source3/smbd/smbXsrv_open.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2012
   5    Copyright (C) Michael Adam 2012
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/filesys.h"
  23 #include "lib/util/server_id.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "dbwrap/dbwrap.h"
  27 #include "dbwrap/dbwrap_rbt.h"
  28 #include "dbwrap/dbwrap_open.h"
  29 #include "../libcli/security/security.h"
  30 #include "messages.h"
  31 #include "lib/util/util_tdb.h"
  32 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  33 #include "serverid.h"
  34
  35 struct smbXsrv_open_table {
  36         struct {
  37                 struct db_context *db_ctx;
  38                 struct db_context *replay_cache_db_ctx;
  39                 uint32_t lowest_id;
  40                 uint32_t highest_id;
  41                 uint32_t max_opens;
  42                 uint32_t num_opens;
  43         } local;
  44         struct {
  45                 struct db_context *db_ctx;
  46         } global;
  47 };
  48
  49 static struct db_context *smbXsrv_open_global_db_ctx = NULL;
  50
  51 NTSTATUS smbXsrv_open_global_init(void)
  52 {
  53         char *global_path = NULL;
  54         struct db_context *db_ctx = NULL;
  55
  56         if (smbXsrv_open_global_db_ctx != NULL) {
  57                 return NT_STATUS_OK;
  58         }
  59
  60         global_path = lock_path(talloc_tos(), "smbXsrv_open_global.tdb");
  61         if (global_path == NULL) {
  62                 return NT_STATUS_NO_MEMORY;
  63         }
  64
  65         db_ctx = db_open(NULL, global_path,
  66                          0, /* hash_size */
  67                          TDB_DEFAULT |
  68                          TDB_CLEAR_IF_FIRST |
  69                          TDB_INCOMPATIBLE_HASH,
  70                          O_RDWR | O_CREAT, 0600,
  71                          DBWRAP_LOCK_ORDER_1,
  72                          DBWRAP_FLAG_NONE);
  73         TALLOC_FREE(global_path);
  74         if (db_ctx == NULL) {
  75                 NTSTATUS status;
  76
  77                 status = map_nt_error_from_unix_common(errno);
  78
  79                 return status;
  80         }
  81
  82         smbXsrv_open_global_db_ctx = db_ctx;
  83
  84         return NT_STATUS_OK;
  85 }
  86
  87 /*
  88  * NOTE:
  89  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
  90  * has the same result as integer comparison between the uint32_t
  91  * values.
  92  *
  93  * TODO: implement string based key
  94  */
  95
  96 #define SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
  97
  98 static TDB_DATA smbXsrv_open_global_id_to_key(uint32_t id,
  99                                               uint8_t *key_buf)
 100 {
 101         TDB_DATA key;
 102
 103         RSIVAL(key_buf, 0, id);
 104
 105         key = make_tdb_data(key_buf, SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE);
 106
 107         return key;
 108 }
 109
 110 #if 0
 111 static NTSTATUS smbXsrv_open_global_key_to_id(TDB_DATA key, uint32_t *id)
 112 {
 113         if (id == NULL) {
 114                 return NT_STATUS_INVALID_PARAMETER;
 115         }
 116
 117         if (key.dsize != SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE) {
 118                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 119         }
 120
 121         *id = RIVAL(key.dptr, 0);
 122
 123         return NT_STATUS_OK;
 124 }
 125 #endif
 126
 127 #define SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
 128
 129 static TDB_DATA smbXsrv_open_local_id_to_key(uint32_t id,
 130                                              uint8_t *key_buf)
 131 {
 132         TDB_DATA key;
 133
 134         RSIVAL(key_buf, 0, id);
 135
 136         key = make_tdb_data(key_buf, SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE);
 137
 138         return key;
 139 }
 140
 141 static NTSTATUS smbXsrv_open_local_key_to_id(TDB_DATA key, uint32_t *id)
 142 {
 143         if (id == NULL) {
 144                 return NT_STATUS_INVALID_PARAMETER;
 145         }
 146
 147         if (key.dsize != SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE) {
 148                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 149         }
 150
 151         *id = RIVAL(key.dptr, 0);
 152
 153         return NT_STATUS_OK;
 154 }
 155
 156 static struct db_record *smbXsrv_open_global_fetch_locked(
 157                         struct db_context *db,
 158                         uint32_t id,
 159                         TALLOC_CTX *mem_ctx)
 160 {
 161         TDB_DATA key;
 162         uint8_t key_buf[SMBXSRV_OPEN_GLOBAL_TDB_KEY_SIZE];
 163         struct db_record *rec = NULL;
 164
 165         key = smbXsrv_open_global_id_to_key(id, key_buf);
 166
 167         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 168
 169         if (rec == NULL) {
 170                 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
 171                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 172         }
 173
 174         return rec;
 175 }
 176
 177 static struct db_record *smbXsrv_open_local_fetch_locked(
 178                         struct db_context *db,
 179                         uint32_t id,
 180                         TALLOC_CTX *mem_ctx)
 181 {
 182         TDB_DATA key;
 183         uint8_t key_buf[SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE];
 184         struct db_record *rec = NULL;
 185
 186         key = smbXsrv_open_local_id_to_key(id, key_buf);
 187
 188         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 189
 190         if (rec == NULL) {
 191                 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
 192                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 193         }
 194
 195         return rec;
 196 }
 197
 198 static NTSTATUS smbXsrv_open_table_init(struct smbXsrv_connection *conn,
 199                                         uint32_t lowest_id,
 200                                         uint32_t highest_id,
 201                                         uint32_t max_opens)
 202 {
 203         struct smbXsrv_client *client = conn->client;
 204         struct smbXsrv_open_table *table;
 205         NTSTATUS status;
 206         uint64_t max_range;
 207
 208         if (lowest_id > highest_id) {
 209                 return NT_STATUS_INTERNAL_ERROR;
 210         }
 211
 212         max_range = highest_id;
 213         max_range -= lowest_id;
 214         max_range += 1;
 215
 216         if (max_opens > max_range) {
 217                 return NT_STATUS_INTERNAL_ERROR;
 218         }
 219
 220         table = talloc_zero(client, struct smbXsrv_open_table);
 221         if (table == NULL) {
 222                 return NT_STATUS_NO_MEMORY;
 223         }
 224
 225         table->local.db_ctx = db_open_rbt(table);
 226         if (table->local.db_ctx == NULL) {
 227                 TALLOC_FREE(table);
 228                 return NT_STATUS_NO_MEMORY;
 229         }
 230         table->local.replay_cache_db_ctx = db_open_rbt(table);
 231         if (table->local.replay_cache_db_ctx == NULL) {
 232                 TALLOC_FREE(table);
 233                 return NT_STATUS_NO_MEMORY;
 234         }
 235         table->local.lowest_id = lowest_id;
 236         table->local.highest_id = highest_id;
 237         table->local.max_opens = max_opens;
 238
 239         status = smbXsrv_open_global_init();
 240         if (!NT_STATUS_IS_OK(status)) {
 241                 TALLOC_FREE(table);
 242                 return status;
 243         }
 244
 245         table->global.db_ctx = smbXsrv_open_global_db_ctx;
 246
 247         client->open_table = table;
 248         return NT_STATUS_OK;
 249 }
 250
 251 struct smbXsrv_open_local_allocate_state {
 252         const uint32_t lowest_id;
 253         const uint32_t highest_id;
 254         uint32_t last_id;
 255         uint32_t useable_id;
 256         NTSTATUS status;
 257 };
 258
 259 static int smbXsrv_open_local_allocate_traverse(struct db_record *rec,
 260                                                    void *private_data)
 261 {
 262         struct smbXsrv_open_local_allocate_state *state =
 263                 (struct smbXsrv_open_local_allocate_state *)private_data;
 264         TDB_DATA key = dbwrap_record_get_key(rec);
 265         uint32_t id = 0;
