s3:smbd: add a comment stating that file_close_user() is redundant for SMB2
[nivanova/samba-autobuild/.git] / source3 / smbd / smbXsrv_session.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    Copyright (C) Stefan Metzmacher 2011-2012
5    Copyright (C) Michael Adam 2012
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "system/filesys.h"
23 #include <tevent.h>
24 #include "lib/util/server_id.h"
25 #include "smbd/smbd.h"
26 #include "smbd/globals.h"
27 #include "dbwrap/dbwrap.h"
28 #include "dbwrap/dbwrap_rbt.h"
29 #include "dbwrap/dbwrap_open.h"
30 #include "dbwrap/dbwrap_watch.h"
31 #include "session.h"
32 #include "auth.h"
33 #include "auth/gensec/gensec.h"
34 #include "../lib/tsocket/tsocket.h"
35 #include "../libcli/security/security.h"
36 #include "messages.h"
37 #include "lib/util/util_tdb.h"
38 #include "librpc/gen_ndr/ndr_smbXsrv.h"
39 #include "serverid.h"
40 #include "lib/util/tevent_ntstatus.h"
41
42 struct smbXsrv_session_table {
43         struct {
44                 struct db_context *db_ctx;
45                 uint32_t lowest_id;
46                 uint32_t highest_id;
47                 uint32_t max_sessions;
48                 uint32_t num_sessions;
49         } local;
50         struct {
51                 struct db_context *db_ctx;
52         } global;
53 };
54
55 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
56
57 NTSTATUS smbXsrv_session_global_init(struct messaging_context *msg_ctx)
58 {
59         char *global_path = NULL;
60         struct db_context *backend = NULL;
61         struct db_context *db_ctx = NULL;
62
63         if (smbXsrv_session_global_db_ctx != NULL) {
64                 return NT_STATUS_OK;
65         }
66
67         /*
68          * This contains secret information like session keys!
69          */
70         global_path = lock_path(talloc_tos(), "smbXsrv_session_global.tdb");
71         if (global_path == NULL) {
72                 return NT_STATUS_NO_MEMORY;
73         }
74
75         backend = db_open(NULL, global_path,
76                           0, /* hash_size */
77                           TDB_DEFAULT |
78                           TDB_CLEAR_IF_FIRST |
79                           TDB_INCOMPATIBLE_HASH,
80                           O_RDWR | O_CREAT, 0600,
81                           DBWRAP_LOCK_ORDER_1,
82                           DBWRAP_FLAG_NONE);
83         TALLOC_FREE(global_path);
84         if (backend == NULL) {
85                 NTSTATUS status;
86
87                 status = map_nt_error_from_unix_common(errno);
88
89                 return status;
90         }
91
92         db_ctx = db_open_watched(NULL, &backend, server_messaging_context());
93         if (db_ctx == NULL) {
94                 TALLOC_FREE(backend);
95                 return NT_STATUS_NO_MEMORY;
96         }
97
98         smbXsrv_session_global_db_ctx = db_ctx;
99
100         return NT_STATUS_OK;
101 }
102
103 /*
104  * NOTE:
105  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
106  * has the same result as integer comparison between the uint32_t
107  * values.
108  *
109  * TODO: implement string based key
110  */
111
112 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
113
114 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
115                                                  uint8_t *key_buf)
116 {
117         TDB_DATA key;
118
119         RSIVAL(key_buf, 0, id);
120
121         key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
122
123         return key;
124 }
125
126 #if 0
127 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
128 {
129         if (id == NULL) {
130                 return NT_STATUS_INVALID_PARAMETER;
131         }
132
133         if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
134                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
135         }
136
137         *id = RIVAL(key.dptr, 0);
138
139         return NT_STATUS_OK;
140 }
141 #endif
142
143 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
144
145 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
146                                                 uint8_t *key_buf)
147 {
148         TDB_DATA key;
149
150         RSIVAL(key_buf, 0, id);
151
152         key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
153
154         return key;
155 }
156
157 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
158 {
159         if (id == NULL) {
160                 return NT_STATUS_INVALID_PARAMETER;
161         }
162
163         if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
164                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
165         }
166
167         *id = RIVAL(key.dptr, 0);
168
169         return NT_STATUS_OK;
170 }
171
172 static struct db_record *smbXsrv_session_global_fetch_locked(
173                         struct db_context *db,
174                         uint32_t id,
175                         TALLOC_CTX *mem_ctx)
176 {
177         TDB_DATA key;
178         uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
179         struct db_record *rec = NULL;
180
181         key = smbXsrv_session_global_id_to_key(id, key_buf);
182
183         rec = dbwrap_fetch_locked(db, mem_ctx, key);
184
185         if (rec == NULL) {
186                 DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
187                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
188         }
189
190         return rec;
191 }
192
193 static struct db_record *smbXsrv_session_local_fetch_locked(
194                         struct db_context *db,
195                         uint32_t id,
196                         TALLOC_CTX *mem_ctx)
197 {
198         TDB_DATA key;
199         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
200         struct db_record *rec = NULL;
201
202         key = smbXsrv_session_local_id_to_key(id, key_buf);
203
204         rec = dbwrap_fetch_locked(db, mem_ctx, key);
205
206         if (rec == NULL) {
207                 DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
208                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
209         }
210
211         return rec;
212 }
213
214 static void smbXsrv_session_close_loop(struct tevent_req *subreq);
215
216 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
217                                            uint32_t lowest_id,
218                                            uint32_t highest_id,
219                                            uint32_t max_sessions)
220 {
221         struct smbXsrv_client *client = conn->client;
222         struct smbXsrv_session_table *table;
223         NTSTATUS status;
224         struct tevent_req *subreq;
225         uint64_t max_range;
226
227         if (lowest_id > highest_id) {
228                 return NT_STATUS_INTERNAL_ERROR;
229         }
230
231         max_range = highest_id;
232         max_range -= lowest_id;
233         max_range += 1;
234
235         if (max_sessions > max_range) {
236                 return NT_STATUS_INTERNAL_ERROR;
237         }
238
239         table = talloc_zero(client, struct smbXsrv_session_table);
240         if (table == NULL) {
241                 return NT_STATUS_NO_MEMORY;
242         }
243
244         table->local.db_ctx = db_open_rbt(table);
245         if (table->local.db_ctx == NULL) {
246                 TALLOC_FREE(table);
247                 return NT_STATUS_NO_MEMORY;
248         }
249         table->local.lowest_id = lowest_id;
250         table->local.highest_id = highest_id;
251         table->local.max_sessions = max_sessions;
252
253         status = smbXsrv_session_global_init(client->msg_ctx);
254         if (!NT_STATUS_IS_OK(status)) {
255                 TALLOC_FREE(table);
256                 return status;
257         }
258
259         table->global.db_ctx = smbXsrv_session_global_db_ctx;
260
261         subreq = messaging_read_send(table,
262                                      client->raw_ev_ctx,
263                                      client->msg_ctx,
264                                      MSG_SMBXSRV_SESSION_CLOSE);
265         if (subreq == NULL) {
266                 TALLOC_FREE(table);
267                 return NT_STATUS_NO_MEMORY;
268         }
269         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
270
271         client->session_table = table;
272         return NT_STATUS_OK;
273 }
274
275 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
276
277 static void smbXsrv_session_close_loop(struct tevent_req *subreq)
278 {
279         struct smbXsrv_client *client =
280                 tevent_req_callback_data(subreq,
281                 struct smbXsrv_client);
282         struct smbXsrv_session_table *table = client->session_table;
283         int ret;
284         struct messaging_rec *rec = NULL;
285         struct smbXsrv_session_closeB close_blob;
286         enum ndr_err_code ndr_err;
287         struct smbXsrv_session_close0 *close_info0 = NULL;
288         struct smbXsrv_session *session = NULL;
289         NTSTATUS status;
290         struct timeval tv = timeval_current();
291         NTTIME now = timeval_to_nttime(&tv);
292
293         ret = messaging_read_recv(subreq, talloc_tos(), &rec);
294         TALLOC_FREE(subreq);
295         if (ret != 0) {
296                 goto next;
297         }
298
299         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
300                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
301         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
302                 status = ndr_map_error2ntstatus(ndr_err);
303                 DEBUG(1,("smbXsrv_session_close_loop: "
304                          "ndr_pull_struct_blob - %s\n",
305                          nt_errstr(status)));
306                 goto next;
307         }
308
309         DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
310         if (DEBUGLVL(10)) {
311                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
312         }
313
314         if (close_blob.version != SMBXSRV_VERSION_0) {
315                 DEBUG(0,("smbXsrv_session_close_loop: "
316                          "ignore invalid version %u\n", close_blob.version));
317                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
318                 goto next;
319         }
320
321         close_info0 = close_blob.info.info0;
322         if (close_info0 == NULL) {
323                 DEBUG(0,("smbXsrv_session_close_loop: "
