source3/smbd/smbXsrv_session.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2011-2012
   5    Copyright (C) Michael Adam 2012
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/filesys.h"
  23 #include <tevent.h>
  24 #include "lib/util/server_id.h"
  25 #include "smbd/smbd.h"
  26 #include "smbd/globals.h"
  27 #include "dbwrap/dbwrap.h"
  28 #include "dbwrap/dbwrap_rbt.h"
  29 #include "dbwrap/dbwrap_open.h"
  30 #include "dbwrap/dbwrap_watch.h"
  31 #include "session.h"
  32 #include "auth.h"
  33 #include "auth/gensec/gensec.h"
  34 #include "../lib/tsocket/tsocket.h"
  35 #include "../libcli/security/security.h"
  36 #include "messages.h"
  37 #include "lib/util/util_tdb.h"
  38 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  39 #include "serverid.h"
  40 #include "lib/util/tevent_ntstatus.h"
  41
  42 struct smbXsrv_session_table {
  43         struct {
  44                 struct db_context *db_ctx;
  45                 uint32_t lowest_id;
  46                 uint32_t highest_id;
  47                 uint32_t max_sessions;
  48                 uint32_t num_sessions;
  49         } local;
  50         struct {
  51                 struct db_context *db_ctx;
  52         } global;
  53 };
  54
  55 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
  56
  57 NTSTATUS smbXsrv_session_global_init(struct messaging_context *msg_ctx)
  58 {
  59         char *global_path = NULL;
  60         struct db_context *backend = NULL;
  61         struct db_context *db_ctx = NULL;
  62
  63         if (smbXsrv_session_global_db_ctx != NULL) {
  64                 return NT_STATUS_OK;
  65         }
  66
  67         /*
  68          * This contains secret information like session keys!
  69          */
  70         global_path = lock_path("smbXsrv_session_global.tdb");
  71         if (global_path == NULL) {
  72                 return NT_STATUS_NO_MEMORY;
  73         }
  74
  75         backend = db_open(NULL, global_path,
  76                           0, /* hash_size */
  77                           TDB_DEFAULT |
  78                           TDB_CLEAR_IF_FIRST |
  79                           TDB_INCOMPATIBLE_HASH,
  80                           O_RDWR | O_CREAT, 0600,
  81                           DBWRAP_LOCK_ORDER_1,
  82                           DBWRAP_FLAG_NONE);
  83         TALLOC_FREE(global_path);
  84         if (backend == NULL) {
  85                 NTSTATUS status;
  86
  87                 status = map_nt_error_from_unix_common(errno);
  88
  89                 return status;
  90         }
  91
  92         db_ctx = db_open_watched(NULL, backend, server_messaging_context());
  93         if (db_ctx == NULL) {
  94                 TALLOC_FREE(backend);
  95                 return NT_STATUS_NO_MEMORY;
  96         }
  97
  98         smbXsrv_session_global_db_ctx = db_ctx;
  99
 100         return NT_STATUS_OK;
 101 }
 102
 103 /*
 104  * NOTE:
 105  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
 106  * has the same result as integer comparison between the uint32_t
 107  * values.
 108  *
 109  * TODO: implement string based key
 110  */
 111
 112 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
 113
 114 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
 115                                                  uint8_t *key_buf)
 116 {
 117         TDB_DATA key;
 118
 119         RSIVAL(key_buf, 0, id);
 120
 121         key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
 122
 123         return key;
 124 }
 125
 126 #if 0
 127 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
 128 {
 129         if (id == NULL) {
 130                 return NT_STATUS_INVALID_PARAMETER;
 131         }
 132
 133         if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
 134                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 135         }
 136
 137         *id = RIVAL(key.dptr, 0);
 138
 139         return NT_STATUS_OK;
 140 }
 141 #endif
 142
 143 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
 144
 145 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
 146                                                 uint8_t *key_buf)
 147 {
 148         TDB_DATA key;
 149
 150         RSIVAL(key_buf, 0, id);
 151
 152         key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
 153
 154         return key;
 155 }
 156
 157 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
 158 {
 159         if (id == NULL) {
 160                 return NT_STATUS_INVALID_PARAMETER;
 161         }
 162
 163         if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
 164                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 165         }
 166
 167         *id = RIVAL(key.dptr, 0);
 168
 169         return NT_STATUS_OK;
 170 }
 171
 172 static struct db_record *smbXsrv_session_global_fetch_locked(
 173                         struct db_context *db,
 174                         uint32_t id,
 175                         TALLOC_CTX *mem_ctx)
 176 {
 177         TDB_DATA key;
 178         uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
 179         struct db_record *rec = NULL;
 180
 181         key = smbXsrv_session_global_id_to_key(id, key_buf);
 182
 183         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 184
 185         if (rec == NULL) {
 186                 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
 187                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 188         }
 189
 190         return rec;
 191 }
 192
 193 static struct db_record *smbXsrv_session_local_fetch_locked(
 194                         struct db_context *db,
 195                         uint32_t id,
 196                         TALLOC_CTX *mem_ctx)
 197 {
 198         TDB_DATA key;
 199         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 200         struct db_record *rec = NULL;
 201
 202         key = smbXsrv_session_local_id_to_key(id, key_buf);
 203
 204         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 205
 206         if (rec == NULL) {
 207                 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
 208                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 209         }
 210
 211         return rec;
 212 }
 213
 214 static void smbXsrv_session_close_loop(struct tevent_req *subreq);
 215
 216 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
 217                                            uint32_t lowest_id,
 218                                            uint32_t highest_id,
 219                                            uint32_t max_sessions)
 220 {
 221         struct smbXsrv_client *client = conn->client;
 222         struct smbXsrv_session_table *table;
 223         NTSTATUS status;
 224         struct tevent_req *subreq;
 225         uint64_t max_range;
 226
 227         if (lowest_id > highest_id) {
 228                 return NT_STATUS_INTERNAL_ERROR;
 229         }
 230
 231         max_range = highest_id;
 232         max_range -= lowest_id;
 233         max_range += 1;
 234
 235         if (max_sessions > max_range) {
 236                 return NT_STATUS_INTERNAL_ERROR;
 237         }
 238
 239         table = talloc_zero(client, struct smbXsrv_session_table);
 240         if (table == NULL) {
 241                 return NT_STATUS_NO_MEMORY;
 242         }
 243
 244         table->local.db_ctx = db_open_rbt(table);
 245         if (table->local.db_ctx == NULL) {
 246                 TALLOC_FREE(table);
 247                 return NT_STATUS_NO_MEMORY;
 248         }
 249         table->local.lowest_id = lowest_id;
 250         table->local.highest_id = highest_id;
 251         table->local.max_sessions = max_sessions;
 252
 253         status = smbXsrv_session_global_init(client->msg_ctx);
 254         if (!NT_STATUS_IS_OK(status)) {
 255                 TALLOC_FREE(table);
 256                 return status;
 257         }
 258
 259         table->global.db_ctx = smbXsrv_session_global_db_ctx;
 260
 261         subreq = messaging_read_send(table, client->ev_ctx, client->msg_ctx,
 262                                      MSG_SMBXSRV_SESSION_CLOSE);
 263         if (subreq == NULL) {
 264                 TALLOC_FREE(table);
 265                 return NT_STATUS_NO_MEMORY;
 266         }
 267         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
 268
 269         client->session_table = table;
 270         return NT_STATUS_OK;
 271 }
 272
 273 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
 274
 275 static void smbXsrv_session_close_loop(struct tevent_req *subreq)
 276 {
 277         struct smbXsrv_client *client =
 278                 tevent_req_callback_data(subreq,
 279                 struct smbXsrv_client);
 280         struct smbXsrv_session_table *table = client->session_table;
 281         int ret;
 282         struct messaging_rec *rec = NULL;
 283         struct smbXsrv_session_closeB close_blob;
 284         enum ndr_err_code ndr_err;
 285         struct smbXsrv_session_close0 *close_info0 = NULL;
 286         struct smbXsrv_session *session = NULL;
 287         NTSTATUS status;
 288         struct timeval tv = timeval_current();
 289         NTTIME now = timeval_to_nttime(&tv);
 290
 291         ret = messaging_read_recv(subreq, talloc_tos(), &rec);
 292         TALLOC_FREE(subreq);
 293         if (ret != 0) {
 294                 goto next;
 295         }
 296
 297         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
 298                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
 299         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 300                 status = ndr_map_error2ntstatus(ndr_err);
 301                 DEBUG(1,("smbXsrv_session_close_loop: "
 302                          "ndr_pull_struct_blob - %s\n",
 303                          nt_errstr(status)));
 304                 goto next;
 305         }
 306
 307         DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
 308         if (DEBUGLVL(10)) {
 309                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 310         }
 311
 312         if (close_blob.version != SMBXSRV_VERSION_0) {
 313                 DEBUG(0,("smbXsrv_session_close_loop: "
 314                          "ignore invalid version %u\n", close_blob.version));
 315                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 316                 goto next;
 317         }
 318
 319         close_info0 = close_blob.info.info0;
 320         if (close_info0 == NULL) {
 321                 DEBUG(0,("smbXsrv_session_close_loop: "
