ba0091103b73636f1a5587b86012a99f999866ce
[kamenim/samba-autobuild/.git] / source3 / smbd / smb2_server.c
1 /*
2    Unix SMB/CIFS implementation.
3    Core SMB2 server
4
5    Copyright (C) Stefan Metzmacher 2009
6    Copyright (C) Jeremy Allison 2010
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "smbprofile.h"
29 #include "../lib/util/bitmap.h"
30 #include "../librpc/gen_ndr/krb5pac.h"
31 #include "auth.h"
32
33 static void smbd_smb2_connection_handler(struct tevent_context *ev,
34                                          struct tevent_fd *fde,
35                                          uint16_t flags,
36                                          void *private_data);
37 static NTSTATUS smbd_smb2_flush_send_queue(struct smbd_server_connection *sconn);
38
39 static const struct smbd_smb2_dispatch_table {
40         uint16_t opcode;
41         const char *name;
42         bool need_session;
43         bool need_tcon;
44         bool as_root;
45         uint16_t fileid_ofs;
46         bool allow_invalid_fileid;
47 } smbd_smb2_table[] = {
48 #define _OP(o) .opcode = o, .name = #o
49         {
50                 _OP(SMB2_OP_NEGPROT),
51                 .as_root = true,
52         },{
53                 _OP(SMB2_OP_SESSSETUP),
54                 .as_root = true,
55         },{
56                 _OP(SMB2_OP_LOGOFF),
57                 .need_session = true,
58                 .as_root = true,
59         },{
60                 _OP(SMB2_OP_TCON),
61                 .need_session = true,
62                 /*
63                  * This call needs to be run as root.
64                  *
65                  * smbd_smb2_request_process_tcon()
66                  * calls make_connection_snum(), which will call
67                  * change_to_user(), when needed.
68                  */
69                 .as_root = true,
70         },{
71                 _OP(SMB2_OP_TDIS),
72                 .need_session = true,
73                 .need_tcon = true,
74                 .as_root = true,
75         },{
76                 _OP(SMB2_OP_CREATE),
77                 .need_session = true,
78                 .need_tcon = true,
79         },{
80                 _OP(SMB2_OP_CLOSE),
81                 .need_session = true,
82                 .need_tcon = true,
83                 .fileid_ofs = 0x08,
84         },{
85                 _OP(SMB2_OP_FLUSH),
86                 .need_session = true,
87                 .need_tcon = true,
88                 .fileid_ofs = 0x08,
89         },{
90                 _OP(SMB2_OP_READ),
91                 .need_session = true,
92                 .need_tcon = true,
93                 .fileid_ofs = 0x10,
94         },{
95                 _OP(SMB2_OP_WRITE),
96                 .need_session = true,
97                 .need_tcon = true,
98                 .fileid_ofs = 0x10,
99         },{
100                 _OP(SMB2_OP_LOCK),
101                 .need_session = true,
102                 .need_tcon = true,
103                 .fileid_ofs = 0x08,
104         },{
105                 _OP(SMB2_OP_IOCTL),
106                 .need_session = true,
107                 .need_tcon = true,
108                 .fileid_ofs = 0x08,
109                 .allow_invalid_fileid = true,
110         },{
111                 _OP(SMB2_OP_CANCEL),
112                 .as_root = true,
113         },{
114                 _OP(SMB2_OP_KEEPALIVE),
115                 .as_root = true,
116         },{
117                 _OP(SMB2_OP_FIND),
118                 .need_session = true,
119                 .need_tcon = true,
120                 .fileid_ofs = 0x08,
121         },{
122                 _OP(SMB2_OP_NOTIFY),
123                 .need_session = true,
124                 .need_tcon = true,
125                 .fileid_ofs = 0x08,
126         },{
127                 _OP(SMB2_OP_GETINFO),
128                 .need_session = true,
129                 .need_tcon = true,
130                 .fileid_ofs = 0x18,
131         },{
132                 _OP(SMB2_OP_SETINFO),
133                 .need_session = true,
134                 .need_tcon = true,
135                 .fileid_ofs = 0x10,
136         },{
137                 _OP(SMB2_OP_BREAK),
138                 .need_session = true,
139                 .need_tcon = true,
140                 /*
141                  * we do not set
142                  * .fileid_ofs here
143                  * as LEASE breaks does not
144                  * have a file id
145                  */
146         }
147 };
148
149 const char *smb2_opcode_name(uint16_t opcode)
150 {
151         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
152                 return "Bad SMB2 opcode";
153         }
154         return smbd_smb2_table[opcode].name;
155 }
156
157 static const struct smbd_smb2_dispatch_table *smbd_smb2_call(uint16_t opcode)
158 {
159         const struct smbd_smb2_dispatch_table *ret = NULL;
160
161         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
162                 return NULL;
163         }
164
165         ret = &smbd_smb2_table[opcode];
166
167         SMB_ASSERT(ret->opcode == opcode);
168
169         return ret;
170 }
171
172 static void print_req_vectors(const struct smbd_smb2_request *req)
173 {
174         int i;
175
176         for (i = 0; i < req->in.vector_count; i++) {
177                 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
178                         (unsigned int)i,
179                         (unsigned int)req->in.vector[i].iov_len);
180         }
181         for (i = 0; i < req->out.vector_count; i++) {
182                 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
183                         (unsigned int)i,
184                         (unsigned int)req->out.vector[i].iov_len);
185         }
186 }
187
188 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
189 {
190         if (size < (4 + SMB2_HDR_BODY)) {
191                 return false;
192         }
193
194         if (IVAL(inbuf, 4) != SMB2_MAGIC) {
195                 return false;
196         }
197
198         return true;
199 }
200
201 static NTSTATUS smbd_initialize_smb2(struct smbd_server_connection *sconn)
202 {
203         struct smbXsrv_connection *xconn = sconn->conn;
204
205         TALLOC_FREE(xconn->transport.fde);
206
207         sconn->smb2.seqnum_low = 0;
208         sconn->smb2.seqnum_range = 1;
209         sconn->smb2.credits_granted = 1;
210         sconn->smb2.max_credits = lp_smb2_max_credits();
211         sconn->smb2.credits_bitmap = bitmap_talloc(sconn,
212                                                    sconn->smb2.max_credits);
213         if (sconn->smb2.credits_bitmap == NULL) {
214                 return NT_STATUS_NO_MEMORY;
215         }
216
217         xconn->transport.fde = tevent_add_fd(sconn->ev_ctx,
218                                         sconn,
219                                         xconn->transport.sock,
220                                         TEVENT_FD_READ,
221                                         smbd_smb2_connection_handler,
222                                         sconn);
223         if (xconn->transport.fde == NULL) {
224                 return NT_STATUS_NO_MEMORY;
225         }
226
227         /* Ensure child is set to non-blocking mode */
228         set_blocking(xconn->transport.sock, false);
229         return NT_STATUS_OK;
230 }
231
232 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
233 #define _smb2_setlen(_buf,len) do { \
234         uint8_t *buf = (uint8_t *)_buf; \
235         buf[0] = 0; \
236         buf[1] = ((len)&0xFF0000)>>16; \
237         buf[2] = ((len)&0xFF00)>>8; \
238         buf[3] = (len)&0xFF; \
239 } while (0)
240
241 static void smb2_setup_nbt_length(struct iovec *vector, int count)
242 {
243         size_t len = 0;
244         int i;
245
246         for (i=1; i < count; i++) {
247                 len += vector[i].iov_len;
248         }
249
250         _smb2_setlen(vector[0].iov_base, len);
251 }
252
253 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
254 {
255         if (req->first_key.length > 0) {
256                 data_blob_clear_free(&req->first_key);
257         }
258         if (req->last_key.length > 0) {
259                 data_blob_clear_free(&req->last_key);
260         }
261         return 0;
262 }
263
264 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
265 {
266         TALLOC_CTX *mem_pool;
267         struct smbd_smb2_request *req;
268
269 #if 0
270         /* Enable this to find subtle valgrind errors. */
271         mem_pool = talloc_init("smbd_smb2_request_allocate");
272 #else
273         mem_pool = talloc_tos();
274 #endif
275         if (mem_pool == NULL) {
276                 return NULL;
277         }
278
279         req = talloc_zero(mem_pool, struct smbd_smb2_request);
280         if (req == NULL) {
281                 talloc_free(mem_pool);
282                 return NULL;
283         }
284         talloc_reparent(mem_pool, mem_ctx, req);
285 #if 0
286         TALLOC_FREE(mem_pool);
287 #endif
288
289         req->last_session_id = UINT64_MAX;
290         req->last_tid = UINT32_MAX;
291
292         talloc_set_destructor(req, smbd_smb2_request_destructor);
293
294         return req;
295 }
296
297 static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *conn,
298                                                NTTIME now,
299                                                uint8_t *buf,
300                                                size_t buflen,
301                                                struct smbd_smb2_request *req,
302                                                struct iovec **piov,
303                                                int *pnum_iov)
304 {
305         TALLOC_CTX *mem_ctx = req;
306         struct iovec *iov;
307         int num_iov = 1;
308         size_t taken = 0;
309         uint8_t *first_hdr = buf;
310         size_t verified_buflen = 0;
311         uint8_t *tf = NULL;
312         size_t tf_len = 0;
313
314         /*
315          * Note: index '0' is reserved for the transport protocol
316          */
317         iov = req->in._vector;
318
319         while (taken < buflen) {
320                 size_t len = buflen - taken;
321                 uint8_t *hdr = first_hdr + taken;
322                 struct iovec *cur;
323                 size_t full_size;
324                 size_t next_command_ofs;
325                 uint16_t body_size;
326                 uint8_t *body = NULL;
327                 uint32_t dyn_size;
328                 uint8_t *dyn = NULL;
329                 struct iovec *iov_alloc = NULL;
330
331                 if (iov != req->in._vector) {
332                         iov_alloc = iov;
333                 }
334
335                 if (verified_buflen > taken) {
336                         len = verified_buflen - taken;
337                 } else {
338                         tf = NULL;
339                         tf_len = 0;
340                 }
341
342                 if (len < 4) {
343                         DEBUG(10, ("%d bytes left, expected at least %d\n",
344                                    (int)len, 4));
345                         goto inval;
346                 }
347                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
348                         struct smbXsrv_session *s = NULL;
349                         uint64_t uid;
350                         struct iovec tf_iov[2];
351                         NTSTATUS status;
352                         size_t enc_len;
353
354                         if (conn->protocol < PROTOCOL_SMB2_24) {
355                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
356                                            "but dialect[0x%04X] is used\n",
357                                            conn->smb2.server.dialect));
358                                 goto inval;
359                         }
360
361                         if (!(conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
362                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
363                                            "but not negotiated "
364                                            "client[0x%08X] server[0x%08X]\n",
365                                            conn->smb2.client.capabilities,
366                                            conn->smb2.server.capabilities));
367                                 goto inval;
368                         }
369
370                         if (len < SMB2_TF_HDR_SIZE) {
371                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
372                                            (int)len, SMB2_TF_HDR_SIZE));
373                                 goto inval;
374                         }
375                         tf = hdr;
376                         tf_len = SMB2_TF_HDR_SIZE;
377                         taken += tf_len;
378
379                         hdr = first_hdr + taken;
380                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
381                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
382
383                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
384                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
385                                            (int)len,
386                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
387                                 goto inval;
388                         }
389
390                         status = smb2srv_session_lookup(conn, uid, now, &s);
391                         if (s == NULL) {
392                                 DEBUG(1, ("invalid session[%llu] in "
393                                           "SMB2_TRANSFORM header\n",
394                                            (unsigned long long)uid));
395                                 TALLOC_FREE(iov_alloc);
396                                 return NT_STATUS_USER_SESSION_DELETED;
397                         }
398
399                         tf_iov[0].iov_base = (void *)tf;
400                         tf_iov[0].iov_len = tf_len;
401                         tf_iov[1].iov_base = (void *)hdr;
402                         tf_iov[1].iov_len = enc_len;
403
404                         status = smb2_signing_decrypt_pdu(s->global->decryption_key,
405                                                           conn->protocol,
406                                                           tf_iov, 2);
407                         if (!NT_STATUS_IS_OK(status)) {
408                                 TALLOC_FREE(iov_alloc);
409                                 return status;
410                         }
411
412                         verified_buflen = taken + enc_len;
413                         len = enc_len;
414                 }
415
416                 /*
417                  * We need the header plus the body length field
418                  */
419
420                 if (len < SMB2_HDR_BODY + 2) {
421                         DEBUG(10, ("%d bytes left, expected at least %d\n",
422                                    (int)len, SMB2_HDR_BODY));
423                         goto inval;
424                 }
425                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
426                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
427                                    IVAL(hdr, 0)));
428                         goto inval;
429                 }
430                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
431                         DEBUG(10, ("Got HDR len %d, expected %d\n",
432                                    SVAL(hdr, 4), SMB2_HDR_BODY));
433                         goto inval;
434                 }
435
436                 full_size = len;
437                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
438                 body_size = SVAL(hdr, SMB2_HDR_BODY);
439
440                 if (next_command_ofs != 0) {
441                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
442                                 goto inval;
443                         }
444                         if (next_command_ofs > full_size) {
445                                 goto inval;
446                         }
447                         full_size = next_command_ofs;
448                 }
449                 if (body_size < 2) {
450                         goto inval;
451                 }
452                 body_size &= 0xfffe;
453
454                 if (body_size > (full_size - SMB2_HDR_BODY)) {
455                         /*
456                          * let the caller handle the error
457                          */
458                         body_size = full_size - SMB2_HDR_BODY;
459                 }
460                 body = hdr + SMB2_HDR_BODY;
461                 dyn = body + body_size;
462                 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
463
464                 if (num_iov >= ARRAY_SIZE(req->in._vector)) {
