error = NT_STATUS_OK;
1089
1090         error = smbXsrv_open_clear_replay_cache(op);
1091         if (!NT_STATUS_IS_OK(error)) {
1092                 DBG_ERR("smbXsrv_open_clear_replay_cache failed: %s\n",
1093                         nt_errstr(error));
1094         }
1095
1096         if (op->table == NULL) {
1097                 return error;
1098         }
1099
1100         table = op->table;
1101         op->table = NULL;
1102
1103         op->status = NT_STATUS_FILE_CLOSED;
1104         op->global->disconnect_time = now;
1105         server_id_set_disconnected(&op->global->server_id);
1106
1107         global_rec = op->global->db_rec;
1108         op->global->db_rec = NULL;
1109         if (global_rec == NULL) {
1110                 global_rec = smbXsrv_open_global_fetch_locked(
1111                                         table->global.db_ctx,
1112                                         op->global->open_global_id,
1113                                         op->global /* TALLOC_CTX */);
1114                 if (global_rec == NULL) {
1115                         error = NT_STATUS_INTERNAL_ERROR;
1116                 }
1117         }
1118
1119         if (global_rec != NULL && op->global->durable) {
1120                 /*
1121                  * If it is a durable open we need to update the global part
1122                  * instead of deleting it
1123                  */
1124                 op->global->db_rec = global_rec;
1125                 status = smbXsrv_open_global_store(op->global);
1126                 if (NT_STATUS_IS_OK(status)) {
1127                         /*
1128                          * smbXsrv_open_global_store does the free
1129                          * of op->global->db_rec
1130                          */
1131                         global_rec = NULL;
1132                 }
1133                 if (!NT_STATUS_IS_OK(status)) {
1134                         DEBUG(0,("smbXsrv_open_close(0x%08x)"
1135                                  "smbXsrv_open_global_store() failed - %s\n",
1136                                  op->global->open_global_id,
1137                                  nt_errstr(status)));
1138                         error = status;
1139                 }
1140
1141                 if (NT_STATUS_IS_OK(status) && CHECK_DEBUGLVL(10)) {
1142                         struct smbXsrv_openB open_blob = {
1143                                 .version = SMBXSRV_VERSION_0,
1144                                 .info.info0 = op,
1145                         };
1146
1147                         DEBUG(10,("smbXsrv_open_close(0x%08x): "
1148                                   "stored disconnect\n",
1149                                   op->global->open_global_id));
1150                         NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
1151                 }
1152         }
1153
1154         if (global_rec != NULL) {
1155                 status = dbwrap_record_delete(global_rec);
1156                 if (!NT_STATUS_IS_OK(status)) {
1157                         TDB_DATA key = dbwrap_record_get_key(global_rec);
1158
1159                         DEBUG(0, ("smbXsrv_open_close(0x%08x): "
1160                                   "failed to delete global key '%s': %s\n",
1161                                   op->global->open_global_id,
1162                                   tdb_data_dbg(key),
1163                                   nt_errstr(status)));
1164                         error = status;
1165                 }
1166         }
1167         TALLOC_FREE(global_rec);
1168
1169         local_rec = op->db_rec;
1170         if (local_rec == NULL) {
1171                 local_rec = smbXsrv_open_local_fetch_locked(table->local.db_ctx,
1172                                                             op->local_id,
1173                                                             op /* TALLOC_CTX*/);
1174                 if (local_rec == NULL) {
1175                         error = NT_STATUS_INTERNAL_ERROR;
1176                 }
1177         }
1178
1179         if (local_rec != NULL) {
1180                 status = dbwrap_record_delete(local_rec);
1181                 if (!NT_STATUS_IS_OK(status)) {
1182                         TDB_DATA key = dbwrap_record_get_key(local_rec);
1183
1184                         DEBUG(0, ("smbXsrv_open_close(0x%08x): "
1185                                   "failed to delete local key '%s': %s\n",
1186                                   op->global->open_global_id,
1187                                   tdb_data_dbg(key),
1188                                   nt_errstr(status)));
1189                         error = status;
1190                 }
1191                 table->local.num_opens -= 1;
1192         }
1193         if (op->db_rec == NULL) {
1194                 TALLOC_FREE(local_rec);
1195         }
1196         op->db_rec = NULL;
1197
1198         if (op->compat) {
1199                 op->compat->op = NULL;
1200                 file_free(NULL, op->compat);
1201                 op->compat = NULL;
1202         }
1203
1204         return error;
1205 }
1206
1207 NTSTATUS smb1srv_open_table_init(struct smbXsrv_connection *conn)
1208 {
1209         uint32_t max_opens;
1210
1211         /*
1212          * Allow a range from 1..65534.