 322                          "ignore NULL info %u\n", close_blob.version));
 323                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 324                 goto next;
 325         }
 326
 327         status = smb2srv_session_lookup_client(client,
 328                                                close_info0->old_session_wire_id,
 329                                                now, &session);
 330         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
 331                 DEBUG(4,("smbXsrv_session_close_loop: "
 332                          "old_session_wire_id %llu not found\n",
 333                          (unsigned long long)close_info0->old_session_wire_id));
 334                 if (DEBUGLVL(4)) {
 335                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 336                 }
 337                 goto next;
 338         }
 339         if (!NT_STATUS_IS_OK(status) &&
 340             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
 341             !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 342                 DEBUG(1,("smbXsrv_session_close_loop: "
 343                          "old_session_wire_id %llu - %s\n",
 344                          (unsigned long long)close_info0->old_session_wire_id,
 345                          nt_errstr(status)));
 346                 if (DEBUGLVL(1)) {
 347                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 348                 }
 349                 goto next;
 350         }
 351
 352         if (session->global->session_global_id != close_info0->old_session_global_id) {
 353                 DEBUG(1,("smbXsrv_session_close_loop: "
 354                          "old_session_wire_id %llu - global %u != %u\n",
 355                          (unsigned long long)close_info0->old_session_wire_id,
 356                          session->global->session_global_id,
 357                          close_info0->old_session_global_id));
 358                 if (DEBUGLVL(1)) {
 359                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 360                 }
 361                 goto next;
 362         }
 363
 364         if (session->global->creation_time != close_info0->old_creation_time) {
 365                 DEBUG(1,("smbXsrv_session_close_loop: "
 366                          "old_session_wire_id %llu - "
 367                          "creation %s (%llu) != %s (%llu)\n",
 368                          (unsigned long long)close_info0->old_session_wire_id,
 369                          nt_time_string(rec, session->global->creation_time),
 370                          (unsigned long long)session->global->creation_time,
 371                          nt_time_string(rec, close_info0->old_creation_time),
 372                          (unsigned long long)close_info0->old_creation_time));
 373                 if (DEBUGLVL(1)) {
 374                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 375                 }
 376                 goto next;
 377         }
 378
 379         subreq = smb2srv_session_shutdown_send(session, client->ev_ctx,
 380                                                session, NULL);
 381         if (subreq == NULL) {
 382                 status = NT_STATUS_NO_MEMORY;
 383                 DEBUG(0, ("smbXsrv_session_close_loop: "
 384                           "smb2srv_session_shutdown_send(%llu) failed: %s\n",
 385                           (unsigned long long)session->global->session_wire_id,
 386                           nt_errstr(status)));
 387                 if (DEBUGLVL(1)) {
 388                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
 389                 }
 390                 goto next;
 391         }
 392         tevent_req_set_callback(subreq,
 393                                 smbXsrv_session_close_shutdown_done,
 394                                 session);
 395
 396 next:
 397         TALLOC_FREE(rec);
 398
 399         subreq = messaging_read_send(table, client->ev_ctx, client->msg_ctx,
 400                                      MSG_SMBXSRV_SESSION_CLOSE);
 401         if (subreq == NULL) {
 402                 const char *r;
 403                 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
 404                 exit_server_cleanly(r);
 405                 return;
 406         }
 407         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
 408 }
 409
 410 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
 411 {
 412         struct smbXsrv_session *session =
 413                 tevent_req_callback_data(subreq,
 414                 struct smbXsrv_session);
 415         NTSTATUS status;
 416
 417         status = smb2srv_session_shutdown_recv(subreq);
 418         TALLOC_FREE(subreq);
 419         if (!NT_STATUS_IS_OK(status)) {
 420                 DEBUG(0, ("smbXsrv_session_close_loop: "
 421                           "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
 422                           (unsigned long long)session->global->session_wire_id,
 423                           nt_errstr(status)));
 424         }
 425
 426         status = smbXsrv_session_logoff(session);
 427         if (!NT_STATUS_IS_OK(status)) {
 428                 DEBUG(0, ("smbXsrv_session_close_loop: "
 429                           "smbXsrv_session_logoff(%llu) failed: %s\n",
 430                           (unsigned long long)session->global->session_wire_id,
 431                           nt_errstr(status)));
 432         }
 433
 434         TALLOC_FREE(session);
 435 }
 436
 437 struct smb1srv_session_local_allocate_state {
 438         const uint32_t lowest_id;
 439         const uint32_t highest_id;
 440         uint32_t last_id;
 441         uint32_t useable_id;
 442         NTSTATUS status;
 443 };
 444
 445 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
 446                                                    void *private_data)
 447 {
 448         struct smb1srv_session_local_allocate_state *state =
 449                 (struct smb1srv_session_local_allocate_state *)private_data;
 450         TDB_DATA key = dbwrap_record_get_key(rec);
 451         uint32_t id = 0;
 452         NTSTATUS status;
 453
 454         status = smbXsrv_session_local_key_to_id(key, &id);
 455         if (!NT_STATUS_IS_OK(status)) {
 456                 state->status = status;
 457                 return -1;
 458         }
 459
 460         if (id <= state->last_id) {
 461                 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 462                 return -1;
 463         }
 464         state->last_id = id;
 465
 466         if (id > state->useable_id) {
 467                 state->status = NT_STATUS_OK;
 468                 return -1;
 469         }
 470
 471         if (state->useable_id == state->highest_id) {
 472                 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
 473                 return -1;
 474         }
 475
 476         state->useable_id +=1;
 477         return 0;
 478 }
 479
 480 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
 481                                                   uint32_t lowest_id,
 482                                                   uint32_t highest_id,
 483                                                   TALLOC_CTX *mem_ctx,
 484                                                   struct db_record **_rec,
 485                                                   uint32_t *_id)
 486 {
 487         struct smb1srv_session_local_allocate_state state = {
 488                 .lowest_id = lowest_id,
 489                 .highest_id = highest_id,
 490                 .last_id = 0,
 491                 .useable_id = lowest_id,
 492                 .status = NT_STATUS_INTERNAL_ERROR,
 493         };
 494         uint32_t i;
 495         uint32_t range;
 496         NTSTATUS status;
 497         int count = 0;
 498
 499         *_rec = NULL;
 500         *_id = 0;
 501
 502         if (lowest_id > highest_id) {
 503                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 504         }
 505
 506         /*
 507          * first we try randomly
 508          */
 509         range = (highest_id - lowest_id) + 1;
 510
 511         for (i = 0; i < (range / 2); i++) {
 512                 uint32_t id;
 513                 TDB_DATA val;
 514                 struct db_record *rec = NULL;
 515
 516                 id = generate_random() % range;
 517                 id += lowest_id;
 518
 519                 if (id < lowest_id) {
 520                         id = lowest_id;
 521                 }
 522                 if (id > highest_id) {
 523                         id = highest_id;
 524                 }
 525
 526                 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
 527                 if (rec == NULL) {
 528                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 529                 }
 530
 531                 val = dbwrap_record_get_value(rec);
 532                 if (val.dsize != 0) {
 533                         TALLOC_FREE(rec);
 534                         continue;
 535                 }
 536
 537                 *_rec = rec;
 538                 *_id = id;
 539                 return NT_STATUS_OK;
 540         }
 541
 542         /*
 543          * if the range is almost full,
 544          * we traverse the whole table
 545          * (this relies on sorted behavior of dbwrap_rbt)
 546          */
 547         status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
 548                                       &state, &count);
 549         if (NT_STATUS_IS_OK(status)) {
 550                 if (NT_STATUS_IS_OK(state.status)) {
 551                         return NT_STATUS_INTERNAL_ERROR;
 552                 }
 553
 554                 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
 555                         return state.status;
 556                 }
 557
 558                 if (state.useable_id <= state.highest_id) {
 559                         state.status = NT_STATUS_OK;
 560                 } else {
 561                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 562                 }
 563         } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
 564                 /*
 565                  * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
 566                  *
 567                  * If we get anything else it is an error, because it
 568                  * means we did not manage to find a free slot in
 569                  * the db.