465                         struct iovec *iov_tmp = NULL;
466
467                         iov_tmp = talloc_realloc(mem_ctx, iov_alloc,
468                                                  struct iovec,
469                                                  num_iov +
470                                                  SMBD_SMB2_NUM_IOV_PER_REQ);
471                         if (iov_tmp == NULL) {
472                                 TALLOC_FREE(iov_alloc);
473                                 return NT_STATUS_NO_MEMORY;
474                         }
475
476                         if (iov_alloc == NULL) {
477                                 memcpy(iov_tmp,
478                                        req->in._vector,
479                                        sizeof(req->in._vector));
480                         }
481
482                         iov = iov_tmp;
483                 }
484                 cur = &iov[num_iov];
485                 num_iov += SMBD_SMB2_NUM_IOV_PER_REQ;
486
487                 cur[SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
488                 cur[SMBD_SMB2_TF_IOV_OFS].iov_len    = tf_len;
489                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
490                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
491                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
492                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_len  = body_size;
493                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
494                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_len   = dyn_size;
495
496                 taken += full_size;
497         }
498
499         *piov = iov;
500         *pnum_iov = num_iov;
501         return NT_STATUS_OK;
502
503 inval:
504         if (iov != req->in._vector) {
505                 TALLOC_FREE(iov);
506         }
507         return NT_STATUS_INVALID_PARAMETER;
508 }
509
510 static NTSTATUS smbd_smb2_request_create(struct smbd_server_connection *sconn,
511                                          uint8_t *inbuf, size_t size,
512                                          struct smbd_smb2_request **_req)
513 {
514         struct smbd_smb2_request *req;
515         uint32_t protocol_version;
516         const uint8_t *inhdr = NULL;
517         uint16_t cmd;
518         uint32_t next_command_ofs;
519         NTSTATUS status;
520         NTTIME now;
521
522         if (size < (4 + SMB2_HDR_BODY + 2)) {
523                 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
524                 return NT_STATUS_INVALID_PARAMETER;
525         }
526
527         inhdr = inbuf + 4;
528
529         protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
530         if (protocol_version != SMB2_MAGIC) {
531                 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
532                          protocol_version));
533                 return NT_STATUS_INVALID_PARAMETER;
534         }
535
536         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
537         if (cmd != SMB2_OP_NEGPROT) {
538                 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
539                          cmd));
540                 return NT_STATUS_INVALID_PARAMETER;
541         }
542
543         next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
544         if (next_command_ofs != 0) {
545                 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
546                          next_command_ofs));
547                 return NT_STATUS_INVALID_PARAMETER;
548         }
549
550         req = smbd_smb2_request_allocate(sconn);
551         if (req == NULL) {
552                 return NT_STATUS_NO_MEMORY;
553         }
554         req->sconn = sconn;
555
556         talloc_steal(req, inbuf);
557
558         req->request_time = timeval_current();
559         now = timeval_to_nttime(&req->request_time);
560
561         status = smbd_smb2_inbuf_parse_compound(sconn->conn,
562                                                 now,
563                                                 inbuf + NBT_HDR_SIZE,
564                                                 size - NBT_HDR_SIZE,
565                                                 req, &req->in.vector,
566                                                 &req->in.vector_count);
567         if (!NT_STATUS_IS_OK(status)) {
568                 TALLOC_FREE(req);
569                 return status;
570         }
571
572         req->current_idx = 1;
573
574         *_req = req;
575         return NT_STATUS_OK;
576 }
577
578 static bool smb2_validate_sequence_number(struct smbd_server_connection *sconn,
579                                           uint64_t message_id, uint64_t seq_id)
580 {
581         struct bitmap *credits_bm = sconn->smb2.credits_bitmap;
582         unsigned int offset;
583
584         if (seq_id < sconn->smb2.seqnum_low) {
585                 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
586                         "%llu (sequence id %llu) "
587                         "(granted = %u, low = %llu, range = %u)\n",
588                         (unsigned long long)message_id,
589                         (unsigned long long)seq_id,
590                         (unsigned int)sconn->smb2.credits_granted,
591                         (unsigned long long)sconn->smb2.seqnum_low,
592                         (unsigned int)sconn->smb2.seqnum_range));
593                 return false;
594         }
595
596         if (seq_id >= sconn->smb2.seqnum_low + sconn->smb2.seqnum_range) {
597                 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
598                         "%llu (sequence id %llu) "
599                         "(granted = %u, low = %llu, range = %u)\n",
600                         (unsigned long long)message_id,
601                         (unsigned long long)seq_id,
602                         (unsigned int)sconn->smb2.credits_granted,
603                         (unsigned long long)sconn->smb2.seqnum_low,
604                         (unsigned int)sconn->smb2.seqnum_range));
605                 return false;
606         }
607
608         offset = seq_id % sconn->smb2.max_credits;
609
610         if (bitmap_query(credits_bm, offset)) {
611                 DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
612                         "%llu (sequence id %llu) "
613                         "(granted = %u, low = %llu, range = %u) "
614                         "(bm offset %u)\n",
615                         (unsigned long long)message_id,
616                         (unsigned long long)seq_id,
617                         (unsigned int)sconn->smb2.credits_granted,
618                         (unsigned long long)sconn->smb2.seqnum_low,
619                         (unsigned int)sconn->smb2.seqnum_range,
620                         offset));
621                 return false;
622         }
623
624         /* Mark the message_ids as seen in the bitmap. */
625         bitmap_set(credits_bm, offset);
626
627         if (seq_id != sconn->smb2.seqnum_low) {
628                 return true;
629         }
630
631         /*
632          * Move the window forward by all the message_id's
633          * already seen.
634          */
635         while (bitmap_query(credits_bm, offset)) {
636                 DEBUG(10,("smb2_validate_sequence_number: clearing "
637                           "id %llu (position %u) from bitmap\n",
638                           (unsigned long long)(sconn->smb2.seqnum_low),
639                           offset));
640                 bitmap_clear(credits_bm, offset);
641
642                 sconn->smb2.seqnum_low += 1;
643                 sconn->smb2.seqnum_range -= 1;
644                 offset = sconn->smb2.seqnum_low % sconn->smb2.max_credits;
645         }
646
647         return true;
648 }
649
650 static bool smb2_validate_message_id(struct smbd_server_connection *sconn,
651                                 const uint8_t *inhdr)
652 {
653         uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
654         uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
655         uint16_t credit_charge = 1;
656         uint64_t i;
657
658         if (opcode == SMB2_OP_CANCEL) {
659                 /* SMB2_CANCEL requests by definition resend messageids. */
660                 return true;
661         }
662
663         if (sconn->smb2.supports_multicredit) {
664                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
665                 credit_charge = MAX(credit_charge, 1);
666         }
667
668         DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
669                    "credits_granted %llu, "
670                    "seqnum low/range: %llu/%llu\n",
671                    (unsigned long long) message_id,
672                    (unsigned long long) credit_charge,
673                    (unsigned long long) sconn->smb2.credits_granted,
674                    (unsigned long long) sconn->smb2.seqnum_low,
675                    (unsigned long long) sconn->smb2.seqnum_range));
676
677         if (sconn->smb2.credits_granted < credit_charge) {
678                 DEBUG(0, ("smb2_validate_message_id: client used more "
679                           "credits than granted, mid %llu, charge %llu, "
680                           "credits_granted %llu, "
681                           "seqnum low/range: %llu/%llu\n",
682                           (unsigned long long) message_id,
683                           (unsigned long long) credit_charge,
684                           (unsigned long long) sconn->smb2.credits_granted,
685                           (unsigned long long) sconn->smb2.seqnum_low,
686                           (unsigned long long) sconn->smb2.seqnum_range));
687                 return false;
688         }
689
690         /*
691          * now check the message ids
692          *
693          * for multi-credit requests we need to check all current mid plus
694          * the implicit mids caused by the credit charge
695          * e.g. current mid = 15, charge 5 => mark 15-19 as used
696          */
697
698         for (i = 0; i <= (credit_charge-1); i++) {
699                 uint64_t id = message_id + i;
700                 bool ok;
701
702                 DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
703                            (unsigned long long)message_id,
704                            credit_charge,
705                            (unsigned long long)id));
706
707                 ok = smb2_validate_sequence_number(sconn, message_id, id);
708                 if (!ok) {
709                         return false;
710                 }
711         }
712
713         /* substract used credits */
714         sconn->smb2.credits_granted -= credit_charge;
715
716         return true;
717 }
718
719 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
720 {
721         int count;
722         int idx;
723
724         count = req->in.vector_count;
725
726         if (count < 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
727                 /* It's not a SMB2 request */
728                 return NT_STATUS_INVALID_PARAMETER;
729         }
730
731         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
732                 struct iovec *hdr = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
733                 struct iovec *body = SMBD_SMB2_IDX_BODY_IOV(req,in,idx);
734                 const uint8_t *inhdr = NULL;
735
736                 if (hdr->iov_len != SMB2_HDR_BODY) {
737                         return NT_STATUS_INVALID_PARAMETER;
738                 }
739
740                 if (body->iov_len < 2) {
741                         return NT_STATUS_INVALID_PARAMETER;
742                 }
743
744                 inhdr = (const uint8_t *)hdr->iov_base;
745
746                 /* Check the SMB2 header */
747                 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
748                         return NT_STATUS_INVALID_PARAMETER;
749                 }
750
751                 if (!smb2_validate_message_id(req->sconn, inhdr)) {
752                         return NT_STATUS_INVALID_PARAMETER;
753                 }
754         }
755
756         return NT_STATUS_OK;
757 }
758
759 static void smb2_set_operation_credit(struct smbd_server_connection *sconn,
760                         const struct iovec *in_vector,
761                         struct iovec *out_vector)
762 {
763         const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
764         uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
765         uint16_t credit_charge = 1;
766         uint16_t credits_requested;
767         uint32_t out_flags;
768         uint16_t cmd;
769         NTSTATUS out_status;
770         uint16_t credits_granted = 0;
771         uint64_t credits_possible;
772         uint16_t current_max_credits;
773
774         /*
775          * first we grant only 1/16th of the max range.
776          *
777          * Windows also starts with the 1/16th and then grants
778          * more later. I was only able to trigger higher
779          * values, when using a very high credit charge.
780          *
781          * TODO: scale up depending on load, free memory
782          *       or other stuff.
783          *       Maybe also on the relationship between number
784          *       of requests and the used sequence number.
785          *       Which means we would grant more credits
786          *       for client which use multi credit requests.
787          */
788         current_max_credits = sconn->smb2.max_credits / 16;
789         current_max_credits = MAX(current_max_credits, 1);
790
791         if (sconn->smb2.supports_multicredit) {
792                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
793                 credit_charge = MAX(credit_charge, 1);
794         }
795
796         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
797         credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
798         out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
799         out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
800
801         SMB_ASSERT(sconn->smb2.max_credits >= sconn->smb2.credits_granted);
802
803         if (sconn->smb2.max_credits < credit_charge) {
804                 smbd_server_connection_terminate(sconn,
805                         "client error: credit charge > max credits\n");
806                 return;
807         }
808
809         if (out_flags & SMB2_HDR_FLAG_ASYNC) {
810                 /*
811                  * In case we already send an async interim
812                  * response, we should not grant
813                  * credits on the final response.
814                  */
815                 credits_granted = 0;
816         } else if (credits_requested > 0) {
817                 uint16_t additional_max = 0;
818                 uint16_t additional_credits = credits_requested - 1;
819
820                 switch (cmd) {
821                 case SMB2_OP_NEGPROT:
822                         break;
823                 case SMB2_OP_SESSSETUP:
824                         /*
825                          * Windows 2012 RC1 starts to grant
826                          * additional credits
827                          * with a successful session setup
828                          */
829                         if (NT_STATUS_IS_OK(out_status)) {
830                                 additional_max = 32;
831                         }
832                         break;
833                 default:
834                         /*
835                          * We match windows and only grant additional credits
836                          * in chunks of 32.
837                          */
838                         additional_max = 32;
839                         break;
840                 }
841
842                 additional_credits = MIN(additional_credits, additional_max);
843
844                 credits_granted = credit_charge + additional_credits;
845         } else if (sconn->smb2.credits_granted == 0) {
846                 /*
847                  * Make sure the client has always at least one credit
848                  */
849                 credits_granted = 1;
850         }
851
852         /*
853          * sequence numbers should not wrap
854          *
855          * 1. calculate the possible credits until
856          *    the sequence numbers start to wrap on 64-bit.
857          *
858          * 2. UINT64_MAX is used for Break Notifications.
859          *
860          * 2. truncate the possible credits to the maximum
861          *    credits we want to grant to the client in total.
862          *
863          * 3. remove the range we'll already granted to the client
864          *    this makes sure the client consumes the lowest sequence
865          *    number, before we can grant additional credits.
