source3/smbd/smb2_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) Jeremy Allison 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "smbprofile.h"
  29 #include "../lib/util/bitmap.h"
  30 #include "../librpc/gen_ndr/krb5pac.h"
  31 #include "auth.h"
  32
  33 #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)
  34
  35 static const char *smb2_names[] = {
  36         "SMB2_NEGPROT",
  37         "SMB2_SESSSETUP",
  38         "SMB2_LOGOFF",
  39         "SMB2_TCON",
  40         "SMB2_TDIS",
  41         "SMB2_CREATE",
  42         "SMB2_CLOSE",
  43         "SMB2_FLUSH",
  44         "SMB2_READ",
  45         "SMB2_WRITE",
  46         "SMB2_LOCK",
  47         "SMB2_IOCTL",
  48         "SMB2_CANCEL",
  49         "SMB2_KEEPALIVE",
  50         "SMB2_FIND",
  51         "SMB2_NOTIFY",
  52         "SMB2_GETINFO",
  53         "SMB2_SETINFO",
  54         "SMB2_BREAK"
  55 };
  56
  57 const char *smb2_opcode_name(uint16_t opcode)
  58 {
  59         if (opcode > 0x12) {
  60                 return "Bad SMB2 opcode";
  61         }
  62         return smb2_names[opcode];
  63 }
  64
  65 static void print_req_vectors(struct smbd_smb2_request *req)
  66 {
  67         int i;
  68
  69         for (i = 0; i < req->in.vector_count; i++) {
  70                 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
  71                         (unsigned int)i,
  72                         (unsigned int)req->in.vector[i].iov_len);
  73         }
  74         for (i = 0; i < req->out.vector_count; i++) {
  75                 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
  76                         (unsigned int)i,
  77                         (unsigned int)req->out.vector[i].iov_len);
  78         }
  79 }
  80
  81 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
  82 {
  83         if (size < (4 + SMB2_HDR_BODY)) {
  84                 return false;
  85         }
  86
  87         if (IVAL(inbuf, 4) != SMB2_MAGIC) {
  88                 return false;
  89         }
  90
  91         return true;
  92 }
  93
  94 static NTSTATUS smbd_initialize_smb2(struct smbd_server_connection *sconn)
  95 {
  96         NTSTATUS status;
  97         int ret;
  98
  99         TALLOC_FREE(sconn->smb1.fde);
 100
 101         sconn->smb2.recv_queue = tevent_queue_create(sconn, "smb2 recv queue");
 102         if (sconn->smb2.recv_queue == NULL) {
 103                 return NT_STATUS_NO_MEMORY;
 104         }
 105
 106         sconn->smb2.send_queue = tevent_queue_create(sconn, "smb2 send queue");
 107         if (sconn->smb2.send_queue == NULL) {
 108                 return NT_STATUS_NO_MEMORY;
 109         }
 110
 111         sconn->smb2.seqnum_low = 0;
 112         sconn->smb2.seqnum_range = 1;
 113         sconn->smb2.credits_granted = 1;
 114         sconn->smb2.max_credits = lp_smb2_max_credits();
 115         sconn->smb2.credits_bitmap = bitmap_talloc(sconn,
 116                                                    sconn->smb2.max_credits);
 117         if (sconn->smb2.credits_bitmap == NULL) {
 118                 return NT_STATUS_NO_MEMORY;
 119         }
 120
 121         ret = tstream_bsd_existing_socket(sconn, sconn->sock,
 122                                           &sconn->smb2.stream);
 123         if (ret == -1) {
 124                 status = map_nt_error_from_unix(errno);
 125                 return status;
 126         }
 127
 128         /* Ensure child is set to non-blocking mode */
 129         set_blocking(sconn->sock, false);
 130         return NT_STATUS_OK;
 131 }
 132
 133 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
 134 #define _smb2_setlen(_buf,len) do { \
 135         uint8_t *buf = (uint8_t *)_buf; \
 136         buf[0] = 0; \
 137         buf[1] = ((len)&0xFF0000)>>16; \
 138         buf[2] = ((len)&0xFF00)>>8; \
 139         buf[3] = (len)&0xFF; \
 140 } while (0)
 141
 142 static void smb2_setup_nbt_length(struct iovec *vector, int count)
 143 {
 144         size_t len = 0;
 145         int i;
 146
 147         for (i=1; i < count; i++) {
 148                 len += vector[i].iov_len;
 149         }
 150
 151         _smb2_setlen(vector[0].iov_base, len);
 152 }
 153
 154 static int smbd_smb2_request_parent_destructor(struct smbd_smb2_request **req)
 155 {
 156         if (*req) {
 157                 (*req)->parent = NULL;
 158                 (*req)->mem_pool = NULL;
 159         }
 160
 161         return 0;
 162 }
 163
 164 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
 165 {
 166         if (req->parent) {
 167                 *req->parent = NULL;
 168                 talloc_free(req->mem_pool);
 169         }
 170
 171         return 0;
 172 }
 173
 174 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
 175 {
 176         TALLOC_CTX *mem_pool;
 177         struct smbd_smb2_request **parent;
 178         struct smbd_smb2_request *req;
 179
 180 #if 0
 181         /* Enable this to find subtle valgrind errors. */
 182         mem_pool = talloc_init("smbd_smb2_request_allocate");
 183 #else
 184         mem_pool = talloc_pool(mem_ctx, 8192);
 185 #endif
 186         if (mem_pool == NULL) {
 187                 return NULL;
 188         }
 189
 190         parent = talloc(mem_pool, struct smbd_smb2_request *);
 191         if (parent == NULL) {
 192                 talloc_free(mem_pool);
 193                 return NULL;
 194         }
 195
 196         req = talloc_zero(parent, struct smbd_smb2_request);
 197         if (req == NULL) {
 198                 talloc_free(mem_pool);
 199                 return NULL;
 200         }
 201         *parent         = req;
 202         req->mem_pool   = mem_pool;
 203         req->parent     = parent;
 204
 205         req->last_session_id = UINT64_MAX;
 206         req->last_tid = UINT32_MAX;
 207
 208         talloc_set_destructor(parent, smbd_smb2_request_parent_destructor);
 209         talloc_set_destructor(req, smbd_smb2_request_destructor);
 210
 211         return req;
 212 }
 213
 214 static NTSTATUS smbd_smb2_request_create(struct smbd_server_connection *sconn,
 215                                          const uint8_t *inbuf, size_t size,
 216                                          struct smbd_smb2_request **_req)
 217 {
 218         struct smbd_smb2_request *req;
 219         uint32_t protocol_version;
 220         const uint8_t *inhdr = NULL;
 221         off_t ofs = 0;
 222         uint16_t cmd;
 223         uint32_t next_command_ofs;
 224
 225         if (size < (4 + SMB2_HDR_BODY + 2)) {
 226                 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
 227                 return NT_STATUS_INVALID_PARAMETER;
 228         }
 229
 230         inhdr = inbuf + 4;
 231
 232         protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
 233         if (protocol_version != SMB2_MAGIC) {
 234                 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
 235                          protocol_version));
 236                 return NT_STATUS_INVALID_PARAMETER;
 237         }
 238
 239         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 240         if (cmd != SMB2_OP_NEGPROT) {
 241                 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
 242                          cmd));
 243                 return NT_STATUS_INVALID_PARAMETER;
 244         }
 245
 246         next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
 247         if (next_command_ofs != 0) {
 248                 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
 249                          next_command_ofs));
 250                 return NT_STATUS_INVALID_PARAMETER;
 251         }
 252
 253         req = smbd_smb2_request_allocate(sconn);
 254         if (req == NULL) {
 255                 return NT_STATUS_NO_MEMORY;
 256         }
 257         req->sconn = sconn;
 258
 259         talloc_steal(req, inbuf);
 260
 261         req->in.vector = talloc_array(req, struct iovec, 4);
 262         if (req->in.vector == NULL) {
 263                 TALLOC_FREE(req);
 264                 return NT_STATUS_NO_MEMORY;
 265         }
 266         req->in.vector_count = 4;
 267
 268         memcpy(req->in.nbt_hdr, inbuf, 4);
 269
 270         ofs = 0;
 271         req->in.vector[0].iov_base      = discard_const_p(void, req->in.nbt_hdr);
 272         req->in.vector[0].iov_len       = 4;
 273         ofs += req->in.vector[0].iov_len;
 274
 275         req->in.vector[1].iov_base      = discard_const_p(void, (inbuf + ofs));
 276         req->in.vector[1].iov_len       = SMB2_HDR_BODY;
 277         ofs += req->in.vector[1].iov_len;
 278
 279         req->in.vector[2].iov_base      = discard_const_p(void, (inbuf + ofs));
 280         req->in.vector[2].iov_len       = SVAL(inbuf, ofs) & 0xFFFE;
 281         ofs += req->in.vector[2].iov_len;
 282
 283         if (ofs > size) {
 284                 return NT_STATUS_INVALID_PARAMETER;
 285         }
 286
 287         req->in.vector[3].iov_base      = discard_const_p(void, (inbuf + ofs));
 288         req->in.vector[3].iov_len       = size - ofs;
 289         ofs += req->in.vector[3].iov_len;
 290
 291         req->current_idx = 1;
 292
 293         *_req = req;
 294         return NT_STATUS_OK;
 295 }
 296
 297 static bool smb2_validate_sequence_number(struct smbd_server_connection *sconn,
 298                                           uint64_t message_id, uint64_t seq_id)
 299 {
 300         struct bitmap *credits_bm = sconn->smb2.credits_bitmap;
 301         unsigned int offset;
 302
 303         if (seq_id < sconn->smb2.seqnum_low) {
 304                 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
 305                         "%llu (sequence id %llu) "
 306                         "(granted = %u, low = %llu, range = %u)\n",
 307                         (unsigned long long)message_id,
 308                         (unsigned long long)seq_id,
 309                         (unsigned int)sconn->smb2.credits_granted,
 310                         (unsigned long long)sconn->smb2.seqnum_low,
 311                         (unsigned int)sconn->smb2.seqnum_range));
 312                 return false;
 313         }
 314
 315         if (seq_id >= sconn->smb2.seqnum_low + sconn->smb2.seqnum_range) {
 316                 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
 317                         "%llu (sequence id %llu) "
 318                         "(granted = %u, low = %llu, range = %u)\n",
 319                         (unsigned long long)message_id,
 320                         (unsigned long long)seq_id,
 321                         (unsigned int)sconn->smb2.credits_granted,
 322                         (unsigned long long)sconn->smb2.seqnum_low,
 323                         (unsigned int)sconn->smb2.seqnum_range));
 324                 return false;
 325         }
 326
 327         offset = seq_id % sconn->smb2.max_credits;
 328
 329         if (bitmap_query(credits_bm, offset)) {
 330                 DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
 331                         "%llu (sequence id %llu) "
 332                         "(granted = %u, low = %llu, range = %u) "
 333                         "(bm offset %u)\n",
 334                         (unsigned long long)message_id,
 335                         (unsigned long long)seq_id,
 336                         (unsigned int)sconn->smb2.credits_granted,
 337                         (unsigned long long)sconn->smb2.seqnum_low,
 338                         (unsigned int)sconn->smb2.seqnum_range,
 339                         offset));
 340                 return false;
 341         }
 342
 343         /* Mark the message_ids as seen in the bitmap. */
 344         bitmap_set(credits_bm, offset);
 345
 346         if (seq_id != sconn->smb2.seqnum_low) {
 347                 return true;
 348         }
 349
 350         /*
 351          * Move the window forward by all the message_id's
 352          * already seen.