 570                  */
 571                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 572         }
 573
 574         if (NT_STATUS_IS_OK(state.status)) {
 575                 uint32_t id;
 576                 TDB_DATA val;
 577                 struct db_record *rec = NULL;
 578
 579                 id = state.useable_id;
 580
 581                 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
 582                 if (rec == NULL) {
 583                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 584                 }
 585
 586                 val = dbwrap_record_get_value(rec);
 587                 if (val.dsize != 0) {
 588                         TALLOC_FREE(rec);
 589                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 590                 }
 591
 592                 *_rec = rec;
 593                 *_id = id;
 594                 return NT_STATUS_OK;
 595         }
 596
 597         return state.status;
 598 }
 599
 600 struct smbXsrv_session_local_fetch_state {
 601         struct smbXsrv_session *session;
 602         NTSTATUS status;
 603 };
 604
 605 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
 606                                                void *private_data)
 607 {
 608         struct smbXsrv_session_local_fetch_state *state =
 609                 (struct smbXsrv_session_local_fetch_state *)private_data;
 610         void *ptr;
 611
 612         if (data.dsize != sizeof(ptr)) {
 613                 state->status = NT_STATUS_INTERNAL_DB_ERROR;
 614                 return;
 615         }
 616
 617         memcpy(&ptr, data.dptr, data.dsize);
 618         state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
 619         state->status = NT_STATUS_OK;
 620 }
 621
 622 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
 623                                              /* conn: optional */
 624                                              struct smbXsrv_connection *conn,
 625                                              uint32_t session_local_id,
 626                                              NTTIME now,
 627                                              struct smbXsrv_session **_session)
 628 {
 629         struct smbXsrv_session_local_fetch_state state = {
 630                 .session = NULL,
 631                 .status = NT_STATUS_INTERNAL_ERROR,
 632         };
 633         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 634         TDB_DATA key;
 635         NTSTATUS status;
 636
 637         *_session = NULL;
 638
 639         if (session_local_id == 0) {
 640                 return NT_STATUS_USER_SESSION_DELETED;
 641         }
 642
 643         if (table == NULL) {
 644                 /* this might happen before the end of negprot */
 645                 return NT_STATUS_USER_SESSION_DELETED;
 646         }
 647
 648         if (table->local.db_ctx == NULL) {
 649                 return NT_STATUS_INTERNAL_ERROR;
 650         }
 651
 652         key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
 653
 654         status = dbwrap_parse_record(table->local.db_ctx, key,
 655                                      smbXsrv_session_local_fetch_parser,
 656                                      &state);
 657         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
 658                 return NT_STATUS_USER_SESSION_DELETED;
 659         } else if (!NT_STATUS_IS_OK(status)) {
 660                 return status;
 661         }
 662         if (!NT_STATUS_IS_OK(state.status)) {
 663                 return state.status;
 664         }
 665
 666         if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
 667                 return NT_STATUS_USER_SESSION_DELETED;
 668         }
 669
 670         /*
 671          * If a connection is specified check if the session is
 672          * valid on the channel.
 673          */
 674         if (conn != NULL) {
 675                 struct smbXsrv_channel_global0 *c = NULL;
 676
 677                 status = smbXsrv_session_find_channel(state.session, conn, &c);
 678                 if (!NT_STATUS_IS_OK(status)) {
 679                         return status;
 680                 }
 681         }
 682
 683         state.session->idle_time = now;
 684
 685         if (!NT_STATUS_IS_OK(state.session->status)) {
 686                 *_session = state.session;
 687                 return state.session->status;
 688         }
 689
 690         if (now > state.session->global->expiration_time) {
 691                 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
 692         }
 693
 694         *_session = state.session;
 695         return state.session->status;
 696 }
 697
 698 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
 699 {
 700         return 0;
 701 }
 702
 703 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 704                                         bool *is_free,
 705                                         bool *was_free,
 706                                         TALLOC_CTX *mem_ctx,
 707                                         struct smbXsrv_session_global0 **_g);
 708
 709 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
 710                                         TALLOC_CTX *mem_ctx,
 711                                         struct smbXsrv_session_global0 **_global)
 712 {
 713         uint32_t i;
 714         struct smbXsrv_session_global0 *global = NULL;
 715         uint32_t last_free = 0;
 716         const uint32_t min_tries = 3;
 717
 718         *_global = NULL;
 719
 720         global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
 721         if (global == NULL) {
 722                 return NT_STATUS_NO_MEMORY;
 723         }
 724         talloc_set_destructor(global, smbXsrv_session_global_destructor);
 725
 726         /*
 727          * Here we just randomly try the whole 32-bit space
 728          *
 729          * We use just 32-bit, because we want to reuse the
 730          * ID for SRVSVC.
 731          */
 732         for (i = 0; i < UINT32_MAX; i++) {
 733                 bool is_free = false;
 734                 bool was_free = false;
 735                 uint32_t id;
 736
 737                 if (i >= min_tries && last_free != 0) {
 738                         id = last_free;
 739                 } else {
 740                         id = generate_random();
 741                 }
 742                 if (id == 0) {
 743                         id++;
 744                 }
 745                 if (id == UINT32_MAX) {
 746                         id--;
 747                 }
 748
 749                 global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
 750                                                                      mem_ctx);
 751                 if (global->db_rec == NULL) {
 752                         talloc_free(global);
 753                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 754                 }
 755
 756                 smbXsrv_session_global_verify_record(global->db_rec,
 757                                                      &is_free,
 758                                                      &was_free,
 759                                                      NULL, NULL);
 760
 761                 if (!is_free) {
 762                         TALLOC_FREE(global->db_rec);
 763                         continue;
 764                 }
 765
 766                 if (!was_free && i < min_tries) {
 767                         /*
 768                          * The session_id is free now,
 769                          * but was not free before.