324                          "ignore NULL info %u\n", close_blob.version));
325                 NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
326                 goto next;
327         }
328
329         status = smb2srv_session_lookup_client(client,
330                                                close_info0->old_session_wire_id,
331                                                now, &session);
332         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
333                 DEBUG(4,("smbXsrv_session_close_loop: "
334                          "old_session_wire_id %llu not found\n",
335                          (unsigned long long)close_info0->old_session_wire_id));
336                 if (DEBUGLVL(4)) {
337                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
338                 }
339                 goto next;
340         }
341         if (!NT_STATUS_IS_OK(status) &&
342             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
343             !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
344                 DEBUG(1,("smbXsrv_session_close_loop: "
345                          "old_session_wire_id %llu - %s\n",
346                          (unsigned long long)close_info0->old_session_wire_id,
347                          nt_errstr(status)));
348                 if (DEBUGLVL(1)) {
349                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
350                 }
351                 goto next;
352         }
353
354         if (session->global->session_global_id != close_info0->old_session_global_id) {
355                 DEBUG(1,("smbXsrv_session_close_loop: "
356                          "old_session_wire_id %llu - global %u != %u\n",
357                          (unsigned long long)close_info0->old_session_wire_id,
358                          session->global->session_global_id,
359                          close_info0->old_session_global_id));
360                 if (DEBUGLVL(1)) {
361                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
362                 }
363                 goto next;
364         }
365
366         if (session->global->creation_time != close_info0->old_creation_time) {
367                 DEBUG(1,("smbXsrv_session_close_loop: "
368                          "old_session_wire_id %llu - "
369                          "creation %s (%llu) != %s (%llu)\n",
370                          (unsigned long long)close_info0->old_session_wire_id,
371                          nt_time_string(rec, session->global->creation_time),
372                          (unsigned long long)session->global->creation_time,
373                          nt_time_string(rec, close_info0->old_creation_time),
374                          (unsigned long long)close_info0->old_creation_time));
375                 if (DEBUGLVL(1)) {
376                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
377                 }
378                 goto next;
379         }
380
381         subreq = smb2srv_session_shutdown_send(session, client->raw_ev_ctx,
382                                                session, NULL);
383         if (subreq == NULL) {
384                 status = NT_STATUS_NO_MEMORY;
385                 DEBUG(0, ("smbXsrv_session_close_loop: "
386                           "smb2srv_session_shutdown_send(%llu) failed: %s\n",
387                           (unsigned long long)session->global->session_wire_id,
388                           nt_errstr(status)));
389                 if (DEBUGLVL(1)) {
390                         NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
391                 }
392                 goto next;
393         }
394         tevent_req_set_callback(subreq,
395                                 smbXsrv_session_close_shutdown_done,
396                                 session);
397
398 next:
399         TALLOC_FREE(rec);
400
401         subreq = messaging_read_send(table,
402                                      client->raw_ev_ctx,
403                                      client->msg_ctx,
404                                      MSG_SMBXSRV_SESSION_CLOSE);
405         if (subreq == NULL) {
406                 const char *r;
407                 r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
408                 exit_server_cleanly(r);
409                 return;
410         }
411         tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
412 }
413
414 static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
415 {
416         struct smbXsrv_session *session =
417                 tevent_req_callback_data(subreq,
418                 struct smbXsrv_session);
419         NTSTATUS status;
420
421         status = smb2srv_session_shutdown_recv(subreq);
422         TALLOC_FREE(subreq);
423         if (!NT_STATUS_IS_OK(status)) {
424                 DEBUG(0, ("smbXsrv_session_close_loop: "
425                           "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
426                           (unsigned long long)session->global->session_wire_id,
427                           nt_errstr(status)));
428         }
429
430         status = smbXsrv_session_logoff(session);
431         if (!NT_STATUS_IS_OK(status)) {
432                 DEBUG(0, ("smbXsrv_session_close_loop: "
433                           "smbXsrv_session_logoff(%llu) failed: %s\n",
434                           (unsigned long long)session->global->session_wire_id,
435                           nt_errstr(status)));
436         }
437
438         TALLOC_FREE(session);
439 }
440
441 struct smb1srv_session_local_allocate_state {
442         const uint32_t lowest_id;
443         const uint32_t highest_id;
444         uint32_t last_id;
445         uint32_t useable_id;
446         NTSTATUS status;
447 };
448
449 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
450                                                    void *private_data)
451 {
452         struct smb1srv_session_local_allocate_state *state =
453                 (struct smb1srv_session_local_allocate_state *)private_data;
454         TDB_DATA key = dbwrap_record_get_key(rec);
455         uint32_t id = 0;
456         NTSTATUS status;
457
458         status = smbXsrv_session_local_key_to_id(key, &id);
459         if (!NT_STATUS_IS_OK(status)) {
460                 state->status = status;
461                 return -1;
462         }
463
464         if (id <= state->last_id) {
465                 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
466                 return -1;
467         }
468         state->last_id = id;
469
470         if (id > state->useable_id) {
471                 state->status = NT_STATUS_OK;
472                 return -1;
473         }
474
475         if (state->useable_id == state->highest_id) {
476                 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
477                 return -1;
478         }
479
480         state->useable_id +=1;
481         return 0;
482 }
483
484 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
485                                                   uint32_t lowest_id,
486                                                   uint32_t highest_id,
487                                                   TALLOC_CTX *mem_ctx,
488                                                   struct db_record **_rec,
489                                                   uint32_t *_id)
490 {
491         struct smb1srv_session_local_allocate_state state = {
492                 .lowest_id = lowest_id,
493                 .highest_id = highest_id,
494                 .last_id = 0,
495                 .useable_id = lowest_id,
496                 .status = NT_STATUS_INTERNAL_ERROR,
497         };
498         uint32_t i;
499         uint32_t range;
500         NTSTATUS status;
501         int count = 0;
502
503         *_rec = NULL;
504         *_id = 0;
505
506         if (lowest_id > highest_id) {
507                 return NT_STATUS_INSUFFICIENT_RESOURCES;
508         }
509
510         /*
511          * first we try randomly
512          */
513         range = (highest_id - lowest_id) + 1;
514
515         for (i = 0; i < (range / 2); i++) {
516                 uint32_t id;
517                 TDB_DATA val;
518                 struct db_record *rec = NULL;
519
520                 id = generate_random() % range;
521                 id += lowest_id;
522
523                 if (id < lowest_id) {
524                         id = lowest_id;
525                 }
526                 if (id > highest_id) {
527                         id = highest_id;
528                 }
529
530                 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
531                 if (rec == NULL) {
532                         return NT_STATUS_INSUFFICIENT_RESOURCES;
533                 }
534
535                 val = dbwrap_record_get_value(rec);
536                 if (val.dsize != 0) {
537                         TALLOC_FREE(rec);
538                         continue;
539                 }
540
541                 *_rec = rec;
542                 *_id = id;
543                 return NT_STATUS_OK;
544         }
545
546         /*
547          * if the range is almost full,
548          * we traverse the whole table
549          * (this relies on sorted behavior of dbwrap_rbt)
550          */
551         status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
552                                       &state, &count);
553         if (NT_STATUS_IS_OK(status)) {
554                 if (NT_STATUS_IS_OK(state.status)) {
555                         return NT_STATUS_INTERNAL_ERROR;
556                 }
557
558                 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
559                         return state.status;
560                 }
561
562                 if (state.useable_id <= state.highest_id) {
563                         state.status = NT_STATUS_OK;
564                 } else {
565                         return NT_STATUS_INSUFFICIENT_RESOURCES;
566                 }
567         } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
568                 /*
569                  * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
570                  *
571                  * If we get anything else it is an error, because it
572                  * means we did not manage to find a free slot in
573                  * the db.