 266         NTSTATUS status;
 267
 268         status = smbXsrv_open_local_key_to_id(key, &id);
 269         if (!NT_STATUS_IS_OK(status)) {
 270                 state->status = status;
 271                 return -1;
 272         }
 273
 274         if (id <= state->last_id) {
 275                 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 276                 return -1;
 277         }
 278         state->last_id = id;
 279
 280         if (id > state->useable_id) {
 281                 state->status = NT_STATUS_OK;
 282                 return -1;
 283         }
 284
 285         if (state->useable_id == state->highest_id) {
 286                 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
 287                 return -1;
 288         }
 289
 290         state->useable_id +=1;
 291         return 0;
 292 }
 293
 294 static NTSTATUS smbXsrv_open_local_allocate_id(struct db_context *db,
 295                                                uint32_t lowest_id,
 296                                                uint32_t highest_id,
 297                                                TALLOC_CTX *mem_ctx,
 298                                                struct db_record **_rec,
 299                                                uint32_t *_id)
 300 {
 301         struct smbXsrv_open_local_allocate_state state = {
 302                 .lowest_id = lowest_id,
 303                 .highest_id = highest_id,
 304                 .last_id = 0,
 305                 .useable_id = lowest_id,
 306                 .status = NT_STATUS_INTERNAL_ERROR,
 307         };
 308         uint32_t i;
 309         uint32_t range;
 310         NTSTATUS status;
 311         int count = 0;
 312
 313         *_rec = NULL;
 314         *_id = 0;
 315
 316         if (lowest_id > highest_id) {
 317                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 318         }
 319
 320         /*
 321          * first we try randomly
 322          */
 323         range = (highest_id - lowest_id) + 1;
 324
 325         for (i = 0; i < (range / 2); i++) {
 326                 uint32_t id;
 327                 TDB_DATA val;
 328                 struct db_record *rec = NULL;
 329
 330                 id = generate_random() % range;
 331                 id += lowest_id;
 332
 333                 if (id < lowest_id) {
 334                         id = lowest_id;
 335                 }
 336                 if (id > highest_id) {
 337                         id = highest_id;
 338                 }
 339
 340                 rec = smbXsrv_open_local_fetch_locked(db, id, mem_ctx);
 341                 if (rec == NULL) {
 342                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 343                 }
 344
 345                 val = dbwrap_record_get_value(rec);
 346                 if (val.dsize != 0) {
 347                         TALLOC_FREE(rec);
 348                         continue;
 349                 }
 350
 351                 *_rec = rec;
 352                 *_id = id;
 353                 return NT_STATUS_OK;
 354         }
 355
 356         /*
 357          * if the range is almost full,
 358          * we traverse the whole table
 359          * (this relies on sorted behavior of dbwrap_rbt)
 360          */
 361         status = dbwrap_traverse_read(db, smbXsrv_open_local_allocate_traverse,
 362                                       &state, &count);
 363         if (NT_STATUS_IS_OK(status)) {
 364                 if (NT_STATUS_IS_OK(state.status)) {
 365                         return NT_STATUS_INTERNAL_ERROR;
 366                 }
 367
 368                 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
 369                         return state.status;
 370                 }
 371
 372                 if (state.useable_id <= state.highest_id) {
 373                         state.status = NT_STATUS_OK;
 374                 } else {
 375                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 376                 }
 377         } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
 378                 /*
 379                  * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
 380                  *
 381                  * If we get anything else it is an error, because it
 382                  * means we did not manage to find a free slot in
 383                  * the db.
 384                  */
 385                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 386         }
 387
 388         if (NT_STATUS_IS_OK(state.status)) {
 389                 uint32_t id;
 390                 TDB_DATA val;
 391                 struct db_record *rec = NULL;
 392
 393                 id = state.useable_id;
 394
 395                 rec = smbXsrv_open_local_fetch_locked(db, id, mem_ctx);
 396                 if (rec == NULL) {
 397                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 398                 }
 399
 400                 val = dbwrap_record_get_value(rec);
 401                 if (val.dsize != 0) {
 402                         TALLOC_FREE(rec);
 403                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 404                 }
 405
 406                 *_rec = rec;
 407                 *_id = id;
 408                 return NT_STATUS_OK;
 409         }
 410
 411         return state.status;
 412 }
 413
 414 struct smbXsrv_open_local_fetch_state {
 415         struct smbXsrv_open *op;
 416         NTSTATUS status;
 417 };
 418
 419 static void smbXsrv_open_local_fetch_parser(TDB_DATA key, TDB_DATA data,
 420                                             void *private_data)
 421 {
 422         struct smbXsrv_open_local_fetch_state *state =
 423                 (struct smbXsrv_open_local_fetch_state *)private_data;
 424         void *ptr;
 425
 426         if (data.dsize != sizeof(ptr)) {
 427                 state->status = NT_STATUS_INTERNAL_DB_ERROR;
 428                 return;
 429         }
 430
 431         memcpy(&ptr, data.dptr, data.dsize);
 432         state->op = talloc_get_type_abort(ptr, struct smbXsrv_open);
 433         state->status = NT_STATUS_OK;
 434 }
 435
 436 static NTSTATUS smbXsrv_open_local_lookup(struct smbXsrv_open_table *table,
 437                                           uint32_t open_local_id,
 438                                           uint32_t open_global_id,
 439                                           NTTIME now,
 440                                           struct smbXsrv_open **_open)
 441 {
 442         struct smbXsrv_open_local_fetch_state state = {
 443                 .op = NULL,
 444                 .status = NT_STATUS_INTERNAL_ERROR,
 445         };
 446         uint8_t key_buf[SMBXSRV_OPEN_LOCAL_TDB_KEY_SIZE];
 447         TDB_DATA key;
 448         NTSTATUS status;
 449
 450         *_open = NULL;
 451
 452         if (open_local_id == 0) {
 453                 return NT_STATUS_FILE_CLOSED;
 454         }
 455
 456         if (table == NULL) {
 457                 /* this might happen before the end of negprot */
 458                 return NT_STATUS_FILE_CLOSED;
 459         }
 460
 461         if (table->local.db_ctx == NULL) {
 462                 return NT_STATUS_INTERNAL_ERROR;
 463         }
 464
 465         key = smbXsrv_open_local_id_to_key(open_local_id, key_buf);
 466
 467         status = dbwrap_parse_record(table->local.db_ctx, key,
 468                                      smbXsrv_open_local_fetch_parser,
 469                                      &state);
 470         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
 471                 return NT_STATUS_FILE_CLOSED;
 472         }
 473         if (!NT_STATUS_IS_OK(status)) {
 474                 return status;
 475         }
 476         if (!NT_STATUS_IS_OK(state.status)) {
 477                 return state.status;
 478         }
 479
 480         if (NT_STATUS_EQUAL(state.op->status, NT_STATUS_FILE_CLOSED)) {
 481                 return NT_STATUS_FILE_CLOSED;
 482         }
 483
 484         if (open_global_id == 0) {
 485                 /* make the global check a no-op for SMB1 */
 486                 open_global_id = state.op->global->open_global_id;
 487         }
 488
 489         if (state.op->global->open_global_id != open_global_id) {
 490                 return NT_STATUS_FILE_CLOSED;