 353          */
 354         while (bitmap_query(credits_bm, offset)) {
 355                 DEBUG(10,("smb2_validate_sequence_number: clearing "
 356                           "id %llu (position %u) from bitmap\n",
 357                           (unsigned long long)(sconn->smb2.seqnum_low),
 358                           offset));
 359                 bitmap_clear(credits_bm, offset);
 360
 361                 sconn->smb2.seqnum_low += 1;
 362                 sconn->smb2.seqnum_range -= 1;
 363                 offset = sconn->smb2.seqnum_low % sconn->smb2.max_credits;
 364         }
 365
 366         return true;
 367 }
 368
 369 static bool smb2_validate_message_id(struct smbd_server_connection *sconn,
 370                                 const uint8_t *inhdr)
 371 {
 372         uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
 373         uint16_t opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
 374         uint16_t credit_charge = 1;
 375         uint64_t i;
 376
 377         if (opcode == SMB2_OP_CANCEL) {
 378                 /* SMB2_CANCEL requests by definition resend messageids. */
 379                 return true;
 380         }
 381
 382         if (sconn->smb2.supports_multicredit) {
 383                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
 384                 credit_charge = MAX(credit_charge, 1);
 385         }
 386
 387         DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
 388                    "credits_granted %llu, "
 389                    "seqnum low/range: %llu/%llu\n",
 390                    (unsigned long long) message_id,
 391                    (unsigned long long) credit_charge,
 392                    (unsigned long long) sconn->smb2.credits_granted,
 393                    (unsigned long long) sconn->smb2.seqnum_low,
 394                    (unsigned long long) sconn->smb2.seqnum_range));
 395
 396         if (sconn->smb2.credits_granted < credit_charge) {
 397                 DEBUG(0, ("smb2_validate_message_id: client used more "
 398                           "credits than granted, mid %llu, charge %llu, "
 399                           "credits_granted %llu, "
 400                           "seqnum low/range: %llu/%llu\n",
 401                           (unsigned long long) message_id,
 402                           (unsigned long long) credit_charge,
 403                           (unsigned long long) sconn->smb2.credits_granted,
 404                           (unsigned long long) sconn->smb2.seqnum_low,
 405                           (unsigned long long) sconn->smb2.seqnum_range));
 406                 return false;
 407         }
 408
 409         /*
 410          * now check the message ids
 411          *
 412          * for multi-credit requests we need to check all current mid plus
 413          * the implicit mids caused by the credit charge
 414          * e.g. current mid = 15, charge 5 => mark 15-19 as used
 415          */
 416
 417         for (i = 0; i <= (credit_charge-1); i++) {
 418                 uint64_t id = message_id + i;
 419                 bool ok;
 420
 421                 DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
 422                            (unsigned long long)message_id,
 423                            credit_charge,
 424                            (unsigned long long)id));
 425
 426                 ok = smb2_validate_sequence_number(sconn, message_id, id);
 427                 if (!ok) {
 428                         return false;
 429                 }
 430         }
 431
 432         /* substract used credits */
 433         sconn->smb2.credits_granted -= credit_charge;
 434
 435         return true;
 436 }
 437
 438 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
 439 {
 440         int count;
 441         int idx;
 442
 443         count = req->in.vector_count;
 444
 445         if (count < 4) {
 446                 /* It's not a SMB2 request */
 447                 return NT_STATUS_INVALID_PARAMETER;
 448         }
 449
 450         for (idx=1; idx < count; idx += 3) {
 451                 const uint8_t *inhdr = NULL;
 452                 uint32_t flags;
 453
 454                 if (req->in.vector[idx].iov_len != SMB2_HDR_BODY) {
 455                         return NT_STATUS_INVALID_PARAMETER;
 456                 }
 457
 458                 if (req->in.vector[idx+1].iov_len < 2) {
 459                         return NT_STATUS_INVALID_PARAMETER;
 460                 }
 461
 462                 inhdr = (const uint8_t *)req->in.vector[idx].iov_base;
 463
 464                 /* Check the SMB2 header */
 465                 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
 466                         return NT_STATUS_INVALID_PARAMETER;
 467                 }
 468
 469                 if (!smb2_validate_message_id(req->sconn, inhdr)) {
 470                         return NT_STATUS_INVALID_PARAMETER;
 471                 }
 472
 473                 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
 474                 if (idx == 1) {
 475                         /*
 476                          * the 1st request should never have the
 477                          * SMB2_HDR_FLAG_CHAINED flag set
 478                          */
 479                         if (flags & SMB2_HDR_FLAG_CHAINED) {
 480                                 req->next_status = NT_STATUS_INVALID_PARAMETER;
 481                                 return NT_STATUS_OK;
 482                         }
 483                 } else if (idx == 4) {
 484                         /*
 485                          * the 2nd request triggers related vs. unrelated
 486                          * compounded requests
 487                          */
 488                         if (flags & SMB2_HDR_FLAG_CHAINED) {
 489                                 req->compound_related = true;
 490                         }
 491                 } else if (idx > 4) {
 492 #if 0
 493                         /*
 494                          * It seems the this tests are wrong
 495                          * see the SMB2-COMPOUND test
 496                          */
 497
 498                         /*
 499                          * all other requests should match the 2nd one
 500                          */
 501                         if (flags & SMB2_HDR_FLAG_CHAINED) {
 502                                 if (!req->compound_related) {
 503                                         req->next_status =
 504                                                 NT_STATUS_INVALID_PARAMETER;
 505                                         return NT_STATUS_OK;
 506                                 }
 507                         } else {
 508                                 if (req->compound_related) {
 509                                         req->next_status =
 510                                                 NT_STATUS_INVALID_PARAMETER;
 511                                         return NT_STATUS_OK;
 512                                 }
 513                         }
 514 #endif
 515                 }
 516         }
 517
 518         return NT_STATUS_OK;
 519 }
 520
 521 static void smb2_set_operation_credit(struct smbd_server_connection *sconn,
 522                         const struct iovec *in_vector,
 523                         struct iovec *out_vector)
 524 {
 525         const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
 526         uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
 527         uint16_t credits_requested;
 528         uint32_t out_flags;
 529         uint16_t cmd;
 530         NTSTATUS out_status;
 531         uint16_t credits_granted = 0;
 532         uint64_t credits_possible;
 533         uint16_t current_max_credits;
 534
 535         /*
 536          * first we grant only 1/16th of the max range.
 537          *
 538          * Windows also starts with the 1/16th and then grants
 539          * more later. I was only able to trigger higher
 540          * values, when using a verify high credit charge.
 541          *
 542          * TODO: scale up depending one load, free memory
 543          *       or other stuff.
 544          *       Maybe also on the relationship between number
 545          *       of requests and the used sequence number.
 546          *       Which means we would grant more credits
 547          *       for client which use multi credit requests.
 548          */
 549         current_max_credits = sconn->smb2.max_credits / 16;
 550         current_max_credits = MAX(current_max_credits, 1);
 551
 552         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 553         credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
 554         out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
 555         out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
 556
 557         SMB_ASSERT(sconn->smb2.max_credits >= sconn->smb2.credits_granted);
 558
 559         if (out_flags & SMB2_HDR_FLAG_ASYNC) {
 560                 /*
 561                  * In case we already send an async interim
 562                  * response, we should not grant
 563                  * credits on the final response.
 564                  */
 565                 credits_granted = 0;
 566         } else if (credits_requested > 0) {
 567                 uint16_t additional_max = 0;
 568                 uint16_t additional_credits = credits_requested - 1;
 569
 570                 switch (cmd) {
 571                 case SMB2_OP_NEGPROT:
 572                         break;
 573                 case SMB2_OP_SESSSETUP:
 574                         /*
 575                          * Windows 2012 RC1 starts to grant
 576                          * additional credits
 577                          * with a successful session setup
 578                          */
 579                         if (NT_STATUS_IS_OK(out_status)) {
 580                                 additional_max = 32;
 581                         }
 582                         break;
 583                 default:
 584                         /*
 585                          * We match windows and only grant additional credits
 586                          * in chunks of 32.
 587                          */
 588                         additional_max = 32;
 589                         break;
 590                 }
 591
 592                 additional_credits = MIN(additional_credits, additional_max);
 593
 594                 credits_granted = 1 + additional_credits;
 595         } else if (sconn->smb2.credits_granted == 0) {
 596                 /*
 597                  * Make sure the client has always at least one credit
 598                  */
 599                 credits_granted = 1;
 600         }
 601
 602         /*
 603          * sequence numbers should not wrap
 604          *
 605          * 1. calculate the possible credits until
 606          *    the sequence numbers start to wrap on 64-bit.
 607          *
 608          * 2. UINT64_MAX is used for Break Notifications.
 609          *
 610          * 2. truncate the possible credits to the maximum
 611          *    credits we want to grant to the client in total.
 612          *
 613          * 3. remove the range we'll already granted to the client
 614          *    this makes sure the client consumes the lowest sequence
 615          *    number, before we can grant additional credits.
 616          */
 617         credits_possible = UINT64_MAX - sconn->smb2.seqnum_low;
 618         if (credits_possible > 0) {
 619                 /* remove UINT64_MAX */
 620                 credits_possible -= 1;
 621         }
 622         credits_possible = MIN(credits_possible, current_max_credits);
 623         credits_possible -= sconn->smb2.seqnum_range;
 624
 625         credits_granted = MIN(credits_granted, credits_possible);
 626
 627         SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
 628         sconn->smb2.credits_granted += credits_granted;
 629         sconn->smb2.seqnum_range += credits_granted;
 630
 631         DEBUG(10,("smb2_set_operation_credit: requested %u, "
 632                 "granted %u, current possible/max %u/%u, "
 633                 "total granted/max/low/range %u/%u/%llu/%u\n",
 634                 (unsigned int)credits_requested,
 635                 (unsigned int)credits_granted,
 636                 (unsigned int)credits_possible,
 637                 (unsigned int)current_max_credits,
 638                 (unsigned int)sconn->smb2.credits_granted,
 639                 (unsigned int)sconn->smb2.max_credits,
 640                 (unsigned long long)sconn->smb2.seqnum_low,
 641                 (unsigned int)sconn->smb2.seqnum_range));
 642 }
 643
 644 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
 645                                 struct smbd_smb2_request *outreq)
 646 {
 647         int count, idx;
 648         uint16_t total_credits = 0;
 649
 650         count = outreq->out.vector_count;
 651
 652         for (idx=1; idx < count; idx += 3) {
 653                 uint8_t *outhdr = (uint8_t *)outreq->out.vector[idx].iov_base;
 654                 smb2_set_operation_credit(outreq->sconn,
 655                         &inreq->in.vector[idx],
 656                         &outreq->out.vector[idx]);
 657                 /* To match Windows, count up what we
 658                    just granted. */
 659                 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
 660                 /* Set to zero in all but the last reply. */
 661                 if (idx + 3 < count) {
 662                         SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
 663                 } else {
 664                         SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
 665                 }
 666         }
 667 }
 668
 669 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
 670 {
 671         struct iovec *vector;
 672         int count;
 673         int idx;
 674
 675         req->request_time = timeval_current();
 676
 677         count = req->in.vector_count;
 678         vector = talloc_zero_array(req, struct iovec, count);
 679         if (vector == NULL) {
 680                 return NT_STATUS_NO_MEMORY;
 681         }
 682
 683         vector[0].iov_base      = req->out.nbt_hdr;
 684         vector[0].iov_len       = 4;
 685         SIVAL(req->out.nbt_hdr, 0, 0);
 686
 687         for (idx=1; idx < count; idx += 3) {
 688                 const uint8_t *inhdr = NULL;
 689                 uint8_t *outhdr = NULL;
 690                 uint8_t *outbody = NULL;
 691                 uint32_t next_command_ofs = 0;
 692                 struct iovec *current = &vector[idx];
 693
 694                 if ((idx + 3) < count) {
 695                         /* we have a next command -
 696                          * setup for the error case. */
 697                         next_command_ofs = SMB2_HDR_BODY + 9;
 698                 }
 699
 700                 inhdr = (const uint8_t *)req->in.vector[idx].iov_base;
 701
 702                 outhdr = talloc_zero_array(vector, uint8_t,
 703                                       OUTVEC_ALLOC_SIZE);
 704                 if (outhdr == NULL) {
 705                         return NT_STATUS_NO_MEMORY;
 706                 }
 707
 708                 outbody = outhdr + SMB2_HDR_BODY;
 709
 710                 current[0].iov_base     = (void *)outhdr;
 711                 current[0].iov_len      = SMB2_HDR_BODY;
 712
 713                 current[1].iov_base     = (void *)outbody;
 714                 current[1].iov_len      = 8;
 715
 716                 current[2].iov_base     = NULL;
 717                 current[2].iov_len      = 0;
 718
 719                 /* setup the SMB2 header */
 720                 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID,     SMB2_MAGIC);
 721                 SSVAL(outhdr, SMB2_HDR_LENGTH,          SMB2_HDR_BODY);
 722                 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
 723                       SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
 724                 SIVAL(outhdr, SMB2_HDR_STATUS,
 725                       NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
 726                 SSVAL(outhdr, SMB2_HDR_OPCODE,
 727                       SVAL(inhdr, SMB2_HDR_OPCODE));
 728                 SIVAL(outhdr, SMB2_HDR_FLAGS,
 729                       IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
 730                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND,    next_command_ofs);
 731                 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
 732                       BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
 733                 SIVAL(outhdr, SMB2_HDR_PID,
 734                       IVAL(inhdr, SMB2_HDR_PID));
 735                 SIVAL(outhdr, SMB2_HDR_TID,
 736                       IVAL(inhdr, SMB2_HDR_TID));
 737                 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
 738                       BVAL(inhdr, SMB2_HDR_SESSION_ID));
 739                 memcpy(outhdr + SMB2_HDR_SIGNATURE,
 740                        inhdr + SMB2_HDR_SIGNATURE, 16);
 741
 742                 /* setup error body header */
 743                 SSVAL(outbody, 0x00, 0x08 + 1);
 744                 SSVAL(outbody, 0x02, 0);
 745                 SIVAL(outbody, 0x04, 0);
 746         }
 747
 748         req->out.vector = vector;
 749         req->out.vector_count = count;
 750
 751         /* setup the length of the NBT packet */
 752         smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
 753
 754         DLIST_ADD_END(req->sconn->smb2.requests, req, struct smbd_smb2_request *);
 755
 756         return NT_STATUS_OK;
 757 }
 758
 759 void smbd_server_connection_terminate_ex(struct smbd_server_connection *sconn,
 760                                          const char *reason,
 761                                          const char *location)
 762 {
 763         DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
 764                   reason, location));
 765         exit_server_cleanly(reason);
 766 }
 767
 768 static bool dup_smb2_vec3(TALLOC_CTX *ctx,
 769                         struct iovec *outvec,
 770                         const struct iovec *srcvec)
 771 {
 772         /* vec[0] is always boilerplate and must
 773          * be allocated with size OUTVEC_ALLOC_SIZE. */
 774
 775         outvec[0].iov_base = talloc_memdup(ctx,
 776                                 srcvec[0].iov_base,
 777                                 OUTVEC_ALLOC_SIZE);
 778         if (!outvec[0].iov_base) {
 779                 return false;
 780         }
 781         outvec[0].iov_len = SMB2_HDR_BODY;
 782
 783         /*
 784          * If this is a "standard" vec[1] of length 8,
 785          * pointing to srcvec[0].iov_base + SMB2_HDR_BODY,
 786          * then duplicate this. Else use talloc_memdup().