866          */
867         credits_possible = UINT64_MAX - sconn->smb2.seqnum_low;
868         if (credits_possible > 0) {
869                 /* remove UINT64_MAX */
870                 credits_possible -= 1;
871         }
872         credits_possible = MIN(credits_possible, current_max_credits);
873         credits_possible -= sconn->smb2.seqnum_range;
874
875         credits_granted = MIN(credits_granted, credits_possible);
876
877         SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
878         sconn->smb2.credits_granted += credits_granted;
879         sconn->smb2.seqnum_range += credits_granted;
880
881         DEBUG(10,("smb2_set_operation_credit: requested %u, charge %u, "
882                 "granted %u, current possible/max %u/%u, "
883                 "total granted/max/low/range %u/%u/%llu/%u\n",
884                 (unsigned int)credits_requested,
885                 (unsigned int)credit_charge,
886                 (unsigned int)credits_granted,
887                 (unsigned int)credits_possible,
888                 (unsigned int)current_max_credits,
889                 (unsigned int)sconn->smb2.credits_granted,
890                 (unsigned int)sconn->smb2.max_credits,
891                 (unsigned long long)sconn->smb2.seqnum_low,
892                 (unsigned int)sconn->smb2.seqnum_range));
893 }
894
895 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
896                                 struct smbd_smb2_request *outreq)
897 {
898         int count, idx;
899         uint16_t total_credits = 0;
900
901         count = outreq->out.vector_count;
902
903         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
904                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(inreq,in,idx);
905                 struct iovec *outhdr_v = SMBD_SMB2_IDX_HDR_IOV(outreq,out,idx);
906                 uint8_t *outhdr = (uint8_t *)outhdr_v->iov_base;
907
908                 smb2_set_operation_credit(outreq->sconn, inhdr_v, outhdr_v);
909
910                 /* To match Windows, count up what we
911                    just granted. */
912                 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
913                 /* Set to zero in all but the last reply. */
914                 if (idx + SMBD_SMB2_NUM_IOV_PER_REQ < count) {
915                         SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
916                 } else {
917                         SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
918                 }
919         }
920 }
921
922 DATA_BLOB smbd_smb2_generate_outbody(struct smbd_smb2_request *req, size_t size)
923 {
924         if (req->current_idx <= 1) {
925                 if (size <= sizeof(req->out._body)) {
926                         return data_blob_const(req->out._body, size);
927                 }
928         }
929
930         return data_blob_talloc(req, NULL, size);
931 }
932
933 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
934 {
935         TALLOC_CTX *mem_ctx;
936         struct iovec *vector;
937         int count;
938         int idx;
939
940         count = req->in.vector_count;
941         if (count <= ARRAY_SIZE(req->out._vector)) {
942                 mem_ctx = req;
943                 vector = req->out._vector;
944         } else {
945                 vector = talloc_zero_array(req, struct iovec, count);
946                 if (vector == NULL) {
947                         return NT_STATUS_NO_MEMORY;
948                 }
949                 mem_ctx = vector;
950         }
951
952         vector[0].iov_base      = req->out.nbt_hdr;
953         vector[0].iov_len       = 4;
954         SIVAL(req->out.nbt_hdr, 0, 0);
955
956         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
957                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
958                 const uint8_t *inhdr = (const uint8_t *)inhdr_v->iov_base;
959                 uint8_t *outhdr = NULL;
960                 uint8_t *outbody = NULL;
961                 uint32_t next_command_ofs = 0;
962                 struct iovec *current = &vector[idx];
963
964                 if ((idx + SMBD_SMB2_NUM_IOV_PER_REQ) < count) {
965                         /* we have a next command -
966                          * setup for the error case. */
967                         next_command_ofs = SMB2_HDR_BODY + 9;
968                 }
969
970                 if (idx == 1) {
971                         outhdr = req->out._hdr;
972                 } else {
973                         outhdr = talloc_zero_array(mem_ctx, uint8_t,
974                                                    OUTVEC_ALLOC_SIZE);
975                         if (outhdr == NULL) {
976                                 return NT_STATUS_NO_MEMORY;
977                         }
978                 }
979
980                 outbody = outhdr + SMB2_HDR_BODY;
981
982                 /*
983                  * SMBD_SMB2_TF_IOV_OFS might be used later
984                  */
985                 current[SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
986                 current[SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
987
988                 current[SMBD_SMB2_HDR_IOV_OFS].iov_base  = (void *)outhdr;
989                 current[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
990
991                 current[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)outbody;
992                 current[SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
993
994                 current[SMBD_SMB2_DYN_IOV_OFS].iov_base  = NULL;
995                 current[SMBD_SMB2_DYN_IOV_OFS].iov_len   = 0;
996
997                 /* setup the SMB2 header */
998                 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID,     SMB2_MAGIC);
999                 SSVAL(outhdr, SMB2_HDR_LENGTH,          SMB2_HDR_BODY);
1000                 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
1001                       SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
1002                 SIVAL(outhdr, SMB2_HDR_STATUS,
1003                       NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
1004                 SSVAL(outhdr, SMB2_HDR_OPCODE,
1005                       SVAL(inhdr, SMB2_HDR_OPCODE));
1006                 SIVAL(outhdr, SMB2_HDR_FLAGS,
1007                       IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
1008                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND,    next_command_ofs);
1009                 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
1010                       BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
1011                 SIVAL(outhdr, SMB2_HDR_PID,
1012                       IVAL(inhdr, SMB2_HDR_PID));
1013                 SIVAL(outhdr, SMB2_HDR_TID,
1014                       IVAL(inhdr, SMB2_HDR_TID));
1015                 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
1016                       BVAL(inhdr, SMB2_HDR_SESSION_ID));
1017                 memcpy(outhdr + SMB2_HDR_SIGNATURE,
1018                        inhdr + SMB2_HDR_SIGNATURE, 16);
1019
1020                 /* setup error body header */
1021                 SSVAL(outbody, 0x00, 0x08 + 1);
1022                 SSVAL(outbody, 0x02, 0);
1023                 SIVAL(outbody, 0x04, 0);
1024         }
1025
1026         req->out.vector = vector;
1027         req->out.vector_count = count;
1028
1029         /* setup the length of the NBT packet */
1030         smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
1031
1032         DLIST_ADD_END(req->sconn->smb2.requests, req, struct smbd_smb2_request *);
1033
1034         return NT_STATUS_OK;
1035 }
1036
1037 void smbd_server_connection_terminate_ex(struct smbd_server_connection *sconn,
1038                                          const char *reason,
1039                                          const char *location)
1040 {
1041         DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
1042                   reason, location));
1043         exit_server_cleanly(reason);
1044 }
1045
1046 static bool dup_smb2_vec4(TALLOC_CTX *ctx,
1047                         struct iovec *outvec,
1048                         const struct iovec *srcvec)
1049 {
1050         const uint8_t *srctf;
1051         size_t srctf_len;
1052         const uint8_t *srchdr;
1053         size_t srchdr_len;
1054         const uint8_t *srcbody;
1055         size_t srcbody_len;
1056         const uint8_t *expected_srcbody;
1057         const uint8_t *srcdyn;
1058         size_t srcdyn_len;
1059         const uint8_t *expected_srcdyn;
1060         uint8_t *dsttf;
1061         uint8_t *dsthdr;
1062         uint8_t *dstbody;
1063         uint8_t *dstdyn;
1064
1065         srctf  = (const uint8_t *)srcvec[SMBD_SMB2_TF_IOV_OFS].iov_base;
1066         srctf_len = srcvec[SMBD_SMB2_TF_IOV_OFS].iov_len;
1067         srchdr  = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
1068         srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
1069         srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
1070         srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
1071         expected_srcbody = srchdr + SMB2_HDR_BODY;
1072         srcdyn  = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
1073         srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
1074         expected_srcdyn = srcbody + 8;
1075
1076         if ((srctf_len != SMB2_TF_HDR_SIZE) && (srctf_len != 0)) {
1077                 return false;
1078         }
1079
1080         if (srchdr_len != SMB2_HDR_BODY) {
1081                 return false;
1082         }
1083
1084         if (srctf_len == SMB2_TF_HDR_SIZE) {
1085                 dsttf = talloc_memdup(ctx, srctf, SMB2_TF_HDR_SIZE);
1086                 if (dsttf == NULL) {
1087                         return false;
1088                 }
1089         } else {
1090                 dsttf = NULL;
1091         }
1092         outvec[SMBD_SMB2_TF_IOV_OFS].iov_base = (void *)dsttf;
1093         outvec[SMBD_SMB2_TF_IOV_OFS].iov_len = srctf_len;
1094
1095         /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
1096          * be allocated with size OUTVEC_ALLOC_SIZE. */
1097
1098         dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
1099         if (dsthdr == NULL) {
1100                 return false;
1101         }
1102         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
1103         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1104
1105         /*
1106          * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
1107          * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
1108          * then duplicate this. Else use talloc_memdup().
1109          */
1110
1111         if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
1112                 dstbody = dsthdr + SMB2_HDR_BODY;
1113         } else {
1114                 dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
1115                 if (dstbody == NULL) {
1116                         return false;
1117                 }
1118         }
1119         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
1120         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
1121
1122         /*
1123          * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
1124          * pointing to
1125          * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
1126          * then duplicate this. Else use talloc_memdup().
1127          */
1128
1129         if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
1130                 dstdyn = dsthdr + SMB2_HDR_BODY + 8;
1131         } else if (srcdyn == NULL) {
1132                 dstdyn = NULL;
1133         } else {
1134                 dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
1135                 if (dstdyn == NULL) {
1136                         return false;
1137                 }
1138         }
1139         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
1140         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
1141
1142         return true;
1143 }
1144
1145 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
1146 {
1147         struct smbd_smb2_request *newreq = NULL;
1148         struct iovec *outvec = NULL;
1149         int count = req->out.vector_count;
1150         int i;
1151
1152         newreq = smbd_smb2_request_allocate(req->sconn);
1153         if (!newreq) {
1154                 return NULL;
1155         }
1156
1157         newreq->sconn = req->sconn;
1158         newreq->session = req->session;
1159         newreq->do_encryption = req->do_encryption;
1160         newreq->do_signing = req->do_signing;
1161         newreq->current_idx = req->current_idx;
1162
1163         outvec = talloc_zero_array(newreq, struct iovec, count);
1164         if (!outvec) {
1165                 TALLOC_FREE(newreq);
1166                 return NULL;
1167         }
1168         newreq->out.vector = outvec;
1169         newreq->out.vector_count = count;
1170
1171         /* Setup the outvec's identically to req. */
1172         outvec[0].iov_base = newreq->out.nbt_hdr;
1173         outvec[0].iov_len = 4;
1174         memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
1175
1176         /* Setup the vectors identically to the ones in req. */
1177         for (i = 1; i < count; i += SMBD_SMB2_NUM_IOV_PER_REQ) {
1178                 if (!dup_smb2_vec4(outvec, &outvec[i], &req->out.vector[i])) {
1179                         break;
1180                 }
1181         }
1182
1183         if (i < count) {
1184                 /* Alloc failed. */
1185                 TALLOC_FREE(newreq);
1186                 return NULL;
1187         }
1188
1189         smb2_setup_nbt_length(newreq->out.vector,
1190                 newreq->out.vector_count);
1191
1192         return newreq;
1193 }
1194
1195 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
1196 {
1197         struct smbd_server_connection *sconn = req->sconn;
1198         struct smbXsrv_connection *conn = req->sconn->conn;
1199         int first_idx = 1;
1200         struct iovec *firsttf = NULL;
1201         struct iovec *outhdr_v = NULL;
1202         uint8_t *outhdr = NULL;
1203         struct smbd_smb2_request *nreq = NULL;
1204         NTSTATUS status;
1205
1206         /* Create a new smb2 request we'll use
1207            for the interim return. */
1208         nreq = dup_smb2_req(req);
1209         if (!nreq) {
1210                 return NT_STATUS_NO_MEMORY;
1211         }
1212
1213         /* Lose the last X out vectors. They're the
1214            ones we'll be using for the async reply. */
1215         nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
1216
1217         smb2_setup_nbt_length(nreq->out.vector,
1218                 nreq->out.vector_count);
1219
1220         /* Step back to the previous reply. */
1221         nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
1222         firsttf = SMBD_SMB2_IDX_TF_IOV(nreq,out,first_idx);
1223         outhdr_v = SMBD_SMB2_OUT_HDR_IOV(nreq);
1224         outhdr = SMBD_SMB2_OUT_HDR_PTR(nreq);
1225         /* And end the chain. */
1226         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
1227
1228         /* Calculate outgoing credits */
1229         smb2_calculate_credits(req, nreq);
1230
1231         if (DEBUGLEVEL >= 10) {
1232                 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
1233                         (unsigned int)nreq->current_idx );
1234                 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
1235                         (unsigned int)nreq->out.vector_count );
1236                 print_req_vectors(nreq);
1237         }
1238
1239         /*
1240          * As we have changed the header (SMB2_HDR_NEXT_COMMAND),
1241          * we need to sign/encrypt here with the last/first key we remembered
1242          */
1243         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
1244                 status = smb2_signing_encrypt_pdu(req->first_key,
1245                                         conn->protocol,
1246                                         firsttf,
1247                                         nreq->out.vector_count - first_idx);
1248                 if (!NT_STATUS_IS_OK(status)) {
1249                         return status;
1250                 }
1251         } else if (req->last_key.length > 0) {
1252                 status = smb2_signing_sign_pdu(req->last_key,
1253                                                conn->protocol,
1254                                                outhdr_v,
1255                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1256                 if (!NT_STATUS_IS_OK(status)) {
1257                         return status;
1258                 }
1259         }
1260
1261         nreq->queue_entry.mem_ctx = nreq;
1262         nreq->queue_entry.vector = nreq->out.vector;
1263         nreq->queue_entry.count = nreq->out.vector_count;
1264         DLIST_ADD_END(conn->smb2.send_queue, &nreq->queue_entry, NULL);
1265         conn->smb2.send_queue_len++;
1266
1267         status = smbd_smb2_flush_send_queue(sconn);
1268         if (!NT_STATUS_IS_OK(status)) {
1269                 return status;
1270         }
1271
1272         return NT_STATUS_OK;
1273 }
1274
1275 struct smbd_smb2_request_pending_state {
1276         struct smbd_server_connection *sconn;
1277         struct smbd_smb2_send_queue queue_entry;
1278         uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
1279         struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
1280 };
1281
1282 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1283                                             struct tevent_timer *te,
1284                                             struct timeval current_time,
1285                                             void *private_data);
1286
1287 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
1288                                          struct tevent_req *subreq,
1289                                          uint32_t defer_time)
1290 {
1291         NTSTATUS status;
1292         struct timeval defer_endtime;
1293         uint8_t *outhdr = NULL;
1294         uint32_t flags;
1295
1296         if (!tevent_req_is_in_progress(subreq)) {
1297                 /*
1298                  * This is a performance optimization,
1299                  * it avoids one tevent_loop iteration,
1300                  * which means we avoid one
1301                  * talloc_stackframe_pool/talloc_free pair.
1302                  */
1303                 tevent_req_notify_callback(subreq);
1304                 return NT_STATUS_OK;
1305         }
1306
1307         req->subreq = subreq;
1308         subreq = NULL;
1309
1310         if (req->async_te) {
1311                 /* We're already async. */
1312                 return NT_STATUS_OK;
1313         }
1314
1315         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1316         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1317         if (flags & SMB2_HDR_FLAG_ASYNC) {
1318                 /* We're already async. */
1319                 return NT_STATUS_OK;
1320         }
1321
1322         if (req->in.vector_count > req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
1323                 /*
1324                  * We're trying to go async in a compound
1325                  * request chain.