 491         }
 492
 493         if (now != 0) {
 494                 state.op->idle_time = now;
 495         }
 496
 497         *_open = state.op;
 498         return state.op->status;
 499 }
 500
 501 static int smbXsrv_open_global_destructor(struct smbXsrv_open_global0 *global)
 502 {
 503         return 0;
 504 }
 505
 506 static void smbXsrv_open_global_verify_record(struct db_record *db_rec,
 507                                         bool *is_free,
 508                                         bool *was_free,
 509                                         TALLOC_CTX *mem_ctx,
 510                                         struct smbXsrv_open_global0 **_g);
 511
 512 static NTSTATUS smbXsrv_open_global_allocate(struct db_context *db,
 513                                         TALLOC_CTX *mem_ctx,
 514                                         struct smbXsrv_open_global0 **_global)
 515 {
 516         uint32_t i;
 517         struct smbXsrv_open_global0 *global = NULL;
 518         uint32_t last_free = 0;
 519         const uint32_t min_tries = 3;
 520
 521         *_global = NULL;
 522
 523         global = talloc_zero(mem_ctx, struct smbXsrv_open_global0);
 524         if (global == NULL) {
 525                 return NT_STATUS_NO_MEMORY;
 526         }
 527         talloc_set_destructor(global, smbXsrv_open_global_destructor);
 528
 529         /*
 530          * Here we just randomly try the whole 32-bit space
 531          *
 532          * We use just 32-bit, because we want to reuse the
 533          * ID for SRVSVC.
 534          */
 535         for (i = 0; i < UINT32_MAX; i++) {
 536                 bool is_free = false;
 537                 bool was_free = false;
 538                 uint32_t id;
 539
 540                 if (i >= min_tries && last_free != 0) {
 541                         id = last_free;
 542                 } else {
 543                         id = generate_random();
 544                 }
 545                 if (id == 0) {
 546                         id++;
 547                 }
 548                 if (id == UINT32_MAX) {
 549                         id--;
 550                 }
 551
 552                 global->db_rec = smbXsrv_open_global_fetch_locked(db, id, mem_ctx);
 553                 if (global->db_rec == NULL) {
 554                         talloc_free(global);
 555                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 556                 }
 557
 558                 smbXsrv_open_global_verify_record(global->db_rec,
 559                                                   &is_free,
 560                                                   &was_free,
 561                                                   NULL, NULL);
 562
 563                 if (!is_free) {
 564                         TALLOC_FREE(global->db_rec);
 565                         continue;
 566                 }
 567
 568                 if (!was_free && i < min_tries) {
 569                         /*
 570                          * The session_id is free now,
 571                          * but was not free before.
 572                          *
 573                          * This happens if a smbd crashed
 574                          * and did not cleanup the record.
 575                          *
 576                          * If this is one of our first tries,
 577                          * then we try to find a real free one.
 578                          */
 579                         if (last_free == 0) {
 580                                 last_free = id;
 581                         }
 582                         TALLOC_FREE(global->db_rec);
 583                         continue;
 584                 }
 585
 586                 global->open_global_id = id;
 587
 588                 *_global = global;
 589                 return NT_STATUS_OK;
 590         }
 591
 592         /* should not be reached */
 593         talloc_free(global);
 594         return NT_STATUS_INTERNAL_ERROR;
 595 }
 596
 597 static void smbXsrv_open_global_verify_record(struct db_record *db_rec,
 598                                         bool *is_free,
 599                                         bool *was_free,
 600                                         TALLOC_CTX *mem_ctx,
 601                                         struct smbXsrv_open_global0 **_g)
 602 {
 603         TDB_DATA key;
 604         TDB_DATA val;
 605         DATA_BLOB blob;
 606         struct smbXsrv_open_globalB global_blob;
 607         enum ndr_err_code ndr_err;
 608         struct smbXsrv_open_global0 *global = NULL;
 609         bool exists;
 610         TALLOC_CTX *frame = talloc_stackframe();
 611
 612         *is_free = false;
 613
 614         if (was_free) {
 615                 *was_free = false;
 616         }
 617         if (_g) {
 618                 *_g = NULL;
 619         }
 620
 621         key = dbwrap_record_get_key(db_rec);
 622
 623         val = dbwrap_record_get_value(db_rec);
 624         if (val.dsize == 0) {
 625                 DEBUG(10, ("%s: empty value\n", __func__));
 626                 TALLOC_FREE(frame);
 627                 *is_free = true;
 628                 if (was_free) {
 629                         *was_free = true;
 630                 }
 631                 return;
 632         }
 633
 634         blob = data_blob_const(val.dptr, val.dsize);
 635
 636         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 637                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_open_globalB);
 638         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 639                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 640                 DEBUG(1,("smbXsrv_open_global_verify_record: "
 641                          "key '%s' ndr_pull_struct_blob - %s\n",
 642                          hex_encode_talloc(frame, key.dptr, key.dsize),
 643                          nt_errstr(status)));
 644                 TALLOC_FREE(frame);
 645                 return;
 646         }
 647
 648         DEBUG(10,("smbXsrv_open_global_verify_record\n"));
 649         if (CHECK_DEBUGLVL(10)) {
 650                 NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
 651         }
 652
 653         if (global_blob.version != SMBXSRV_VERSION_0) {
 654                 DEBUG(0,("smbXsrv_open_global_verify_record: "
 655                          "key '%s' use unsupported version %u\n",
 656                          hex_encode_talloc(frame, key.dptr, key.dsize),
 657                          global_blob.version));
 658                 NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
 659                 TALLOC_FREE(frame);
 660                 return;
 661         }
 662
 663         global = global_blob.info.info0;
 664
 665         if (server_id_is_disconnected(&global->server_id)) {
 666                 exists = true;
 667         } else {
 668                 exists = serverid_exists(&global->server_id);
 669         }
 670         if (!exists) {
 671                 struct server_id_buf idbuf;
 672                 DEBUG(2,("smbXsrv_open_global_verify_record: "
 673                          "key '%s' server_id %s does not exist.\n",
 674                          hex_encode_talloc(frame, key.dptr, key.dsize),
 675                          server_id_str_buf(global->server_id, &idbuf)));
 676                 if (CHECK_DEBUGLVL(2)) {
 677                         NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
 678                 }
 679                 TALLOC_FREE(frame);
 680                 dbwrap_record_delete(db_rec);
 681                 *is_free = true;
 682                 return;
 683         }
 684
 685         if (_g) {
 686                 *_g = talloc_move(mem_ctx, &global);
 687         }
 688         TALLOC_FREE(frame);
 689 }
 690
 691 static NTSTATUS smbXsrv_open_global_store(struct smbXsrv_open_global0 *global)
 692 {
 693         struct smbXsrv_open_globalB global_blob;
 694         DATA_BLOB blob = data_blob_null;
 695         TDB_DATA key;
 696         TDB_DATA val;
 697         NTSTATUS status;
 698         enum ndr_err_code ndr_err;
 699
 700         /*
 701          * TODO: if we use other versions than '0'
 702          * we would add glue code here, that would be able to
 703          * store the information in the old format.