 787          */
 788
 789         if (srcvec[1].iov_len == 8 &&
 790                         srcvec[1].iov_base ==
 791                                 ((uint8_t *)srcvec[0].iov_base) +
 792                                         SMB2_HDR_BODY) {
 793                 outvec[1].iov_base = ((uint8_t *)outvec[0].iov_base) +
 794                                         SMB2_HDR_BODY;
 795                 outvec[1].iov_len = 8;
 796         } else {
 797                 outvec[1].iov_base = talloc_memdup(ctx,
 798                                 srcvec[1].iov_base,
 799                                 srcvec[1].iov_len);
 800                 if (!outvec[1].iov_base) {
 801                         return false;
 802                 }
 803                 outvec[1].iov_len = srcvec[1].iov_len;
 804         }
 805
 806         /*
 807          * If this is a "standard" vec[2] of length 1,
 808          * pointing to srcvec[0].iov_base + (OUTVEC_ALLOC_SIZE - 1)
 809          * then duplicate this. Else use talloc_memdup().
 810          */
 811
 812         if (srcvec[2].iov_base &&
 813                         srcvec[2].iov_len) {
 814                 if (srcvec[2].iov_base ==
 815                                 ((uint8_t *)srcvec[0].iov_base) +
 816                                         (OUTVEC_ALLOC_SIZE - 1) &&
 817                                 srcvec[2].iov_len == 1) {
 818                         /* Common SMB2 error packet case. */
 819                         outvec[2].iov_base = ((uint8_t *)outvec[0].iov_base) +
 820                                 (OUTVEC_ALLOC_SIZE - 1);
 821                 } else {
 822                         outvec[2].iov_base = talloc_memdup(ctx,
 823                                         srcvec[2].iov_base,
 824                                         srcvec[2].iov_len);
 825                         if (!outvec[2].iov_base) {
 826                                 return false;
 827                         }
 828                 }
 829                 outvec[2].iov_len = srcvec[2].iov_len;
 830         } else {
 831                 outvec[2].iov_base = NULL;
 832                 outvec[2].iov_len = 0;
 833         }
 834         return true;
 835 }
 836
 837 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
 838 {
 839         struct smbd_smb2_request *newreq = NULL;
 840         struct iovec *outvec = NULL;
 841         int count = req->out.vector_count;
 842         int i;
 843
 844         newreq = smbd_smb2_request_allocate(req->sconn);
 845         if (!newreq) {
 846                 return NULL;
 847         }
 848
 849         newreq->sconn = req->sconn;
 850         newreq->session = req->session;
 851         newreq->do_signing = req->do_signing;
 852         newreq->current_idx = req->current_idx;
 853
 854         outvec = talloc_zero_array(newreq, struct iovec, count);
 855         if (!outvec) {
 856                 TALLOC_FREE(newreq);
 857                 return NULL;
 858         }
 859         newreq->out.vector = outvec;
 860         newreq->out.vector_count = count;
 861
 862         /* Setup the outvec's identically to req. */
 863         outvec[0].iov_base = newreq->out.nbt_hdr;
 864         outvec[0].iov_len = 4;
 865         memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
 866
 867         /* Setup the vectors identically to the ones in req. */
 868         for (i = 1; i < count; i += 3) {
 869                 if (!dup_smb2_vec3(outvec, &outvec[i], &req->out.vector[i])) {
 870                         break;
 871                 }
 872         }
 873
 874         if (i < count) {
 875                 /* Alloc failed. */
 876                 TALLOC_FREE(newreq);
 877                 return NULL;
 878         }
 879
 880         smb2_setup_nbt_length(newreq->out.vector,
 881                 newreq->out.vector_count);
 882
 883         return newreq;
 884 }
 885
 886 static void smbd_smb2_request_writev_done(struct tevent_req *subreq);
 887
 888 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
 889 {
 890         int i = 0;
 891         uint8_t *outhdr = NULL;
 892         struct smbd_smb2_request *nreq = NULL;
 893
 894         /* Create a new smb2 request we'll use
 895            for the interim return. */
 896         nreq = dup_smb2_req(req);
 897         if (!nreq) {
 898                 return NT_STATUS_NO_MEMORY;
 899         }
 900
 901         /* Lose the last 3 out vectors. They're the
 902            ones we'll be using for the async reply. */
 903         nreq->out.vector_count -= 3;
 904
 905         smb2_setup_nbt_length(nreq->out.vector,
 906                 nreq->out.vector_count);
 907
 908         /* Step back to the previous reply. */
 909         i = nreq->current_idx - 3;
 910         outhdr = (uint8_t *)nreq->out.vector[i].iov_base;
 911         /* And end the chain. */
 912         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
 913
 914         /* Calculate outgoing credits */
 915         smb2_calculate_credits(req, nreq);
 916
 917         /* Re-sign if needed. */
 918         if (nreq->do_signing) {
 919                 NTSTATUS status;
 920                 struct smbXsrv_session *x = nreq->session;
 921                 struct smbXsrv_connection *conn = x->connection;
 922                 DATA_BLOB signing_key = x->global->channels[0].signing_key;
 923
 924                 status = smb2_signing_sign_pdu(signing_key,
 925                                                conn->protocol,
 926                                                &nreq->out.vector[i], 3);
 927                 if (!NT_STATUS_IS_OK(status)) {
 928                         return status;
 929                 }
 930         }
 931         if (DEBUGLEVEL >= 10) {
 932                 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
 933                         (unsigned int)nreq->current_idx );
 934                 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
 935                         (unsigned int)nreq->out.vector_count );
 936                 print_req_vectors(nreq);
 937         }
 938         nreq->subreq = tstream_writev_queue_send(nreq,
 939                                         nreq->sconn->ev_ctx,
 940                                         nreq->sconn->smb2.stream,
 941                                         nreq->sconn->smb2.send_queue,
 942                                         nreq->out.vector,
 943                                         nreq->out.vector_count);
 944
 945         if (nreq->subreq == NULL) {
 946                 return NT_STATUS_NO_MEMORY;
 947         }
 948
 949         tevent_req_set_callback(nreq->subreq,
 950                         smbd_smb2_request_writev_done,
 951                         nreq);
 952
 953         return NT_STATUS_OK;
 954 }
 955
 956 struct smbd_smb2_request_pending_state {
 957         struct smbd_server_connection *sconn;
 958         uint8_t buf[4 + SMB2_HDR_BODY + 0x08 + 1];
 959         struct iovec vector[3];
 960 };
 961
 962 static void smbd_smb2_request_pending_writev_done(struct tevent_req *subreq)
 963 {
 964         struct smbd_smb2_request_pending_state *state =
 965                 tevent_req_callback_data(subreq,
 966                         struct smbd_smb2_request_pending_state);
 967         struct smbd_server_connection *sconn = state->sconn;
 968         int ret;
 969         int sys_errno;
 970
 971         ret = tstream_writev_queue_recv(subreq, &sys_errno);
 972         TALLOC_FREE(subreq);
 973         if (ret == -1) {
 974                 NTSTATUS status = map_nt_error_from_unix(sys_errno);
 975                 smbd_server_connection_terminate(sconn, nt_errstr(status));
 976                 return;
 977         }
 978
 979         TALLOC_FREE(state);
 980 }
 981
 982 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
 983                                             struct tevent_timer *te,
 984                                             struct timeval current_time,
 985                                             void *private_data);
 986
 987 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
 988                                          struct tevent_req *subreq,
 989                                          uint32_t defer_time)
 990 {
 991         NTSTATUS status;
 992         int i = req->current_idx;
 993         struct timeval defer_endtime;
 994         uint8_t *outhdr = NULL;
 995         uint32_t flags;
 996
 997         if (!tevent_req_is_in_progress(subreq)) {
 998                 return NT_STATUS_OK;
 999         }
1000
1001         req->subreq = subreq;
1002         subreq = NULL;
1003
1004         if (req->async_te) {
1005                 /* We're already async. */
1006                 return NT_STATUS_OK;
1007         }
1008
1009         outhdr = (uint8_t *)req->out.vector[i].iov_base;
1010         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1011         if (flags & SMB2_HDR_FLAG_ASYNC) {
1012                 /* We're already async. */
1013                 return NT_STATUS_OK;
1014         }
1015
1016         if (req->in.vector_count > i + 3) {
1017                 /*
1018                  * We're trying to go async in a compound
1019                  * request chain. This is not allowed.
1020                  * Cancel the outstanding request.
1021                  */
1022                 tevent_req_cancel(req->subreq);
1023                 return smbd_smb2_request_error(req,
1024                         NT_STATUS_INSUFFICIENT_RESOURCES);
1025         }
1026
1027         if (DEBUGLEVEL >= 10) {
1028                 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
1029                         (unsigned int)req->current_idx );
1030                 print_req_vectors(req);
1031         }
1032
1033         if (req->out.vector_count > 4) {
1034                 struct iovec *outvec = NULL;
1035
1036                 /* This is a compound reply. We
1037                  * must do an interim response
1038                  * followed by the async response
1039                  * to match W2K8R2.
1040                  */
1041                 status = smb2_send_async_interim_response(req);
1042                 if (!NT_STATUS_IS_OK(status)) {
1043                         return status;
1044                 }
1045
1046                 /*
1047                  * We're splitting off the last SMB2
1048                  * request in a compound set, and the
1049                  * smb2_send_async_interim_response()
1050                  * call above just sent all the replies
1051                  * for the previous SMB2 requests in
1052                  * this compound set. So we're no longer
1053                  * in the "compound_related_in_progress"
1054                  * state, and this is no longer a compound
1055                  * request.