1326                  * This is only allowed for opens that
1327                  * cause an oplock break, otherwise it
1328                  * is not allowed. See [MS-SMB2].pdf
1329                  * note <194> on Section 3.3.5.2.7.
1330                  */
1331                 const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1332
1333                 if (SVAL(inhdr, SMB2_HDR_OPCODE) != SMB2_OP_CREATE) {
1334                         /*
1335                          * Cancel the outstanding request.
1336                          */
1337                         bool ok = tevent_req_cancel(req->subreq);
1338                         if (ok) {
1339                                 return NT_STATUS_OK;
1340                         }
1341                         TALLOC_FREE(req->subreq);
1342                         return smbd_smb2_request_error(req,
1343                                 NT_STATUS_INTERNAL_ERROR);
1344                 }
1345         }
1346
1347         if (DEBUGLEVEL >= 10) {
1348                 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
1349                         (unsigned int)req->current_idx );
1350                 print_req_vectors(req);
1351         }
1352
1353         if (req->current_idx > 1) {
1354                 /*
1355                  * We're going async in a compound
1356                  * chain after the first request has
1357                  * already been processed. Send an
1358                  * interim response containing the
1359                  * set of replies already generated.
1360                  */
1361                 int idx = req->current_idx;
1362
1363                 status = smb2_send_async_interim_response(req);
1364                 if (!NT_STATUS_IS_OK(status)) {
1365                         return status;
1366                 }
1367                 if (req->first_key.length > 0) {
1368                         data_blob_clear_free(&req->first_key);
1369                 }
1370
1371                 req->current_idx = 1;
1372
1373                 /*
1374                  * Re-arrange the in.vectors to remove what
1375                  * we just sent.
1376                  */
1377                 memmove(&req->in.vector[1],
1378                         &req->in.vector[idx],
1379                         sizeof(req->in.vector[0])*(req->in.vector_count - idx));
1380                 req->in.vector_count = 1 + (req->in.vector_count - idx);
1381
1382                 /* Re-arrange the out.vectors to match. */
1383                 memmove(&req->out.vector[1],
1384                         &req->out.vector[idx],
1385                         sizeof(req->out.vector[0])*(req->out.vector_count - idx));
1386                 req->out.vector_count = 1 + (req->out.vector_count - idx);
1387
1388                 if (req->in.vector_count == 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
1389                         /*
1390                          * We only have one remaining request as
1391                          * we've processed everything else.
1392                          * This is no longer a compound request.
1393                          */
1394                         req->compound_related = false;
1395                         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1396                         flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
1397                         SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
1398                 }
1399         }
1400         if (req->last_key.length > 0) {
1401                 data_blob_clear_free(&req->last_key);
1402         }
1403
1404         defer_endtime = timeval_current_ofs_usec(defer_time);
1405         req->async_te = tevent_add_timer(req->sconn->ev_ctx,
1406                                          req, defer_endtime,
1407                                          smbd_smb2_request_pending_timer,
1408                                          req);
1409         if (req->async_te == NULL) {
1410                 return NT_STATUS_NO_MEMORY;
1411         }
1412
1413         return NT_STATUS_OK;
1414 }
1415
1416 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1417                                             struct tevent_timer *te,
1418                                             struct timeval current_time,
1419                                             void *private_data)
1420 {
1421         struct smbd_smb2_request *req =
1422                 talloc_get_type_abort(private_data,
1423                 struct smbd_smb2_request);
1424         struct smbd_server_connection *sconn = req->sconn;
1425         struct smbXsrv_connection *xconn = sconn->conn;
1426         struct smbd_smb2_request_pending_state *state = NULL;
1427         uint8_t *outhdr = NULL;
1428         const uint8_t *inhdr = NULL;
1429         uint8_t *tf = NULL;
1430         size_t tf_len = 0;
1431         uint8_t *hdr = NULL;
1432         uint8_t *body = NULL;
1433         uint8_t *dyn = NULL;
1434         uint32_t flags = 0;
1435         uint64_t session_id = 0;
1436         uint64_t message_id = 0;
1437         uint64_t nonce_high = 0;
1438         uint64_t nonce_low = 0;
1439         uint64_t async_id = 0;
1440         NTSTATUS status;
1441
1442         TALLOC_FREE(req->async_te);
1443
1444         /* Ensure our final reply matches the interim one. */
1445         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1446         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1447         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1448         message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1449         session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
1450
1451         async_id = message_id; /* keep it simple for now... */
1452
1453         SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1454         SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
1455
1456         DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1457                 "going async\n",
1458                 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1459                 (unsigned long long)async_id ));
1460
1461         /*
1462          * What we send is identical to a smbd_smb2_request_error
1463          * packet with an error status of STATUS_PENDING. Make use
1464          * of this fact sometime when refactoring. JRA.
1465          */
1466
1467         state = talloc_zero(req->sconn, struct smbd_smb2_request_pending_state);
1468         if (state == NULL) {
1469                 smbd_server_connection_terminate(req->sconn,
1470                                                  nt_errstr(NT_STATUS_NO_MEMORY));
1471                 return;
1472         }
1473         state->sconn = req->sconn;
1474
1475         tf = state->buf + NBT_HDR_SIZE;
1476         tf_len = SMB2_TF_HDR_SIZE;
1477
1478         hdr = tf + SMB2_TF_HDR_SIZE;
1479         body = hdr + SMB2_HDR_BODY;
1480         dyn = body + 8;
1481
1482         if (req->do_encryption) {
1483                 struct smbXsrv_session *x = req->session;
1484
1485                 nonce_high = x->nonce_high;
1486                 nonce_low = x->nonce_low;
1487
1488                 x->nonce_low += 1;
1489                 if (x->nonce_low == 0) {
1490                         x->nonce_low += 1;
1491                         x->nonce_high += 1;
1492                 }
1493         }
1494
1495         SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
1496         SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
1497         SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
1498         SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
1499
1500         SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1501         SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1502         SSVAL(hdr, SMB2_HDR_EPOCH, 0);
1503         SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
1504         SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
1505
1506         SIVAL(hdr, SMB2_HDR_FLAGS, flags);
1507         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
1508         SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
1509         SBVAL(hdr, SMB2_HDR_PID, async_id);
1510         SBVAL(hdr, SMB2_HDR_SESSION_ID,
1511                 BVAL(outhdr, SMB2_HDR_SESSION_ID));
1512         memcpy(hdr+SMB2_HDR_SIGNATURE,
1513                outhdr+SMB2_HDR_SIGNATURE, 16);
1514
1515         SSVAL(body, 0x00, 0x08 + 1);
1516
1517         SCVAL(body, 0x02, 0);
1518         SCVAL(body, 0x03, 0);
1519         SIVAL(body, 0x04, 0);
1520         /* Match W2K8R2... */
1521         SCVAL(dyn,  0x00, 0x21);
1522
1523         state->vector[0].iov_base = (void *)state->buf;
1524         state->vector[0].iov_len = NBT_HDR_SIZE;
1525
1526         if (req->do_encryption) {
1527                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
1528                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    = tf_len;
1529         } else {
1530                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
1531                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
1532         }
1533
1534         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
1535         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
1536
1537         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
1538         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
1539
1540         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
1541         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len   = 1;
1542
1543         smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
1544
1545         /* Ensure we correctly go through crediting. Grant
1546            the credits now, and zero credits on the final
1547            response. */
1548         smb2_set_operation_credit(req->sconn,
1549                         SMBD_SMB2_IN_HDR_IOV(req),
1550                         &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
1551
1552         SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1553
1554         if (DEBUGLVL(10)) {
1555                 int i;
1556
1557                 for (i = 0; i < ARRAY_SIZE(state->vector); i++) {
1558                         dbgtext("\tstate->vector[%u/%u].iov_len = %u\n",
1559                                 (unsigned int)i,
1560                                 (unsigned int)ARRAY_SIZE(state->vector),
1561                                 (unsigned int)state->vector[i].iov_len);
1562                 }
1563         }
1564
1565         if (req->do_encryption) {
1566                 struct smbXsrv_session *x = req->session;
1567                 DATA_BLOB encryption_key = x->global->encryption_key;
1568
1569                 status = smb2_signing_encrypt_pdu(encryption_key,
1570                                         xconn->protocol,
1571                                         &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
1572                                         SMBD_SMB2_NUM_IOV_PER_REQ);
1573                 if (!NT_STATUS_IS_OK(status)) {
1574                         smbd_server_connection_terminate(req->sconn,
1575                                                 nt_errstr(status));
1576                         return;
1577                 }
1578         } else if (req->do_signing) {
1579                 struct smbXsrv_session *x = req->session;
1580                 DATA_BLOB signing_key = x->global->channels[0].signing_key;
1581
1582                 status = smb2_signing_sign_pdu(signing_key,
1583                                         xconn->protocol,
1584                                         &state->vector[1+SMBD_SMB2_HDR_IOV_OFS],
1585                                         SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1586                 if (!NT_STATUS_IS_OK(status)) {
1587                         smbd_server_connection_terminate(req->sconn,
1588                                                 nt_errstr(status));
1589                         return;
1590                 }
1591         }
1592
1593         state->queue_entry.mem_ctx = state;
1594         state->queue_entry.vector = state->vector;
1595         state->queue_entry.count = ARRAY_SIZE(state->vector);
1596         DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry, NULL);
1597         xconn->smb2.send_queue_len++;
1598
1599         status = smbd_smb2_flush_send_queue(sconn);
1600         if (!NT_STATUS_IS_OK(status)) {
1601                 smbd_server_connection_terminate(sconn,
1602                                                  nt_errstr(status));
1603                 return;
1604         }
1605 }
1606
1607 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
1608 {
1609         struct smbd_server_connection *sconn = req->sconn;
1610         struct smbd_smb2_request *cur;
1611         const uint8_t *inhdr;
1612         uint32_t flags;
1613         uint64_t search_message_id;
1614         uint64_t search_async_id;
1615         uint64_t found_id;
1616
1617         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1618
1619         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1620         search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1621         search_async_id = BVAL(inhdr, SMB2_HDR_PID);
1622
1623         /*
1624          * we don't need the request anymore
1625          * cancel requests never have a response
1626          */
1627         DLIST_REMOVE(req->sconn->smb2.requests, req);
1628         TALLOC_FREE(req);
1629
1630         for (cur = sconn->smb2.requests; cur; cur = cur->next) {
1631                 const uint8_t *outhdr;
1632                 uint64_t message_id;
1633                 uint64_t async_id;
1634
1635                 if (cur->compound_related) {
1636                         /*
1637                          * Never cancel anything in a compound request.
1638                          * Way too hard to deal with the result.
1639                          */
1640                         continue;
1641                 }
1642
1643                 outhdr = SMBD_SMB2_OUT_HDR_PTR(cur);
1644
1645                 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1646                 async_id = BVAL(outhdr, SMB2_HDR_PID);
1647
1648                 if (flags & SMB2_HDR_FLAG_ASYNC) {
1649                         if (search_async_id == async_id) {
1650                                 found_id = async_id;
1651                                 break;
1652                         }
1653                 } else {
1654                         if (search_message_id == message_id) {
1655                                 found_id = message_id;
1656                                 break;
1657                         }
1658                 }
1659         }
1660
1661         if (cur && cur->subreq) {
1662                 inhdr = SMBD_SMB2_IN_HDR_PTR(cur);
1663                 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1664                         "cancel opcode[%s] mid %llu\n",
1665                         smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1666                         (unsigned long long)found_id ));
1667                 tevent_req_cancel(cur->subreq);
1668         }
1669
1670         return NT_STATUS_OK;
1671 }
1672
1673 /*************************************************************
1674  Ensure an incoming tid is a valid one for us to access.
1675  Change to the associated uid credentials and chdir to the
1676  valid tid directory.
1677 *************************************************************/
1678
1679 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
1680 {
1681         const uint8_t *inhdr;
1682         uint32_t in_flags;
1683         uint32_t in_tid;
1684         struct smbXsrv_tcon *tcon;
1685         NTSTATUS status;
1686         NTTIME now = timeval_to_nttime(&req->request_time);
1687
1688         req->tcon = NULL;
1689
1690         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1691
1692         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1693         in_tid = IVAL(inhdr, SMB2_HDR_TID);
1694
1695         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1696                 in_tid = req->last_tid;
1697         }
1698
1699         req->last_tid = 0;
1700
1701         status = smb2srv_tcon_lookup(req->session,
1702                                      in_tid, now, &tcon);
1703         if (!NT_STATUS_IS_OK(status)) {
1704                 return status;
1705         }
1706
1707         if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
1708                 return NT_STATUS_ACCESS_DENIED;
1709         }
1710
1711         /* should we pass FLAG_CASELESS_PATHNAMES here? */
1712         if (!set_current_service(tcon->compat, 0, true)) {
1713                 return NT_STATUS_ACCESS_DENIED;
1714         }
1715
1716         req->tcon = tcon;
1717         req->last_tid = in_tid;
1718
1719         return NT_STATUS_OK;
1720 }
1721
1722 /*************************************************************
1723  Ensure an incoming session_id is a valid one for us to access.
1724 *************************************************************/
1725
1726 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
1727 {
1728         const uint8_t *inhdr;
1729         uint32_t in_flags;
1730         uint16_t in_opcode;
1731         uint64_t in_session_id;
1732         struct smbXsrv_session *session = NULL;
1733         struct auth_session_info *session_info;
1734         NTSTATUS status;
1735         NTTIME now = timeval_to_nttime(&req->request_time);
1736
1737         req->session = NULL;
1738         req->tcon = NULL;
1739
1740         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1741
1742         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1743         in_opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1744         in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
1745
1746         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1747                 in_session_id = req->last_session_id;
1748         }
1749
1750         req->last_session_id = 0;
1751
1752         /* lookup an existing session */
1753         status = smb2srv_session_lookup(req->sconn->conn,
1754                                         in_session_id, now,
1755                                         &session);
1756         if (session) {
1757                 req->session = session;
1758                 req->last_session_id = in_session_id;
1759         }
1760         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1761                 switch (in_opcode) {
1762                 case SMB2_OP_SESSSETUP:
1763                         status = NT_STATUS_OK;
1764                         break;
1765                 default:
1766                         break;
1767                 }
1768         }
1769         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1770                 switch (in_opcode) {
1771                 case SMB2_OP_TCON:
1772                 case SMB2_OP_CREATE:
1773                 case SMB2_OP_GETINFO:
1774                 case SMB2_OP_SETINFO:
1775                         return NT_STATUS_INVALID_HANDLE;
1776                 default:
1777                         /*
1778                          * Notice the check for
1779                          * (session_info == NULL)
1780                          * below.