1213          *
1214          * With real_max_open_files possible ids,
1215          * truncated to the SMB1 limit of 16-bit.
1216          *
1217          * 0 and 0xFFFF are no valid ids.
1218          */
1219         max_opens = conn->client->sconn->real_max_open_files;
1220         max_opens = MIN(max_opens, UINT16_MAX - 1);
1221
1222         return smbXsrv_open_table_init(conn, 1, UINT16_MAX - 1, max_opens);
1223 }
1224
1225 NTSTATUS smb1srv_open_lookup(struct smbXsrv_connection *conn,
1226                              uint16_t fnum, NTTIME now,
1227                              struct smbXsrv_open **_open)
1228 {
1229         struct smbXsrv_open_table *table = conn->client->open_table;
1230         uint32_t local_id = fnum;
1231         uint32_t global_id = 0;
1232
1233         return smbXsrv_open_local_lookup(table, local_id, global_id, now, _open);
1234 }
1235
1236 NTSTATUS smb2srv_open_table_init(struct smbXsrv_connection *conn)
1237 {
1238         uint32_t max_opens;
1239
1240         /*
1241          * Allow a range from 1..4294967294.
1242          *
1243          * With real_max_open_files possible ids,
1244          * truncated to 16-bit (the same as SMB1 for now).
1245          *
1246          * 0 and 0xFFFFFFFF are no valid ids.
1247          *
1248          * The usage of conn->sconn->real_max_open_files
1249          * is the reason that we use one open table per
1250          * transport connection (as we still have a 1:1 mapping
1251          * between process and transport connection).
1252          */
1253         max_opens = conn->client->sconn->real_max_open_files;
1254         max_opens = MIN(max_opens, UINT16_MAX - 1);
1255
1256         return smbXsrv_open_table_init(conn, 1, UINT32_MAX - 1, max_opens);
1257 }
1258
1259 NTSTATUS smb2srv_open_lookup(struct smbXsrv_connection *conn,
1260                              uint64_t persistent_id,
1261                              uint64_t volatile_id,
1262                              NTTIME now,
1263                              struct smbXsrv_open **_open)
1264 {
1265         struct smbXsrv_open_table *table = conn->client->open_table;
1266         uint32_t local_id = volatile_id & UINT32_MAX;
1267         uint64_t local_zeros = volatile_id & 0xFFFFFFFF00000000LLU;
1268         uint32_t global_id = persistent_id & UINT32_MAX;
1269         uint64_t global_zeros = persistent_id & 0xFFFFFFFF00000000LLU;
1270         NTSTATUS status;
1271
1272         if (local_zeros != 0) {
1273                 return NT_STATUS_FILE_CLOSED;
1274         }
1275
1276         if (global_zeros != 0) {
1277                 return NT_STATUS_FILE_CLOSED;
1278         }
1279
1280         if (global_id == 0) {
1281                 return NT_STATUS_FILE_CLOSED;
1282         }
1283
1284         status = smbXsrv_open_local_lookup(table, local_id, global_id, now,
1285                                            _open);
1286         if (!NT_STATUS_IS_OK(status)) {
1287                 return status;
1288         }
1289
1290         /*
1291          * Clear the replay cache for this create_guid if it exists:
1292          * This is based on the assumption that this lookup will be
1293          * triggered by a client request using the file-id for lookup.
