source3/smbd/smbXsrv_session.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2011-2012
   5    Copyright (C) Michael Adam 2012
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/filesys.h"
  23 #include <tevent.h>
  24 #include "lib/util/server_id.h"
  25 #include "smbd/smbd.h"
  26 #include "smbd/globals.h"
  27 #include "dbwrap/dbwrap.h"
  28 #include "dbwrap/dbwrap_rbt.h"
  29 #include "dbwrap/dbwrap_open.h"
  30 #include "dbwrap/dbwrap_watch.h"
  31 #include "session.h"
  32 #include "auth.h"
  33 #include "auth/gensec/gensec.h"
  34 #include "../lib/tsocket/tsocket.h"
  35 #include "../libcli/security/security.h"
  36 #include "messages.h"
  37 #include "lib/util/util_tdb.h"
  38 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  39 #include "serverid.h"
  40 #include "lib/util/tevent_ntstatus.h"
  41
  42 struct smbXsrv_session_table {
  43         struct {
  44                 struct db_context *db_ctx;
  45                 uint32_t lowest_id;
  46                 uint32_t highest_id;
  47                 uint32_t max_sessions;
  48                 uint32_t num_sessions;
  49         } local;
  50         struct {
  51                 struct db_context *db_ctx;
  52         } global;
  53 };
  54
  55 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
  56
  57 NTSTATUS smbXsrv_session_global_init(struct messaging_context *msg_ctx)
  58 {
  59         char *global_path = NULL;
  60         struct db_context *backend = NULL;
  61         struct db_context *db_ctx = NULL;
  62
  63         if (smbXsrv_session_global_db_ctx != NULL) {
  64                 return NT_STATUS_OK;
  65         }
  66
  67         /*
  68          * This contains secret information like session keys!
  69          */
  70         global_path = lock_path(talloc_tos(), "smbXsrv_session_global.tdb");
  71         if (global_path == NULL) {
  72                 return NT_STATUS_NO_MEMORY;
  73         }
  74
  75         backend = db_open(NULL, global_path,
  76                           0, /* hash_size */
  77                           TDB_DEFAULT |
  78                           TDB_CLEAR_IF_FIRST |
  79                           TDB_INCOMPATIBLE_HASH,
  80                           O_RDWR | O_CREAT, 0600,
  81                           DBWRAP_LOCK_ORDER_1,
  82                           DBWRAP_FLAG_NONE);
  83         TALLOC_FREE(global_path);
  84         if (backend == NULL) {
  85                 NTSTATUS status;
  86
  87                 status = map_nt_error_from_unix_common(errno);
  88
  89                 return status;
  90         }
  91
  92         db_ctx = db_open_watched(NULL, &backend, global_messaging_context());
  93         if (db_ctx == NULL) {
  94                 TALLOC_FREE(backend);
  95                 return NT_STATUS_NO_MEMORY;
  96         }
  97
  98         smbXsrv_session_global_db_ctx = db_ctx;
  99
 100         return NT_STATUS_OK;
 101 }
 102
 103 /*
 104  * NOTE:
 105  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
 106  * has the same result as integer comparison between the uint32_t
 107  * values.
 108  *
 109  * TODO: implement string based key
 110  */
 111
 112 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
 113
 114 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
 115                                                  uint8_t *key_buf)
 116 {
 117         TDB_DATA key;
 118
 119         RSIVAL(key_buf, 0, id);
 120
 121         key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
 122
 123         return key;
 124 }
 125
 126 #if 0
 127 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
 128 {
 129         if (id == NULL) {
 130                 return NT_STATUS_INVALID_PARAMETER;
 131         }
 132
 133         if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
 134                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 135         }
 136
 137         *id = RIVAL(key.dptr, 0);
 138
 139         return NT_STATUS_OK;
 140 }
 141 #endif
 142
 143 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
 144
 145 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
 146                                                 uint8_t *key_buf)
 147 {
 148         TDB_DATA key;
 149
 150         RSIVAL(key_buf, 0, id);
 151
 152         key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
 153
 154         return key;
 155 }
 156
 157 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
 158 {
 159         if (id == NULL) {
 160                 return NT_STATUS_INVALID_PARAMETER;
 161         }
 162
 163         if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
 164                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 165         }
 166
 167         *id = RIVAL(key.dptr, 0);
 168
 169         return NT_STATUS_OK;
 170 }
 171
 172 static struct db_record *smbXsrv_session_global_fetch_locked(
 173                         struct db_context *db,
 174                         uint32_t id,
 175                         TALLOC_CTX *mem_ctx)
 176 {
 177         TDB_DATA key;
 178         uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
 179         struct db_record *rec = NULL;
 180
 181         key = smbXsrv_session_global_id_to_key(id, key_buf);
 182
 183         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 184
 185         if (rec == NULL) {
 186                 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
 187                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 188         }
 189
 190         return rec;
 191 }
 192
 193 static struct db_record *smbXsrv_session_local_fetch_locked(
 194                         struct db_context *db,
 195                         uint32_t id,
 196                         TALLOC_CTX *mem_ctx)
 197 {
 198         TDB_DATA key;
 199         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 200         struct db_record *rec = NULL;
 201
 202         key = smbXsrv_session_local_id_to_key(id, key_buf);
 203
 204         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 205
 206         if (rec == NULL) {
 207                 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
 208                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 209         }
 210
 211         return rec;
 212 }
 213
 214 static void smbXsrv_session_close_loop(struct tevent_req *subreq);
 215
 216 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
 217                                            uint32_t lowest_id,
 218                                            uint32_t highest_id,
 219                                            uint32_t max_sessions)
 220 {
 221         struct smbXsrv_client *client = conn->client;
 222         struct smbXsrv_session_table *table;
 223         NTSTATUS status;
 224         struct tevent_req *subreq;
 225         uint64_t max_range;
 226
 227         if (lowest_id > highest_id) {
 228                 return NT_STATUS_INTERNAL_ERROR;
 229         }
 230
 231         max_range = highest_id;
 232         max_range -= lowest_id;
 233         max_range += 1;
 234
 235         if (max_sessions > max_range) {
 236                 return NT_STATUS_INTERNAL_ERROR;
 237         }
 238
 239         table = talloc_zero(client, struct smbXsrv_session_table);
 240         if (table == NULL) {
 241                 return NT_STATUS_NO_MEMORY;
 242         }
 243
 244         table->local.db_ctx = db_open_rbt(table);
 245         if (table->local.db_ctx == NULL) {
 246                 TALLOC_FREE(table);
 247                 return NT_STATUS_NO_MEMORY;
 248         }
 249         table->local.lowest_id = lowest_id;
 250         table->local.highest_id = highest_id;
 251         table->local.max_sessions = max_sessions;
 252
 253         status = smbXsrv_session_global_init(client->msg_ctx);
 254         if (!NT_STATUS_IS_OK(status)) {
 255                 TALLOC_FREE(table);
 256                 return status;
 257         }
 258
 259         table->global.db_ctx = smbXsrv_session_global_db_ctx;
 260
 261         subreq = messaging_read_send(table,
 262                                      client->raw_ev_ctx,
 263                                      client->msg_ctx,
 264                                      MSG_SMBXSRV_SESSION_CLOSE);
 265         if (subreq == NULL) {
 266                 TALLOC_FREE(table);
 267                 return NT_STATUS_NO_MEMORY;
 268         }
 269         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
 270
 271         client->session_table = table;
 272         return NT_STATUS_OK;
 273 }
 274
 275 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
 276
 277 static void smbXsrv_session_close_loop(struct tevent_req *subreq)
 278 {
 279         struct smbXsrv_client *client =
 280                 tevent_req_callback_data(subreq,
 281                 struct smbXsrv_client);
 282         struct smbXsrv_session_table *table = client->session_table;
 283         int ret;
 284         struct messaging_rec *rec = NULL;
 285         struct smbXsrv_session_closeB close_blob;
 286         enum ndr_err_code ndr_err;
 287         struct smbXsrv_session_close0 *close_info0 = NULL;
 288         struct smbXsrv_session *session = NULL;
 289         NTSTATUS status;
 290         struct timeval tv = timeval_current();
 291         NTTIME now = timeval_to_nttime(&tv);
 292
 293         ret = messaging_read_recv(subreq, talloc_tos(), &rec);
 294         TALLOC_FREE(subreq);
 295         if (ret != 0) {
 296                 goto next;
 297         }
 298
 299         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
 300                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
 301         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 302                 status = ndr_map_error2ntstatus(ndr_err);
 303                 DEBUG(1,("smbXsrv_session_close_loop: "
 304                          "ndr_pull_struct_blob - %s\n",
 305                          nt_errstr(status)));
 306                 goto next;
 307         }
 308
 309         DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
 310         if (DEBUGLVL(10)) {
 311                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 312         }
 313
 314         if (close_blob.version != SMBXSRV_VERSION_0) {
 315                 DEBUG(0,("smbXsrv_session_close_loop: "
 316                          "ignore invalid version %u\n", close_blob.version));
 317                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 318                 goto next;
 319         }
 320
 321         close_info0 = close_blob.info.info0;
 322         if (close_info0 == NULL) {
 323                 DEBUG(0,("smbXsrv_session_close_loop: "