574                  */
575                 return NT_STATUS_INSUFFICIENT_RESOURCES;
576         }
577
578         if (NT_STATUS_IS_OK(state.status)) {
579                 uint32_t id;
580                 TDB_DATA val;
581                 struct db_record *rec = NULL;
582
583                 id = state.useable_id;
584
585                 rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
586                 if (rec == NULL) {
587                         return NT_STATUS_INSUFFICIENT_RESOURCES;
588                 }
589
590                 val = dbwrap_record_get_value(rec);
591                 if (val.dsize != 0) {
592                         TALLOC_FREE(rec);
593                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
594                 }
595
596                 *_rec = rec;
597                 *_id = id;
598                 return NT_STATUS_OK;
599         }
600
601         return state.status;
602 }
603
604 struct smbXsrv_session_local_fetch_state {
605         struct smbXsrv_session *session;
606         NTSTATUS status;
607 };
608
609 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
610                                                void *private_data)
611 {
612         struct smbXsrv_session_local_fetch_state *state =
613                 (struct smbXsrv_session_local_fetch_state *)private_data;
614         void *ptr;
615
616         if (data.dsize != sizeof(ptr)) {
617                 state->status = NT_STATUS_INTERNAL_DB_ERROR;
618                 return;
619         }
620
621         memcpy(&ptr, data.dptr, data.dsize);
622         state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
623         state->status = NT_STATUS_OK;
624 }
625
626 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
627                                              /* conn: optional */
628                                              struct smbXsrv_connection *conn,
629                                              uint32_t session_local_id,
630                                              NTTIME now,
631                                              struct smbXsrv_session **_session)
632 {
633         struct smbXsrv_session_local_fetch_state state = {
634                 .session = NULL,
635                 .status = NT_STATUS_INTERNAL_ERROR,
636         };
637         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
638         TDB_DATA key;
639         NTSTATUS status;
640
641         *_session = NULL;
642
643         if (session_local_id == 0) {
644                 return NT_STATUS_USER_SESSION_DELETED;
645         }
646
647         if (table == NULL) {
648                 /* this might happen before the end of negprot */
649                 return NT_STATUS_USER_SESSION_DELETED;
650         }
651
652         if (table->local.db_ctx == NULL) {
653                 return NT_STATUS_INTERNAL_ERROR;
654         }
655
656         key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
657
658         status = dbwrap_parse_record(table->local.db_ctx, key,
659                                      smbXsrv_session_local_fetch_parser,
660                                      &state);
661         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
662                 return NT_STATUS_USER_SESSION_DELETED;
663         } else if (!NT_STATUS_IS_OK(status)) {
664                 return status;
665         }
666         if (!NT_STATUS_IS_OK(state.status)) {
667                 return state.status;
668         }
669
670         if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
671                 return NT_STATUS_USER_SESSION_DELETED;
672         }
673
674         /*
675          * If a connection is specified check if the session is
676          * valid on the channel.
677          */
678         if (conn != NULL) {
679                 struct smbXsrv_channel_global0 *c = NULL;
680
681                 status = smbXsrv_session_find_channel(state.session, conn, &c);
682                 if (!NT_STATUS_IS_OK(status)) {
683                         return status;
684                 }
685         }
686
687         state.session->idle_time = now;
688
689         if (!NT_STATUS_IS_OK(state.session->status)) {
690                 *_session = state.session;
691                 return state.session->status;
692         }
693
694         if (now > state.session->global->expiration_time) {
695                 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
696         }
697
698         *_session = state.session;
699         return state.session->status;
700 }
701
702 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
703 {
704         return 0;
705 }
706
707 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
708                                         bool *is_free,
709                                         bool *was_free,
710                                         TALLOC_CTX *mem_ctx,
711                                         struct smbXsrv_session_global0 **_g);
712
713 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
714                                         TALLOC_CTX *mem_ctx,
715                                         struct smbXsrv_session_global0 **_global)
716 {
717         uint32_t i;
718         struct smbXsrv_session_global0 *global = NULL;
719         uint32_t last_free = 0;
720         const uint32_t min_tries = 3;
721
722         *_global = NULL;
723
724         global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
725         if (global == NULL) {
726                 return NT_STATUS_NO_MEMORY;
727         }
728         talloc_set_destructor(global, smbXsrv_session_global_destructor);
729
730         /*
731          * Here we just randomly try the whole 32-bit space
732          *
733          * We use just 32-bit, because we want to reuse the
734          * ID for SRVSVC.
735          */
736         for (i = 0; i < UINT32_MAX; i++) {
737                 bool is_free = false;
738                 bool was_free = false;
739                 uint32_t id;
740
741                 if (i >= min_tries && last_free != 0) {
742                         id = last_free;
743                 } else {
744                         id = generate_random();
745                 }
746                 if (id == 0) {
747                         id++;
748                 }
749                 if (id == UINT32_MAX) {
750                         id--;
751                 }
752
753                 global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
754                                                                      mem_ctx);
755                 if (global->db_rec == NULL) {
756                         talloc_free(global);
757                         return NT_STATUS_INSUFFICIENT_RESOURCES;
758                 }
759
760                 smbXsrv_session_global_verify_record(global->db_rec,
761                                                      &is_free,
762                                                      &was_free,
763                                                      NULL, NULL);
764
765                 if (!is_free) {
766                         TALLOC_FREE(global->db_rec);
767                         continue;
768                 }
769
770                 if (!was_free && i < min_tries) {
771                         /*
772                          * The session_id is free now,
773                          * but was not free before.
774                          *
775                          * This happens if a smbd crashed
776                          * and did not cleanup the record.
777                          *
778                          * If this is one of our first tries,
779                          * then we try to find a real free one.