1294          * Hence the client has proven that it has in fact seen the
1295          * reply to its initial create call. So subsequent create replays
1296          * should be treated as invalid. Hence the index for create_guid
1297          * lookup needs to be removed.
1298          */
1299         status = smbXsrv_open_clear_replay_cache(*_open);
1300
1301         return status;
1302 }
1303
1304 /*
1305  * This checks or marks the replay cache, we have the following
1306  * cases:
1307  *
1308  * 1. There is no record in the cache
1309  *    => we add the passes caller_req_guid as holder_req_guid
1310  *       together with local_id as 0.
1311  *    => We return STATUS_FWP_RESERVED in order to indicate
1312  *       that the caller holds the current reservation
1313  *
1314  * 2. There is a record in the cache and holder_req_guid
1315  *    is already the same as caller_req_guid and local_id is 0
1316  *    => We return STATUS_FWP_RESERVED in order to indicate
1317  *       that the caller holds the current reservation
1318  *
1319  * 3. There is a record in the cache with a holder_req_guid
1320  *    other than caller_req_guid (and local_id is 0):
1321  *    => We return NT_STATUS_FILE_NOT_AVAILABLE to indicate
1322  *       the original request is still pending
1323  *
1324  * 4. There is a record in the cache with a zero holder_req_guid
1325  *    and a valid local_id:
1326  *    => We lookup the existing open by local_id
1327  *    => We return NT_STATUS_OK together with the smbXsrv_open
1328  *
1329  *
1330  * With NT_STATUS_OK the caller can continue the replay processing.
1331  *
1332  * With STATUS_FWP_RESERVED the caller should continue the normal
1333  * open processing:
1334  * - On success:
1335  *   - smbXsrv_open_update()/smbXsrv_open_set_replay_cache()
1336  *     will convert the record to a zero holder_req_guid
1337  *     with a valid local_id.
1338  * - On failure:
1339  *   - smbXsrv_open_purge_replay_cache() should cleanup
1340  *     the reservation.
1341  *
1342  * All other values should be returned to the client,
1343  * while NT_STATUS_FILE_NOT_AVAILABLE will trigger the
1344  * retry loop on the client.
1345  */
1346 NTSTATUS smb2srv_open_lookup_replay_cache(struct smbXsrv_connection *conn,
1347                                           struct GUID caller_req_guid,
1348                                           struct GUID create_guid,
1349                                           const char *name,
1350                                           NTTIME now,
1351                                           struct smbXsrv_open **_open)
1352 {
1353         TALLOC_CTX *frame = talloc_stackframe();
1354         NTSTATUS status;
1355         struct smbXsrv_open_table *table = conn->client->open_table;
1356         struct db_context *db = table->local.replay_cache_db_ctx;
1357         struct GUID_txt_buf _create_guid_buf;
1358         struct GUID_txt_buf tmp_guid_buf;
1359         const char *create_guid_str = NULL;
1360         TDB_DATA create_guid_key;
1361         struct db_record *db_rec = NULL;
1362         struct smbXsrv_open *op = NULL;
1363         struct smbXsrv_open_replay_cache rc = {
1364                 .holder_req_guid = caller_req_guid,
1365                 .idle_time = now,
1366                 .local_id = 0,
1367         };
1368         enum ndr_err_code ndr_err;
1369         DATA_BLOB blob = data_blob_null;
1370         TDB_DATA val;
1371
1372         *_open = NULL;
1373
1374         create_guid_str = GUID_buf_string(&create_guid, &_create_guid_buf);
1375         create_guid_key = string_term_tdb_data(create_guid_str);
1376
1377         db_rec = dbwrap_fetch_locked(db, frame, create_guid_key);
1378         if (db_rec == NULL) {
1379                 TALLOC_FREE(frame);
1380                 return NT_STATUS_INTERNAL_DB_ERROR;
1381         }
1382
1383         val = dbwrap_record_get_value(db_rec);
1384         if (val.dsize == 0) {
1385                 uint8_t data[SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE];
1386
1387                 blob = data_blob_const(data, ARRAY_SIZE(data));