 704          */
 705
 706         if (global->db_rec == NULL) {
 707                 return NT_STATUS_INTERNAL_ERROR;
 708         }
 709
 710         key = dbwrap_record_get_key(global->db_rec);
 711         val = dbwrap_record_get_value(global->db_rec);
 712
 713         ZERO_STRUCT(global_blob);
 714         global_blob.version = smbXsrv_version_global_current();
 715         if (val.dsize >= 8) {
 716                 global_blob.seqnum = IVAL(val.dptr, 4);
 717         }
 718         global_blob.seqnum += 1;
 719         global_blob.info.info0 = global;
 720
 721         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 722                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_open_globalB);
 723         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 724                 status = ndr_map_error2ntstatus(ndr_err);
 725                 DEBUG(1,("smbXsrv_open_global_store: key '%s' ndr_push - %s\n",
 726                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 727                          nt_errstr(status)));
 728                 TALLOC_FREE(global->db_rec);
 729                 return status;
 730         }
 731
 732         val = make_tdb_data(blob.data, blob.length);
 733         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 734         if (!NT_STATUS_IS_OK(status)) {
 735                 DEBUG(1,("smbXsrv_open_global_store: key '%s' store - %s\n",
 736                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 737                          nt_errstr(status)));
 738                 TALLOC_FREE(global->db_rec);
 739                 return status;
 740         }
 741
 742         if (CHECK_DEBUGLVL(10)) {
 743                 DEBUG(10,("smbXsrv_open_global_store: key '%s' stored\n",
 744                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
 745                 NDR_PRINT_DEBUG(smbXsrv_open_globalB, &global_blob);
 746         }
 747
 748         TALLOC_FREE(global->db_rec);
 749
 750         return NT_STATUS_OK;
 751 }
 752
 753 static NTSTATUS smbXsrv_open_global_lookup(struct smbXsrv_open_table *table,
 754                                            uint32_t open_global_id,
 755                                            TALLOC_CTX *mem_ctx,
 756                                            struct smbXsrv_open_global0 **_global)
 757 {
 758         struct db_record *global_rec = NULL;
 759         bool is_free = false;
 760
 761         *_global = NULL;
 762
 763         if (table->global.db_ctx == NULL) {
 764                 return NT_STATUS_INTERNAL_ERROR;
 765         }
 766
 767         global_rec = smbXsrv_open_global_fetch_locked(table->global.db_ctx,
 768                                                       open_global_id,
 769                                                       mem_ctx);
 770         if (global_rec == NULL) {
 771                 return NT_STATUS_INTERNAL_DB_ERROR;
 772         }
 773
 774         smbXsrv_open_global_verify_record(global_rec,
 775                                           &is_free,
 776                                           NULL,
 777                                           mem_ctx,
 778                                           _global);
 779         if (is_free) {
 780                 DEBUG(10, ("%s: is_free=true\n", __func__));
 781                 talloc_free(global_rec);
 782                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 783         }
 784
 785         (*_global)->db_rec = talloc_move(*_global, &global_rec);
 786
 787         talloc_set_destructor(*_global, smbXsrv_open_global_destructor);
 788
 789         return NT_STATUS_OK;
 790 }
 791
 792 static int smbXsrv_open_destructor(struct smbXsrv_open *op)
 793 {
 794         NTSTATUS status;
 795
 796         status = smbXsrv_open_close(op, 0);
 797         if (!NT_STATUS_IS_OK(status)) {
 798                 DEBUG(0, ("smbXsrv_open_destructor: "
 799                           "smbXsrv_open_close() failed - %s\n",
 800                           nt_errstr(status)));
 801         }
 802
 803         TALLOC_FREE(op->global);
 804
 805         return 0;
 806 }
 807
 808 NTSTATUS smbXsrv_open_create(struct smbXsrv_connection *conn,
 809                              struct auth_session_info *session_info,
 810                              NTTIME now,
 811                              struct smbXsrv_open **_open)
 812 {
 813         struct smbXsrv_open_table *table = conn->client->open_table;
 814         struct db_record *local_rec = NULL;
 815         struct smbXsrv_open *op = NULL;
 816         void *ptr = NULL;
 817         TDB_DATA val;
 818         struct smbXsrv_open_global0 *global = NULL;
 819         NTSTATUS status;
 820         struct dom_sid *current_sid = NULL;
 821         struct security_token *current_token = NULL;
 822
 823         if (session_info == NULL) {
 824                 return NT_STATUS_INVALID_HANDLE;
 825         }
 826         current_token = session_info->security_token;
 827
 828         if (current_token == NULL) {
 829                 return NT_STATUS_INVALID_HANDLE;
 830         }
 831
 832         if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
 833                 current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
 834         }
 835
 836         if (current_sid == NULL) {
 837                 return NT_STATUS_INVALID_HANDLE;
 838         }
 839
 840         if (table->local.num_opens >= table->local.max_opens) {
 841                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 842         }
 843
 844         op = talloc_zero(table, struct smbXsrv_open);
 845         if (op == NULL) {
 846                 return NT_STATUS_NO_MEMORY;
 847         }
 848         op->table = table;
 849         op->status = NT_STATUS_OK; /* TODO: start with INTERNAL_ERROR */
 850         op->idle_time = now;
 851
 852         status = smbXsrv_open_global_allocate(table->global.db_ctx,
 853                                               op, &global);
 854         if (!NT_STATUS_IS_OK(status)) {
 855                 TALLOC_FREE(op);
 856                 return status;
 857         }
 858         op->global = global;
 859
 860         status = smbXsrv_open_local_allocate_id(table->local.db_ctx,
 861                                                 table->local.lowest_id,
 862                                                 table->local.highest_id,
 863                                                 op,
 864                                                 &local_rec,
 865                                                 &op->local_id);
 866         if (!NT_STATUS_IS_OK(status)) {
 867                 TALLOC_FREE(op);
 868                 return status;
 869         }
 870
 871         global->open_persistent_id = global->open_global_id;
 872         global->open_volatile_id = op->local_id;
 873
 874         global->server_id = messaging_server_id(conn->client->msg_ctx);
 875         global->open_time = now;