 324                          "ignore NULL info %u\n", close_blob.version));
 325                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 326                 goto next;
 327         }
 328
 329         status = smb2srv_session_lookup_client(client,
 330                                                close_info0->old_session_wire_id,
 331                                                now, &session);
 332         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
 333                 DEBUG(4,("smbXsrv_session_close_loop: "
 334                          "old_session_wire_id %llu not found\n",
 335                          (unsigned long long)close_info0->old_session_wire_id));
 336                 if (DEBUGLVL(4)) {
 337                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 338                 }
 339                 goto next;
 340         }
 341         if (!NT_STATUS_IS_OK(status) &&
 342             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
 343             !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 344                 DEBUG(1,("smbXsrv_session_close_loop: "
 345                          "old_session_wire_id %llu - %s\n",
 346                          (unsigned long long)close_info0->old_session_wire_id,
 347                          nt_errstr(status)));
 348                 if (DEBUGLVL(1)) {
 349                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 350                 }
 351                 goto next;
 352         }
 353
 354         if (session->global->session_global_id != close_info0->old_session_global_id) {
 355                 DEBUG(1,("smbXsrv_session_close_loop: "
 356                          "old_session_wire_id %llu - global %u != %u\n",
 357                          (unsigned long long)close_info0->old_session_wire_id,
 358                          session->global->session_global_id,
 359                          close_info0->old_session_global_id));
 360                 if (DEBUGLVL(1)) {
 361                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 362                 }
 363                 goto next;
 364         }
 365
 366         if (session->global->creation_time != close_info0->old_creation_time) {
 367                 DEBUG(1,("smbXsrv_session_close_loop: "
 368                          "old_session_wire_id %llu - "
 369                          "creation %s (%llu) != %s (%llu)\n",
 370                          (unsigned long long)close_info0->old_session_wire_id,
 371                          nt_time_string(rec, session->global->creation_time),
 372                          (unsigned long long)session->global->creation_time,
 373                          nt_time_string(rec, close_info0->old_creation_time),
 374                          (unsigned long long)close_info0->old_creation_time));
 375                 if (DEBUGLVL(1)) {
 376                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 377                 }
 378                 goto next;
 379         }
 380
 381         subreq = smb2srv_session_shutdown_send(session, client->raw_ev_ctx,
 382                                                session, NULL);
 383         if (subreq == NULL) {
 384                 status = NT_STATUS_NO_MEMORY;
 385                 DEBUG(0, ("smbXsrv_session_close_loop: "
 386                           "smb2srv_session_shutdown_send(%llu) failed: %s\n",
 387                           (unsigned long long)session->global->session_wire_id,
 388                           nt_errstr(status)));
 389                 if (DEBUGLVL(1)) {
 390                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 391                 }
 392                 goto next;
 393         }
 394         tevent_req_set_callback(subreq,
 395                                 smbXsrv_session_close_shutdown_done,
 396                                 session);
 397
 398 next:
 399         TALLOC_FREE(rec);
 400
 401         subreq = messaging_read_send(table,
 402                                      client->raw_ev_ctx,
 403                                      client->msg_ctx,
 404                                      MSG_SMBXSRV_SESSION_CLOSE);
 405         if (subreq == NULL) {
 406                 const char *r;
 407                 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
 408                 exit_server_cleanly(r);
 409                 return;
 410         }
 411         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
 412 }
 413
 414 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
 415 {
 416         struct smbXsrv_session *session =
 417                 tevent_req_callback_data(subreq,
 418                 struct smbXsrv_session);
 419         NTSTATUS status;
 420
 421         status = smb2srv_session_shutdown_recv(subreq);
 422         TALLOC_FREE(subreq);
 423         if (!NT_STATUS_IS_OK(status)) {
 424                 DEBUG(0, ("smbXsrv_session_close_loop: "
 425                           "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
 426                           (unsigned long long)session->global->session_wire_id,
 427                           nt_errstr(status)));
 428         }
 429
 430         status = smbXsrv_session_logoff(session);
 431         if (!NT_STATUS_IS_OK(status)) {
 432                 DEBUG(0, ("smbXsrv_session_close_loop: "
 433                           "smbXsrv_session_logoff(%llu) failed: %s\n",
 434                           (unsigned long long)session->global->session_wire_id,
 435                           nt_errstr(status)));
 436         }
 437
 438         TALLOC_FREE(session);
 439 }
 440
 441 struct smb1srv_session_local_allocate_state {
 442         const uint32_t lowest_id;
 443         const uint32_t highest_id;
 444         uint32_t last_id;
 445         uint32_t useable_id;
 446         NTSTATUS status;
 447 };
 448
 449 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
 450                                                    void *private_data)
 451 {
 452         struct smb1srv_session_local_allocate_state *state =
 453                 (struct smb1srv_session_local_allocate_state *)private_data;
 454         TDB_DATA key = dbwrap_record_get_key(rec);
 455         uint32_t id = 0;
 456         NTSTATUS status;
 457
 458         status = smbXsrv_session_local_key_to_id(key, &id);
 459         if (!NT_STATUS_IS_OK(status)) {
 460                 state->status = status;
 461                 return -1;
 462         }
 463
 464         if (id <= state->last_id) {
 465                 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 466                 return -1;
 467         }
 468         state->last_id = id;
 469
 470         if (id > state->useable_id) {
 471                 state->status = NT_STATUS_OK;
 472                 return -1;
 473         }
 474
 475         if (state->useable_id == state->highest_id) {
 476                 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
 477                 return -1;
 478         }
 479
 480         state->useable_id +=1;
 481         return 0;
 482 }
 483
 484 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
 485                                                   uint32_t lowest_id,
 486                                                   uint32_t highest_id,
 487                                                   TALLOC_CTX *mem_ctx,
 488                                                   struct db_record **_rec,
 489                                                   uint32_t *_id)
 490 {
 491         struct smb1srv_session_local_allocate_state state = {
 492                 .lowest_id = lowest_id,
 493                 .highest_id = highest_id,
 494                 .last_id = 0,
 495                 .useable_id = lowest_id,
 496                 .status = NT_STATUS_INTERNAL_ERROR,
 497         };
 498         uint32_t i;
 499         uint32_t range;
 500         NTSTATUS status;
 501         int count = 0;
 502
 503         *_rec = NULL;
 504         *_id = 0;
 505
 506         if (lowest_id > highest_id) {
 507                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 508         }
 509
 510         /*
 511          * first we try randomly
 512          */
 513         range = (highest_id - lowest_id) + 1;
 514
 515         for (i = 0; i < (range / 2); i++) {
 516                 uint32_t id;
 517                 TDB_DATA val;
 518                 struct db_record *rec = NULL;
 519
 520                 id = generate_random() % range;
 521                 id += lowest_id;
 522
 523                 if (id < lowest_id) {
 524                         id = lowest_id;
 525                 }
 526                 if (id > highest_id) {
 527                         id = highest_id;
 528                 }
 529
 530                 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
 531                 if (rec == NULL) {
 532                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 533                 }
 534
 535                 val = dbwrap_record_get_value(rec);
 536                 if (val.dsize != 0) {
 537                         TALLOC_FREE(rec);
 538                         continue;
 539                 }
 540
 541                 *_rec = rec;
 542                 *_id = id;
 543                 return NT_STATUS_OK;
 544         }
 545
 546         /*
 547          * if the range is almost full,
 548          * we traverse the whole table
 549          * (this relies on sorted behavior of dbwrap_rbt)
 550          */
 551         status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
 552                                       &state, &count);
 553         if (NT_STATUS_IS_OK(status)) {
 554                 if (NT_STATUS_IS_OK(state.status)) {
 555                         return NT_STATUS_INTERNAL_ERROR;
 556                 }
 557
 558                 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
 559                         return state.status;
 560                 }
 561
 562                 if (state.useable_id <= state.highest_id) {
 563                         state.status = NT_STATUS_OK;
 564                 } else {
 565                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 566                 }
 567         } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
 568                 /*
 569                  * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
 570                  *
 571                  * If we get anything else it is an error, because it
 572                  * means we did not manage to find a free slot in
 573                  * the db.