1388                 ndr_err = ndr_push_struct_into_fixed_blob(&blob, &rc,
1389                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_open_replay_cache);
1390                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1391                         status = ndr_map_error2ntstatus(ndr_err);
1392                         TALLOC_FREE(frame);
1393                         return status;
1394                 }
1395
1396                 val = make_tdb_data(blob.data, blob.length);
1397                 status = dbwrap_record_store(db_rec, val, TDB_REPLACE);
1398                 if (!NT_STATUS_IS_OK(status)) {
1399                         TALLOC_FREE(frame);
1400                         return status;
1401                 }
1402
1403                 /*
1404                  * We're the new holder
1405                  */
1406                 *_open = NULL;
1407                 TALLOC_FREE(frame);
1408                 return NT_STATUS_FWP_RESERVED;
1409         }
1410
1411         if (val.dsize != SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE) {
1412                 TALLOC_FREE(frame);
1413                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1414         }
1415
1416         blob = data_blob_const(val.dptr, val.dsize);
1417         ndr_err = ndr_pull_struct_blob_all_noalloc(&blob, &rc,
1418                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_open_replay_cache);
1419         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1420                 status = ndr_map_error2ntstatus(ndr_err);
1421                 TALLOC_FREE(frame);
1422                 return status;
1423         }
1424         if (rc.local_id != 0) {
1425                 if (GUID_equal(&rc.holder_req_guid, &caller_req_guid)) {
1426                         /*
1427                          * This should not happen
1428                          */
1429                         status = NT_STATUS_INTERNAL_ERROR;
1430                         DBG_ERR("caller %s already holds local_id %u for create %s [%s] - %s\n",
1431                                 GUID_buf_string(&caller_req_guid, &tmp_guid_buf),
1432                                 (unsigned)rc.local_id,
1433                                 create_guid_str,
1434                                 name,
1435                                 nt_errstr(status));
1436
1437                         TALLOC_FREE(frame);
1438                         return status;
1439                 }
1440
1441                 status = smbXsrv_open_local_lookup(table,
1442                                                    rc.local_id,
1443                                                    0, /* global_id */
1444                                                    now,
1445                                                    &op);
1446                 if (!NT_STATUS_IS_OK(status)) {
1447                         DBG_ERR("holder %s stale for local_id %u for create %s [%s] - %s\n",
1448                                 GUID_buf_string(&rc.holder_req_guid, &tmp_guid_buf),
1449                                 (unsigned)rc.local_id,
1450                                 create_guid_str,
1451                                 name,
1452                                 nt_errstr(status));
1453
1454                         TALLOC_FREE(frame);
1455                         return status;
1456                 }
1457
1458                 /*
1459                  * We found an open the caller can reuse.
1460                  */
1461                 SMB_ASSERT(op != NULL);
1462                 *_open = op;
1463                 TALLOC_FREE(frame);
1464                 return NT_STATUS_OK;
1465         }
1466
1467         if (GUID_equal(&rc.holder_req_guid, &caller_req_guid)) {
1468                 /*
1469                  * We're still the holder
1470                  */
1471                 *_open = NULL;
1472                 TALLOC_FREE(frame);
1473                 return NT_STATUS_FWP_RESERVED;
1474         }
1475
1476         /*
1477          * The original request (or a former replay) is still
1478          * pending, ask the client to retry by sending FILE_NOT_AVAILABLE.