1781                          */
1782                         status = NT_STATUS_OK;
1783                         break;
1784                 }
1785         }
1786         if (!NT_STATUS_IS_OK(status)) {
1787                 return status;
1788         }
1789
1790         session_info = session->global->auth_session_info;
1791         if (session_info == NULL) {
1792                 return NT_STATUS_INVALID_HANDLE;
1793         }
1794
1795         if (in_session_id != req->sconn->conn->last_session_id) {
1796                 req->sconn->conn->last_session_id = in_session_id;
1797                 set_current_user_info(session_info->unix_info->sanitized_username,
1798                                       session_info->unix_info->unix_name,
1799                                       session_info->info->domain_name);
1800         }
1801
1802         return NT_STATUS_OK;
1803 }
1804
1805 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
1806                                                 uint32_t data_length)
1807 {
1808         uint16_t needed_charge;
1809         uint16_t credit_charge = 1;
1810         const uint8_t *inhdr;
1811
1812         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1813
1814         if (req->sconn->smb2.supports_multicredit) {
1815                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
1816                 credit_charge = MAX(credit_charge, 1);
1817         }
1818
1819         needed_charge = (data_length - 1)/ 65536 + 1;
1820
1821         DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
1822                    (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
1823                    credit_charge, needed_charge));
1824
1825         if (needed_charge > credit_charge) {
1826                 DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
1827                           credit_charge, needed_charge));
1828                 return NT_STATUS_INVALID_PARAMETER;
1829         }
1830
1831         return NT_STATUS_OK;
1832 }
1833
1834 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
1835                                         size_t expected_body_size)
1836 {
1837         struct iovec *inhdr_v;
1838         const uint8_t *inhdr;
1839         uint16_t opcode;
1840         const uint8_t *inbody;
1841         size_t body_size;
1842         size_t min_dyn_size = expected_body_size & 0x00000001;
1843         int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
1844
1845         /*
1846          * The following should be checked already.
1847          */
1848         if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
1849                 return NT_STATUS_INTERNAL_ERROR;
1850         }
1851         if (req->current_idx > max_idx) {
1852                 return NT_STATUS_INTERNAL_ERROR;
1853         }
1854
1855         inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
1856         if (inhdr_v->iov_len != SMB2_HDR_BODY) {
1857                 return NT_STATUS_INTERNAL_ERROR;
1858         }
1859         if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
1860                 return NT_STATUS_INTERNAL_ERROR;
1861         }
1862
1863         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1864         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1865
1866         switch (opcode) {
1867         case SMB2_OP_IOCTL:
1868         case SMB2_OP_GETINFO:
1869                 min_dyn_size = 0;
1870                 break;
1871         case SMB2_OP_WRITE:
1872                 if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) {
1873                         if (req->smb1req->unread_bytes < min_dyn_size) {
1874                                 return NT_STATUS_INVALID_PARAMETER;
1875                         }
1876
1877                         min_dyn_size = 0;
1878                 }
1879                 break;
1880         }
1881
1882         /*
1883          * Now check the expected body size,
1884          * where the last byte might be in the
1885          * dynamic section..
1886          */
1887         if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
1888                 return NT_STATUS_INVALID_PARAMETER;
1889         }
1890         if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
1891                 return NT_STATUS_INVALID_PARAMETER;
1892         }
1893
1894         inbody = SMBD_SMB2_IN_BODY_PTR(req);
1895
1896         body_size = SVAL(inbody, 0x00);
1897         if (body_size != expected_body_size) {
1898                 return NT_STATUS_INVALID_PARAMETER;
1899         }
1900
1901         return NT_STATUS_OK;
1902 }
1903
1904 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
1905 {
1906         struct smbXsrv_connection *conn = req->sconn->conn;
1907         const struct smbd_smb2_dispatch_table *call = NULL;
1908         const struct iovec *intf_v = SMBD_SMB2_IN_TF_IOV(req);
1909         const uint8_t *inhdr;
1910         uint16_t opcode;
1911         uint32_t flags;
1912         uint64_t mid;
1913         NTSTATUS status;
1914         NTSTATUS session_status;
1915         uint32_t allowed_flags;
1916         NTSTATUS return_value;
1917         struct smbXsrv_session *x = NULL;
1918         bool signing_required = false;
1919         bool encryption_required = false;
1920
1921         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1922
1923         /* TODO: verify more things */
1924
1925         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1926         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1927         mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1928         DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
1929                 smb2_opcode_name(opcode),
1930                 (unsigned long long)mid));
1931
1932         if (conn->protocol >= PROTOCOL_SMB2_02) {
1933                 /*
1934                  * once the protocol is negotiated
1935                  * SMB2_OP_NEGPROT is not allowed anymore
1936                  */
1937                 if (opcode == SMB2_OP_NEGPROT) {
1938                         /* drop the connection */
1939                         return NT_STATUS_INVALID_PARAMETER;
1940                 }
1941         } else {
1942                 /*
1943                  * if the protocol is not negotiated yet
1944                  * only SMB2_OP_NEGPROT is allowed.
1945                  */
1946                 if (opcode != SMB2_OP_NEGPROT) {
1947                         /* drop the connection */
1948                         return NT_STATUS_INVALID_PARAMETER;
1949                 }
1950         }
1951
1952         /*
1953          * Check if the client provided a valid session id,
1954          * if so smbd_smb2_request_check_session() calls
1955          * set_current_user_info().
1956          *
1957          * As some command don't require a valid session id
1958          * we defer the check of the session_status
1959          */
1960         session_status = smbd_smb2_request_check_session(req);
1961         x = req->session;
1962         if (x != NULL) {
1963                 signing_required = x->global->signing_required;
1964                 encryption_required = x->global->encryption_required;
1965
1966                 if (opcode == SMB2_OP_SESSSETUP &&
1967                     x->global->channels[0].signing_key.length) {
1968                         signing_required = true;
1969                 }
1970         }
1971
1972         req->do_signing = false;
1973         req->do_encryption = false;
1974         if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
1975                 const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
1976                 uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
1977
1978                 if (x != NULL && x->global->session_wire_id != tf_session_id) {
1979                         DEBUG(0,("smbd_smb2_request_dispatch: invalid session_id"
1980                                  "in SMB2_HDR[%llu], SMB2_TF[%llu]\n",
1981                                  (unsigned long long)x->global->session_wire_id,
1982                                  (unsigned long long)tf_session_id));
1983                         /*
1984                          * TODO: windows allows this...
1985                          * should we drop the connection?
1986                          *
1987                          * For now we just return ACCESS_DENIED
1988                          * (Windows clients never trigger this)
1989                          * and wait for an update of [MS-SMB2].
1990                          */
1991                         return smbd_smb2_request_error(req,
1992                                         NT_STATUS_ACCESS_DENIED);
1993                 }
1994
1995                 req->do_encryption = true;
1996         }
1997
1998         if (encryption_required && !req->do_encryption) {
1999                 return smbd_smb2_request_error(req,
2000                                 NT_STATUS_ACCESS_DENIED);
2001         }
2002
2003         call = smbd_smb2_call(opcode);
2004         if (call == NULL) {
2005                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2006         }
2007
2008         allowed_flags = SMB2_HDR_FLAG_CHAINED |
2009                         SMB2_HDR_FLAG_SIGNED |
2010                         SMB2_HDR_FLAG_DFS;
2011         if (opcode == SMB2_OP_CANCEL) {
2012                 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
2013         }
2014         if ((flags & ~allowed_flags) != 0) {
2015                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2016         }
2017
2018         if (flags & SMB2_HDR_FLAG_CHAINED) {
2019                 /*
2020                  * This check is mostly for giving the correct error code
2021                  * for compounded requests.
2022                  */
2023                 if (!NT_STATUS_IS_OK(session_status)) {
2024                         return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2025                 }
2026         } else {
2027                 req->compat_chain_fsp = NULL;
2028         }
2029
2030         if (req->do_encryption) {
2031                 signing_required = false;
2032         } else if (signing_required || (flags & SMB2_HDR_FLAG_SIGNED)) {
2033                 DATA_BLOB signing_key;
2034
2035                 if (x == NULL) {
2036                         /*
2037                          * MS-SMB2: 3.3.5.2.4 Verifying the Signature.
2038                          * If the SMB2 header of the SMB2 NEGOTIATE
2039                          * request has the SMB2_FLAGS_SIGNED bit set in the
2040                          * Flags field, the server MUST fail the request
2041                          * with STATUS_INVALID_PARAMETER.
2042                          *
2043                          * Microsoft test tool checks this.
2044                          */
2045
2046                         if ((opcode == SMB2_OP_NEGPROT) &&
2047                                         (flags & SMB2_HDR_FLAG_SIGNED)) {
2048                                 status = NT_STATUS_INVALID_PARAMETER;
2049                         } else {
2050                                 status = NT_STATUS_USER_SESSION_DELETED;
2051                         }
2052                         return smbd_smb2_request_error(req, status);
2053                 }
2054
2055                 signing_key = x->global->channels[0].signing_key;
2056
2057                 /*
2058                  * If we have a signing key, we should
2059                  * sign the response
2060                  */
2061                 if (signing_key.length > 0) {
2062                         req->do_signing = true;
2063                 }
2064
2065                 status = smb2_signing_check_pdu(signing_key,
2066                                                 conn->protocol,
2067                                                 SMBD_SMB2_IN_HDR_IOV(req),
2068                                                 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2069                 if (!NT_STATUS_IS_OK(status)) {
2070                         return smbd_smb2_request_error(req, status);
2071                 }
2072
2073                 /*
2074                  * Now that we know the request was correctly signed
2075                  * we have to sign the response too.
2076                  */
2077                 req->do_signing = true;
2078
2079                 if (!NT_STATUS_IS_OK(session_status)) {
2080                         return smbd_smb2_request_error(req, session_status);
2081                 }
2082         } else if (opcode == SMB2_OP_CANCEL) {
2083                 /* Cancel requests are allowed to skip the signing */
2084         } else if (signing_required) {
2085                 /*
2086                  * If signing is required we try to sign
2087                  * a possible error response
2088                  */
2089                 req->do_signing = true;
2090                 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
2091         }
2092
2093         if (flags & SMB2_HDR_FLAG_CHAINED) {
2094                 req->compound_related = true;
2095         }
2096
2097         if (call->need_session) {
2098                 if (!NT_STATUS_IS_OK(session_status)) {
2099                         return smbd_smb2_request_error(req, session_status);
2100                 }
2101         }
2102
2103         if (call->need_tcon) {
2104                 SMB_ASSERT(call->need_session);
2105
2106                 /*
2107                  * This call needs to be run as user.
2108                  *
2109                  * smbd_smb2_request_check_tcon()
2110                  * calls change_to_user() on success.