 770                          *
 771                          * This happens if a smbd crashed
 772                          * and did not cleanup the record.
 773                          *
 774                          * If this is one of our first tries,
 775                          * then we try to find a real free one.
 776                          */
 777                         if (last_free == 0) {
 778                                 last_free = id;
 779                         }
 780                         TALLOC_FREE(global->db_rec);
 781                         continue;
 782                 }
 783
 784                 global->session_global_id = id;
 785
 786                 *_global = global;
 787                 return NT_STATUS_OK;
 788         }
 789
 790         /* should not be reached */
 791         talloc_free(global);
 792         return NT_STATUS_INTERNAL_ERROR;
 793 }
 794
 795 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 796                                         bool *is_free,
 797                                         bool *was_free,
 798                                         TALLOC_CTX *mem_ctx,
 799                                         struct smbXsrv_session_global0 **_g)
 800 {
 801         TDB_DATA key;
 802         TDB_DATA val;
 803         DATA_BLOB blob;
 804         struct smbXsrv_session_globalB global_blob;
 805         enum ndr_err_code ndr_err;
 806         struct smbXsrv_session_global0 *global = NULL;
 807         bool exists;
 808         TALLOC_CTX *frame = talloc_stackframe();
 809
 810         *is_free = false;
 811
 812         if (was_free) {
 813                 *was_free = false;
 814         }
 815         if (_g) {
 816                 *_g = NULL;
 817         }
 818
 819         key = dbwrap_record_get_key(db_rec);
 820
 821         val = dbwrap_record_get_value(db_rec);
 822         if (val.dsize == 0) {
 823                 TALLOC_FREE(frame);
 824                 *is_free = true;
 825                 if (was_free) {
 826                         *was_free = true;
 827                 }
 828                 return;
 829         }
 830
 831         blob = data_blob_const(val.dptr, val.dsize);
 832
 833         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 834                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
 835         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 836                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 837                 DEBUG(1,("smbXsrv_session_global_verify_record: "
 838                          "key '%s' ndr_pull_struct_blob - %s\n",
 839                          hex_encode_talloc(frame, key.dptr, key.dsize),
 840                          nt_errstr(status)));
 841                 TALLOC_FREE(frame);
 842                 *is_free = true;
 843                 if (was_free) {
 844                         *was_free = true;
 845                 }
 846                 return;
 847         }
 848
 849         DEBUG(10,("smbXsrv_session_global_verify_record\n"));
 850         if (DEBUGLVL(10)) {
 851                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 852         }
 853
 854         if (global_blob.version != SMBXSRV_VERSION_0) {
 855                 DEBUG(0,("smbXsrv_session_global_verify_record: "
 856                          "key '%s' use unsupported version %u\n",
 857                          hex_encode_talloc(frame, key.dptr, key.dsize),
 858                          global_blob.version));
 859                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 860                 TALLOC_FREE(frame);
 861                 *is_free = true;
 862                 if (was_free) {
 863                         *was_free = true;
 864                 }
 865                 return;
 866         }
 867
 868         global = global_blob.info.info0;
 869
 870         exists = serverid_exists(&global->channels[0].server_id);
 871         if (!exists) {
 872                 struct server_id_buf idbuf;
 873                 DEBUG(2,("smbXsrv_session_global_verify_record: "
 874                          "key '%s' server_id %s does not exist.\n",
 875                          hex_encode_talloc(frame, key.dptr, key.dsize),
 876                          server_id_str_buf(global->channels[0].server_id,
 877                                            &idbuf)));
 878                 if (DEBUGLVL(2)) {
 879                         NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 880                 }
 881                 TALLOC_FREE(frame);
 882                 dbwrap_record_delete(db_rec);
 883                 *is_free = true;
 884                 return;
 885         }
 886
 887         if (_g) {
 888                 *_g = talloc_move(mem_ctx, &global);
 889         }
 890         TALLOC_FREE(frame);
 891 }
 892
 893 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
 894 {
 895         struct smbXsrv_session_globalB global_blob;
 896         DATA_BLOB blob = data_blob_null;
 897         TDB_DATA key;
 898         TDB_DATA val;
 899         NTSTATUS status;
 900         enum ndr_err_code ndr_err;
 901
 902         /*
 903          * TODO: if we use other versions than '0'
 904          * we would add glue code here, that would be able to
 905          * store the information in the old format.
 906          */
 907
 908         if (global->db_rec == NULL) {
 909                 return NT_STATUS_INTERNAL_ERROR;
 910         }
 911
 912         key = dbwrap_record_get_key(global->db_rec);
 913         val = dbwrap_record_get_value(global->db_rec);
 914
 915         ZERO_STRUCT(global_blob);
 916         global_blob.version = smbXsrv_version_global_current();
 917         if (val.dsize >= 8) {
 918                 global_blob.seqnum = IVAL(val.dptr, 4);
 919         }
 920         global_blob.seqnum += 1;
 921         global_blob.info.info0 = global;
 922
 923         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 924                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
 925         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 926                 status = ndr_map_error2ntstatus(ndr_err);
 927                 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
 928                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 929                          nt_errstr(status)));
 930                 TALLOC_FREE(global->db_rec);
 931                 return status;
 932         }
 933
 934         val = make_tdb_data(blob.data, blob.length);
 935         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 936         if (!NT_STATUS_IS_OK(status)) {
 937                 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
 938                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 939                          nt_errstr(status)));
 940                 TALLOC_FREE(global->db_rec);
 941                 return status;
 942         }
 943
 944         if (DEBUGLVL(10)) {
 945                 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
 946                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
 947                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 948         }
 949
 950         TALLOC_FREE(global->db_rec);
 951
 952         return NT_STATUS_OK;
 953 }
 954
 955 struct smb2srv_session_close_previous_state {
 956         struct tevent_context *ev;
 957         struct smbXsrv_connection *connection;
 958         struct dom_sid *current_sid;
 959         uint64_t current_session_id;
 960         struct db_record *db_rec;
 961 };
 962
 963 static void smb2srv_session_close_previous_check(struct tevent_req *req);
 964 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
 965
 966 struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
 967                                         struct tevent_context *ev,
 968                                         struct smbXsrv_connection *conn,
 969                                         struct auth_session_info *session_info,
 970                                         uint64_t previous_session_id,
 971                                         uint64_t current_session_id)