 574                  */
 575                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 576         }
 577
 578         if (NT_STATUS_IS_OK(state.status)) {
 579                 uint32_t id;
 580                 TDB_DATA val;
 581                 struct db_record *rec = NULL;
 582
 583                 id = state.useable_id;
 584
 585                 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
 586                 if (rec == NULL) {
 587                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 588                 }
 589
 590                 val = dbwrap_record_get_value(rec);
 591                 if (val.dsize != 0) {
 592                         TALLOC_FREE(rec);
 593                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 594                 }
 595
 596                 *_rec = rec;
 597                 *_id = id;
 598                 return NT_STATUS_OK;
 599         }
 600
 601         return state.status;
 602 }
 603
 604 struct smbXsrv_session_local_fetch_state {
 605         struct smbXsrv_session *session;
 606         NTSTATUS status;
 607 };
 608
 609 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
 610                                                void *private_data)
 611 {
 612         struct smbXsrv_session_local_fetch_state *state =
 613                 (struct smbXsrv_session_local_fetch_state *)private_data;
 614         void *ptr;
 615
 616         if (data.dsize != sizeof(ptr)) {
 617                 state->status = NT_STATUS_INTERNAL_DB_ERROR;
 618                 return;
 619         }
 620
 621         memcpy(&ptr, data.dptr, data.dsize);
 622         state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
 623         state->status = NT_STATUS_OK;
 624 }
 625
 626 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
 627                                              /* conn: optional */
 628                                              struct smbXsrv_connection *conn,
 629                                              uint32_t session_local_id,
 630                                              NTTIME now,
 631                                              struct smbXsrv_session **_session)
 632 {
 633         struct smbXsrv_session_local_fetch_state state = {
 634                 .session = NULL,
 635                 .status = NT_STATUS_INTERNAL_ERROR,
 636         };
 637         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 638         TDB_DATA key;
 639         NTSTATUS status;
 640
 641         *_session = NULL;
 642
 643         if (session_local_id == 0) {
 644                 return NT_STATUS_USER_SESSION_DELETED;
 645         }
 646
 647         if (table == NULL) {
 648                 /* this might happen before the end of negprot */
 649                 return NT_STATUS_USER_SESSION_DELETED;
 650         }
 651
 652         if (table->local.db_ctx == NULL) {
 653                 return NT_STATUS_INTERNAL_ERROR;
 654         }
 655
 656         key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
 657
 658         status = dbwrap_parse_record(table->local.db_ctx, key,
 659                                      smbXsrv_session_local_fetch_parser,
 660                                      &state);
 661         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
 662                 return NT_STATUS_USER_SESSION_DELETED;
 663         } else if (!NT_STATUS_IS_OK(status)) {
 664                 return status;
 665         }
 666         if (!NT_STATUS_IS_OK(state.status)) {
 667                 return state.status;
 668         }
 669
 670         if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
 671                 return NT_STATUS_USER_SESSION_DELETED;
 672         }
 673
 674         /*
 675          * If a connection is specified check if the session is
 676          * valid on the channel.
 677          */
 678         if (conn != NULL) {
 679                 struct smbXsrv_channel_global0 *c = NULL;
 680
 681                 status = smbXsrv_session_find_channel(state.session, conn, &c);
 682                 if (!NT_STATUS_IS_OK(status)) {
 683                         return status;
 684                 }
 685         }
 686
 687         state.session->idle_time = now;
 688
 689         if (!NT_STATUS_IS_OK(state.session->status)) {
 690                 *_session = state.session;
 691                 return state.session->status;
 692         }
 693
 694         if (now > state.session->global->expiration_time) {
 695                 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
 696         }
 697
 698         *_session = state.session;
 699         return state.session->status;
 700 }
 701
 702 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
 703 {
 704         return 0;
 705 }
 706
 707 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 708                                         bool *is_free,
 709                                         bool *was_free,
 710                                         TALLOC_CTX *mem_ctx,
 711                                         struct smbXsrv_session_global0 **_g);
 712
 713 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
 714                                         TALLOC_CTX *mem_ctx,
 715                                         struct smbXsrv_session_global0 **_global)
 716 {
 717         uint32_t i;
 718         struct smbXsrv_session_global0 *global = NULL;
 719         uint32_t last_free = 0;
 720         const uint32_t min_tries = 3;
 721
 722         *_global = NULL;
 723
 724         global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
 725         if (global == NULL) {
 726                 return NT_STATUS_NO_MEMORY;
 727         }
 728         talloc_set_destructor(global, smbXsrv_session_global_destructor);
 729
 730         /*
 731          * Here we just randomly try the whole 32-bit space
 732          *
 733          * We use just 32-bit, because we want to reuse the
 734          * ID for SRVSVC.
 735          */
 736         for (i = 0; i < UINT32_MAX; i++) {
 737                 bool is_free = false;
 738                 bool was_free = false;
 739                 uint32_t id;
 740
 741                 if (i >= min_tries && last_free != 0) {
 742                         id = last_free;
 743                 } else {
 744                         id = generate_random();
 745                 }
 746                 if (id == 0) {
 747                         id++;
 748                 }
 749                 if (id == UINT32_MAX) {
 750                         id--;
 751                 }
 752
 753                 global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
 754                                                                      mem_ctx);
 755                 if (global->db_rec == NULL) {
 756                         talloc_free(global);
 757                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 758                 }
 759
 760                 smbXsrv_session_global_verify_record(global->db_rec,
 761                                                      &is_free,
 762                                                      &was_free,
 763                                                      NULL, NULL);
 764
 765                 if (!is_free) {
 766                         TALLOC_FREE(global->db_rec);
 767                         continue;
 768                 }
 769
 770                 if (!was_free && i < min_tries) {
 771                         /*
 772                          * The session_id is free now,
 773                          * but was not free before.
 774                          *
 775                          * This happens if a smbd crashed
 776                          * and did not cleanup the record.
 777                          *
 778                          * If this is one of our first tries,
 779                          * then we try to find a real free one.