1056                  */
1057                 req->compound_related = false;
1058                 req->sconn->smb2.compound_related_in_progress = false;
1059
1060                 /* Re-arrange the in.vectors. */
1061                 req->in.vector[1] = req->in.vector[i];
1062                 req->in.vector[2] = req->in.vector[i+1];
1063                 req->in.vector[3] = req->in.vector[i+2];
1064                 req->in.vector_count = 4;
1065
1066                 /* Reset the new in size. */
1067                 smb2_setup_nbt_length(req->in.vector, 4);
1068
1069                 /* Now recreate the out.vectors. */
1070                 outvec = talloc_zero_array(req, struct iovec, 4);
1071                 if (!outvec) {
1072                         return NT_STATUS_NO_MEMORY;
1073                 }
1074
1075                 /* 0 is always boilerplate and must
1076                  * be of size 4 for the length field. */
1077
1078                 outvec[0].iov_base = req->out.nbt_hdr;
1079                 outvec[0].iov_len = 4;
1080                 SIVAL(req->out.nbt_hdr, 0, 0);
1081
1082                 if (!dup_smb2_vec3(outvec, &outvec[1], &req->out.vector[i])) {
1083                         return NT_STATUS_NO_MEMORY;
1084                 }
1085
1086                 TALLOC_FREE(req->out.vector);
1087
1088                 req->out.vector = outvec;
1089
1090                 req->current_idx = 1;
1091                 req->out.vector_count = 4;
1092
1093                 outhdr = (uint8_t *)req->out.vector[1].iov_base;
1094                 flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
1095                 SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
1096         }
1097
1098         defer_endtime = timeval_current_ofs_usec(defer_time);
1099         req->async_te = tevent_add_timer(req->sconn->ev_ctx,
1100                                          req, defer_endtime,
1101                                          smbd_smb2_request_pending_timer,
1102                                          req);
1103         if (req->async_te == NULL) {
1104                 return NT_STATUS_NO_MEMORY;
1105         }
1106
1107         return NT_STATUS_OK;
1108 }
1109
1110 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1111                                             struct tevent_timer *te,
1112                                             struct timeval current_time,
1113                                             void *private_data)
1114 {
1115         struct smbd_smb2_request *req =
1116                 talloc_get_type_abort(private_data,
1117                 struct smbd_smb2_request);
1118         struct smbd_smb2_request_pending_state *state = NULL;
1119         int i = req->current_idx;
1120         uint8_t *outhdr = NULL;
1121         const uint8_t *inhdr = NULL;
1122         uint8_t *hdr = NULL;
1123         uint8_t *body = NULL;
1124         uint32_t flags = 0;
1125         uint64_t message_id = 0;
1126         uint64_t async_id = 0;
1127         struct tevent_req *subreq = NULL;
1128
1129         TALLOC_FREE(req->async_te);
1130
1131         /* Ensure our final reply matches the interim one. */
1132         inhdr = (const uint8_t *)req->in.vector[1].iov_base;
1133         outhdr = (uint8_t *)req->out.vector[1].iov_base;
1134         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1135         message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1136
1137         async_id = message_id; /* keep it simple for now... */
1138
1139         SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1140         SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
1141
1142         DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1143                 "going async\n",
1144                 smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
1145                 (unsigned long long)async_id ));
1146
1147         /*
1148          * What we send is identical to a smbd_smb2_request_error
1149          * packet with an error status of STATUS_PENDING. Make use
1150          * of this fact sometime when refactoring. JRA.
1151          */
1152
1153         state = talloc_zero(req->sconn, struct smbd_smb2_request_pending_state);
1154         if (state == NULL) {
1155                 smbd_server_connection_terminate(req->sconn,
1156                                                  nt_errstr(NT_STATUS_NO_MEMORY));
1157                 return;
1158         }
1159         state->sconn = req->sconn;
1160
1161         state->vector[0].iov_base = (void *)state->buf;
1162         state->vector[0].iov_len = 4;
1163
1164         state->vector[1].iov_base = state->buf + 4;
1165         state->vector[1].iov_len = SMB2_HDR_BODY;
1166
1167         state->vector[2].iov_base = state->buf + 4 + SMB2_HDR_BODY;
1168         state->vector[2].iov_len = 9;
1169
1170         smb2_setup_nbt_length(state->vector, 3);
1171
1172         hdr = (uint8_t *)state->vector[1].iov_base;
1173         body = (uint8_t *)state->vector[2].iov_base;
1174
1175         SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1176         SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1177         SSVAL(hdr, SMB2_HDR_EPOCH, 0);
1178         SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
1179         SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
1180
1181         SIVAL(hdr, SMB2_HDR_FLAGS, flags);
1182         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
1183         SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
1184         SBVAL(hdr, SMB2_HDR_PID, async_id);
1185         SBVAL(hdr, SMB2_HDR_SESSION_ID,
1186                 BVAL(outhdr, SMB2_HDR_SESSION_ID));
1187         memcpy(hdr+SMB2_HDR_SIGNATURE,
1188                outhdr+SMB2_HDR_SIGNATURE, 16);
1189
1190         SSVAL(body, 0x00, 0x08 + 1);
1191
1192         SCVAL(body, 0x02, 0);
1193         SCVAL(body, 0x03, 0);
1194         SIVAL(body, 0x04, 0);
1195         /* Match W2K8R2... */
1196         SCVAL(body, 0x08, 0x21);
1197
1198         /* Ensure we correctly go through crediting. Grant
1199            the credits now, and zero credits on the final
1200            response. */
1201         smb2_set_operation_credit(req->sconn,
1202                         &req->in.vector[i],
1203                         &state->vector[1]);
1204
1205         SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1206
1207         if (req->do_signing) {
1208                 NTSTATUS status;
1209                 struct smbXsrv_session *x = req->session;
1210                 struct smbXsrv_connection *conn = x->connection;
1211                 DATA_BLOB signing_key = x->global->channels[0].signing_key;
1212
1213                 status = smb2_signing_sign_pdu(signing_key,
1214                                                conn->protocol,
1215                                                &state->vector[1], 2);
1216                 if (!NT_STATUS_IS_OK(status)) {
1217                         smbd_server_connection_terminate(req->sconn,
1218                                                 nt_errstr(status));
1219                         return;
1220                 }
1221         }
1222
1223         subreq = tstream_writev_queue_send(state,
1224                                         state->sconn->ev_ctx,
1225                                         state->sconn->smb2.stream,
1226                                         state->sconn->smb2.send_queue,
1227                                         state->vector,
1228                                         3);
1229         if (subreq == NULL) {
1230                 smbd_server_connection_terminate(state->sconn,
1231                                                  nt_errstr(NT_STATUS_NO_MEMORY));
1232                 return;
1233         }
1234         tevent_req_set_callback(subreq,
1235                         smbd_smb2_request_pending_writev_done,
1236                         state);
1237 }
1238
1239 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
1240 {
1241         struct smbd_server_connection *sconn = req->sconn;
1242         struct smbd_smb2_request *cur;
1243         const uint8_t *inhdr;
1244         int i = req->current_idx;
1245         uint32_t flags;
1246         uint64_t search_message_id;
1247         uint64_t search_async_id;
1248         uint64_t found_id;
1249
1250         inhdr = (const uint8_t *)req->in.vector[i].iov_base;
1251
1252         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1253         search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1254         search_async_id = BVAL(inhdr, SMB2_HDR_PID);
1255
1256         /*
1257          * we don't need the request anymore
1258          * cancel requests never have a response
1259          */
1260         DLIST_REMOVE(req->sconn->smb2.requests, req);
1261         TALLOC_FREE(req);
1262
1263         for (cur = sconn->smb2.requests; cur; cur = cur->next) {
1264                 const uint8_t *outhdr;
1265                 uint64_t message_id;
1266                 uint64_t async_id;
1267
1268                 i = cur->current_idx;
1269
1270                 outhdr = (const uint8_t *)cur->out.vector[i].iov_base;
1271
1272                 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1273                 async_id = BVAL(outhdr, SMB2_HDR_PID);
1274
1275                 if (flags & SMB2_HDR_FLAG_ASYNC) {
1276                         if (search_async_id == async_id) {
1277                                 found_id = async_id;
1278                                 break;
1279                         }
1280                 } else {
1281                         if (search_message_id == message_id) {
1282                                 found_id = message_id;
1283                                 break;
1284                         }
1285                 }
1286         }
1287
1288         if (cur && cur->subreq) {
1289                 inhdr = (const uint8_t *)cur->in.vector[i].iov_base;
1290                 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1291                         "cancel opcode[%s] mid %llu\n",
1292                         smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
1293                         (unsigned long long)found_id ));
1294                 tevent_req_cancel(cur->subreq);
1295         }
1296
1297         return NT_STATUS_OK;
1298 }
1299
1300 /*************************************************************
1301  Ensure an incoming tid is a valid one for us to access.
1302  Change to the associated uid credentials and chdir to the
1303  valid tid directory.
1304 *************************************************************/
1305
1306 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
1307 {
1308         const uint8_t *inhdr;
1309         int i = req->current_idx;
1310         uint32_t in_flags;
1311         uint32_t in_tid;
1312         struct smbXsrv_tcon0 *tcon;
1313         NTSTATUS status;
1314         NTTIME now = timeval_to_nttime(&req->request_time);
1315
1316         req->tcon = NULL;
1317
1318         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
1319
1320         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1321         in_tid = IVAL(inhdr, SMB2_HDR_TID);
1322
1323         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1324                 in_tid = req->last_tid;
1325         }
1326
1327         status = smb2srv_tcon_lookup(req->session,
1328                                      in_tid, now, &tcon);
1329         if (!NT_STATUS_IS_OK(status)) {
1330                 return status;
1331         }
1332
1333         if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
1334                 return NT_STATUS_ACCESS_DENIED;
1335         }
1336
1337         /* should we pass FLAG_CASELESS_PATHNAMES here? */
1338         if (!set_current_service(tcon->compat, 0, true)) {
1339                 return NT_STATUS_ACCESS_DENIED;
1340         }
1341
1342         req->tcon = tcon;
1343         req->last_tid = in_tid;
1344
1345         return NT_STATUS_OK;
1346 }
1347
1348 /*************************************************************
1349  Ensure an incoming session_id is a valid one for us to access.
1350 *************************************************************/
1351
1352 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
1353 {
1354         const uint8_t *inhdr;
1355         int i = req->current_idx;
1356         uint32_t in_flags;
1357         uint16_t in_opcode;
1358         uint64_t in_session_id;
1359         struct smbXsrv_session *session = NULL;
1360         struct auth_session_info *session_info;
1361         NTSTATUS status;
1362         NTTIME now = timeval_to_nttime(&req->request_time);
1363
1364         req->session = NULL;
1365         req->tcon = NULL;
1366
1367         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
1368
1369         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1370         in_opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
1371         in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
1372
1373         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1374                 in_session_id = req->last_session_id;
1375         }
1376
1377         /* lookup an existing session */
1378         status = smb2srv_session_lookup(req->sconn->conn,
1379                                         in_session_id, now,
1380                                         &session);
1381         if (session) {
1382                 req->session = session;
1383                 req->last_session_id = in_session_id;
1384         }
1385         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1386                 switch (in_opcode) {
1387                 case SMB2_OP_SESSSETUP:
1388                         status = NT_STATUS_OK;
1389                         break;
1390                 default:
1391                         break;
1392                 }
1393         }
1394         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1395                 switch (in_opcode) {
1396                 case SMB2_OP_TCON:
1397                 case SMB2_OP_CREATE:
1398                 case SMB2_OP_GETINFO:
1399                 case SMB2_OP_SETINFO:
1400                         return NT_STATUS_INVALID_HANDLE;
1401                 default:
1402                         /*
1403                          * Notice the check for
1404                          * (session_info == NULL)
1405                          * below.
1406                          */
1407                         status = NT_STATUS_OK;
1408                         break;
1409                 }
1410         }
1411         if (!NT_STATUS_IS_OK(status)) {
1412                 return status;
1413         }
1414
1415         session_info = session->global->auth_session_info;
1416         if (session_info == NULL) {
1417                 return NT_STATUS_INVALID_HANDLE;
1418         }
1419
1420         set_current_user_info(session_info->unix_info->sanitized_username,
1421                               session_info->unix_info->unix_name,
1422                               session_info->info->domain_name);
1423
1424         return NT_STATUS_OK;
1425 }
1426
1427 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
1428                                                 uint32_t data_length)
1429 {
1430         uint16_t needed_charge;
1431         uint16_t credit_charge;
1432         const uint8_t *inhdr;
1433         int i = req->current_idx;
1434
1435         if (!req->sconn->smb2.supports_multicredit) {
1436                 if (data_length > 65536) {
1437                         return NT_STATUS_INVALID_PARAMETER;
1438                 }
1439                 return NT_STATUS_OK;
1440         }
1441
1442         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
1443         credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
1444
1445         /* requests larger than 64 KB need credit charge */
1446         if (credit_charge == 0 && data_length > 65536) {
1447                 DEBUG(2, ("Request larger than 64KB w/o creditcharge\n"));
1448                 return NT_STATUS_INVALID_PARAMETER;
1449         }
1450
1451         needed_charge = (data_length - 1)/ 65536 + 1;
1452
1453         DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
1454                    (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
1455                    credit_charge, needed_charge));
1456
1457         if (needed_charge > credit_charge) {
1458                 DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
1459                                         credit_charge, needed_charge));
1460                 return NT_STATUS_INVALID_PARAMETER;
1461         }
1462
1463         return NT_STATUS_OK;
1464 }
1465
1466 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
1467                                         size_t expected_body_size)
1468 {
1469         const uint8_t *inhdr;
1470         uint16_t opcode;
1471         const uint8_t *inbody;
1472         int i = req->current_idx;
1473         size_t body_size;
1474         size_t min_dyn_size = expected_body_size & 0x00000001;
1475
1476         /*
1477          * The following should be checked already.