2111                  */
2112                 status = smbd_smb2_request_check_tcon(req);
2113                 if (!NT_STATUS_IS_OK(status)) {
2114                         return smbd_smb2_request_error(req, status);
2115                 }
2116                 if (req->tcon->global->encryption_required) {
2117                         encryption_required = true;
2118                 }
2119                 if (encryption_required && !req->do_encryption) {
2120                         return smbd_smb2_request_error(req,
2121                                 NT_STATUS_ACCESS_DENIED);
2122                 }
2123         }
2124
2125         if (call->fileid_ofs != 0) {
2126                 size_t needed = call->fileid_ofs + 16;
2127                 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
2128                 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
2129                 uint64_t file_id_persistent;
2130                 uint64_t file_id_volatile;
2131                 struct files_struct *fsp;
2132
2133                 SMB_ASSERT(call->need_tcon);
2134
2135                 if (needed > body_size) {
2136                         return smbd_smb2_request_error(req,
2137                                         NT_STATUS_INVALID_PARAMETER);
2138                 }
2139
2140                 file_id_persistent      = BVAL(body, call->fileid_ofs + 0);
2141                 file_id_volatile        = BVAL(body, call->fileid_ofs + 8);
2142
2143                 fsp = file_fsp_smb2(req, file_id_persistent, file_id_volatile);
2144                 if (fsp == NULL) {
2145                         if (!call->allow_invalid_fileid) {
2146                                 return smbd_smb2_request_error(req,
2147                                                 NT_STATUS_FILE_CLOSED);
2148                         }
2149
2150                         if (file_id_persistent != UINT64_MAX) {
2151                                 return smbd_smb2_request_error(req,
2152                                                 NT_STATUS_FILE_CLOSED);
2153                         }
2154                         if (file_id_volatile != UINT64_MAX) {
2155                                 return smbd_smb2_request_error(req,
2156                                                 NT_STATUS_FILE_CLOSED);
2157                         }
2158                 }
2159         }
2160
2161         if (call->as_root) {
2162                 SMB_ASSERT(call->fileid_ofs == 0);
2163                 /* This call needs to be run as root */
2164                 change_to_root_user();
2165         } else {
2166                 SMB_ASSERT(call->need_tcon);
2167         }
2168
2169         switch (opcode) {
2170         case SMB2_OP_NEGPROT:
2171                 {
2172                         START_PROFILE(smb2_negprot);
2173                         return_value = smbd_smb2_request_process_negprot(req);
2174                         END_PROFILE(smb2_negprot);
2175                 }
2176                 break;
2177
2178         case SMB2_OP_SESSSETUP:
2179                 {
2180                         START_PROFILE(smb2_sesssetup);
2181                         return_value = smbd_smb2_request_process_sesssetup(req);
2182                         END_PROFILE(smb2_sesssetup);
2183                 }
2184                 break;
2185
2186         case SMB2_OP_LOGOFF:
2187                 {
2188                         START_PROFILE(smb2_logoff);
2189                         return_value = smbd_smb2_request_process_logoff(req);
2190                         END_PROFILE(smb2_logoff);
2191                 }
2192                 break;
2193
2194         case SMB2_OP_TCON:
2195                 {
2196                         START_PROFILE(smb2_tcon);
2197                         return_value = smbd_smb2_request_process_tcon(req);
2198                         END_PROFILE(smb2_tcon);
2199                 }
2200                 break;
2201
2202         case SMB2_OP_TDIS:
2203                 {
2204                         START_PROFILE(smb2_tdis);
2205                         return_value = smbd_smb2_request_process_tdis(req);
2206                         END_PROFILE(smb2_tdis);
2207                 }
2208                 break;
2209
2210         case SMB2_OP_CREATE:
2211                 {
2212                         START_PROFILE(smb2_create);
2213                         return_value = smbd_smb2_request_process_create(req);
2214                         END_PROFILE(smb2_create);
2215                 }
2216                 break;
2217
2218         case SMB2_OP_CLOSE:
2219                 {
2220                         START_PROFILE(smb2_close);
2221                         return_value = smbd_smb2_request_process_close(req);
2222                         END_PROFILE(smb2_close);
2223                 }
2224                 break;
2225
2226         case SMB2_OP_FLUSH:
2227                 {
2228                         START_PROFILE(smb2_flush);
2229                         return_value = smbd_smb2_request_process_flush(req);
2230                         END_PROFILE(smb2_flush);
2231                 }
2232                 break;
2233
2234         case SMB2_OP_READ:
2235                 {
2236                         START_PROFILE(smb2_read);
2237                         return_value = smbd_smb2_request_process_read(req);
2238                         END_PROFILE(smb2_read);
2239                 }
2240                 break;
2241
2242         case SMB2_OP_WRITE:
2243                 {
2244                         START_PROFILE(smb2_write);
2245                         return_value = smbd_smb2_request_process_write(req);
2246                         END_PROFILE(smb2_write);
2247                 }
2248                 break;
2249
2250         case SMB2_OP_LOCK:
2251                 {
2252                         START_PROFILE(smb2_lock);
2253                         return_value = smbd_smb2_request_process_lock(req);
2254                         END_PROFILE(smb2_lock);
2255                 }
2256                 break;
2257
2258         case SMB2_OP_IOCTL:
2259                 {
2260                         START_PROFILE(smb2_ioctl);
2261                         return_value = smbd_smb2_request_process_ioctl(req);
2262                         END_PROFILE(smb2_ioctl);
2263                 }
2264                 break;
2265
2266         case SMB2_OP_CANCEL:
2267                 {
2268                         START_PROFILE(smb2_cancel);
2269                         return_value = smbd_smb2_request_process_cancel(req);
2270                         END_PROFILE(smb2_cancel);
2271                 }
2272                 break;
2273
2274         case SMB2_OP_KEEPALIVE:
2275                 {
2276                         START_PROFILE(smb2_keepalive);
2277                         return_value = smbd_smb2_request_process_keepalive(req);
2278                         END_PROFILE(smb2_keepalive);
2279                 }
2280                 break;
2281
2282         case SMB2_OP_FIND:
2283                 {
2284                         START_PROFILE(smb2_find);
2285                         return_value = smbd_smb2_request_process_find(req);
2286                         END_PROFILE(smb2_find);
2287                 }
2288                 break;
2289
2290         case SMB2_OP_NOTIFY:
2291                 {
2292                         START_PROFILE(smb2_notify);
2293                         return_value = smbd_smb2_request_process_notify(req);
2294                         END_PROFILE(smb2_notify);
2295                 }
2296                 break;
2297
2298         case SMB2_OP_GETINFO:
2299                 {
2300                         START_PROFILE(smb2_getinfo);
2301                         return_value = smbd_smb2_request_process_getinfo(req);
2302                         END_PROFILE(smb2_getinfo);
2303                 }
2304                 break;
2305
2306         case SMB2_OP_SETINFO:
2307                 {
2308                         START_PROFILE(smb2_setinfo);
2309                         return_value = smbd_smb2_request_process_setinfo(req);
2310                         END_PROFILE(smb2_setinfo);
2311                 }
2312                 break;
2313
2314         case SMB2_OP_BREAK:
2315                 {
2316                         START_PROFILE(smb2_break);
2317                         return_value = smbd_smb2_request_process_break(req);
2318                         END_PROFILE(smb2_break);
2319                 }
2320                 break;
2321
2322         default:
2323                 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2324                 break;
2325         }
2326         return return_value;
2327 }
2328
2329 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
2330 {
2331         struct smbd_server_connection *sconn = req->sconn;
2332         struct smbXsrv_connection *conn = req->sconn->conn;
2333         int first_idx = 1;
2334         struct iovec *firsttf = SMBD_SMB2_IDX_TF_IOV(req,out,first_idx);
2335         struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
2336         struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
2337         NTSTATUS status;
2338
2339         req->subreq = NULL;
2340         TALLOC_FREE(req->async_te);
2341
2342         if (req->do_encryption &&
2343             (firsttf->iov_len == 0) &&
2344             (req->first_key.length == 0) &&
2345             (req->session != NULL) &&
2346             (req->session->global->encryption_key.length != 0))
2347         {
2348                 DATA_BLOB encryption_key = req->session->global->encryption_key;
2349                 uint8_t *tf;
2350                 uint64_t session_id = req->session->global->session_wire_id;
2351                 struct smbXsrv_session *x = req->session;
2352                 uint64_t nonce_high;
2353                 uint64_t nonce_low;
2354
2355                 nonce_high = x->nonce_high;
2356                 nonce_low = x->nonce_low;
2357
2358                 x->nonce_low += 1;
2359                 if (x->nonce_low == 0) {
2360                         x->nonce_low += 1;
2361                         x->nonce_high += 1;
2362                 }
2363
2364                 /*
2365                  * We need to place the SMB2_TRANSFORM header before the
2366                  * first SMB2 header
2367                  */
2368
2369                 /*
2370                  * we need to remember the encryption key
2371                  * and defer the signing/encryption until
2372                  * we are sure that we do not change
2373                  * the header again.
2374                  */
2375                 req->first_key = data_blob_dup_talloc(req, encryption_key);
2376                 if (req->first_key.data == NULL) {
2377                         return NT_STATUS_NO_MEMORY;
2378                 }
2379
2380                 tf = talloc_zero_array(req, uint8_t,
2381                                        SMB2_TF_HDR_SIZE);
2382                 if (tf == NULL) {
2383                         return NT_STATUS_NO_MEMORY;
2384                 }
2385
2386                 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2387                 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2388                 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2389                 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
2390
2391                 firsttf->iov_base = (void *)tf;
2392                 firsttf->iov_len = SMB2_TF_HDR_SIZE;
2393         }
2394
2395         if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
2396             (req->last_key.length > 0) &&
2397             (firsttf->iov_len == 0))
2398         {
2399                 int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
2400                 struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
2401
2402                 /*
2403                  * As we are sure the header of the last request in the
2404                  * compound chain will not change, we can to sign here
2405                  * with the last signing key we remembered.
2406                  */
2407                 status = smb2_signing_sign_pdu(req->last_key,
2408                                                conn->protocol,
2409                                                lasthdr,
2410                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2411                 if (!NT_STATUS_IS_OK(status)) {
2412                         return status;
2413                 }
2414         }
2415         if (req->last_key.length > 0) {
2416                 data_blob_clear_free(&req->last_key);
2417         }
2418
2419         req->current_idx += SMBD_SMB2_NUM_IOV_PER_REQ;
2420
2421         if (req->current_idx < req->out.vector_count) {
2422                 /*
2423                  * We must process the remaining compound
2424                  * SMB2 requests before any new incoming SMB2
2425                  * requests. This is because incoming SMB2
2426                  * requests may include a cancel for a
2427                  * compound request we haven't processed
2428                  * yet.
2429                  */
2430                 struct tevent_immediate *im = tevent_create_immediate(req);
2431                 if (!im) {
2432                         return NT_STATUS_NO_MEMORY;
2433                 }
2434
2435                 if (req->do_signing && firsttf->iov_len == 0) {
2436                         struct smbXsrv_session *x = req->session;
2437                         DATA_BLOB signing_key = x->global->channels[0].signing_key;
2438
2439                         /*
2440                          * we need to remember the signing key
2441                          * and defer the signing until
2442                          * we are sure that we do not change
2443                          * the header again.
2444                          */
2445                         req->last_key = data_blob_dup_talloc(req, signing_key);
2446                         if (req->last_key.data == NULL) {
2447                                 return NT_STATUS_NO_MEMORY;
2448                         }
2449                 }
2450
2451                 tevent_schedule_immediate(im,
2452                                         req->sconn->ev_ctx,
2453                                         smbd_smb2_request_dispatch_immediate,
2454                                         req);
2455                 return NT_STATUS_OK;
2456         }
2457
2458         if (req->compound_related) {
2459                 req->compound_related = false;
2460         }
2461
2462         smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
2463
2464         /* Set credit for these operations (zero credits if this
2465            is a final reply for an async operation). */
2466         smb2_calculate_credits(req, req);
2467
2468         /*
2469          * now check if we need to sign the current response
2470          */
2471         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
2472                 status = smb2_signing_encrypt_pdu(req->first_key,
2473                                         conn->protocol,
2474                                         firsttf,
2475                                         req->out.vector_count - first_idx);
2476                 if (!NT_STATUS_IS_OK(status)) {
2477                         return status;
2478                 }
2479         } else if (req->do_signing) {
2480                 struct smbXsrv_session *x = req->session;
2481                 DATA_BLOB signing_key = x->global->channels[0].signing_key;
2482
2483                 status = smb2_signing_sign_pdu(signing_key,
2484                                                conn->protocol,
2485                                                outhdr,
2486                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2487                 if (!NT_STATUS_IS_OK(status)) {
2488                         return status;
2489                 }
2490         }
2491         if (req->first_key.length > 0) {
2492                 data_blob_clear_free(&req->first_key);
2493         }
2494
2495         /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
2496         if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
2497             outdyn->iov_base == NULL && outdyn->iov_len != 0) {
2498                 /* Dynamic part is NULL. Chop it off,
2499                    We're going to send it via sendfile. */
2500                 req->out.vector_count -= 1;
2501         }
2502
2503         /*
2504          * We're done with this request -
2505          * move it off the "being processed" queue.
2506          */
2507         DLIST_REMOVE(req->sconn->smb2.requests, req);
2508
2509         req->queue_entry.mem_ctx = req;
2510         req->queue_entry.vector = req->out.vector;
2511         req->queue_entry.count = req->out.vector_count;
2512         DLIST_ADD_END(conn->smb2.send_queue, &req->queue_entry, NULL);
2513         conn->smb2.send_queue_len++;
2514
2515         status = smbd_smb2_flush_send_queue(sconn);
2516         if (!NT_STATUS_IS_OK(status)) {
2517                 return status;
2518         }
2519
2520         return NT_STATUS_OK;
2521 }
2522
2523 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn);
2524
2525 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
2526                                         struct tevent_immediate *im,
2527                                         void *private_data)
2528 {
2529         struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
2530                                         struct smbd_smb2_request);
2531         struct smbd_server_connection *sconn = req->sconn;
2532         NTSTATUS status;
2533
2534         TALLOC_FREE(im);
2535
2536         if (DEBUGLEVEL >= 10) {
2537                 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
2538                         req->current_idx, req->in.vector_count));
2539                 print_req_vectors(req);
2540         }
2541
2542         status = smbd_smb2_request_dispatch(req);
2543         if (!NT_STATUS_IS_OK(status)) {
2544                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2545                 return;
2546         }
2547
2548         status = smbd_smb2_request_next_incoming(sconn);
2549         if (!NT_STATUS_IS_OK(status)) {
2550                 smbd_server_connection_terminate(sconn, nt_errstr(status));
2551                 return;
2552         }
2553 }
2554
2555 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
2556                                    NTSTATUS status,
2557                                    DATA_BLOB body, DATA_BLOB *dyn,
2558                                    const char *location)
2559 {
2560         uint8_t *outhdr;
2561         struct iovec *outbody_v;
2562         struct iovec *outdyn_v;
2563         uint32_t next_command_ofs;
2564
2565         DEBUG(10,("smbd_smb2_request_done_ex: "
2566                   "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
2567                   req->current_idx, nt_errstr(status), (unsigned int)body.length,
2568                   dyn ? "yes": "no",
2569                   (unsigned int)(dyn ? dyn->length : 0),
2570                   location));
2571
2572         if (body.length < 2) {
2573                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2574         }
2575
2576         if ((body.length % 2) != 0) {
2577                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
2578         }
2579
2580         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2581         outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
2582         outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
2583
2584         next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
2585         SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
2586
2587         outbody_v->iov_base = (void *)body.data;
2588         outbody_v->iov_len = body.length;
2589
2590         if (dyn) {
2591                 outdyn_v->iov_base = (void *)dyn->data;
2592                 outdyn_v->iov_len = dyn->length;
2593         } else {
2594                 outdyn_v->iov_base = NULL;
2595                 outdyn_v->iov_len = 0;
2596         }
2597
2598         /* see if we need to recalculate the offset to the next response */
2599         if (next_command_ofs > 0) {
2600                 next_command_ofs  = SMB2_HDR_BODY;
2601                 next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
2602                 next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
2603         }
2604
2605         if ((next_command_ofs % 8) != 0) {
2606                 size_t pad_size = 8 - (next_command_ofs % 8);
2607                 if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
2608                         /*
2609                          * if the dyn buffer is empty
2610                          * we can use it to add padding
2611                          */
2612                         uint8_t *pad;
2613
2614                         pad = talloc_zero_array(req,
2615                                                 uint8_t, pad_size);
2616                         if (pad == NULL) {
2617                                 return smbd_smb2_request_error(req,
2618                                                 NT_STATUS_NO_MEMORY);
2619                         }
2620
2621                         outdyn_v->iov_base = (void *)pad;
2622                         outdyn_v->iov_len = pad_size;
2623                 } else {
2624                         /*
2625                          * For now we copy the dynamic buffer
2626                          * and add the padding to the new buffer
2627                          */
2628                         size_t old_size;
2629                         uint8_t *old_dyn;
2630                         size_t new_size;
2631                         uint8_t *new_dyn;
2632
2633                         old_size = SMBD_SMB2_OUT_DYN_LEN(req);
2634                         old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
2635
2636                         new_size = old_size + pad_size;
2637                         new_dyn = talloc_zero_array(req,
2638                                                uint8_t, new_size);
2639                         if (new_dyn == NULL) {
2640                                 return smbd_smb2_request_error(req,
2641                                                 NT_STATUS_NO_MEMORY);
2642                         }
2643
2644                         memcpy(new_dyn, old_dyn, old_size);
2645                         memset(new_dyn + old_size, 0, pad_size);
2646
2647                         outdyn_v->iov_base = (void *)new_dyn;
2648                         outdyn_v->iov_len = new_size;
2649                 }
2650                 next_command_ofs += pad_size;
2651         }
2652
2653         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
2654
2655         return smbd_smb2_request_reply(req);
2656 }
2657
2658 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
2659                                     NTSTATUS status,
2660                                     DATA_BLOB *info,
2661                                     const char *location)
2662 {
2663         struct smbXsrv_connection *xconn = req->sconn->conn;
2664         DATA_BLOB body;
2665         DATA_BLOB _dyn;
2666         uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
2667         size_t unread_bytes = smbd_smb2_unread_bytes(req);
2668
2669         DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
2670                   req->current_idx, nt_errstr(status), info ? " +info" : "",
2671                   location));
2672
2673         if (unread_bytes) {
2674                 /* Recvfile error. Drain incoming socket. */
2675                 size_t ret;
2676
2677                 errno = 0;
2678                 ret = drain_socket(xconn->transport.sock, unread_bytes);
2679                 if (ret != unread_bytes) {
2680                         NTSTATUS error;
2681
2682                         if (errno == 0) {
2683                                 error = NT_STATUS_IO_DEVICE_ERROR;
2684                         } else {
2685                                 error = map_nt_error_from_unix_common(errno);
2686                         }
2687
2688                         DEBUG(2, ("Failed to drain %u bytes from SMB2 socket: "
2689                                   "ret[%u] errno[%d] => %s\n",
2690                                   (unsigned)unread_bytes,
2691                                   (unsigned)ret, errno, nt_errstr(error)));
2692                         return error;
2693                 }
2694         }
2695
2696         body.data = outhdr + SMB2_HDR_BODY;
2697         body.length = 8;
2698         SSVAL(body.data, 0, 9);
2699
2700         if (info) {
2701                 SIVAL(body.data, 0x04, info->length);
2702         } else {
2703                 /* Allocated size of req->out.vector[i].iov_base
2704                  * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
2705                  * 1 byte without having to do an alloc.