 780                          */
 781                         if (last_free == 0) {
 782                                 last_free = id;
 783                         }
 784                         TALLOC_FREE(global->db_rec);
 785                         continue;
 786                 }
 787
 788                 global->session_global_id = id;
 789
 790                 *_global = global;
 791                 return NT_STATUS_OK;
 792         }
 793
 794         /* should not be reached */
 795         talloc_free(global);
 796         return NT_STATUS_INTERNAL_ERROR;
 797 }
 798
 799 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 800                                         bool *is_free,
 801                                         bool *was_free,
 802                                         TALLOC_CTX *mem_ctx,
 803                                         struct smbXsrv_session_global0 **_g)
 804 {
 805         TDB_DATA key;
 806         TDB_DATA val;
 807         DATA_BLOB blob;
 808         struct smbXsrv_session_globalB global_blob;
 809         enum ndr_err_code ndr_err;
 810         struct smbXsrv_session_global0 *global = NULL;
 811         bool exists;
 812         TALLOC_CTX *frame = talloc_stackframe();
 813
 814         *is_free = false;
 815
 816         if (was_free) {
 817                 *was_free = false;
 818         }
 819         if (_g) {
 820                 *_g = NULL;
 821         }
 822
 823         key = dbwrap_record_get_key(db_rec);
 824
 825         val = dbwrap_record_get_value(db_rec);
 826         if (val.dsize == 0) {
 827                 TALLOC_FREE(frame);
 828                 *is_free = true;
 829                 if (was_free) {
 830                         *was_free = true;
 831                 }
 832                 return;
 833         }
 834
 835         blob = data_blob_const(val.dptr, val.dsize);
 836
 837         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 838                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
 839         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 840                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 841                 DEBUG(1,("smbXsrv_session_global_verify_record: "
 842                          "key '%s' ndr_pull_struct_blob - %s\n",
 843                          hex_encode_talloc(frame, key.dptr, key.dsize),
 844                          nt_errstr(status)));
 845                 TALLOC_FREE(frame);
 846                 *is_free = true;
 847                 if (was_free) {
 848                         *was_free = true;
 849                 }
 850                 return;
 851         }
 852
 853         DEBUG(10,("smbXsrv_session_global_verify_record\n"));
 854         if (DEBUGLVL(10)) {
 855                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 856         }
 857
 858         if (global_blob.version != SMBXSRV_VERSION_0) {
 859                 DEBUG(0,("smbXsrv_session_global_verify_record: "
 860                          "key '%s' use unsupported version %u\n",
 861                          hex_encode_talloc(frame, key.dptr, key.dsize),
 862                          global_blob.version));
 863                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 864                 TALLOC_FREE(frame);
 865                 *is_free = true;
 866                 if (was_free) {
 867                         *was_free = true;
 868                 }
 869                 return;
 870         }
 871
 872         global = global_blob.info.info0;
 873
 874         exists = serverid_exists(&global->channels[0].server_id);
 875         if (!exists) {
 876                 struct server_id_buf idbuf;
 877                 DEBUG(2,("smbXsrv_session_global_verify_record: "
 878                          "key '%s' server_id %s does not exist.\n",
 879                          hex_encode_talloc(frame, key.dptr, key.dsize),
 880                          server_id_str_buf(global->channels[0].server_id,
 881                                            &idbuf)));
 882                 if (DEBUGLVL(2)) {
 883                         NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 884                 }
 885                 TALLOC_FREE(frame);
 886                 dbwrap_record_delete(db_rec);
 887                 *is_free = true;
 888                 return;
 889         }
 890
 891         if (_g) {
 892                 *_g = talloc_move(mem_ctx, &global);
 893         }
 894         TALLOC_FREE(frame);
 895 }
 896
 897 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
 898 {
 899         struct smbXsrv_session_globalB global_blob;
 900         DATA_BLOB blob = data_blob_null;
 901         TDB_DATA key;
 902         TDB_DATA val;
 903         NTSTATUS status;
 904         enum ndr_err_code ndr_err;
 905
 906         /*
 907          * TODO: if we use other versions than '0'
 908          * we would add glue code here, that would be able to
 909          * store the information in the old format.
 910          */
 911
 912         if (global->db_rec == NULL) {
 913                 return NT_STATUS_INTERNAL_ERROR;
 914         }
 915
 916         key = dbwrap_record_get_key(global->db_rec);
 917         val = dbwrap_record_get_value(global->db_rec);
 918
 919         ZERO_STRUCT(global_blob);
 920         global_blob.version = smbXsrv_version_global_current();
 921         if (val.dsize >= 8) {
 922                 global_blob.seqnum = IVAL(val.dptr, 4);
 923         }
 924         global_blob.seqnum += 1;
 925         global_blob.info.info0 = global;
 926
 927         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 928                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
 929         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 930                 status = ndr_map_error2ntstatus(ndr_err);
 931                 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
 932                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 933                          nt_errstr(status)));
 934                 TALLOC_FREE(global->db_rec);
 935                 return status;
 936         }
 937
 938         val = make_tdb_data(blob.data, blob.length);
 939         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 940         if (!NT_STATUS_IS_OK(status)) {
 941                 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
 942                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 943                          nt_errstr(status)));
 944                 TALLOC_FREE(global->db_rec);
 945                 return status;
 946         }
 947
 948         if (DEBUGLVL(10)) {
 949                 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
 950                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
 951                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 952         }
 953
 954         TALLOC_FREE(global->db_rec);
 955
 956         return NT_STATUS_OK;
 957 }
 958
 959 struct smb2srv_session_close_previous_state {
 960         struct tevent_context *ev;
 961         struct smbXsrv_connection *connection;
 962         struct dom_sid *current_sid;
 963         uint64_t previous_session_id;
 964         uint64_t current_session_id;
 965         struct db_record *db_rec;
 966 };
 967
 968 static void smb2srv_session_close_previous_check(struct tevent_req *req);
 969 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
 970
 971 struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
 972                                         struct tevent_context *ev,
 973                                         struct smbXsrv_connection *conn,
 974                                         struct auth_session_info *session_info,
 975                                         uint64_t previous_session_id,
 976                                         uint64_t current_session_id)
 977 {
 978         struct tevent_req *req;
 979         struct smb2srv_session_close_previous_state *state;
 980         uint32_t global_id = previous_session_id & UINT32_MAX;
 981         uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
 982         struct smbXsrv_session_table *table = conn->client->session_table;
 983         struct security_token *current_token = NULL;
 984
 985         req = tevent_req_create(mem_ctx, &state,
 986                                 struct smb2srv_session_close_previous_state);
 987         if (req == NULL) {
 988                 return NULL;
 989         }
 990         state->ev = ev;
 991         state->connection = conn;
 992         state->previous_session_id = previous_session_id;
 993         state->current_session_id = current_session_id;
 994
 995         if (global_zeros != 0) {
 996                 tevent_req_done(req);
 997                 return tevent_req_post(req, ev);
 998         }
 999
1000         if (session_info == NULL) {
1001                 tevent_req_done(req);
1002                 return tevent_req_post(req, ev);
1003         }
1004         current_token = session_info->security_token;
1005
1006         if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
1007                 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
1008         }
1009
1010         if (state->current_sid == NULL) {
1011                 tevent_req_done(req);
1012                 return tevent_req_post(req, ev);
1013         }
1014
1015         if (!security_token_has_nt_authenticated_users(current_token)) {
1016                 /* TODO */
1017                 tevent_req_done(req);
1018                 return tevent_req_post(req, ev);
1019         }
1020
1021         state->db_rec = smbXsrv_session_global_fetch_locked(
1022                                                         table->global.db_ctx,
1023                                                         global_id,
1024                                                         state /* TALLOC_CTX */);
1025         if (state->db_rec == NULL) {
1026                 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1027                 return tevent_req_post(req, ev);
1028         }
1029
1030         smb2srv_session_close_previous_check(req);
1031         if (!tevent_req_is_in_progress(req)) {
1032                 return tevent_req_post(req, ev);
1033         }
1034
1035         return req;
1036 }
1037
1038 static void smb2srv_session_close_previous_check(struct tevent_req *req)
1039 {
1040         struct smb2srv_session_close_previous_state *state =
1041                 tevent_req_data(req,
1042                 struct smb2srv_session_close_previous_state);
1043         struct smbXsrv_connection *conn = state->connection;
1044         DATA_BLOB blob;
1045         struct security_token *previous_token = NULL;
1046         struct smbXsrv_session_global0 *global = NULL;
1047         enum ndr_err_code ndr_err;
1048         struct smbXsrv_session_close0 close_info0;
1049         struct smbXsrv_session_closeB close_blob;
1050         struct tevent_req *subreq = NULL;
1051         NTSTATUS status;
1052         bool is_free = false;
1053
1054         smbXsrv_session_global_verify_record(state->db_rec,
1055                                              &is_free,
1056                                              NULL,
1057                                              state,
1058                                              &global);