1478          */
1479         if ((i+2) > req->in.vector_count) {
1480                 return NT_STATUS_INTERNAL_ERROR;
1481         }
1482         if (req->in.vector[i+0].iov_len != SMB2_HDR_BODY) {
1483                 return NT_STATUS_INTERNAL_ERROR;
1484         }
1485         if (req->in.vector[i+1].iov_len < 2) {
1486                 return NT_STATUS_INTERNAL_ERROR;
1487         }
1488
1489         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
1490         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1491
1492         switch (opcode) {
1493         case SMB2_OP_IOCTL:
1494         case SMB2_OP_GETINFO:
1495                 min_dyn_size = 0;
1496                 break;
1497         }
1498
1499         /*
1500          * Now check the expected body size,
1501          * where the last byte might be in the
1502          * dynamic section..
1503          */
1504         if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
1505                 return NT_STATUS_INVALID_PARAMETER;
1506         }
1507         if (req->in.vector[i+2].iov_len < min_dyn_size) {
1508                 return NT_STATUS_INVALID_PARAMETER;
1509         }
1510
1511         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
1512
1513         body_size = SVAL(inbody, 0x00);
1514         if (body_size != expected_body_size) {
1515                 return NT_STATUS_INVALID_PARAMETER;
1516         }
1517
1518         return NT_STATUS_OK;
1519 }
1520
1521 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
1522 {
1523         const uint8_t *inhdr;
1524         int i = req->current_idx;
1525         uint16_t opcode;
1526         uint32_t flags;
1527         uint64_t mid;
1528         NTSTATUS status;
1529         NTSTATUS session_status;
1530         uint32_t allowed_flags;
1531         NTSTATUS return_value;
1532         struct smbXsrv_session *x = NULL;
1533         bool signing_required = false;
1534
1535         inhdr = (const uint8_t *)req->in.vector[i].iov_base;
1536
1537         /* TODO: verify more things */
1538
1539         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1540         opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
1541         mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1542         DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
1543                 smb2_opcode_name(opcode),
1544                 (unsigned long long)mid));
1545
1546         if (get_Protocol() >= PROTOCOL_SMB2_02) {
1547                 /*
1548                  * once the protocol is negotiated
1549                  * SMB2_OP_NEGPROT is not allowed anymore
1550                  */
1551                 if (opcode == SMB2_OP_NEGPROT) {
1552                         /* drop the connection */
1553                         return NT_STATUS_INVALID_PARAMETER;
1554                 }
1555         } else {
1556                 /*
1557                  * if the protocol is not negotiated yet
1558                  * only SMB2_OP_NEGPROT is allowed.
1559                  */
1560                 if (opcode != SMB2_OP_NEGPROT) {
1561                         /* drop the connection */
1562                         return NT_STATUS_INVALID_PARAMETER;
1563                 }
1564         }
1565
1566         allowed_flags = SMB2_HDR_FLAG_CHAINED |
1567                         SMB2_HDR_FLAG_SIGNED |
1568                         SMB2_HDR_FLAG_DFS;
1569         if (opcode == SMB2_OP_CANCEL) {
1570                 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
1571         }
1572         if ((flags & ~allowed_flags) != 0) {
1573                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
1574         }
1575
1576         /*
1577          * Check if the client provided a valid session id,
1578          * if so smbd_smb2_request_check_session() calls
1579          * set_current_user_info().
1580          *
1581          * As some command don't require a valid session id
1582          * we defer the check of the session_status
1583          */
1584         session_status = smbd_smb2_request_check_session(req);
1585         x = req->session;
1586
1587         if (x != NULL) {
1588                 signing_required = x->global->signing_required;
1589
1590                 if (opcode == SMB2_OP_SESSSETUP &&
1591                     x->global->channels[0].signing_key.length) {
1592                         signing_required = true;
1593                 }
1594         }
1595
1596         req->do_signing = false;
1597         if (flags & SMB2_HDR_FLAG_SIGNED) {
1598                 struct smbXsrv_connection *conn = x->connection;
1599                 DATA_BLOB signing_key = x->global->channels[0].signing_key;
1600
1601                 if (!NT_STATUS_IS_OK(session_status)) {
1602                         return smbd_smb2_request_error(req, session_status);
1603                 }
1604
1605                 req->do_signing = true;
1606                 status = smb2_signing_check_pdu(signing_key,
1607                                                 conn->protocol,
1608                                                 &req->in.vector[i], 3);
1609                 if (!NT_STATUS_IS_OK(status)) {
1610                         return smbd_smb2_request_error(req, status);
1611                 }
1612         } else if (opcode == SMB2_OP_CANCEL) {
1613                 /* Cancel requests are allowed to skip the signing */
1614         } else if (signing_required) {
1615                 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
1616         }
1617
1618         if (flags & SMB2_HDR_FLAG_CHAINED) {
1619                 /*
1620                  * This check is mostly for giving the correct error code
1621                  * for compounded requests.
1622                  *
1623                  * TODO: we may need to move this after the session
1624                  *       and tcon checks.
1625                  */
1626                 if (!NT_STATUS_IS_OK(req->next_status)) {
1627                         return smbd_smb2_request_error(req, req->next_status);
1628                 }
1629         } else {
1630                 req->compat_chain_fsp = NULL;
1631         }
1632
1633         if (req->compound_related) {
1634                 req->sconn->smb2.compound_related_in_progress = true;
1635         }
1636
1637         switch (opcode) {
1638         case SMB2_OP_NEGPROT:
1639                 /* This call needs to be run as root */
1640                 change_to_root_user();
1641
1642                 {
1643                         START_PROFILE(smb2_negprot);
1644                         return_value = smbd_smb2_request_process_negprot(req);
1645                         END_PROFILE(smb2_negprot);
1646                 }
1647                 break;
1648
1649         case SMB2_OP_SESSSETUP:
1650                 /* This call needs to be run as root */
1651                 change_to_root_user();
1652
1653                 {
1654                         START_PROFILE(smb2_sesssetup);
1655                         return_value = smbd_smb2_request_process_sesssetup(req);
1656                         END_PROFILE(smb2_sesssetup);
1657                 }
1658                 break;
1659
1660         case SMB2_OP_LOGOFF:
1661                 if (!NT_STATUS_IS_OK(session_status)) {
1662                         return_value = smbd_smb2_request_error(req, session_status);
1663                         break;
1664                 }
1665
1666                 /* This call needs to be run as root */
1667                 change_to_root_user();
1668
1669                 {
1670                         START_PROFILE(smb2_logoff);
1671                         return_value = smbd_smb2_request_process_logoff(req);
1672                         END_PROFILE(smb2_logoff);
1673                 }
1674                 break;
1675
1676         case SMB2_OP_TCON:
1677                 if (!NT_STATUS_IS_OK(session_status)) {
1678                         return_value = smbd_smb2_request_error(req, session_status);
1679                         break;
1680                 }
1681
1682                 /*
1683                  * This call needs to be run as root.
1684                  *
1685                  * smbd_smb2_request_process_tcon()
1686                  * calls make_connection_snum(), which will call
1687                  * change_to_user(), when needed.
1688                  */
1689                 change_to_root_user();
1690
1691                 {
1692                         START_PROFILE(smb2_tcon);
1693                         return_value = smbd_smb2_request_process_tcon(req);
1694                         END_PROFILE(smb2_tcon);
1695                 }
1696                 break;
1697
1698         case SMB2_OP_TDIS:
1699                 if (!NT_STATUS_IS_OK(session_status)) {
1700                         return_value = smbd_smb2_request_error(req, session_status);
1701                         break;
1702                 }
1703                 /*
1704                  * This call needs to be run as user.
1705                  *
1706                  * smbd_smb2_request_check_tcon()
1707                  * calls change_to_user() on success.
1708                  */
1709                 status = smbd_smb2_request_check_tcon(req);
1710                 if (!NT_STATUS_IS_OK(status)) {
1711                         return_value = smbd_smb2_request_error(req, status);
1712                         break;
1713                 }
1714                 /* This call needs to be run as root */
1715                 change_to_root_user();
1716
1717
1718                 {
1719                         START_PROFILE(smb2_tdis);
1720                         return_value = smbd_smb2_request_process_tdis(req);
1721                         END_PROFILE(smb2_tdis);
1722                 }
1723                 break;
1724
1725         case SMB2_OP_CREATE:
1726                 if (!NT_STATUS_IS_OK(session_status)) {
1727                         return_value = smbd_smb2_request_error(req, session_status);
1728                         break;
1729                 }
1730                 /*
1731                  * This call needs to be run as user.
1732                  *
1733                  * smbd_smb2_request_check_tcon()
1734                  * calls change_to_user() on success.
1735                  */
1736                 status = smbd_smb2_request_check_tcon(req);
1737                 if (!NT_STATUS_IS_OK(status)) {
1738                         return_value = smbd_smb2_request_error(req, status);
1739                         break;
1740                 }
1741
1742                 {
1743                         START_PROFILE(smb2_create);
1744                         return_value = smbd_smb2_request_process_create(req);
1745                         END_PROFILE(smb2_create);
1746                 }
1747                 break;
1748
1749         case SMB2_OP_CLOSE:
1750                 if (!NT_STATUS_IS_OK(session_status)) {
1751                         return_value = smbd_smb2_request_error(req, session_status);
1752                         break;
1753                 }
1754                 /*
1755                  * This call needs to be run as user.
1756                  *
1757                  * smbd_smb2_request_check_tcon()
1758                  * calls change_to_user() on success.
1759                  */
1760                 status = smbd_smb2_request_check_tcon(req);
1761                 if (!NT_STATUS_IS_OK(status)) {
1762                         return_value = smbd_smb2_request_error(req, status);
1763                         break;
1764                 }
1765
1766                 {
1767                         START_PROFILE(smb2_close);
1768                         return_value = smbd_smb2_request_process_close(req);
1769                         END_PROFILE(smb2_close);
1770                 }
1771                 break;
1772
1773         case SMB2_OP_FLUSH:
1774                 if (!NT_STATUS_IS_OK(session_status)) {
1775                         return_value = smbd_smb2_request_error(req, session_status);
1776                         break;
1777                 }
1778                 /*
1779                  * This call needs to be run as user.
1780                  *
1781                  * smbd_smb2_request_check_tcon()
1782                  * calls change_to_user() on success.
1783                  */
1784                 status = smbd_smb2_request_check_tcon(req);
1785                 if (!NT_STATUS_IS_OK(status)) {
1786                         return_value = smbd_smb2_request_error(req, status);
1787                         break;
1788                 }
1789
1790                 {
1791                         START_PROFILE(smb2_flush);
1792                         return_value = smbd_smb2_request_process_flush(req);
1793                         END_PROFILE(smb2_flush);
1794                 }
1795                 break;
1796
1797         case SMB2_OP_READ:
1798                 if (!NT_STATUS_IS_OK(session_status)) {
1799                         return_value = smbd_smb2_request_error(req, session_status);
1800                         break;
1801                 }
1802                 /*
1803                  * This call needs to be run as user.
1804                  *
1805                  * smbd_smb2_request_check_tcon()
1806                  * calls change_to_user() on success.
1807                  */
1808                 status = smbd_smb2_request_check_tcon(req);
1809                 if (!NT_STATUS_IS_OK(status)) {
1810                         return_value = smbd_smb2_request_error(req, status);
1811                         break;
1812                 }
1813
1814                 {
1815                         START_PROFILE(smb2_read);
1816                         return_value = smbd_smb2_request_process_read(req);
1817                         END_PROFILE(smb2_read);
1818                 }
1819                 break;
1820
1821         case SMB2_OP_WRITE:
1822                 if (!NT_STATUS_IS_OK(session_status)) {
1823                         return_value = smbd_smb2_request_error(req, session_status);
1824                         break;
1825                 }
1826                 /*
1827                  * This call needs to be run as user.
1828                  *
1829                  * smbd_smb2_request_check_tcon()
1830                  * calls change_to_user() on success.
1831                  */
1832                 status = smbd_smb2_request_check_tcon(req);
1833                 if (!NT_STATUS_IS_OK(status)) {
1834                         return_value = smbd_smb2_request_error(req, status);
1835                         break;
1836                 }
1837
1838                 {
1839                         START_PROFILE(smb2_write);
1840                         return_value = smbd_smb2_request_process_write(req);
1841                         END_PROFILE(smb2_write);
1842                 }
1843                 break;
1844
1845         case SMB2_OP_LOCK:
1846                 if (!NT_STATUS_IS_OK(session_status)) {
1847                         /* Too ugly to live ? JRA. */
1848                         if (NT_STATUS_EQUAL(session_status,NT_STATUS_USER_SESSION_DELETED)) {
1849                                 session_status = NT_STATUS_FILE_CLOSED;
1850                         }
1851                         return_value = smbd_smb2_request_error(req, session_status);
1852                         break;
1853                 }
1854                 /*
1855                  * This call needs to be run as user.
1856                  *
1857                  * smbd_smb2_request_check_tcon()
1858                  * calls change_to_user() on success.