 876         global->open_owner = *current_sid;
 877         if (conn->protocol >= PROTOCOL_SMB2_10) {
 878                 global->client_guid = conn->smb2.client.guid;
 879         }
 880
 881         ptr = op;
 882         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
 883         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
 884         TALLOC_FREE(local_rec);
 885         if (!NT_STATUS_IS_OK(status)) {
 886                 TALLOC_FREE(op);
 887                 return status;
 888         }
 889         table->local.num_opens += 1;
 890
 891         talloc_set_destructor(op, smbXsrv_open_destructor);
 892
 893         status = smbXsrv_open_global_store(global);
 894         if (!NT_STATUS_IS_OK(status)) {
 895                 DEBUG(0,("smbXsrv_open_create: "
 896                          "global_id (0x%08x) store failed - %s\n",
 897                          op->global->open_global_id,
 898                          nt_errstr(status)));
 899                 TALLOC_FREE(op);
 900                 return status;
 901         }
 902
 903         if (CHECK_DEBUGLVL(10)) {
 904                 struct smbXsrv_openB open_blob = {
 905                         .version = SMBXSRV_VERSION_0,
 906                         .info.info0 = op,
 907                 };
 908
 909                 DEBUG(10,("smbXsrv_open_create: global_id (0x%08x) stored\n",
 910                          op->global->open_global_id));
 911                 NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
 912         }
 913
 914         *_open = op;
 915         return NT_STATUS_OK;
 916 }
 917
 918 uint32_t smbXsrv_open_hash(struct smbXsrv_open *_open)
 919 {
 920         uint8_t buf[8+8+8];
 921         uint32_t ret;
 922         TDB_DATA key;
 923
 924         SBVAL(buf,  0, _open->global->open_persistent_id);
 925         SBVAL(buf,  8, _open->global->open_volatile_id);
 926         SBVAL(buf, 16, _open->global->open_time);
 927
 928         key = (TDB_DATA) { .dptr = buf, .dsize = sizeof(buf) };
 929         ret = tdb_jenkins_hash(&key);
 930
 931         if (ret == 0) {
 932                 ret = 1;
 933         }
 934
 935         return ret;
 936 }
 937
 938 static NTSTATUS smbXsrv_open_set_replay_cache(struct smbXsrv_open *op)
 939 {
 940         struct GUID *create_guid;
 941         struct GUID_txt_buf buf;
 942         char *guid_string;
 943         struct db_context *db = op->table->local.replay_cache_db_ctx;
 944         NTSTATUS status;
 945
 946         if (!(op->flags & SMBXSRV_OPEN_NEED_REPLAY_CACHE)) {
 947                 return NT_STATUS_OK;
 948         }
 949
 950         if (op->flags & SMBXSRV_OPEN_HAVE_REPLAY_CACHE) {
 951                 return NT_STATUS_OK;
 952         }
 953
 954         create_guid = &op->global->create_guid;
 955         if (GUID_all_zero(create_guid)) {
 956                 return NT_STATUS_OK;
 957         }
 958
 959         guid_string = GUID_buf_string(create_guid, &buf);
 960         if (guid_string == NULL) {
 961                 return NT_STATUS_INVALID_PARAMETER;
 962         }
 963
 964         status = dbwrap_store_uint32_bystring(db, guid_string, op->local_id);
 965
 966         if (NT_STATUS_IS_OK(status)) {
 967                 op->flags |= SMBXSRV_OPEN_HAVE_REPLAY_CACHE;
 968                 op->flags &= ~SMBXSRV_OPEN_NEED_REPLAY_CACHE;
 969         }
 970
 971         return status;
 972 }
 973
 974 static NTSTATUS smbXsrv_open_clear_replay_cache(struct smbXsrv_open *op)
 975 {
 976         struct GUID *create_guid;
 977         struct GUID_txt_buf buf;
 978         char *guid_string;
 979         struct db_context *db;
 980         NTSTATUS status;
 981
 982         if (op->table == NULL) {
 983                 return NT_STATUS_OK;
 984         }
 985
 986         db = op->table->local.replay_cache_db_ctx;
 987
 988         if (!(op->flags & SMBXSRV_OPEN_HAVE_REPLAY_CACHE)) {
 989                 return NT_STATUS_OK;
 990         }
 991
 992         create_guid = &op->global->create_guid;
 993         if (GUID_all_zero(create_guid)) {
 994                 return NT_STATUS_OK;
 995         }
 996
 997         guid_string = GUID_buf_string(create_guid, &buf);
 998         if (guid_string == NULL) {
 999                 return NT_STATUS_INVALID_PARAMETER;
1000         }
1001
1002         status = dbwrap_purge_bystring(db, guid_string);
1003
1004         if (NT_STATUS_IS_OK(status)) {
1005                 op->flags &= ~SMBXSRV_OPEN_HAVE_REPLAY_CACHE;
1006         }
1007
1008         return status;
1009 }
1010
1011 NTSTATUS smbXsrv_open_update(struct smbXsrv_open *op)
1012 {
1013         struct smbXsrv_open_table *table = op->table;
1014         NTSTATUS status;
1015
1016         if (op->global->db_rec != NULL) {
1017                 DEBUG(0, ("smbXsrv_open_update(0x%08x): "
1018                           "Called with db_rec != NULL'\n",
1019                           op->global->open_global_id));
1020                 return NT_STATUS_INTERNAL_ERROR;
1021         }
1022
1023         op->global->db_rec = smbXsrv_open_global_fetch_locked(
1024                                                 table->global.db_ctx,
1025                                                 op->global->open_global_id,
1026                                                 op->global /* TALLOC_CTX */);
1027         if (op->global->db_rec == NULL) {
1028                 return NT_STATUS_INTERNAL_DB_ERROR;
1029         }
1030
1031         status = smbXsrv_open_global_store(op->global);
1032         if (!NT_STATUS_IS_OK(status)) {
1033                 DEBUG(0,("smbXsrv_open_update: "
1034                          "global_id (0x%08x) store failed - %s\n",
1035                          op->global->open_global_id,
1036                          nt_errstr(status)));
1037                 return status;
1038         }
1039
1040         status = smbXsrv_open_set_replay_cache(op);
1041         if (!NT_STATUS_IS_OK(status)) {
1042                 DBG_ERR("smbXsrv_open_set_replay_cache failed: %s\n",
1043                         nt_errstr(status));
1044                 return status;
1045         }
1046
1047         if (CHECK_DEBUGLVL(10)) {
1048                 struct smbXsrv_openB open_blob = {
1049                         .version = SMBXSRV_VERSION_0,
1050                         .info.info0 = op,
1051                 };
1052
1053                 DEBUG(10,("smbXsrv_open_update: global_id (0x%08x) stored\n",
1054                           op->global->open_global_id));
1055                 NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
1056         }
1057
1058         return NT_STATUS_OK;
1059 }
1060
1061 NTSTATUS smbXsrv_open_close(struct smbXsrv_open *op, NTTIME now)
1062 {
1063         struct smbXsrv_open_table *table;
1064         struct db_record *local_rec = NULL;
1065         struct db_record *global_rec = NULL;
1066         NTSTATUS status;
1067         NTSTATUS error = NT_STATUS_OK;
1068