1059
1060         if (is_free) {
1061                 TALLOC_FREE(state->db_rec);
1062                 tevent_req_done(req);
1063                 return;
1064         }
1065
1066         if (global->auth_session_info == NULL) {
1067                 TALLOC_FREE(state->db_rec);
1068                 tevent_req_done(req);
1069                 return;
1070         }
1071
1072         previous_token = global->auth_session_info->security_token;
1073
1074         if (!security_token_is_sid(previous_token, state->current_sid)) {
1075                 TALLOC_FREE(state->db_rec);
1076                 tevent_req_done(req);
1077                 return;
1078         }
1079
1080         subreq = dbwrap_watched_watch_send(state, state->ev, state->db_rec,
1081                                            (struct server_id){0});
1082         if (tevent_req_nomem(subreq, req)) {
1083                 TALLOC_FREE(state->db_rec);
1084                 return;
1085         }
1086         tevent_req_set_callback(subreq,
1087                                 smb2srv_session_close_previous_modified,
1088                                 req);
1089
1090         close_info0.old_session_global_id = global->session_global_id;
1091         close_info0.old_session_wire_id = global->session_wire_id;
1092         close_info0.old_creation_time = global->creation_time;
1093         close_info0.new_session_wire_id = state->current_session_id;
1094
1095         ZERO_STRUCT(close_blob);
1096         close_blob.version = smbXsrv_version_global_current();
1097         close_blob.info.info0 = &close_info0;
1098
1099         ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1100                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1101         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1102                 TALLOC_FREE(state->db_rec);
1103                 status = ndr_map_error2ntstatus(ndr_err);
1104                 DEBUG(1,("smb2srv_session_close_previous_check: "
1105                          "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1106                          (unsigned long long)close_info0.old_session_wire_id,
1107                          (unsigned long long)close_info0.new_session_wire_id,
1108                          nt_errstr(status)));
1109                 tevent_req_nterror(req, status);
1110                 return;
1111         }
1112
1113         status = messaging_send(conn->client->msg_ctx,
1114                                 global->channels[0].server_id,
1115                                 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1116         TALLOC_FREE(state->db_rec);
1117         if (tevent_req_nterror(req, status)) {
1118                 return;
1119         }
1120
1121         TALLOC_FREE(global);
1122         return;
1123 }
1124
1125 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1126 {
1127         struct tevent_req *req =
1128                 tevent_req_callback_data(subreq,
1129                 struct tevent_req);
1130         struct smb2srv_session_close_previous_state *state =
1131                 tevent_req_data(req,
1132                 struct smb2srv_session_close_previous_state);
1133         uint32_t global_id;
1134         NTSTATUS status;
1135
1136         status = dbwrap_watched_watch_recv(subreq, NULL, NULL);
1137         TALLOC_FREE(subreq);
1138         if (tevent_req_nterror(req, status)) {
1139                 return;
1140         }
1141
1142         global_id = state->previous_session_id & UINT32_MAX;
1143
1144         state->db_rec = smbXsrv_session_global_fetch_locked(
1145                 state->connection->client->session_table->global.db_ctx,
1146                 global_id, state /* TALLOC_CTX */);
1147
1148         smb2srv_session_close_previous_check(req);
1149 }
1150
1151 NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1152 {
1153         NTSTATUS status;
1154
1155         if (tevent_req_is_nterror(req, &status)) {
1156                 tevent_req_received(req);
1157                 return status;
1158         }
1159
1160         tevent_req_received(req);
1161         return NT_STATUS_OK;
1162 }
1163
1164 static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1165 {
1166         NTSTATUS status;
1167         struct smbXsrv_connection *xconn = NULL;
1168
1169         if (session->client != NULL) {
1170                 xconn = session->client->connections;
1171         }
1172
1173         for (; xconn != NULL; xconn = xconn->next) {
1174                 struct smbd_smb2_request *preq;
1175
1176                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1177                         if (preq->session != session) {
1178                                 continue;
1179                         }
1180
1181                         preq->session = NULL;
1182                         /*
1183                          * If we no longer have a session we can't
1184                          * sign or encrypt replies.
1185                          */
1186                         preq->do_signing = false;
1187                         preq->do_encryption = false;
1188                         preq->preauth = NULL;
1189                 }
1190         }
1191
1192         status = smbXsrv_session_logoff(session);
1193         return status;
1194 }
1195
1196 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1197 {
1198         NTSTATUS status;
1199
1200         status = smbXsrv_session_clear_and_logoff(session);
1201         if (!NT_STATUS_IS_OK(status)) {
1202                 DEBUG(0, ("smbXsrv_session_destructor: "
1203                           "smbXsrv_session_logoff() failed: %s\n",
1204                           nt_errstr(status)));
1205         }
1206
1207         TALLOC_FREE(session->global);
1208
1209         return 0;
1210 }
1211
1212 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1213                                 NTTIME now,
1214                                 struct smbXsrv_session **_session)
1215 {
1216         struct smbXsrv_session_table *table = conn->client->session_table;
1217         struct db_record *local_rec = NULL;
1218         struct smbXsrv_session *session = NULL;
1219         void *ptr = NULL;
1220         TDB_DATA val;
1221         struct smbXsrv_session_global0 *global = NULL;
1222         struct smbXsrv_channel_global0 *channel = NULL;
1223         NTSTATUS status;
1224
1225         if (table->local.num_sessions >= table->local.max_sessions) {
1226                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1227         }
1228
1229         session = talloc_zero(table, struct smbXsrv_session);
1230         if (session == NULL) {
1231                 return NT_STATUS_NO_MEMORY;
1232         }
1233         session->table = table;
1234         session->idle_time = now;
1235         session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1236         session->client = conn->client;
1237         session->homes_snum = -1;
1238
1239         status = smbXsrv_session_global_allocate(table->global.db_ctx,
1240                                                  session,
1241                                                  &global);
1242         if (!NT_STATUS_IS_OK(status)) {
1243                 TALLOC_FREE(session);
1244                 return status;
1245         }
1246         session->global = global;
1247
1248         if (conn->protocol >= PROTOCOL_SMB2_02) {
1249                 uint64_t id = global->session_global_id;
1250
1251                 global->connection_dialect = conn->smb2.server.dialect;
1252
1253                 global->session_wire_id = id;
1254
1255                 status = smb2srv_tcon_table_init(session);
1256                 if (!NT_STATUS_IS_OK(status)) {
1257                         TALLOC_FREE(session);
1258                         return status;
1259                 }
1260
1261                 session->local_id = global->session_global_id;
1262
1263                 local_rec = smbXsrv_session_local_fetch_locked(
1264                                                 table->local.db_ctx,
1265                                                 session->local_id,
1266                                                 session /* TALLOC_CTX */);
1267                 if (local_rec == NULL) {
1268                         TALLOC_FREE(session);
1269                         return NT_STATUS_NO_MEMORY;
1270                 }
1271
1272                 val = dbwrap_record_get_value(local_rec);
1273                 if (val.dsize != 0) {
1274                         TALLOC_FREE(session);
1275                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1276                 }
1277         } else {
1278
1279                 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1280                                                         table->local.lowest_id,
1281                                                         table->local.highest_id,
1282                                                         session,
1283                                                         &local_rec,
1284                                                         &session->local_id);
1285                 if (!NT_STATUS_IS_OK(status)) {
1286                         TALLOC_FREE(session);
1287                         return status;
1288                 }
1289
1290                 global->session_wire_id = session->local_id;
1291         }
1292
1293         global->creation_time = now;
1294         global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1295
1296         status = smbXsrv_session_add_channel(session, conn, &channel);
1297         if (!NT_STATUS_IS_OK(status)) {
1298                 TALLOC_FREE(session);
1299                 return status;
1300         }
1301
1302         ptr = session;
1303         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1304         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1305         TALLOC_FREE(local_rec);
1306         if (!NT_STATUS_IS_OK(status)) {
1307                 TALLOC_FREE(session);
1308                 return status;
1309         }
1310         table->local.num_sessions += 1;
1311
1312         talloc_set_destructor(session, smbXsrv_session_destructor);
1313
1314         status = smbXsrv_session_global_store(global);
1315         if (!NT_STATUS_IS_OK(status)) {
1316                 DEBUG(0,("smbXsrv_session_create: "
1317                          "global_id (0x%08x) store failed - %s\n",
1318                          session->global->session_global_id,
1319                          nt_errstr(status)));
1320                 TALLOC_FREE(session);
1321                 return status;
1322         }
1323
1324         if (DEBUGLVL(10)) {
1325                 struct smbXsrv_sessionB session_blob = {
1326                         .version = SMBXSRV_VERSION_0,
1327                         .info.info0 = session,
1328                 };
1329
1330                 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1331                          session->global->session_global_id));
1332                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1333         }
1334
1335         *_session = session;
1336         return NT_STATUS_OK;
1337 }
1338
1339 NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1340                                      struct smbXsrv_connection *conn,