1859                  */
1860                 status = smbd_smb2_request_check_tcon(req);
1861                 if (!NT_STATUS_IS_OK(status)) {
1862                         /* Too ugly to live ? JRA. */
1863                         if (NT_STATUS_EQUAL(status,NT_STATUS_NETWORK_NAME_DELETED)) {
1864                                 status = NT_STATUS_FILE_CLOSED;
1865                         }
1866                         return_value = smbd_smb2_request_error(req, status);
1867                         break;
1868                 }
1869
1870                 {
1871                         START_PROFILE(smb2_lock);
1872                         return_value = smbd_smb2_request_process_lock(req);
1873                         END_PROFILE(smb2_lock);
1874                 }
1875                 break;
1876
1877         case SMB2_OP_IOCTL:
1878                 if (!NT_STATUS_IS_OK(session_status)) {
1879                         return_value = smbd_smb2_request_error(req, session_status);
1880                         break;
1881                 }
1882                 /*
1883                  * This call needs to be run as user.
1884                  *
1885                  * smbd_smb2_request_check_tcon()
1886                  * calls change_to_user() on success.
1887                  */
1888                 status = smbd_smb2_request_check_tcon(req);
1889                 if (!NT_STATUS_IS_OK(status)) {
1890                         return_value = smbd_smb2_request_error(req, status);
1891                         break;
1892                 }
1893
1894                 {
1895                         START_PROFILE(smb2_ioctl);
1896                         return_value = smbd_smb2_request_process_ioctl(req);
1897                         END_PROFILE(smb2_ioctl);
1898                 }
1899                 break;
1900
1901         case SMB2_OP_CANCEL:
1902                 /*
1903                  * This call needs to be run as root
1904                  *
1905                  * That is what we also do in the SMB1 case.
1906                  */
1907                 change_to_root_user();
1908
1909                 {
1910                         START_PROFILE(smb2_cancel);
1911                         return_value = smbd_smb2_request_process_cancel(req);
1912                         END_PROFILE(smb2_cancel);
1913                 }
1914                 break;
1915
1916         case SMB2_OP_KEEPALIVE:
1917                 /* This call needs to be run as root */
1918                 change_to_root_user();
1919
1920                 {
1921                         START_PROFILE(smb2_keepalive);
1922                         return_value = smbd_smb2_request_process_keepalive(req);
1923                         END_PROFILE(smb2_keepalive);
1924                 }
1925                 break;
1926
1927         case SMB2_OP_FIND:
1928                 if (!NT_STATUS_IS_OK(session_status)) {
1929                         return_value = smbd_smb2_request_error(req, session_status);
1930                         break;
1931                 }
1932                 /*
1933                  * This call needs to be run as user.
1934                  *
1935                  * smbd_smb2_request_check_tcon()
1936                  * calls change_to_user() on success.
1937                  */
1938                 status = smbd_smb2_request_check_tcon(req);
1939                 if (!NT_STATUS_IS_OK(status)) {
1940                         return_value = smbd_smb2_request_error(req, status);
1941                         break;
1942                 }
1943
1944                 {
1945                         START_PROFILE(smb2_find);
1946                         return_value = smbd_smb2_request_process_find(req);
1947                         END_PROFILE(smb2_find);
1948                 }
1949                 break;
1950
1951         case SMB2_OP_NOTIFY:
1952                 if (!NT_STATUS_IS_OK(session_status)) {
1953                         return_value = smbd_smb2_request_error(req, session_status);
1954                         break;
1955                 }
1956                 /*
1957                  * This call needs to be run as user.
1958                  *
1959                  * smbd_smb2_request_check_tcon()
1960                  * calls change_to_user() on success.
1961                  */
1962                 status = smbd_smb2_request_check_tcon(req);
1963                 if (!NT_STATUS_IS_OK(status)) {
1964                         return_value = smbd_smb2_request_error(req, status);
1965                         break;
1966                 }
1967
1968                 {
1969                         START_PROFILE(smb2_notify);
1970                         return_value = smbd_smb2_request_process_notify(req);
1971                         END_PROFILE(smb2_notify);
1972                 }
1973                 break;
1974
1975         case SMB2_OP_GETINFO:
1976                 if (!NT_STATUS_IS_OK(session_status)) {
1977                         return_value = smbd_smb2_request_error(req, session_status);
1978                         break;
1979                 }
1980                 /*
1981                  * This call needs to be run as user.
1982                  *
1983                  * smbd_smb2_request_check_tcon()
1984                  * calls change_to_user() on success.
1985                  */
1986                 status = smbd_smb2_request_check_tcon(req);
1987                 if (!NT_STATUS_IS_OK(status)) {
1988                         return_value = smbd_smb2_request_error(req, status);
1989                         break;
1990                 }
1991
1992                 {
1993                         START_PROFILE(smb2_getinfo);
1994                         return_value = smbd_smb2_request_process_getinfo(req);
1995                         END_PROFILE(smb2_getinfo);
1996                 }
1997                 break;
1998
1999         case SMB2_OP_SETINFO:
2000                 if (!NT_STATUS_IS_OK(session_status)) {
2001                         return_value = smbd_smb2_request_error(req, session_status);
2002                         break;
2003                 }
2004                 /*
2005                  * This call needs to be run as user.
2006                  *
2007                  * smbd_smb2_request_check_tcon()
2008                  * calls change_to_user() on success.
2009                  */
2010                 status = smbd_smb2_request_check_tcon(req);
2011                 if (!NT_STATUS_IS_OK(status)) {
2012                         return_value = smbd_smb2_request_error(req, status);
2013                         break;
2014                 }
2015
2016                 {
2017                         START_PROFILE(smb2_setinfo);
2018                         return_value = smbd_smb2_request_process_setinfo(req);
2019                         END_PROFILE(smb2_setinfo);
2020                 }
2021                 break;
2022
2023         case SMB2_OP_BREAK:
2024                 if (!NT_STATUS_IS_OK(session_status)) {
2025                         return_value = smbd_smb2_request_error(req, session_status);
2026                         break;
2027                 }
2028                 /*
2029                  * This call needs to be run as user.
2030                  *
2031                  * smbd_smb2_request_check_tcon()
2032                  * calls change_to_user() on success.
2033                  */
2034                 status = smbd_smb2_request_check_tcon(req);
2035                 if (!NT_STATUS_IS_OK(status)) {
2036                         return_value = smbd_smb2_request_error(req, status);
2037                         break;
2038                 }
2039
2040                 {
2041                         START_PROFILE(smb2_break);
2042                         return_value = smbd_smb2_request_process_break(req);
2043                         END_PROFILE(smb2_break);
2044                 }
2045                 break;
2046
2047         default:
2048                 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2049                 break;
2050         }
2051         return return_value;
2052 }
2053
2054 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
2055 {
2056         struct tevent_req *subreq;
2057         int i = req->current_idx;
2058
2059         req->subreq = NULL;
2060         TALLOC_FREE(req->async_te);
2061
2062         req->current_idx += 3;
2063
2064         if (req->current_idx < req->out.vector_count) {
2065                 /*
2066                  * We must process the remaining compound
2067                  * SMB2 requests before any new incoming SMB2
2068                  * requests. This is because incoming SMB2
2069                  * requests may include a cancel for a
2070                  * compound request we haven't processed
2071                  * yet.
2072                  */
2073                 struct tevent_immediate *im = tevent_create_immediate(req);
2074                 if (!im) {
2075                         return NT_STATUS_NO_MEMORY;
2076                 }
2077                 tevent_schedule_immediate(im,
2078                                         req->sconn->ev_ctx,
2079                                         smbd_smb2_request_dispatch_immediate,
2080                                         req);
2081                 return NT_STATUS_OK;
2082         }
2083
2084         if (req->compound_related) {
2085                 req->sconn->smb2.compound_related_in_progress = false;
2086         }
2087
2088         smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
2089
2090         /* Set credit for these operations (zero credits if this
2091            is a final reply for an async operation). */
2092         smb2_calculate_credits(req, req);
2093
2094         if (req->do_signing) {
2095                 NTSTATUS status;
2096                 struct smbXsrv_session *x = req->session;
2097                 struct smbXsrv_connection *conn = x->connection;
2098                 DATA_BLOB signing_key = x->global->channels[0].signing_key;
2099
2100                 status = smb2_signing_sign_pdu(signing_key,
2101                                                conn->protocol,
2102                                                &req->out.vector[i], 3);
2103                 if (!NT_STATUS_IS_OK(status)) {
2104                         return status;
2105                 }
2106         }
2107
2108         if (DEBUGLEVEL >= 10) {
2109                 dbgtext("smbd_smb2_request_reply: sending...\n");
2110                 print_req_vectors(req);
2111         }
2112
2113         /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
2114         if (req->out.vector_count == 4 &&
2115                         req->out.vector[3].iov_base == NULL &&
2116                         req->out.vector[3].iov_len != 0) {
2117                 /* Dynamic part is NULL. Chop it off,
2118                    We're going to send it via sendfile. */
2119                 req->out.vector_count -= 1;
2120         }
2121
2122         subreq = tstream_writev_queue_send(req,
2123                                            req->sconn->ev_ctx,
2124                                            req->sconn->smb2.stream,
2125                                            req->sconn->smb2.send_queue,
2126                                            req->out.vector,
2127                                            req->out.vector_count);
2128         if (subreq == NULL) {
2129                 return NT_STATUS_NO_MEMORY;
2130         }
2131         tevent_req_set_callback(subreq, smbd_smb2_request_writev_done, req);
2132         /*
2133          * We're done with this request -
2134          * move it off the "being processed" queue.
2135          */
2136         DLIST_REMOVE(req->sconn->smb2.requests, req);
2137
2138         return NT_STATUS_OK;
2139 }
2140
2141 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn);
2142
2143 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
2144                                         struct tevent_immediate *im,
2145                                         void *private_data)
2146 {
2147         struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
2148                                         struct smbd_smb2_request);
2149         struct smbd_server_connection *sconn = req->sconn;
2150         NTSTATUS status;
2151
2152         TALLOC_FREE(im);
2153
2154         if (DEBUGLEVEL >= 10) {
2155                 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
2156                         req->current_idx, req->in.vector_count));
2157                 print_req_vectors(req);
2158         }
2159
2160         status = smbd_smb2_request_dispatch(req);
2161         if (!NT_STATUS_IS_OK(status)) {
2162                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2163                 return;
2164         }
2165
2166         status = smbd_smb2_request_next_incoming(sconn);
2167         if (!NT_STATUS_IS_OK(status)) {
2168                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2169                 return;
2170         }
2171 }
2172
2173 static void smbd_smb2_request_writev_done(struct tevent_req *subreq)
2174 {
2175         struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
2176                                         struct smbd_smb2_request);
2177         struct smbd_server_connection *sconn = req->sconn;
2178         int ret;
2179         int sys_errno;
2180         NTSTATUS status;
2181
2182         ret = tstream_writev_queue_recv(subreq, &sys_errno);
2183         TALLOC_FREE(subreq);
2184         TALLOC_FREE(req);
2185         if (ret == -1) {
2186                 status = map_nt_error_from_unix(sys_errno);
2187                 DEBUG(2,("smbd_smb2_request_writev_done: client write error %s\n",
2188                         nt_errstr(status)));
2189                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2190                 return;
2191         }
2192
2193         status = smbd_smb2_request_next_incoming(sconn);
2194         if (!NT_STATUS_IS_OK(status)) {
2195                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2196                 return;
2197         }
2198 }
2199
2200 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
2201                                    NTSTATUS status,
2202                                    DATA_BLOB body, DATA_BLOB *dyn,
2203                                    const char *location)
2204 {
2205         uint8_t *outhdr;
2206         int i = req->current_idx;
2207         uint32_t next_command_ofs;
2208
2209         DEBUG(10,("smbd_smb2_request_done_ex: "
2210                   "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
2211                   i, nt_errstr(status), (unsigned int)body.length,
2212                   dyn ? "yes": "no",
2213                   (unsigned int)(dyn ? dyn->length : 0),
2214                   location));
2215
2216         if (body.length < 2) {
2217                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2218         }
2219
2220         if ((body.length % 2) != 0) {
2221                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2222         }
2223
2224         outhdr = (uint8_t *)req->out.vector[i].iov_base;
2225
2226         next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
2227         SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
2228
2229         req->out.vector[i+1].iov_base = (void *)body.data;
2230         req->out.vector[i+1].iov_len = body.length;
2231
2232         if (dyn) {
2233                 req->out.vector[i+2].iov_base   = (void *)dyn->data;
2234                 req->out.vector[i+2].iov_len    = dyn->length;
2235         } else {
2236                 req->out.vector[i+2].iov_base = NULL;
2237                 req->out.vector[i+2].iov_len = 0;
2238         }
2239
2240         /* see if we need to recalculate the offset to the next response */
2241         if (next_command_ofs > 0) {
2242                 next_command_ofs  = SMB2_HDR_BODY;
2243                 next_command_ofs += req->out.vector[i+1].iov_len;
2244                 next_command_ofs += req->out.vector[i+2].iov_len;
2245         }
2246
2247         if ((next_command_ofs % 8) != 0) {
2248                 size_t pad_size = 8 - (next_command_ofs % 8);
2249                 if (req->out.vector[i+2].iov_len == 0) {
2250                         /*
2251                          * if the dyn buffer is empty
2252                          * we can use it to add padding
2253                          */
2254                         uint8_t *pad;
2255
2256                         pad = talloc_zero_array(req->out.vector,
2257                                                 uint8_t, pad_size);
2258                         if (pad == NULL) {
2259                                 return smbd_smb2_request_error(req,
2260                                                 NT_STATUS_NO_MEMORY);
2261                         }
2262
2263                         req->out.vector[i+2].iov_base = (void *)pad;
2264                         req->out.vector[i+2].iov_len = pad_size;
2265                 } else {
2266                         /*
2267                          * For now we copy the dynamic buffer
2268                          * and add the padding to the new buffer
2269                          */
2270                         size_t old_size;
2271                         uint8_t *old_dyn;
2272                         size_t new_size;
2273                         uint8_t *new_dyn;
2274
2275                         old_size = req->out.vector[i+2].iov_len;
2276                         old_dyn = (uint8_t *)req->out.vector[i+2].iov_base;
2277
2278                         new_size = old_size + pad_size;
2279                         new_dyn = talloc_zero_array(req->out.vector,
2280                                                uint8_t, new_size);
2281                         if (new_dyn == NULL) {
2282                                 return smbd_smb2_request_error(req,
2283                                                 NT_STATUS_NO_MEMORY);
2284                         }
2285
2286                         memcpy(new_dyn, old_dyn, old_size);
2287                         memset(new_dyn + old_size, 0, pad_size);
2288
2289                         req->out.vector[i+2].iov_base = (void *)new_dyn;
2290                         req->out.vector[i+2].iov_len = new_size;
2291                 }
2292                 next_command_ofs += pad_size;
2293         }
2294
2295         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
2296
2297         return smbd_smb2_request_reply(req);
2298 }
2299
2300 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
2301                                     NTSTATUS status,
2302                                     DATA_BLOB *info,
2303                                     const char *location)
2304 {
2305         DATA_BLOB body;
2306         int i = req->current_idx;
2307         uint8_t *outhdr = (uint8_t *)req->out.vector[i].iov_base;
2308
2309         DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
2310                   i, nt_errstr(status), info ? " +info" : "",
2311                   location));
2312
2313         body.data = outhdr + SMB2_HDR_BODY;
2314         body.length = 8;
2315         SSVAL(body.data, 0, 9);
2316
2317         if (info) {
2318                 SIVAL(body.data, 0x04, info->length);
2319         } else {
2320                 /* Allocated size of req->out.vector[i].iov_base
2321                  * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
2322                  * 1 byte without having to do an alloc.