 972 {
 973         struct tevent_req *req;
 974         struct smb2srv_session_close_previous_state *state;
 975         uint32_t global_id = previous_session_id & UINT32_MAX;
 976         uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
 977         struct smbXsrv_session_table *table = conn->client->session_table;
 978         struct security_token *current_token = NULL;
 979
 980         req = tevent_req_create(mem_ctx, &state,
 981                                 struct smb2srv_session_close_previous_state);
 982         if (req == NULL) {
 983                 return NULL;
 984         }
 985         state->ev = ev;
 986         state->connection = conn;
 987         state->current_session_id = current_session_id;
 988
 989         if (global_zeros != 0) {
 990                 tevent_req_done(req);
 991                 return tevent_req_post(req, ev);
 992         }
 993
 994         if (session_info == NULL) {
 995                 tevent_req_done(req);
 996                 return tevent_req_post(req, ev);
 997         }
 998         current_token = session_info->security_token;
 999
1000         if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
1001                 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
1002         }
1003
1004         if (state->current_sid == NULL) {
1005                 tevent_req_done(req);
1006                 return tevent_req_post(req, ev);
1007         }
1008
1009         if (!security_token_has_nt_authenticated_users(current_token)) {
1010                 /* TODO */
1011                 tevent_req_done(req);
1012                 return tevent_req_post(req, ev);
1013         }
1014
1015         state->db_rec = smbXsrv_session_global_fetch_locked(
1016                                                         table->global.db_ctx,
1017                                                         global_id,
1018                                                         state /* TALLOC_CTX */);
1019         if (state->db_rec == NULL) {
1020                 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1021                 return tevent_req_post(req, ev);
1022         }
1023
1024         smb2srv_session_close_previous_check(req);
1025         if (!tevent_req_is_in_progress(req)) {
1026                 return tevent_req_post(req, ev);
1027         }
1028
1029         return req;
1030 }
1031
1032 static void smb2srv_session_close_previous_check(struct tevent_req *req)
1033 {
1034         struct smb2srv_session_close_previous_state *state =
1035                 tevent_req_data(req,
1036                 struct smb2srv_session_close_previous_state);
1037         struct smbXsrv_connection *conn = state->connection;
1038         DATA_BLOB blob;
1039         struct security_token *previous_token = NULL;
1040         struct smbXsrv_session_global0 *global = NULL;
1041         enum ndr_err_code ndr_err;
1042         struct smbXsrv_session_close0 close_info0;
1043         struct smbXsrv_session_closeB close_blob;
1044         struct tevent_req *subreq = NULL;
1045         NTSTATUS status;
1046         bool is_free = false;
1047
1048         smbXsrv_session_global_verify_record(state->db_rec,
1049                                              &is_free,
1050                                              NULL,
1051                                              state,
1052                                              &global);
1053
1054         if (is_free) {
1055                 TALLOC_FREE(state->db_rec);
1056                 tevent_req_done(req);
1057                 return;
1058         }
1059
1060         if (global->auth_session_info == NULL) {
1061                 TALLOC_FREE(state->db_rec);
1062                 tevent_req_done(req);
1063                 return;
1064         }
1065
1066         previous_token = global->auth_session_info->security_token;
1067
1068         if (!security_token_is_sid(previous_token, state->current_sid)) {
1069                 TALLOC_FREE(state->db_rec);
1070                 tevent_req_done(req);
1071                 return;
1072         }
1073
1074         subreq = dbwrap_watched_watch_send(state, state->ev, state->db_rec,
1075                                            (struct server_id){0});
1076         if (tevent_req_nomem(subreq, req)) {
1077                 TALLOC_FREE(state->db_rec);
1078                 return;
1079         }
1080         tevent_req_set_callback(subreq,
1081                                 smb2srv_session_close_previous_modified,
1082                                 req);
1083
1084         close_info0.old_session_global_id = global->session_global_id;
1085         close_info0.old_session_wire_id = global->session_wire_id;
1086         close_info0.old_creation_time = global->creation_time;
1087         close_info0.new_session_wire_id = state->current_session_id;
1088
1089         ZERO_STRUCT(close_blob);
1090         close_blob.version = smbXsrv_version_global_current();
1091         close_blob.info.info0 = &close_info0;
1092
1093         ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1094                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1095         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1096                 TALLOC_FREE(state->db_rec);
1097                 status = ndr_map_error2ntstatus(ndr_err);
1098                 DEBUG(1,("smb2srv_session_close_previous_check: "
1099                          "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1100                          (unsigned long long)close_info0.old_session_wire_id,
1101                          (unsigned long long)close_info0.new_session_wire_id,
1102                          nt_errstr(status)));
1103                 tevent_req_nterror(req, status);
1104                 return;
1105         }
1106
1107         status = messaging_send(conn->msg_ctx,
1108                                 global->channels[0].server_id,
1109                                 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1110         TALLOC_FREE(state->db_rec);
1111         if (tevent_req_nterror(req, status)) {
1112                 return;
1113         }
1114
1115         TALLOC_FREE(global);
1116         return;
1117 }
1118
1119 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1120 {
1121         struct tevent_req *req =
1122                 tevent_req_callback_data(subreq,
1123                 struct tevent_req);
1124         struct smb2srv_session_close_previous_state *state =
1125                 tevent_req_data(req,
1126                 struct smb2srv_session_close_previous_state);
1127         NTSTATUS status;
1128
1129         status = dbwrap_watched_watch_recv(subreq, state, &state->db_rec, NULL,
1130                                            NULL);
1131         TALLOC_FREE(subreq);
1132         if (tevent_req_nterror(req, status)) {
1133                 return;
1134         }
1135
1136         smb2srv_session_close_previous_check(req);
1137 }
1138
1139 NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1140 {
1141         NTSTATUS status;
1142
1143         if (tevent_req_is_nterror(req, &status)) {
1144                 tevent_req_received(req);
1145                 return status;
1146         }
1147
1148         tevent_req_received(req);
1149         return NT_STATUS_OK;
1150 }
1151
1152 static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1153 {
1154         NTSTATUS status;
1155         struct smbXsrv_connection *xconn = NULL;
1156
1157         if (session->client != NULL) {
1158                 xconn = session->client->connections;
1159         }
1160
1161         for (; xconn != NULL; xconn = xconn->next) {
1162                 struct smbd_smb2_request *preq;
1163
1164                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1165                         if (preq->session != session) {
1166                                 continue;
1167                         }
1168
1169                         preq->session = NULL;
1170                         /*
1171                          * If we no longer have a session we can't
1172                          * sign or encrypt replies.