1479          */
1480         status = NT_STATUS_FILE_NOT_AVAILABLE;
1481         DBG_DEBUG("holder %s still pending for create %s [%s] - %s\n",
1482                    GUID_buf_string(&rc.holder_req_guid, &tmp_guid_buf),
1483                    create_guid_str,
1484                    name,
1485                    nt_errstr(status));
1486         TALLOC_FREE(frame);
1487         return status;
1488 }
1489
1490 NTSTATUS smb2srv_open_recreate(struct smbXsrv_connection *conn,
1491                                struct auth_session_info *session_info,
1492                                uint64_t persistent_id,
1493                                const struct GUID *create_guid,
1494                                NTTIME now,
1495                                struct smbXsrv_open **_open)
1496 {
1497         struct smbXsrv_open_table *table = conn->client->open_table;
1498         struct db_record *local_rec = NULL;
1499         struct smbXsrv_open *op = NULL;
1500         void *ptr = NULL;
1501         TDB_DATA val;
1502         uint32_t global_id = persistent_id & UINT32_MAX;
1503         uint64_t global_zeros = persistent_id & 0xFFFFFFFF00000000LLU;
1504         NTSTATUS status;
1505         struct security_token *current_token = NULL;
1506
1507         if (session_info == NULL) {
1508                 DEBUG(10, ("session_info=NULL\n"));
1509                 return NT_STATUS_INVALID_HANDLE;
1510         }
1511         current_token = session_info->security_token;
1512
1513         if (current_token == NULL) {
1514                 DEBUG(10, ("current_token=NULL\n"));
1515                 return NT_STATUS_INVALID_HANDLE;
1516         }
1517
1518         if (global_zeros != 0) {
1519                 DEBUG(10, ("global_zeros!=0\n"));
1520                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1521         }
1522
1523         op = talloc_zero(table, struct smbXsrv_open);
1524         if (op == NULL) {
1525                 return NT_STATUS_NO_MEMORY;
1526         }
1527         op->table = table;
1528
1529         status = smbXsrv_open_global_lookup(table, global_id, op, &op->global);
1530         if (!NT_STATUS_IS_OK(status)) {
1531                 TALLOC_FREE(op);
1532                 DEBUG(10, ("smbXsrv_open_global_lookup returned %s\n",
1533                            nt_errstr(status)));
1534                 return status;
1535         }
1536
1537         /*
1538          * If the provided create_guid is NULL, this means that
1539          * the reconnect request was a v1 request. In that case
1540          * we should skipt the create GUID verification, since
1541          * it is valid to v1-reconnect a v2-opened handle.
1542          */
1543         if ((create_guid != NULL) &&
1544             !GUID_equal(&op->global->create_guid, create_guid))
1545         {
1546                 TALLOC_FREE(op);
1547                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1548         }
1549
1550         if (!security_token_is_sid(current_token, &op->global->open_owner)) {
1551                 TALLOC_FREE(op);
1552                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1553         }
1554
1555         if (!op->global->durable) {
1556                 TALLOC_FREE(op);
1557                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1558         }
1559
1560         if (table->local.num_opens >= table->local.max_opens) {
1561                 TALLOC_FREE(op);
1562                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1563         }
1564
1565         status = smbXsrv_open_local_allocate_id(table->local.db_ctx,
1566                                                 table->local.lowest_id,
1567                                                 table->local.highest_id,
1568                                                 op,
1569                                                 &local_rec,
1570                                                 &op->local_id);
1571         if (!NT_STATUS_IS_OK(status)) {
1572                 TALLOC_FREE(op);
1573                 return status;
1574         }
1575
1576         op->idle_time = now;
1577         op->status = NT_STATUS_FILE_CLOSED;
1578
1579         op->global->open_volatile_id = op->local_id;
1580         op->global->server_id = messaging_server_id(conn->client->msg_ctx);
1581
1582         ptr = op;
1583         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1584         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1585         TALLOC_FREE(local_rec);