2323                  */
2324                 info = talloc_zero_array(req->out.vector,
2325                                         DATA_BLOB,
2326                                         1);
2327                 if (!info) {
2328                         return NT_STATUS_NO_MEMORY;
2329                 }
2330                 info->data = ((uint8_t *)outhdr) +
2331                         OUTVEC_ALLOC_SIZE - 1;
2332                 info->length = 1;
2333                 SCVAL(info->data, 0, 0);
2334         }
2335
2336         /*
2337          * if a request fails, all other remaining
2338          * compounded requests should fail too
2339          */
2340         req->next_status = NT_STATUS_INVALID_PARAMETER;
2341
2342         return smbd_smb2_request_done_ex(req, status, body, info, __location__);
2343 }
2344
2345
2346 struct smbd_smb2_send_oplock_break_state {
2347         struct smbd_server_connection *sconn;
2348         uint8_t buf[4 + SMB2_HDR_BODY + 0x18];
2349         struct iovec vector;
2350 };
2351
2352 static void smbd_smb2_oplock_break_writev_done(struct tevent_req *subreq);
2353
2354 NTSTATUS smbd_smb2_send_oplock_break(struct smbd_server_connection *sconn,
2355                                      uint64_t file_id_persistent,
2356                                      uint64_t file_id_volatile,
2357                                      uint8_t oplock_level)
2358 {
2359         struct smbd_smb2_send_oplock_break_state *state;
2360         struct tevent_req *subreq;
2361         uint8_t *hdr;
2362         uint8_t *body;
2363
2364         state = talloc(sconn, struct smbd_smb2_send_oplock_break_state);
2365         if (state == NULL) {
2366                 return NT_STATUS_NO_MEMORY;
2367         }
2368         state->sconn = sconn;
2369
2370         state->vector.iov_base = (void *)state->buf;
2371         state->vector.iov_len = sizeof(state->buf);
2372
2373         _smb2_setlen(state->buf, sizeof(state->buf) - 4);
2374         hdr = state->buf + 4;
2375         body = hdr + SMB2_HDR_BODY;
2376
2377         SIVAL(hdr, 0,                           SMB2_MAGIC);
2378         SSVAL(hdr, SMB2_HDR_LENGTH,             SMB2_HDR_BODY);
2379         SSVAL(hdr, SMB2_HDR_EPOCH,              0);
2380         SIVAL(hdr, SMB2_HDR_STATUS,             0);
2381         SSVAL(hdr, SMB2_HDR_OPCODE,             SMB2_OP_BREAK);
2382         SSVAL(hdr, SMB2_HDR_CREDIT,             0);
2383         SIVAL(hdr, SMB2_HDR_FLAGS,              SMB2_HDR_FLAG_REDIRECT);
2384         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND,       0);
2385         SBVAL(hdr, SMB2_HDR_MESSAGE_ID,         UINT64_MAX);
2386         SIVAL(hdr, SMB2_HDR_PID,                0);
2387         SIVAL(hdr, SMB2_HDR_TID,                0);
2388         SBVAL(hdr, SMB2_HDR_SESSION_ID,         0);
2389         memset(hdr+SMB2_HDR_SIGNATURE, 0, 16);
2390
2391         SSVAL(body, 0x00, 0x18);
2392
2393         SCVAL(body, 0x02, oplock_level);
2394         SCVAL(body, 0x03, 0);           /* reserved */
2395         SIVAL(body, 0x04, 0);           /* reserved */
2396         SBVAL(body, 0x08, file_id_persistent);
2397         SBVAL(body, 0x10, file_id_volatile);
2398
2399         subreq = tstream_writev_queue_send(state,
2400                                            sconn->ev_ctx,
2401                                            sconn->smb2.stream,
2402                                            sconn->smb2.send_queue,
2403                                            &state->vector, 1);
2404         if (subreq == NULL) {
2405                 return NT_STATUS_NO_MEMORY;
2406         }
2407         tevent_req_set_callback(subreq,
2408                                 smbd_smb2_oplock_break_writev_done,
2409                                 state);
2410
2411         return NT_STATUS_OK;
2412 }
2413
2414 static void smbd_smb2_oplock_break_writev_done(struct tevent_req *subreq)
2415 {
2416         struct smbd_smb2_send_oplock_break_state *state =
2417                 tevent_req_callback_data(subreq,
2418                 struct smbd_smb2_send_oplock_break_state);
2419         struct smbd_server_connection *sconn = state->sconn;
2420         int ret;
2421         int sys_errno;
2422
2423         ret = tstream_writev_queue_recv(subreq, &sys_errno);
2424         TALLOC_FREE(subreq);
2425         if (ret == -1) {
2426                 NTSTATUS status = map_nt_error_from_unix(sys_errno);
2427                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2428                 return;
2429         }
2430
2431         TALLOC_FREE(state);
2432 }
2433
2434 struct smbd_smb2_request_read_state {
2435         size_t missing;
2436         bool asked_for_header;
2437         struct smbd_smb2_request *smb2_req;
2438 };
2439
2440 static int smbd_smb2_request_next_vector(struct tstream_context *stream,
2441                                          void *private_data,
2442                                          TALLOC_CTX *mem_ctx,
2443                                          struct iovec **_vector,
2444                                          size_t *_count);
2445 static void smbd_smb2_request_read_done(struct tevent_req *subreq);
2446
2447 static struct tevent_req *smbd_smb2_request_read_send(TALLOC_CTX *mem_ctx,
2448                                         struct tevent_context *ev,
2449                                         struct smbd_server_connection *sconn)
2450 {
2451         struct tevent_req *req;
2452         struct smbd_smb2_request_read_state *state;
2453         struct tevent_req *subreq;
2454
2455         req = tevent_req_create(mem_ctx, &state,
2456                                 struct smbd_smb2_request_read_state);
2457         if (req == NULL) {
2458                 return NULL;
2459         }
2460         state->missing = 0;
2461         state->asked_for_header = false;
2462
2463         state->smb2_req = smbd_smb2_request_allocate(state);
2464         if (tevent_req_nomem(state->smb2_req, req)) {
2465                 return tevent_req_post(req, ev);
2466         }
2467         state->smb2_req->sconn = sconn;
2468
2469         subreq = tstream_readv_pdu_queue_send(state, ev, sconn->smb2.stream,
2470                                               sconn->smb2.recv_queue,
2471                                               smbd_smb2_request_next_vector,
2472                                               state);
2473         if (tevent_req_nomem(subreq, req)) {
2474                 return tevent_req_post(req, ev);
2475         }
2476         tevent_req_set_callback(subreq, smbd_smb2_request_read_done, req);
2477
2478         return req;
2479 }
2480
2481 static int smbd_smb2_request_next_vector(struct tstream_context *stream,
2482                                          void *private_data,
2483                                          TALLOC_CTX *mem_ctx,
2484                                          struct iovec **_vector,
2485                                          size_t *_count)
2486 {
2487         struct smbd_smb2_request_read_state *state =
2488                 talloc_get_type_abort(private_data,
2489                 struct smbd_smb2_request_read_state);
2490         struct smbd_smb2_request *req = state->smb2_req;
2491         struct iovec *vector;
2492         int idx = req->in.vector_count;
2493         size_t len = 0;
2494         uint8_t *buf = NULL;
2495
2496         if (req->in.vector_count == 0) {
2497                 /*
2498                  * first we need to get the NBT header
2499                  */
2500                 req->in.vector = talloc_array(req, struct iovec,
2501                                               req->in.vector_count + 1);
2502                 if (req->in.vector == NULL) {
2503                         return -1;
2504                 }
2505                 req->in.vector_count += 1;
2506
2507                 req->in.vector[idx].iov_base    = (void *)req->in.nbt_hdr;
2508                 req->in.vector[idx].iov_len     = 4;
2509
2510                 vector = talloc_array(mem_ctx, struct iovec, 1);
2511                 if (vector == NULL) {
2512                         return -1;
2513                 }
2514
2515                 vector[0] = req->in.vector[idx];
2516
2517                 *_vector = vector;
2518                 *_count = 1;
2519                 return 0;
2520         }
2521
2522         if (req->in.vector_count == 1) {
2523                 /*
2524                  * Now we analyze the NBT header
2525                  */
2526                 state->missing = smb2_len(req->in.vector[0].iov_base);
2527
2528                 if (state->missing == 0) {
2529                         /* if there're no remaining bytes, we're done */
2530                         *_vector = NULL;
2531                         *_count = 0;
2532                         return 0;
2533                 }
2534
2535                 req->in.vector = talloc_realloc(req, req->in.vector,
2536                                                 struct iovec,
2537                                                 req->in.vector_count + 1);
2538                 if (req->in.vector == NULL) {
2539                         return -1;
2540                 }
2541                 req->in.vector_count += 1;
2542
2543                 if (CVAL(req->in.vector[0].iov_base, 0) != 0) {
2544                         /*
2545                          * it's a special NBT message,
2546                          * so get all remaining bytes
2547                          */
2548                         len = state->missing;
2549                 } else if (state->missing < (SMB2_HDR_BODY + 2)) {
2550                         /*
2551                          * it's an invalid message, just read what we can get
2552                          * and let the caller handle the error
2553                          */
2554                         len = state->missing;
2555                 } else {
2556                         /*
2557                          * We assume it's a SMB2 request,
2558                          * and we first get the header and the
2559                          * first 2 bytes (the struct size) of the body
2560                          */
2561                         len = SMB2_HDR_BODY + 2;
2562
2563                         state->asked_for_header = true;
2564                 }
2565
2566                 state->missing -= len;
2567
2568                 buf = talloc_array(req->in.vector, uint8_t, len);
2569                 if (buf == NULL) {
2570                         return -1;
2571                 }
2572
2573                 req->in.vector[idx].iov_base    = (void *)buf;
2574                 req->in.vector[idx].iov_len     = len;
2575
2576                 vector = talloc_array(mem_ctx, struct iovec, 1);
2577                 if (vector == NULL) {
2578                         return -1;
2579                 }
2580
2581                 vector[0] = req->in.vector[idx];
2582
2583                 *_vector = vector;
2584                 *_count = 1;
2585                 return 0;
2586         }
2587
2588         if (state->missing == 0) {
2589                 /* if there're no remaining bytes, we're done */
2590                 *_vector = NULL;
2591                 *_count = 0;
2592                 return 0;
2593         }
2594
2595         if (state->asked_for_header) {
2596                 const uint8_t *hdr;
2597                 size_t full_size;
2598                 size_t next_command_ofs;
2599                 size_t body_size;
2600                 uint8_t *body;
2601                 size_t dyn_size;
2602                 uint8_t *dyn;
2603                 bool invalid = false;
2604
2605                 state->asked_for_header = false;
2606
2607                 /*
2608                  * We got the SMB2 header and the first 2 bytes
2609                  * of the body. We fix the size to just the header
2610                  * and manually copy the 2 first bytes to the body section
2611                  */
2612                 req->in.vector[idx-1].iov_len = SMB2_HDR_BODY;
2613                 hdr = (const uint8_t *)req->in.vector[idx-1].iov_base;
2614
2615                 /* allocate vectors for body and dynamic areas */
2616                 req->in.vector = talloc_realloc(req, req->in.vector,
2617                                                 struct iovec,
2618                                                 req->in.vector_count + 2);
2619                 if (req->in.vector == NULL) {
2620                         return -1;
2621                 }
2622                 req->in.vector_count += 2;
2623
2624                 full_size = state->missing + SMB2_HDR_BODY + 2;
2625                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
2626                 body_size = SVAL(hdr, SMB2_HDR_BODY);
2627
2628                 if (next_command_ofs != 0) {
2629                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
2630                                 /*
2631                                  * this is invalid, just return a zero
2632                                  * body and let the caller deal with the error
2633                                  */
2634                                 invalid = true;
2635                         } else if (next_command_ofs > full_size) {
2636                                 /*
2637                                  * this is invalid, just return a zero
2638                                  * body and let the caller deal with the error
2639                                  */
2640                                 invalid = true;
2641                         } else {
2642                                 full_size = next_command_ofs;
2643                         }
2644                 }
2645
2646                 if (!invalid) {
2647                         if (body_size < 2) {
2648                                 /*
2649                                  * this is invalid, just return a zero
2650                                  * body and let the caller deal with the error
2651                                  */
2652                                 invalid = true;
2653                         }
2654
2655                         /*
2656                          * Mask out the lowest bit, the "dynamic" part
2657                          * of body_size.