1173                          */
1174                         preq->do_signing = false;
1175                         preq->do_encryption = false;
1176                         preq->preauth = NULL;
1177                 }
1178         }
1179
1180         status = smbXsrv_session_logoff(session);
1181         return status;
1182 }
1183
1184 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1185 {
1186         NTSTATUS status;
1187
1188         status = smbXsrv_session_clear_and_logoff(session);
1189         if (!NT_STATUS_IS_OK(status)) {
1190                 DEBUG(0, ("smbXsrv_session_destructor: "
1191                           "smbXsrv_session_logoff() failed: %s\n",
1192                           nt_errstr(status)));
1193         }
1194
1195         TALLOC_FREE(session->global);
1196
1197         return 0;
1198 }
1199
1200 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1201                                 NTTIME now,
1202                                 struct smbXsrv_session **_session)
1203 {
1204         struct smbXsrv_session_table *table = conn->client->session_table;
1205         struct db_record *local_rec = NULL;
1206         struct smbXsrv_session *session = NULL;
1207         void *ptr = NULL;
1208         TDB_DATA val;
1209         struct smbXsrv_session_global0 *global = NULL;
1210         struct smbXsrv_channel_global0 *channel = NULL;
1211         NTSTATUS status;
1212
1213         if (table->local.num_sessions >= table->local.max_sessions) {
1214                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1215         }
1216
1217         session = talloc_zero(table, struct smbXsrv_session);
1218         if (session == NULL) {
1219                 return NT_STATUS_NO_MEMORY;
1220         }
1221         session->table = table;
1222         session->idle_time = now;
1223         session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1224         session->client = conn->client;
1225
1226         status = smbXsrv_session_global_allocate(table->global.db_ctx,
1227                                                  session,
1228                                                  &global);
1229         if (!NT_STATUS_IS_OK(status)) {
1230                 TALLOC_FREE(session);
1231                 return status;
1232         }
1233         session->global = global;
1234
1235         if (conn->protocol >= PROTOCOL_SMB2_02) {
1236                 uint64_t id = global->session_global_id;
1237
1238                 global->connection_dialect = conn->smb2.server.dialect;
1239
1240                 global->session_wire_id = id;
1241
1242                 status = smb2srv_tcon_table_init(session);
1243                 if (!NT_STATUS_IS_OK(status)) {
1244                         TALLOC_FREE(session);
1245                         return status;
1246                 }
1247
1248                 session->local_id = global->session_global_id;
1249
1250                 local_rec = smbXsrv_session_local_fetch_locked(
1251                                                 table->local.db_ctx,
1252                                                 session->local_id,
1253                                                 session /* TALLOC_CTX */);
1254                 if (local_rec == NULL) {
1255                         TALLOC_FREE(session);
1256                         return NT_STATUS_NO_MEMORY;
1257                 }
1258
1259                 val = dbwrap_record_get_value(local_rec);
1260                 if (val.dsize != 0) {
1261                         TALLOC_FREE(session);
1262                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1263                 }
1264         } else {
1265
1266                 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1267                                                         table->local.lowest_id,
1268                                                         table->local.highest_id,
1269                                                         session,
1270                                                         &local_rec,
1271                                                         &session->local_id);
1272                 if (!NT_STATUS_IS_OK(status)) {
1273                         TALLOC_FREE(session);
1274                         return status;
1275                 }
1276
1277                 global->session_wire_id = session->local_id;
1278         }
1279
1280         global->creation_time = now;
1281         global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1282
1283         status = smbXsrv_session_add_channel(session, conn, &channel);
1284         if (!NT_STATUS_IS_OK(status)) {
1285                 TALLOC_FREE(session);
1286                 return status;
1287         }
1288
1289         ptr = session;
1290         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1291         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1292         TALLOC_FREE(local_rec);
1293         if (!NT_STATUS_IS_OK(status)) {
1294                 TALLOC_FREE(session);
1295                 return status;
1296         }
1297         table->local.num_sessions += 1;
1298
1299         talloc_set_destructor(session, smbXsrv_session_destructor);
1300
1301         status = smbXsrv_session_global_store(global);
1302         if (!NT_STATUS_IS_OK(status)) {
1303                 DEBUG(0,("smbXsrv_session_create: "
1304                          "global_id (0x%08x) store failed - %s\n",
1305                          session->global->session_global_id,
1306                          nt_errstr(status)));
1307                 TALLOC_FREE(session);
1308                 return status;
1309         }
1310
1311         if (DEBUGLVL(10)) {
1312                 struct smbXsrv_sessionB session_blob;
1313
1314                 ZERO_STRUCT(session_blob);
1315                 session_blob.version = SMBXSRV_VERSION_0;
1316                 session_blob.info.info0 = session;
1317
1318                 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1319                          session->global->session_global_id));
1320                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1321         }
1322
1323         *_session = session;
1324         return NT_STATUS_OK;
1325 }
1326
1327 NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1328                                      struct smbXsrv_connection *conn,
1329                                      struct smbXsrv_channel_global0 **_c)
1330 {
1331         struct smbXsrv_session_global0 *global = session->global;
1332         struct smbXsrv_channel_global0 *c = NULL;
1333
1334         if (global->num_channels > 31) {
1335                 /*
1336                  * Windows 2012 and 2012R2 allow up to 32 channels
1337                  */
1338                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1339         }
1340
1341         c = talloc_realloc(global,
1342                            global->channels,
1343                            struct smbXsrv_channel_global0,
1344                            global->num_channels + 1);
1345         if (c == NULL) {
1346                 return NT_STATUS_NO_MEMORY;
1347         }
1348         global->channels = c;
1349
1350         c = &global->channels[global->num_channels];
1351         ZERO_STRUCTP(c);
1352
1353         c->server_id = messaging_server_id(conn->msg_ctx);
1354         c->local_address = tsocket_address_string(conn->local_address,
1355                                                   global->channels);
1356         if (c->local_address == NULL) {
1357                 return NT_STATUS_NO_MEMORY;
1358         }
1359         c->remote_address = tsocket_address_string(conn->remote_address,
1360                                                    global->channels);
1361         if (c->remote_address == NULL) {
1362                 return NT_STATUS_NO_MEMORY;
1363         }
1364         c->remote_name = talloc_strdup(global->channels,
1365                                        conn->remote_hostname);
1366         if (c->remote_name == NULL) {
1367                 return NT_STATUS_NO_MEMORY;
1368         }
1369         c->connection = conn;
1370
1371         global->num_channels += 1;
1372
1373         *_c = c;
1374         return NT_STATUS_OK;
1375 }
1376
1377 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1378 {
1379         struct smbXsrv_session_table *table = session->table;
1380         NTSTATUS status;
1381
1382         if (session->global->db_rec != NULL) {
1383                 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1384                           "Called with db_rec != NULL'\n",
1385                           session->global->session_global_id));
1386                 return NT_STATUS_INTERNAL_ERROR;
1387         }
1388
1389         session->global->db_rec = smbXsrv_session_global_fetch_locked(
1390                                         table->global.db_ctx,
1391                                         session->global->session_global_id,
1392                                         session->global /* TALLOC_CTX */);
1393         if (session->global->db_rec == NULL) {
1394                 return NT_STATUS_INTERNAL_DB_ERROR;
1395         }
1396
1397         status = smbXsrv_session_global_store(session->global);
1398         if (!NT_STATUS_IS_OK(status)) {
1399                 DEBUG(0,("smbXsrv_session_update: "
1400                          "global_id (0x%08x) store failed - %s\n",
1401                          session->global->session_global_id,
1402                          nt_errstr(status)));
1403                 return status;
1404         }
1405
1406         if (DEBUGLVL(10)) {
1407                 struct smbXsrv_sessionB session_blob;
1408
1409                 ZERO_STRUCT(session_blob);
1410                 session_blob.version = SMBXSRV_VERSION_0;
1411                 session_blob.info.info0 = session;
1412
1413                 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1414                           session->global->session_global_id));
1415                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1416         }
1417
1418         return NT_STATUS_OK;
1419 }
1420
1421 NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1422                                       const struct smbXsrv_connection *conn,
1423                                       struct smbXsrv_channel_global0 **_c)
1424 {
1425         uint32_t i;
1426
1427         for (i=0; i < session->global->num_channels; i++) {
1428                 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1429
1430                 if (c->connection == conn) {
1431                         *_c = c;
1432                         return NT_STATUS_OK;
1433                 }
1434         }
1435
1436         return NT_STATUS_USER_SESSION_DELETED;
1437 }
1438
1439 NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1440                                    const struct smbXsrv_connection *conn,
1441                                    NTTIME now,
1442                                    struct smbXsrv_session_auth0 **_a)
1443 {
1444         struct smbXsrv_session_auth0 *a;
1445
1446         for (a = session->pending_auth; a != NULL; a = a->next) {
1447                 if (a->connection == conn) {
1448                         if (now != 0) {
1449                                 a->idle_time = now;
1450                         }
1451                         *_a = a;
1452                         return NT_STATUS_OK;
1453                 }
1454         }
1455
1456         return NT_STATUS_USER_SESSION_DELETED;
1457 }
1458
1459 static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1460 {
1461         if (a->session == NULL) {
1462                 return 0;
1463         }
1464
1465         DLIST_REMOVE(a->session->pending_auth, a);
1466         a->session = NULL;
1467         return 0;
1468 }
1469
1470 NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1471                                      struct smbXsrv_connection *conn,
1472                                      NTTIME now,
1473                                      uint8_t in_flags,
1474                                      uint8_t in_security_mode,
1475                                      struct smbXsrv_session_auth0 **_a)
1476 {
1477         struct smbXsrv_session_auth0 *a;
1478         NTSTATUS status;
1479
1480         status = smbXsrv_session_find_auth(session, conn, 0, &a);
1481         if (NT_STATUS_IS_OK(status)) {
1482                 return NT_STATUS_INTERNAL_ERROR;
1483         }
1484
1485         a = talloc_zero(session, struct smbXsrv_session_auth0);
1486         if (a == NULL) {
1487                 return NT_STATUS_NO_MEMORY;
1488         }
1489         a->session = session;
1490         a->connection = conn;
1491         a->in_flags = in_flags;
1492         a->in_security_mode = in_security_mode;
1493         a->creation_time = now;
1494         a->idle_time = now;
1495
1496         if (conn->protocol >= PROTOCOL_SMB3_10) {
1497                 a->preauth = talloc(a, struct smbXsrv_preauth);
1498                 if (a->preauth == NULL) {
1499                         TALLOC_FREE(session);
1500                         return NT_STATUS_NO_MEMORY;
1501                 }
1502                 *a->preauth = conn->smb2.preauth;
1503         }
1504
1505         talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1506         DLIST_ADD_END(session->pending_auth, a);
1507
1508         *_a = a;
1509         return NT_STATUS_OK;
1510 }
1511
1512 struct smb2srv_session_shutdown_state {
1513         struct tevent_queue *wait_queue;
1514 };
1515
1516 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1517
1518 struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1519                                         struct tevent_context *ev,
1520                                         struct smbXsrv_session *session,
1521                                         struct smbd_smb2_request *current_req)
1522 {
1523         struct tevent_req *req;
1524         struct smb2srv_session_shutdown_state *state;
1525         struct tevent_req *subreq;
1526         struct smbXsrv_connection *xconn = NULL;
1527         size_t len = 0;
1528
1529         /*
1530          * Make sure that no new request will be able to use this session.