1069         error = smbXsrv_open_clear_replay_cache(op);
1070         if (!NT_STATUS_IS_OK(error)) {
1071                 DBG_ERR("smbXsrv_open_clear_replay_cache failed: %s\n",
1072                         nt_errstr(error));
1073         }
1074
1075         if (op->table == NULL) {
1076                 return error;
1077         }
1078
1079         table = op->table;
1080         op->table = NULL;
1081
1082         op->status = NT_STATUS_FILE_CLOSED;
1083         op->global->disconnect_time = now;
1084         server_id_set_disconnected(&op->global->server_id);
1085
1086         global_rec = op->global->db_rec;
1087         op->global->db_rec = NULL;
1088         if (global_rec == NULL) {
1089                 global_rec = smbXsrv_open_global_fetch_locked(
1090                                         table->global.db_ctx,
1091                                         op->global->open_global_id,
1092                                         op->global /* TALLOC_CTX */);
1093                 if (global_rec == NULL) {
1094                         error = NT_STATUS_INTERNAL_ERROR;
1095                 }
1096         }
1097
1098         if (global_rec != NULL && op->global->durable) {
1099                 /*
1100                  * If it is a durable open we need to update the global part
1101                  * instead of deleting it
1102                  */
1103                 op->global->db_rec = global_rec;
1104                 status = smbXsrv_open_global_store(op->global);
1105                 if (NT_STATUS_IS_OK(status)) {
1106                         /*
1107                          * smbXsrv_open_global_store does the free
1108                          * of op->global->db_rec
1109                          */
1110                         global_rec = NULL;
1111                 }
1112                 if (!NT_STATUS_IS_OK(status)) {
1113                         DEBUG(0,("smbXsrv_open_close(0x%08x)"
1114                                  "smbXsrv_open_global_store() failed - %s\n",
1115                                  op->global->open_global_id,
1116                                  nt_errstr(status)));
1117                         error = status;
1118                 }
1119
1120                 if (NT_STATUS_IS_OK(status) && CHECK_DEBUGLVL(10)) {
1121                         struct smbXsrv_openB open_blob = {
1122                                 .version = SMBXSRV_VERSION_0,
1123                                 .info.info0 = op,
1124                         };
1125
1126                         DEBUG(10,("smbXsrv_open_close(0x%08x): "
1127                                   "stored disconnect\n",
1128                                   op->global->open_global_id));
1129                         NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
1130                 }
1131         }
1132
1133         if (global_rec != NULL) {
1134                 status = dbwrap_record_delete(global_rec);
1135                 if (!NT_STATUS_IS_OK(status)) {
1136                         TDB_DATA key = dbwrap_record_get_key(global_rec);
1137
1138                         DEBUG(0, ("smbXsrv_open_close(0x%08x): "
1139                                   "failed to delete global key '%s': %s\n",
1140                                   op->global->open_global_id,
1141                                   hex_encode_talloc(global_rec, key.dptr,
1142                                                     key.dsize),
1143                                   nt_errstr(status)));
1144                         error = status;
1145                 }
1146         }
1147         TALLOC_FREE(global_rec);
1148
1149         local_rec = op->db_rec;
1150         if (local_rec == NULL) {
1151                 local_rec = smbXsrv_open_local_fetch_locked(table->local.db_ctx,
1152                                                             op->local_id,
1153                                                             op /* TALLOC_CTX*/);
1154                 if (local_rec == NULL) {
1155                         error = NT_STATUS_INTERNAL_ERROR;
1156                 }
1157         }
1158
1159         if (local_rec != NULL) {
1160                 status = dbwrap_record_delete(local_rec);
1161                 if (!NT_STATUS_IS_OK(status)) {
1162                         TDB_DATA key = dbwrap_record_get_key(local_rec);
1163
1164                         DEBUG(0, ("smbXsrv_open_close(0x%08x): "
1165                                   "failed to delete local key '%s': %s\n",
1166                                   op->global->open_global_id,
1167                                   hex_encode_talloc(local_rec, key.dptr,
1168                                                     key.dsize),
1169                                   nt_errstr(status)));
1170                         error = status;
1171                 }
1172                 table->local.num_opens -= 1;
1173         }
1174         if (op->db_rec == NULL) {
1175                 TALLOC_FREE(local_rec);
1176         }
1177         op->db_rec = NULL;
1178
1179         if (op->compat) {
1180                 op->compat->op = NULL;
1181                 file_free(NULL, op->compat);
1182                 op->compat = NULL;
1183         }
1184
1185         return error;
1186 }
1187
1188 NTSTATUS smb1srv_open_table_init(struct smbXsrv_connection *conn)
1189 {
1190         uint32_t max_opens;
1191
1192         /*
1193          * Allow a range from 1..65534.
1194          *
1195          * With real_max_open_files possible ids,
1196          * truncated to the SMB1 limit of 16-bit.
1197          *
1198          * 0 and 0xFFFF are no valid ids.
1199          */
1200         max_opens = conn->client->sconn->real_max_open_files;
1201         max_opens = MIN(max_opens, UINT16_MAX - 1);
1202
1203         return smbXsrv_open_table_init(conn, 1, UINT16_MAX - 1, max_opens);
1204 }
1205
1206 NTSTATUS smb1srv_open_lookup(struct smbXsrv_connection *conn,
1207                              uint16_t fnum, NTTIME now,
1208                              struct smbXsrv_open **_open)
1209 {
1210         struct smbXsrv_open_table *table = conn->client->open_table;
1211         uint32_t local_id = fnum;
1212         uint32_t global_id = 0;
1213
1214         return smbXsrv_open_local_lookup(table, local_id, global_id, now, _open);
1215 }
1216
1217 NTSTATUS smb2srv_open_table_init(struct smbXsrv_connection *conn)
1218 {
1219         uint32_t max_opens;
1220
1221         /*
1222          * Allow a range from 1..4294967294.
1223          *
1224          * With real_max_open_files possible ids,
1225          * truncated to 16-bit (the same as SMB1 for now).
1226          *
1227          * 0 and 0xFFFFFFFF are no valid ids.
1228          *
1229          * The usage of conn->sconn->real_max_open_files
1230          * is the reason that we use one open table per
1231          * transport connection (as we still have a 1:1 mapping
1232          * between process and transport connection).