1586         if (!NT_STATUS_IS_OK(status)) {
1587                 TALLOC_FREE(op);
1588                 return status;
1589         }
1590         table->local.num_opens += 1;
1591
1592         talloc_set_destructor(op, smbXsrv_open_destructor);
1593
1594         status = smbXsrv_open_global_store(op->global);
1595         if (!NT_STATUS_IS_OK(status)) {
1596                 TALLOC_FREE(op);
1597                 return status;
1598         }
1599
1600         if (CHECK_DEBUGLVL(10)) {
1601                 struct smbXsrv_openB open_blob = {
1602                         .info.info0 = op,
1603                 };
1604
1605                 DEBUG(10,("smbXsrv_open_recreate: global_id (0x%08x) stored\n",
1606                          op->global->open_global_id));
1607                 NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
1608         }
1609
1610         *_open = op;
1611         return NT_STATUS_OK;
1612 }
1613
1614
1615 static NTSTATUS smbXsrv_open_global_parse_record(TALLOC_CTX *mem_ctx,
1616                                                  struct db_record *rec,
1617                                                  struct smbXsrv_open_global0 **global)
1618 {
1619         TDB_DATA key = dbwrap_record_get_key(rec);
1620         TDB_DATA val = dbwrap_record_get_value(rec);
1621         DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
1622         struct smbXsrv_open_globalB global_blob;
1623         enum ndr_err_code ndr_err;
1624         NTSTATUS status;
1625         TALLOC_CTX *frame = talloc_stackframe();
1626
1627         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
1628                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_open_globalB);
1629         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1630                 DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
1631                          "key '%s' ndr_pull_struct_blob - %s\n",
1632                          tdb_data_dbg(key),
1633                          ndr_errstr(ndr_err)));
1634                 status = ndr_map_error2ntstatus(ndr_err);
1635                 goto done;
1636         }
1637
1638         if (global_blob.version != SMBXSRV_VERSION_0) {
1639                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
1640                 DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
1641                          "key '%s' unsupported version - %d - %s\n",
1642                          tdb_data_dbg(key),
1643                          (int)global_blob.version,
1644                          nt_errstr(status)));
1645                 goto done;
1646         }
1647
1648         if (global_blob.info.info0 == NULL) {
1649                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
1650                 DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
1651                          "key '%s' info0 NULL pointer - %s\n",
1652                          tdb_data_dbg(key),
1653                          nt_errstr(status)));
1654                 goto done;
1655         }
1656
1657         *global = talloc_move(mem_ctx, &global_blob.info.info0);
1658         status = NT_STATUS_OK;
1659 done:
1660         talloc_free(frame);
1661         return status;
1662 }
1663
1664 struct smbXsrv_open_global_traverse_state {
1665         int (*fn)(struct smbXsrv_open_global0 *, void *);
1666         void *private_data;
1667 };
1668
1669 static int smbXsrv_open_global_traverse_fn(struct db_record *rec, void *data)
1670 {
1671         struct smbXsrv_open_global_traverse_state *state =
1672                 (struct smbXsrv_open_global_traverse_state*)data;
1673         struct smbXsrv_open_global0 *global = NULL;
1674         NTSTATUS status;
1675         int ret = -1;
1676
1677         status = smbXsrv_open_global_parse_record(talloc_tos(), rec, &global);
1678         if (!NT_STATUS_IS_OK(status)) {
1679                 return -1;
1680         }
1681
1682         global->db_rec = rec;
1683         ret = state->fn(global, state->private_data);
1684         talloc_free(global);
1685         return ret;
1686 }
1687
1688 NTSTATUS smbXsrv_open_global_traverse(
1689                         int (*fn)(struct smbXsrv_open_global0 *, void *),
1690                         void *private_data)
1691 {
1692
1693         NTSTATUS status;
1694         int count = 0;
1695         struct smbXsrv_open_global_traverse_state state = {