780                          */
781                         if (last_free == 0) {
782                                 last_free = id;
783                         }
784                         TALLOC_FREE(global->db_rec);
785                         continue;
786                 }
787
788                 global->session_global_id = id;
789
790                 *_global = global;
791                 return NT_STATUS_OK;
792         }
793
794         /* should not be reached */
795         talloc_free(global);
796         return NT_STATUS_INTERNAL_ERROR;
797 }
798
799 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
800                                         bool *is_free,
801                                         bool *was_free,
802                                         TALLOC_CTX *mem_ctx,
803                                         struct smbXsrv_session_global0 **_g)
804 {
805         TDB_DATA key;
806         TDB_DATA val;
807         DATA_BLOB blob;
808         struct smbXsrv_session_globalB global_blob;
809         enum ndr_err_code ndr_err;
810         struct smbXsrv_session_global0 *global = NULL;
811         bool exists;
812         TALLOC_CTX *frame = talloc_stackframe();
813
814         *is_free = false;
815
816         if (was_free) {
817                 *was_free = false;
818         }
819         if (_g) {
820                 *_g = NULL;
821         }
822
823         key = dbwrap_record_get_key(db_rec);
824
825         val = dbwrap_record_get_value(db_rec);
826         if (val.dsize == 0) {
827                 TALLOC_FREE(frame);
828                 *is_free = true;
829                 if (was_free) {
830                         *was_free = true;
831                 }
832                 return;
833         }
834
835         blob = data_blob_const(val.dptr, val.dsize);
836
837         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
838                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
839         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
840                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
841                 DEBUG(1,("smbXsrv_session_global_verify_record: "
842                          "key '%s' ndr_pull_struct_blob - %s\n",
843                          hex_encode_talloc(frame, key.dptr, key.dsize),
844                          nt_errstr(status)));
845                 TALLOC_FREE(frame);
846                 *is_free = true;
847                 if (was_free) {
848                         *was_free = true;
849                 }
850                 return;
851         }
852
853         DEBUG(10,("smbXsrv_session_global_verify_record\n"));
854         if (DEBUGLVL(10)) {
855                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
856         }
857
858         if (global_blob.version != SMBXSRV_VERSION_0) {
859                 DEBUG(0,("smbXsrv_session_global_verify_record: "
860                          "key '%s' use unsupported version %u\n",
861                          hex_encode_talloc(frame, key.dptr, key.dsize),
862                          global_blob.version));
863                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
864                 TALLOC_FREE(frame);
865                 *is_free = true;
866                 if (was_free) {
867                         *was_free = true;
868                 }
869                 return;
870         }
871
872         global = global_blob.info.info0;
873
874         exists = serverid_exists(&global->channels[0].server_id);
875         if (!exists) {
876                 struct server_id_buf idbuf;
877                 DEBUG(2,("smbXsrv_session_global_verify_record: "
878                          "key '%s' server_id %s does not exist.\n",
879                          hex_encode_talloc(frame, key.dptr, key.dsize),
880                          server_id_str_buf(global->channels[0].server_id,
881                                            &idbuf)));
882                 if (DEBUGLVL(2)) {
883                         NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
884                 }
885                 TALLOC_FREE(frame);
886                 dbwrap_record_delete(db_rec);
887                 *is_free = true;
888                 return;
889         }
890
891         if (_g) {
892                 *_g = talloc_move(mem_ctx, &global);
893         }
894         TALLOC_FREE(frame);
895 }
896
897 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
898 {
899         struct smbXsrv_session_globalB global_blob;
900         DATA_BLOB blob = data_blob_null;
901         TDB_DATA key;
902         TDB_DATA val;
903         NTSTATUS status;
904         enum ndr_err_code ndr_err;
905
906         /*
907          * TODO: if we use other versions than '0'
908          * we would add glue code here, that would be able to
909          * store the information in the old format.
910          */
911
912         if (global->db_rec == NULL) {
913                 return NT_STATUS_INTERNAL_ERROR;
914         }
915
916         key = dbwrap_record_get_key(global->db_rec);
917         val = dbwrap_record_get_value(global->db_rec);
918
919         ZERO_STRUCT(global_blob);
920         global_blob.version = smbXsrv_version_global_current();
921         if (val.dsize >= 8) {
922                 global_blob.seqnum = IVAL(val.dptr, 4);
923         }
924         global_blob.seqnum += 1;
925         global_blob.info.info0 = global;
926
927         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
928                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
929         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
930                 status = ndr_map_error2ntstatus(ndr_err);
931                 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
932                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
933                          nt_errstr(status)));
934                 TALLOC_FREE(global->db_rec);
935                 return status;
936         }
937
938         val = make_tdb_data(blob.data, blob.length);
939         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
940         if (!NT_STATUS_IS_OK(status)) {
941                 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
942                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
943                          nt_errstr(status)));
944                 TALLOC_FREE(global->db_rec);
945                 return status;
946         }
947
948         if (DEBUGLVL(10)) {
949                 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
950                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
951                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
952         }
953
954         TALLOC_FREE(global->db_rec);
955
956         return NT_STATUS_OK;
957 }
958
959 struct smb2srv_session_close_previous_state {
960         struct tevent_context *ev;
961         struct smbXsrv_connection *connection;
962         struct dom_sid *current_sid;
963         uint64_t previous_session_id;
964         uint64_t current_session_id;
965         struct db_record *db_rec;
966 };
967
968 static void smb2srv_session_close_previous_check(struct tevent_req *req);
969 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
970
971 struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
972                                         struct tevent_context *ev,
973                                         struct smbXsrv_connection *conn,
974                                         struct auth_session_info *session_info,
975                                         uint64_t previous_session_id,
976                                         uint64_t current_session_id)
977 {
978         struct tevent_req *req;
979         struct smb2srv_session_close_previous_state *state;
980         uint32_t global_id = previous_session_id & UINT32_MAX;
981         uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
982         struct smbXsrv_session_table *table = conn->client->session_table;
983         struct security_token *current_token = NULL;
984
985         req = tevent_req_create(mem_ctx, &state,
986                                 struct smb2srv_session_close_previous_state);
987         if (req == NULL) {
988                 return NULL;
989         }
990         state->ev = ev;
991         state->connection = conn;
992         state->previous_session_id = previous_session_id;
993         state->current_session_id = current_session_id;
994
995         if (global_zeros != 0) {
996                 tevent_req_done(req);
997                 return tevent_req_post(req, ev);
998         }
999
1000         if (session_info == NULL) {
1001                 tevent_req_done(req);
1002                 return tevent_req_post(req, ev);
1003         }
1004         current_token = session_info->security_token;
1005
1006         if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
1007                 state->current_sid = &current_token->sids[PRIMARY_USER_SID_INDEX];
1008         }
1009
1010         if (state->current_sid == NULL) {
1011                 tevent_req_done(req);
1012                 return tevent_req_post(req, ev);
1013         }
1014
1015         if (!security_token_has_nt_authenticated_users(current_token)) {
1016                 /* TODO */
1017                 tevent_req_done(req);
1018                 return tevent_req_post(req, ev);
1019         }
1020
1021         state->db_rec = smbXsrv_session_global_fetch_locked(
1022                                                         table->global.db_ctx,
1023                                                         global_id,
1024                                                         state /* TALLOC_CTX */);
1025         if (state->db_rec == NULL) {
1026                 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1027                 return tevent_req_post(req, ev);
1028         }
1029
1030         smb2srv_session_close_previous_check(req);
1031         if (!tevent_req_is_in_progress(req)) {
1032                 return tevent_req_post(req, ev);
1033         }
1034
1035         return req;
1036 }