1341                                      struct smbXsrv_channel_global0 **_c)
1342 {
1343         struct smbXsrv_session_global0 *global = session->global;
1344         struct smbXsrv_channel_global0 *c = NULL;
1345
1346         if (global->num_channels > 31) {
1347                 /*
1348                  * Windows 2012 and 2012R2 allow up to 32 channels
1349                  */
1350                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1351         }
1352
1353         c = talloc_realloc(global,
1354                            global->channels,
1355                            struct smbXsrv_channel_global0,
1356                            global->num_channels + 1);
1357         if (c == NULL) {
1358                 return NT_STATUS_NO_MEMORY;
1359         }
1360         global->channels = c;
1361
1362         c = &global->channels[global->num_channels];
1363         ZERO_STRUCTP(c);
1364
1365         c->server_id = messaging_server_id(conn->client->msg_ctx);
1366         c->local_address = tsocket_address_string(conn->local_address,
1367                                                   global->channels);
1368         if (c->local_address == NULL) {
1369                 return NT_STATUS_NO_MEMORY;
1370         }
1371         c->remote_address = tsocket_address_string(conn->remote_address,
1372                                                    global->channels);
1373         if (c->remote_address == NULL) {
1374                 return NT_STATUS_NO_MEMORY;
1375         }
1376         c->remote_name = talloc_strdup(global->channels,
1377                                        conn->remote_hostname);
1378         if (c->remote_name == NULL) {
1379                 return NT_STATUS_NO_MEMORY;
1380         }
1381         c->connection = conn;
1382
1383         global->num_channels += 1;
1384
1385         *_c = c;
1386         return NT_STATUS_OK;
1387 }
1388
1389 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1390 {
1391         struct smbXsrv_session_table *table = session->table;
1392         NTSTATUS status;
1393
1394         if (session->global->db_rec != NULL) {
1395                 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1396                           "Called with db_rec != NULL'\n",
1397                           session->global->session_global_id));
1398                 return NT_STATUS_INTERNAL_ERROR;
1399         }
1400
1401         session->global->db_rec = smbXsrv_session_global_fetch_locked(
1402                                         table->global.db_ctx,
1403                                         session->global->session_global_id,
1404                                         session->global /* TALLOC_CTX */);
1405         if (session->global->db_rec == NULL) {
1406                 return NT_STATUS_INTERNAL_DB_ERROR;
1407         }
1408
1409         status = smbXsrv_session_global_store(session->global);
1410         if (!NT_STATUS_IS_OK(status)) {
1411                 DEBUG(0,("smbXsrv_session_update: "
1412                          "global_id (0x%08x) store failed - %s\n",
1413                          session->global->session_global_id,
1414                          nt_errstr(status)));
1415                 return status;
1416         }
1417
1418         if (DEBUGLVL(10)) {
1419                 struct smbXsrv_sessionB session_blob = {
1420                         .version = SMBXSRV_VERSION_0,
1421                         .info.info0 = session,
1422                 };
1423
1424                 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1425                           session->global->session_global_id));
1426                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1427         }
1428
1429         return NT_STATUS_OK;
1430 }
1431
1432 NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1433                                       const struct smbXsrv_connection *conn,
1434                                       struct smbXsrv_channel_global0 **_c)
1435 {
1436         uint32_t i;
1437
1438         for (i=0; i < session->global->num_channels; i++) {
1439                 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1440
1441                 if (c->connection == conn) {
1442                         *_c = c;
1443                         return NT_STATUS_OK;
1444                 }
1445         }
1446
1447         return NT_STATUS_USER_SESSION_DELETED;
1448 }
1449
1450 NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1451                                    const struct smbXsrv_connection *conn,
1452                                    NTTIME now,
1453                                    struct smbXsrv_session_auth0 **_a)
1454 {
1455         struct smbXsrv_session_auth0 *a;
1456
1457         for (a = session->pending_auth; a != NULL; a = a->next) {
1458                 if (a->connection == conn) {
1459                         if (now != 0) {
1460                                 a->idle_time = now;
1461                         }
1462                         *_a = a;
1463                         return NT_STATUS_OK;
1464                 }
1465         }
1466
1467         return NT_STATUS_USER_SESSION_DELETED;
1468 }
1469
1470 static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1471 {
1472         if (a->session == NULL) {
1473                 return 0;
1474         }
1475
1476         DLIST_REMOVE(a->session->pending_auth, a);
1477         a->session = NULL;
1478         return 0;
1479 }
1480
1481 NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1482                                      struct smbXsrv_connection *conn,
1483                                      NTTIME now,
1484                                      uint8_t in_flags,
1485                                      uint8_t in_security_mode,
1486                                      struct smbXsrv_session_auth0 **_a)
1487 {
1488         struct smbXsrv_session_auth0 *a;
1489         NTSTATUS status;
1490
1491         status = smbXsrv_session_find_auth(session, conn, 0, &a);
1492         if (NT_STATUS_IS_OK(status)) {
1493                 return NT_STATUS_INTERNAL_ERROR;
1494         }
1495
1496         a = talloc_zero(session, struct smbXsrv_session_auth0);
1497         if (a == NULL) {
1498                 return NT_STATUS_NO_MEMORY;
1499         }
1500         a->session = session;
1501         a->connection = conn;
1502         a->in_flags = in_flags;
1503         a->in_security_mode = in_security_mode;
1504         a->creation_time = now;
1505         a->idle_time = now;
1506
1507         if (conn->protocol >= PROTOCOL_SMB3_10) {
1508                 a->preauth = talloc(a, struct smbXsrv_preauth);
1509                 if (a->preauth == NULL) {
1510                         TALLOC_FREE(session);
1511                         return NT_STATUS_NO_MEMORY;
1512                 }
1513                 *a->preauth = conn->smb2.preauth;
1514         }
1515
1516         talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1517         DLIST_ADD_END(session->pending_auth, a);
1518
1519         *_a = a;
1520         return NT_STATUS_OK;
1521 }
1522
1523 struct smb2srv_session_shutdown_state {
1524         struct tevent_queue *wait_queue;
1525 };
1526
1527 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1528
1529 struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1530                                         struct tevent_context *ev,
1531                                         struct smbXsrv_session *session,
1532                                         struct smbd_smb2_request *current_req)
1533 {
1534         struct tevent_req *req;
1535         struct smb2srv_session_shutdown_state *state;
1536         struct tevent_req *subreq;
1537         struct smbXsrv_connection *xconn = NULL;
1538         size_t len = 0;
1539
1540         /*
1541          * Make sure that no new request will be able to use this session.
1542          */
1543         session->status = NT_STATUS_USER_SESSION_DELETED;
1544
1545         req = tevent_req_create(mem_ctx, &state,
1546                                 struct smb2srv_session_shutdown_state);
1547         if (req == NULL) {
1548                 return NULL;
1549         }
1550
1551         state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1552         if (tevent_req_nomem(state->wait_queue, req)) {
1553                 return tevent_req_post(req, ev);
1554         }
1555
1556         for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1557                 struct smbd_smb2_request *preq;
1558
1559                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1560                         if (preq == current_req) {
1561                                 /* Can't cancel current request. */
1562                                 continue;
1563                         }
1564                         if (preq->session != session) {
1565                                 /* Request on different session. */
1566                                 continue;
1567                         }
1568
1569                         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1570                                 preq->session = NULL;
1571                                 /*
1572                                  * If we no longer have a session we can't
1573                                  * sign or encrypt replies.
1574                                  */
1575                                 preq->do_signing = false;
1576                                 preq->do_encryption = false;
1577                                 preq->preauth = NULL;
1578
1579                                 if (preq->subreq != NULL) {
1580                                         tevent_req_cancel(preq->subreq);
1581                                 }
1582                                 continue;
1583                         }
1584
1585                         /*
1586                          * Never cancel anything in a compound
1587                          * request. Way too hard to deal with
1588                          * the result.
1589                          */
1590                         if (!preq->compound_related && preq->subreq != NULL) {
1591                                 tevent_req_cancel(preq->subreq);
1592                         }
1593
1594                         /*
1595                          * Now wait until the request is finished.
1596                          *
1597                          * We don't set a callback, as we just want to block the
1598                          * wait queue and the talloc_free() of the request will
1599                          * remove the item from the wait queue.
1600                          */
1601                         subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1602                         if (tevent_req_nomem(subreq, req)) {
1603                                 return tevent_req_post(req, ev);
1604                         }
1605                 }
1606         }
1607
1608         len = tevent_queue_length(state->wait_queue);
1609         if (len == 0) {
1610                 tevent_req_done(req);
1611                 return tevent_req_post(req, ev);
1612         }
1613
1614         /*
1615          * Now we add our own waiter to the end of the queue,
1616          * this way we get notified when all pending requests are finished
1617          * and send to the socket.