2706                  */
2707                 info = &_dyn;
2708                 info->data = ((uint8_t *)outhdr) +
2709                         OUTVEC_ALLOC_SIZE - 1;
2710                 info->length = 1;
2711                 SCVAL(info->data, 0, 0);
2712         }
2713
2714         /*
2715          * Note: Even if there is an error, continue to process the request.
2716          * per MS-SMB2.
2717          */
2718
2719         return smbd_smb2_request_done_ex(req, status, body, info, __location__);
2720 }
2721
2722
2723 struct smbd_smb2_send_break_state {
2724         struct smbd_server_connection *sconn;
2725         struct smbd_smb2_send_queue queue_entry;
2726         uint8_t nbt_hdr[NBT_HDR_SIZE];
2727         uint8_t tf[SMB2_TF_HDR_SIZE];
2728         uint8_t hdr[SMB2_HDR_BODY];
2729         struct iovec vector[1+SMBD_SMB2_NUM_IOV_PER_REQ];
2730         uint8_t body[1];
2731 };
2732
2733 static NTSTATUS smbd_smb2_send_break(struct smbd_server_connection *sconn,
2734                                      struct smbXsrv_session *session,
2735                                      struct smbXsrv_tcon *tcon,
2736                                      const uint8_t *body,
2737                                      size_t body_len)
2738 {
2739         struct smbd_smb2_send_break_state *state;
2740         struct smbXsrv_connection *conn = sconn->conn;
2741         bool do_encryption = session->global->encryption_required;
2742         uint64_t nonce_high = 0;
2743         uint64_t nonce_low = 0;
2744         NTSTATUS status;
2745         size_t statelen;
2746
2747         if (tcon->global->encryption_required) {
2748                 do_encryption = true;
2749         }
2750
2751         statelen = offsetof(struct smbd_smb2_send_break_state, body) +
2752                 body_len;
2753
2754         state = talloc_zero_size(sconn, statelen);
2755         if (state == NULL) {
2756                 return NT_STATUS_NO_MEMORY;
2757         }
2758         talloc_set_name_const(state, "struct smbd_smb2_send_break_state");
2759         state->sconn = sconn;
2760
2761         if (do_encryption) {
2762                 nonce_high = session->nonce_high;
2763                 nonce_low = session->nonce_low;
2764
2765                 session->nonce_low += 1;
2766                 if (session->nonce_low == 0) {
2767                         session->nonce_low += 1;
2768                         session->nonce_high += 1;
2769                 }
2770         }
2771
2772         SIVAL(state->tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2773         SBVAL(state->tf, SMB2_TF_NONCE+0, nonce_low);
2774         SBVAL(state->tf, SMB2_TF_NONCE+8, nonce_high);
2775         SBVAL(state->tf, SMB2_TF_SESSION_ID, session->global->session_wire_id);
2776
2777         SIVAL(state->hdr, 0,                            SMB2_MAGIC);
2778         SSVAL(state->hdr, SMB2_HDR_LENGTH,              SMB2_HDR_BODY);
2779         SSVAL(state->hdr, SMB2_HDR_EPOCH,               0);
2780         SIVAL(state->hdr, SMB2_HDR_STATUS,              0);
2781         SSVAL(state->hdr, SMB2_HDR_OPCODE,              SMB2_OP_BREAK);
2782         SSVAL(state->hdr, SMB2_HDR_CREDIT,              0);
2783         SIVAL(state->hdr, SMB2_HDR_FLAGS,               SMB2_HDR_FLAG_REDIRECT);
2784         SIVAL(state->hdr, SMB2_HDR_NEXT_COMMAND,        0);
2785         SBVAL(state->hdr, SMB2_HDR_MESSAGE_ID,          UINT64_MAX);
2786         SIVAL(state->hdr, SMB2_HDR_PID,         0);
2787         SIVAL(state->hdr, SMB2_HDR_TID,         0);
2788         SBVAL(state->hdr, SMB2_HDR_SESSION_ID,          0);
2789         memset(state->hdr+SMB2_HDR_SIGNATURE, 0, 16);
2790
2791         state->vector[0] = (struct iovec) {
2792                 .iov_base = state->nbt_hdr,
2793                 .iov_len  = sizeof(state->nbt_hdr)
2794         };
2795
2796         if (do_encryption) {
2797                 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
2798                         .iov_base = state->tf,
2799                         .iov_len  = sizeof(state->tf)
2800                 };
2801         } else {
2802                 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
2803                         .iov_base = NULL,
2804                         .iov_len  = 0
2805                 };
2806         }
2807
2808         state->vector[1+SMBD_SMB2_HDR_IOV_OFS] = (struct iovec) {
2809                 .iov_base = state->hdr,
2810                 .iov_len  = sizeof(state->hdr)
2811         };
2812
2813         memcpy(state->body, body, body_len);
2814
2815         state->vector[1+SMBD_SMB2_BODY_IOV_OFS] = (struct iovec) {
2816                 .iov_base = state->body,
2817                 .iov_len  = body_len /* no sizeof(state->body) .. :-) */
2818         };
2819
2820         /*
2821          * state->vector[1+SMBD_SMB2_DYN_IOV_OFS] is NULL by talloc_zero above
2822          */
2823
2824         smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
2825
2826         if (do_encryption) {
2827                 DATA_BLOB encryption_key = session->global->encryption_key;
2828
2829                 status = smb2_signing_encrypt_pdu(encryption_key,
2830                                         conn->protocol,
2831                                         &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
2832                                         SMBD_SMB2_NUM_IOV_PER_REQ);
2833                 if (!NT_STATUS_IS_OK(status)) {
2834                         return status;
2835                 }
2836         }
2837
2838         state->queue_entry.mem_ctx = state;
2839         state->queue_entry.vector = state->vector;
2840         state->queue_entry.count = ARRAY_SIZE(state->vector);
2841         DLIST_ADD_END(conn->smb2.send_queue, &state->queue_entry, NULL);
2842         conn->smb2.send_queue_len++;
2843
2844         status = smbd_smb2_flush_send_queue(sconn);
2845         if (!NT_STATUS_IS_OK(status)) {
2846                 return status;
2847         }
2848
2849         return NT_STATUS_OK;
2850 }
2851
2852 NTSTATUS smbd_smb2_send_oplock_break(struct smbd_server_connection *sconn,
2853                                      struct smbXsrv_session *session,
2854                                      struct smbXsrv_tcon *tcon,
2855                                      struct smbXsrv_open *op,
2856                                      uint8_t oplock_level)
2857 {
2858         uint8_t body[0x18];
2859
2860         SSVAL(body, 0x00, sizeof(body));
2861         SCVAL(body, 0x02, oplock_level);
2862         SCVAL(body, 0x03, 0);           /* reserved */
2863         SIVAL(body, 0x04, 0);           /* reserved */
2864         SBVAL(body, 0x08, op->global->open_persistent_id);
2865         SBVAL(body, 0x10, op->global->open_volatile_id);
2866
2867         return smbd_smb2_send_break(sconn, session, tcon, body, sizeof(body));
2868 }
2869
2870 static bool is_smb2_recvfile_write(struct smbd_smb2_request_read_state *state)
2871 {
2872         NTSTATUS status;
2873         uint32_t flags;
2874         uint64_t file_id_persistent;
2875         uint64_t file_id_volatile;
2876         struct smbXsrv_open *op = NULL;
2877         struct files_struct *fsp = NULL;
2878         const uint8_t *body = NULL;
2879
2880         /*
2881          * This is only called with a pktbuf
2882          * of at least SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN
2883          * bytes
2884          */
2885
2886         if (IVAL(state->pktbuf, 0) == SMB2_TF_MAGIC) {
2887                 /* Transform header. Cannot recvfile. */
2888                 return false;
2889         }
2890         if (IVAL(state->pktbuf, 0) != SMB2_MAGIC) {
2891                 /* Not SMB2. Normal error path will cope. */
2892                 return false;
2893         }
2894         if (SVAL(state->pktbuf, 4) != SMB2_HDR_BODY) {
2895                 /* Not SMB2. Normal error path will cope. */
2896                 return false;
2897         }
2898         if (SVAL(state->pktbuf, SMB2_HDR_OPCODE) != SMB2_OP_WRITE) {
2899                 /* Needs to be a WRITE. */
2900                 return false;
2901         }
2902         if (IVAL(state->pktbuf, SMB2_HDR_NEXT_COMMAND) != 0) {
2903                 /* Chained. Cannot recvfile. */
2904                 return false;
2905         }
2906         flags = IVAL(state->pktbuf, SMB2_HDR_FLAGS);
2907         if (flags & SMB2_HDR_FLAG_CHAINED) {
2908                 /* Chained. Cannot recvfile. */
2909                 return false;
2910         }
2911         if (flags & SMB2_HDR_FLAG_SIGNED) {
2912                 /* Signed. Cannot recvfile. */
2913                 return false;
2914         }
2915
2916         body = &state->pktbuf[SMB2_HDR_BODY];
2917
2918         file_id_persistent      = BVAL(body, 0x10);
2919         file_id_volatile        = BVAL(body, 0x18);
2920
2921         status = smb2srv_open_lookup(state->req->sconn->conn,
2922                                      file_id_persistent,
2923                                      file_id_volatile,
2924                                      0, /* now */
2925                                      &op);
2926         if (!NT_STATUS_IS_OK(status)) {
2927                 return false;
2928         }
2929
2930         fsp = op->compat;
2931         if (fsp == NULL) {
2932                 return false;
2933         }
2934         if (fsp->conn == NULL) {
2935                 return false;
2936         }
2937
2938         if (IS_IPC(fsp->conn)) {
2939                 return false;
2940         }
2941         if (IS_PRINT(fsp->conn)) {
2942                 return false;
2943         }
2944
2945         DEBUG(10,("Doing recvfile write len = %u\n",
2946                 (unsigned int)(state->pktfull - state->pktlen)));
2947
2948         return true;
2949 }
2950
2951 static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn)
2952 {
2953         struct smbXsrv_connection *xconn = sconn->conn;
2954         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
2955         size_t max_send_queue_len;
2956         size_t cur_send_queue_len;
2957
2958         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2959                 /*
2960                  * we're not supposed to do any io
2961                  */
2962                 return NT_STATUS_OK;
2963         }
2964
2965         if (state->req != NULL) {
2966                 /*
2967                  * if there is already a tstream_readv_pdu
2968                  * pending, we are done.
2969                  */
2970                 return NT_STATUS_OK;
2971         }
2972
2973         max_send_queue_len = MAX(1, sconn->smb2.max_credits/16);
2974         cur_send_queue_len = xconn->smb2.send_queue_len;
2975
2976         if (cur_send_queue_len > max_send_queue_len) {
2977                 /*
2978                  * if we have a lot of requests to send,
2979                  * we wait until they are on the wire until we
2980                  * ask for the next request.