1531          */
1532         session->status = NT_STATUS_USER_SESSION_DELETED;
1533
1534         req = tevent_req_create(mem_ctx, &state,
1535                                 struct smb2srv_session_shutdown_state);
1536         if (req == NULL) {
1537                 return NULL;
1538         }
1539
1540         state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1541         if (tevent_req_nomem(state->wait_queue, req)) {
1542                 return tevent_req_post(req, ev);
1543         }
1544
1545         for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1546                 struct smbd_smb2_request *preq;
1547
1548                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1549                         if (preq == current_req) {
1550                                 /* Can't cancel current request. */
1551                                 continue;
1552                         }
1553                         if (preq->session != session) {
1554                                 /* Request on different session. */
1555                                 continue;
1556                         }
1557
1558                         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1559                                 preq->session = NULL;
1560                                 /*
1561                                  * If we no longer have a session we can't
1562                                  * sign or encrypt replies.
1563                                  */
1564                                 preq->do_signing = false;
1565                                 preq->do_encryption = false;
1566                                 preq->preauth = NULL;
1567
1568                                 if (preq->subreq != NULL) {
1569                                         tevent_req_cancel(preq->subreq);
1570                                 }
1571                                 continue;
1572                         }
1573
1574                         /*
1575                          * Never cancel anything in a compound
1576                          * request. Way too hard to deal with
1577                          * the result.
1578                          */
1579                         if (!preq->compound_related && preq->subreq != NULL) {
1580                                 tevent_req_cancel(preq->subreq);
1581                         }
1582
1583                         /*
1584                          * Now wait until the request is finished.
1585                          *
1586                          * We don't set a callback, as we just want to block the
1587                          * wait queue and the talloc_free() of the request will
1588                          * remove the item from the wait queue.
1589                          */
1590                         subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1591                         if (tevent_req_nomem(subreq, req)) {
1592                                 return tevent_req_post(req, ev);
1593                         }
1594                 }
1595         }
1596
1597         len = tevent_queue_length(state->wait_queue);
1598         if (len == 0) {
1599                 tevent_req_done(req);
1600                 return tevent_req_post(req, ev);
1601         }
1602
1603         /*
1604          * Now we add our own waiter to the end of the queue,
1605          * this way we get notified when all pending requests are finished
1606          * and send to the socket.
1607          */
1608         subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1609         if (tevent_req_nomem(subreq, req)) {
1610                 return tevent_req_post(req, ev);
1611         }
1612         tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1613
1614         return req;
1615 }
1616
1617 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1618 {
1619         struct tevent_req *req =
1620                 tevent_req_callback_data(subreq,
1621                 struct tevent_req);
1622
1623         tevent_queue_wait_recv(subreq);
1624         TALLOC_FREE(subreq);
1625
1626         tevent_req_done(req);
1627 }
1628
1629 NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1630 {
1631         return tevent_req_simple_recv_ntstatus(req);
1632 }
1633
1634 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1635 {
1636         struct smbXsrv_session_table *table;
1637         struct db_record *local_rec = NULL;
1638         struct db_record *global_rec = NULL;
1639         struct smbd_server_connection *sconn = NULL;
1640         NTSTATUS status;
1641         NTSTATUS error = NT_STATUS_OK;
1642
1643         if (session->table == NULL) {
1644                 return NT_STATUS_OK;
1645         }
1646
1647         table = session->table;
1648         session->table = NULL;
1649
1650         sconn = session->client->sconn;
1651         session->client = NULL;
1652         session->status = NT_STATUS_USER_SESSION_DELETED;
1653
1654         global_rec = session->global->db_rec;
1655         session->global->db_rec = NULL;
1656         if (global_rec == NULL) {
1657                 global_rec = smbXsrv_session_global_fetch_locked(
1658                                         table->global.db_ctx,
1659                                         session->global->session_global_id,
1660                                         session->global /* TALLOC_CTX */);
1661                 if (global_rec == NULL) {
1662                         error = NT_STATUS_INTERNAL_ERROR;
1663                 }
1664         }
1665
1666         if (global_rec != NULL) {
1667                 status = dbwrap_record_delete(global_rec);
1668                 if (!NT_STATUS_IS_OK(status)) {
1669                         TDB_DATA key = dbwrap_record_get_key(global_rec);
1670
1671                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1672                                   "failed to delete global key '%s': %s\n",
1673                                   session->global->session_global_id,
1674                                   hex_encode_talloc(global_rec, key.dptr,
1675                                                     key.dsize),
1676                                   nt_errstr(status)));
1677                         error = status;
1678                 }
1679         }
1680         TALLOC_FREE(global_rec);
1681
1682         local_rec = session->db_rec;
1683         if (local_rec == NULL) {
1684                 local_rec = smbXsrv_session_local_fetch_locked(
1685                                                 table->local.db_ctx,
1686                                                 session->local_id,
1687                                                 session /* TALLOC_CTX */);
1688                 if (local_rec == NULL) {
1689                         error = NT_STATUS_INTERNAL_ERROR;
1690                 }
1691         }
1692
1693         if (local_rec != NULL) {
1694                 status = dbwrap_record_delete(local_rec);
1695                 if (!NT_STATUS_IS_OK(status)) {
1696                         TDB_DATA key = dbwrap_record_get_key(local_rec);
1697
1698                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1699                                   "failed to delete local key '%s': %s\n",
1700                                   session->global->session_global_id,
1701                                   hex_encode_talloc(local_rec, key.dptr,
1702                                                     key.dsize),
1703                                   nt_errstr(status)));
1704                         error = status;
1705                 }
1706                 table->local.num_sessions -= 1;
1707         }
1708         if (session->db_rec == NULL) {
1709                 TALLOC_FREE(local_rec);
1710         }
1711         session->db_rec = NULL;
1712
1713         if (session->compat) {
1714                 file_close_user(sconn, session->compat->vuid);
1715         }
1716
1717         if (session->tcon_table != NULL) {
1718                 /*
1719                  * Note: We only have a tcon_table for SMB2.