1233          */
1234         max_opens = conn->client->sconn->real_max_open_files;
1235         max_opens = MIN(max_opens, UINT16_MAX - 1);
1236
1237         return smbXsrv_open_table_init(conn, 1, UINT32_MAX - 1, max_opens);
1238 }
1239
1240 NTSTATUS smb2srv_open_lookup(struct smbXsrv_connection *conn,
1241                              uint64_t persistent_id,
1242                              uint64_t volatile_id,
1243                              NTTIME now,
1244                              struct smbXsrv_open **_open)
1245 {
1246         struct smbXsrv_open_table *table = conn->client->open_table;
1247         uint32_t local_id = volatile_id & UINT32_MAX;
1248         uint64_t local_zeros = volatile_id & 0xFFFFFFFF00000000LLU;
1249         uint32_t global_id = persistent_id & UINT32_MAX;
1250         uint64_t global_zeros = persistent_id & 0xFFFFFFFF00000000LLU;
1251         NTSTATUS status;
1252
1253         if (local_zeros != 0) {
1254                 return NT_STATUS_FILE_CLOSED;
1255         }
1256
1257         if (global_zeros != 0) {
1258                 return NT_STATUS_FILE_CLOSED;
1259         }
1260
1261         if (global_id == 0) {
1262                 return NT_STATUS_FILE_CLOSED;
1263         }
1264
1265         status = smbXsrv_open_local_lookup(table, local_id, global_id, now,
1266                                            _open);
1267         if (!NT_STATUS_IS_OK(status)) {
1268                 return status;
1269         }
1270
1271         /*
1272          * Clear the replay cache for this create_guid if it exists:
1273          * This is based on the assumption that this lookup will be
1274          * triggered by a client request using the file-id for lookup.
1275          * Hence the client has proven that it has in fact seen the
1276          * reply to its initial create call. So subsequent create replays
1277          * should be treated as invalid. Hence the index for create_guid
1278          * lookup needs to be removed.
1279          */
1280         status = smbXsrv_open_clear_replay_cache(*_open);
1281
1282         return status;
1283 }
1284
1285 NTSTATUS smb2srv_open_lookup_replay_cache(struct smbXsrv_connection *conn,
1286                                           const struct GUID *create_guid,
1287                                           NTTIME now, /* TODO: needed ? */
1288                                           struct smbXsrv_open **_open)
1289 {
1290         NTSTATUS status;
1291         char *guid_string;
1292         struct GUID_txt_buf buf;
1293         uint32_t local_id = 0;
1294         struct smbXsrv_open_table *table = conn->client->open_table;
1295         struct db_context *db = table->local.replay_cache_db_ctx;
1296
1297         if (GUID_all_zero(create_guid)) {
1298                 return NT_STATUS_NOT_FOUND;
1299         }
1300
1301         guid_string = GUID_buf_string(create_guid, &buf);
1302         if (guid_string == NULL) {
1303                 return NT_STATUS_INVALID_PARAMETER;
1304         }
1305
1306         status = dbwrap_fetch_uint32_bystring(db, guid_string, &local_id);
1307         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1308                 return status;
1309         }
1310         if (!NT_STATUS_IS_OK(status)) {
1311                 DBG_ERR("failed to fetch local_id from replay cache: %s\n",
1312                         nt_errstr(status));
1313                 return status;
1314         }
1315
1316         status = smbXsrv_open_local_lookup(table, local_id, 0, /* global_id */
1317                                            now, _open);
1318         if (!NT_STATUS_IS_OK(status)) {
1319                 DBG_ERR("smbXsrv_open_local_lookup failed for local_id %u\n",
1320                         (unsigned)local_id);
1321         }
1322
1323         return status;
1324 }
1325
1326 NTSTATUS smb2srv_open_recreate(struct smbXsrv_connection *conn,
1327                                struct auth_session_info *session_info,
1328                                uint64_t persistent_id,
1329                                const struct GUID *create_guid,
1330                                NTTIME now,
1331                                struct smbXsrv_open **_open)
1332 {
1333         struct smbXsrv_open_table *table = conn->client->open_table;
1334         struct db_record *local_rec = NULL;
1335         struct smbXsrv_open *op = NULL;
1336         void *ptr = NULL;
1337         TDB_DATA val;
1338         uint32_t global_id = persistent_id & UINT32_MAX;
1339         uint64_t global_zeros = persistent_id & 0xFFFFFFFF00000000LLU;
1340         NTSTATUS status;
1341         struct security_token *current_token = NULL;
1342
1343         if (session_info == NULL) {
1344                 DEBUG(10, ("session_info=NULL\n"));
1345                 return NT_STATUS_INVALID_HANDLE;
1346         }
1347         current_token = session_info->security_token;
1348
1349         if (current_token == NULL) {
1350                 DEBUG(10, ("current_token=NULL\n"));
1351                 return NT_STATUS_INVALID_HANDLE;
1352         }
1353
1354         if (global_zeros != 0) {
1355                 DEBUG(10, ("global_zeros!=0\n"));
1356                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1357         }
1358
1359         op = talloc_zero(table, struct smbXsrv_open);
1360         if (op == NULL) {
1361                 return NT_STATUS_NO_MEMORY;
1362         }
1363         op->table = table;
1364
1365         status = smbXsrv_open_global_lookup(table, global_id, op, &op->global);
1366         if (!NT_STATUS_IS_OK(status)) {
1367                 TALLOC_FREE(op);
1368                 DEBUG(10, ("smbXsrv_open_global_lookup returned %s\n",
1369                            nt_errstr(status)));
1370                 return status;
1371         }
1372
1373         /*
1374          * If the provided create_guid is NULL, this means that
1375          * the reconnect request was a v1 request. In that case
1376          * we should skipt the create GUID verification, since
1377          * it is valid to v1-reconnect a v2-opened handle.