1696                 .fn = fn,
1697                 .private_data = private_data,
1698         };
1699
1700         become_root();
1701         status = smbXsrv_open_global_init();
1702         if (!NT_STATUS_IS_OK(status)) {
1703                 unbecome_root();
1704                 DEBUG(0, ("Failed to initialize open_global: %s\n",
1705                           nt_errstr(status)));
1706                 return status;
1707         }
1708
1709         status = dbwrap_traverse_read(smbXsrv_open_global_db_ctx,
1710                                       smbXsrv_open_global_traverse_fn,
1711                                       &state,
1712                                       &count);
1713         unbecome_root();
1714
1715         return status;
1716 }
1717
1718 NTSTATUS smbXsrv_open_cleanup(uint64_t persistent_id)
1719 {
1720         NTSTATUS status = NT_STATUS_OK;
1721         TALLOC_CTX *frame = talloc_stackframe();
1722         struct smbXsrv_open_global0 *op = NULL;
1723         TDB_DATA val;
1724         struct db_record *rec;
1725         bool delete_open = false;
1726         uint32_t global_id = persistent_id & UINT32_MAX;
1727
1728         rec = smbXsrv_open_global_fetch_locked(smbXsrv_open_global_db_ctx,
1729                                                global_id,
1730                                                frame);
1731         if (rec == NULL) {
1732                 status = NT_STATUS_NOT_FOUND;
1733                 goto done;
1734         }
1735
1736         val = dbwrap_record_get_value(rec);
1737         if (val.dsize == 0) {
1738                 DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
1739                           "empty record in %s, skipping...\n",
1740                            global_id, dbwrap_name(smbXsrv_open_global_db_ctx)));
1741                 goto done;
1742         }
1743
1744         status = smbXsrv_open_global_parse_record(talloc_tos(), rec, &op);
1745         if (!NT_STATUS_IS_OK(status)) {
1746                 DEBUG(1, ("smbXsrv_open_cleanup[global: 0x%08x] "
1747                           "failed to read record: %s\n",
1748                           global_id, nt_errstr(status)));
1749                 goto done;
1750         }
1751
1752         if (server_id_is_disconnected(&op->server_id)) {
1753                 struct timeval now, disconnect_time;
1754                 int64_t tdiff;
1755                 now = timeval_current();
1756                 nttime_to_timeval(&disconnect_time, op->disconnect_time);
1757                 tdiff = usec_time_diff(&now, &disconnect_time);
1758                 delete_open = (tdiff >= 1000*op->durable_timeout_msec);
1759
1760                 DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
1761                            "disconnected at [%s] %us ago with "
1762                            "timeout of %us -%s reached\n",
1763                            global_id,
1764                            nt_time_string(frame, op->disconnect_time),
1765                            (unsigned)(tdiff/1000000),
1766                            op->durable_timeout_msec / 1000,
1767                            delete_open ? "" : " not"));
1768         } else if (!serverid_exists(&op->server_id)) {
1769                 struct server_id_buf idbuf;
1770                 DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
1771                            "server[%s] does not exist\n",
1772                            global_id,
1773                            server_id_str_buf(op->server_id, &idbuf)));
1774                 delete_open = true;
1775         }
1776
1777         if (!delete_open) {
1778                 goto done;
1779         }
1780
1781         status = dbwrap_record_delete(rec);
1782         if (!NT_STATUS_IS_OK(status)) {
1783                 DEBUG(1, ("smbXsrv_open_cleanup[global: 0x%08x] "
1784                           "failed to delete record"
1785                           "from %s: %s\n", global_id,
1786                           dbwrap_name(smbXsrv_open_global_db_ctx),
1787                           nt_errstr(status)));
1788                 goto done;
1789         }
1790
1791         DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
1792                    "delete record from %s\n",
1793                    global_id,
1794                    dbwrap_name(smbXsrv_open_global_db_ctx)));
1795
1796 done:
1797         talloc_free(frame);
1798         return status;
1799 }