1618          */
1619         subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1620         if (tevent_req_nomem(subreq, req)) {
1621                 return tevent_req_post(req, ev);
1622         }
1623         tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1624
1625         return req;
1626 }
1627
1628 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1629 {
1630         struct tevent_req *req =
1631                 tevent_req_callback_data(subreq,
1632                 struct tevent_req);
1633
1634         tevent_queue_wait_recv(subreq);
1635         TALLOC_FREE(subreq);
1636
1637         tevent_req_done(req);
1638 }
1639
1640 NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1641 {
1642         return tevent_req_simple_recv_ntstatus(req);
1643 }
1644
1645 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1646 {
1647         struct smbXsrv_session_table *table;
1648         struct db_record *local_rec = NULL;
1649         struct db_record *global_rec = NULL;
1650         struct smbd_server_connection *sconn = NULL;
1651         NTSTATUS status;
1652         NTSTATUS error = NT_STATUS_OK;
1653
1654         if (session->table == NULL) {
1655                 return NT_STATUS_OK;
1656         }
1657
1658         table = session->table;
1659         session->table = NULL;
1660
1661         sconn = session->client->sconn;
1662         session->client = NULL;
1663         session->status = NT_STATUS_USER_SESSION_DELETED;
1664
1665         /*
1666          * For SMB2 this is a bit redundant as files are also close
1667          * below via smb2srv_tcon_disconnect_all() -> ... ->
1668          * smbXsrv_tcon_disconnect() -> close_cnum() ->
1669          * file_close_conn().
1670          */
1671         file_close_user(sconn, session->global->session_wire_id);
1672
1673         if (session->tcon_table != NULL) {
1674                 /*
1675                  * Note: We only have a tcon_table for SMB2.
1676                  */
1677                 status = smb2srv_tcon_disconnect_all(session);
1678                 if (!NT_STATUS_IS_OK(status)) {
1679                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1680                                   "smb2srv_tcon_disconnect_all() failed: %s\n",
1681                                   session->global->session_global_id,
1682                                   nt_errstr(status)));
1683                         error = status;
1684                 }
1685         }
1686
1687         invalidate_vuid(sconn, session->global->session_wire_id);
1688
1689         global_rec = session->global->db_rec;
1690         session->global->db_rec = NULL;
1691         if (global_rec == NULL) {
1692                 global_rec = smbXsrv_session_global_fetch_locked(
1693                                         table->global.db_ctx,
1694                                         session->global->session_global_id,
1695                                         session->global /* TALLOC_CTX */);
1696                 if (global_rec == NULL) {
1697                         error = NT_STATUS_INTERNAL_ERROR;
1698                 }
1699         }
1700
1701         if (global_rec != NULL) {
1702                 status = dbwrap_record_delete(global_rec);
1703                 if (!NT_STATUS_IS_OK(status)) {
1704                         TDB_DATA key = dbwrap_record_get_key(global_rec);
1705
1706                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1707                                   "failed to delete global key '%s': %s\n",
1708                                   session->global->session_global_id,
1709                                   hex_encode_talloc(global_rec, key.dptr,
1710                                                     key.dsize),
1711                                   nt_errstr(status)));
1712                         error = status;
1713                 }
1714         }
1715         TALLOC_FREE(global_rec);
1716
1717         local_rec = session->db_rec;
1718         if (local_rec == NULL) {
1719                 local_rec = smbXsrv_session_local_fetch_locked(
1720                                                 table->local.db_ctx,
1721                                                 session->local_id,
1722                                                 session /* TALLOC_CTX */);
1723                 if (local_rec == NULL) {
1724                         error = NT_STATUS_INTERNAL_ERROR;
1725                 }
1726         }
1727
1728         if (local_rec != NULL) {
1729                 status = dbwrap_record_delete(local_rec);
1730                 if (!NT_STATUS_IS_OK(status)) {
1731                         TDB_DATA key = dbwrap_record_get_key(local_rec);
1732
1733                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1734                                   "failed to delete local key '%s': %s\n",
1735                                   session->global->session_global_id,
1736                                   hex_encode_talloc(local_rec, key.dptr,
1737                                                     key.dsize),
1738                                   nt_errstr(status)));
1739                         error = status;
1740                 }
1741                 table->local.num_sessions -= 1;
1742         }
1743         if (session->db_rec == NULL) {
1744                 TALLOC_FREE(local_rec);
1745         }
1746         session->db_rec = NULL;
1747
1748         return error;
1749 }
1750
1751 struct smbXsrv_session_logoff_all_state {
1752         NTSTATUS first_status;
1753         int errors;
1754 };
1755
1756 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1757                                                void *private_data);
1758
1759 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_client *client)
1760 {
1761         struct smbXsrv_session_table *table = client->session_table;
1762         struct smbXsrv_session_logoff_all_state state;
1763         NTSTATUS status;
1764         int count = 0;
1765
1766         if (table == NULL) {
1767                 DEBUG(10, ("smbXsrv_session_logoff_all: "
1768                            "empty session_table, nothing to do.\n"));
1769                 return NT_STATUS_OK;
1770         }
1771
1772         ZERO_STRUCT(state);
1773
1774         status = dbwrap_traverse(table->local.db_ctx,
1775                                  smbXsrv_session_logoff_all_callback,
1776                                  &state, &count);
1777         if (!NT_STATUS_IS_OK(status)) {
1778                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1779                           "dbwrap_traverse() failed: %s\n",
1780                           nt_errstr(status)));
1781                 return status;
1782         }
1783
1784         if (!NT_STATUS_IS_OK(state.first_status)) {
1785                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1786                           "count[%d] errors[%d] first[%s]\n",
1787                           count, state.errors,
1788                           nt_errstr(state.first_status)));
1789                 return state.first_status;
1790         }
1791
1792         return NT_STATUS_OK;
1793 }
1794
1795 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1796                                                void *private_data)
1797 {
1798         struct smbXsrv_session_logoff_all_state *state =
1799                 (struct smbXsrv_session_logoff_all_state *)private_data;
1800         TDB_DATA val;
1801         void *ptr = NULL;
1802         struct smbXsrv_session *session = NULL;
1803         NTSTATUS status;
1804
1805         val = dbwrap_record_get_value(local_rec);
1806         if (val.dsize != sizeof(ptr)) {
1807                 status = NT_STATUS_INTERNAL_ERROR;
1808                 if (NT_STATUS_IS_OK(state->first_status)) {
1809                         state->first_status = status;
1810                 }
1811                 state->errors++;
1812                 return 0;
1813         }
1814
1815         memcpy(&ptr, val.dptr, val.dsize);
1816         session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1817
1818         session->db_rec = local_rec;
1819
1820         status = smbXsrv_session_clear_and_logoff(session);
1821         if (!NT_STATUS_IS_OK(status)) {
1822                 if (NT_STATUS_IS_OK(state->first_status)) {
1823                         state->first_status = status;
1824                 }
1825                 state->errors++;
1826                 return 0;
1827         }
1828
1829         return 0;
1830 }
1831
1832 struct smbXsrv_session_local_trav_state {
1833         NTSTATUS status;
1834         int (*caller_cb)(struct smbXsrv_session *session,
1835                          void *caller_data);
1836         void *caller_data;
1837 };
1838
1839 static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
1840                                              void *private_data);
1841
1842 NTSTATUS smbXsrv_session_local_traverse(
1843         struct smbXsrv_client *client,
1844         int (*caller_cb)(struct smbXsrv_session *session,
1845                          void *caller_data),
1846         void *caller_data)
1847 {
1848         struct smbXsrv_session_table *table = client->session_table;
1849         struct smbXsrv_session_local_trav_state state;
1850         NTSTATUS status;
1851         int count = 0;
1852
1853         state = (struct smbXsrv_session_local_trav_state) {
1854                 .status = NT_STATUS_OK,
1855                 .caller_cb = caller_cb,
1856                 .caller_data = caller_data,
1857         };
1858
1859         if (table == NULL) {
1860                 DBG_DEBUG("empty session_table, nothing to do.\n");
1861                 return NT_STATUS_OK;
1862         }
1863
1864         status = dbwrap_traverse(table->local.db_ctx,
1865                                  smbXsrv_session_local_traverse_cb,
1866                                  &state,
1867                                  &count);
1868         if (!NT_STATUS_IS_OK(status)) {
1869                 DBG_ERR("dbwrap_traverse() failed: %s\n", nt_errstr(status));
1870                 return status;
1871         }
1872         if (!NT_STATUS_IS_OK(state.status)) {
1873                 DBG_ERR("count[%d] status[%s]\n",
1874                         count, nt_errstr(state.status));
1875                 return state.status;
1876         }
1877
1878         return NT_STATUS_OK;
1879 }
1880
1881 static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
1882                                              void *private_data)
1883 {
1884         struct smbXsrv_session_local_trav_state *state =
1885                 (struct smbXsrv_session_local_trav_state *)private_data;
1886         TDB_DATA val;
1887         void *ptr = NULL;
1888         struct smbXsrv_session *session = NULL;
1889
1890         val = dbwrap_record_get_value(local_rec);
1891         if (val.dsize != sizeof(ptr)) {
1892                 state->status = NT_STATUS_INTERNAL_ERROR;
1893                 return -1;
1894         }
1895
1896         memcpy(&ptr, val.dptr, val.dsize);
1897         session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1898         session->db_rec = local_rec;
1899
1900         return state->caller_cb(session, state->caller_data);
1901 }
1902
1903 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
1904 {
1905         /*
1906          * Allow a range from 1..65534 with 65534 values.