2981                  */
2982                 return NT_STATUS_OK;
2983         }
2984
2985         /* ask for the next request */
2986         ZERO_STRUCTP(state);
2987         state->req = smbd_smb2_request_allocate(sconn);
2988         if (state->req == NULL) {
2989                 return NT_STATUS_NO_MEMORY;
2990         }
2991         state->req->sconn = sconn;
2992         state->min_recv_size = lp_min_receive_file_size();
2993
2994         TEVENT_FD_READABLE(xconn->transport.fde);
2995
2996         return NT_STATUS_OK;
2997 }
2998
2999 void smbd_smb2_first_negprot(struct smbd_server_connection *sconn,
3000                              uint8_t *inbuf, size_t size)
3001 {
3002         NTSTATUS status;
3003         struct smbd_smb2_request *req = NULL;
3004
3005         DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
3006                  (unsigned int)size));
3007
3008         status = smbd_initialize_smb2(sconn);
3009         if (!NT_STATUS_IS_OK(status)) {
3010                 smbd_server_connection_terminate(sconn, nt_errstr(status));
3011                 return;
3012         }
3013
3014         status = smbd_smb2_request_create(sconn, inbuf, size, &req);
3015         if (!NT_STATUS_IS_OK(status)) {
3016                 smbd_server_connection_terminate(sconn, nt_errstr(status));
3017                 return;
3018         }
3019
3020         status = smbd_smb2_request_validate(req);
3021         if (!NT_STATUS_IS_OK(status)) {
3022                 smbd_server_connection_terminate(sconn, nt_errstr(status));
3023                 return;
3024         }
3025
3026         status = smbd_smb2_request_setup_out(req);
3027         if (!NT_STATUS_IS_OK(status)) {
3028                 smbd_server_connection_terminate(sconn, nt_errstr(status));
3029                 return;
3030         }
3031
3032         status = smbd_smb2_request_dispatch(req);
3033         if (!NT_STATUS_IS_OK(status)) {
3034                 smbd_server_connection_terminate(sconn, nt_errstr(status));
3035                 return;
3036         }
3037
3038         status = smbd_smb2_request_next_incoming(sconn);
3039         if (!NT_STATUS_IS_OK(status)) {
3040                 smbd_server_connection_terminate(sconn, nt_errstr(status));
3041                 return;
3042         }
3043
3044         sconn->num_requests++;
3045 }
3046
3047 static int socket_error_from_errno(int ret,
3048                                    int sys_errno,
3049                                    bool *retry)
3050 {
3051         *retry = false;
3052
3053         if (ret >= 0) {
3054                 return 0;
3055         }
3056
3057         if (ret != -1) {
3058                 return EIO;
3059         }
3060
3061         if (sys_errno == 0) {
3062                 return EIO;
3063         }
3064
3065         if (sys_errno == EINTR) {
3066                 *retry = true;
3067                 return sys_errno;
3068         }
3069
3070         if (sys_errno == EINPROGRESS) {
3071                 *retry = true;
3072                 return sys_errno;
3073         }
3074
3075         if (sys_errno == EAGAIN) {
3076                 *retry = true;
3077                 return sys_errno;
3078         }
3079
3080         /* ENOMEM is retryable on Solaris/illumos, and possibly other systems. */
3081         if (sys_errno == ENOMEM) {
3082                 *retry = true;
3083                 return sys_errno;
3084         }
3085
3086 #ifdef EWOULDBLOCK
3087 #if EWOULDBLOCK != EAGAIN
3088         if (sys_errno == EWOULDBLOCK) {
3089                 *retry = true;
3090                 return sys_errno;
3091         }
3092 #endif
3093 #endif
3094
3095         return sys_errno;
3096 }
3097
3098 static NTSTATUS smbd_smb2_flush_send_queue(struct smbd_server_connection *sconn)
3099 {
3100         struct smbXsrv_connection *xconn = sconn->conn;
3101         int ret;
3102         int err;
3103         bool retry;
3104
3105         if (xconn->smb2.send_queue == NULL) {
3106                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3107                 return NT_STATUS_OK;
3108         }
3109
3110         while (xconn->smb2.send_queue != NULL) {
3111                 struct smbd_smb2_send_queue *e = xconn->smb2.send_queue;
3112
3113                 if (e->sendfile_header != NULL) {
3114                         size_t size = 0;
3115                         size_t i = 0;
3116                         uint8_t *buf;
3117
3118                         for (i=0; i < e->count; i++) {
3119                                 size += e->vector[i].iov_len;
3120                         }
3121
3122                         if (size <= e->sendfile_header->length) {
3123                                 buf = e->sendfile_header->data;
3124                         } else {
3125                                 buf = talloc_array(e->mem_ctx, uint8_t, size);
3126                                 if (buf == NULL) {
3127                                         return NT_STATUS_NO_MEMORY;
3128                                 }
3129                         }
3130
3131                         size = 0;
3132                         for (i=0; i < e->count; i++) {
3133                                 memcpy(buf+size,
3134                                        e->vector[i].iov_base,
3135                                        e->vector[i].iov_len);
3136                                 size += e->vector[i].iov_len;
3137                         }
3138
3139                         e->sendfile_header->data = buf;
3140                         e->sendfile_header->length = size;
3141                         e->count = 0;
3142
3143                         xconn->smb2.send_queue_len--;
3144                         DLIST_REMOVE(xconn->smb2.send_queue, e);
3145                         /*
3146                          * This triggers the sendfile path via
3147                          * the destructor.
3148                          */
3149                         talloc_free(e->mem_ctx);
3150                         continue;
3151                 }
3152
3153                 ret = writev(xconn->transport.sock, e->vector, e->count);
3154                 if (ret == 0) {
3155                         /* propagate end of file */
3156                         return NT_STATUS_INTERNAL_ERROR;
3157                 }
3158                 err = socket_error_from_errno(ret, errno, &retry);
3159                 if (retry) {
3160                         /* retry later */
3161                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
3162                         return NT_STATUS_OK;
3163                 }
3164                 if (err != 0) {
3165                         return map_nt_error_from_unix_common(err);
3166                 }
3167                 while (ret > 0) {
3168                         if (ret < e->vector[0].iov_len) {
3169                                 uint8_t *base;
3170                                 base = (uint8_t *)e->vector[0].iov_base;
3171                                 base += ret;
3172                                 e->vector[0].iov_base = (void *)base;
3173                                 e->vector[0].iov_len -= ret;
3174                                 break;
3175                         }
3176                         ret -= e->vector[0].iov_len;
3177                         e->vector += 1;
3178                         e->count -= 1;
3179                 }
3180
3181                 /*
3182                  * there're maybe some empty vectors at the end
3183                  * which we need to skip, otherwise we would get
3184                  * ret == 0 from the readv() call and return EPIPE
3185                  */
3186                 while (e->count > 0) {
3187                         if (e->vector[0].iov_len > 0) {
3188                                 break;
3189                         }
3190                         e->vector += 1;
3191                         e->count -= 1;
3192                 }
3193
3194                 if (e->count > 0) {
3195                         /* we have more to write */
3196                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
3197                         return NT_STATUS_OK;
3198                 }
3199
3200                 xconn->smb2.send_queue_len--;
3201                 DLIST_REMOVE(xconn->smb2.send_queue, e);
3202                 talloc_free(e->mem_ctx);
3203         }
3204
3205         return NT_STATUS_OK;
3206 }
3207
3208 static NTSTATUS smbd_smb2_io_handler(struct smbd_server_connection *sconn,
3209                                      uint16_t fde_flags)
3210 {
3211         struct smbXsrv_connection *xconn = sconn->conn;
3212         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
3213         struct smbd_smb2_request *req = NULL;
3214         size_t min_recvfile_size = UINT32_MAX;
3215         int ret;
3216         int err;
3217         bool retry;
3218         NTSTATUS status;
3219         NTTIME now;
3220
3221         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
3222                 /*
3223                  * we're not supposed to do any io
3224                  */
3225                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3226                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3227                 return NT_STATUS_OK;
3228         }
3229
3230         if (fde_flags & TEVENT_FD_WRITE) {
3231                 status = smbd_smb2_flush_send_queue(sconn);
3232                 if (!NT_STATUS_IS_OK(status)) {
3233                         return status;
3234                 }
3235         }
3236
3237         if (!(fde_flags & TEVENT_FD_READ)) {
3238                 return NT_STATUS_OK;
3239         }
3240
3241         if (state->req == NULL) {
3242                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3243                 return NT_STATUS_OK;
3244         }
3245
3246 again:
3247         if (!state->hdr.done) {
3248                 state->hdr.done = true;
3249
3250                 state->vector.iov_base = (void *)state->hdr.nbt;
3251                 state->vector.iov_len = NBT_HDR_SIZE;
3252         }
3253
3254         ret = readv(xconn->transport.sock, &state->vector, 1);
3255         if (ret == 0) {
3256                 /* propagate end of file */
3257                 return NT_STATUS_END_OF_FILE;
3258         }
3259         err = socket_error_from_errno(ret, errno, &retry);
3260         if (retry) {
3261                 /* retry later */
3262                 TEVENT_FD_READABLE(xconn->transport.fde);
3263                 return NT_STATUS_OK;
3264         }
3265         if (err != 0) {
3266                 return map_nt_error_from_unix_common(err);
3267         }
3268
3269         if (ret < state->vector.iov_len) {
3270                 uint8_t *base;
3271                 base = (uint8_t *)state->vector.iov_base;
3272                 base += ret;
3273                 state->vector.iov_base = (void *)base;
3274                 state->vector.iov_len -= ret;
3275                 /* we have more to read */
3276                 TEVENT_FD_READABLE(xconn->transport.fde);
3277                 return NT_STATUS_OK;
3278         }
3279
3280         if (state->pktlen > 0) {
3281                 if (state->doing_receivefile && !is_smb2_recvfile_write(state)) {
3282                         /*
3283                          * Not a possible receivefile write.
3284                          * Read the rest of the data.
3285                          */
3286                         state->doing_receivefile = false;
3287
3288                         state->pktbuf = talloc_realloc(state->req,
3289                                                        state->pktbuf,
3290                                                        uint8_t,
3291                                                        state->pktfull);
3292                         if (state->pktbuf == NULL) {
3293                                 return NT_STATUS_NO_MEMORY;
3294                         }
3295
3296                         state->vector.iov_base = (void *)(state->pktbuf +
3297                                 state->pktlen);
3298                         state->vector.iov_len = (state->pktfull -
3299                                 state->pktlen);
3300
3301                         state->pktlen = state->pktfull;
3302                         goto again;
3303                 }
3304
3305                 /*
3306                  * Either this is a receivefile write so we've
3307                  * done a short read, or if not we have all the data.
3308                  */
3309                 goto got_full;
3310         }
3311
3312         /*
3313          * Now we analyze the NBT header
3314          */
3315         if (state->hdr.nbt[0] != 0x00) {
3316                 state->min_recv_size = 0;
3317         }
3318         state->pktfull = smb2_len(state->hdr.nbt);
3319         if (state->pktfull == 0) {
3320                 goto got_full;
3321         }
3322
3323         if (state->min_recv_size != 0) {
3324                 min_recvfile_size = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3325                 min_recvfile_size += state->min_recv_size;
3326         }
3327
3328         if (state->pktfull > min_recvfile_size) {
3329                 /*
3330                  * Might be a receivefile write. Read the SMB2 HEADER +
3331                  * SMB2_WRITE header first. Set 'doing_receivefile'
3332                  * as we're *attempting* receivefile write. If this
3333                  * turns out not to be a SMB2_WRITE request or otherwise
3334                  * not suitable then we'll just read the rest of the data
3335                  * the next time this function is called.
3336                  */
3337                 state->pktlen = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3338                 state->doing_receivefile = true;
3339         } else {
3340                 state->pktlen = state->pktfull;
3341         }
3342
3343         state->pktbuf = talloc_array(state->req, uint8_t, state->pktlen);
3344         if (state->pktbuf == NULL) {
3345                 return NT_STATUS_NO_MEMORY;
3346         }
3347
3348         state->vector.iov_base = (void *)state->pktbuf;
3349         state->vector.iov_len = state->pktlen;
3350
3351         goto again;
3352
3353 got_full:
3354
3355         if (state->hdr.nbt[0] != 0x00) {
3356                 DEBUG(1,("ignore NBT[0x%02X] msg\n",
3357                          state->hdr.nbt[0]));
3358
3359                 req = state->req;
3360                 ZERO_STRUCTP(state);
3361                 state->req = req;
3362                 state->min_recv_size = lp_min_receive_file_size();
3363                 req = NULL;
3364                 goto again;
3365         }
3366
3367         req = state->req;
3368         state->req = NULL;
3369
3370         req->request_time = timeval_current();
3371         now = timeval_to_nttime(&req->request_time);
3372
3373         status = smbd_smb2_inbuf_parse_compound(req->sconn->conn,
3374                                                 now,
3375                                                 state->pktbuf,
3376                                                 state->pktlen,
3377                                                 req,
3378                                                 &req->in.vector,
3379                                                 &req->in.vector_count);
3380         if (!NT_STATUS_IS_OK(status)) {
3381                 return status;
3382         }
3383
3384         if (state->doing_receivefile) {
3385                 req->smb1req = talloc_zero(req, struct smb_request);
3386                 if (req->smb1req == NULL) {
3387                         return NT_STATUS_NO_MEMORY;
3388                 }
3389                 req->smb1req->unread_bytes = state->pktfull - state->pktlen;
3390         }
3391
3392         ZERO_STRUCTP(state);
3393
3394         req->current_idx = 1;
3395
3396         DEBUG(10,("smbd_smb2_request idx[%d] of %d vectors\n",
3397                  req->current_idx, req->in.vector_count));
3398
3399         status = smbd_smb2_request_validate(req);
3400         if (!NT_STATUS_IS_OK(status)) {
3401                 return status;
3402         }
3403
3404         status = smbd_smb2_request_setup_out(req);
3405         if (!NT_STATUS_IS_OK(status)) {
3406                 return status;
3407         }
3408
3409         status = smbd_smb2_request_dispatch(req);
3410         if (!NT_STATUS_IS_OK(status)) {
3411                 return status;
3412         }
3413
3414         sconn->num_requests++;
3415
3416         /* The timeout_processing function isn't run nearly
3417            often enough to&n