2658                          */
2659                         body_size &= ~1;
2660
2661                         if (body_size > (full_size - SMB2_HDR_BODY)) {
2662                                 /*
2663                                  * this is invalid, just return a zero
2664                                  * body and let the caller deal with the error
2665                                  */
2666                                 invalid = true;
2667                         }
2668                 }
2669
2670                 if (invalid) {
2671                         /* the caller should check this */
2672                         body_size = 2;
2673                 }
2674
2675                 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
2676
2677                 state->missing -= (body_size - 2) + dyn_size;
2678
2679                 body = talloc_array(req->in.vector, uint8_t, body_size);
2680                 if (body == NULL) {
2681                         return -1;
2682                 }
2683
2684                 dyn = talloc_array(req->in.vector, uint8_t, dyn_size);
2685                 if (dyn == NULL) {
2686                         return -1;
2687                 }
2688
2689                 req->in.vector[idx].iov_base    = (void *)body;
2690                 req->in.vector[idx].iov_len     = body_size;
2691                 req->in.vector[idx+1].iov_base  = (void *)dyn;
2692                 req->in.vector[idx+1].iov_len   = dyn_size;
2693
2694                 vector = talloc_array(mem_ctx, struct iovec, 2);
2695                 if (vector == NULL) {
2696                         return -1;
2697                 }
2698
2699                 /*
2700                  * the first 2 bytes of the body were already fetched
2701                  * together with the header
2702                  */
2703                 memcpy(body, hdr + SMB2_HDR_BODY, 2);
2704                 vector[0].iov_base = body + 2;
2705                 vector[0].iov_len = body_size - 2;
2706
2707                 vector[1] = req->in.vector[idx+1];
2708
2709                 *_vector = vector;
2710                 *_count = 2;
2711                 return 0;
2712         }
2713
2714         /*
2715          * when we endup here, we're looking for a new SMB2 request
2716          * next. And we ask for its header and the first 2 bytes of
2717          * the body (like we did for the first SMB2 request).
2718          */
2719
2720         req->in.vector = talloc_realloc(req, req->in.vector,
2721                                         struct iovec,
2722                                         req->in.vector_count + 1);
2723         if (req->in.vector == NULL) {
2724                 return -1;
2725         }
2726         req->in.vector_count += 1;
2727
2728         /*
2729          * We assume it's a SMB2 request,
2730          * and we first get the header and the
2731          * first 2 bytes (the struct size) of the body
2732          */
2733         len = SMB2_HDR_BODY + 2;
2734
2735         if (len > state->missing) {
2736                 /* let the caller handle the error */
2737                 len = state->missing;
2738         }
2739
2740         state->missing -= len;
2741         state->asked_for_header = true;
2742
2743         buf = talloc_array(req->in.vector, uint8_t, len);
2744         if (buf == NULL) {
2745                 return -1;
2746         }
2747
2748         req->in.vector[idx].iov_base    = (void *)buf;
2749         req->in.vector[idx].iov_len     = len;
2750
2751         vector = talloc_array(mem_ctx, struct iovec, 1);
2752         if (vector == NULL) {
2753                 return -1;
2754         }
2755
2756         vector[0] = req->in.vector[idx];
2757
2758         *_vector = vector;
2759         *_count = 1;
2760         return 0;
2761 }
2762
2763 static void smbd_smb2_request_read_done(struct tevent_req *subreq)
2764 {
2765         struct tevent_req *req =
2766                 tevent_req_callback_data(subreq,
2767                 struct tevent_req);
2768         int ret;
2769         int sys_errno;
2770         NTSTATUS status;
2771
2772         ret = tstream_readv_pdu_queue_recv(subreq, &sys_errno);
2773         if (ret == -1) {
2774                 status = map_nt_error_from_unix(sys_errno);
2775                 tevent_req_nterror(req, status);
2776                 return;
2777         }
2778
2779         tevent_req_done(req);
2780 }
2781
2782 static NTSTATUS smbd_smb2_request_read_recv(struct tevent_req *req,
2783                                             TALLOC_CTX *mem_ctx,
2784                                             struct smbd_smb2_request **_smb2_req)
2785 {
2786         struct smbd_smb2_request_read_state *state =
2787                 tevent_req_data(req,
2788                 struct smbd_smb2_request_read_state);
2789         NTSTATUS status;
2790
2791         if (tevent_req_is_nterror(req, &status)) {
2792                 tevent_req_received(req);
2793                 return status;
2794         }
2795
2796         talloc_steal(mem_ctx, state->smb2_req->mem_pool);
2797         *_smb2_req = state->smb2_req;
2798         tevent_req_received(req);
2799         return NT_STATUS_OK;
2800 }
2801
2802 static void smbd_smb2_request_incoming(struct tevent_req *subreq);
2803
2804 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn)
2805 {
2806         size_t max_send_queue_len;
2807         size_t cur_send_queue_len;
2808         struct tevent_req *subreq;
2809
2810         if (sconn->smb2.compound_related_in_progress) {
2811                 /*
2812                  * Can't read another until the related
2813                  * compound is done.
2814                  */
2815                 return NT_STATUS_OK;
2816         }
2817
2818         if (tevent_queue_length(sconn->smb2.recv_queue) > 0) {
2819                 /*
2820                  * if there is already a smbd_smb2_request_read
2821                  * pending, we are done.
2822                  */
2823                 return NT_STATUS_OK;
2824         }
2825
2826         max_send_queue_len = MAX(1, sconn->smb2.max_credits/16);
2827         cur_send_queue_len = tevent_queue_length(sconn->smb2.send_queue);
2828
2829         if (cur_send_queue_len > max_send_queue_len) {
2830                 /*
2831                  * if we have a lot of requests to send,
2832                  * we wait until they are on the wire until we
2833                  * ask for the next request.
2834                  */
2835                 return NT_STATUS_OK;
2836         }
2837
2838         /* ask for the next request */
2839         subreq = smbd_smb2_request_read_send(sconn, sconn->ev_ctx, sconn);
2840         if (subreq == NULL) {
2841                 return NT_STATUS_NO_MEMORY;
2842         }
2843         tevent_req_set_callback(subreq, smbd_smb2_request_incoming, sconn);
2844
2845         return NT_STATUS_OK;
2846 }
2847
2848 void smbd_smb2_first_negprot(struct smbd_server_connection *sconn,
2849                              const uint8_t *inbuf, size_t size)
2850 {
2851         NTSTATUS status;
2852         struct smbd_smb2_request *req = NULL;
2853
2854         DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
2855                  (unsigned int)size));
2856
2857         status = smbd_initialize_smb2(sconn);
2858         if (!NT_STATUS_IS_OK(status)) {
2859                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2860                 return;
2861         }
2862
2863         status = smbd_smb2_request_create(sconn, inbuf, size, &req);
2864         if (!NT_STATUS_IS_OK(status)) {
2865                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2866                 return;
2867         }
2868
2869         status = smbd_smb2_request_validate(req);
2870         if (!NT_STATUS_IS_OK(status)) {
2871                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2872                 return;
2873         }
2874
2875         status = smbd_smb2_request_setup_out(req);
2876         if (!NT_STATUS_IS_OK(status)) {
2877                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2878                 return;
2879         }
2880
2881         status = smbd_smb2_request_dispatch(req);
2882         if (!NT_STATUS_IS_OK(status)) {
2883                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2884                 return;
2885         }
2886
2887         status = smbd_smb2_request_next_incoming(sconn);
2888         if (!NT_STATUS_IS_OK(status)) {
2889                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2890                 return;
2891         }
2892
2893         sconn->num_requests++;
2894 }
2895
2896 static void smbd_smb2_request_incoming(struct tevent_req *subreq)
2897 {
2898         struct smbd_server_connection *sconn = tevent_req_callback_data(subreq,
2899                                                struct smbd_server_connection);
2900         NTSTATUS status;
2901         struct smbd_smb2_request *req = NULL;
2902
2903         status = smbd_smb2_request_read_recv(subreq, sconn, &req);
2904         TALLOC_FREE(subreq);
2905         if (!NT_STATUS_IS_OK(status)) {
2906                 DEBUG(2,("smbd_smb2_request_incoming: client read error %s\n",
2907                         nt_errstr(status)));
2908                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2909                 return;
2910         }
2911
2912         if (req->in.nbt_hdr[0] != 0x00) {
2913                 DEBUG(1,("smbd_smb2_request_incoming: ignore NBT[0x%02X] msg\n",
2914                          req->in.nbt_hdr[0]));
2915                 TALLOC_FREE(req);
2916                 goto next;
2917         }
2918
2919         req->current_idx = 1;
2920
2921         DEBUG(10,("smbd_smb2_request_incoming: idx[%d] of %d vectors\n",
2922                  req->current_idx, req->in.vector_count));
2923
2924         status = smbd_smb2_request_validate(req);
2925         if (!NT_STATUS_IS_OK(status)) {
2926                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2927                 return;
2928         }
2929
2930         status = smbd_smb2_request_setup_out(req);
2931         if (!NT_STATUS_IS_OK(status)) {
2932                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2933                 return;
2934         }
2935
2936         status = smbd_smb2_request_dispatch(req);
2937         if (!NT_STATUS_IS_OK(status)) {
2938                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2939                 return;
2940         }
2941
2942 next:
2943         status = smbd_smb2_request_next_incoming(sconn);
2944         if (!NT_STATUS_IS_OK(status)) {
2945                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2946                 return;
2947         }
2948
2949         sconn->num_requests++;
2950
2951         /* The timeout_processing function isn't run nearly
2952            often enough to implement 'max log size' without
2953            overrunning the size of the file by many megabytes.
2954            This is especially true if we are running at debug
2955            level 10.  Checking every 50 SMB2s is a nice
2956            tradeoff of performance vs log file size overrun. */
2957
2958         if ((sconn->num_requests % 50) == 0 &&
2959             need_to_check_log_size()) {
2960                 change_to_root_user();
2961                 check_log_size();
2962         }
2963 }