1907          */
1908         return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
1909                                           UINT16_MAX - 1);
1910 }
1911
1912 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
1913                                 uint16_t vuid, NTTIME now,
1914                                 struct smbXsrv_session **session)
1915 {
1916         struct smbXsrv_session_table *table = conn->client->session_table;
1917         uint32_t local_id = vuid;
1918
1919         return smbXsrv_session_local_lookup(table, conn, local_id, now,
1920                                             session);
1921 }
1922
1923 NTSTATUS smbXsrv_session_info_lookup(struct smbXsrv_client *client,
1924                                      uint64_t session_wire_id,
1925                                      struct auth_session_info **si)
1926 {
1927         struct smbXsrv_session_table *table = client->session_table;
1928         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
1929         struct smbXsrv_session_local_fetch_state state = {
1930                 .session = NULL,
1931                 .status = NT_STATUS_INTERNAL_ERROR,
1932         };
1933         TDB_DATA key;
1934         NTSTATUS status;
1935
1936         if (session_wire_id == 0) {
1937                 return NT_STATUS_USER_SESSION_DELETED;
1938         }
1939
1940         if (table == NULL) {
1941                 /* this might happen before the end of negprot */
1942                 return NT_STATUS_USER_SESSION_DELETED;
1943         }
1944
1945         if (table->local.db_ctx == NULL) {
1946                 return NT_STATUS_INTERNAL_ERROR;
1947         }
1948
1949         key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
1950
1951         status = dbwrap_parse_record(table->local.db_ctx, key,
1952                                      smbXsrv_session_local_fetch_parser,
1953                                      &state);
1954         if (!NT_STATUS_IS_OK(status)) {
1955                 return status;
1956         }
1957         if (!NT_STATUS_IS_OK(state.status)) {
1958                 return state.status;
1959         }
1960         if (state.session->global->auth_session_info == NULL) {
1961                 return NT_STATUS_USER_SESSION_DELETED;
1962         }
1963
1964         *si = state.session->global->auth_session_info;
1965         return NT_STATUS_OK;
1966 }
1967
1968 /*
1969  * In memory of get_valid_user_struct()
1970  *
1971  * This function is similar to smbXsrv_session_local_lookup() and it's wrappers,
1972  * but it doesn't implement the state checks of
1973  * those. get_valid_smbXsrv_session() is NOT meant to be called to validate the
1974  * session wire-id of incoming SMB requests, it MUST only be used in later
1975  * internal processing where the session wire-id has already been validated.
1976  */
1977 NTSTATUS get_valid_smbXsrv_session(struct smbXsrv_client *client,
1978                                    uint64_t session_wire_id,
1979                                    struct smbXsrv_session **session)
1980 {
1981         struct smbXsrv_session_table *table = client->session_table;
1982         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
1983         struct smbXsrv_session_local_fetch_state state = {
1984                 .session = NULL,
1985                 .status = NT_STATUS_INTERNAL_ERROR,
1986         };
1987         TDB_DATA key;
1988         NTSTATUS status;
1989
1990         if (session_wire_id == 0) {
1991                 return NT_STATUS_USER_SESSION_DELETED;
1992         }
1993
1994         if (table == NULL) {
1995                 /* this might happen before the end of negprot */
1996                 return NT_STATUS_USER_SESSION_DELETED;
1997         }
1998
1999         if (table->local.db_ctx == NULL) {
2000                 return NT_STATUS_INTERNAL_ERROR;
2001         }
2002
2003         key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
2004
2005         status = dbwrap_parse_record(table->local.db_ctx, key,
2006                                      smbXsrv_session_local_fetch_parser,
2007                                      &state);
2008         if (!NT_STATUS_IS_OK(status)) {
2009                 return status;
2010         }
2011         if (!NT_STATUS_IS_OK(state.status)) {
2012                 return state.status;
2013         }
2014         if (state.session->global->auth_session_info == NULL) {
2015                 return NT_STATUS_USER_SESSION_DELETED;
2016         }
2017
2018         *session = state.session;
2019         return NT_STATUS_OK;
2020 }
2021
2022 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
2023 {
2024         /*
2025          * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
2026          */
2027         return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
2028                                           UINT16_MAX - 1);
2029 }
2030
2031 static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
2032                                            /* conn: optional */
2033                                            struct smbXsrv_connection *conn,
2034                                            uint64_t session_id, NTTIME now,
2035                                            struct smbXsrv_session **session)
2036 {
2037         uint32_t local_id = session_id & UINT32_MAX;
2038         uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
2039
2040         if (local_zeros != 0) {
2041                 return NT_STATUS_USER_SESSION_DELETED;
2042         }
2043
2044         return smbXsrv_session_local_lookup(table, conn, local_id, now,
2045                                             session);
2046 }
2047
2048 NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
2049                                      uint64_t session_id, NTTIME now,
2050                                      struct smbXsrv_session **session)
2051 {
2052         struct smbXsrv_session_table *table = conn->client->session_table;
2053         return smb2srv_session_lookup_raw(table, conn, session_id, now,
2054                                           session);
2055 }
2056
2057 NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
2058                                        uint64_t session_id, NTTIME now,
2059                                        struct smbXsrv_session **session)
2060 {
2061         struct smbXsrv_session_table *table = client->session_table;
2062         return smb2srv_session_lookup_raw(table, NULL, session_id, now,
2063                                           session);
2064 }
2065
2066 struct smbXsrv_session_global_traverse_state {
2067         int (*fn)(struct smbXsrv_session_global0 *, void *);
2068         void *private_data;
2069 };
2070
2071 static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
2072 {
2073         int ret = -1;
2074         struct smbXsrv_session_global_traverse_state *state =
2075                 (struct smbXsrv_session_global_traverse_state*)data;
2076         TDB_DATA key = dbwrap_record_get_key(rec);
2077         TDB_DATA val = dbwrap_record_get_value(rec);
2078         DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
2079         struct smbXsrv_session_globalB global_blob;
2080         enum ndr_err_code ndr_err;
2081         TALLOC_CTX *frame = talloc_stackframe();
2082
2083         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
2084                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
2085         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2086                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
2087                          "key '%s' ndr_pull_struct_blob - %s\n",
2088                          hex_encode_talloc(frame, key.dptr, key.dsize),
2089                          ndr_errstr(ndr_err)));
2090                 goto done;
2091         }
2092
2093         if (global_blob.version != SMBXSRV_VERSION_0) {
2094                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
2095                          "key '%s' unsupported version - %d\n",
2096                          hex_encode_talloc(frame, key.dptr, key.dsize),
2097                          (int)global_blob.version));
2098                 goto done;
2099         }
2100
2101         global_blob.info.info0->db_rec = rec;
2102         ret = state->fn(global_blob.info.info0, state->private_data);
2103 done:
2104         TALLOC_FREE(frame);
2105         return ret;
2106 }
2107
2108 NTSTATUS smbXsrv_session_global_traverse(
2109                         int (*fn)(struct smbXsrv_session_global0 *, void *),
2110                         void *private_data)
2111 {
2112
2113         NTSTATUS status;
2114         int count = 0;
2115         struct smbXsrv_session_global_traverse_state state = {
2116                 .fn = fn,
2117                 .private_data = private_data,
2118         };
2119
2120         become_root();
2121         status = smbXsrv_session_global_init(NULL);
2122         if (!NT_STATUS_IS_OK(status)) {
2123                 unbecome_root();
2124                 DEBUG(0, ("Failed to initialize session_global: %s\n",
2125                           nt_errstr(status)));
2126                 return status;
2127         }
2128
2129         status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
2130                                       smbXsrv_session_global_traverse_fn,
2131                                       &state,
2132                                       &count);
2133         unbecome_root();
2134
2135         return status;
2136 }