1037
1038 static void smb2srv_session_close_previous_check(struct tevent_req *req)
1039 {
1040         struct smb2srv_session_close_previous_state *state =
1041                 tevent_req_data(req,
1042                 struct smb2srv_session_close_previous_state);
1043         struct smbXsrv_connection *conn = state->connection;
1044         DATA_BLOB blob;
1045         struct security_token *previous_token = NULL;
1046         struct smbXsrv_session_global0 *global = NULL;
1047         enum ndr_err_code ndr_err;
1048         struct smbXsrv_session_close0 close_info0;
1049         struct smbXsrv_session_closeB close_blob;
1050         struct tevent_req *subreq = NULL;
1051         NTSTATUS status;
1052         bool is_free = false;
1053
1054         smbXsrv_session_global_verify_record(state->db_rec,
1055                                              &is_free,
1056                                              NULL,
1057                                              state,
1058                                              &global);
1059
1060         if (is_free) {
1061                 TALLOC_FREE(state->db_rec);
1062                 tevent_req_done(req);
1063                 return;
1064         }
1065
1066         if (global->auth_session_info == NULL) {
1067                 TALLOC_FREE(state->db_rec);
1068                 tevent_req_done(req);
1069                 return;
1070         }
1071
1072         previous_token = global->auth_session_info->security_token;
1073
1074         if (!security_token_is_sid(previous_token, state->current_sid)) {
1075                 TALLOC_FREE(state->db_rec);
1076                 tevent_req_done(req);
1077                 return;
1078         }
1079
1080         subreq = dbwrap_watched_watch_send(state, state->ev, state->db_rec,
1081                                            (struct server_id){0});
1082         if (tevent_req_nomem(subreq, req)) {
1083                 TALLOC_FREE(state->db_rec);
1084                 return;
1085         }
1086         tevent_req_set_callback(subreq,
1087                                 smb2srv_session_close_previous_modified,
1088                                 req);
1089
1090         close_info0.old_session_global_id = global->session_global_id;
1091         close_info0.old_session_wire_id = global->session_wire_id;
1092         close_info0.old_creation_time = global->creation_time;
1093         close_info0.new_session_wire_id = state->current_session_id;
1094
1095         ZERO_STRUCT(close_blob);
1096         close_blob.version = smbXsrv_version_global_current();
1097         close_blob.info.info0 = &close_info0;
1098
1099         ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1100                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1101         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1102                 TALLOC_FREE(state->db_rec);
1103                 status = ndr_map_error2ntstatus(ndr_err);
1104                 DEBUG(1,("smb2srv_session_close_previous_check: "
1105                          "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1106                          (unsigned long long)close_info0.old_session_wire_id,
1107                          (unsigned long long)close_info0.new_session_wire_id,
1108                          nt_errstr(status)));
1109                 tevent_req_nterror(req, status);
1110                 return;
1111         }
1112
1113         status = messaging_send(conn->client->msg_ctx,
1114                                 global->channels[0].server_id,
1115                                 MSG_SMBXSRV_SESSION_CLOSE, &blob);
1116         TALLOC_FREE(state->db_rec);
1117         if (tevent_req_nterror(req, status)) {
1118                 return;
1119         }
1120
1121         TALLOC_FREE(global);
1122         return;
1123 }
1124
1125 static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1126 {
1127         struct tevent_req *req =
1128                 tevent_req_callback_data(subreq,
1129                 struct tevent_req);
1130         struct smb2srv_session_close_previous_state *state =
1131                 tevent_req_data(req,
1132                 struct smb2srv_session_close_previous_state);
1133         uint32_t global_id;
1134         NTSTATUS status;
1135
1136         status = dbwrap_watched_watch_recv(subreq, NULL, NULL);
1137         TALLOC_FREE(subreq);
1138         if (tevent_req_nterror(req, status)) {
1139                 return;
1140         }
1141
1142         global_id = state->previous_session_id & UINT32_MAX;
1143
1144         state->db_rec = smbXsrv_session_global_fetch_locked(
1145                 state->connection->client->session_table->global.db_ctx,
1146                 global_id, state /* TALLOC_CTX */);
1147
1148         smb2srv_session_close_previous_check(req);
1149 }
1150
1151 NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1152 {
1153         NTSTATUS status;
1154
1155         if (tevent_req_is_nterror(req, &status)) {
1156                 tevent_req_received(req);
1157                 return status;
1158         }
1159
1160         tevent_req_received(req);
1161         return NT_STATUS_OK;
1162 }
1163
1164 static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1165 {
1166         NTSTATUS status;
1167         struct smbXsrv_connection *xconn = NULL;
1168
1169         if (session->client != NULL) {
1170                 xconn = session->client->connections;
1171         }
1172
1173         for (; xconn != NULL; xconn = xconn->next) {
1174                 struct smbd_smb2_request *preq;
1175
1176                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1177                         if (preq->session != session) {
1178                                 continue;
1179                         }
1180
1181                         preq->session = NULL;
1182                         /*
1183                          * If we no longer have a session we can't
1184                          * sign or encrypt replies.
1185                          */
1186                         preq->do_signing = false;
1187                         preq->do_encryption = false;
1188                         preq->preauth = NULL;
1189                 }
1190         }
1191
1192         status = smbXsrv_session_logoff(session);
1193         return status;
1194 }
1195
1196 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1197 {
1198         NTSTATUS status;
1199
1200         status = smbXsrv_session_clear_and_logoff(session);
1201         if (!NT_STATUS_IS_OK(status)) {
1202                 DEBUG(0, ("smbXsrv_session_destructor: "
1203                           "smbXsrv_session_logoff() failed: %s\n",
1204                           nt_errstr(status)));
1205         }
1206
1207         TALLOC_FREE(session->global);
1208
1209         return 0;
1210 }
1211
1212 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1213                                 NTTIME now,
1214                                 struct smbXsrv_session **_session)
1215 {
1216         struct smbXsrv_session_table *table = conn->client->session_table;
1217         struct db_record *local_rec = NULL;
1218         struct smbXsrv_session *session = NULL;
1219         void *ptr = NULL;
1220         TDB_DATA val;
1221         struct smbXsrv_session_global0 *global = NULL;
1222         struct smbXsrv_channel_global0 *channel = NULL;
1223         NTSTATUS status;
1224
1225         if (table->local.num_sessions >= table->local.max_sessions) {
1226                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1227         }
1228
1229         session = talloc_zero(table, struct smbXsrv_session);
1230         if (session == NULL) {
1231                 return NT_STATUS_NO_MEMORY;
1232         }
1233         session->table = table;
1234         session->idle_time = now;
1235         session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1236         session->client = conn->client;
1237
1238         status = smbXsrv_session_global_allocate(table->global.db_ctx,
1239                                                  session,
1240                                                  &global);
1241         if (!NT_STATUS_IS_OK(status)) {
1242                 TALLOC_FREE(session);
1243                 return status;
1244         }
1245         session->global = global;
1246
1247         if (conn->protocol >= PROTOCOL_SMB2_02) {
1248                 uint64_t id = global->session_global_id;
1249
1250                 global->connection_dialect = conn->smb2.server.dialect;
1251
1252                 global->session_wire_id = id;
1253
1254                 status = smb2srv_tcon_table_init(session);
1255                 if (!NT_STATUS_IS_OK(status)) {
1256                         TALLOC_FREE(session);
1257                         return status;
1258                 }
1259
1260                 session->local_id = global->session_global_id;
1261
1262                 local_rec = smbXsrv_session_local_fetch_locked(
1263                                                 table->local.db_ctx,
1264                                                 session->local_id,
1265                                                 session /* TALLOC_CTX */);
1266                 if (local_rec == NULL) {
1267                         TALLOC_FREE(session);
1268                         return NT_STATUS_NO_MEMORY;
1269                 }
1270
1271                 val = dbwrap_record_get_value(local_rec);
1272                 if (val.dsize != 0) {
1273                         TALLOC_FREE(session);
1274                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1275                 }
1276         } else {
1277
1278                 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1279                                                         table->local.lowest_id,
1280                                                         table->local.highest_id,
1281                                                         session,
1282                                                         &local_rec,
1283                                                         &session->local_id);