1378          */
1379         if ((create_guid != NULL) &&
1380             !GUID_equal(&op->global->create_guid, create_guid))
1381         {
1382                 TALLOC_FREE(op);
1383                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1384         }
1385
1386         if (!security_token_is_sid(current_token, &op->global->open_owner)) {
1387                 TALLOC_FREE(op);
1388                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1389         }
1390
1391         if (!op->global->durable) {
1392                 TALLOC_FREE(op);
1393                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1394         }
1395
1396         if (table->local.num_opens >= table->local.max_opens) {
1397                 TALLOC_FREE(op);
1398                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1399         }
1400
1401         status = smbXsrv_open_local_allocate_id(table->local.db_ctx,
1402                                                 table->local.lowest_id,
1403                                                 table->local.highest_id,
1404                                                 op,
1405                                                 &local_rec,
1406                                                 &op->local_id);
1407         if (!NT_STATUS_IS_OK(status)) {
1408                 TALLOC_FREE(op);
1409                 return status;
1410         }
1411
1412         op->idle_time = now;
1413         op->status = NT_STATUS_FILE_CLOSED;
1414
1415         op->global->open_volatile_id = op->local_id;
1416         op->global->server_id = messaging_server_id(conn->client->msg_ctx);
1417
1418         ptr = op;
1419         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1420         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1421         TALLOC_FREE(local_rec);
1422         if (!NT_STATUS_IS_OK(status)) {
1423                 TALLOC_FREE(op);
1424                 return status;
1425         }
1426         table->local.num_opens += 1;
1427
1428         talloc_set_destructor(op, smbXsrv_open_destructor);
1429
1430         status = smbXsrv_open_global_store(op->global);
1431         if (!NT_STATUS_IS_OK(status)) {
1432                 TALLOC_FREE(op);
1433                 return status;
1434         }
1435
1436         if (CHECK_DEBUGLVL(10)) {
1437                 struct smbXsrv_openB open_blob = {
1438                         .info.info0 = op,
1439                 };
1440
1441                 DEBUG(10,("smbXsrv_open_recreate: global_id (0x%08x) stored\n",
1442                          op->global->open_global_id));
1443                 NDR_PRINT_DEBUG(smbXsrv_openB, &open_blob);
1444         }
1445
1446         *_open = op;
1447         return NT_STATUS_OK;
1448 }
1449
1450
1451 static NTSTATUS smbXsrv_open_global_parse_record(TALLOC_CTX *mem_ctx,
1452                                                  struct db_record *rec,
1453                                                  struct smbXsrv_open_global0 **global)
1454 {
1455         TDB_DATA key = dbwrap_record_get_key(rec);
1456         TDB_DATA val = dbwrap_record_get_value(rec);
1457         DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
1458         struct smbXsrv_open_globalB global_blob;
1459         enum ndr_err_code ndr_err;
1460         NTSTATUS status;
1461         TALLOC_CTX *frame = talloc_stackframe();
1462
1463         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
1464                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_open_globalB);
1465         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1466                 DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
1467                          "key '%s' ndr_pull_struct_blob - %s\n",
1468                          hex_encode_talloc(frame, key.dptr, key.dsize),
1469                          ndr_errstr(ndr_err)));
1470                 status = ndr_map_error2ntstatus(ndr_err);
1471                 goto done;
1472         }
1473
1474         if (global_blob.version != SMBXSRV_VERSION_0) {
1475                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
1476                 DEBUG(1,("Invalid record in smbXsrv_open_global.tdb:"
1477                          "key '%s' unsupported version - %d - %s\n",
1478                          hex_encode_talloc(frame, key.dptr, key.dsize),
1479                          (int)global_blob.version,
1480                          nt_errstr(status)));
1481                 goto done;
1482         }
1483
1484         *global = talloc_move(mem_ctx, &global_blob.info.info0);
1485         status = NT_STATUS_OK;
1486 done:
1487         talloc_free(frame);
1488         return status;
1489 }
1490
1491 struct smbXsrv_open_global_traverse_state {
1492         int (*fn)(struct smbXsrv_open_global0 *, void *);
1493         void *private_data;
1494 };
1495
1496 static int smbXsrv_open_global_traverse_fn(struct db_record *rec, void *data)
1497 {
1498         struct smbXsrv_open_global_traverse_state *state =
1499                 (struct smbXsrv_open_global_traverse_state*)data;
1500         struct smbXsrv_open_global0 *global = NULL;
1501         NTSTATUS status;
1502         int ret = -1;
1503
1504         status = smbXsrv_open_global_parse_record(talloc_tos(), rec, &global);
1505         if (!NT_STATUS_IS_OK(status)) {
1506                 return -1;
1507         }
1508
1509         global->db_rec = rec;
1510         ret = state->fn(global, state->private_data);
1511         talloc_free(global);
1512         return ret;
1513 }
1514
1515 NTSTATUS smbXsrv_open_global_traverse(
1516                         int (*fn)(struct smbXsrv_open_global0 *, void *),
1517                         void *private_data)
1518 {
1519
1520         NTSTATUS status;
1521         int count = 0;
1522         struct smbXsrv_open_global_traverse_state state = {
1523                 .fn = fn,
1524                 .private_data = private_data,
1525         };
1526
1527         become_root();
1528         status = smbXsrv_open_global_init();
1529         if (!NT_STATUS_IS_OK(status)) {
1530                 unbecome_root();
1531                 DEBUG(0, ("Failed to initialize open_global: %s\n",
1532                           nt_errstr(status)));
1533                 return status;
1534         }
1535
1536         status = dbwrap_traverse_read(smbXsrv_open_global_db_ctx,
1537                                       smbXsrv_open_global_traverse_fn,
1538                                       &state,
1539                                       &count);
1540         unbecome_root();
1541
1542         return status;
1543 }
1544
1545 NTSTATUS smbXsrv_open_cleanup(uint64_t persistent_id)
1546 {
1547         NTSTATUS status = NT_STATUS_OK;
1548         TALLOC_CTX *frame = talloc_stackframe();
1549         struct smbXsrv_open_global0 *op = NULL;
1550         TDB_DATA val;
1551         struct db_record *rec;
1552         bool delete_open = false;
1553         uint32_t global_id = persistent_id & UINT32_MAX;
1554
1555         rec = smbXsrv_open_global_fetch_locked(smbXsrv_open_global_db_ctx,
1556                                                global_id,
1557                                                frame);
1558         if (rec == NULL) {
1559                 status = NT_STATUS_NOT_FOUND;
1560                 goto done;
1561         }
1562
1563         val = dbwrap_record_get_value(rec);
1564         if (val.dsize == 0) {
1565                 DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
1566                           "empty record in %s, skipping...\n",
1567                            global_id, dbwrap_name(smbXsrv_open_global_db_ctx)));
1568                 goto done;
1569         }
1570
1571         status = smbXsrv_open_global_parse_record(talloc_tos(), rec, &op);
1572         if (!NT_STATUS_IS_OK(status)) {
1573                 DEBUG(1, ("smbXsrv_open_cleanup[global: 0x%08x] "
1574                           "failed to read record: %s\n",
1575                           global_id, nt_errstr(status)));
1576                 goto done;
1577         }
1578
1579         if (server_id_is_disconnected(&op->server_id)) {
1580                 struct timeval now, disconnect_time;
1581                 int64_t tdiff;
1582                 now = timeval_current();
1583                 nttime_to_timeval(&disconnect_time, op->disconnect_time);
1584                 tdiff = usec_time_diff(&now, &disconnect_time);
1585                 delete_open = (tdiff >= 1000*op->durable_timeout_msec);
1586
1587                 DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
1588                            "disconnected at [%s] %us ago with "
1589                            "timeout of %us -%s reached\n",
1590                            global_id,
1591                            nt_time_string(frame, op->disconnect_time),
1592                            (unsigned)(tdiff/1000000),
1593                            op->durable_timeout_msec / 1000,
1594                            delete_open ? "" : " not"));
1595         } else if (!serverid_exists(&op->server_id)) {
1596                 struct server_id_buf idbuf;
1597                 DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
1598                            "server[%s] does not exist\n",
1599                            global_id,
1600                            server_id_str_buf(op->server_id, &idbuf)));
1601                 delete_open = true;
1602         }
1603
1604         if (!delete_open) {
1605                 goto done;
1606         }
1607
1608         status = dbwrap_record_delete(rec);
1609         if (!NT_STATUS_IS_OK(status)) {
1610                 DEBUG(1, ("smbXsrv_open_cleanup[global: 0x%08x] "
1611                           "failed to delete record"
1612                           "from %s: %s\n", global_id,
1613                           dbwrap_name(smbXsrv_open_global_db_ctx),
1614                           nt_errstr(status)));
1615                 goto done;
1616         }
1617
1618         DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
1619                    "delete record from %s\n",
1620                    global_id,
1621                    dbwrap_name(smbXsrv_open_global_db_ctx)));
1622
1623 done:
1624         talloc_free(frame);
1625         return status;
1626 }