1720                  */
1721                 status = smb2srv_tcon_disconnect_all(session);
1722                 if (!NT_STATUS_IS_OK(status)) {
1723                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1724                                   "smb2srv_tcon_disconnect_all() failed: %s\n",
1725                                   session->global->session_global_id,
1726                                   nt_errstr(status)));
1727                         error = status;
1728                 }
1729         }
1730
1731         if (session->compat) {
1732                 invalidate_vuid(sconn, session->compat->vuid);
1733                 session->compat = NULL;
1734         }
1735
1736         return error;
1737 }
1738
1739 struct smbXsrv_session_logoff_all_state {
1740         NTSTATUS first_status;
1741         int errors;
1742 };
1743
1744 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1745                                                void *private_data);
1746
1747 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_connection *conn)
1748 {
1749         struct smbXsrv_session_table *table = conn->client->session_table;
1750         struct smbXsrv_session_logoff_all_state state;
1751         NTSTATUS status;
1752         int count = 0;
1753
1754         if (table == NULL) {
1755                 DEBUG(10, ("smbXsrv_session_logoff_all: "
1756                            "empty session_table, nothing to do.\n"));
1757                 return NT_STATUS_OK;
1758         }
1759
1760         ZERO_STRUCT(state);
1761
1762         status = dbwrap_traverse(table->local.db_ctx,
1763                                  smbXsrv_session_logoff_all_callback,
1764                                  &state, &count);
1765         if (!NT_STATUS_IS_OK(status)) {
1766                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1767                           "dbwrap_traverse() failed: %s\n",
1768                           nt_errstr(status)));
1769                 return status;
1770         }
1771
1772         if (!NT_STATUS_IS_OK(state.first_status)) {
1773                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1774                           "count[%d] errors[%d] first[%s]\n",
1775                           count, state.errors,
1776                           nt_errstr(state.first_status)));
1777                 return state.first_status;
1778         }
1779
1780         return NT_STATUS_OK;
1781 }
1782
1783 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1784                                                void *private_data)
1785 {
1786         struct smbXsrv_session_logoff_all_state *state =
1787                 (struct smbXsrv_session_logoff_all_state *)private_data;
1788         TDB_DATA val;
1789         void *ptr = NULL;
1790         struct smbXsrv_session *session = NULL;
1791         NTSTATUS status;
1792
1793         val = dbwrap_record_get_value(local_rec);
1794         if (val.dsize != sizeof(ptr)) {
1795                 status = NT_STATUS_INTERNAL_ERROR;
1796                 if (NT_STATUS_IS_OK(state->first_status)) {
1797                         state->first_status = status;
1798                 }
1799                 state->errors++;
1800                 return 0;
1801         }
1802
1803         memcpy(&ptr, val.dptr, val.dsize);
1804         session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1805
1806         session->db_rec = local_rec;
1807
1808         status = smbXsrv_session_clear_and_logoff(session);
1809         if (!NT_STATUS_IS_OK(status)) {
1810                 if (NT_STATUS_IS_OK(state->first_status)) {
1811                         state->first_status = status;
1812                 }
1813                 state->errors++;
1814                 return 0;
1815         }
1816
1817         return 0;
1818 }
1819
1820 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
1821 {
1822         /*
1823          * Allow a range from 1..65534 with 65534 values.
1824          */
1825         return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
1826                                           UINT16_MAX - 1);
1827 }
1828
1829 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
1830                                 uint16_t vuid, NTTIME now,
1831                                 struct smbXsrv_session **session)
1832 {
1833         struct smbXsrv_session_table *table = conn->client->session_table;
1834         uint32_t local_id = vuid;
1835
1836         return smbXsrv_session_local_lookup(table, conn, local_id, now,
1837                                             session);
1838 }
1839
1840 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
1841 {
1842         /*
1843          * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
1844          */
1845         return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
1846                                           UINT16_MAX - 1);
1847 }
1848
1849 static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
1850                                            /* conn: optional */
1851                                            struct smbXsrv_connection *conn,
1852                                            uint64_t session_id, NTTIME now,
1853                                            struct smbXsrv_session **session)
1854 {
1855         uint32_t local_id = session_id & UINT32_MAX;
1856         uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
1857
1858         if (local_zeros != 0) {
1859                 return NT_STATUS_USER_SESSION_DELETED;
1860         }
1861
1862         return smbXsrv_session_local_lookup(table, conn, local_id, now,
1863                                             session);
1864 }
1865
1866 NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
1867                                      uint64_t session_id, NTTIME now,
1868                                      struct smbXsrv_session **session)
1869 {
1870         struct smbXsrv_session_table *table = conn->client->session_table;
1871         return smb2srv_session_lookup_raw(table, conn, session_id, now,
1872                                           session);
1873 }
1874
1875 NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
1876                                        uint64_t session_id, NTTIME now,
1877                                        struct smbXsrv_session **session)
1878 {
1879         struct smbXsrv_session_table *table = client->session_table;
1880         return smb2srv_session_lookup_raw(table, NULL, session_id, now,
1881                                           session);
1882 }
1883
1884 struct smbXsrv_session_global_traverse_state {
1885         int (*fn)(struct smbXsrv_session_global0 *, void *);
1886         void *private_data;
1887 };
1888
1889 static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
1890 {
1891         int ret = -1;
1892         struct smbXsrv_session_global_traverse_state *state =
1893                 (struct smbXsrv_session_global_traverse_state*)data;
1894         TDB_DATA key = dbwrap_record_get_key(rec);
1895         TDB_DATA val = dbwrap_record_get_value(rec);
1896         DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
1897         struct smbXsrv_session_globalB global_blob;
1898         enum ndr_err_code ndr_err;
1899         TALLOC_CTX *frame = talloc_stackframe();
1900
1901         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
1902                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
1903         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1904                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1905                          "key '%s' ndr_pull_struct_blob - %s\n",
1906                          hex_encode_talloc(frame, key.dptr, key.dsize),
1907                          ndr_errstr(ndr_err)));
1908                 goto done;
1909         }
1910
1911         if (global_blob.version != SMBXSRV_VERSION_0) {
1912                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1913                          "key '%s' unsuported version - %d\n",
1914                          hex_encode_talloc(frame, key.dptr, key.dsize),
1915                          (int)global_blob.version));
1916                 goto done;
1917         }
1918
1919         global_blob.info.info0->db_rec = rec;
1920         ret = state->fn(global_blob.info.info0, state->private_data);
1921 done:
1922         TALLOC_FREE(frame);
1923         return ret;
1924 }
1925
1926 NTSTATUS smbXsrv_session_global_traverse(
1927                         int (*fn)(struct smbXsrv_session_global0 *, void *),
1928                         void *private_data)
1929 {
1930
1931         NTSTATUS status;
1932         int count = 0;
1933         struct smbXsrv_session_global_traverse_state state = {
1934                 .fn = fn,
1935                 .private_data = private_data,
1936         };
1937
1938         become_root();
1939         status = smbXsrv_session_global_init(NULL);
1940         if (!NT_STATUS_IS_OK(status)) {
1941                 unbecome_root();
1942                 DEBUG(0, ("Failed to initialize session_global: %s\n",
1943                           nt_errstr(status)));
1944                 return status;
1945         }
1946
1947         status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
1948                                       smbXsrv_session_global_traverse_fn,
1949                                       &state,
1950                                       &count);
1951         unbecome_root();
1952
1953         return status;
1954 }