1284                 if (!NT_STATUS_IS_OK(status)) {
1285                         TALLOC_FREE(session);
1286                         return status;
1287                 }
1288
1289                 global->session_wire_id = session->local_id;
1290         }
1291
1292         global->creation_time = now;
1293         global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1294
1295         status = smbXsrv_session_add_channel(session, conn, &channel);
1296         if (!NT_STATUS_IS_OK(status)) {
1297                 TALLOC_FREE(session);
1298                 return status;
1299         }
1300
1301         ptr = session;
1302         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1303         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1304         TALLOC_FREE(local_rec);
1305         if (!NT_STATUS_IS_OK(status)) {
1306                 TALLOC_FREE(session);
1307                 return status;
1308         }
1309         table->local.num_sessions += 1;
1310
1311         talloc_set_destructor(session, smbXsrv_session_destructor);
1312
1313         status = smbXsrv_session_global_store(global);
1314         if (!NT_STATUS_IS_OK(status)) {
1315                 DEBUG(0,("smbXsrv_session_create: "
1316                          "global_id (0x%08x) store failed - %s\n",
1317                          session->global->session_global_id,
1318                          nt_errstr(status)));
1319                 TALLOC_FREE(session);
1320                 return status;
1321         }
1322
1323         if (DEBUGLVL(10)) {
1324                 struct smbXsrv_sessionB session_blob;
1325
1326                 ZERO_STRUCT(session_blob);
1327                 session_blob.version = SMBXSRV_VERSION_0;
1328                 session_blob.info.info0 = session;
1329
1330                 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1331                          session->global->session_global_id));
1332                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1333         }
1334
1335         *_session = session;
1336         return NT_STATUS_OK;
1337 }
1338
1339 NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1340                                      struct smbXsrv_connection *conn,
1341                                      struct smbXsrv_channel_global0 **_c)
1342 {
1343         struct smbXsrv_session_global0 *global = session->global;
1344         struct smbXsrv_channel_global0 *c = NULL;
1345
1346         if (global->num_channels > 31) {
1347                 /*
1348                  * Windows 2012 and 2012R2 allow up to 32 channels
1349                  */
1350                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1351         }
1352
1353         c = talloc_realloc(global,
1354                            global->channels,
1355                            struct smbXsrv_channel_global0,
1356                            global->num_channels + 1);
1357         if (c == NULL) {
1358                 return NT_STATUS_NO_MEMORY;
1359         }
1360         global->channels = c;
1361
1362         c = &global->channels[global->num_channels];
1363         ZERO_STRUCTP(c);
1364
1365         c->server_id = messaging_server_id(conn->client->msg_ctx);
1366         c->local_address = tsocket_address_string(conn->local_address,
1367                                                   global->channels);
1368         if (c->local_address == NULL) {
1369                 return NT_STATUS_NO_MEMORY;
1370         }
1371         c->remote_address = tsocket_address_string(conn->remote_address,
1372                                                    global->channels);
1373         if (c->remote_address == NULL) {
1374                 return NT_STATUS_NO_MEMORY;
1375         }
1376         c->remote_name = talloc_strdup(global->channels,
1377                                        conn->remote_hostname);
1378         if (c->remote_name == NULL) {
1379                 return NT_STATUS_NO_MEMORY;
1380         }
1381         c->connection = conn;
1382
1383         global->num_channels += 1;
1384
1385         *_c = c;
1386         return NT_STATUS_OK;
1387 }
1388
1389 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1390 {
1391         struct smbXsrv_session_table *table = session->table;
1392         NTSTATUS status;
1393
1394         if (session->global->db_rec != NULL) {
1395                 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1396                           "Called with db_rec != NULL'\n",
1397                           session->global->session_global_id));
1398                 return NT_STATUS_INTERNAL_ERROR;
1399         }
1400
1401         session->global->db_rec = smbXsrv_session_global_fetch_locked(
1402                                         table->global.db_ctx,
1403                                         session->global->session_global_id,
1404                                         session->global /* TALLOC_CTX */);
1405         if (session->global->db_rec == NULL) {
1406                 return NT_STATUS_INTERNAL_DB_ERROR;
1407         }
1408
1409         status = smbXsrv_session_global_store(session->global);
1410         if (!NT_STATUS_IS_OK(status)) {
1411                 DEBUG(0,("smbXsrv_session_update: "
1412                          "global_id (0x%08x) store failed - %s\n",
1413                          session->global->session_global_id,
1414                          nt_errstr(status)));
1415                 return status;
1416         }
1417
1418         if (DEBUGLVL(10)) {
1419                 struct smbXsrv_sessionB session_blob;
1420
1421                 ZERO_STRUCT(session_blob);
1422                 session_blob.version = SMBXSRV_VERSION_0;
1423                 session_blob.info.info0 = session;
1424
1425                 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1426                           session->global->session_global_id));
1427                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1428         }
1429
1430         return NT_STATUS_OK;
1431 }
1432
1433 NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1434                                       const struct smbXsrv_connection *conn,
1435                                       struct smbXsrv_channel_global0 **_c)
1436 {
1437         uint32_t i;
1438
1439         for (i=0; i < session->global->num_channels; i++) {
1440                 struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1441
1442                 if (c->connection == conn) {
1443                         *_c = c;
1444                         return NT_STATUS_OK;
1445                 }
1446         }
1447
1448         return NT_STATUS_USER_SESSION_DELETED;
1449 }
1450
1451 NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1452                                    const struct smbXsrv_connection *conn,
1453                                    NTTIME now,
1454                                    struct smbXsrv_session_auth0 **_a)
1455 {
1456         struct smbXsrv_session_auth0 *a;
1457
1458         for (a = session->pending_auth; a != NULL; a = a->next) {
1459                 if (a->connection == conn) {
1460                         if (now != 0) {
1461                                 a->idle_time = now;
1462                         }
1463                         *_a = a;
1464                         return NT_STATUS_OK;
1465                 }
1466         }
1467
1468         return NT_STATUS_USER_SESSION_DELETED;
1469 }
1470
1471 static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1472 {
1473         if (a->session == NULL) {
1474                 return 0;
1475         }
1476
1477         DLIST_REMOVE(a->session->pending_auth, a);
1478         a->session = NULL;
1479         return 0;
1480 }
1481
1482 NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1483                                      struct smbXsrv_connection *conn,
1484                                      NTTIME now,
1485                                      uint8_t in_flags,
1486                                      uint8_t in_security_mode,
1487                                      struct smbXsrv_session_auth0 **_a)
1488 {
1489         struct smbXsrv_session_auth0 *a;
1490         NTSTATUS status;
1491
1492         status = smbXsrv_session_find_auth(session, conn, 0, &a);
1493         if (NT_STATUS_IS_OK(status)) {
1494                 return NT_STATUS_INTERNAL_ERROR;
1495         }
1496
1497         a = talloc_zero(session, struct smbXsrv_session_auth0);
1498         if (a == NULL) {
1499                 return NT_STATUS_NO_MEMORY;
1500         }
1501         a->session = session;
1502         a->connection = conn;
1503         a->in_flags = in_flags;
1504         a->in_security_mode = in_security_mode;
1505         a->creation_time = now;
1506         a->idle_time = now;
1507
1508         if (conn->protocol >= PROTOCOL_SMB3_10) {
1509                 a->preauth = talloc(a, struct smbXsrv_preauth);
1510                 if (a->preauth == NULL) {
1511                         TALLOC_FREE(session);
1512                         return NT_STATUS_NO_MEMORY;
1513                 }
1514                 *a->preauth = conn->smb2.preauth;
1515         }
1516
1517         talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1518         DLIST_ADD_END(session->pending_auth, a);
1519
1520         *_a = a;
1521         return NT_STATUS_OK;
1522 }
1523
1524 struct smb2srv_session_shutdown_state {
1525         struct tevent_queue *wait_queue;
1526 };
1527
1528 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1529
1530 struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1531                                         struct tevent_context *ev,
1532                                         struct smbXsrv_session *session,
1533                                         struct smbd_smb2_request *current_req)
1534 {
1535         struct tevent_req *req;
1536         struct smb2srv_session_shutdown_state *state;
1537         struct tevent_req *subreq;
1538         struct smbXsrv_connection *xconn = NULL;
1539         size_t len = 0;
1540
1541         /*
1542          * Make sure that no new request will be able to use this session.
1543          */
1544         session->status = NT_STATUS_USER_SESSION_DELETED;
1545
1546         req = tevent_req_create(mem_ctx, &state,
1547                                 struct smb2srv_session_shutdown_state);
1548         if (req == NULL) {
1549                 return NULL;
1550         }
1551
1552         state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1553         if (tevent_req_nomem(state->wait_queue, req)) {
1554                 return tevent_req_post(req, ev);
1555         }
1556
1557         for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1558                 struct smbd_smb2_request *preq;
1559
1560                 for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1561                         if (preq == current_req) {
1562                                 /* Can't cancel current request. */
1563                                 continue;
1564                         }
1565                         if (preq->session != session) {
1566                                 /* Request on different session. */
1567                                 continue;
1568                         }
1569
1570                         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
1571                                 preq->session = NULL;
1572                                 /*
1573                                  * If we no longer have a session we can't
1574                                  * sign or encrypt replies.
1575                                  */
1576                                 preq->do_signing = false;
1577                                 preq->do_encryption = false;
1578                                 preq->preauth = NULL;
1579
1580                                 if (preq->subreq != NULL) {
1581                                         tevent_req_cancel(preq->subreq);
1582                                 }
1583                                 continue;
1584                         }
1585
1586                         /*
1587                          * Never cancel anything in a compound
1588                          * request. Way too hard to deal with
1589                          * the result.
1590                          */
1591                         if (!preq->compound_related && preq->subreq != NULL) {
1592                                 tevent_req_cancel(preq->subreq);
1593                         }
1594
1595                         /*
1596                          * Now wait until the request is finished.
1597                          *
1598                          * We don't set a callback, as we just want to block the
1599                          * wait queue and the talloc_free() of the request will
1600                          * remove the item from the wait queue.
1601                          */
1602                         subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1603                         if (tevent_req_nomem(subreq, req)) {
1604                                 return tevent_req_post(req, ev);
1605                         }
1606                 }
1607         }
1608
1609         len = tevent_queue_length(state->wait_queue);
1610         if (len == 0) {
1611                 tevent_req_done(req);
1612                 return tevent_req_post(req, ev);
1613         }
1614
1615         /*
1616          * Now we add our own waiter to the end of the queue,
1617          * this way we get notified when all pending requests are finished
1618          * and send to the socket.
1619          */
1620         subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1621         if (tevent_req_nomem(subreq, req)) {
1622                 return tevent_req_post(req, ev);
1623         }
1624         tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1625
1626         return req;
1627 }
1628
1629 static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1630 {
1631         struct tevent_req *req =
1632                 tevent_req_callback_data(subreq,
1633                 struct tevent_req);
1634
1635         tevent_queue_wait_recv(subreq);
1636         TALLOC_FREE(subreq);
1637
1638         tevent_req_done(req);
1639 }
1640
1641 NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1642 {
1643         return tevent_req_simple_recv_ntstatus(req);
1644 }
1645
1646 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1647 {
1648         struct smbXsrv_session_table *table;
1649         struct db_record *local_rec = NULL;
1650         struct db_record *global_rec = NULL;
1651         struct smbd_server_connection *sconn = NULL;
1652         NTSTATUS status;
1653         NTSTATUS error = NT_STATUS_OK;
1654
1655         if (session->table == NULL) {
1656                 return NT_STATUS_OK;
1657         }
1658
1659         table = session->table;
1660         session->table = NULL;
1661
1662         sconn = session->client->sconn;
1663         session->client = NULL;
1664         session->status = NT_STATUS_USER_SESSION_DELETED;
1665
1666         if (session->compat) {
1667                 /*
1668                  * For SMB2 this is a bit redundant as files are also close
1669                  * below via smb2srv_tcon_disconnect_all() -> ... ->
1670                  * smbXsrv_tcon_disconnect() -> close_cnum() ->
1671                  * file_close_conn().
1672                  */
1673                 file_close_user(sconn, session->compat->vuid);
1674         }
1675
1676         if (session->tcon_table != NULL) {
1677                 /*
1678                  * Note: We only have a tcon_table for SMB2.
1679                  */
1680                 status = smb2srv_tcon_disconnect_all(session);
1681                 if (!NT_STATUS_IS_OK(status)) {
1682                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1683                                   "smb2srv_tcon_disconnect_all() failed: %s\n",
1684                                   session->global->session_global_id,
1685                                   nt_errstr(status)));
1686                         error = status;
1687                 }
1688         }
1689
1690         if (session->compat) {
1691                 invalidate_vuid(sconn, session->compat->vuid);
1692                 session->compat = NULL;
1693         }
1694
1695         global_rec = session->global->db_rec;
1696         session->global->db_rec = NULL;
1697         if (global_rec == NULL) {
1698                 global_rec = smbXsrv_session_global_fetch_locked(
1699                                         table->global.db_ctx,
1700                                         session->global->session_global_id,
1701                                         session->global /* TALLOC_CTX */);
1702                 if (global_rec == NULL) {
1703                         error = NT_STATUS_INTERNAL_ERROR;
1704                 }
1705         }
1706
1707         if (global_rec != NULL) {
1708                 status = dbwrap_record_delete(global_rec);
1709                 if (!NT_STATUS_IS_OK(status)) {
1710                         TDB_DATA key = dbwrap_record_get_key(global_rec);
1711
1712                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1713                                   "failed to delete global key '%s': %s\n",
1714                                   session->global->session_global_id,
1715                                   hex_encode_talloc(global_rec, key.dptr,
1716                                                     key.dsize),
1717                                   nt_errstr(status)));
1718                         error = status;
1719                 }
1720         }
1721         TALLOC_FREE(global_rec);
1722
1723         local_rec = session->db_rec;
1724         if (local_rec == NULL) {
1725                 local_rec = smbXsrv_session_local_fetch_locked(
1726                                                 table->local.db_ctx,
1727                                                 session->local_id,
1728                                                 session /* TALLOC_CTX */);
1729                 if (local_rec == NULL) {
1730                         error = NT_STATUS_INTERNAL_ERROR;
1731                 }
1732         }
1733
1734         if (local_rec != NULL) {
1735                 status = dbwrap_record_delete(local_rec);
1736                 if (!NT_STATUS_IS_OK(status)) {
1737                         TDB_DATA key = dbwrap_record_get_key(local_rec);
1738
1739                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1740                                   "failed to delete local key '%s': %s\n",
1741                                   session->global->session_global_id,
1742                                   hex_encode_talloc(local_rec, key.dptr,
1743                                                     key.dsize),
1744                                   nt_errstr(status)));
1745                         error = status;
1746                 }
1747                 table->local.num_sessions -= 1;
1748         }
1749         if (session->db_rec == NULL) {
1750                 TALLOC_FREE(local_rec);
1751         }
1752         session->db_rec = NULL;
1753
1754         return error;
1755 }
1756
1757 struct smbXsrv_session_logoff_all_state {
1758         NTSTATUS first_status;
1759         int errors;
1760 };
1761
1762 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1763                                                void *private_data);
1764
1765 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_client *client)
1766 {
1767         struct smbXsrv_session_table *table = client->session_table;
1768         struct smbXsrv_session_logoff_all_state state;
1769         NTSTATUS status;
1770         int count = 0;
1771
1772         if (table == NULL) {
1773                 DEBUG(10, ("smbXsrv_session_logoff_all: "
1774                            "empty session_table, nothing to do.\n"));
1775                 return NT_STATUS_OK;
1776         }
1777
1778         ZERO_STRUCT(state);
1779
1780         status = dbwrap_traverse(table->local.db_ctx,
1781                                  smbXsrv_session_logoff_all_callback,
1782                                  &state, &count);
1783         if (!NT_STATUS_IS_OK(status)) {
1784                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1785                           "dbwrap_traverse() failed: %s\n",
1786                           nt_errstr(status)));
1787                 return status;
1788         }
1789
1790         if (!NT_STATUS_IS_OK(state.first_status)) {
1791                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1792                           "count[%d] errors[%d] first[%s]\n",
1793                           count, state.errors,
1794                           nt_errstr(state.first_status)));
1795                 return state.first_status;
1796         }
1797
1798         return NT_STATUS_OK;
1799 }
1800
1801 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1802                                                void *private_data)
1803 {
1804         struct smbXsrv_session_logoff_all_state *state =
1805                 (struct smbXsrv_session_logoff_all_state *)private_data;
1806         TDB_DATA val;
1807         void *ptr = NULL;
1808         struct smbXsrv_session *session = NULL;
1809         NTSTATUS status;
1810
1811         val = dbwrap_record_get_value(local_rec);
1812         if (val.dsize != sizeof(ptr)) {
1813                 status = NT_STATUS_INTERNAL_ERROR;
1814                 if (NT_STATUS_IS_OK(state->first_status)) {
1815                         state->first_status = status;
1816                 }
1817                 state->errors++;
1818                 return 0;
1819         }
1820
1821         memcpy(&ptr, val.dptr, val.dsize);
1822         session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1823
1824         session->db_rec = local_rec;
1825
1826         status = smbXsrv_session_clear_and_logoff(session);
1827         if (!NT_STATUS_IS_OK(status)) {
1828                 if (NT_STATUS_IS_OK(state->first_status)) {
1829                         state->first_status = status;
1830                 }
1831                 state->errors++;
1832                 return 0;
1833         }
1834
1835         return 0;
1836 }
1837
1838 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
1839 {
1840         /*
1841          * Allow a range from 1..65534 with 65534 values.
1842          */
1843         return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
1844                                           UINT16_MAX - 1);
1845 }
1846
1847 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
1848                                 uint16_t vuid, NTTIME now,
1849                                 struct smbXsrv_session **session)
1850 {
1851         struct smbXsrv_session_table *table = conn->client->session_table;
1852         uint32_t local_id = vuid;
1853
1854         return smbXsrv_session_local_lookup(table, conn, local_id, now,
1855                                             session);
1856 }
1857
1858 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
1859 {
1860         /*
1861          * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
1862          */
1863         return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
1864                                           UINT16_MAX - 1);
1865 }
1866
1867 static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
1868                                            /* conn: optional */
1869                                            struct smbXsrv_connection *conn,
1870                                            uint64_t session_id, NTTIME now,
1871                                            struct smbXsrv_session **session)
1872 {
1873         uint32_t local_id = session_id & UINT32_MAX;
1874         uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
1875
1876         if (local_zeros != 0) {
1877                 return NT_STATUS_USER_SESSION_DELETED;
1878         }
1879
1880         return smbXsrv_session_local_lookup(table, conn, local_id, now,
1881                                             session);
1882 }
1883
1884 NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
1885                                      uint64_t session_id, NTTIME now,
1886                                      struct smbXsrv_session **session)
1887 {
1888         struct smbXsrv_session_table *table = conn->client->session_table;
1889         return smb2srv_session_lookup_raw(table, conn, session_id, now,
1890                                           session);
1891 }
1892
1893 NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
1894                                        uint64_t session_id, NTTIME now,
1895                                        struct smbXsrv_session **session)
1896 {
1897         struct smbXsrv_session_table *table = client->session_table;
1898         return smb2srv_session_lookup_raw(table, NULL, session_id, now,
1899                                           session);
1900 }
1901
1902 struct smbXsrv_session_global_traverse_state {
1903         int (*fn)(struct smbXsrv_session_global0 *, void *);
1904         void *private_data;
1905 };
1906
1907 static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
1908 {
1909         int ret = -1;
1910         struct smbXsrv_session_global_traverse_state *state =
1911                 (struct smbXsrv_session_global_traverse_state*)data;
1912         TDB_DATA key = dbwrap_record_get_key(rec);
1913         TDB_DATA val = dbwrap_record_get_value(rec);
1914         DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
1915         struct smbXsrv_session_globalB global_blob;
1916         enum ndr_err_code ndr_err;
1917         TALLOC_CTX *frame = talloc_stackframe();
1918
1919         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
1920                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
1921         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1922                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1923                          "key '%s' ndr_pull_struct_blob - %s\n",
1924                          hex_encode_talloc(frame, key.dptr, key.dsize),
1925                          ndr_errstr(ndr_err)));
1926                 goto done;
1927         }
1928
1929         if (global_blob.version != SMBXSRV_VERSION_0) {
1930                 DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
1931                          "key '%s' unsupported version - %d\n",
1932                          hex_encode_talloc(frame, key.dptr, key.dsize),
1933                          (int)global_blob.version));
1934                 goto done;
1935         }
1936
1937         global_blob.info.info0->db_rec = rec;
1938         ret = state->fn(global_blob.info.info0, state->private_data);
1939 done:
1940         TALLOC_FREE(frame);
1941         return ret;
1942 }
1943
1944 NTSTATUS smbXsrv_session_global_traverse(
1945                         int (*fn)(struct smbXsrv_session_global0 *, void *),
1946                         void *private_data)
1947 {
1948
1949         NTSTATUS status;
1950         int count = 0;
1951         struct smbXsrv_session_global_traverse_state state = {
1952                 .fn = fn,
1953                 .private_data = private_data,
1954         };
1955
1956         become_root();
1957         status = smbXsrv_session_global_init(NULL);
1958         if (!NT_STATUS_IS_OK(status)) {
1959                 unbecome_root();
1960                 DEBUG(0, ("Failed to initialize session_global: %s\n",
1961                           nt_errstr(status)));
1962                 return status;
1963         }
1964
1965         status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
1966                                       smbXsrv_session_global_traverse_fn,
1967                                       &state,
1968                                       &count);
1969         unbecome_root();
1970
1971         return status;
1972 }